1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 /*
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  */
  27 
  28 /*
  29  * VM - Hardware Address Translation management for Spitfire MMU.
  30  *
  31  * This file implements the machine specific hardware translation
  32  * needed by the VM system.  The machine independent interface is
  33  * described in <vm/hat.h> while the machine dependent interface
  34  * and data structures are described in <vm/hat_sfmmu.h>.
  35  *
  36  * The hat layer manages the address translation hardware as a cache
  37  * driven by calls from the higher levels in the VM system.
  38  */
  39 
  40 #include <sys/types.h>
  41 #include <sys/kstat.h>
  42 #include <vm/hat.h>
  43 #include <vm/hat_sfmmu.h>
  44 #include <vm/page.h>
  45 #include <sys/pte.h>
  46 #include <sys/systm.h>
  47 #include <sys/mman.h>
  48 #include <sys/sysmacros.h>
  49 #include <sys/machparam.h>
  50 #include <sys/vtrace.h>
  51 #include <sys/kmem.h>
  52 #include <sys/mmu.h>
  53 #include <sys/cmn_err.h>
  54 #include <sys/cpu.h>
  55 #include <sys/cpuvar.h>
  56 #include <sys/debug.h>
  57 #include <sys/lgrp.h>
  58 #include <sys/archsystm.h>
  59 #include <sys/machsystm.h>
  60 #include <sys/vmsystm.h>
  61 #include <vm/as.h>
  62 #include <vm/seg.h>
  63 #include <vm/seg_kp.h>
  64 #include <vm/seg_kmem.h>
  65 #include <vm/seg_kpm.h>
  66 #include <vm/rm.h>
  67 #include <sys/t_lock.h>
  68 #include <sys/obpdefs.h>
  69 #include <sys/vm_machparam.h>
  70 #include <sys/var.h>
  71 #include <sys/trap.h>
  72 #include <sys/machtrap.h>
  73 #include <sys/scb.h>
  74 #include <sys/bitmap.h>
  75 #include <sys/machlock.h>
  76 #include <sys/membar.h>
  77 #include <sys/atomic.h>
  78 #include <sys/cpu_module.h>
  79 #include <sys/prom_debug.h>
  80 #include <sys/ksynch.h>
  81 #include <sys/mem_config.h>
  82 #include <sys/mem_cage.h>
  83 #include <vm/vm_dep.h>
  84 #include <vm/xhat_sfmmu.h>
  85 #include <sys/fpu/fpusystm.h>
  86 #include <vm/mach_kpm.h>
  87 #include <sys/callb.h>
  88 
  89 #ifdef  DEBUG
  90 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)                     \
  91         if (SFMMU_IS_SHMERID_VALID(rid)) {                              \
  92                 caddr_t _eaddr = (saddr) + (len);                       \
  93                 sf_srd_t *_srdp;                                        \
  94                 sf_region_t *_rgnp;                                     \
  95                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                       \
  96                 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid));       \
  97                 ASSERT((hat) != ksfmmup);                               \
  98                 _srdp = (hat)->sfmmu_srdp;                           \
  99                 ASSERT(_srdp != NULL);                                  \
 100                 ASSERT(_srdp->srd_refcnt != 0);                              \
 101                 _rgnp = _srdp->srd_hmergnp[(rid)];                   \
 102                 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid);               \
 103                 ASSERT(_rgnp->rgn_refcnt != 0);                              \
 104                 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
 105                 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 106                     SFMMU_REGION_HME);                                  \
 107                 ASSERT((saddr) >= _rgnp->rgn_saddr);                      \
 108                 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 109                 ASSERT(_eaddr > _rgnp->rgn_saddr);                        \
 110                 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 111         }
 112 
 113 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)              \
 114 {                                                                        \
 115                 caddr_t _hsva;                                           \
 116                 caddr_t _heva;                                           \
 117                 caddr_t _rsva;                                           \
 118                 caddr_t _reva;                                           \
 119                 int     _ttesz = get_hblk_ttesz(hmeblkp);                \
 120                 int     _flagtte;                                        \
 121                 ASSERT((srdp)->srd_refcnt != 0);                      \
 122                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                        \
 123                 ASSERT((rgnp)->rgn_id == rid);                                \
 124                 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE));         \
 125                 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 126                     SFMMU_REGION_HME);                                   \
 127                 ASSERT(_ttesz <= (rgnp)->rgn_pgszc);                       \
 128                 _hsva = (caddr_t)get_hblk_base(hmeblkp);                 \
 129                 _heva = get_hblk_endaddr(hmeblkp);                       \
 130                 _rsva = (caddr_t)P2ALIGN(                                \
 131                     (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES);    \
 132                 _reva = (caddr_t)P2ROUNDUP(                              \
 133                     (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size),     \
 134                     HBLK_MIN_BYTES);                                     \
 135                 ASSERT(_hsva >= _rsva);                                       \
 136                 ASSERT(_hsva < _reva);                                        \
 137                 ASSERT(_heva > _rsva);                                        \
 138                 ASSERT(_heva <= _reva);                                       \
 139                 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ :  \
 140                         _ttesz;                                          \
 141                 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte));             \
 142 }
 143 
 144 #else /* DEBUG */
 145 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
 146 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
 147 #endif /* DEBUG */
 148 
 149 #if defined(SF_ERRATA_57)
 150 extern caddr_t errata57_limit;
 151 #endif
 152 
 153 #define HME8BLK_SZ_RND          ((roundup(HME8BLK_SZ, sizeof (int64_t))) /  \
 154                                 (sizeof (int64_t)))
 155 #define HBLK_RESERVE            ((struct hme_blk *)hblk_reserve)
 156 
 157 #define HBLK_RESERVE_CNT        128
 158 #define HBLK_RESERVE_MIN        20
 159 
 160 static struct hme_blk           *freehblkp;
 161 static kmutex_t                 freehblkp_lock;
 162 static int                      freehblkcnt;
 163 
 164 static int64_t                  hblk_reserve[HME8BLK_SZ_RND];
 165 static kmutex_t                 hblk_reserve_lock;
 166 static kthread_t                *hblk_reserve_thread;
 167 
 168 static nucleus_hblk8_info_t     nucleus_hblk8;
 169 static nucleus_hblk1_info_t     nucleus_hblk1;
 170 
 171 /*
 172  * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
 173  * after the initial phase of removing an hmeblk from the hash chain, see
 174  * the detailed comment in sfmmu_hblk_hash_rm() for further details.
 175  */
 176 static cpu_hme_pend_t           *cpu_hme_pend;
 177 static uint_t                   cpu_hme_pend_thresh;
 178 /*
 179  * SFMMU specific hat functions
 180  */
 181 void    hat_pagecachectl(struct page *, int);
 182 
 183 /* flags for hat_pagecachectl */
 184 #define HAT_CACHE       0x1
 185 #define HAT_UNCACHE     0x2
 186 #define HAT_TMPNC       0x4
 187 
 188 /*
 189  * Flag to allow the creation of non-cacheable translations
 190  * to system memory. It is off by default. At the moment this
 191  * flag is used by the ecache error injector. The error injector
 192  * will turn it on when creating such a translation then shut it
 193  * off when it's finished.
 194  */
 195 
 196 int     sfmmu_allow_nc_trans = 0;
 197 
 198 /*
 199  * Flag to disable large page support.
 200  *      value of 1 => disable all large pages.
 201  *      bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
 202  *
 203  * For example, use the value 0x4 to disable 512K pages.
 204  *
 205  */
 206 #define LARGE_PAGES_OFF         0x1
 207 
 208 /*
 209  * The disable_large_pages and disable_ism_large_pages variables control
 210  * hat_memload_array and the page sizes to be used by ISM and the kernel.
 211  *
 212  * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
 213  * are only used to control which OOB pages to use at upper VM segment creation
 214  * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
 215  * Their values may come from platform or CPU specific code to disable page
 216  * sizes that should not be used.
 217  *
 218  * WARNING: 512K pages are currently not supported for ISM/DISM.
 219  */
 220 uint_t  disable_large_pages = 0;
 221 uint_t  disable_ism_large_pages = (1 << TTE512K);
 222 uint_t  disable_auto_data_large_pages = 0;
 223 uint_t  disable_auto_text_large_pages = 0;
 224 
 225 /*
 226  * Private sfmmu data structures for hat management
 227  */
 228 static struct kmem_cache *sfmmuid_cache;
 229 static struct kmem_cache *mmuctxdom_cache;
 230 
 231 /*
 232  * Private sfmmu data structures for tsb management
 233  */
 234 static struct kmem_cache *sfmmu_tsbinfo_cache;
 235 static struct kmem_cache *sfmmu_tsb8k_cache;
 236 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
 237 static vmem_t *kmem_bigtsb_arena;
 238 static vmem_t *kmem_tsb_arena;
 239 
 240 /*
 241  * sfmmu static variables for hmeblk resource management.
 242  */
 243 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
 244 static struct kmem_cache *sfmmu8_cache;
 245 static struct kmem_cache *sfmmu1_cache;
 246 static struct kmem_cache *pa_hment_cache;
 247 
 248 static kmutex_t         ism_mlist_lock; /* mutex for ism mapping list */
 249 /*
 250  * private data for ism
 251  */
 252 static struct kmem_cache *ism_blk_cache;
 253 static struct kmem_cache *ism_ment_cache;
 254 #define ISMID_STARTADDR NULL
 255 
 256 /*
 257  * Region management data structures and function declarations.
 258  */
 259 
 260 static void     sfmmu_leave_srd(sfmmu_t *);
 261 static int      sfmmu_srdcache_constructor(void *, void *, int);
 262 static void     sfmmu_srdcache_destructor(void *, void *);
 263 static int      sfmmu_rgncache_constructor(void *, void *, int);
 264 static void     sfmmu_rgncache_destructor(void *, void *);
 265 static int      sfrgnmap_isnull(sf_region_map_t *);
 266 static int      sfhmergnmap_isnull(sf_hmeregion_map_t *);
 267 static int      sfmmu_scdcache_constructor(void *, void *, int);
 268 static void     sfmmu_scdcache_destructor(void *, void *);
 269 static void     sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
 270     size_t, void *, u_offset_t);
 271 
 272 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
 273 static sf_srd_bucket_t *srd_buckets;
 274 static struct kmem_cache *srd_cache;
 275 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
 276 static struct kmem_cache *region_cache;
 277 static struct kmem_cache *scd_cache;
 278 
 279 #ifdef sun4v
 280 int use_bigtsb_arena = 1;
 281 #else
 282 int use_bigtsb_arena = 0;
 283 #endif
 284 
 285 /* External /etc/system tunable, for turning on&off the shctx support */
 286 int disable_shctx = 0;
 287 /* Internal variable, set by MD if the HW supports shctx feature */
 288 int shctx_on = 0;
 289 
 290 #ifdef DEBUG
 291 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
 292 #endif
 293 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
 294 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
 295 
 296 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
 297 static void sfmmu_find_scd(sfmmu_t *);
 298 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
 299 static void sfmmu_finish_join_scd(sfmmu_t *);
 300 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
 301 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
 302 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
 303 static void sfmmu_free_scd_tsbs(sfmmu_t *);
 304 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
 305 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
 306 static void sfmmu_ism_hatflags(sfmmu_t *, int);
 307 static int sfmmu_srd_lock_held(sf_srd_t *);
 308 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
 309 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
 310 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
 311 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
 312 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
 313 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
 314 
 315 /*
 316  * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
 317  * HAT flags, synchronizing TLB/TSB coherency, and context management.
 318  * The lock is hashed on the sfmmup since the case where we need to lock
 319  * all processes is rare but does occur (e.g. we need to unload a shared
 320  * mapping from all processes using the mapping).  We have a lot of buckets,
 321  * and each slab of sfmmu_t's can use about a quarter of them, giving us
 322  * a fairly good distribution without wasting too much space and overhead
 323  * when we have to grab them all.
 324  */
 325 #define SFMMU_NUM_LOCK  128             /* must be power of two */
 326 hatlock_t       hat_lock[SFMMU_NUM_LOCK];
 327 
 328 /*
 329  * Hash algorithm optimized for a small number of slabs.
 330  *  7 is (highbit((sizeof sfmmu_t)) - 1)
 331  * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
 332  * kmem_cache, and thus they will be sequential within that cache.  In
 333  * addition, each new slab will have a different "color" up to cache_maxcolor
 334  * which will skew the hashing for each successive slab which is allocated.
 335  * If the size of sfmmu_t changed to a larger size, this algorithm may need
 336  * to be revisited.
 337  */
 338 #define TSB_HASH_SHIFT_BITS (7)
 339 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
 340 
 341 #ifdef DEBUG
 342 int tsb_hash_debug = 0;
 343 #define TSB_HASH(sfmmup)        \
 344         (tsb_hash_debug ? &hat_lock[0] : \
 345         &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
 346 #else   /* DEBUG */
 347 #define TSB_HASH(sfmmup)        &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
 348 #endif  /* DEBUG */
 349 
 350 
 351 /* sfmmu_replace_tsb() return codes. */
 352 typedef enum tsb_replace_rc {
 353         TSB_SUCCESS,
 354         TSB_ALLOCFAIL,
 355         TSB_LOSTRACE,
 356         TSB_ALREADY_SWAPPED,
 357         TSB_CANTGROW
 358 } tsb_replace_rc_t;
 359 
 360 /*
 361  * Flags for TSB allocation routines.
 362  */
 363 #define TSB_ALLOC       0x01
 364 #define TSB_FORCEALLOC  0x02
 365 #define TSB_GROW        0x04
 366 #define TSB_SHRINK      0x08
 367 #define TSB_SWAPIN      0x10
 368 
 369 /*
 370  * Support for HAT callbacks.
 371  */
 372 #define SFMMU_MAX_RELOC_CALLBACKS       10
 373 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
 374 static id_t sfmmu_cb_nextid = 0;
 375 static id_t sfmmu_tsb_cb_id;
 376 struct sfmmu_callback *sfmmu_cb_table;
 377 
 378 kmutex_t        kpr_mutex;
 379 kmutex_t        kpr_suspendlock;
 380 kthread_t       *kreloc_thread;
 381 
 382 /*
 383  * Enable VA->PA translation sanity checking on DEBUG kernels.
 384  * Disabled by default.  This is incompatible with some
 385  * drivers (error injector, RSM) so if it breaks you get
 386  * to keep both pieces.
 387  */
 388 int hat_check_vtop = 0;
 389 
 390 /*
 391  * Private sfmmu routines (prototypes)
 392  */
 393 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
 394 static struct   hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
 395                         struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
 396                         uint_t);
 397 static caddr_t  sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
 398                         caddr_t, demap_range_t *, uint_t);
 399 static caddr_t  sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
 400                         caddr_t, int);
 401 static void     sfmmu_hblk_free(struct hme_blk **);
 402 static void     sfmmu_hblks_list_purge(struct hme_blk **, int);
 403 static uint_t   sfmmu_get_free_hblk(struct hme_blk **, uint_t);
 404 static uint_t   sfmmu_put_free_hblk(struct hme_blk *, uint_t);
 405 static struct hme_blk *sfmmu_hblk_steal(int);
 406 static int      sfmmu_steal_this_hblk(struct hmehash_bucket *,
 407                         struct hme_blk *, uint64_t, struct hme_blk *);
 408 static caddr_t  sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
 409 
 410 static void     hat_do_memload_array(struct hat *, caddr_t, size_t,
 411                     struct page **, uint_t, uint_t, uint_t);
 412 static void     hat_do_memload(struct hat *, caddr_t, struct page *,
 413                     uint_t, uint_t, uint_t);
 414 static void     sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
 415                     uint_t, uint_t, pgcnt_t, uint_t);
 416 void            sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
 417                         uint_t);
 418 static int      sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
 419                         uint_t, uint_t);
 420 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
 421                                         caddr_t, int, uint_t);
 422 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
 423                         struct hmehash_bucket *, caddr_t, uint_t, uint_t,
 424                         uint_t);
 425 static int      sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
 426                         caddr_t, page_t **, uint_t, uint_t);
 427 static void     sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
 428 
 429 static int      sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
 430 static pfn_t    sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
 431 void            sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
 432 #ifdef VAC
 433 static void     sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
 434 static int      sfmmu_vacconflict_array(caddr_t, page_t *, int *);
 435 int     tst_tnc(page_t *pp, pgcnt_t);
 436 void    conv_tnc(page_t *pp, int);
 437 #endif
 438 
 439 static void     sfmmu_get_ctx(sfmmu_t *);
 440 static void     sfmmu_free_sfmmu(sfmmu_t *);
 441 
 442 static void     sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
 443 static void     sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
 444 
 445 cpuset_t        sfmmu_pageunload(page_t *, struct sf_hment *, int);
 446 static void     hat_pagereload(struct page *, struct page *);
 447 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
 448 #ifdef VAC
 449 void    sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
 450 static void     sfmmu_page_cache(page_t *, int, int, int);
 451 #endif
 452 
 453 cpuset_t        sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
 454     struct hme_blk *, int);
 455 static void     sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 456                         pfn_t, int, int, int, int);
 457 static void     sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 458                         pfn_t, int);
 459 static void     sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
 460 static void     sfmmu_tlb_range_demap(demap_range_t *);
 461 static void     sfmmu_invalidate_ctx(sfmmu_t *);
 462 static void     sfmmu_sync_mmustate(sfmmu_t *);
 463 
 464 static void     sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
 465 static int      sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
 466                         sfmmu_t *);
 467 static void     sfmmu_tsb_free(struct tsb_info *);
 468 static void     sfmmu_tsbinfo_free(struct tsb_info *);
 469 static int      sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
 470                         sfmmu_t *);
 471 static void     sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
 472 static void     sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
 473 static int      sfmmu_select_tsb_szc(pgcnt_t);
 474 static void     sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
 475 #define         sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
 476         sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
 477 #define         sfmmu_unload_tsb(sfmmup, vaddr, szc)    \
 478         sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
 479 static void     sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
 480 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
 481     hatlock_t *, uint_t);
 482 static void     sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
 483 
 484 #ifdef VAC
 485 void    sfmmu_cache_flush(pfn_t, int);
 486 void    sfmmu_cache_flushcolor(int, pfn_t);
 487 #endif
 488 static caddr_t  sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
 489                         caddr_t, demap_range_t *, uint_t, int);
 490 
 491 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
 492 static uint_t   sfmmu_ptov_attr(tte_t *);
 493 static caddr_t  sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
 494                         caddr_t, demap_range_t *, uint_t);
 495 static uint_t   sfmmu_vtop_prot(uint_t, uint_t *);
 496 static int      sfmmu_idcache_constructor(void *, void *, int);
 497 static void     sfmmu_idcache_destructor(void *, void *);
 498 static int      sfmmu_hblkcache_constructor(void *, void *, int);
 499 static void     sfmmu_hblkcache_destructor(void *, void *);
 500 static void     sfmmu_hblkcache_reclaim(void *);
 501 static void     sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
 502                         struct hmehash_bucket *);
 503 static void     sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
 504                         struct hme_blk *, struct hme_blk **, int);
 505 static void     sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
 506                         uint64_t);
 507 static struct hme_blk *sfmmu_check_pending_hblks(int);
 508 static void     sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
 509 static void     sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
 510 static void     sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
 511                         int, caddr_t *);
 512 static void     sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
 513 
 514 static void     sfmmu_rm_large_mappings(page_t *, int);
 515 
 516 static void     hat_lock_init(void);
 517 static void     hat_kstat_init(void);
 518 static int      sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
 519 static void     sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
 520 static  int     sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
 521 static void     sfmmu_check_page_sizes(sfmmu_t *, int);
 522 int     fnd_mapping_sz(page_t *);
 523 static void     iment_add(struct ism_ment *,  struct hat *);
 524 static void     iment_sub(struct ism_ment *, struct hat *);
 525 static pgcnt_t  ism_tsb_entries(sfmmu_t *, int szc);
 526 extern void     sfmmu_setup_tsbinfo(sfmmu_t *);
 527 extern void     sfmmu_clear_utsbinfo(void);
 528 
 529 static void             sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
 530 
 531 extern int vpm_enable;
 532 
 533 /* kpm globals */
 534 #ifdef  DEBUG
 535 /*
 536  * Enable trap level tsbmiss handling
 537  */
 538 int     kpm_tsbmtl = 1;
 539 
 540 /*
 541  * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
 542  * required TLB shootdowns in this case, so handle w/ care. Off by default.
 543  */
 544 int     kpm_tlb_flush;
 545 #endif  /* DEBUG */
 546 
 547 static void     *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
 548 
 549 #ifdef DEBUG
 550 static void     sfmmu_check_hblk_flist();
 551 #endif
 552 
 553 /*
 554  * Semi-private sfmmu data structures.  Some of them are initialize in
 555  * startup or in hat_init. Some of them are private but accessed by
 556  * assembly code or mach_sfmmu.c
 557  */
 558 struct hmehash_bucket *uhme_hash;       /* user hmeblk hash table */
 559 struct hmehash_bucket *khme_hash;       /* kernel hmeblk hash table */
 560 uint64_t        uhme_hash_pa;           /* PA of uhme_hash */
 561 uint64_t        khme_hash_pa;           /* PA of khme_hash */
 562 int             uhmehash_num;           /* # of buckets in user hash table */
 563 int             khmehash_num;           /* # of buckets in kernel hash table */
 564 
 565 uint_t          max_mmu_ctxdoms = 0;    /* max context domains in the system */
 566 mmu_ctx_t       **mmu_ctxs_tbl;         /* global array of context domains */
 567 uint64_t        mmu_saved_gnum = 0;     /* to init incoming MMUs' gnums */
 568 
 569 #define DEFAULT_NUM_CTXS_PER_MMU 8192
 570 static uint_t   nctxs = DEFAULT_NUM_CTXS_PER_MMU;
 571 
 572 int             cache;                  /* describes system cache */
 573 
 574 caddr_t         ktsb_base;              /* kernel 8k-indexed tsb base address */
 575 uint64_t        ktsb_pbase;             /* kernel 8k-indexed tsb phys address */
 576 int             ktsb_szcode;            /* kernel 8k-indexed tsb size code */
 577 int             ktsb_sz;                /* kernel 8k-indexed tsb size */
 578 
 579 caddr_t         ktsb4m_base;            /* kernel 4m-indexed tsb base address */
 580 uint64_t        ktsb4m_pbase;           /* kernel 4m-indexed tsb phys address */
 581 int             ktsb4m_szcode;          /* kernel 4m-indexed tsb size code */
 582 int             ktsb4m_sz;              /* kernel 4m-indexed tsb size */
 583 
 584 uint64_t        kpm_tsbbase;            /* kernel seg_kpm 4M TSB base address */
 585 int             kpm_tsbsz;              /* kernel seg_kpm 4M TSB size code */
 586 uint64_t        kpmsm_tsbbase;          /* kernel seg_kpm 8K TSB base address */
 587 int             kpmsm_tsbsz;            /* kernel seg_kpm 8K TSB size code */
 588 
 589 #ifndef sun4v
 590 int             utsb_dtlb_ttenum = -1;  /* index in TLB for utsb locked TTE */
 591 int             utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
 592 int             dtlb_resv_ttenum;       /* index in TLB of first reserved TTE */
 593 caddr_t         utsb_vabase;            /* reserved kernel virtual memory */
 594 caddr_t         utsb4m_vabase;          /* for trap handler TSB accesses */
 595 #endif /* sun4v */
 596 uint64_t        tsb_alloc_bytes = 0;    /* bytes allocated to TSBs */
 597 vmem_t          *kmem_tsb_default_arena[NLGRPS_MAX];    /* For dynamic TSBs */
 598 vmem_t          *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
 599 
 600 /*
 601  * Size to use for TSB slabs.  Future platforms that support page sizes
 602  * larger than 4M may wish to change these values, and provide their own
 603  * assembly macros for building and decoding the TSB base register contents.
 604  * Note disable_large_pages will override the value set here.
 605  */
 606 static  uint_t tsb_slab_ttesz = TTE4M;
 607 size_t  tsb_slab_size = MMU_PAGESIZE4M;
 608 uint_t  tsb_slab_shift = MMU_PAGESHIFT4M;
 609 /* PFN mask for TTE */
 610 size_t  tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
 611 
 612 /*
 613  * Size to use for TSB slabs.  These are used only when 256M tsb arenas
 614  * exist.
 615  */
 616 static uint_t   bigtsb_slab_ttesz = TTE256M;
 617 static size_t   bigtsb_slab_size = MMU_PAGESIZE256M;
 618 static uint_t   bigtsb_slab_shift = MMU_PAGESHIFT256M;
 619 /* 256M page alignment for 8K pfn */
 620 static size_t   bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
 621 
 622 /* largest TSB size to grow to, will be smaller on smaller memory systems */
 623 static int      tsb_max_growsize = 0;
 624 
 625 /*
 626  * Tunable parameters dealing with TSB policies.
 627  */
 628 
 629 /*
 630  * This undocumented tunable forces all 8K TSBs to be allocated from
 631  * the kernel heap rather than from the kmem_tsb_default_arena arenas.
 632  */
 633 #ifdef  DEBUG
 634 int     tsb_forceheap = 0;
 635 #endif  /* DEBUG */
 636 
 637 /*
 638  * Decide whether to use per-lgroup arenas, or one global set of
 639  * TSB arenas.  The default is not to break up per-lgroup, since
 640  * most platforms don't recognize any tangible benefit from it.
 641  */
 642 int     tsb_lgrp_affinity = 0;
 643 
 644 /*
 645  * Used for growing the TSB based on the process RSS.
 646  * tsb_rss_factor is based on the smallest TSB, and is
 647  * shifted by the TSB size to determine if we need to grow.
 648  * The default will grow the TSB if the number of TTEs for
 649  * this page size exceeds 75% of the number of TSB entries,
 650  * which should _almost_ eliminate all conflict misses
 651  * (at the expense of using up lots and lots of memory).
 652  */
 653 #define TSB_RSS_FACTOR          (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
 654 #define SFMMU_RSS_TSBSIZE(tsbszc)       (tsb_rss_factor << tsbszc)
 655 #define SELECT_TSB_SIZECODE(pgcnt) ( \
 656         (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
 657         default_tsb_size)
 658 #define TSB_OK_SHRINK() \
 659         (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
 660 #define TSB_OK_GROW()   \
 661         (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
 662 
 663 int     enable_tsb_rss_sizing = 1;
 664 int     tsb_rss_factor  = (int)TSB_RSS_FACTOR;
 665 
 666 /* which TSB size code to use for new address spaces or if rss sizing off */
 667 int default_tsb_size = TSB_8K_SZCODE;
 668 
 669 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
 670 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
 671 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT        32
 672 
 673 #ifdef DEBUG
 674 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
 675 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
 676 static int tsb_alloc_mtbf = 0;  /* fail allocation every n attempts */
 677 static int tsb_alloc_fail_mtbf = 0;
 678 static int tsb_alloc_count = 0;
 679 #endif /* DEBUG */
 680 
 681 /* if set to 1, will remap valid TTEs when growing TSB. */
 682 int tsb_remap_ttes = 1;
 683 
 684 /*
 685  * If we have more than this many mappings, allocate a second TSB.
 686  * This default is chosen because the I/D fully associative TLBs are
 687  * assumed to have at least 8 available entries. Platforms with a
 688  * larger fully-associative TLB could probably override the default.
 689  */
 690 
 691 #ifdef sun4v
 692 int tsb_sectsb_threshold = 0;
 693 #else
 694 int tsb_sectsb_threshold = 8;
 695 #endif
 696 
 697 /*
 698  * kstat data
 699  */
 700 struct sfmmu_global_stat sfmmu_global_stat;
 701 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
 702 
 703 /*
 704  * Global data
 705  */
 706 sfmmu_t         *ksfmmup;               /* kernel's hat id */
 707 
 708 #ifdef DEBUG
 709 static void     chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
 710 #endif
 711 
 712 /* sfmmu locking operations */
 713 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
 714 static int      sfmmu_mlspl_held(struct page *, int);
 715 
 716 kmutex_t *sfmmu_page_enter(page_t *);
 717 void    sfmmu_page_exit(kmutex_t *);
 718 int     sfmmu_page_spl_held(struct page *);
 719 
 720 /* sfmmu internal locking operations - accessed directly */
 721 static void     sfmmu_mlist_reloc_enter(page_t *, page_t *,
 722                                 kmutex_t **, kmutex_t **);
 723 static void     sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
 724 static hatlock_t *
 725                 sfmmu_hat_enter(sfmmu_t *);
 726 static hatlock_t *
 727                 sfmmu_hat_tryenter(sfmmu_t *);
 728 static void     sfmmu_hat_exit(hatlock_t *);
 729 static void     sfmmu_hat_lock_all(void);
 730 static void     sfmmu_hat_unlock_all(void);
 731 static void     sfmmu_ismhat_enter(sfmmu_t *, int);
 732 static void     sfmmu_ismhat_exit(sfmmu_t *, int);
 733 
 734 kpm_hlk_t       *kpmp_table;
 735 uint_t          kpmp_table_sz;  /* must be a power of 2 */
 736 uchar_t         kpmp_shift;
 737 
 738 kpm_shlk_t      *kpmp_stable;
 739 uint_t          kpmp_stable_sz; /* must be a power of 2 */
 740 
 741 /*
 742  * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
 743  * SPL_SHIFT is log2(SPL_TABLE_SIZE).
 744  */
 745 #if ((2*NCPU_P2) > 128)
 746 #define SPL_SHIFT       ((unsigned)(NCPU_LOG2 + 1))
 747 #else
 748 #define SPL_SHIFT       7U
 749 #endif
 750 #define SPL_TABLE_SIZE  (1U << SPL_SHIFT)
 751 #define SPL_MASK        (SPL_TABLE_SIZE - 1)
 752 
 753 /*
 754  * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
 755  * and by multiples of SPL_SHIFT to get as many varied bits as we can.
 756  */
 757 #define SPL_INDEX(pp) \
 758         ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
 759         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
 760         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
 761         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
 762         SPL_MASK)
 763 
 764 #define SPL_HASH(pp)    \
 765         (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
 766 
 767 static  pad_mutex_t     sfmmu_page_lock[SPL_TABLE_SIZE];
 768 
 769 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
 770 
 771 #define MML_TABLE_SIZE  SPL_TABLE_SIZE
 772 #define MLIST_HASH(pp)  (&mml_table[SPL_INDEX(pp)].pad_mutex)
 773 
 774 static pad_mutex_t      mml_table[MML_TABLE_SIZE];
 775 
 776 /*
 777  * hat_unload_callback() will group together callbacks in order
 778  * to avoid xt_sync() calls.  This is the maximum size of the group.
 779  */
 780 #define MAX_CB_ADDR     32
 781 
 782 tte_t   hw_tte;
 783 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
 784 
 785 static char     *mmu_ctx_kstat_names[] = {
 786         "mmu_ctx_tsb_exceptions",
 787         "mmu_ctx_tsb_raise_exception",
 788         "mmu_ctx_wrap_around",
 789 };
 790 
 791 /*
 792  * Wrapper for vmem_xalloc since vmem_create only allows limited
 793  * parameters for vm_source_alloc functions.  This function allows us
 794  * to specify alignment consistent with the size of the object being
 795  * allocated.
 796  */
 797 static void *
 798 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
 799 {
 800         return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
 801 }
 802 
 803 /* Common code for setting tsb_alloc_hiwater. */
 804 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages)      tsb_alloc_hiwater = \
 805                 ptob(pages) / tsb_alloc_hiwater_factor
 806 
 807 /*
 808  * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
 809  * a single TSB.  physmem is the number of physical pages so we need physmem 8K
 810  * TTEs to represent all those physical pages.  We round this up by using
 811  * 1<<highbit().  To figure out which size code to use, remember that the size
 812  * code is just an amount to shift the smallest TSB size to get the size of
 813  * this TSB.  So we subtract that size, TSB_START_SIZE, from highbit() (or
 814  * highbit() - 1) to get the size code for the smallest TSB that can represent
 815  * all of physical memory, while erring on the side of too much.
 816  *
 817  * Restrict tsb_max_growsize to make sure that:
 818  *      1) TSBs can't grow larger than the TSB slab size
 819  *      2) TSBs can't grow larger than UTSB_MAX_SZCODE.
 820  */
 821 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) {                             \
 822         int     _i, _szc, _slabszc, _tsbszc;                            \
 823                                                                         \
 824         _i = highbit(pages);                                            \
 825         if ((1 << (_i - 1)) == (pages))                                   \
 826                 _i--;           /* 2^n case, round down */              \
 827         _szc = _i - TSB_START_SIZE;                                     \
 828         _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
 829         _tsbszc = MIN(_szc, _slabszc);                                  \
 830         tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE);               \
 831 }
 832 
 833 /*
 834  * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
 835  * tsb_info which handles that TTE size.
 836  */
 837 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) {                  \
 838         (tsbinfop) = (sfmmup)->sfmmu_tsb;                            \
 839         ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) ||                \
 840             sfmmu_hat_lock_held(sfmmup));                               \
 841         if ((tte_szc) >= TTE4M)      {                                       \
 842                 ASSERT((tsbinfop) != NULL);                             \
 843                 (tsbinfop) = (tsbinfop)->tsb_next;                   \
 844         }                                                               \
 845 }
 846 
 847 /*
 848  * Macro to use to unload entries from the TSB.
 849  * It has knowledge of which page sizes get replicated in the TSB
 850  * and will call the appropriate unload routine for the appropriate size.
 851  */
 852 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat)         \
 853 {                                                                       \
 854         int ttesz = get_hblk_ttesz(hmeblkp);                            \
 855         if (ttesz == TTE8K || ttesz == TTE4M) {                         \
 856                 sfmmu_unload_tsb(sfmmup, addr, ttesz);                  \
 857         } else {                                                        \
 858                 caddr_t sva = ismhat ? addr :                           \
 859                     (caddr_t)get_hblk_base(hmeblkp);                    \
 860                 caddr_t eva = sva + get_hblk_span(hmeblkp);             \
 861                 ASSERT(addr >= sva && addr < eva);                        \
 862                 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz);        \
 863         }                                                               \
 864 }
 865 
 866 
 867 /* Update tsb_alloc_hiwater after memory is configured. */
 868 /*ARGSUSED*/
 869 static void
 870 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
 871 {
 872         /* Assumes physmem has already been updated. */
 873         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 874         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 875 }
 876 
 877 /*
 878  * Update tsb_alloc_hiwater before memory is deleted.  We'll do nothing here
 879  * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
 880  * deleted.
 881  */
 882 /*ARGSUSED*/
 883 static int
 884 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
 885 {
 886         return (0);
 887 }
 888 
 889 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
 890 /*ARGSUSED*/
 891 static void
 892 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
 893 {
 894         /*
 895          * Whether the delete was cancelled or not, just go ahead and update
 896          * tsb_alloc_hiwater and tsb_max_growsize.
 897          */
 898         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 899         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 900 }
 901 
 902 static kphysm_setup_vector_t sfmmu_update_vec = {
 903         KPHYSM_SETUP_VECTOR_VERSION,    /* version */
 904         sfmmu_update_post_add,          /* post_add */
 905         sfmmu_update_pre_del,           /* pre_del */
 906         sfmmu_update_post_del           /* post_del */
 907 };
 908 
 909 
 910 /*
 911  * HME_BLK HASH PRIMITIVES
 912  */
 913 
 914 /*
 915  * Enter a hme on the mapping list for page pp.
 916  * When large pages are more prevalent in the system we might want to
 917  * keep the mapping list in ascending order by the hment size. For now,
 918  * small pages are more frequent, so don't slow it down.
 919  */
 920 #define HME_ADD(hme, pp)                                        \
 921 {                                                               \
 922         ASSERT(sfmmu_mlist_held(pp));                           \
 923                                                                 \
 924         hme->hme_prev = NULL;                                        \
 925         hme->hme_next = pp->p_mapping;                            \
 926         hme->hme_page = pp;                                  \
 927         if (pp->p_mapping) {                                 \
 928                 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
 929                 ASSERT(pp->p_share > 0);                  \
 930         } else  {                                               \
 931                 /* EMPTY */                                     \
 932                 ASSERT(pp->p_share == 0);                    \
 933         }                                                       \
 934         pp->p_mapping = hme;                                 \
 935         pp->p_share++;                                               \
 936 }
 937 
 938 /*
 939  * Enter a hme on the mapping list for page pp.
 940  * If we are unmapping a large translation, we need to make sure that the
 941  * change is reflect in the corresponding bit of the p_index field.
 942  */
 943 #define HME_SUB(hme, pp)                                        \
 944 {                                                               \
 945         ASSERT(sfmmu_mlist_held(pp));                           \
 946         ASSERT(hme->hme_page == pp || IS_PAHME(hme));                \
 947                                                                 \
 948         if (pp->p_mapping == NULL) {                         \
 949                 panic("hme_remove - no mappings");              \
 950         }                                                       \
 951                                                                 \
 952         membar_stst();  /* ensure previous stores finish */     \
 953                                                                 \
 954         ASSERT(pp->p_share > 0);                          \
 955         pp->p_share--;                                               \
 956                                                                 \
 957         if (hme->hme_prev) {                                 \
 958                 ASSERT(pp->p_mapping != hme);                        \
 959                 ASSERT(hme->hme_prev->hme_page == pp ||           \
 960                         IS_PAHME(hme->hme_prev));            \
 961                 hme->hme_prev->hme_next = hme->hme_next;       \
 962         } else {                                                \
 963                 ASSERT(pp->p_mapping == hme);                        \
 964                 pp->p_mapping = hme->hme_next;                    \
 965                 ASSERT((pp->p_mapping == NULL) ?             \
 966                         (pp->p_share == 0) : 1);             \
 967         }                                                       \
 968                                                                 \
 969         if (hme->hme_next) {                                 \
 970                 ASSERT(hme->hme_next->hme_page == pp ||           \
 971                         IS_PAHME(hme->hme_next));            \
 972                 hme->hme_next->hme_prev = hme->hme_prev;       \
 973         }                                                       \
 974                                                                 \
 975         /* zero out the entry */                                \
 976         hme->hme_next = NULL;                                        \
 977         hme->hme_prev = NULL;                                        \
 978         hme->hme_page = NULL;                                        \
 979                                                                 \
 980         if (hme_size(hme) > TTE8K) {                         \
 981                 /* remove mappings for remainder of large pg */ \
 982                 sfmmu_rm_large_mappings(pp, hme_size(hme));     \
 983         }                                                       \
 984 }
 985 
 986 /*
 987  * This function returns the hment given the hme_blk and a vaddr.
 988  * It assumes addr has already been checked to belong to hme_blk's
 989  * range.
 990  */
 991 #define HBLKTOHME(hment, hmeblkp, addr)                                 \
 992 {                                                                       \
 993         int index;                                                      \
 994         HBLKTOHME_IDX(hment, hmeblkp, addr, index)                      \
 995 }
 996 
 997 /*
 998  * Version of HBLKTOHME that also returns the index in hmeblkp
 999  * of the hment.
1000  */
1001 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx)                        \
1002 {                                                                       \
1003         ASSERT(in_hblk_range((hmeblkp), (addr)));                       \
1004                                                                         \
1005         if (get_hblk_ttesz(hmeblkp) == TTE8K) {                         \
1006                 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1007         } else                                                          \
1008                 idx = 0;                                                \
1009                                                                         \
1010         (hment) = &(hmeblkp)->hblk_hme[idx];                             \
1011 }
1012 
1013 /*
1014  * Disable any page sizes not supported by the CPU
1015  */
1016 void
1017 hat_init_pagesizes()
1018 {
1019         int             i;
1020 
1021         mmu_exported_page_sizes = 0;
1022         for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1023 
1024                 szc_2_userszc[i] = (uint_t)-1;
1025                 userszc_2_szc[i] = (uint_t)-1;
1026 
1027                 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1028                         disable_large_pages |= (1 << i);
1029                 } else {
1030                         szc_2_userszc[i] = mmu_exported_page_sizes;
1031                         userszc_2_szc[mmu_exported_page_sizes] = i;
1032                         mmu_exported_page_sizes++;
1033                 }
1034         }
1035 
1036         disable_ism_large_pages |= disable_large_pages;
1037         disable_auto_data_large_pages = disable_large_pages;
1038         disable_auto_text_large_pages = disable_large_pages;
1039 
1040         /*
1041          * Initialize mmu-specific large page sizes.
1042          */
1043         if (&mmu_large_pages_disabled) {
1044                 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1045                 disable_ism_large_pages |=
1046                     mmu_large_pages_disabled(HAT_LOAD_SHARE);
1047                 disable_auto_data_large_pages |=
1048                     mmu_large_pages_disabled(HAT_AUTO_DATA);
1049                 disable_auto_text_large_pages |=
1050                     mmu_large_pages_disabled(HAT_AUTO_TEXT);
1051         }
1052 }
1053 
1054 /*
1055  * Initialize the hardware address translation structures.
1056  */
1057 void
1058 hat_init(void)
1059 {
1060         int             i;
1061         uint_t          sz;
1062         size_t          size;
1063 
1064         hat_lock_init();
1065         hat_kstat_init();
1066 
1067         /*
1068          * Hardware-only bits in a TTE
1069          */
1070         MAKE_TTE_MASK(&hw_tte);
1071 
1072         hat_init_pagesizes();
1073 
1074         /* Initialize the hash locks */
1075         for (i = 0; i < khmehash_num; i++) {
1076                 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1077                     MUTEX_DEFAULT, NULL);
1078                 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1079         }
1080         for (i = 0; i < uhmehash_num; i++) {
1081                 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1082                     MUTEX_DEFAULT, NULL);
1083                 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1084         }
1085         khmehash_num--;         /* make sure counter starts from 0 */
1086         uhmehash_num--;         /* make sure counter starts from 0 */
1087 
1088         /*
1089          * Allocate context domain structures.
1090          *
1091          * A platform may choose to modify max_mmu_ctxdoms in
1092          * set_platform_defaults(). If a platform does not define
1093          * a set_platform_defaults() or does not choose to modify
1094          * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1095          *
1096          * For all platforms that have CPUs sharing MMUs, this
1097          * value must be defined.
1098          */
1099         if (max_mmu_ctxdoms == 0)
1100                 max_mmu_ctxdoms = max_ncpus;
1101 
1102         size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1103         mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1104 
1105         /* mmu_ctx_t is 64 bytes aligned */
1106         mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1107             sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1108         /*
1109          * MMU context domain initialization for the Boot CPU.
1110          * This needs the context domains array allocated above.
1111          */
1112         mutex_enter(&cpu_lock);
1113         sfmmu_cpu_init(CPU);
1114         mutex_exit(&cpu_lock);
1115 
1116         /*
1117          * Intialize ism mapping list lock.
1118          */
1119 
1120         mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1121 
1122         /*
1123          * Each sfmmu structure carries an array of MMU context info
1124          * structures, one per context domain. The size of this array depends
1125          * on the maximum number of context domains. So, the size of the
1126          * sfmmu structure varies per platform.
1127          *
1128          * sfmmu is allocated from static arena, because trap
1129          * handler at TL > 0 is not allowed to touch kernel relocatable
1130          * memory. sfmmu's alignment is changed to 64 bytes from
1131          * default 8 bytes, as the lower 6 bits will be used to pass
1132          * pgcnt to vtag_flush_pgcnt_tl1.
1133          */
1134         size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1135 
1136         sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1137             64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1138             NULL, NULL, static_arena, 0);
1139 
1140         sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1141             sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1142 
1143         /*
1144          * Since we only use the tsb8k cache to "borrow" pages for TSBs
1145          * from the heap when low on memory or when TSB_FORCEALLOC is
1146          * specified, don't use magazines to cache them--we want to return
1147          * them to the system as quickly as possible.
1148          */
1149         sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1150             MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1151             static_arena, KMC_NOMAGAZINE);
1152 
1153         /*
1154          * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1155          * memory, which corresponds to the old static reserve for TSBs.
1156          * tsb_alloc_hiwater_factor defaults to 32.  This caps the amount of
1157          * memory we'll allocate for TSB slabs; beyond this point TSB
1158          * allocations will be taken from the kernel heap (via
1159          * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1160          * consumer.
1161          */
1162         if (tsb_alloc_hiwater_factor == 0) {
1163                 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1164         }
1165         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1166 
1167         for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1168                 if (!(disable_large_pages & (1 << sz)))
1169                         break;
1170         }
1171 
1172         if (sz < tsb_slab_ttesz) {
1173                 tsb_slab_ttesz = sz;
1174                 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1175                 tsb_slab_size = 1 << tsb_slab_shift;
1176                 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1177                 use_bigtsb_arena = 0;
1178         } else if (use_bigtsb_arena &&
1179             (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1180                 use_bigtsb_arena = 0;
1181         }
1182 
1183         if (!use_bigtsb_arena) {
1184                 bigtsb_slab_shift = tsb_slab_shift;
1185         }
1186         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1187 
1188         /*
1189          * On smaller memory systems, allocate TSB memory in smaller chunks
1190          * than the default 4M slab size. We also honor disable_large_pages
1191          * here.
1192          *
1193          * The trap handlers need to be patched with the final slab shift,
1194          * since they need to be able to construct the TSB pointer at runtime.
1195          */
1196         if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1197             !(disable_large_pages & (1 << TTE512K))) {
1198                 tsb_slab_ttesz = TTE512K;
1199                 tsb_slab_shift = MMU_PAGESHIFT512K;
1200                 tsb_slab_size = MMU_PAGESIZE512K;
1201                 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1202                 use_bigtsb_arena = 0;
1203         }
1204 
1205         if (!use_bigtsb_arena) {
1206                 bigtsb_slab_ttesz = tsb_slab_ttesz;
1207                 bigtsb_slab_shift = tsb_slab_shift;
1208                 bigtsb_slab_size = tsb_slab_size;
1209                 bigtsb_slab_mask = tsb_slab_mask;
1210         }
1211 
1212 
1213         /*
1214          * Set up memory callback to update tsb_alloc_hiwater and
1215          * tsb_max_growsize.
1216          */
1217         i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1218         ASSERT(i == 0);
1219 
1220         /*
1221          * kmem_tsb_arena is the source from which large TSB slabs are
1222          * drawn.  The quantum of this arena corresponds to the largest
1223          * TSB size we can dynamically allocate for user processes.
1224          * Currently it must also be a supported page size since we
1225          * use exactly one translation entry to map each slab page.
1226          *
1227          * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1228          * which most TSBs are allocated.  Since most TSB allocations are
1229          * typically 8K we have a kmem cache we stack on top of each
1230          * kmem_tsb_default_arena to speed up those allocations.
1231          *
1232          * Note the two-level scheme of arenas is required only
1233          * because vmem_create doesn't allow us to specify alignment
1234          * requirements.  If this ever changes the code could be
1235          * simplified to use only one level of arenas.
1236          *
1237          * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1238          * will be provided in addition to the 4M kmem_tsb_arena.
1239          */
1240         if (use_bigtsb_arena) {
1241                 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1242                     bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1243                     vmem_xfree, heap_arena, 0, VM_SLEEP);
1244         }
1245 
1246         kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1247             sfmmu_vmem_xalloc_aligned_wrapper,
1248             vmem_xfree, heap_arena, 0, VM_SLEEP);
1249 
1250         if (tsb_lgrp_affinity) {
1251                 char s[50];
1252                 for (i = 0; i < NLGRPS_MAX; i++) {
1253                         if (use_bigtsb_arena) {
1254                                 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1255                                 kmem_bigtsb_default_arena[i] = vmem_create(s,
1256                                     NULL, 0, 2 * tsb_slab_size,
1257                                     sfmmu_tsb_segkmem_alloc,
1258                                     sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1259                                     0, VM_SLEEP | VM_BESTFIT);
1260                         }
1261 
1262                         (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1263                         kmem_tsb_default_arena[i] = vmem_create(s,
1264                             NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1265                             sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1266                             VM_SLEEP | VM_BESTFIT);
1267 
1268                         (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1269                         sfmmu_tsb_cache[i] = kmem_cache_create(s,
1270                             PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1271                             kmem_tsb_default_arena[i], 0);
1272                 }
1273         } else {
1274                 if (use_bigtsb_arena) {
1275                         kmem_bigtsb_default_arena[0] =
1276                             vmem_create("kmem_bigtsb_default", NULL, 0,
1277                             2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1278                             sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1279                             VM_SLEEP | VM_BESTFIT);
1280                 }
1281 
1282                 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1283                     NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1284                     sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1285                     VM_SLEEP | VM_BESTFIT);
1286                 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1287                     PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1288                     kmem_tsb_default_arena[0], 0);
1289         }
1290 
1291         sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1292             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1293             sfmmu_hblkcache_destructor,
1294             sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1295             hat_memload_arena, KMC_NOHASH);
1296 
1297         hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1298             segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1299             VMC_DUMPSAFE | VM_SLEEP);
1300 
1301         sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1302             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1303             sfmmu_hblkcache_destructor,
1304             NULL, (void *)HME1BLK_SZ,
1305             hat_memload1_arena, KMC_NOHASH);
1306 
1307         pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1308             0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1309 
1310         ism_blk_cache = kmem_cache_create("ism_blk_cache",
1311             sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1312             NULL, NULL, static_arena, KMC_NOHASH);
1313 
1314         ism_ment_cache = kmem_cache_create("ism_ment_cache",
1315             sizeof (ism_ment_t), 0, NULL, NULL,
1316             NULL, NULL, NULL, 0);
1317 
1318         /*
1319          * We grab the first hat for the kernel,
1320          */
1321         AS_LOCK_ENTER(&kas, RW_WRITER);
1322         kas.a_hat = hat_alloc(&kas);
1323         AS_LOCK_EXIT(&kas);
1324 
1325         /*
1326          * Initialize hblk_reserve.
1327          */
1328         ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1329             va_to_pa((caddr_t)hblk_reserve);
1330 
1331 #ifndef UTSB_PHYS
1332         /*
1333          * Reserve some kernel virtual address space for the locked TTEs
1334          * that allow us to probe the TSB from TL>0.
1335          */
1336         utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1337             0, 0, NULL, NULL, VM_SLEEP);
1338         utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1339             0, 0, NULL, NULL, VM_SLEEP);
1340 #endif
1341 
1342 #ifdef VAC
1343         /*
1344          * The big page VAC handling code assumes VAC
1345          * will not be bigger than the smallest big
1346          * page- which is 64K.
1347          */
1348         if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1349                 cmn_err(CE_PANIC, "VAC too big!");
1350         }
1351 #endif
1352 
1353         (void) xhat_init();
1354 
1355         uhme_hash_pa = va_to_pa(uhme_hash);
1356         khme_hash_pa = va_to_pa(khme_hash);
1357 
1358         /*
1359          * Initialize relocation locks. kpr_suspendlock is held
1360          * at PIL_MAX to prevent interrupts from pinning the holder
1361          * of a suspended TTE which may access it leading to a
1362          * deadlock condition.
1363          */
1364         mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1365         mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1366 
1367         /*
1368          * If Shared context support is disabled via /etc/system
1369          * set shctx_on to 0 here if it was set to 1 earlier in boot
1370          * sequence by cpu module initialization code.
1371          */
1372         if (shctx_on && disable_shctx) {
1373                 shctx_on = 0;
1374         }
1375 
1376         if (shctx_on) {
1377                 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1378                     sizeof (srd_buckets[0]), KM_SLEEP);
1379                 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1380                         mutex_init(&srd_buckets[i].srdb_lock, NULL,
1381                             MUTEX_DEFAULT, NULL);
1382                 }
1383 
1384                 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1385                     0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1386                     NULL, NULL, NULL, 0);
1387                 region_cache = kmem_cache_create("region_cache",
1388                     sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1389                     sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1390                 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1391                     0, sfmmu_scdcache_constructor,  sfmmu_scdcache_destructor,
1392                     NULL, NULL, NULL, 0);
1393         }
1394 
1395         /*
1396          * Pre-allocate hrm_hashtab before enabling the collection of
1397          * refmod statistics.  Allocating on the fly would mean us
1398          * running the risk of suffering recursive mutex enters or
1399          * deadlocks.
1400          */
1401         hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1402             KM_SLEEP);
1403 
1404         /* Allocate per-cpu pending freelist of hmeblks */
1405         cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1406             KM_SLEEP);
1407         cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1408             (uintptr_t)cpu_hme_pend, 64);
1409 
1410         for (i = 0; i < NCPU; i++) {
1411                 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1412                     NULL);
1413         }
1414 
1415         if (cpu_hme_pend_thresh == 0) {
1416                 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1417         }
1418 }
1419 
1420 /*
1421  * Initialize locking for the hat layer, called early during boot.
1422  */
1423 static void
1424 hat_lock_init()
1425 {
1426         int i;
1427 
1428         /*
1429          * initialize the array of mutexes protecting a page's mapping
1430          * list and p_nrm field.
1431          */
1432         for (i = 0; i < MML_TABLE_SIZE; i++)
1433                 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1434 
1435         if (kpm_enable) {
1436                 for (i = 0; i < kpmp_table_sz; i++) {
1437                         mutex_init(&kpmp_table[i].khl_mutex, NULL,
1438                             MUTEX_DEFAULT, NULL);
1439                 }
1440         }
1441 
1442         /*
1443          * Initialize array of mutex locks that protects sfmmu fields and
1444          * TSB lists.
1445          */
1446         for (i = 0; i < SFMMU_NUM_LOCK; i++)
1447                 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1448                     NULL);
1449 }
1450 
1451 #define SFMMU_KERNEL_MAXVA \
1452         (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1453 
1454 /*
1455  * Allocate a hat structure.
1456  * Called when an address space first uses a hat.
1457  */
1458 struct hat *
1459 hat_alloc(struct as *as)
1460 {
1461         sfmmu_t *sfmmup;
1462         int i;
1463         uint64_t cnum;
1464         extern uint_t get_color_start(struct as *);
1465 
1466         ASSERT(AS_WRITE_HELD(as));
1467         sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1468         sfmmup->sfmmu_as = as;
1469         sfmmup->sfmmu_flags = 0;
1470         sfmmup->sfmmu_tteflags = 0;
1471         sfmmup->sfmmu_rtteflags = 0;
1472         LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1473 
1474         if (as == &kas) {
1475                 ksfmmup = sfmmup;
1476                 sfmmup->sfmmu_cext = 0;
1477                 cnum = KCONTEXT;
1478 
1479                 sfmmup->sfmmu_clrstart = 0;
1480                 sfmmup->sfmmu_tsb = NULL;
1481                 /*
1482                  * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1483                  * to setup tsb_info for ksfmmup.
1484                  */
1485         } else {
1486 
1487                 /*
1488                  * Just set to invalid ctx. When it faults, it will
1489                  * get a valid ctx. This would avoid the situation
1490                  * where we get a ctx, but it gets stolen and then
1491                  * we fault when we try to run and so have to get
1492                  * another ctx.
1493                  */
1494                 sfmmup->sfmmu_cext = 0;
1495                 cnum = INVALID_CONTEXT;
1496 
1497                 /* initialize original physical page coloring bin */
1498                 sfmmup->sfmmu_clrstart = get_color_start(as);
1499 #ifdef DEBUG
1500                 if (tsb_random_size) {
1501                         uint32_t randval = (uint32_t)gettick() >> 4;
1502                         int size = randval % (tsb_max_growsize + 1);
1503 
1504                         /* chose a random tsb size for stress testing */
1505                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1506                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1507                 } else
1508 #endif /* DEBUG */
1509                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1510                             default_tsb_size,
1511                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1512                 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1513                 ASSERT(sfmmup->sfmmu_tsb != NULL);
1514         }
1515 
1516         ASSERT(max_mmu_ctxdoms > 0);
1517         for (i = 0; i < max_mmu_ctxdoms; i++) {
1518                 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1519                 sfmmup->sfmmu_ctxs[i].gnum = 0;
1520         }
1521 
1522         for (i = 0; i < max_mmu_page_sizes; i++) {
1523                 sfmmup->sfmmu_ttecnt[i] = 0;
1524                 sfmmup->sfmmu_scdrttecnt[i] = 0;
1525                 sfmmup->sfmmu_ismttecnt[i] = 0;
1526                 sfmmup->sfmmu_scdismttecnt[i] = 0;
1527                 sfmmup->sfmmu_pgsz[i] = TTE8K;
1528         }
1529         sfmmup->sfmmu_tsb0_4minflcnt = 0;
1530         sfmmup->sfmmu_iblk = NULL;
1531         sfmmup->sfmmu_ismhat = 0;
1532         sfmmup->sfmmu_scdhat = 0;
1533         sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1534         if (sfmmup == ksfmmup) {
1535                 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1536         } else {
1537                 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1538         }
1539         sfmmup->sfmmu_free = 0;
1540         sfmmup->sfmmu_rmstat = 0;
1541         sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1542         sfmmup->sfmmu_xhat_provider = NULL;
1543         cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1544         sfmmup->sfmmu_srdp = NULL;
1545         SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1546         bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1547         sfmmup->sfmmu_scdp = NULL;
1548         sfmmup->sfmmu_scd_link.next = NULL;
1549         sfmmup->sfmmu_scd_link.prev = NULL;
1550         return (sfmmup);
1551 }
1552 
1553 /*
1554  * Create per-MMU context domain kstats for a given MMU ctx.
1555  */
1556 static void
1557 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1558 {
1559         mmu_ctx_stat_t  stat;
1560         kstat_t         *mmu_kstat;
1561 
1562         ASSERT(MUTEX_HELD(&cpu_lock));
1563         ASSERT(mmu_ctxp->mmu_kstat == NULL);
1564 
1565         mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1566             "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1567 
1568         if (mmu_kstat == NULL) {
1569                 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1570                     mmu_ctxp->mmu_idx);
1571         } else {
1572                 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1573                 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1574                         kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1575                             mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1576                 mmu_ctxp->mmu_kstat = mmu_kstat;
1577                 kstat_install(mmu_kstat);
1578         }
1579 }
1580 
1581 /*
1582  * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1583  * context domain information for a given CPU. If a platform does not
1584  * specify that interface, then the function below is used instead to return
1585  * default information. The defaults are as follows:
1586  *
1587  *      - The number of MMU context IDs supported on any CPU in the
1588  *        system is 8K.
1589  *      - There is one MMU context domain per CPU.
1590  */
1591 /*ARGSUSED*/
1592 static void
1593 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1594 {
1595         infop->mmu_nctxs = nctxs;
1596         infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1597 }
1598 
1599 /*
1600  * Called during CPU initialization to set the MMU context-related information
1601  * for a CPU.
1602  *
1603  * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1604  */
1605 void
1606 sfmmu_cpu_init(cpu_t *cp)
1607 {
1608         mmu_ctx_info_t  info;
1609         mmu_ctx_t       *mmu_ctxp;
1610 
1611         ASSERT(MUTEX_HELD(&cpu_lock));
1612 
1613         if (&plat_cpuid_to_mmu_ctx_info == NULL)
1614                 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1615         else
1616                 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1617 
1618         ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1619 
1620         if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1621                 /* Each mmu_ctx is cacheline aligned. */
1622                 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1623                 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1624 
1625                 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1626                     (void *)ipltospl(DISP_LEVEL));
1627                 mmu_ctxp->mmu_idx = info.mmu_idx;
1628                 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1629                 /*
1630                  * Globally for lifetime of a system,
1631                  * gnum must always increase.
1632                  * mmu_saved_gnum is protected by the cpu_lock.
1633                  */
1634                 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1635                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1636 
1637                 sfmmu_mmu_kstat_create(mmu_ctxp);
1638 
1639                 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1640         } else {
1641                 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1642                 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1643         }
1644 
1645         /*
1646          * The mmu_lock is acquired here to prevent races with
1647          * the wrap-around code.
1648          */
1649         mutex_enter(&mmu_ctxp->mmu_lock);
1650 
1651 
1652         mmu_ctxp->mmu_ncpus++;
1653         CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1654         CPU_MMU_IDX(cp) = info.mmu_idx;
1655         CPU_MMU_CTXP(cp) = mmu_ctxp;
1656 
1657         mutex_exit(&mmu_ctxp->mmu_lock);
1658 }
1659 
1660 static void
1661 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1662 {
1663         ASSERT(MUTEX_HELD(&cpu_lock));
1664         ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1665 
1666         mutex_destroy(&mmu_ctxp->mmu_lock);
1667 
1668         if (mmu_ctxp->mmu_kstat)
1669                 kstat_delete(mmu_ctxp->mmu_kstat);
1670 
1671         /* mmu_saved_gnum is protected by the cpu_lock. */
1672         if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1673                 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1674 
1675         kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1676 }
1677 
1678 /*
1679  * Called to perform MMU context-related cleanup for a CPU.
1680  */
1681 void
1682 sfmmu_cpu_cleanup(cpu_t *cp)
1683 {
1684         mmu_ctx_t       *mmu_ctxp;
1685 
1686         ASSERT(MUTEX_HELD(&cpu_lock));
1687 
1688         mmu_ctxp = CPU_MMU_CTXP(cp);
1689         ASSERT(mmu_ctxp != NULL);
1690 
1691         /*
1692          * The mmu_lock is acquired here to prevent races with
1693          * the wrap-around code.
1694          */
1695         mutex_enter(&mmu_ctxp->mmu_lock);
1696 
1697         CPU_MMU_CTXP(cp) = NULL;
1698 
1699         CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1700         if (--mmu_ctxp->mmu_ncpus == 0) {
1701                 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1702                 mutex_exit(&mmu_ctxp->mmu_lock);
1703                 sfmmu_ctxdom_free(mmu_ctxp);
1704                 return;
1705         }
1706 
1707         mutex_exit(&mmu_ctxp->mmu_lock);
1708 }
1709 
1710 uint_t
1711 sfmmu_ctxdom_nctxs(int idx)
1712 {
1713         return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1714 }
1715 
1716 #ifdef sun4v
1717 /*
1718  * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1719  * consistant after suspend/resume on system that can resume on a different
1720  * hardware than it was suspended.
1721  *
1722  * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1723  * from being allocated.  It acquires all hat_locks, which blocks most access to
1724  * context data, except for a few cases that are handled separately or are
1725  * harmless.  It wraps each domain to increment gnum and invalidate on-CPU
1726  * contexts, and forces cnum to its max.  As a result of this call all user
1727  * threads that are running on CPUs trap and try to perform wrap around but
1728  * can't because hat_locks are taken.  Threads that were not on CPUs but started
1729  * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1730  * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1731  * on hat_lock trying to wrap.  sfmmu_ctxdom_lock() must be called before CPUs
1732  * are paused, else it could deadlock acquiring locks held by paused CPUs.
1733  *
1734  * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1735  * the CPUs that had them.  It must be called after CPUs have been paused. This
1736  * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1737  * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1738  * runs with interrupts disabled.  When CPUs are later resumed, they may enter
1739  * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1740  * return failure.  Or, they will be blocked trying to acquire hat_lock. Thus
1741  * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1742  * accessing the old context domains.
1743  *
1744  * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1745  * allocates new context domains based on hardware layout.  It initializes
1746  * every CPU that had context domain before migration to have one again.
1747  * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1748  * could deadlock acquiring locks held by paused CPUs.
1749  *
1750  * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1751  * acquire new context ids and continue execution.
1752  *
1753  * Therefore functions should be called in the following order:
1754  *       suspend_routine()
1755  *              sfmmu_ctxdom_lock()
1756  *              pause_cpus()
1757  *              suspend()
1758  *                      if (suspend failed)
1759  *                              sfmmu_ctxdom_unlock()
1760  *              ...
1761  *              sfmmu_ctxdom_remove()
1762  *              resume_cpus()
1763  *              sfmmu_ctxdom_update()
1764  *              sfmmu_ctxdom_unlock()
1765  */
1766 static cpuset_t sfmmu_ctxdoms_pset;
1767 
1768 void
1769 sfmmu_ctxdoms_remove()
1770 {
1771         processorid_t   id;
1772         cpu_t           *cp;
1773 
1774         /*
1775          * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1776          * be restored post-migration. A CPU may be powered off and not have a
1777          * domain, for example.
1778          */
1779         CPUSET_ZERO(sfmmu_ctxdoms_pset);
1780 
1781         for (id = 0; id < NCPU; id++) {
1782                 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1783                         CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1784                         CPU_MMU_CTXP(cp) = NULL;
1785                 }
1786         }
1787 }
1788 
1789 void
1790 sfmmu_ctxdoms_lock(void)
1791 {
1792         int             idx;
1793         mmu_ctx_t       *mmu_ctxp;
1794 
1795         sfmmu_hat_lock_all();
1796 
1797         /*
1798          * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1799          * hat_lock is always taken before calling it.
1800          *
1801          * For each domain, set mmu_cnum to max so no more contexts can be
1802          * allocated, and wrap to flush on-CPU contexts and force threads to
1803          * acquire a new context when we later drop hat_lock after migration.
1804          * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1805          * but the latter uses CAS and will miscompare and not overwrite it.
1806          */
1807         kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1808         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1809                 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1810                         mutex_enter(&mmu_ctxp->mmu_lock);
1811                         mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1812                         /* make sure updated cnum visible */
1813                         membar_enter();
1814                         mutex_exit(&mmu_ctxp->mmu_lock);
1815                         sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1816                 }
1817         }
1818         kpreempt_enable();
1819 }
1820 
1821 void
1822 sfmmu_ctxdoms_unlock(void)
1823 {
1824         sfmmu_hat_unlock_all();
1825 }
1826 
1827 void
1828 sfmmu_ctxdoms_update(void)
1829 {
1830         processorid_t   id;
1831         cpu_t           *cp;
1832         uint_t          idx;
1833         mmu_ctx_t       *mmu_ctxp;
1834 
1835         /*
1836          * Free all context domains.  As side effect, this increases
1837          * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1838          * init gnum in the new domains, which therefore will be larger than the
1839          * sfmmu gnum for any process, guaranteeing that every process will see
1840          * a new generation and allocate a new context regardless of what new
1841          * domain it runs in.
1842          */
1843         mutex_enter(&cpu_lock);
1844 
1845         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1846                 if (mmu_ctxs_tbl[idx] != NULL) {
1847                         mmu_ctxp = mmu_ctxs_tbl[idx];
1848                         mmu_ctxs_tbl[idx] = NULL;
1849                         sfmmu_ctxdom_free(mmu_ctxp);
1850                 }
1851         }
1852 
1853         for (id = 0; id < NCPU; id++) {
1854                 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1855                     (cp = cpu[id]) != NULL)
1856                         sfmmu_cpu_init(cp);
1857         }
1858         mutex_exit(&cpu_lock);
1859 }
1860 #endif
1861 
1862 /*
1863  * Hat_setup, makes an address space context the current active one.
1864  * In sfmmu this translates to setting the secondary context with the
1865  * corresponding context.
1866  */
1867 void
1868 hat_setup(struct hat *sfmmup, int allocflag)
1869 {
1870         hatlock_t *hatlockp;
1871 
1872         /* Init needs some special treatment. */
1873         if (allocflag == HAT_INIT) {
1874                 /*
1875                  * Make sure that we have
1876                  * 1. a TSB
1877                  * 2. a valid ctx that doesn't get stolen after this point.
1878                  */
1879                 hatlockp = sfmmu_hat_enter(sfmmup);
1880 
1881                 /*
1882                  * Swap in the TSB.  hat_init() allocates tsbinfos without
1883                  * TSBs, but we need one for init, since the kernel does some
1884                  * special things to set up its stack and needs the TSB to
1885                  * resolve page faults.
1886                  */
1887                 sfmmu_tsb_swapin(sfmmup, hatlockp);
1888 
1889                 sfmmu_get_ctx(sfmmup);
1890 
1891                 sfmmu_hat_exit(hatlockp);
1892         } else {
1893                 ASSERT(allocflag == HAT_ALLOC);
1894 
1895                 hatlockp = sfmmu_hat_enter(sfmmup);
1896                 kpreempt_disable();
1897 
1898                 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1899                 /*
1900                  * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1901                  * pagesize bits don't matter in this case since we are passing
1902                  * INVALID_CONTEXT to it.
1903                  * Compatibility Note: hw takes care of MMU_SCONTEXT1
1904                  */
1905                 sfmmu_setctx_sec(INVALID_CONTEXT);
1906                 sfmmu_clear_utsbinfo();
1907 
1908                 kpreempt_enable();
1909                 sfmmu_hat_exit(hatlockp);
1910         }
1911 }
1912 
1913 /*
1914  * Free all the translation resources for the specified address space.
1915  * Called from as_free when an address space is being destroyed.
1916  */
1917 void
1918 hat_free_start(struct hat *sfmmup)
1919 {
1920         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1921         ASSERT(sfmmup != ksfmmup);
1922         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
1923 
1924         sfmmup->sfmmu_free = 1;
1925         if (sfmmup->sfmmu_scdp != NULL) {
1926                 sfmmu_leave_scd(sfmmup, 0);
1927         }
1928 
1929         ASSERT(sfmmup->sfmmu_scdp == NULL);
1930 }
1931 
1932 void
1933 hat_free_end(struct hat *sfmmup)
1934 {
1935         int i;
1936 
1937         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
1938         ASSERT(sfmmup->sfmmu_free == 1);
1939         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1940         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1941         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1942         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1943         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1944         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1945 
1946         if (sfmmup->sfmmu_rmstat) {
1947                 hat_freestat(sfmmup->sfmmu_as, NULL);
1948         }
1949 
1950         while (sfmmup->sfmmu_tsb != NULL) {
1951                 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1952                 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1953                 sfmmup->sfmmu_tsb = next;
1954         }
1955 
1956         if (sfmmup->sfmmu_srdp != NULL) {
1957                 sfmmu_leave_srd(sfmmup);
1958                 ASSERT(sfmmup->sfmmu_srdp == NULL);
1959                 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1960                         if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1961                                 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1962                                     SFMMU_L2_HMERLINKS_SIZE);
1963                                 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1964                         }
1965                 }
1966         }
1967         sfmmu_free_sfmmu(sfmmup);
1968 
1969 #ifdef DEBUG
1970         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1971                 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1972         }
1973 #endif
1974 
1975         kmem_cache_free(sfmmuid_cache, sfmmup);
1976 }
1977 
1978 /*
1979  * Set up any translation structures, for the specified address space,
1980  * that are needed or preferred when the process is being swapped in.
1981  */
1982 /* ARGSUSED */
1983 void
1984 hat_swapin(struct hat *hat)
1985 {
1986         ASSERT(hat->sfmmu_xhat_provider == NULL);
1987 }
1988 
1989 /*
1990  * Free all of the translation resources, for the specified address space,
1991  * that can be freed while the process is swapped out. Called from as_swapout.
1992  * Also, free up the ctx that this process was using.
1993  */
1994 void
1995 hat_swapout(struct hat *sfmmup)
1996 {
1997         struct hmehash_bucket *hmebp;
1998         struct hme_blk *hmeblkp;
1999         struct hme_blk *pr_hblk = NULL;
2000         struct hme_blk *nx_hblk;
2001         int i;
2002         struct hme_blk *list = NULL;
2003         hatlock_t *hatlockp;
2004         struct tsb_info *tsbinfop;
2005         struct free_tsb {
2006                 struct free_tsb *next;
2007                 struct tsb_info *tsbinfop;
2008         };                      /* free list of TSBs */
2009         struct free_tsb *freelist, *last, *next;
2010 
2011         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
2012         SFMMU_STAT(sf_swapout);
2013 
2014         /*
2015          * There is no way to go from an as to all its translations in sfmmu.
2016          * Here is one of the times when we take the big hit and traverse
2017          * the hash looking for hme_blks to free up.  Not only do we free up
2018          * this as hme_blks but all those that are free.  We are obviously
2019          * swapping because we need memory so let's free up as much
2020          * as we can.
2021          *
2022          * Note that we don't flush TLB/TSB here -- it's not necessary
2023          * because:
2024          *  1) we free the ctx we're using and throw away the TSB(s);
2025          *  2) processes aren't runnable while being swapped out.
2026          */
2027         ASSERT(sfmmup != KHATID);
2028         for (i = 0; i <= UHMEHASH_SZ; i++) {
2029                 hmebp = &uhme_hash[i];
2030                 SFMMU_HASH_LOCK(hmebp);
2031                 hmeblkp = hmebp->hmeblkp;
2032                 pr_hblk = NULL;
2033                 while (hmeblkp) {
2034 
2035                         ASSERT(!hmeblkp->hblk_xhat_bit);
2036 
2037                         if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2038                             !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2039                                 ASSERT(!hmeblkp->hblk_shared);
2040                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2041                                     (caddr_t)get_hblk_base(hmeblkp),
2042                                     get_hblk_endaddr(hmeblkp),
2043                                     NULL, HAT_UNLOAD);
2044                         }
2045                         nx_hblk = hmeblkp->hblk_next;
2046                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2047                                 ASSERT(!hmeblkp->hblk_lckcnt);
2048                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2049                                     &list, 0);
2050                         } else {
2051                                 pr_hblk = hmeblkp;
2052                         }
2053                         hmeblkp = nx_hblk;
2054                 }
2055                 SFMMU_HASH_UNLOCK(hmebp);
2056         }
2057 
2058         sfmmu_hblks_list_purge(&list, 0);
2059 
2060         /*
2061          * Now free up the ctx so that others can reuse it.
2062          */
2063         hatlockp = sfmmu_hat_enter(sfmmup);
2064 
2065         sfmmu_invalidate_ctx(sfmmup);
2066 
2067         /*
2068          * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2069          * If TSBs were never swapped in, just return.
2070          * This implies that we don't support partial swapping
2071          * of TSBs -- either all are swapped out, or none are.
2072          *
2073          * We must hold the HAT lock here to prevent racing with another
2074          * thread trying to unmap TTEs from the TSB or running the post-
2075          * relocator after relocating the TSB's memory.  Unfortunately, we
2076          * can't free memory while holding the HAT lock or we could
2077          * deadlock, so we build a list of TSBs to be freed after marking
2078          * the tsbinfos as swapped out and free them after dropping the
2079          * lock.
2080          */
2081         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2082                 sfmmu_hat_exit(hatlockp);
2083                 return;
2084         }
2085 
2086         SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2087         last = freelist = NULL;
2088         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2089             tsbinfop = tsbinfop->tsb_next) {
2090                 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2091 
2092                 /*
2093                  * Cast the TSB into a struct free_tsb and put it on the free
2094                  * list.
2095                  */
2096                 if (freelist == NULL) {
2097                         last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2098                 } else {
2099                         last->next = (struct free_tsb *)tsbinfop->tsb_va;
2100                         last = last->next;
2101                 }
2102                 last->next = NULL;
2103                 last->tsbinfop = tsbinfop;
2104                 tsbinfop->tsb_flags |= TSB_SWAPPED;
2105                 /*
2106                  * Zero out the TTE to clear the valid bit.
2107                  * Note we can't use a value like 0xbad because we want to
2108                  * ensure diagnostic bits are NEVER set on TTEs that might
2109                  * be loaded.  The intent is to catch any invalid access
2110                  * to the swapped TSB, such as a thread running with a valid
2111                  * context without first calling sfmmu_tsb_swapin() to
2112                  * allocate TSB memory.
2113                  */
2114                 tsbinfop->tsb_tte.ll = 0;
2115         }
2116 
2117         /* Now we can drop the lock and free the TSB memory. */
2118         sfmmu_hat_exit(hatlockp);
2119         for (; freelist != NULL; freelist = next) {
2120                 next = freelist->next;
2121                 sfmmu_tsb_free(freelist->tsbinfop);
2122         }
2123 }
2124 
2125 /*
2126  * Duplicate the translations of an as into another newas
2127  */
2128 /* ARGSUSED */
2129 int
2130 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2131         uint_t flag)
2132 {
2133         sf_srd_t *srdp;
2134         sf_scd_t *scdp;
2135         int i;
2136         extern uint_t get_color_start(struct as *);
2137 
2138         ASSERT(hat->sfmmu_xhat_provider == NULL);
2139         ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2140             (flag == HAT_DUP_SRD));
2141         ASSERT(hat != ksfmmup);
2142         ASSERT(newhat != ksfmmup);
2143         ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2144 
2145         if (flag == HAT_DUP_COW) {
2146                 panic("hat_dup: HAT_DUP_COW not supported");
2147         }
2148 
2149         if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2150                 ASSERT(srdp->srd_evp != NULL);
2151                 VN_HOLD(srdp->srd_evp);
2152                 ASSERT(srdp->srd_refcnt > 0);
2153                 newhat->sfmmu_srdp = srdp;
2154                 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2155         }
2156 
2157         /*
2158          * HAT_DUP_ALL flag is used after as duplication is done.
2159          */
2160         if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2161                 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2162                 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2163                 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2164                         newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2165                 }
2166 
2167                 /* check if need to join scd */
2168                 if ((scdp = hat->sfmmu_scdp) != NULL &&
2169                     newhat->sfmmu_scdp != scdp) {
2170                         int ret;
2171                         SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2172                             &scdp->scd_region_map, ret);
2173                         ASSERT(ret);
2174                         sfmmu_join_scd(scdp, newhat);
2175                         ASSERT(newhat->sfmmu_scdp == scdp &&
2176                             scdp->scd_refcnt >= 2);
2177                         for (i = 0; i < max_mmu_page_sizes; i++) {
2178                                 newhat->sfmmu_ismttecnt[i] =
2179                                     hat->sfmmu_ismttecnt[i];
2180                                 newhat->sfmmu_scdismttecnt[i] =
2181                                     hat->sfmmu_scdismttecnt[i];
2182                         }
2183                 }
2184 
2185                 sfmmu_check_page_sizes(newhat, 1);
2186         }
2187 
2188         if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2189             update_proc_pgcolorbase_after_fork != 0) {
2190                 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2191         }
2192         return (0);
2193 }
2194 
2195 void
2196 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2197         uint_t attr, uint_t flags)
2198 {
2199         hat_do_memload(hat, addr, pp, attr, flags,
2200             SFMMU_INVALID_SHMERID);
2201 }
2202 
2203 void
2204 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2205         uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2206 {
2207         uint_t rid;
2208         if (rcookie == HAT_INVALID_REGION_COOKIE ||
2209             hat->sfmmu_xhat_provider != NULL) {
2210                 hat_do_memload(hat, addr, pp, attr, flags,
2211                     SFMMU_INVALID_SHMERID);
2212                 return;
2213         }
2214         rid = (uint_t)((uint64_t)rcookie);
2215         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2216         hat_do_memload(hat, addr, pp, attr, flags, rid);
2217 }
2218 
2219 /*
2220  * Set up addr to map to page pp with protection prot.
2221  * As an optimization we also load the TSB with the
2222  * corresponding tte but it is no big deal if  the tte gets kicked out.
2223  */
2224 static void
2225 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2226         uint_t attr, uint_t flags, uint_t rid)
2227 {
2228         tte_t tte;
2229 
2230 
2231         ASSERT(hat != NULL);
2232         ASSERT(PAGE_LOCKED(pp));
2233         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2234         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2235         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2236         SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2237 
2238         if (PP_ISFREE(pp)) {
2239                 panic("hat_memload: loading a mapping to free page %p",
2240                     (void *)pp);
2241         }
2242 
2243         if (hat->sfmmu_xhat_provider) {
2244                 /* no regions for xhats */
2245                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
2246                 XHAT_MEMLOAD(hat, addr, pp, attr, flags);
2247                 return;
2248         }
2249 
2250         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2251 
2252         if (flags & ~SFMMU_LOAD_ALLFLAG)
2253                 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2254                     flags & ~SFMMU_LOAD_ALLFLAG);
2255 
2256         if (hat->sfmmu_rmstat)
2257                 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2258 
2259 #if defined(SF_ERRATA_57)
2260         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2261             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2262             !(flags & HAT_LOAD_SHARE)) {
2263                 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2264                     " page executable");
2265                 attr &= ~PROT_EXEC;
2266         }
2267 #endif
2268 
2269         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2270         (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2271 
2272         /*
2273          * Check TSB and TLB page sizes.
2274          */
2275         if ((flags & HAT_LOAD_SHARE) == 0) {
2276                 sfmmu_check_page_sizes(hat, 1);
2277         }
2278 }
2279 
2280 /*
2281  * hat_devload can be called to map real memory (e.g.
2282  * /dev/kmem) and even though hat_devload will determine pf is
2283  * for memory, it will be unable to get a shared lock on the
2284  * page (because someone else has it exclusively) and will
2285  * pass dp = NULL.  If tteload doesn't get a non-NULL
2286  * page pointer it can't cache memory.
2287  */
2288 void
2289 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2290         uint_t attr, int flags)
2291 {
2292         tte_t tte;
2293         struct page *pp = NULL;
2294         int use_lgpg = 0;
2295 
2296         ASSERT(hat != NULL);
2297 
2298         if (hat->sfmmu_xhat_provider) {
2299                 XHAT_DEVLOAD(hat, addr, len, pfn, attr, flags);
2300                 return;
2301         }
2302 
2303         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2304         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2305         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2306         if (len == 0)
2307                 panic("hat_devload: zero len");
2308         if (flags & ~SFMMU_LOAD_ALLFLAG)
2309                 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2310                     flags & ~SFMMU_LOAD_ALLFLAG);
2311 
2312 #if defined(SF_ERRATA_57)
2313         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2314             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2315             !(flags & HAT_LOAD_SHARE)) {
2316                 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2317                     " page executable");
2318                 attr &= ~PROT_EXEC;
2319         }
2320 #endif
2321 
2322         /*
2323          * If it's a memory page find its pp
2324          */
2325         if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2326                 pp = page_numtopp_nolock(pfn);
2327                 if (pp == NULL) {
2328                         flags |= HAT_LOAD_NOCONSIST;
2329                 } else {
2330                         if (PP_ISFREE(pp)) {
2331                                 panic("hat_memload: loading "
2332                                     "a mapping to free page %p",
2333                                     (void *)pp);
2334                         }
2335                         if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2336                                 panic("hat_memload: loading a mapping "
2337                                     "to unlocked relocatable page %p",
2338                                     (void *)pp);
2339                         }
2340                         ASSERT(len == MMU_PAGESIZE);
2341                 }
2342         }
2343 
2344         if (hat->sfmmu_rmstat)
2345                 hat_resvstat(len, hat->sfmmu_as, addr);
2346 
2347         if (flags & HAT_LOAD_NOCONSIST) {
2348                 attr |= SFMMU_UNCACHEVTTE;
2349                 use_lgpg = 1;
2350         }
2351         if (!pf_is_memory(pfn)) {
2352                 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2353                 use_lgpg = 1;
2354                 switch (attr & HAT_ORDER_MASK) {
2355                         case HAT_STRICTORDER:
2356                         case HAT_UNORDERED_OK:
2357                                 /*
2358                                  * we set the side effect bit for all non
2359                                  * memory mappings unless merging is ok
2360                                  */
2361                                 attr |= SFMMU_SIDEFFECT;
2362                                 break;
2363                         case HAT_MERGING_OK:
2364                         case HAT_LOADCACHING_OK:
2365                         case HAT_STORECACHING_OK:
2366                                 break;
2367                         default:
2368                                 panic("hat_devload: bad attr");
2369                                 break;
2370                 }
2371         }
2372         while (len) {
2373                 if (!use_lgpg) {
2374                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2375                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2376                             flags, SFMMU_INVALID_SHMERID);
2377                         len -= MMU_PAGESIZE;
2378                         addr += MMU_PAGESIZE;
2379                         pfn++;
2380                         continue;
2381                 }
2382                 /*
2383                  *  try to use large pages, check va/pa alignments
2384                  *  Note that 32M/256M page sizes are not (yet) supported.
2385                  */
2386                 if ((len >= MMU_PAGESIZE4M) &&
2387                     !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2388                     !(disable_large_pages & (1 << TTE4M)) &&
2389                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2390                         sfmmu_memtte(&tte, pfn, attr, TTE4M);
2391                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2392                             flags, SFMMU_INVALID_SHMERID);
2393                         len -= MMU_PAGESIZE4M;
2394                         addr += MMU_PAGESIZE4M;
2395                         pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2396                 } else if ((len >= MMU_PAGESIZE512K) &&
2397                     !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2398                     !(disable_large_pages & (1 << TTE512K)) &&
2399                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2400                         sfmmu_memtte(&tte, pfn, attr, TTE512K);
2401                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2402                             flags, SFMMU_INVALID_SHMERID);
2403                         len -= MMU_PAGESIZE512K;
2404                         addr += MMU_PAGESIZE512K;
2405                         pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2406                 } else if ((len >= MMU_PAGESIZE64K) &&
2407                     !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2408                     !(disable_large_pages & (1 << TTE64K)) &&
2409                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2410                         sfmmu_memtte(&tte, pfn, attr, TTE64K);
2411                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2412                             flags, SFMMU_INVALID_SHMERID);
2413                         len -= MMU_PAGESIZE64K;
2414                         addr += MMU_PAGESIZE64K;
2415                         pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2416                 } else {
2417                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2418                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2419                             flags, SFMMU_INVALID_SHMERID);
2420                         len -= MMU_PAGESIZE;
2421                         addr += MMU_PAGESIZE;
2422                         pfn++;
2423                 }
2424         }
2425 
2426         /*
2427          * Check TSB and TLB page sizes.
2428          */
2429         if ((flags & HAT_LOAD_SHARE) == 0) {
2430                 sfmmu_check_page_sizes(hat, 1);
2431         }
2432 }
2433 
2434 void
2435 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2436         struct page **pps, uint_t attr, uint_t flags)
2437 {
2438         hat_do_memload_array(hat, addr, len, pps, attr, flags,
2439             SFMMU_INVALID_SHMERID);
2440 }
2441 
2442 void
2443 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2444         struct page **pps, uint_t attr, uint_t flags,
2445         hat_region_cookie_t rcookie)
2446 {
2447         uint_t rid;
2448         if (rcookie == HAT_INVALID_REGION_COOKIE ||
2449             hat->sfmmu_xhat_provider != NULL) {
2450                 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2451                     SFMMU_INVALID_SHMERID);
2452                 return;
2453         }
2454         rid = (uint_t)((uint64_t)rcookie);
2455         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2456         hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2457 }
2458 
2459 /*
2460  * Map the largest extend possible out of the page array. The array may NOT
2461  * be in order.  The largest possible mapping a page can have
2462  * is specified in the p_szc field.  The p_szc field
2463  * cannot change as long as there any mappings (large or small)
2464  * to any of the pages that make up the large page. (ie. any
2465  * promotion/demotion of page size is not up to the hat but up to
2466  * the page free list manager).  The array
2467  * should consist of properly aligned contigous pages that are
2468  * part of a big page for a large mapping to be created.
2469  */
2470 static void
2471 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2472         struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2473 {
2474         int  ttesz;
2475         size_t mapsz;
2476         pgcnt_t numpg, npgs;
2477         tte_t tte;
2478         page_t *pp;
2479         uint_t large_pages_disable;
2480 
2481         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2482         SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2483 
2484         if (hat->sfmmu_xhat_provider) {
2485                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
2486                 XHAT_MEMLOAD_ARRAY(hat, addr, len, pps, attr, flags);
2487                 return;
2488         }
2489 
2490         if (hat->sfmmu_rmstat)
2491                 hat_resvstat(len, hat->sfmmu_as, addr);
2492 
2493 #if defined(SF_ERRATA_57)
2494         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2495             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2496             !(flags & HAT_LOAD_SHARE)) {
2497                 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2498                     "user page executable");
2499                 attr &= ~PROT_EXEC;
2500         }
2501 #endif
2502 
2503         /* Get number of pages */
2504         npgs = len >> MMU_PAGESHIFT;
2505 
2506         if (flags & HAT_LOAD_SHARE) {
2507                 large_pages_disable = disable_ism_large_pages;
2508         } else {
2509                 large_pages_disable = disable_large_pages;
2510         }
2511 
2512         if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2513                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2514                     rid);
2515                 return;
2516         }
2517 
2518         while (npgs >= NHMENTS) {
2519                 pp = *pps;
2520                 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2521                         /*
2522                          * Check if this page size is disabled.
2523                          */
2524                         if (large_pages_disable & (1 << ttesz))
2525                                 continue;
2526 
2527                         numpg = TTEPAGES(ttesz);
2528                         mapsz = numpg << MMU_PAGESHIFT;
2529                         if ((npgs >= numpg) &&
2530                             IS_P2ALIGNED(addr, mapsz) &&
2531                             IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2532                                 /*
2533                                  * At this point we have enough pages and
2534                                  * we know the virtual address and the pfn
2535                                  * are properly aligned.  We still need
2536                                  * to check for physical contiguity but since
2537                                  * it is very likely that this is the case
2538                                  * we will assume they are so and undo
2539                                  * the request if necessary.  It would
2540                                  * be great if we could get a hint flag
2541                                  * like HAT_CONTIG which would tell us
2542                                  * the pages are contigous for sure.
2543                                  */
2544                                 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2545                                     attr, ttesz);
2546                                 if (!sfmmu_tteload_array(hat, &tte, addr,
2547                                     pps, flags, rid)) {
2548                                         break;
2549                                 }
2550                         }
2551                 }
2552                 if (ttesz == TTE8K) {
2553                         /*
2554                          * We were not able to map array using a large page
2555                          * batch a hmeblk or fraction at a time.
2556                          */
2557                         numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2558                             & (NHMENTS-1);
2559                         numpg = NHMENTS - numpg;
2560                         ASSERT(numpg <= npgs);
2561                         mapsz = numpg * MMU_PAGESIZE;
2562                         sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2563                             numpg, rid);
2564                 }
2565                 addr += mapsz;
2566                 npgs -= numpg;
2567                 pps += numpg;
2568         }
2569 
2570         if (npgs) {
2571                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2572                     rid);
2573         }
2574 
2575         /*
2576          * Check TSB and TLB page sizes.
2577          */
2578         if ((flags & HAT_LOAD_SHARE) == 0) {
2579                 sfmmu_check_page_sizes(hat, 1);
2580         }
2581 }
2582 
2583 /*
2584  * Function tries to batch 8K pages into the same hme blk.
2585  */
2586 static void
2587 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2588                     uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2589 {
2590         tte_t   tte;
2591         page_t *pp;
2592         struct hmehash_bucket *hmebp;
2593         struct hme_blk *hmeblkp;
2594         int     index;
2595 
2596         while (npgs) {
2597                 /*
2598                  * Acquire the hash bucket.
2599                  */
2600                 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2601                     rid);
2602                 ASSERT(hmebp);
2603 
2604                 /*
2605                  * Find the hment block.
2606                  */
2607                 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2608                     TTE8K, flags, rid);
2609                 ASSERT(hmeblkp);
2610 
2611                 do {
2612                         /*
2613                          * Make the tte.
2614                          */
2615                         pp = *pps;
2616                         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2617 
2618                         /*
2619                          * Add the translation.
2620                          */
2621                         (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2622                             vaddr, pps, flags, rid);
2623 
2624                         /*
2625                          * Goto next page.
2626                          */
2627                         pps++;
2628                         npgs--;
2629 
2630                         /*
2631                          * Goto next address.
2632                          */
2633                         vaddr += MMU_PAGESIZE;
2634 
2635                         /*
2636                          * Don't crossover into a different hmentblk.
2637                          */
2638                         index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2639                             (NHMENTS-1));
2640 
2641                 } while (index != 0 && npgs != 0);
2642 
2643                 /*
2644                  * Release the hash bucket.
2645                  */
2646 
2647                 sfmmu_tteload_release_hashbucket(hmebp);
2648         }
2649 }
2650 
2651 /*
2652  * Construct a tte for a page:
2653  *
2654  * tte_valid = 1
2655  * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2656  * tte_size = size
2657  * tte_nfo = attr & HAT_NOFAULT
2658  * tte_ie = attr & HAT_STRUCTURE_LE
2659  * tte_hmenum = hmenum
2660  * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2661  * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2662  * tte_ref = 1 (optimization)
2663  * tte_wr_perm = attr & PROT_WRITE;
2664  * tte_no_sync = attr & HAT_NOSYNC
2665  * tte_lock = attr & SFMMU_LOCKTTE
2666  * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2667  * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2668  * tte_e = attr & SFMMU_SIDEFFECT
2669  * tte_priv = !(attr & PROT_USER)
2670  * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2671  * tte_glb = 0
2672  */
2673 void
2674 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2675 {
2676         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2677 
2678         ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2679         ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2680 
2681         if (TTE_IS_NOSYNC(ttep)) {
2682                 TTE_SET_REF(ttep);
2683                 if (TTE_IS_WRITABLE(ttep)) {
2684                         TTE_SET_MOD(ttep);
2685                 }
2686         }
2687         if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2688                 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2689         }
2690 }
2691 
2692 /*
2693  * This function will add a translation to the hme_blk and allocate the
2694  * hme_blk if one does not exist.
2695  * If a page structure is specified then it will add the
2696  * corresponding hment to the mapping list.
2697  * It will also update the hmenum field for the tte.
2698  *
2699  * Currently this function is only used for kernel mappings.
2700  * So pass invalid region to sfmmu_tteload_array().
2701  */
2702 void
2703 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2704         uint_t flags)
2705 {
2706         ASSERT(sfmmup == ksfmmup);
2707         (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2708             SFMMU_INVALID_SHMERID);
2709 }
2710 
2711 /*
2712  * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2713  * Assumes that a particular page size may only be resident in one TSB.
2714  */
2715 static void
2716 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2717 {
2718         struct tsb_info *tsbinfop = NULL;
2719         uint64_t tag;
2720         struct tsbe *tsbe_addr;
2721         uint64_t tsb_base;
2722         uint_t tsb_size;
2723         int vpshift = MMU_PAGESHIFT;
2724         int phys = 0;
2725 
2726         if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2727                 phys = ktsb_phys;
2728                 if (ttesz >= TTE4M) {
2729 #ifndef sun4v
2730                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2731 #endif
2732                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2733                         tsb_size = ktsb4m_szcode;
2734                 } else {
2735                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2736                         tsb_size = ktsb_szcode;
2737                 }
2738         } else {
2739                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2740 
2741                 /*
2742                  * If there isn't a TSB for this page size, or the TSB is
2743                  * swapped out, there is nothing to do.  Note that the latter
2744                  * case seems impossible but can occur if hat_pageunload()
2745                  * is called on an ISM mapping while the process is swapped
2746                  * out.
2747                  */
2748                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2749                         return;
2750 
2751                 /*
2752                  * If another thread is in the middle of relocating a TSB
2753                  * we can't unload the entry so set a flag so that the
2754                  * TSB will be flushed before it can be accessed by the
2755                  * process.
2756                  */
2757                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2758                         if (ttep == NULL)
2759                                 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2760                         return;
2761                 }
2762 #if defined(UTSB_PHYS)
2763                 phys = 1;
2764                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2765 #else
2766                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2767 #endif
2768                 tsb_size = tsbinfop->tsb_szc;
2769         }
2770         if (ttesz >= TTE4M)
2771                 vpshift = MMU_PAGESHIFT4M;
2772 
2773         tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2774         tag = sfmmu_make_tsbtag(vaddr);
2775 
2776         if (ttep == NULL) {
2777                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2778         } else {
2779                 if (ttesz >= TTE4M) {
2780                         SFMMU_STAT(sf_tsb_load4m);
2781                 } else {
2782                         SFMMU_STAT(sf_tsb_load8k);
2783                 }
2784 
2785                 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2786         }
2787 }
2788 
2789 /*
2790  * Unmap all entries from [start, end) matching the given page size.
2791  *
2792  * This function is used primarily to unmap replicated 64K or 512K entries
2793  * from the TSB that are inserted using the base page size TSB pointer, but
2794  * it may also be called to unmap a range of addresses from the TSB.
2795  */
2796 void
2797 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2798 {
2799         struct tsb_info *tsbinfop;
2800         uint64_t tag;
2801         struct tsbe *tsbe_addr;
2802         caddr_t vaddr;
2803         uint64_t tsb_base;
2804         int vpshift, vpgsz;
2805         uint_t tsb_size;
2806         int phys = 0;
2807 
2808         /*
2809          * Assumptions:
2810          *  If ttesz == 8K, 64K or 512K, we walk through the range 8K
2811          *  at a time shooting down any valid entries we encounter.
2812          *
2813          *  If ttesz >= 4M we walk the range 4M at a time shooting
2814          *  down any valid mappings we find.
2815          */
2816         if (sfmmup == ksfmmup) {
2817                 phys = ktsb_phys;
2818                 if (ttesz >= TTE4M) {
2819 #ifndef sun4v
2820                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2821 #endif
2822                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2823                         tsb_size = ktsb4m_szcode;
2824                 } else {
2825                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2826                         tsb_size = ktsb_szcode;
2827                 }
2828         } else {
2829                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2830 
2831                 /*
2832                  * If there isn't a TSB for this page size, or the TSB is
2833                  * swapped out, there is nothing to do.  Note that the latter
2834                  * case seems impossible but can occur if hat_pageunload()
2835                  * is called on an ISM mapping while the process is swapped
2836                  * out.
2837                  */
2838                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2839                         return;
2840 
2841                 /*
2842                  * If another thread is in the middle of relocating a TSB
2843                  * we can't unload the entry so set a flag so that the
2844                  * TSB will be flushed before it can be accessed by the
2845                  * process.
2846                  */
2847                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2848                         tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2849                         return;
2850                 }
2851 #if defined(UTSB_PHYS)
2852                 phys = 1;
2853                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2854 #else
2855                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2856 #endif
2857                 tsb_size = tsbinfop->tsb_szc;
2858         }
2859         if (ttesz >= TTE4M) {
2860                 vpshift = MMU_PAGESHIFT4M;
2861                 vpgsz = MMU_PAGESIZE4M;
2862         } else {
2863                 vpshift = MMU_PAGESHIFT;
2864                 vpgsz = MMU_PAGESIZE;
2865         }
2866 
2867         for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2868                 tag = sfmmu_make_tsbtag(vaddr);
2869                 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2870                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2871         }
2872 }
2873 
2874 /*
2875  * Select the optimum TSB size given the number of mappings
2876  * that need to be cached.
2877  */
2878 static int
2879 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2880 {
2881         int szc = 0;
2882 
2883 #ifdef DEBUG
2884         if (tsb_grow_stress) {
2885                 uint32_t randval = (uint32_t)gettick() >> 4;
2886                 return (randval % (tsb_max_growsize + 1));
2887         }
2888 #endif  /* DEBUG */
2889 
2890         while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2891                 szc++;
2892         return (szc);
2893 }
2894 
2895 /*
2896  * This function will add a translation to the hme_blk and allocate the
2897  * hme_blk if one does not exist.
2898  * If a page structure is specified then it will add the
2899  * corresponding hment to the mapping list.
2900  * It will also update the hmenum field for the tte.
2901  * Furthermore, it attempts to create a large page translation
2902  * for <addr,hat> at page array pps.  It assumes addr and first
2903  * pp is correctly aligned.  It returns 0 if successful and 1 otherwise.
2904  */
2905 static int
2906 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2907         page_t **pps, uint_t flags, uint_t rid)
2908 {
2909         struct hmehash_bucket *hmebp;
2910         struct hme_blk *hmeblkp;
2911         int     ret;
2912         uint_t  size;
2913 
2914         /*
2915          * Get mapping size.
2916          */
2917         size = TTE_CSZ(ttep);
2918         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2919 
2920         /*
2921          * Acquire the hash bucket.
2922          */
2923         hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2924         ASSERT(hmebp);
2925 
2926         /*
2927          * Find the hment block.
2928          */
2929         hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2930             rid);
2931         ASSERT(hmeblkp);
2932 
2933         /*
2934          * Add the translation.
2935          */
2936         ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2937             rid);
2938 
2939         /*
2940          * Release the hash bucket.
2941          */
2942         sfmmu_tteload_release_hashbucket(hmebp);
2943 
2944         return (ret);
2945 }
2946 
2947 /*
2948  * Function locks and returns a pointer to the hash bucket for vaddr and size.
2949  */
2950 static struct hmehash_bucket *
2951 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2952     uint_t rid)
2953 {
2954         struct hmehash_bucket *hmebp;
2955         int hmeshift;
2956         void *htagid = sfmmutohtagid(sfmmup, rid);
2957 
2958         ASSERT(htagid != NULL);
2959 
2960         hmeshift = HME_HASH_SHIFT(size);
2961 
2962         hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2963 
2964         SFMMU_HASH_LOCK(hmebp);
2965 
2966         return (hmebp);
2967 }
2968 
2969 /*
2970  * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2971  * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2972  * allocated.
2973  */
2974 static struct hme_blk *
2975 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2976         caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2977 {
2978         hmeblk_tag hblktag;
2979         int hmeshift;
2980         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2981 
2982         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2983 
2984         hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2985         ASSERT(hblktag.htag_id != NULL);
2986         hmeshift = HME_HASH_SHIFT(size);
2987         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2988         hblktag.htag_rehash = HME_HASH_REHASH(size);
2989         hblktag.htag_rid = rid;
2990 
2991 ttearray_realloc:
2992 
2993         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2994 
2995         /*
2996          * We block until hblk_reserve_lock is released; it's held by
2997          * the thread, temporarily using hblk_reserve, until hblk_reserve is
2998          * replaced by a hblk from sfmmu8_cache.
2999          */
3000         if (hmeblkp == (struct hme_blk *)hblk_reserve &&
3001             hblk_reserve_thread != curthread) {
3002                 SFMMU_HASH_UNLOCK(hmebp);
3003                 mutex_enter(&hblk_reserve_lock);
3004                 mutex_exit(&hblk_reserve_lock);
3005                 SFMMU_STAT(sf_hblk_reserve_hit);
3006                 SFMMU_HASH_LOCK(hmebp);
3007                 goto ttearray_realloc;
3008         }
3009 
3010         if (hmeblkp == NULL) {
3011                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3012                     hblktag, flags, rid);
3013                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3014                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3015         } else {
3016                 /*
3017                  * It is possible for 8k and 64k hblks to collide since they
3018                  * have the same rehash value. This is because we
3019                  * lazily free hblks and 8K/64K blks could be lingering.
3020                  * If we find size mismatch we free the block and & try again.
3021                  */
3022                 if (get_hblk_ttesz(hmeblkp) != size) {
3023                         ASSERT(!hmeblkp->hblk_vcnt);
3024                         ASSERT(!hmeblkp->hblk_hmecnt);
3025                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3026                             &list, 0);
3027                         goto ttearray_realloc;
3028                 }
3029                 if (hmeblkp->hblk_shw_bit) {
3030                         /*
3031                          * if the hblk was previously used as a shadow hblk then
3032                          * we will change it to a normal hblk
3033                          */
3034                         ASSERT(!hmeblkp->hblk_shared);
3035                         if (hmeblkp->hblk_shw_mask) {
3036                                 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3037                                 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3038                                 goto ttearray_realloc;
3039                         } else {
3040                                 hmeblkp->hblk_shw_bit = 0;
3041                         }
3042                 }
3043                 SFMMU_STAT(sf_hblk_hit);
3044         }
3045 
3046         /*
3047          * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3048          * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3049          * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3050          * just add these hmeblks to the per-cpu pending queue.
3051          */
3052         sfmmu_hblks_list_purge(&list, 1);
3053 
3054         ASSERT(get_hblk_ttesz(hmeblkp) == size);
3055         ASSERT(!hmeblkp->hblk_shw_bit);
3056         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3057         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3058         ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3059 
3060         return (hmeblkp);
3061 }
3062 
3063 /*
3064  * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3065  * otherwise.
3066  */
3067 static int
3068 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3069         caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3070 {
3071         page_t *pp = *pps;
3072         int hmenum, size, remap;
3073         tte_t tteold, flush_tte;
3074 #ifdef DEBUG
3075         tte_t orig_old;
3076 #endif /* DEBUG */
3077         struct sf_hment *sfhme;
3078         kmutex_t *pml, *pmtx;
3079         hatlock_t *hatlockp;
3080         int myflt;
3081 
3082         /*
3083          * remove this panic when we decide to let user virtual address
3084          * space be >= USERLIMIT.
3085          */
3086         if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3087                 panic("user addr %p in kernel space", (void *)vaddr);
3088 #if defined(TTE_IS_GLOBAL)
3089         if (TTE_IS_GLOBAL(ttep))
3090                 panic("sfmmu_tteload: creating global tte");
3091 #endif
3092 
3093 #ifdef DEBUG
3094         if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3095             !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3096                 panic("sfmmu_tteload: non cacheable memory tte");
3097 #endif /* DEBUG */
3098 
3099         /* don't simulate dirty bit for writeable ISM/DISM mappings */
3100         if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3101                 TTE_SET_REF(ttep);
3102                 TTE_SET_MOD(ttep);
3103         }
3104 
3105         if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3106             !TTE_IS_MOD(ttep)) {
3107                 /*
3108                  * Don't load TSB for dummy as in ISM.  Also don't preload
3109                  * the TSB if the TTE isn't writable since we're likely to
3110                  * fault on it again -- preloading can be fairly expensive.
3111                  */
3112                 flags |= SFMMU_NO_TSBLOAD;
3113         }
3114 
3115         size = TTE_CSZ(ttep);
3116         switch (size) {
3117         case TTE8K:
3118                 SFMMU_STAT(sf_tteload8k);
3119                 break;
3120         case TTE64K:
3121                 SFMMU_STAT(sf_tteload64k);
3122                 break;
3123         case TTE512K:
3124                 SFMMU_STAT(sf_tteload512k);
3125                 break;
3126         case TTE4M:
3127                 SFMMU_STAT(sf_tteload4m);
3128                 break;
3129         case (TTE32M):
3130                 SFMMU_STAT(sf_tteload32m);
3131                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3132                 break;
3133         case (TTE256M):
3134                 SFMMU_STAT(sf_tteload256m);
3135                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3136                 break;
3137         }
3138 
3139         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3140         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3141         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3142         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3143 
3144         HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3145 
3146         /*
3147          * Need to grab mlist lock here so that pageunload
3148          * will not change tte behind us.
3149          */
3150         if (pp) {
3151                 pml = sfmmu_mlist_enter(pp);
3152         }
3153 
3154         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3155         /*
3156          * Look for corresponding hment and if valid verify
3157          * pfns are equal.
3158          */
3159         remap = TTE_IS_VALID(&tteold);
3160         if (remap) {
3161                 pfn_t   new_pfn, old_pfn;
3162 
3163                 old_pfn = TTE_TO_PFN(vaddr, &tteold);
3164                 new_pfn = TTE_TO_PFN(vaddr, ttep);
3165 
3166                 if (flags & HAT_LOAD_REMAP) {
3167                         /* make sure we are remapping same type of pages */
3168                         if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3169                                 panic("sfmmu_tteload - tte remap io<->memory");
3170                         }
3171                         if (old_pfn != new_pfn &&
3172                             (pp != NULL || sfhme->hme_page != NULL)) {
3173                                 panic("sfmmu_tteload - tte remap pp != NULL");
3174                         }
3175                 } else if (old_pfn != new_pfn) {
3176                         panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3177                             (void *)hmeblkp);
3178                 }
3179                 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3180         }
3181 
3182         if (pp) {
3183                 if (size == TTE8K) {
3184 #ifdef VAC
3185                         /*
3186                          * Handle VAC consistency
3187                          */
3188                         if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3189                                 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3190                         }
3191 #endif
3192 
3193                         if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3194                                 pmtx = sfmmu_page_enter(pp);
3195                                 PP_CLRRO(pp);
3196                                 sfmmu_page_exit(pmtx);
3197                         } else if (!PP_ISMAPPED(pp) &&
3198                             (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3199                                 pmtx = sfmmu_page_enter(pp);
3200                                 if (!(PP_ISMOD(pp))) {
3201                                         PP_SETRO(pp);
3202                                 }
3203                                 sfmmu_page_exit(pmtx);
3204                         }
3205 
3206                 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3207                         /*
3208                          * sfmmu_pagearray_setup failed so return
3209                          */
3210                         sfmmu_mlist_exit(pml);
3211                         return (1);
3212                 }
3213         }
3214 
3215         /*
3216          * Make sure hment is not on a mapping list.
3217          */
3218         ASSERT(remap || (sfhme->hme_page == NULL));
3219 
3220         /* if it is not a remap then hme->next better be NULL */
3221         ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3222 
3223         if (flags & HAT_LOAD_LOCK) {
3224                 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3225                         panic("too high lckcnt-hmeblk %p",
3226                             (void *)hmeblkp);
3227                 }
3228                 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3229 
3230                 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3231         }
3232 
3233 #ifdef VAC
3234         if (pp && PP_ISNC(pp)) {
3235                 /*
3236                  * If the physical page is marked to be uncacheable, like
3237                  * by a vac conflict, make sure the new mapping is also
3238                  * uncacheable.
3239                  */
3240                 TTE_CLR_VCACHEABLE(ttep);
3241                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3242         }
3243 #endif
3244         ttep->tte_hmenum = hmenum;
3245 
3246 #ifdef DEBUG
3247         orig_old = tteold;
3248 #endif /* DEBUG */
3249 
3250         while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3251                 if ((sfmmup == KHATID) &&
3252                     (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3253                         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3254                 }
3255 #ifdef DEBUG
3256                 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3257 #endif /* DEBUG */
3258         }
3259         ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3260 
3261         if (!TTE_IS_VALID(&tteold)) {
3262 
3263                 atomic_inc_16(&hmeblkp->hblk_vcnt);
3264                 if (rid == SFMMU_INVALID_SHMERID) {
3265                         atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3266                 } else {
3267                         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3268                         sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3269                         /*
3270                          * We already accounted for region ttecnt's in sfmmu
3271                          * during hat_join_region() processing. Here we
3272                          * only update ttecnt's in region struture.
3273                          */
3274                         atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3275                 }
3276         }
3277 
3278         myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3279         if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3280             sfmmup != ksfmmup) {
3281                 uchar_t tteflag = 1 << size;
3282                 if (rid == SFMMU_INVALID_SHMERID) {
3283                         if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3284                                 hatlockp = sfmmu_hat_enter(sfmmup);
3285                                 sfmmup->sfmmu_tteflags |= tteflag;
3286                                 sfmmu_hat_exit(hatlockp);
3287                         }
3288                 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3289                         hatlockp = sfmmu_hat_enter(sfmmup);
3290                         sfmmup->sfmmu_rtteflags |= tteflag;
3291                         sfmmu_hat_exit(hatlockp);
3292                 }
3293                 /*
3294                  * Update the current CPU tsbmiss area, so the current thread
3295                  * won't need to take the tsbmiss for the new pagesize.
3296                  * The other threads in the process will update their tsb
3297                  * miss area lazily in sfmmu_tsbmiss_exception() when they
3298                  * fail to find the translation for a newly added pagesize.
3299                  */
3300                 if (size > TTE64K && myflt) {
3301                         struct tsbmiss *tsbmp;
3302                         kpreempt_disable();
3303                         tsbmp = &tsbmiss_area[CPU->cpu_id];
3304                         if (rid == SFMMU_INVALID_SHMERID) {
3305                                 if (!(tsbmp->uhat_tteflags & tteflag)) {
3306                                         tsbmp->uhat_tteflags |= tteflag;
3307                                 }
3308                         } else {
3309                                 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3310                                         tsbmp->uhat_rtteflags |= tteflag;
3311                                 }
3312                         }
3313                         kpreempt_enable();
3314                 }
3315         }
3316 
3317         if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3318             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3319                 hatlockp = sfmmu_hat_enter(sfmmup);
3320                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3321                 sfmmu_hat_exit(hatlockp);
3322         }
3323 
3324         flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3325             hw_tte.tte_intlo;
3326         flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3327             hw_tte.tte_inthi;
3328 
3329         if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3330                 /*
3331                  * If remap and new tte differs from old tte we need
3332                  * to sync the mod bit and flush TLB/TSB.  We don't
3333                  * need to sync ref bit because we currently always set
3334                  * ref bit in tteload.
3335                  */
3336                 ASSERT(TTE_IS_REF(ttep));
3337                 if (TTE_IS_MOD(&tteold)) {
3338                         sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3339                 }
3340                 /*
3341                  * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3342                  * hmes are only used for read only text. Adding this code for
3343                  * completeness and future use of shared hmeblks with writable
3344                  * mappings of VMODSORT vnodes.
3345                  */
3346                 if (hmeblkp->hblk_shared) {
3347                         cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3348                             sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3349                         xt_sync(cpuset);
3350                         SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3351                 } else {
3352                         sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3353                         xt_sync(sfmmup->sfmmu_cpusran);
3354                 }
3355         }
3356 
3357         if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3358                 /*
3359                  * We only preload 8K and 4M mappings into the TSB, since
3360                  * 64K and 512K mappings are replicated and hence don't
3361                  * have a single, unique TSB entry. Ditto for 32M/256M.
3362                  */
3363                 if (size == TTE8K || size == TTE4M) {
3364                         sf_scd_t *scdp;
3365                         hatlockp = sfmmu_hat_enter(sfmmup);
3366                         /*
3367                          * Don't preload private TSB if the mapping is used
3368                          * by the shctx in the SCD.
3369                          */
3370                         scdp = sfmmup->sfmmu_scdp;
3371                         if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3372                             !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3373                                 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3374                                     size);
3375                         }
3376                         sfmmu_hat_exit(hatlockp);
3377                 }
3378         }
3379         if (pp) {
3380                 if (!remap) {
3381                         HME_ADD(sfhme, pp);
3382                         atomic_inc_16(&hmeblkp->hblk_hmecnt);
3383                         ASSERT(hmeblkp->hblk_hmecnt > 0);
3384 
3385                         /*
3386                          * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3387                          * see pageunload() for comment.
3388                          */
3389                 }
3390                 sfmmu_mlist_exit(pml);
3391         }
3392 
3393         return (0);
3394 }
3395 /*
3396  * Function unlocks hash bucket.
3397  */
3398 static void
3399 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3400 {
3401         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3402         SFMMU_HASH_UNLOCK(hmebp);
3403 }
3404 
3405 /*
3406  * function which checks and sets up page array for a large
3407  * translation.  Will set p_vcolor, p_index, p_ro fields.
3408  * Assumes addr and pfnum of first page are properly aligned.
3409  * Will check for physical contiguity. If check fails it return
3410  * non null.
3411  */
3412 static int
3413 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3414 {
3415         int     i, index, ttesz;
3416         pfn_t   pfnum;
3417         pgcnt_t npgs;
3418         page_t *pp, *pp1;
3419         kmutex_t *pmtx;
3420 #ifdef VAC
3421         int osz;
3422         int cflags = 0;
3423         int vac_err = 0;
3424 #endif
3425         int newidx = 0;
3426 
3427         ttesz = TTE_CSZ(ttep);
3428 
3429         ASSERT(ttesz > TTE8K);
3430 
3431         npgs = TTEPAGES(ttesz);
3432         index = PAGESZ_TO_INDEX(ttesz);
3433 
3434         pfnum = (*pps)->p_pagenum;
3435         ASSERT(IS_P2ALIGNED(pfnum, npgs));
3436 
3437         /*
3438          * Save the first pp so we can do HAT_TMPNC at the end.
3439          */
3440         pp1 = *pps;
3441 #ifdef VAC
3442         osz = fnd_mapping_sz(pp1);
3443 #endif
3444 
3445         for (i = 0; i < npgs; i++, pps++) {
3446                 pp = *pps;
3447                 ASSERT(PAGE_LOCKED(pp));
3448                 ASSERT(pp->p_szc >= ttesz);
3449                 ASSERT(pp->p_szc == pp1->p_szc);
3450                 ASSERT(sfmmu_mlist_held(pp));
3451 
3452                 /*
3453                  * XXX is it possible to maintain P_RO on the root only?
3454                  */
3455                 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3456                         pmtx = sfmmu_page_enter(pp);
3457                         PP_CLRRO(pp);
3458                         sfmmu_page_exit(pmtx);
3459                 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3460                     !PP_ISMOD(pp)) {
3461                         pmtx = sfmmu_page_enter(pp);
3462                         if (!(PP_ISMOD(pp))) {
3463                                 PP_SETRO(pp);
3464                         }
3465                         sfmmu_page_exit(pmtx);
3466                 }
3467 
3468                 /*
3469                  * If this is a remap we skip vac & contiguity checks.
3470                  */
3471                 if (remap)
3472                         continue;
3473 
3474                 /*
3475                  * set p_vcolor and detect any vac conflicts.
3476                  */
3477 #ifdef VAC
3478                 if (vac_err == 0) {
3479                         vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3480 
3481                 }
3482 #endif
3483 
3484                 /*
3485                  * Save current index in case we need to undo it.
3486                  * Note: "PAGESZ_TO_INDEX(sz)   (1 << (sz))"
3487                  *      "SFMMU_INDEX_SHIFT      6"
3488                  *       "SFMMU_INDEX_MASK      ((1 << SFMMU_INDEX_SHIFT) - 1)"
3489                  *       "PP_MAPINDEX(p_index)  (p_index & SFMMU_INDEX_MASK)"
3490                  *
3491                  * So:  index = PAGESZ_TO_INDEX(ttesz);
3492                  *      if ttesz == 1 then index = 0x2
3493                  *                  2 then index = 0x4
3494                  *                  3 then index = 0x8
3495                  *                  4 then index = 0x10
3496                  *                  5 then index = 0x20
3497                  * The code below checks if it's a new pagesize (ie, newidx)
3498                  * in case we need to take it back out of p_index,
3499                  * and then or's the new index into the existing index.
3500                  */
3501                 if ((PP_MAPINDEX(pp) & index) == 0)
3502                         newidx = 1;
3503                 pp->p_index = (PP_MAPINDEX(pp) | index);
3504 
3505                 /*
3506                  * contiguity check
3507                  */
3508                 if (pp->p_pagenum != pfnum) {
3509                         /*
3510                          * If we fail the contiguity test then
3511                          * the only thing we need to fix is the p_index field.
3512                          * We might get a few extra flushes but since this
3513                          * path is rare that is ok.  The p_ro field will
3514                          * get automatically fixed on the next tteload to
3515                          * the page.  NO TNC bit is set yet.
3516                          */
3517                         while (i >= 0) {
3518                                 pp = *pps;
3519                                 if (newidx)
3520                                         pp->p_index = (PP_MAPINDEX(pp) &
3521                                             ~index);
3522                                 pps--;
3523                                 i--;
3524                         }
3525                         return (1);
3526                 }
3527                 pfnum++;
3528                 addr += MMU_PAGESIZE;
3529         }
3530 
3531 #ifdef VAC
3532         if (vac_err) {
3533                 if (ttesz > osz) {
3534                         /*
3535                          * There are some smaller mappings that causes vac
3536                          * conflicts. Convert all existing small mappings to
3537                          * TNC.
3538                          */
3539                         SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3540                         sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3541                             npgs);
3542                 } else {
3543                         /* EMPTY */
3544                         /*
3545                          * If there exists an big page mapping,
3546                          * that means the whole existing big page
3547                          * has TNC setting already. No need to covert to
3548                          * TNC again.
3549                          */
3550                         ASSERT(PP_ISTNC(pp1));
3551                 }
3552         }
3553 #endif  /* VAC */
3554 
3555         return (0);
3556 }
3557 
3558 #ifdef VAC
3559 /*
3560  * Routine that detects vac consistency for a large page. It also
3561  * sets virtual color for all pp's for this big mapping.
3562  */
3563 static int
3564 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3565 {
3566         int vcolor, ocolor;
3567 
3568         ASSERT(sfmmu_mlist_held(pp));
3569 
3570         if (PP_ISNC(pp)) {
3571                 return (HAT_TMPNC);
3572         }
3573 
3574         vcolor = addr_to_vcolor(addr);
3575         if (PP_NEWPAGE(pp)) {
3576                 PP_SET_VCOLOR(pp, vcolor);
3577                 return (0);
3578         }
3579 
3580         ocolor = PP_GET_VCOLOR(pp);
3581         if (ocolor == vcolor) {
3582                 return (0);
3583         }
3584 
3585         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3586                 /*
3587                  * Previous user of page had a differnet color
3588                  * but since there are no current users
3589                  * we just flush the cache and change the color.
3590                  * As an optimization for large pages we flush the
3591                  * entire cache of that color and set a flag.
3592                  */
3593                 SFMMU_STAT(sf_pgcolor_conflict);
3594                 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3595                         CacheColor_SetFlushed(*cflags, ocolor);
3596                         sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3597                 }
3598                 PP_SET_VCOLOR(pp, vcolor);
3599                 return (0);
3600         }
3601 
3602         /*
3603          * We got a real conflict with a current mapping.
3604          * set flags to start unencaching all mappings
3605          * and return failure so we restart looping
3606          * the pp array from the beginning.
3607          */
3608         return (HAT_TMPNC);
3609 }
3610 #endif  /* VAC */
3611 
3612 /*
3613  * creates a large page shadow hmeblk for a tte.
3614  * The purpose of this routine is to allow us to do quick unloads because
3615  * the vm layer can easily pass a very large but sparsely populated range.
3616  */
3617 static struct hme_blk *
3618 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3619 {
3620         struct hmehash_bucket *hmebp;
3621         hmeblk_tag hblktag;
3622         int hmeshift, size, vshift;
3623         uint_t shw_mask, newshw_mask;
3624         struct hme_blk *hmeblkp;
3625 
3626         ASSERT(sfmmup != KHATID);
3627         if (mmu_page_sizes == max_mmu_page_sizes) {
3628                 ASSERT(ttesz < TTE256M);
3629         } else {
3630                 ASSERT(ttesz < TTE4M);
3631                 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3632                 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3633         }
3634 
3635         if (ttesz == TTE8K) {
3636                 size = TTE512K;
3637         } else {
3638                 size = ++ttesz;
3639         }
3640 
3641         hblktag.htag_id = sfmmup;
3642         hmeshift = HME_HASH_SHIFT(size);
3643         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3644         hblktag.htag_rehash = HME_HASH_REHASH(size);
3645         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3646         hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3647 
3648         SFMMU_HASH_LOCK(hmebp);
3649 
3650         HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3651         ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3652         if (hmeblkp == NULL) {
3653                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3654                     hblktag, flags, SFMMU_INVALID_SHMERID);
3655         }
3656         ASSERT(hmeblkp);
3657         if (!hmeblkp->hblk_shw_mask) {
3658                 /*
3659                  * if this is a unused hblk it was just allocated or could
3660                  * potentially be a previous large page hblk so we need to
3661                  * set the shadow bit.
3662                  */
3663                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3664                 hmeblkp->hblk_shw_bit = 1;
3665         } else if (hmeblkp->hblk_shw_bit == 0) {
3666                 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3667                     (void *)hmeblkp);
3668         }
3669         ASSERT(hmeblkp->hblk_shw_bit == 1);
3670         ASSERT(!hmeblkp->hblk_shared);
3671         vshift = vaddr_to_vshift(hblktag, vaddr, size);
3672         ASSERT(vshift < 8);
3673         /*
3674          * Atomically set shw mask bit
3675          */
3676         do {
3677                 shw_mask = hmeblkp->hblk_shw_mask;
3678                 newshw_mask = shw_mask | (1 << vshift);
3679                 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3680                     newshw_mask);
3681         } while (newshw_mask != shw_mask);
3682 
3683         SFMMU_HASH_UNLOCK(hmebp);
3684 
3685         return (hmeblkp);
3686 }
3687 
3688 /*
3689  * This routine cleanup a previous shadow hmeblk and changes it to
3690  * a regular hblk.  This happens rarely but it is possible
3691  * when a process wants to use large pages and there are hblks still
3692  * lying around from the previous as that used these hmeblks.
3693  * The alternative was to cleanup the shadow hblks at unload time
3694  * but since so few user processes actually use large pages, it is
3695  * better to be lazy and cleanup at this time.
3696  */
3697 static void
3698 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3699         struct hmehash_bucket *hmebp)
3700 {
3701         caddr_t addr, endaddr;
3702         int hashno, size;
3703 
3704         ASSERT(hmeblkp->hblk_shw_bit);
3705         ASSERT(!hmeblkp->hblk_shared);
3706 
3707         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3708 
3709         if (!hmeblkp->hblk_shw_mask) {
3710                 hmeblkp->hblk_shw_bit = 0;
3711                 return;
3712         }
3713         addr = (caddr_t)get_hblk_base(hmeblkp);
3714         endaddr = get_hblk_endaddr(hmeblkp);
3715         size = get_hblk_ttesz(hmeblkp);
3716         hashno = size - 1;
3717         ASSERT(hashno > 0);
3718         SFMMU_HASH_UNLOCK(hmebp);
3719 
3720         sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3721 
3722         SFMMU_HASH_LOCK(hmebp);
3723 }
3724 
3725 static void
3726 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3727         int hashno)
3728 {
3729         int hmeshift, shadow = 0;
3730         hmeblk_tag hblktag;
3731         struct hmehash_bucket *hmebp;
3732         struct hme_blk *hmeblkp;
3733         struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3734 
3735         ASSERT(hashno > 0);
3736         hblktag.htag_id = sfmmup;
3737         hblktag.htag_rehash = hashno;
3738         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3739 
3740         hmeshift = HME_HASH_SHIFT(hashno);
3741 
3742         while (addr < endaddr) {
3743                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3744                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3745                 SFMMU_HASH_LOCK(hmebp);
3746                 /* inline HME_HASH_SEARCH */
3747                 hmeblkp = hmebp->hmeblkp;
3748                 pr_hblk = NULL;
3749                 while (hmeblkp) {
3750                         if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3751                                 /* found hme_blk */
3752                                 ASSERT(!hmeblkp->hblk_shared);
3753                                 if (hmeblkp->hblk_shw_bit) {
3754                                         if (hmeblkp->hblk_shw_mask) {
3755                                                 shadow = 1;
3756                                                 sfmmu_shadow_hcleanup(sfmmup,
3757                                                     hmeblkp, hmebp);
3758                                                 break;
3759                                         } else {
3760                                                 hmeblkp->hblk_shw_bit = 0;
3761                                         }
3762                                 }
3763 
3764                                 /*
3765                                  * Hblk_hmecnt and hblk_vcnt could be non zero
3766                                  * since hblk_unload() does not gurantee that.
3767                                  *
3768                                  * XXX - this could cause tteload() to spin
3769                                  * where sfmmu_shadow_hcleanup() is called.
3770                                  */
3771                         }
3772 
3773                         nx_hblk = hmeblkp->hblk_next;
3774                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3775                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3776                                     &list, 0);
3777                         } else {
3778                                 pr_hblk = hmeblkp;
3779                         }
3780                         hmeblkp = nx_hblk;
3781                 }
3782 
3783                 SFMMU_HASH_UNLOCK(hmebp);
3784 
3785                 if (shadow) {
3786                         /*
3787                          * We found another shadow hblk so cleaned its
3788                          * children.  We need to go back and cleanup
3789                          * the original hblk so we don't change the
3790                          * addr.
3791                          */
3792                         shadow = 0;
3793                 } else {
3794                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
3795                             (1 << hmeshift));
3796                 }
3797         }
3798         sfmmu_hblks_list_purge(&list, 0);
3799 }
3800 
3801 /*
3802  * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3803  * may still linger on after pageunload.
3804  */
3805 static void
3806 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3807 {
3808         int hmeshift;
3809         hmeblk_tag hblktag;
3810         struct hmehash_bucket *hmebp;
3811         struct hme_blk *hmeblkp;
3812         struct hme_blk *pr_hblk;
3813         struct hme_blk *list = NULL;
3814 
3815         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3816         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3817 
3818         hmeshift = HME_HASH_SHIFT(ttesz);
3819         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3820         hblktag.htag_rehash = ttesz;
3821         hblktag.htag_rid = rid;
3822         hblktag.htag_id = srdp;
3823         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3824 
3825         SFMMU_HASH_LOCK(hmebp);
3826         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3827         if (hmeblkp != NULL) {
3828                 ASSERT(hmeblkp->hblk_shared);
3829                 ASSERT(!hmeblkp->hblk_shw_bit);
3830                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3831                         panic("sfmmu_cleanup_rhblk: valid hmeblk");
3832                 }
3833                 ASSERT(!hmeblkp->hblk_lckcnt);
3834                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3835                     &list, 0);
3836         }
3837         SFMMU_HASH_UNLOCK(hmebp);
3838         sfmmu_hblks_list_purge(&list, 0);
3839 }
3840 
3841 /* ARGSUSED */
3842 static void
3843 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3844     size_t r_size, void *r_obj, u_offset_t r_objoff)
3845 {
3846 }
3847 
3848 /*
3849  * Searches for an hmeblk which maps addr, then unloads this mapping
3850  * and updates *eaddrp, if the hmeblk is found.
3851  */
3852 static void
3853 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3854     caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3855 {
3856         int hmeshift;
3857         hmeblk_tag hblktag;
3858         struct hmehash_bucket *hmebp;
3859         struct hme_blk *hmeblkp;
3860         struct hme_blk *pr_hblk;
3861         struct hme_blk *list = NULL;
3862 
3863         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3864         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3865         ASSERT(ttesz >= HBLK_MIN_TTESZ);
3866 
3867         hmeshift = HME_HASH_SHIFT(ttesz);
3868         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3869         hblktag.htag_rehash = ttesz;
3870         hblktag.htag_rid = rid;
3871         hblktag.htag_id = srdp;
3872         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3873 
3874         SFMMU_HASH_LOCK(hmebp);
3875         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3876         if (hmeblkp != NULL) {
3877                 ASSERT(hmeblkp->hblk_shared);
3878                 ASSERT(!hmeblkp->hblk_lckcnt);
3879                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3880                         *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3881                             eaddr, NULL, HAT_UNLOAD);
3882                         ASSERT(*eaddrp > addr);
3883                 }
3884                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3885                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3886                     &list, 0);
3887         }
3888         SFMMU_HASH_UNLOCK(hmebp);
3889         sfmmu_hblks_list_purge(&list, 0);
3890 }
3891 
3892 static void
3893 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3894 {
3895         int ttesz = rgnp->rgn_pgszc;
3896         size_t rsz = rgnp->rgn_size;
3897         caddr_t rsaddr = rgnp->rgn_saddr;
3898         caddr_t readdr = rsaddr + rsz;
3899         caddr_t rhsaddr;
3900         caddr_t va;
3901         uint_t rid = rgnp->rgn_id;
3902         caddr_t cbsaddr;
3903         caddr_t cbeaddr;
3904         hat_rgn_cb_func_t rcbfunc;
3905         ulong_t cnt;
3906 
3907         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3908         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3909 
3910         ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3911         ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3912         if (ttesz < HBLK_MIN_TTESZ) {
3913                 ttesz = HBLK_MIN_TTESZ;
3914                 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3915         } else {
3916                 rhsaddr = rsaddr;
3917         }
3918 
3919         if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3920                 rcbfunc = sfmmu_rgn_cb_noop;
3921         }
3922 
3923         while (ttesz >= HBLK_MIN_TTESZ) {
3924                 cbsaddr = rsaddr;
3925                 cbeaddr = rsaddr;
3926                 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3927                         ttesz--;
3928                         continue;
3929                 }
3930                 cnt = 0;
3931                 va = rsaddr;
3932                 while (va < readdr) {
3933                         ASSERT(va >= rhsaddr);
3934                         if (va != cbeaddr) {
3935                                 if (cbeaddr != cbsaddr) {
3936                                         ASSERT(cbeaddr > cbsaddr);
3937                                         (*rcbfunc)(cbsaddr, cbeaddr,
3938                                             rsaddr, rsz, rgnp->rgn_obj,
3939                                             rgnp->rgn_objoff);
3940                                 }
3941                                 cbsaddr = va;
3942                                 cbeaddr = va;
3943                         }
3944                         sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3945                             ttesz, &cbeaddr);
3946                         cnt++;
3947                         va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3948                 }
3949                 if (cbeaddr != cbsaddr) {
3950                         ASSERT(cbeaddr > cbsaddr);
3951                         (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3952                             rsz, rgnp->rgn_obj,
3953                             rgnp->rgn_objoff);
3954                 }
3955                 ttesz--;
3956         }
3957 }
3958 
3959 /*
3960  * Release one hardware address translation lock on the given address range.
3961  */
3962 void
3963 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3964 {
3965         struct hmehash_bucket *hmebp;
3966         hmeblk_tag hblktag;
3967         int hmeshift, hashno = 1;
3968         struct hme_blk *hmeblkp, *list = NULL;
3969         caddr_t endaddr;
3970 
3971         ASSERT(sfmmup != NULL);
3972         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
3973 
3974         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3975         ASSERT((len & MMU_PAGEOFFSET) == 0);
3976         endaddr = addr + len;
3977         hblktag.htag_id = sfmmup;
3978         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3979 
3980         /*
3981          * Spitfire supports 4 page sizes.
3982          * Most pages are expected to be of the smallest page size (8K) and
3983          * these will not need to be rehashed. 64K pages also don't need to be
3984          * rehashed because an hmeblk spans 64K of address space. 512K pages
3985          * might need 1 rehash and and 4M pages might need 2 rehashes.
3986          */
3987         while (addr < endaddr) {
3988                 hmeshift = HME_HASH_SHIFT(hashno);
3989                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3990                 hblktag.htag_rehash = hashno;
3991                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3992 
3993                 SFMMU_HASH_LOCK(hmebp);
3994 
3995                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3996                 if (hmeblkp != NULL) {
3997                         ASSERT(!hmeblkp->hblk_shared);
3998                         /*
3999                          * If we encounter a shadow hmeblk then
4000                          * we know there are no valid hmeblks mapping
4001                          * this address at this size or larger.
4002                          * Just increment address by the smallest
4003                          * page size.
4004                          */
4005                         if (hmeblkp->hblk_shw_bit) {
4006                                 addr += MMU_PAGESIZE;
4007                         } else {
4008                                 addr = sfmmu_hblk_unlock(hmeblkp, addr,
4009                                     endaddr);
4010                         }
4011                         SFMMU_HASH_UNLOCK(hmebp);
4012                         hashno = 1;
4013                         continue;
4014                 }
4015                 SFMMU_HASH_UNLOCK(hmebp);
4016 
4017                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4018                         /*
4019                          * We have traversed the whole list and rehashed
4020                          * if necessary without finding the address to unlock
4021                          * which should never happen.
4022                          */
4023                         panic("sfmmu_unlock: addr not found. "
4024                             "addr %p hat %p", (void *)addr, (void *)sfmmup);
4025                 } else {
4026                         hashno++;
4027                 }
4028         }
4029 
4030         sfmmu_hblks_list_purge(&list, 0);
4031 }
4032 
4033 void
4034 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4035     hat_region_cookie_t rcookie)
4036 {
4037         sf_srd_t *srdp;
4038         sf_region_t *rgnp;
4039         int ttesz;
4040         uint_t rid;
4041         caddr_t eaddr;
4042         caddr_t va;
4043         int hmeshift;
4044         hmeblk_tag hblktag;
4045         struct hmehash_bucket *hmebp;
4046         struct hme_blk *hmeblkp;
4047         struct hme_blk *pr_hblk;
4048         struct hme_blk *list;
4049 
4050         if (rcookie == HAT_INVALID_REGION_COOKIE) {
4051                 hat_unlock(sfmmup, addr, len);
4052                 return;
4053         }
4054 
4055         ASSERT(sfmmup != NULL);
4056         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4057         ASSERT(sfmmup != ksfmmup);
4058 
4059         srdp = sfmmup->sfmmu_srdp;
4060         rid = (uint_t)((uint64_t)rcookie);
4061         VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
4062         eaddr = addr + len;
4063         va = addr;
4064         list = NULL;
4065         rgnp = srdp->srd_hmergnp[rid];
4066         SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4067 
4068         ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4069         ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4070         if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4071                 ttesz = HBLK_MIN_TTESZ;
4072         } else {
4073                 ttesz = rgnp->rgn_pgszc;
4074         }
4075         while (va < eaddr) {
4076                 while (ttesz < rgnp->rgn_pgszc &&
4077                     IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4078                         ttesz++;
4079                 }
4080                 while (ttesz >= HBLK_MIN_TTESZ) {
4081                         if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4082                                 ttesz--;
4083                                 continue;
4084                         }
4085                         hmeshift = HME_HASH_SHIFT(ttesz);
4086                         hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4087                         hblktag.htag_rehash = ttesz;
4088                         hblktag.htag_rid = rid;
4089                         hblktag.htag_id = srdp;
4090                         hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4091                         SFMMU_HASH_LOCK(hmebp);
4092                         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4093                             &list);
4094                         if (hmeblkp == NULL) {
4095                                 SFMMU_HASH_UNLOCK(hmebp);
4096                                 ttesz--;
4097                                 continue;
4098                         }
4099                         ASSERT(hmeblkp->hblk_shared);
4100                         va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4101                         ASSERT(va >= eaddr ||
4102                             IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4103                         SFMMU_HASH_UNLOCK(hmebp);
4104                         break;
4105                 }
4106                 if (ttesz < HBLK_MIN_TTESZ) {
4107                         panic("hat_unlock_region: addr not found "
4108                             "addr %p hat %p", (void *)va, (void *)sfmmup);
4109                 }
4110         }
4111         sfmmu_hblks_list_purge(&list, 0);
4112 }
4113 
4114 /*
4115  * Function to unlock a range of addresses in an hmeblk.  It returns the
4116  * next address that needs to be unlocked.
4117  * Should be called with the hash lock held.
4118  */
4119 static caddr_t
4120 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4121 {
4122         struct sf_hment *sfhme;
4123         tte_t tteold, ttemod;
4124         int ttesz, ret;
4125 
4126         ASSERT(in_hblk_range(hmeblkp, addr));
4127         ASSERT(hmeblkp->hblk_shw_bit == 0);
4128 
4129         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4130         ttesz = get_hblk_ttesz(hmeblkp);
4131 
4132         HBLKTOHME(sfhme, hmeblkp, addr);
4133         while (addr < endaddr) {
4134 readtte:
4135                 sfmmu_copytte(&sfhme->hme_tte, &tteold);
4136                 if (TTE_IS_VALID(&tteold)) {
4137 
4138                         ttemod = tteold;
4139 
4140                         ret = sfmmu_modifytte_try(&tteold, &ttemod,
4141                             &sfhme->hme_tte);
4142 
4143                         if (ret < 0)
4144                                 goto readtte;
4145 
4146                         if (hmeblkp->hblk_lckcnt == 0)
4147                                 panic("zero hblk lckcnt");
4148 
4149                         if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4150                             (uintptr_t)endaddr)
4151                                 panic("can't unlock large tte");
4152 
4153                         ASSERT(hmeblkp->hblk_lckcnt > 0);
4154                         atomic_dec_32(&hmeblkp->hblk_lckcnt);
4155                         HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4156                 } else {
4157                         panic("sfmmu_hblk_unlock: invalid tte");
4158                 }
4159                 addr += TTEBYTES(ttesz);
4160                 sfhme++;
4161         }
4162         return (addr);
4163 }
4164 
4165 /*
4166  * Physical Address Mapping Framework
4167  *
4168  * General rules:
4169  *
4170  * (1) Applies only to seg_kmem memory pages. To make things easier,
4171  *     seg_kpm addresses are also accepted by the routines, but nothing
4172  *     is done with them since by definition their PA mappings are static.
4173  * (2) hat_add_callback() may only be called while holding the page lock
4174  *     SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4175  *     or passing HAC_PAGELOCK flag.
4176  * (3) prehandler() and posthandler() may not call hat_add_callback() or
4177  *     hat_delete_callback(), nor should they allocate memory. Post quiesce
4178  *     callbacks may not sleep or acquire adaptive mutex locks.
4179  * (4) Either prehandler() or posthandler() (but not both) may be specified
4180  *     as being NULL.  Specifying an errhandler() is optional.
4181  *
4182  * Details of using the framework:
4183  *
4184  * registering a callback (hat_register_callback())
4185  *
4186  *      Pass prehandler, posthandler, errhandler addresses
4187  *      as described below. If capture_cpus argument is nonzero,
4188  *      suspend callback to the prehandler will occur with CPUs
4189  *      captured and executing xc_loop() and CPUs will remain
4190  *      captured until after the posthandler suspend callback
4191  *      occurs.
4192  *
4193  * adding a callback (hat_add_callback())
4194  *
4195  *      as_pagelock();
4196  *      hat_add_callback();
4197  *      save returned pfn in private data structures or program registers;
4198  *      as_pageunlock();
4199  *
4200  * prehandler()
4201  *
4202  *      Stop all accesses by physical address to this memory page.
4203  *      Called twice: the first, PRESUSPEND, is a context safe to acquire
4204  *      adaptive locks. The second, SUSPEND, is called at high PIL with
4205  *      CPUs captured so adaptive locks may NOT be acquired (and all spin
4206  *      locks must be XCALL_PIL or higher locks).
4207  *
4208  *      May return the following errors:
4209  *              EIO:    A fatal error has occurred. This will result in panic.
4210  *              EAGAIN: The page cannot be suspended. This will fail the
4211  *                      relocation.
4212  *              0:      Success.
4213  *
4214  * posthandler()
4215  *
4216  *      Save new pfn in private data structures or program registers;
4217  *      not allowed to fail (non-zero return values will result in panic).
4218  *
4219  * errhandler()
4220  *
4221  *      called when an error occurs related to the callback.  Currently
4222  *      the only such error is HAT_CB_ERR_LEAKED which indicates that
4223  *      a page is being freed, but there are still outstanding callback(s)
4224  *      registered on the page.
4225  *
4226  * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4227  *
4228  *      stop using physical address
4229  *      hat_delete_callback();
4230  *
4231  */
4232 
4233 /*
4234  * Register a callback class.  Each subsystem should do this once and
4235  * cache the id_t returned for use in setting up and tearing down callbacks.
4236  *
4237  * There is no facility for removing callback IDs once they are created;
4238  * the "key" should be unique for each module, so in case a module is unloaded
4239  * and subsequently re-loaded, we can recycle the module's previous entry.
4240  */
4241 id_t
4242 hat_register_callback(int key,
4243         int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4244         int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4245         int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4246         int capture_cpus)
4247 {
4248         id_t id;
4249 
4250         /*
4251          * Search the table for a pre-existing callback associated with
4252          * the identifier "key".  If one exists, we re-use that entry in
4253          * the table for this instance, otherwise we assign the next
4254          * available table slot.
4255          */
4256         for (id = 0; id < sfmmu_max_cb_id; id++) {
4257                 if (sfmmu_cb_table[id].key == key)
4258                         break;
4259         }
4260 
4261         if (id == sfmmu_max_cb_id) {
4262                 id = sfmmu_cb_nextid++;
4263                 if (id >= sfmmu_max_cb_id)
4264                         panic("hat_register_callback: out of callback IDs");
4265         }
4266 
4267         ASSERT(prehandler != NULL || posthandler != NULL);
4268 
4269         sfmmu_cb_table[id].key = key;
4270         sfmmu_cb_table[id].prehandler = prehandler;
4271         sfmmu_cb_table[id].posthandler = posthandler;
4272         sfmmu_cb_table[id].errhandler = errhandler;
4273         sfmmu_cb_table[id].capture_cpus = capture_cpus;
4274 
4275         return (id);
4276 }
4277 
4278 #define HAC_COOKIE_NONE (void *)-1
4279 
4280 /*
4281  * Add relocation callbacks to the specified addr/len which will be called
4282  * when relocating the associated page. See the description of pre and
4283  * posthandler above for more details.
4284  *
4285  * If HAC_PAGELOCK is included in flags, the underlying memory page is
4286  * locked internally so the caller must be able to deal with the callback
4287  * running even before this function has returned.  If HAC_PAGELOCK is not
4288  * set, it is assumed that the underlying memory pages are locked.
4289  *
4290  * Since the caller must track the individual page boundaries anyway,
4291  * we only allow a callback to be added to a single page (large
4292  * or small).  Thus [addr, addr + len) MUST be contained within a single
4293  * page.
4294  *
4295  * Registering multiple callbacks on the same [addr, addr+len) is supported,
4296  * _provided_that_ a unique parameter is specified for each callback.
4297  * If multiple callbacks are registered on the same range the callback will
4298  * be invoked with each unique parameter. Registering the same callback with
4299  * the same argument more than once will result in corrupted kernel state.
4300  *
4301  * Returns the pfn of the underlying kernel page in *rpfn
4302  * on success, or PFN_INVALID on failure.
4303  *
4304  * cookiep (if passed) provides storage space for an opaque cookie
4305  * to return later to hat_delete_callback(). This cookie makes the callback
4306  * deletion significantly quicker by avoiding a potentially lengthy hash
4307  * search.
4308  *
4309  * Returns values:
4310  *    0:      success
4311  *    ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4312  *    EINVAL: callback ID is not valid
4313  *    ENXIO:  ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4314  *            space
4315  *    ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4316  */
4317 int
4318 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4319         void *pvt, pfn_t *rpfn, void **cookiep)
4320 {
4321         struct          hmehash_bucket *hmebp;
4322         hmeblk_tag      hblktag;
4323         struct hme_blk  *hmeblkp;
4324         int             hmeshift, hashno;
4325         caddr_t         saddr, eaddr, baseaddr;
4326         struct pa_hment *pahmep;
4327         struct sf_hment *sfhmep, *osfhmep;
4328         kmutex_t        *pml;
4329         tte_t           tte;
4330         page_t          *pp;
4331         vnode_t         *vp;
4332         u_offset_t      off;
4333         pfn_t           pfn;
4334         int             kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4335         int             locked = 0;
4336 
4337         /*
4338          * For KPM mappings, just return the physical address since we
4339          * don't need to register any callbacks.
4340          */
4341         if (IS_KPM_ADDR(vaddr)) {
4342                 uint64_t paddr;
4343                 SFMMU_KPM_VTOP(vaddr, paddr);
4344                 *rpfn = btop(paddr);
4345                 if (cookiep != NULL)
4346                         *cookiep = HAC_COOKIE_NONE;
4347                 return (0);
4348         }
4349 
4350         if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4351                 *rpfn = PFN_INVALID;
4352                 return (EINVAL);
4353         }
4354 
4355         if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4356                 *rpfn = PFN_INVALID;
4357                 return (ENOMEM);
4358         }
4359 
4360         sfhmep = &pahmep->sfment;
4361 
4362         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4363         eaddr = saddr + len;
4364 
4365 rehash:
4366         /* Find the mapping(s) for this page */
4367         for (hashno = TTE64K, hmeblkp = NULL;
4368             hmeblkp == NULL && hashno <= mmu_hashcnt;
4369             hashno++) {
4370                 hmeshift = HME_HASH_SHIFT(hashno);
4371                 hblktag.htag_id = ksfmmup;
4372                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4373                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4374                 hblktag.htag_rehash = hashno;
4375                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4376 
4377                 SFMMU_HASH_LOCK(hmebp);
4378 
4379                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4380 
4381                 if (hmeblkp == NULL)
4382                         SFMMU_HASH_UNLOCK(hmebp);
4383         }
4384 
4385         if (hmeblkp == NULL) {
4386                 kmem_cache_free(pa_hment_cache, pahmep);
4387                 *rpfn = PFN_INVALID;
4388                 return (ENXIO);
4389         }
4390 
4391         ASSERT(!hmeblkp->hblk_shared);
4392 
4393         HBLKTOHME(osfhmep, hmeblkp, saddr);
4394         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4395 
4396         if (!TTE_IS_VALID(&tte)) {
4397                 SFMMU_HASH_UNLOCK(hmebp);
4398                 kmem_cache_free(pa_hment_cache, pahmep);
4399                 *rpfn = PFN_INVALID;
4400                 return (ENXIO);
4401         }
4402 
4403         /*
4404          * Make sure the boundaries for the callback fall within this
4405          * single mapping.
4406          */
4407         baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4408         ASSERT(saddr >= baseaddr);
4409         if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4410                 SFMMU_HASH_UNLOCK(hmebp);
4411                 kmem_cache_free(pa_hment_cache, pahmep);
4412                 *rpfn = PFN_INVALID;
4413                 return (ERANGE);
4414         }
4415 
4416         pfn = sfmmu_ttetopfn(&tte, vaddr);
4417 
4418         /*
4419          * The pfn may not have a page_t underneath in which case we
4420          * just return it. This can happen if we are doing I/O to a
4421          * static portion of the kernel's address space, for instance.
4422          */
4423         pp = osfhmep->hme_page;
4424         if (pp == NULL) {
4425                 SFMMU_HASH_UNLOCK(hmebp);
4426                 kmem_cache_free(pa_hment_cache, pahmep);
4427                 *rpfn = pfn;
4428                 if (cookiep)
4429                         *cookiep = HAC_COOKIE_NONE;
4430                 return (0);
4431         }
4432         ASSERT(pp == PP_PAGEROOT(pp));
4433 
4434         vp = pp->p_vnode;
4435         off = pp->p_offset;
4436 
4437         pml = sfmmu_mlist_enter(pp);
4438 
4439         if (flags & HAC_PAGELOCK) {
4440                 if (!page_trylock(pp, SE_SHARED)) {
4441                         /*
4442                          * Somebody is holding SE_EXCL lock. Might
4443                          * even be hat_page_relocate(). Drop all
4444                          * our locks, lookup the page in &kvp, and
4445                          * retry. If it doesn't exist in &kvp and &zvp,
4446                          * then we must be dealing with a kernel mapped
4447                          * page which doesn't actually belong to
4448                          * segkmem so we punt.
4449                          */
4450                         sfmmu_mlist_exit(pml);
4451                         SFMMU_HASH_UNLOCK(hmebp);
4452                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4453 
4454                         /* check zvp before giving up */
4455                         if (pp == NULL)
4456                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4457                                     SE_SHARED);
4458 
4459                         /* Okay, we didn't find it, give up */
4460                         if (pp == NULL) {
4461                                 kmem_cache_free(pa_hment_cache, pahmep);
4462                                 *rpfn = pfn;
4463                                 if (cookiep)
4464                                         *cookiep = HAC_COOKIE_NONE;
4465                                 return (0);
4466                         }
4467                         page_unlock(pp);
4468                         goto rehash;
4469                 }
4470                 locked = 1;
4471         }
4472 
4473         if (!PAGE_LOCKED(pp) && !panicstr)
4474                 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4475 
4476         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4477             pp->p_offset != off) {
4478                 /*
4479                  * The page moved before we got our hands on it.  Drop
4480                  * all the locks and try again.
4481                  */
4482                 ASSERT((flags & HAC_PAGELOCK) != 0);
4483                 sfmmu_mlist_exit(pml);
4484                 SFMMU_HASH_UNLOCK(hmebp);
4485                 page_unlock(pp);
4486                 locked = 0;
4487                 goto rehash;
4488         }
4489 
4490         if (!VN_ISKAS(vp)) {
4491                 /*
4492                  * This is not a segkmem page but another page which
4493                  * has been kernel mapped. It had better have at least
4494                  * a share lock on it. Return the pfn.
4495                  */
4496                 sfmmu_mlist_exit(pml);
4497                 SFMMU_HASH_UNLOCK(hmebp);
4498                 if (locked)
4499                         page_unlock(pp);
4500                 kmem_cache_free(pa_hment_cache, pahmep);
4501                 ASSERT(PAGE_LOCKED(pp));
4502                 *rpfn = pfn;
4503                 if (cookiep)
4504                         *cookiep = HAC_COOKIE_NONE;
4505                 return (0);
4506         }
4507 
4508         /*
4509          * Setup this pa_hment and link its embedded dummy sf_hment into
4510          * the mapping list.
4511          */
4512         pp->p_share++;
4513         pahmep->cb_id = callback_id;
4514         pahmep->addr = vaddr;
4515         pahmep->len = len;
4516         pahmep->refcnt = 1;
4517         pahmep->flags = 0;
4518         pahmep->pvt = pvt;
4519 
4520         sfhmep->hme_tte.ll = 0;
4521         sfhmep->hme_data = pahmep;
4522         sfhmep->hme_prev = osfhmep;
4523         sfhmep->hme_next = osfhmep->hme_next;
4524 
4525         if (osfhmep->hme_next)
4526                 osfhmep->hme_next->hme_prev = sfhmep;
4527 
4528         osfhmep->hme_next = sfhmep;
4529 
4530         sfmmu_mlist_exit(pml);
4531         SFMMU_HASH_UNLOCK(hmebp);
4532 
4533         if (locked)
4534                 page_unlock(pp);
4535 
4536         *rpfn = pfn;
4537         if (cookiep)
4538                 *cookiep = (void *)pahmep;
4539 
4540         return (0);
4541 }
4542 
4543 /*
4544  * Remove the relocation callbacks from the specified addr/len.
4545  */
4546 void
4547 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4548         void *cookie)
4549 {
4550         struct          hmehash_bucket *hmebp;
4551         hmeblk_tag      hblktag;
4552         struct hme_blk  *hmeblkp;
4553         int             hmeshift, hashno;
4554         caddr_t         saddr;
4555         struct pa_hment *pahmep;
4556         struct sf_hment *sfhmep, *osfhmep;
4557         kmutex_t        *pml;
4558         tte_t           tte;
4559         page_t          *pp;
4560         vnode_t         *vp;
4561         u_offset_t      off;
4562         int             locked = 0;
4563 
4564         /*
4565          * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4566          * remove so just return.
4567          */
4568         if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4569                 return;
4570 
4571         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4572 
4573 rehash:
4574         /* Find the mapping(s) for this page */
4575         for (hashno = TTE64K, hmeblkp = NULL;
4576             hmeblkp == NULL && hashno <= mmu_hashcnt;
4577             hashno++) {
4578                 hmeshift = HME_HASH_SHIFT(hashno);
4579                 hblktag.htag_id = ksfmmup;
4580                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4581                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4582                 hblktag.htag_rehash = hashno;
4583                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4584 
4585                 SFMMU_HASH_LOCK(hmebp);
4586 
4587                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4588 
4589                 if (hmeblkp == NULL)
4590                         SFMMU_HASH_UNLOCK(hmebp);
4591         }
4592 
4593         if (hmeblkp == NULL)
4594                 return;
4595 
4596         ASSERT(!hmeblkp->hblk_shared);
4597 
4598         HBLKTOHME(osfhmep, hmeblkp, saddr);
4599 
4600         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4601         if (!TTE_IS_VALID(&tte)) {
4602                 SFMMU_HASH_UNLOCK(hmebp);
4603                 return;
4604         }
4605 
4606         pp = osfhmep->hme_page;
4607         if (pp == NULL) {
4608                 SFMMU_HASH_UNLOCK(hmebp);
4609                 ASSERT(cookie == NULL);
4610                 return;
4611         }
4612 
4613         vp = pp->p_vnode;
4614         off = pp->p_offset;
4615 
4616         pml = sfmmu_mlist_enter(pp);
4617 
4618         if (flags & HAC_PAGELOCK) {
4619                 if (!page_trylock(pp, SE_SHARED)) {
4620                         /*
4621                          * Somebody is holding SE_EXCL lock. Might
4622                          * even be hat_page_relocate(). Drop all
4623                          * our locks, lookup the page in &kvp, and
4624                          * retry. If it doesn't exist in &kvp and &zvp,
4625                          * then we must be dealing with a kernel mapped
4626                          * page which doesn't actually belong to
4627                          * segkmem so we punt.
4628                          */
4629                         sfmmu_mlist_exit(pml);
4630                         SFMMU_HASH_UNLOCK(hmebp);
4631                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4632                         /* check zvp before giving up */
4633                         if (pp == NULL)
4634                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4635                                     SE_SHARED);
4636 
4637                         if (pp == NULL) {
4638                                 ASSERT(cookie == NULL);
4639                                 return;
4640                         }
4641                         page_unlock(pp);
4642                         goto rehash;
4643                 }
4644                 locked = 1;
4645         }
4646 
4647         ASSERT(PAGE_LOCKED(pp));
4648 
4649         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4650             pp->p_offset != off) {
4651                 /*
4652                  * The page moved before we got our hands on it.  Drop
4653                  * all the locks and try again.
4654                  */
4655                 ASSERT((flags & HAC_PAGELOCK) != 0);
4656                 sfmmu_mlist_exit(pml);
4657                 SFMMU_HASH_UNLOCK(hmebp);
4658                 page_unlock(pp);
4659                 locked = 0;
4660                 goto rehash;
4661         }
4662 
4663         if (!VN_ISKAS(vp)) {
4664                 /*
4665                  * This is not a segkmem page but another page which
4666                  * has been kernel mapped.
4667                  */
4668                 sfmmu_mlist_exit(pml);
4669                 SFMMU_HASH_UNLOCK(hmebp);
4670                 if (locked)
4671                         page_unlock(pp);
4672                 ASSERT(cookie == NULL);
4673                 return;
4674         }
4675 
4676         if (cookie != NULL) {
4677                 pahmep = (struct pa_hment *)cookie;
4678                 sfhmep = &pahmep->sfment;
4679         } else {
4680                 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4681                     sfhmep = sfhmep->hme_next) {
4682 
4683                         /*
4684                          * skip va<->pa mappings
4685                          */
4686                         if (!IS_PAHME(sfhmep))
4687                                 continue;
4688 
4689                         pahmep = sfhmep->hme_data;
4690                         ASSERT(pahmep != NULL);
4691 
4692                         /*
4693                          * if pa_hment matches, remove it
4694                          */
4695                         if ((pahmep->pvt == pvt) &&
4696                             (pahmep->addr == vaddr) &&
4697                             (pahmep->len == len)) {
4698                                 break;
4699                         }
4700                 }
4701         }
4702 
4703         if (sfhmep == NULL) {
4704                 if (!panicstr) {
4705                         panic("hat_delete_callback: pa_hment not found, pp %p",
4706                             (void *)pp);
4707                 }
4708                 return;
4709         }
4710 
4711         /*
4712          * Note: at this point a valid kernel mapping must still be
4713          * present on this page.
4714          */
4715         pp->p_share--;
4716         if (pp->p_share <= 0)
4717                 panic("hat_delete_callback: zero p_share");
4718 
4719         if (--pahmep->refcnt == 0) {
4720                 if (pahmep->flags != 0)
4721                         panic("hat_delete_callback: pa_hment is busy");
4722 
4723                 /*
4724                  * Remove sfhmep from the mapping list for the page.
4725                  */
4726                 if (sfhmep->hme_prev) {
4727                         sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4728                 } else {
4729                         pp->p_mapping = sfhmep->hme_next;
4730                 }
4731 
4732                 if (sfhmep->hme_next)
4733                         sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4734 
4735                 sfmmu_mlist_exit(pml);
4736                 SFMMU_HASH_UNLOCK(hmebp);
4737 
4738                 if (locked)
4739                         page_unlock(pp);
4740 
4741                 kmem_cache_free(pa_hment_cache, pahmep);
4742                 return;
4743         }
4744 
4745         sfmmu_mlist_exit(pml);
4746         SFMMU_HASH_UNLOCK(hmebp);
4747         if (locked)
4748                 page_unlock(pp);
4749 }
4750 
4751 /*
4752  * hat_probe returns 1 if the translation for the address 'addr' is
4753  * loaded, zero otherwise.
4754  *
4755  * hat_probe should be used only for advisorary purposes because it may
4756  * occasionally return the wrong value. The implementation must guarantee that
4757  * returning the wrong value is a very rare event. hat_probe is used
4758  * to implement optimizations in the segment drivers.
4759  *
4760  */
4761 int
4762 hat_probe(struct hat *sfmmup, caddr_t addr)
4763 {
4764         pfn_t pfn;
4765         tte_t tte;
4766 
4767         ASSERT(sfmmup != NULL);
4768         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4769 
4770         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4771 
4772         if (sfmmup == ksfmmup) {
4773                 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4774                     == PFN_SUSPENDED) {
4775                         sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4776                 }
4777         } else {
4778                 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4779         }
4780 
4781         if (pfn != PFN_INVALID)
4782                 return (1);
4783         else
4784                 return (0);
4785 }
4786 
4787 ssize_t
4788 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4789 {
4790         tte_t tte;
4791 
4792         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4793 
4794         if (sfmmup == ksfmmup) {
4795                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4796                         return (-1);
4797                 }
4798         } else {
4799                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4800                         return (-1);
4801                 }
4802         }
4803 
4804         ASSERT(TTE_IS_VALID(&tte));
4805         return (TTEBYTES(TTE_CSZ(&tte)));
4806 }
4807 
4808 uint_t
4809 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4810 {
4811         tte_t tte;
4812 
4813         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4814 
4815         if (sfmmup == ksfmmup) {
4816                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4817                         tte.ll = 0;
4818                 }
4819         } else {
4820                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4821                         tte.ll = 0;
4822                 }
4823         }
4824         if (TTE_IS_VALID(&tte)) {
4825                 *attr = sfmmu_ptov_attr(&tte);
4826                 return (0);
4827         }
4828         *attr = 0;
4829         return ((uint_t)0xffffffff);
4830 }
4831 
4832 /*
4833  * Enables more attributes on specified address range (ie. logical OR)
4834  */
4835 void
4836 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4837 {
4838         if (hat->sfmmu_xhat_provider) {
4839                 XHAT_SETATTR(hat, addr, len, attr);
4840                 return;
4841         } else {
4842                 /*
4843                  * This must be a CPU HAT. If the address space has
4844                  * XHATs attached, change attributes for all of them,
4845                  * just in case
4846                  */
4847                 ASSERT(hat->sfmmu_as != NULL);
4848                 if (hat->sfmmu_as->a_xhat != NULL)
4849                         xhat_setattr_all(hat->sfmmu_as, addr, len, attr);
4850         }
4851 
4852         sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4853 }
4854 
4855 /*
4856  * Assigns attributes to the specified address range.  All the attributes
4857  * are specified.
4858  */
4859 void
4860 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4861 {
4862         if (hat->sfmmu_xhat_provider) {
4863                 XHAT_CHGATTR(hat, addr, len, attr);
4864                 return;
4865         } else {
4866                 /*
4867                  * This must be a CPU HAT. If the address space has
4868                  * XHATs attached, change attributes for all of them,
4869                  * just in case
4870                  */
4871                 ASSERT(hat->sfmmu_as != NULL);
4872                 if (hat->sfmmu_as->a_xhat != NULL)
4873                         xhat_chgattr_all(hat->sfmmu_as, addr, len, attr);
4874         }
4875 
4876         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4877 }
4878 
4879 /*
4880  * Remove attributes on the specified address range (ie. loginal NAND)
4881  */
4882 void
4883 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4884 {
4885         if (hat->sfmmu_xhat_provider) {
4886                 XHAT_CLRATTR(hat, addr, len, attr);
4887                 return;
4888         } else {
4889                 /*
4890                  * This must be a CPU HAT. If the address space has
4891                  * XHATs attached, change attributes for all of them,
4892                  * just in case
4893                  */
4894                 ASSERT(hat->sfmmu_as != NULL);
4895                 if (hat->sfmmu_as->a_xhat != NULL)
4896                         xhat_clrattr_all(hat->sfmmu_as, addr, len, attr);
4897         }
4898 
4899         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4900 }
4901 
4902 /*
4903  * Change attributes on an address range to that specified by attr and mode.
4904  */
4905 static void
4906 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4907         int mode)
4908 {
4909         struct hmehash_bucket *hmebp;
4910         hmeblk_tag hblktag;
4911         int hmeshift, hashno = 1;
4912         struct hme_blk *hmeblkp, *list = NULL;
4913         caddr_t endaddr;
4914         cpuset_t cpuset;
4915         demap_range_t dmr;
4916 
4917         CPUSET_ZERO(cpuset);
4918 
4919         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4920         ASSERT((len & MMU_PAGEOFFSET) == 0);
4921         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4922 
4923         if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4924             ((addr + len) > (caddr_t)USERLIMIT)) {
4925                 panic("user addr %p in kernel space",
4926                     (void *)addr);
4927         }
4928 
4929         endaddr = addr + len;
4930         hblktag.htag_id = sfmmup;
4931         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4932         DEMAP_RANGE_INIT(sfmmup, &dmr);
4933 
4934         while (addr < endaddr) {
4935                 hmeshift = HME_HASH_SHIFT(hashno);
4936                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4937                 hblktag.htag_rehash = hashno;
4938                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4939 
4940                 SFMMU_HASH_LOCK(hmebp);
4941 
4942                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4943                 if (hmeblkp != NULL) {
4944                         ASSERT(!hmeblkp->hblk_shared);
4945                         /*
4946                          * We've encountered a shadow hmeblk so skip the range
4947                          * of the next smaller mapping size.
4948                          */
4949                         if (hmeblkp->hblk_shw_bit) {
4950                                 ASSERT(sfmmup != ksfmmup);
4951                                 ASSERT(hashno > 1);
4952                                 addr = (caddr_t)P2END((uintptr_t)addr,
4953                                     TTEBYTES(hashno - 1));
4954                         } else {
4955                                 addr = sfmmu_hblk_chgattr(sfmmup,
4956                                     hmeblkp, addr, endaddr, &dmr, attr, mode);
4957                         }
4958                         SFMMU_HASH_UNLOCK(hmebp);
4959                         hashno = 1;
4960                         continue;
4961                 }
4962                 SFMMU_HASH_UNLOCK(hmebp);
4963 
4964                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4965                         /*
4966                          * We have traversed the whole list and rehashed
4967                          * if necessary without finding the address to chgattr.
4968                          * This is ok, so we increment the address by the
4969                          * smallest hmeblk range for kernel mappings or for
4970                          * user mappings with no large pages, and the largest
4971                          * hmeblk range, to account for shadow hmeblks, for
4972                          * user mappings with large pages and continue.
4973                          */
4974                         if (sfmmup == ksfmmup)
4975                                 addr = (caddr_t)P2END((uintptr_t)addr,
4976                                     TTEBYTES(1));
4977                         else
4978                                 addr = (caddr_t)P2END((uintptr_t)addr,
4979                                     TTEBYTES(hashno));
4980                         hashno = 1;
4981                 } else {
4982                         hashno++;
4983                 }
4984         }
4985 
4986         sfmmu_hblks_list_purge(&list, 0);
4987         DEMAP_RANGE_FLUSH(&dmr);
4988         cpuset = sfmmup->sfmmu_cpusran;
4989         xt_sync(cpuset);
4990 }
4991 
4992 /*
4993  * This function chgattr on a range of addresses in an hmeblk.  It returns the
4994  * next addres that needs to be chgattr.
4995  * It should be called with the hash lock held.
4996  * XXX It should be possible to optimize chgattr by not flushing every time but
4997  * on the other hand:
4998  * 1. do one flush crosscall.
4999  * 2. only flush if we are increasing permissions (make sure this will work)
5000  */
5001 static caddr_t
5002 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5003         caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
5004 {
5005         tte_t tte, tteattr, tteflags, ttemod;
5006         struct sf_hment *sfhmep;
5007         int ttesz;
5008         struct page *pp = NULL;
5009         kmutex_t *pml, *pmtx;
5010         int ret;
5011         int use_demap_range;
5012 #if defined(SF_ERRATA_57)
5013         int check_exec;
5014 #endif
5015 
5016         ASSERT(in_hblk_range(hmeblkp, addr));
5017         ASSERT(hmeblkp->hblk_shw_bit == 0);
5018         ASSERT(!hmeblkp->hblk_shared);
5019 
5020         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5021         ttesz = get_hblk_ttesz(hmeblkp);
5022 
5023         /*
5024          * Flush the current demap region if addresses have been
5025          * skipped or the page size doesn't match.
5026          */
5027         use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
5028         if (use_demap_range) {
5029                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5030         } else if (dmrp != NULL) {
5031                 DEMAP_RANGE_FLUSH(dmrp);
5032         }
5033 
5034         tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
5035 #if defined(SF_ERRATA_57)
5036         check_exec = (sfmmup != ksfmmup) &&
5037             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5038             TTE_IS_EXECUTABLE(&tteattr);
5039 #endif
5040         HBLKTOHME(sfhmep, hmeblkp, addr);
5041         while (addr < endaddr) {
5042                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5043                 if (TTE_IS_VALID(&tte)) {
5044                         if ((tte.ll & tteflags.ll) == tteattr.ll) {
5045                                 /*
5046                                  * if the new attr is the same as old
5047                                  * continue
5048                                  */
5049                                 goto next_addr;
5050                         }
5051                         if (!TTE_IS_WRITABLE(&tteattr)) {
5052                                 /*
5053                                  * make sure we clear hw modify bit if we
5054                                  * removing write protections
5055                                  */
5056                                 tteflags.tte_intlo |= TTE_HWWR_INT;
5057                         }
5058 
5059                         pml = NULL;
5060                         pp = sfhmep->hme_page;
5061                         if (pp) {
5062                                 pml = sfmmu_mlist_enter(pp);
5063                         }
5064 
5065                         if (pp != sfhmep->hme_page) {
5066                                 /*
5067                                  * tte must have been unloaded.
5068                                  */
5069                                 ASSERT(pml);
5070                                 sfmmu_mlist_exit(pml);
5071                                 continue;
5072                         }
5073 
5074                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5075 
5076                         ttemod = tte;
5077                         ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5078                         ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5079 
5080 #if defined(SF_ERRATA_57)
5081                         if (check_exec && addr < errata57_limit)
5082                                 ttemod.tte_exec_perm = 0;
5083 #endif
5084                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5085                             &sfhmep->hme_tte);
5086 
5087                         if (ret < 0) {
5088                                 /* tte changed underneath us */
5089                                 if (pml) {
5090                                         sfmmu_mlist_exit(pml);
5091                                 }
5092                                 continue;
5093                         }
5094 
5095                         if (tteflags.tte_intlo & TTE_HWWR_INT) {
5096                                 /*
5097                                  * need to sync if we are clearing modify bit.
5098                                  */
5099                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5100                         }
5101 
5102                         if (pp && PP_ISRO(pp)) {
5103                                 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5104                                         pmtx = sfmmu_page_enter(pp);
5105                                         PP_CLRRO(pp);
5106                                         sfmmu_page_exit(pmtx);
5107                                 }
5108                         }
5109 
5110                         if (ret > 0 && use_demap_range) {
5111                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5112                         } else if (ret > 0) {
5113                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5114                         }
5115 
5116                         if (pml) {
5117                                 sfmmu_mlist_exit(pml);
5118                         }
5119                 }
5120 next_addr:
5121                 addr += TTEBYTES(ttesz);
5122                 sfhmep++;
5123                 DEMAP_RANGE_NEXTPG(dmrp);
5124         }
5125         return (addr);
5126 }
5127 
5128 /*
5129  * This routine converts virtual attributes to physical ones.  It will
5130  * update the tteflags field with the tte mask corresponding to the attributes
5131  * affected and it returns the new attributes.  It will also clear the modify
5132  * bit if we are taking away write permission.  This is necessary since the
5133  * modify bit is the hardware permission bit and we need to clear it in order
5134  * to detect write faults.
5135  */
5136 static uint64_t
5137 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5138 {
5139         tte_t ttevalue;
5140 
5141         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5142 
5143         switch (mode) {
5144         case SFMMU_CHGATTR:
5145                 /* all attributes specified */
5146                 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5147                 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5148                 ttemaskp->tte_inthi = TTEINTHI_ATTR;
5149                 ttemaskp->tte_intlo = TTEINTLO_ATTR;
5150                 break;
5151         case SFMMU_SETATTR:
5152                 ASSERT(!(attr & ~HAT_PROT_MASK));
5153                 ttemaskp->ll = 0;
5154                 ttevalue.ll = 0;
5155                 /*
5156                  * a valid tte implies exec and read for sfmmu
5157                  * so no need to do anything about them.
5158                  * since priviledged access implies user access
5159                  * PROT_USER doesn't make sense either.
5160                  */
5161                 if (attr & PROT_WRITE) {
5162                         ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5163                         ttevalue.tte_intlo |= TTE_WRPRM_INT;
5164                 }
5165                 break;
5166         case SFMMU_CLRATTR:
5167                 /* attributes will be nand with current ones */
5168                 if (attr & ~(PROT_WRITE | PROT_USER)) {
5169                         panic("sfmmu: attr %x not supported", attr);
5170                 }
5171                 ttemaskp->ll = 0;
5172                 ttevalue.ll = 0;
5173                 if (attr & PROT_WRITE) {
5174                         /* clear both writable and modify bit */
5175                         ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5176                 }
5177                 if (attr & PROT_USER) {
5178                         ttemaskp->tte_intlo |= TTE_PRIV_INT;
5179                         ttevalue.tte_intlo |= TTE_PRIV_INT;
5180                 }
5181                 break;
5182         default:
5183                 panic("sfmmu_vtop_attr: bad mode %x", mode);
5184         }
5185         ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5186         return (ttevalue.ll);
5187 }
5188 
5189 static uint_t
5190 sfmmu_ptov_attr(tte_t *ttep)
5191 {
5192         uint_t attr;
5193 
5194         ASSERT(TTE_IS_VALID(ttep));
5195 
5196         attr = PROT_READ;
5197 
5198         if (TTE_IS_WRITABLE(ttep)) {
5199                 attr |= PROT_WRITE;
5200         }
5201         if (TTE_IS_EXECUTABLE(ttep)) {
5202                 attr |= PROT_EXEC;
5203         }
5204         if (!TTE_IS_PRIVILEGED(ttep)) {
5205                 attr |= PROT_USER;
5206         }
5207         if (TTE_IS_NFO(ttep)) {
5208                 attr |= HAT_NOFAULT;
5209         }
5210         if (TTE_IS_NOSYNC(ttep)) {
5211                 attr |= HAT_NOSYNC;
5212         }
5213         if (TTE_IS_SIDEFFECT(ttep)) {
5214                 attr |= SFMMU_SIDEFFECT;
5215         }
5216         if (!TTE_IS_VCACHEABLE(ttep)) {
5217                 attr |= SFMMU_UNCACHEVTTE;
5218         }
5219         if (!TTE_IS_PCACHEABLE(ttep)) {
5220                 attr |= SFMMU_UNCACHEPTTE;
5221         }
5222         return (attr);
5223 }
5224 
5225 /*
5226  * hat_chgprot is a deprecated hat call.  New segment drivers
5227  * should store all attributes and use hat_*attr calls.
5228  *
5229  * Change the protections in the virtual address range
5230  * given to the specified virtual protection.  If vprot is ~PROT_WRITE,
5231  * then remove write permission, leaving the other
5232  * permissions unchanged.  If vprot is ~PROT_USER, remove user permissions.
5233  *
5234  */
5235 void
5236 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5237 {
5238         struct hmehash_bucket *hmebp;
5239         hmeblk_tag hblktag;
5240         int hmeshift, hashno = 1;
5241         struct hme_blk *hmeblkp, *list = NULL;
5242         caddr_t endaddr;
5243         cpuset_t cpuset;
5244         demap_range_t dmr;
5245 
5246         ASSERT((len & MMU_PAGEOFFSET) == 0);
5247         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5248 
5249         if (sfmmup->sfmmu_xhat_provider) {
5250                 XHAT_CHGPROT(sfmmup, addr, len, vprot);
5251                 return;
5252         } else {
5253                 /*
5254                  * This must be a CPU HAT. If the address space has
5255                  * XHATs attached, change attributes for all of them,
5256                  * just in case
5257                  */
5258                 ASSERT(sfmmup->sfmmu_as != NULL);
5259                 if (sfmmup->sfmmu_as->a_xhat != NULL)
5260                         xhat_chgprot_all(sfmmup->sfmmu_as, addr, len, vprot);
5261         }
5262 
5263         CPUSET_ZERO(cpuset);
5264 
5265         if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5266             ((addr + len) > (caddr_t)USERLIMIT)) {
5267                 panic("user addr %p vprot %x in kernel space",
5268                     (void *)addr, vprot);
5269         }
5270         endaddr = addr + len;
5271         hblktag.htag_id = sfmmup;
5272         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5273         DEMAP_RANGE_INIT(sfmmup, &dmr);
5274 
5275         while (addr < endaddr) {
5276                 hmeshift = HME_HASH_SHIFT(hashno);
5277                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5278                 hblktag.htag_rehash = hashno;
5279                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5280 
5281                 SFMMU_HASH_LOCK(hmebp);
5282 
5283                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5284                 if (hmeblkp != NULL) {
5285                         ASSERT(!hmeblkp->hblk_shared);
5286                         /*
5287                          * We've encountered a shadow hmeblk so skip the range
5288                          * of the next smaller mapping size.
5289                          */
5290                         if (hmeblkp->hblk_shw_bit) {
5291                                 ASSERT(sfmmup != ksfmmup);
5292                                 ASSERT(hashno > 1);
5293                                 addr = (caddr_t)P2END((uintptr_t)addr,
5294                                     TTEBYTES(hashno - 1));
5295                         } else {
5296                                 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5297                                     addr, endaddr, &dmr, vprot);
5298                         }
5299                         SFMMU_HASH_UNLOCK(hmebp);
5300                         hashno = 1;
5301                         continue;
5302                 }
5303                 SFMMU_HASH_UNLOCK(hmebp);
5304 
5305                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5306                         /*
5307                          * We have traversed the whole list and rehashed
5308                          * if necessary without finding the address to chgprot.
5309                          * This is ok so we increment the address by the
5310                          * smallest hmeblk range for kernel mappings and the
5311                          * largest hmeblk range, to account for shadow hmeblks,
5312                          * for user mappings and continue.
5313                          */
5314                         if (sfmmup == ksfmmup)
5315                                 addr = (caddr_t)P2END((uintptr_t)addr,
5316                                     TTEBYTES(1));
5317                         else
5318                                 addr = (caddr_t)P2END((uintptr_t)addr,
5319                                     TTEBYTES(hashno));
5320                         hashno = 1;
5321                 } else {
5322                         hashno++;
5323                 }
5324         }
5325 
5326         sfmmu_hblks_list_purge(&list, 0);
5327         DEMAP_RANGE_FLUSH(&dmr);
5328         cpuset = sfmmup->sfmmu_cpusran;
5329         xt_sync(cpuset);
5330 }
5331 
5332 /*
5333  * This function chgprots a range of addresses in an hmeblk.  It returns the
5334  * next addres that needs to be chgprot.
5335  * It should be called with the hash lock held.
5336  * XXX It shold be possible to optimize chgprot by not flushing every time but
5337  * on the other hand:
5338  * 1. do one flush crosscall.
5339  * 2. only flush if we are increasing permissions (make sure this will work)
5340  */
5341 static caddr_t
5342 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5343         caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5344 {
5345         uint_t pprot;
5346         tte_t tte, ttemod;
5347         struct sf_hment *sfhmep;
5348         uint_t tteflags;
5349         int ttesz;
5350         struct page *pp = NULL;
5351         kmutex_t *pml, *pmtx;
5352         int ret;
5353         int use_demap_range;
5354 #if defined(SF_ERRATA_57)
5355         int check_exec;
5356 #endif
5357 
5358         ASSERT(in_hblk_range(hmeblkp, addr));
5359         ASSERT(hmeblkp->hblk_shw_bit == 0);
5360         ASSERT(!hmeblkp->hblk_shared);
5361 
5362 #ifdef DEBUG
5363         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5364             (endaddr < get_hblk_endaddr(hmeblkp))) {
5365                 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5366         }
5367 #endif /* DEBUG */
5368 
5369         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5370         ttesz = get_hblk_ttesz(hmeblkp);
5371 
5372         pprot = sfmmu_vtop_prot(vprot, &tteflags);
5373 #if defined(SF_ERRATA_57)
5374         check_exec = (sfmmup != ksfmmup) &&
5375             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5376             ((vprot & PROT_EXEC) == PROT_EXEC);
5377 #endif
5378         HBLKTOHME(sfhmep, hmeblkp, addr);
5379 
5380         /*
5381          * Flush the current demap region if addresses have been
5382          * skipped or the page size doesn't match.
5383          */
5384         use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5385         if (use_demap_range) {
5386                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5387         } else if (dmrp != NULL) {
5388                 DEMAP_RANGE_FLUSH(dmrp);
5389         }
5390 
5391         while (addr < endaddr) {
5392                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5393                 if (TTE_IS_VALID(&tte)) {
5394                         if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5395                                 /*
5396                                  * if the new protection is the same as old
5397                                  * continue
5398                                  */
5399                                 goto next_addr;
5400                         }
5401                         pml = NULL;
5402                         pp = sfhmep->hme_page;
5403                         if (pp) {
5404                                 pml = sfmmu_mlist_enter(pp);
5405                         }
5406                         if (pp != sfhmep->hme_page) {
5407                                 /*
5408                                  * tte most have been unloaded
5409                                  * underneath us.  Recheck
5410                                  */
5411                                 ASSERT(pml);
5412                                 sfmmu_mlist_exit(pml);
5413                                 continue;
5414                         }
5415 
5416                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5417 
5418                         ttemod = tte;
5419                         TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5420 #if defined(SF_ERRATA_57)
5421                         if (check_exec && addr < errata57_limit)
5422                                 ttemod.tte_exec_perm = 0;
5423 #endif
5424                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5425                             &sfhmep->hme_tte);
5426 
5427                         if (ret < 0) {
5428                                 /* tte changed underneath us */
5429                                 if (pml) {
5430                                         sfmmu_mlist_exit(pml);
5431                                 }
5432                                 continue;
5433                         }
5434 
5435                         if (tteflags & TTE_HWWR_INT) {
5436                                 /*
5437                                  * need to sync if we are clearing modify bit.
5438                                  */
5439                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5440                         }
5441 
5442                         if (pp && PP_ISRO(pp)) {
5443                                 if (pprot & TTE_WRPRM_INT) {
5444                                         pmtx = sfmmu_page_enter(pp);
5445                                         PP_CLRRO(pp);
5446                                         sfmmu_page_exit(pmtx);
5447                                 }
5448                         }
5449 
5450                         if (ret > 0 && use_demap_range) {
5451                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5452                         } else if (ret > 0) {
5453                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5454                         }
5455 
5456                         if (pml) {
5457                                 sfmmu_mlist_exit(pml);
5458                         }
5459                 }
5460 next_addr:
5461                 addr += TTEBYTES(ttesz);
5462                 sfhmep++;
5463                 DEMAP_RANGE_NEXTPG(dmrp);
5464         }
5465         return (addr);
5466 }
5467 
5468 /*
5469  * This routine is deprecated and should only be used by hat_chgprot.
5470  * The correct routine is sfmmu_vtop_attr.
5471  * This routine converts virtual page protections to physical ones.  It will
5472  * update the tteflags field with the tte mask corresponding to the protections
5473  * affected and it returns the new protections.  It will also clear the modify
5474  * bit if we are taking away write permission.  This is necessary since the
5475  * modify bit is the hardware permission bit and we need to clear it in order
5476  * to detect write faults.
5477  * It accepts the following special protections:
5478  * ~PROT_WRITE = remove write permissions.
5479  * ~PROT_USER = remove user permissions.
5480  */
5481 static uint_t
5482 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5483 {
5484         if (vprot == (uint_t)~PROT_WRITE) {
5485                 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5486                 return (0);             /* will cause wrprm to be cleared */
5487         }
5488         if (vprot == (uint_t)~PROT_USER) {
5489                 *tteflagsp = TTE_PRIV_INT;
5490                 return (0);             /* will cause privprm to be cleared */
5491         }
5492         if ((vprot == 0) || (vprot == PROT_USER) ||
5493             ((vprot & PROT_ALL) != vprot)) {
5494                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5495         }
5496 
5497         switch (vprot) {
5498         case (PROT_READ):
5499         case (PROT_EXEC):
5500         case (PROT_EXEC | PROT_READ):
5501                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5502                 return (TTE_PRIV_INT);          /* set prv and clr wrt */
5503         case (PROT_WRITE):
5504         case (PROT_WRITE | PROT_READ):
5505         case (PROT_EXEC | PROT_WRITE):
5506         case (PROT_EXEC | PROT_WRITE | PROT_READ):
5507                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5508                 return (TTE_PRIV_INT | TTE_WRPRM_INT);  /* set prv and wrt */
5509         case (PROT_USER | PROT_READ):
5510         case (PROT_USER | PROT_EXEC):
5511         case (PROT_USER | PROT_EXEC | PROT_READ):
5512                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5513                 return (0);                     /* clr prv and wrt */
5514         case (PROT_USER | PROT_WRITE):
5515         case (PROT_USER | PROT_WRITE | PROT_READ):
5516         case (PROT_USER | PROT_EXEC | PROT_WRITE):
5517         case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5518                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5519                 return (TTE_WRPRM_INT);         /* clr prv and set wrt */
5520         default:
5521                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5522         }
5523         return (0);
5524 }
5525 
5526 /*
5527  * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5528  * the normal algorithm would take too long for a very large VA range with
5529  * few real mappings. This routine just walks thru all HMEs in the global
5530  * hash table to find and remove mappings.
5531  */
5532 static void
5533 hat_unload_large_virtual(
5534         struct hat              *sfmmup,
5535         caddr_t                 startaddr,
5536         size_t                  len,
5537         uint_t                  flags,
5538         hat_callback_t          *callback)
5539 {
5540         struct hmehash_bucket *hmebp;
5541         struct hme_blk *hmeblkp;
5542         struct hme_blk *pr_hblk = NULL;
5543         struct hme_blk *nx_hblk;
5544         struct hme_blk *list = NULL;
5545         int i;
5546         demap_range_t dmr, *dmrp;
5547         cpuset_t cpuset;
5548         caddr_t endaddr = startaddr + len;
5549         caddr_t sa;
5550         caddr_t ea;
5551         caddr_t cb_sa[MAX_CB_ADDR];
5552         caddr_t cb_ea[MAX_CB_ADDR];
5553         int     addr_cnt = 0;
5554         int     a = 0;
5555 
5556         if (sfmmup->sfmmu_free) {
5557                 dmrp = NULL;
5558         } else {
5559                 dmrp = &dmr;
5560                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5561         }
5562 
5563         /*
5564          * Loop through all the hash buckets of HME blocks looking for matches.
5565          */
5566         for (i = 0; i <= UHMEHASH_SZ; i++) {
5567                 hmebp = &uhme_hash[i];
5568                 SFMMU_HASH_LOCK(hmebp);
5569                 hmeblkp = hmebp->hmeblkp;
5570                 pr_hblk = NULL;
5571                 while (hmeblkp) {
5572                         nx_hblk = hmeblkp->hblk_next;
5573 
5574                         /*
5575                          * skip if not this context, if a shadow block or
5576                          * if the mapping is not in the requested range
5577                          */
5578                         if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5579                             hmeblkp->hblk_shw_bit ||
5580                             (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5581                             (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5582                                 pr_hblk = hmeblkp;
5583                                 goto next_block;
5584                         }
5585 
5586                         ASSERT(!hmeblkp->hblk_shared);
5587                         /*
5588                          * unload if there are any current valid mappings
5589                          */
5590                         if (hmeblkp->hblk_vcnt != 0 ||
5591                             hmeblkp->hblk_hmecnt != 0)
5592                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5593                                     sa, ea, dmrp, flags);
5594 
5595                         /*
5596                          * on unmap we also release the HME block itself, once
5597                          * all mappings are gone.
5598                          */
5599                         if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5600                             !hmeblkp->hblk_vcnt &&
5601                             !hmeblkp->hblk_hmecnt) {
5602                                 ASSERT(!hmeblkp->hblk_lckcnt);
5603                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5604                                     &list, 0);
5605                         } else {
5606                                 pr_hblk = hmeblkp;
5607                         }
5608 
5609                         if (callback == NULL)
5610                                 goto next_block;
5611 
5612                         /*
5613                          * HME blocks may span more than one page, but we may be
5614                          * unmapping only one page, so check for a smaller range
5615                          * for the callback
5616                          */
5617                         if (sa < startaddr)
5618                                 sa = startaddr;
5619                         if (--ea > endaddr)
5620                                 ea = endaddr - 1;
5621 
5622                         cb_sa[addr_cnt] = sa;
5623                         cb_ea[addr_cnt] = ea;
5624                         if (++addr_cnt == MAX_CB_ADDR) {
5625                                 if (dmrp != NULL) {
5626                                         DEMAP_RANGE_FLUSH(dmrp);
5627                                         cpuset = sfmmup->sfmmu_cpusran;
5628                                         xt_sync(cpuset);
5629                                 }
5630 
5631                                 for (a = 0; a < MAX_CB_ADDR; ++a) {
5632                                         callback->hcb_start_addr = cb_sa[a];
5633                                         callback->hcb_end_addr = cb_ea[a];
5634                                         callback->hcb_function(callback);
5635                                 }
5636                                 addr_cnt = 0;
5637                         }
5638 
5639 next_block:
5640                         hmeblkp = nx_hblk;
5641                 }
5642                 SFMMU_HASH_UNLOCK(hmebp);
5643         }
5644 
5645         sfmmu_hblks_list_purge(&list, 0);
5646         if (dmrp != NULL) {
5647                 DEMAP_RANGE_FLUSH(dmrp);
5648                 cpuset = sfmmup->sfmmu_cpusran;
5649                 xt_sync(cpuset);
5650         }
5651 
5652         for (a = 0; a < addr_cnt; ++a) {
5653                 callback->hcb_start_addr = cb_sa[a];
5654                 callback->hcb_end_addr = cb_ea[a];
5655                 callback->hcb_function(callback);
5656         }
5657 
5658         /*
5659          * Check TSB and TLB page sizes if the process isn't exiting.
5660          */
5661         if (!sfmmup->sfmmu_free)
5662                 sfmmu_check_page_sizes(sfmmup, 0);
5663 }
5664 
5665 /*
5666  * Unload all the mappings in the range [addr..addr+len). addr and len must
5667  * be MMU_PAGESIZE aligned.
5668  */
5669 
5670 extern struct seg *segkmap;
5671 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5672 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5673 
5674 
5675 void
5676 hat_unload_callback(
5677         struct hat *sfmmup,
5678         caddr_t addr,
5679         size_t len,
5680         uint_t flags,
5681         hat_callback_t *callback)
5682 {
5683         struct hmehash_bucket *hmebp;
5684         hmeblk_tag hblktag;
5685         int hmeshift, hashno, iskernel;
5686         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5687         caddr_t endaddr;
5688         cpuset_t cpuset;
5689         int addr_count = 0;
5690         int a;
5691         caddr_t cb_start_addr[MAX_CB_ADDR];
5692         caddr_t cb_end_addr[MAX_CB_ADDR];
5693         int issegkmap = ISSEGKMAP(sfmmup, addr);
5694         demap_range_t dmr, *dmrp;
5695 
5696         if (sfmmup->sfmmu_xhat_provider) {
5697                 XHAT_UNLOAD_CALLBACK(sfmmup, addr, len, flags, callback);
5698                 return;
5699         } else {
5700                 /*
5701                  * This must be a CPU HAT. If the address space has
5702                  * XHATs attached, unload the mappings for all of them,
5703                  * just in case
5704                  */
5705                 ASSERT(sfmmup->sfmmu_as != NULL);
5706                 if (sfmmup->sfmmu_as->a_xhat != NULL)
5707                         xhat_unload_callback_all(sfmmup->sfmmu_as, addr,
5708                             len, flags, callback);
5709         }
5710 
5711         ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5712             AS_LOCK_HELD(sfmmup->sfmmu_as));
5713 
5714         ASSERT(sfmmup != NULL);
5715         ASSERT((len & MMU_PAGEOFFSET) == 0);
5716         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5717 
5718         /*
5719          * Probing through a large VA range (say 63 bits) will be slow, even
5720          * at 4 Meg steps between the probes. So, when the virtual address range
5721          * is very large, search the HME entries for what to unload.
5722          *
5723          *      len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5724          *
5725          *      UHMEHASH_SZ is number of hash buckets to examine
5726          *
5727          */
5728         if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5729                 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5730                 return;
5731         }
5732 
5733         CPUSET_ZERO(cpuset);
5734 
5735         /*
5736          * If the process is exiting, we can save a lot of fuss since
5737          * we'll flush the TLB when we free the ctx anyway.
5738          */
5739         if (sfmmup->sfmmu_free) {
5740                 dmrp = NULL;
5741         } else {
5742                 dmrp = &dmr;
5743                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5744         }
5745 
5746         endaddr = addr + len;
5747         hblktag.htag_id = sfmmup;
5748         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5749 
5750         /*
5751          * It is likely for the vm to call unload over a wide range of
5752          * addresses that are actually very sparsely populated by
5753          * translations.  In order to speed this up the sfmmu hat supports
5754          * the concept of shadow hmeblks. Dummy large page hmeblks that
5755          * correspond to actual small translations are allocated at tteload
5756          * time and are referred to as shadow hmeblks.  Now, during unload
5757          * time, we first check if we have a shadow hmeblk for that
5758          * translation.  The absence of one means the corresponding address
5759          * range is empty and can be skipped.
5760          *
5761          * The kernel is an exception to above statement and that is why
5762          * we don't use shadow hmeblks and hash starting from the smallest
5763          * page size.
5764          */
5765         if (sfmmup == KHATID) {
5766                 iskernel = 1;
5767                 hashno = TTE64K;
5768         } else {
5769                 iskernel = 0;
5770                 if (mmu_page_sizes == max_mmu_page_sizes) {
5771                         hashno = TTE256M;
5772                 } else {
5773                         hashno = TTE4M;
5774                 }
5775         }
5776         while (addr < endaddr) {
5777                 hmeshift = HME_HASH_SHIFT(hashno);
5778                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5779                 hblktag.htag_rehash = hashno;
5780                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5781 
5782                 SFMMU_HASH_LOCK(hmebp);
5783 
5784                 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5785                 if (hmeblkp == NULL) {
5786                         /*
5787                          * didn't find an hmeblk. skip the appropiate
5788                          * address range.
5789                          */
5790                         SFMMU_HASH_UNLOCK(hmebp);
5791                         if (iskernel) {
5792                                 if (hashno < mmu_hashcnt) {
5793                                         hashno++;
5794                                         continue;
5795                                 } else {
5796                                         hashno = TTE64K;
5797                                         addr = (caddr_t)roundup((uintptr_t)addr
5798                                             + 1, MMU_PAGESIZE64K);
5799                                         continue;
5800                                 }
5801                         }
5802                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5803                             (1 << hmeshift));
5804                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5805                                 ASSERT(hashno == TTE64K);
5806                                 continue;
5807                         }
5808                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5809                                 hashno = TTE512K;
5810                                 continue;
5811                         }
5812                         if (mmu_page_sizes == max_mmu_page_sizes) {
5813                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5814                                         hashno = TTE4M;
5815                                         continue;
5816                                 }
5817                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5818                                         hashno = TTE32M;
5819                                         continue;
5820                                 }
5821                                 hashno = TTE256M;
5822                                 continue;
5823                         } else {
5824                                 hashno = TTE4M;
5825                                 continue;
5826                         }
5827                 }
5828                 ASSERT(hmeblkp);
5829                 ASSERT(!hmeblkp->hblk_shared);
5830                 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5831                         /*
5832                          * If the valid count is zero we can skip the range
5833                          * mapped by this hmeblk.
5834                          * We free hblks in the case of HAT_UNMAP.  HAT_UNMAP
5835                          * is used by segment drivers as a hint
5836                          * that the mapping resource won't be used any longer.
5837                          * The best example of this is during exit().
5838                          */
5839                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5840                             get_hblk_span(hmeblkp));
5841                         if ((flags & HAT_UNLOAD_UNMAP) ||
5842                             (iskernel && !issegkmap)) {
5843                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5844                                     &list, 0);
5845                         }
5846                         SFMMU_HASH_UNLOCK(hmebp);
5847 
5848                         if (iskernel) {
5849                                 hashno = TTE64K;
5850                                 continue;
5851                         }
5852                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5853                                 ASSERT(hashno == TTE64K);
5854                                 continue;
5855                         }
5856                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5857                                 hashno = TTE512K;
5858                                 continue;
5859                         }
5860                         if (mmu_page_sizes == max_mmu_page_sizes) {
5861                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5862                                         hashno = TTE4M;
5863                                         continue;
5864                                 }
5865                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5866                                         hashno = TTE32M;
5867                                         continue;
5868                                 }
5869                                 hashno = TTE256M;
5870                                 continue;
5871                         } else {
5872                                 hashno = TTE4M;
5873                                 continue;
5874                         }
5875                 }
5876                 if (hmeblkp->hblk_shw_bit) {
5877                         /*
5878                          * If we encounter a shadow hmeblk we know there is
5879                          * smaller sized hmeblks mapping the same address space.
5880                          * Decrement the hash size and rehash.
5881                          */
5882                         ASSERT(sfmmup != KHATID);
5883                         hashno--;
5884                         SFMMU_HASH_UNLOCK(hmebp);
5885                         continue;
5886                 }
5887 
5888                 /*
5889                  * track callback address ranges.
5890                  * only start a new range when it's not contiguous
5891                  */
5892                 if (callback != NULL) {
5893                         if (addr_count > 0 &&
5894                             addr == cb_end_addr[addr_count - 1])
5895                                 --addr_count;
5896                         else
5897                                 cb_start_addr[addr_count] = addr;
5898                 }
5899 
5900                 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5901                     dmrp, flags);
5902 
5903                 if (callback != NULL)
5904                         cb_end_addr[addr_count++] = addr;
5905 
5906                 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5907                     !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5908                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5909                 }
5910                 SFMMU_HASH_UNLOCK(hmebp);
5911 
5912                 /*
5913                  * Notify our caller as to exactly which pages
5914                  * have been unloaded. We do these in clumps,
5915                  * to minimize the number of xt_sync()s that need to occur.
5916                  */
5917                 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5918                         if (dmrp != NULL) {
5919                                 DEMAP_RANGE_FLUSH(dmrp);
5920                                 cpuset = sfmmup->sfmmu_cpusran;
5921                                 xt_sync(cpuset);
5922                         }
5923 
5924                         for (a = 0; a < MAX_CB_ADDR; ++a) {
5925                                 callback->hcb_start_addr = cb_start_addr[a];
5926                                 callback->hcb_end_addr = cb_end_addr[a];
5927                                 callback->hcb_function(callback);
5928                         }
5929                         addr_count = 0;
5930                 }
5931                 if (iskernel) {
5932                         hashno = TTE64K;
5933                         continue;
5934                 }
5935                 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5936                         ASSERT(hashno == TTE64K);
5937                         continue;
5938                 }
5939                 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5940                         hashno = TTE512K;
5941                         continue;
5942                 }
5943                 if (mmu_page_sizes == max_mmu_page_sizes) {
5944                         if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5945                                 hashno = TTE4M;
5946                                 continue;
5947                         }
5948                         if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5949                                 hashno = TTE32M;
5950                                 continue;
5951                         }
5952                         hashno = TTE256M;
5953                 } else {
5954                         hashno = TTE4M;
5955                 }
5956         }
5957 
5958         sfmmu_hblks_list_purge(&list, 0);
5959         if (dmrp != NULL) {
5960                 DEMAP_RANGE_FLUSH(dmrp);
5961                 cpuset = sfmmup->sfmmu_cpusran;
5962                 xt_sync(cpuset);
5963         }
5964         if (callback && addr_count != 0) {
5965                 for (a = 0; a < addr_count; ++a) {
5966                         callback->hcb_start_addr = cb_start_addr[a];
5967                         callback->hcb_end_addr = cb_end_addr[a];
5968                         callback->hcb_function(callback);
5969                 }
5970         }
5971 
5972         /*
5973          * Check TSB and TLB page sizes if the process isn't exiting.
5974          */
5975         if (!sfmmup->sfmmu_free)
5976                 sfmmu_check_page_sizes(sfmmup, 0);
5977 }
5978 
5979 /*
5980  * Unload all the mappings in the range [addr..addr+len). addr and len must
5981  * be MMU_PAGESIZE aligned.
5982  */
5983 void
5984 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5985 {
5986         if (sfmmup->sfmmu_xhat_provider) {
5987                 XHAT_UNLOAD(sfmmup, addr, len, flags);
5988                 return;
5989         }
5990         hat_unload_callback(sfmmup, addr, len, flags, NULL);
5991 }
5992 
5993 
5994 /*
5995  * Find the largest mapping size for this page.
5996  */
5997 int
5998 fnd_mapping_sz(page_t *pp)
5999 {
6000         int sz;
6001         int p_index;
6002 
6003         p_index = PP_MAPINDEX(pp);
6004 
6005         sz = 0;
6006         p_index >>= 1;    /* don't care about 8K bit */
6007         for (; p_index; p_index >>= 1) {
6008                 sz++;
6009         }
6010 
6011         return (sz);
6012 }
6013 
6014 /*
6015  * This function unloads a range of addresses for an hmeblk.
6016  * It returns the next address to be unloaded.
6017  * It should be called with the hash lock held.
6018  */
6019 static caddr_t
6020 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6021         caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
6022 {
6023         tte_t   tte, ttemod;
6024         struct  sf_hment *sfhmep;
6025         int     ttesz;
6026         long    ttecnt;
6027         page_t *pp;
6028         kmutex_t *pml;
6029         int ret;
6030         int use_demap_range;
6031 
6032         ASSERT(in_hblk_range(hmeblkp, addr));
6033         ASSERT(!hmeblkp->hblk_shw_bit);
6034         ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
6035         ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
6036         ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
6037 
6038 #ifdef DEBUG
6039         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
6040             (endaddr < get_hblk_endaddr(hmeblkp))) {
6041                 panic("sfmmu_hblk_unload: partial unload of large page");
6042         }
6043 #endif /* DEBUG */
6044 
6045         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6046         ttesz = get_hblk_ttesz(hmeblkp);
6047 
6048         use_demap_range = ((dmrp == NULL) ||
6049             (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
6050 
6051         if (use_demap_range) {
6052                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
6053         } else if (dmrp != NULL) {
6054                 DEMAP_RANGE_FLUSH(dmrp);
6055         }
6056         ttecnt = 0;
6057         HBLKTOHME(sfhmep, hmeblkp, addr);
6058 
6059         while (addr < endaddr) {
6060                 pml = NULL;
6061                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6062                 if (TTE_IS_VALID(&tte)) {
6063                         pp = sfhmep->hme_page;
6064                         if (pp != NULL) {
6065                                 pml = sfmmu_mlist_enter(pp);
6066                         }
6067 
6068                         /*
6069                          * Verify if hme still points to 'pp' now that
6070                          * we have p_mapping lock.
6071                          */
6072                         if (sfhmep->hme_page != pp) {
6073                                 if (pp != NULL && sfhmep->hme_page != NULL) {
6074                                         ASSERT(pml != NULL);
6075                                         sfmmu_mlist_exit(pml);
6076                                         /* Re-start this iteration. */
6077                                         continue;
6078                                 }
6079                                 ASSERT((pp != NULL) &&
6080                                     (sfhmep->hme_page == NULL));
6081                                 goto tte_unloaded;
6082                         }
6083 
6084                         /*
6085                          * This point on we have both HASH and p_mapping
6086                          * lock.
6087                          */
6088                         ASSERT(pp == sfhmep->hme_page);
6089                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6090 
6091                         /*
6092                          * We need to loop on modify tte because it is
6093                          * possible for pagesync to come along and
6094                          * change the software bits beneath us.
6095                          *
6096                          * Page_unload can also invalidate the tte after
6097                          * we read tte outside of p_mapping lock.
6098                          */
6099 again:
6100                         ttemod = tte;
6101 
6102                         TTE_SET_INVALID(&ttemod);
6103                         ret = sfmmu_modifytte_try(&tte, &ttemod,
6104                             &sfhmep->hme_tte);
6105 
6106                         if (ret <= 0) {
6107                                 if (TTE_IS_VALID(&tte)) {
6108                                         ASSERT(ret < 0);
6109                                         goto again;
6110                                 }
6111                                 if (pp != NULL) {
6112                                         panic("sfmmu_hblk_unload: pp = 0x%p "
6113                                             "tte became invalid under mlist"
6114                                             " lock = 0x%p", (void *)pp,
6115                                             (void *)pml);
6116                                 }
6117                                 continue;
6118                         }
6119 
6120                         if (!(flags & HAT_UNLOAD_NOSYNC)) {
6121                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6122                         }
6123 
6124                         /*
6125                          * Ok- we invalidated the tte. Do the rest of the job.
6126                          */
6127                         ttecnt++;
6128 
6129                         if (flags & HAT_UNLOAD_UNLOCK) {
6130                                 ASSERT(hmeblkp->hblk_lckcnt > 0);
6131                                 atomic_dec_32(&hmeblkp->hblk_lckcnt);
6132                                 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6133                         }
6134 
6135                         /*
6136                          * Normally we would need to flush the page
6137                          * from the virtual cache at this point in
6138                          * order to prevent a potential cache alias
6139                          * inconsistency.
6140                          * The particular scenario we need to worry
6141                          * about is:
6142                          * Given:  va1 and va2 are two virtual address
6143                          * that alias and map the same physical
6144                          * address.
6145                          * 1.   mapping exists from va1 to pa and data
6146                          * has been read into the cache.
6147                          * 2.   unload va1.
6148                          * 3.   load va2 and modify data using va2.
6149                          * 4    unload va2.
6150                          * 5.   load va1 and reference data.  Unless we
6151                          * flush the data cache when we unload we will
6152                          * get stale data.
6153                          * Fortunately, page coloring eliminates the
6154                          * above scenario by remembering the color a
6155                          * physical page was last or is currently
6156                          * mapped to.  Now, we delay the flush until
6157                          * the loading of translations.  Only when the
6158                          * new translation is of a different color
6159                          * are we forced to flush.
6160                          */
6161                         if (use_demap_range) {
6162                                 /*
6163                                  * Mark this page as needing a demap.
6164                                  */
6165                                 DEMAP_RANGE_MARKPG(dmrp, addr);
6166                         } else {
6167                                 ASSERT(sfmmup != NULL);
6168                                 ASSERT(!hmeblkp->hblk_shared);
6169                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6170                                     sfmmup->sfmmu_free, 0);
6171                         }
6172 
6173                         if (pp) {
6174                                 /*
6175                                  * Remove the hment from the mapping list
6176                                  */
6177                                 ASSERT(hmeblkp->hblk_hmecnt > 0);
6178 
6179                                 /*
6180                                  * Again, we cannot
6181                                  * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6182                                  */
6183                                 HME_SUB(sfhmep, pp);
6184                                 membar_stst();
6185                                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
6186                         }
6187 
6188                         ASSERT(hmeblkp->hblk_vcnt > 0);
6189                         atomic_dec_16(&hmeblkp->hblk_vcnt);
6190 
6191                         ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6192                             !hmeblkp->hblk_lckcnt);
6193 
6194 #ifdef VAC
6195                         if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6196                                 if (PP_ISTNC(pp)) {
6197                                         /*
6198                                          * If page was temporary
6199                                          * uncached, try to recache
6200                                          * it. Note that HME_SUB() was
6201                                          * called above so p_index and
6202                                          * mlist had been updated.
6203                                          */
6204                                         conv_tnc(pp, ttesz);
6205                                 } else if (pp->p_mapping == NULL) {
6206                                         ASSERT(kpm_enable);
6207                                         /*
6208                                          * Page is marked to be in VAC conflict
6209                                          * to an existing kpm mapping and/or is
6210                                          * kpm mapped using only the regular
6211                                          * pagesize.
6212                                          */
6213                                         sfmmu_kpm_hme_unload(pp);
6214                                 }
6215                         }
6216 #endif  /* VAC */
6217                 } else if ((pp = sfhmep->hme_page) != NULL) {
6218                                 /*
6219                                  * TTE is invalid but the hme
6220                                  * still exists. let pageunload
6221                                  * complete its job.
6222                                  */
6223                                 ASSERT(pml == NULL);
6224                                 pml = sfmmu_mlist_enter(pp);
6225                                 if (sfhmep->hme_page != NULL) {
6226                                         sfmmu_mlist_exit(pml);
6227                                         continue;
6228                                 }
6229                                 ASSERT(sfhmep->hme_page == NULL);
6230                 } else if (hmeblkp->hblk_hmecnt != 0) {
6231                         /*
6232                          * pageunload may have not finished decrementing
6233                          * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6234                          * wait for pageunload to finish. Rely on pageunload
6235                          * to decrement hblk_hmecnt after hblk_vcnt.
6236                          */
6237                         pfn_t pfn = TTE_TO_TTEPFN(&tte);
6238                         ASSERT(pml == NULL);
6239                         if (pf_is_memory(pfn)) {
6240                                 pp = page_numtopp_nolock(pfn);
6241                                 if (pp != NULL) {
6242                                         pml = sfmmu_mlist_enter(pp);
6243                                         sfmmu_mlist_exit(pml);
6244                                         pml = NULL;
6245                                 }
6246                         }
6247                 }
6248 
6249 tte_unloaded:
6250                 /*
6251                  * At this point, the tte we are looking at
6252                  * should be unloaded, and hme has been unlinked
6253                  * from page too. This is important because in
6254                  * pageunload, it does ttesync() then HME_SUB.
6255                  * We need to make sure HME_SUB has been completed
6256                  * so we know ttesync() has been completed. Otherwise,
6257                  * at exit time, after return from hat layer, VM will
6258                  * release as structure which hat_setstat() (called
6259                  * by ttesync()) needs.
6260                  */
6261 #ifdef DEBUG
6262                 {
6263                         tte_t   dtte;
6264 
6265                         ASSERT(sfhmep->hme_page == NULL);
6266 
6267                         sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6268                         ASSERT(!TTE_IS_VALID(&dtte));
6269                 }
6270 #endif
6271 
6272                 if (pml) {
6273                         sfmmu_mlist_exit(pml);
6274                 }
6275 
6276                 addr += TTEBYTES(ttesz);
6277                 sfhmep++;
6278                 DEMAP_RANGE_NEXTPG(dmrp);
6279         }
6280         /*
6281          * For shared hmeblks this routine is only called when region is freed
6282          * and no longer referenced.  So no need to decrement ttecnt
6283          * in the region structure here.
6284          */
6285         if (ttecnt > 0 && sfmmup != NULL) {
6286                 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6287         }
6288         return (addr);
6289 }
6290 
6291 /*
6292  * Invalidate a virtual address range for the local CPU.
6293  * For best performance ensure that the va range is completely
6294  * mapped, otherwise the entire TLB will be flushed.
6295  */
6296 void
6297 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6298 {
6299         ssize_t sz;
6300         caddr_t endva = va + size;
6301 
6302         while (va < endva) {
6303                 sz = hat_getpagesize(sfmmup, va);
6304                 if (sz < 0) {
6305                         vtag_flushall();
6306                         break;
6307                 }
6308                 vtag_flushpage(va, (uint64_t)sfmmup);
6309                 va += sz;
6310         }
6311 }
6312 
6313 /*
6314  * Synchronize all the mappings in the range [addr..addr+len).
6315  * Can be called with clearflag having two states:
6316  * HAT_SYNC_DONTZERO means just return the rm stats
6317  * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6318  */
6319 void
6320 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6321 {
6322         struct hmehash_bucket *hmebp;
6323         hmeblk_tag hblktag;
6324         int hmeshift, hashno = 1;
6325         struct hme_blk *hmeblkp, *list = NULL;
6326         caddr_t endaddr;
6327         cpuset_t cpuset;
6328 
6329         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
6330         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6331         ASSERT((len & MMU_PAGEOFFSET) == 0);
6332         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6333             (clearflag == HAT_SYNC_ZERORM));
6334 
6335         CPUSET_ZERO(cpuset);
6336 
6337         endaddr = addr + len;
6338         hblktag.htag_id = sfmmup;
6339         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6340 
6341         /*
6342          * Spitfire supports 4 page sizes.
6343          * Most pages are expected to be of the smallest page
6344          * size (8K) and these will not need to be rehashed. 64K
6345          * pages also don't need to be rehashed because the an hmeblk
6346          * spans 64K of address space. 512K pages might need 1 rehash and
6347          * and 4M pages 2 rehashes.
6348          */
6349         while (addr < endaddr) {
6350                 hmeshift = HME_HASH_SHIFT(hashno);
6351                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6352                 hblktag.htag_rehash = hashno;
6353                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6354 
6355                 SFMMU_HASH_LOCK(hmebp);
6356 
6357                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6358                 if (hmeblkp != NULL) {
6359                         ASSERT(!hmeblkp->hblk_shared);
6360                         /*
6361                          * We've encountered a shadow hmeblk so skip the range
6362                          * of the next smaller mapping size.
6363                          */
6364                         if (hmeblkp->hblk_shw_bit) {
6365                                 ASSERT(sfmmup != ksfmmup);
6366                                 ASSERT(hashno > 1);
6367                                 addr = (caddr_t)P2END((uintptr_t)addr,
6368                                     TTEBYTES(hashno - 1));
6369                         } else {
6370                                 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6371                                     addr, endaddr, clearflag);
6372                         }
6373                         SFMMU_HASH_UNLOCK(hmebp);
6374                         hashno = 1;
6375                         continue;
6376                 }
6377                 SFMMU_HASH_UNLOCK(hmebp);
6378 
6379                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6380                         /*
6381                          * We have traversed the whole list and rehashed
6382                          * if necessary without finding the address to sync.
6383                          * This is ok so we increment the address by the
6384                          * smallest hmeblk range for kernel mappings and the
6385                          * largest hmeblk range, to account for shadow hmeblks,
6386                          * for user mappings and continue.
6387                          */
6388                         if (sfmmup == ksfmmup)
6389                                 addr = (caddr_t)P2END((uintptr_t)addr,
6390                                     TTEBYTES(1));
6391                         else
6392                                 addr = (caddr_t)P2END((uintptr_t)addr,
6393                                     TTEBYTES(hashno));
6394                         hashno = 1;
6395                 } else {
6396                         hashno++;
6397                 }
6398         }
6399         sfmmu_hblks_list_purge(&list, 0);
6400         cpuset = sfmmup->sfmmu_cpusran;
6401         xt_sync(cpuset);
6402 }
6403 
6404 static caddr_t
6405 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6406         caddr_t endaddr, int clearflag)
6407 {
6408         tte_t   tte, ttemod;
6409         struct sf_hment *sfhmep;
6410         int ttesz;
6411         struct page *pp;
6412         kmutex_t *pml;
6413         int ret;
6414 
6415         ASSERT(hmeblkp->hblk_shw_bit == 0);
6416         ASSERT(!hmeblkp->hblk_shared);
6417 
6418         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6419 
6420         ttesz = get_hblk_ttesz(hmeblkp);
6421         HBLKTOHME(sfhmep, hmeblkp, addr);
6422 
6423         while (addr < endaddr) {
6424                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6425                 if (TTE_IS_VALID(&tte)) {
6426                         pml = NULL;
6427                         pp = sfhmep->hme_page;
6428                         if (pp) {
6429                                 pml = sfmmu_mlist_enter(pp);
6430                         }
6431                         if (pp != sfhmep->hme_page) {
6432                                 /*
6433                                  * tte most have been unloaded
6434                                  * underneath us.  Recheck
6435                                  */
6436                                 ASSERT(pml);
6437                                 sfmmu_mlist_exit(pml);
6438                                 continue;
6439                         }
6440 
6441                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6442 
6443                         if (clearflag == HAT_SYNC_ZERORM) {
6444                                 ttemod = tte;
6445                                 TTE_CLR_RM(&ttemod);
6446                                 ret = sfmmu_modifytte_try(&tte, &ttemod,
6447                                     &sfhmep->hme_tte);
6448                                 if (ret < 0) {
6449                                         if (pml) {
6450                                                 sfmmu_mlist_exit(pml);
6451                                         }
6452                                         continue;
6453                                 }
6454 
6455                                 if (ret > 0) {
6456                                         sfmmu_tlb_demap(addr, sfmmup,
6457                                             hmeblkp, 0, 0);
6458                                 }
6459                         }
6460                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
6461                         if (pml) {
6462                                 sfmmu_mlist_exit(pml);
6463                         }
6464                 }
6465                 addr += TTEBYTES(ttesz);
6466                 sfhmep++;
6467         }
6468         return (addr);
6469 }
6470 
6471 /*
6472  * This function will sync a tte to the page struct and it will
6473  * update the hat stats. Currently it allows us to pass a NULL pp
6474  * and we will simply update the stats.  We may want to change this
6475  * so we only keep stats for pages backed by pp's.
6476  */
6477 static void
6478 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6479 {
6480         uint_t rm = 0;
6481         int     sz;
6482         pgcnt_t npgs;
6483 
6484         ASSERT(TTE_IS_VALID(ttep));
6485 
6486         if (TTE_IS_NOSYNC(ttep)) {
6487                 return;
6488         }
6489 
6490         if (TTE_IS_REF(ttep))  {
6491                 rm = P_REF;
6492         }
6493         if (TTE_IS_MOD(ttep))  {
6494                 rm |= P_MOD;
6495         }
6496 
6497         if (rm == 0) {
6498                 return;
6499         }
6500 
6501         sz = TTE_CSZ(ttep);
6502         if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6503                 int i;
6504                 caddr_t vaddr = addr;
6505 
6506                 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6507                         hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6508                 }
6509 
6510         }
6511 
6512         /*
6513          * XXX I want to use cas to update nrm bits but they
6514          * currently belong in common/vm and not in hat where
6515          * they should be.
6516          * The nrm bits are protected by the same mutex as
6517          * the one that protects the page's mapping list.
6518          */
6519         if (!pp)
6520                 return;
6521         ASSERT(sfmmu_mlist_held(pp));
6522         /*
6523          * If the tte is for a large page, we need to sync all the
6524          * pages covered by the tte.
6525          */
6526         if (sz != TTE8K) {
6527                 ASSERT(pp->p_szc != 0);
6528                 pp = PP_GROUPLEADER(pp, sz);
6529                 ASSERT(sfmmu_mlist_held(pp));
6530         }
6531 
6532         /* Get number of pages from tte size. */
6533         npgs = TTEPAGES(sz);
6534 
6535         do {
6536                 ASSERT(pp);
6537                 ASSERT(sfmmu_mlist_held(pp));
6538                 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6539                     ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6540                         hat_page_setattr(pp, rm);
6541 
6542                 /*
6543                  * Are we done? If not, we must have a large mapping.
6544                  * For large mappings we need to sync the rest of the pages
6545                  * covered by this tte; goto the next page.
6546                  */
6547         } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6548 }
6549 
6550 /*
6551  * Execute pre-callback handler of each pa_hment linked to pp
6552  *
6553  * Inputs:
6554  *   flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6555  *   capture_cpus: pointer to return value (below)
6556  *
6557  * Returns:
6558  *   Propagates the subsystem callback return values back to the caller;
6559  *   returns 0 on success.  If capture_cpus is non-NULL, the value returned
6560  *   is zero if all of the pa_hments are of a type that do not require
6561  *   capturing CPUs prior to suspending the mapping, else it is 1.
6562  */
6563 static int
6564 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6565 {
6566         struct sf_hment *sfhmep;
6567         struct pa_hment *pahmep;
6568         int (*f)(caddr_t, uint_t, uint_t, void *);
6569         int             ret;
6570         id_t            id;
6571         int             locked = 0;
6572         kmutex_t        *pml;
6573 
6574         ASSERT(PAGE_EXCL(pp));
6575         if (!sfmmu_mlist_held(pp)) {
6576                 pml = sfmmu_mlist_enter(pp);
6577                 locked = 1;
6578         }
6579 
6580         if (capture_cpus)
6581                 *capture_cpus = 0;
6582 
6583 top:
6584         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6585                 /*
6586                  * skip sf_hments corresponding to VA<->PA mappings;
6587                  * for pa_hment's, hme_tte.ll is zero
6588                  */
6589                 if (!IS_PAHME(sfhmep))
6590                         continue;
6591 
6592                 pahmep = sfhmep->hme_data;
6593                 ASSERT(pahmep != NULL);
6594 
6595                 /*
6596                  * skip if pre-handler has been called earlier in this loop
6597                  */
6598                 if (pahmep->flags & flag)
6599                         continue;
6600 
6601                 id = pahmep->cb_id;
6602                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6603                 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6604                         *capture_cpus = 1;
6605                 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6606                         pahmep->flags |= flag;
6607                         continue;
6608                 }
6609 
6610                 /*
6611                  * Drop the mapping list lock to avoid locking order issues.
6612                  */
6613                 if (locked)
6614                         sfmmu_mlist_exit(pml);
6615 
6616                 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6617                 if (ret != 0)
6618                         return (ret);   /* caller must do the cleanup */
6619 
6620                 if (locked) {
6621                         pml = sfmmu_mlist_enter(pp);
6622                         pahmep->flags |= flag;
6623                         goto top;
6624                 }
6625 
6626                 pahmep->flags |= flag;
6627         }
6628 
6629         if (locked)
6630                 sfmmu_mlist_exit(pml);
6631 
6632         return (0);
6633 }
6634 
6635 /*
6636  * Execute post-callback handler of each pa_hment linked to pp
6637  *
6638  * Same overall assumptions and restrictions apply as for
6639  * hat_pageprocess_precallbacks().
6640  */
6641 static void
6642 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6643 {
6644         pfn_t pgpfn = pp->p_pagenum;
6645         pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6646         pfn_t newpfn;
6647         struct sf_hment *sfhmep;
6648         struct pa_hment *pahmep;
6649         int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6650         id_t    id;
6651         int     locked = 0;
6652         kmutex_t *pml;
6653 
6654         ASSERT(PAGE_EXCL(pp));
6655         if (!sfmmu_mlist_held(pp)) {
6656                 pml = sfmmu_mlist_enter(pp);
6657                 locked = 1;
6658         }
6659 
6660 top:
6661         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6662                 /*
6663                  * skip sf_hments corresponding to VA<->PA mappings;
6664                  * for pa_hment's, hme_tte.ll is zero
6665                  */
6666                 if (!IS_PAHME(sfhmep))
6667                         continue;
6668 
6669                 pahmep = sfhmep->hme_data;
6670                 ASSERT(pahmep != NULL);
6671 
6672                 if ((pahmep->flags & flag) == 0)
6673                         continue;
6674 
6675                 pahmep->flags &= ~flag;
6676 
6677                 id = pahmep->cb_id;
6678                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6679                 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6680                         continue;
6681 
6682                 /*
6683                  * Convert the base page PFN into the constituent PFN
6684                  * which is needed by the callback handler.
6685                  */
6686                 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6687 
6688                 /*
6689                  * Drop the mapping list lock to avoid locking order issues.
6690                  */
6691                 if (locked)
6692                         sfmmu_mlist_exit(pml);
6693 
6694                 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6695                     != 0)
6696                         panic("sfmmu: posthandler failed");
6697 
6698                 if (locked) {
6699                         pml = sfmmu_mlist_enter(pp);
6700                         goto top;
6701                 }
6702         }
6703 
6704         if (locked)
6705                 sfmmu_mlist_exit(pml);
6706 }
6707 
6708 /*
6709  * Suspend locked kernel mapping
6710  */
6711 void
6712 hat_pagesuspend(struct page *pp)
6713 {
6714         struct sf_hment *sfhmep;
6715         sfmmu_t *sfmmup;
6716         tte_t tte, ttemod;
6717         struct hme_blk *hmeblkp;
6718         caddr_t addr;
6719         int index, cons;
6720         cpuset_t cpuset;
6721 
6722         ASSERT(PAGE_EXCL(pp));
6723         ASSERT(sfmmu_mlist_held(pp));
6724 
6725         mutex_enter(&kpr_suspendlock);
6726 
6727         /*
6728          * We're about to suspend a kernel mapping so mark this thread as
6729          * non-traceable by DTrace. This prevents us from running into issues
6730          * with probe context trying to touch a suspended page
6731          * in the relocation codepath itself.
6732          */
6733         curthread->t_flag |= T_DONTDTRACE;
6734 
6735         index = PP_MAPINDEX(pp);
6736         cons = TTE8K;
6737 
6738 retry:
6739         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6740 
6741                 if (IS_PAHME(sfhmep))
6742                         continue;
6743 
6744                 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6745                         continue;
6746 
6747                 /*
6748                  * Loop until we successfully set the suspend bit in
6749                  * the TTE.
6750                  */
6751 again:
6752                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6753                 ASSERT(TTE_IS_VALID(&tte));
6754 
6755                 ttemod = tte;
6756                 TTE_SET_SUSPEND(&ttemod);
6757                 if (sfmmu_modifytte_try(&tte, &ttemod,
6758                     &sfhmep->hme_tte) < 0)
6759                         goto again;
6760 
6761                 /*
6762                  * Invalidate TSB entry
6763                  */
6764                 hmeblkp = sfmmu_hmetohblk(sfhmep);
6765 
6766                 sfmmup = hblktosfmmu(hmeblkp);
6767                 ASSERT(sfmmup == ksfmmup);
6768                 ASSERT(!hmeblkp->hblk_shared);
6769 
6770                 addr = tte_to_vaddr(hmeblkp, tte);
6771 
6772                 /*
6773                  * No need to make sure that the TSB for this sfmmu is
6774                  * not being relocated since it is ksfmmup and thus it
6775                  * will never be relocated.
6776                  */
6777                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6778 
6779                 /*
6780                  * Update xcall stats
6781                  */
6782                 cpuset = cpu_ready_set;
6783                 CPUSET_DEL(cpuset, CPU->cpu_id);
6784 
6785                 /* LINTED: constant in conditional context */
6786                 SFMMU_XCALL_STATS(ksfmmup);
6787 
6788                 /*
6789                  * Flush TLB entry on remote CPU's
6790                  */
6791                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6792                     (uint64_t)ksfmmup);
6793                 xt_sync(cpuset);
6794 
6795                 /*
6796                  * Flush TLB entry on local CPU
6797                  */
6798                 vtag_flushpage(addr, (uint64_t)ksfmmup);
6799         }
6800 
6801         while (index != 0) {
6802                 index = index >> 1;
6803                 if (index != 0)
6804                         cons++;
6805                 if (index & 0x1) {
6806                         pp = PP_GROUPLEADER(pp, cons);
6807                         goto retry;
6808                 }
6809         }
6810 }
6811 
6812 #ifdef  DEBUG
6813 
6814 #define N_PRLE  1024
6815 struct prle {
6816         page_t *targ;
6817         page_t *repl;
6818         int status;
6819         int pausecpus;
6820         hrtime_t whence;
6821 };
6822 
6823 static struct prle page_relocate_log[N_PRLE];
6824 static int prl_entry;
6825 static kmutex_t prl_mutex;
6826 
6827 #define PAGE_RELOCATE_LOG(t, r, s, p)                                   \
6828         mutex_enter(&prl_mutex);                                    \
6829         page_relocate_log[prl_entry].targ = *(t);                       \
6830         page_relocate_log[prl_entry].repl = *(r);                       \
6831         page_relocate_log[prl_entry].status = (s);                      \
6832         page_relocate_log[prl_entry].pausecpus = (p);                   \
6833         page_relocate_log[prl_entry].whence = gethrtime();              \
6834         prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1;     \
6835         mutex_exit(&prl_mutex);
6836 
6837 #else   /* !DEBUG */
6838 #define PAGE_RELOCATE_LOG(t, r, s, p)
6839 #endif
6840 
6841 /*
6842  * Core Kernel Page Relocation Algorithm
6843  *
6844  * Input:
6845  *
6846  * target :     constituent pages are SE_EXCL locked.
6847  * replacement: constituent pages are SE_EXCL locked.
6848  *
6849  * Output:
6850  *
6851  * nrelocp:     number of pages relocated
6852  */
6853 int
6854 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6855 {
6856         page_t          *targ, *repl;
6857         page_t          *tpp, *rpp;
6858         kmutex_t        *low, *high;
6859         spgcnt_t        npages, i;
6860         page_t          *pl = NULL;
6861         int             old_pil;
6862         cpuset_t        cpuset;
6863         int             cap_cpus;
6864         int             ret;
6865 #ifdef VAC
6866         int             cflags = 0;
6867 #endif
6868 
6869         if (!kcage_on || PP_ISNORELOC(*target)) {
6870                 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6871                 return (EAGAIN);
6872         }
6873 
6874         mutex_enter(&kpr_mutex);
6875         kreloc_thread = curthread;
6876 
6877         targ = *target;
6878         repl = *replacement;
6879         ASSERT(repl != NULL);
6880         ASSERT(targ->p_szc == repl->p_szc);
6881 
6882         npages = page_get_pagecnt(targ->p_szc);
6883 
6884         /*
6885          * unload VA<->PA mappings that are not locked
6886          */
6887         tpp = targ;
6888         for (i = 0; i < npages; i++) {
6889                 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6890                 tpp++;
6891         }
6892 
6893         /*
6894          * Do "presuspend" callbacks, in a context from which we can still
6895          * block as needed. Note that we don't hold the mapping list lock
6896          * of "targ" at this point due to potential locking order issues;
6897          * we assume that between the hat_pageunload() above and holding
6898          * the SE_EXCL lock that the mapping list *cannot* change at this
6899          * point.
6900          */
6901         ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6902         if (ret != 0) {
6903                 /*
6904                  * EIO translates to fatal error, for all others cleanup
6905                  * and return EAGAIN.
6906                  */
6907                 ASSERT(ret != EIO);
6908                 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6909                 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6910                 kreloc_thread = NULL;
6911                 mutex_exit(&kpr_mutex);
6912                 return (EAGAIN);
6913         }
6914 
6915         /*
6916          * acquire p_mapping list lock for both the target and replacement
6917          * root pages.
6918          *
6919          * low and high refer to the need to grab the mlist locks in a
6920          * specific order in order to prevent race conditions.  Thus the
6921          * lower lock must be grabbed before the higher lock.
6922          *
6923          * This will block hat_unload's accessing p_mapping list.  Since
6924          * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6925          * blocked.  Thus, no one else will be accessing the p_mapping list
6926          * while we suspend and reload the locked mapping below.
6927          */
6928         tpp = targ;
6929         rpp = repl;
6930         sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6931 
6932         kpreempt_disable();
6933 
6934         /*
6935          * We raise our PIL to 13 so that we don't get captured by
6936          * another CPU or pinned by an interrupt thread.  We can't go to
6937          * PIL 14 since the nexus driver(s) may need to interrupt at
6938          * that level in the case of IOMMU pseudo mappings.
6939          */
6940         cpuset = cpu_ready_set;
6941         CPUSET_DEL(cpuset, CPU->cpu_id);
6942         if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6943                 old_pil = splr(XCALL_PIL);
6944         } else {
6945                 old_pil = -1;
6946                 xc_attention(cpuset);
6947         }
6948         ASSERT(getpil() == XCALL_PIL);
6949 
6950         /*
6951          * Now do suspend callbacks. In the case of an IOMMU mapping
6952          * this will suspend all DMA activity to the page while it is
6953          * being relocated. Since we are well above LOCK_LEVEL and CPUs
6954          * may be captured at this point we should have acquired any needed
6955          * locks in the presuspend callback.
6956          */
6957         ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6958         if (ret != 0) {
6959                 repl = targ;
6960                 goto suspend_fail;
6961         }
6962 
6963         /*
6964          * Raise the PIL yet again, this time to block all high-level
6965          * interrupts on this CPU. This is necessary to prevent an
6966          * interrupt routine from pinning the thread which holds the
6967          * mapping suspended and then touching the suspended page.
6968          *
6969          * Once the page is suspended we also need to be careful to
6970          * avoid calling any functions which touch any seg_kmem memory
6971          * since that memory may be backed by the very page we are
6972          * relocating in here!
6973          */
6974         hat_pagesuspend(targ);
6975 
6976         /*
6977          * Now that we are confident everybody has stopped using this page,
6978          * copy the page contents.  Note we use a physical copy to prevent
6979          * locking issues and to avoid fpRAS because we can't handle it in
6980          * this context.
6981          */
6982         for (i = 0; i < npages; i++, tpp++, rpp++) {
6983 #ifdef VAC
6984                 /*
6985                  * If the replacement has a different vcolor than
6986                  * the one being replacd, we need to handle VAC
6987                  * consistency for it just as we were setting up
6988                  * a new mapping to it.
6989                  */
6990                 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6991                     (tpp->p_vcolor != rpp->p_vcolor) &&
6992                     !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6993                         CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6994                         sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6995                             rpp->p_pagenum);
6996                 }
6997 #endif
6998                 /*
6999                  * Copy the contents of the page.
7000                  */
7001                 ppcopy_kernel(tpp, rpp);
7002         }
7003 
7004         tpp = targ;
7005         rpp = repl;
7006         for (i = 0; i < npages; i++, tpp++, rpp++) {
7007                 /*
7008                  * Copy attributes.  VAC consistency was handled above,
7009                  * if required.
7010                  */
7011                 rpp->p_nrm = tpp->p_nrm;
7012                 tpp->p_nrm = 0;
7013                 rpp->p_index = tpp->p_index;
7014                 tpp->p_index = 0;
7015 #ifdef VAC
7016                 rpp->p_vcolor = tpp->p_vcolor;
7017 #endif
7018         }
7019 
7020         /*
7021          * First, unsuspend the page, if we set the suspend bit, and transfer
7022          * the mapping list from the target page to the replacement page.
7023          * Next process postcallbacks; since pa_hment's are linked only to the
7024          * p_mapping list of root page, we don't iterate over the constituent
7025          * pages.
7026          */
7027         hat_pagereload(targ, repl);
7028 
7029 suspend_fail:
7030         hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
7031 
7032         /*
7033          * Now lower our PIL and release any captured CPUs since we
7034          * are out of the "danger zone".  After this it will again be
7035          * safe to acquire adaptive mutex locks, or to drop them...
7036          */
7037         if (old_pil != -1) {
7038                 splx(old_pil);
7039         } else {
7040                 xc_dismissed(cpuset);
7041         }
7042 
7043         kpreempt_enable();
7044 
7045         sfmmu_mlist_reloc_exit(low, high);
7046 
7047         /*
7048          * Postsuspend callbacks should drop any locks held across
7049          * the suspend callbacks.  As before, we don't hold the mapping
7050          * list lock at this point.. our assumption is that the mapping
7051          * list still can't change due to our holding SE_EXCL lock and
7052          * there being no unlocked mappings left. Hence the restriction
7053          * on calling context to hat_delete_callback()
7054          */
7055         hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
7056         if (ret != 0) {
7057                 /*
7058                  * The second presuspend call failed: we got here through
7059                  * the suspend_fail label above.
7060                  */
7061                 ASSERT(ret != EIO);
7062                 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
7063                 kreloc_thread = NULL;
7064                 mutex_exit(&kpr_mutex);
7065                 return (EAGAIN);
7066         }
7067 
7068         /*
7069          * Now that we're out of the performance critical section we can
7070          * take care of updating the hash table, since we still
7071          * hold all the pages locked SE_EXCL at this point we
7072          * needn't worry about things changing out from under us.
7073          */
7074         tpp = targ;
7075         rpp = repl;
7076         for (i = 0; i < npages; i++, tpp++, rpp++) {
7077 
7078                 /*
7079                  * replace targ with replacement in page_hash table
7080                  */
7081                 targ = tpp;
7082                 page_relocate_hash(rpp, targ);
7083 
7084                 /*
7085                  * concatenate target; caller of platform_page_relocate()
7086                  * expects target to be concatenated after returning.
7087                  */
7088                 ASSERT(targ->p_next == targ);
7089                 ASSERT(targ->p_prev == targ);
7090                 page_list_concat(&pl, &targ);
7091         }
7092 
7093         ASSERT(*target == pl);
7094         *nrelocp = npages;
7095         PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
7096         kreloc_thread = NULL;
7097         mutex_exit(&kpr_mutex);
7098         return (0);
7099 }
7100 
7101 /*
7102  * Called when stray pa_hments are found attached to a page which is
7103  * being freed.  Notify the subsystem which attached the pa_hment of
7104  * the error if it registered a suitable handler, else panic.
7105  */
7106 static void
7107 sfmmu_pahment_leaked(struct pa_hment *pahmep)
7108 {
7109         id_t cb_id = pahmep->cb_id;
7110 
7111         ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
7112         if (sfmmu_cb_table[cb_id].errhandler != NULL) {
7113                 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7114                     HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7115                         return;         /* non-fatal */
7116         }
7117         panic("pa_hment leaked: 0x%p", (void *)pahmep);
7118 }
7119 
7120 /*
7121  * Remove all mappings to page 'pp'.
7122  */
7123 int
7124 hat_pageunload(struct page *pp, uint_t forceflag)
7125 {
7126         struct page *origpp = pp;
7127         struct sf_hment *sfhme, *tmphme;
7128         struct hme_blk *hmeblkp;
7129         kmutex_t *pml;
7130 #ifdef VAC
7131         kmutex_t *pmtx;
7132 #endif
7133         cpuset_t cpuset, tset;
7134         int index, cons;
7135         int xhme_blks;
7136         int pa_hments;
7137 
7138         ASSERT(PAGE_EXCL(pp));
7139 
7140 retry_xhat:
7141         tmphme = NULL;
7142         xhme_blks = 0;
7143         pa_hments = 0;
7144         CPUSET_ZERO(cpuset);
7145 
7146         pml = sfmmu_mlist_enter(pp);
7147 
7148 #ifdef VAC
7149         if (pp->p_kpmref)
7150                 sfmmu_kpm_pageunload(pp);
7151         ASSERT(!PP_ISMAPPED_KPM(pp));
7152 #endif
7153         /*
7154          * Clear vpm reference. Since the page is exclusively locked
7155          * vpm cannot be referencing it.
7156          */
7157         if (vpm_enable) {
7158                 pp->p_vpmref = 0;
7159         }
7160 
7161         index = PP_MAPINDEX(pp);
7162         cons = TTE8K;
7163 retry:
7164         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7165                 tmphme = sfhme->hme_next;
7166 
7167                 if (IS_PAHME(sfhme)) {
7168                         ASSERT(sfhme->hme_data != NULL);
7169                         pa_hments++;
7170                         continue;
7171                 }
7172 
7173                 hmeblkp = sfmmu_hmetohblk(sfhme);
7174                 if (hmeblkp->hblk_xhat_bit) {
7175                         struct xhat_hme_blk *xblk =
7176                             (struct xhat_hme_blk *)hmeblkp;
7177 
7178                         (void) XHAT_PAGEUNLOAD(xblk->xhat_hme_blk_hat,
7179                             pp, forceflag, XBLK2PROVBLK(xblk));
7180 
7181                         xhme_blks = 1;
7182                         continue;
7183                 }
7184 
7185                 /*
7186                  * If there are kernel mappings don't unload them, they will
7187                  * be suspended.
7188                  */
7189                 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7190                     hmeblkp->hblk_tag.htag_id == ksfmmup)
7191                         continue;
7192 
7193                 tset = sfmmu_pageunload(pp, sfhme, cons);
7194                 CPUSET_OR(cpuset, tset);
7195         }
7196 
7197         while (index != 0) {
7198                 index = index >> 1;
7199                 if (index != 0)
7200                         cons++;
7201                 if (index & 0x1) {
7202                         /* Go to leading page */
7203                         pp = PP_GROUPLEADER(pp, cons);
7204                         ASSERT(sfmmu_mlist_held(pp));
7205                         goto retry;
7206                 }
7207         }
7208 
7209         /*
7210          * cpuset may be empty if the page was only mapped by segkpm,
7211          * in which case we won't actually cross-trap.
7212          */
7213         xt_sync(cpuset);
7214 
7215         /*
7216          * The page should have no mappings at this point, unless
7217          * we were called from hat_page_relocate() in which case we
7218          * leave the locked mappings which will be suspended later.
7219          */
7220         ASSERT(!PP_ISMAPPED(origpp) || xhme_blks || pa_hments ||
7221             (forceflag == SFMMU_KERNEL_RELOC));
7222 
7223 #ifdef VAC
7224         if (PP_ISTNC(pp)) {
7225                 if (cons == TTE8K) {
7226                         pmtx = sfmmu_page_enter(pp);
7227                         PP_CLRTNC(pp);
7228                         sfmmu_page_exit(pmtx);
7229                 } else {
7230                         conv_tnc(pp, cons);
7231                 }
7232         }
7233 #endif  /* VAC */
7234 
7235         if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7236                 /*
7237                  * Unlink any pa_hments and free them, calling back
7238                  * the responsible subsystem to notify it of the error.
7239                  * This can occur in situations such as drivers leaking
7240                  * DMA handles: naughty, but common enough that we'd like
7241                  * to keep the system running rather than bringing it
7242                  * down with an obscure error like "pa_hment leaked"
7243                  * which doesn't aid the user in debugging their driver.
7244                  */
7245                 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7246                         tmphme = sfhme->hme_next;
7247                         if (IS_PAHME(sfhme)) {
7248                                 struct pa_hment *pahmep = sfhme->hme_data;
7249                                 sfmmu_pahment_leaked(pahmep);
7250                                 HME_SUB(sfhme, pp);
7251                                 kmem_cache_free(pa_hment_cache, pahmep);
7252                         }
7253                 }
7254 
7255                 ASSERT(!PP_ISMAPPED(origpp) || xhme_blks);
7256         }
7257 
7258         sfmmu_mlist_exit(pml);
7259 
7260         /*
7261          * XHAT may not have finished unloading pages
7262          * because some other thread was waiting for
7263          * mlist lock and XHAT_PAGEUNLOAD let it do
7264          * the job.
7265          */
7266         if (xhme_blks) {
7267                 pp = origpp;
7268                 goto retry_xhat;
7269         }
7270 
7271         return (0);
7272 }
7273 
7274 cpuset_t
7275 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7276 {
7277         struct hme_blk *hmeblkp;
7278         sfmmu_t *sfmmup;
7279         tte_t tte, ttemod;
7280 #ifdef DEBUG
7281         tte_t orig_old;
7282 #endif /* DEBUG */
7283         caddr_t addr;
7284         int ttesz;
7285         int ret;
7286         cpuset_t cpuset;
7287 
7288         ASSERT(pp != NULL);
7289         ASSERT(sfmmu_mlist_held(pp));
7290         ASSERT(!PP_ISKAS(pp));
7291 
7292         CPUSET_ZERO(cpuset);
7293 
7294         hmeblkp = sfmmu_hmetohblk(sfhme);
7295 
7296 readtte:
7297         sfmmu_copytte(&sfhme->hme_tte, &tte);
7298         if (TTE_IS_VALID(&tte)) {
7299                 sfmmup = hblktosfmmu(hmeblkp);
7300                 ttesz = get_hblk_ttesz(hmeblkp);
7301                 /*
7302                  * Only unload mappings of 'cons' size.
7303                  */
7304                 if (ttesz != cons)
7305                         return (cpuset);
7306 
7307                 /*
7308                  * Note that we have p_mapping lock, but no hash lock here.
7309                  * hblk_unload() has to have both hash lock AND p_mapping
7310                  * lock before it tries to modify tte. So, the tte could
7311                  * not become invalid in the sfmmu_modifytte_try() below.
7312                  */
7313                 ttemod = tte;
7314 #ifdef DEBUG
7315                 orig_old = tte;
7316 #endif /* DEBUG */
7317 
7318                 TTE_SET_INVALID(&ttemod);
7319                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7320                 if (ret < 0) {
7321 #ifdef DEBUG
7322                         /* only R/M bits can change. */
7323                         chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7324 #endif /* DEBUG */
7325                         goto readtte;
7326                 }
7327 
7328                 if (ret == 0) {
7329                         panic("pageunload: cas failed?");
7330                 }
7331 
7332                 addr = tte_to_vaddr(hmeblkp, tte);
7333 
7334                 if (hmeblkp->hblk_shared) {
7335                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7336                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
7337                         sf_region_t *rgnp;
7338                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7339                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7340                         ASSERT(srdp != NULL);
7341                         rgnp = srdp->srd_hmergnp[rid];
7342                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7343                         cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7344                         sfmmu_ttesync(NULL, addr, &tte, pp);
7345                         ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7346                         atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7347                 } else {
7348                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
7349                         atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7350 
7351                         /*
7352                          * We need to flush the page from the virtual cache
7353                          * in order to prevent a virtual cache alias
7354                          * inconsistency. The particular scenario we need
7355                          * to worry about is:
7356                          * Given:  va1 and va2 are two virtual address that
7357                          * alias and will map the same physical address.
7358                          * 1.   mapping exists from va1 to pa and data has
7359                          *      been read into the cache.
7360                          * 2.   unload va1.
7361                          * 3.   load va2 and modify data using va2.
7362                          * 4    unload va2.
7363                          * 5.   load va1 and reference data.  Unless we flush
7364                          *      the data cache when we unload we will get
7365                          *      stale data.
7366                          * This scenario is taken care of by using virtual
7367                          * page coloring.
7368                          */
7369                         if (sfmmup->sfmmu_ismhat) {
7370                                 /*
7371                                  * Flush TSBs, TLBs and caches
7372                                  * of every process
7373                                  * sharing this ism segment.
7374                                  */
7375                                 sfmmu_hat_lock_all();
7376                                 mutex_enter(&ism_mlist_lock);
7377                                 kpreempt_disable();
7378                                 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7379                                     pp->p_pagenum, CACHE_NO_FLUSH);
7380                                 kpreempt_enable();
7381                                 mutex_exit(&ism_mlist_lock);
7382                                 sfmmu_hat_unlock_all();
7383                                 cpuset = cpu_ready_set;
7384                         } else {
7385                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7386                                 cpuset = sfmmup->sfmmu_cpusran;
7387                         }
7388                 }
7389 
7390                 /*
7391                  * Hme_sub has to run after ttesync() and a_rss update.
7392                  * See hblk_unload().
7393                  */
7394                 HME_SUB(sfhme, pp);
7395                 membar_stst();
7396 
7397                 /*
7398                  * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7399                  * since pteload may have done a HME_ADD() right after
7400                  * we did the HME_SUB() above. Hmecnt is now maintained
7401                  * by cas only. no lock guranteed its value. The only
7402                  * gurantee we have is the hmecnt should not be less than
7403                  * what it should be so the hblk will not be taken away.
7404                  * It's also important that we decremented the hmecnt after
7405                  * we are done with hmeblkp so that this hmeblk won't be
7406                  * stolen.
7407                  */
7408                 ASSERT(hmeblkp->hblk_hmecnt > 0);
7409                 ASSERT(hmeblkp->hblk_vcnt > 0);
7410                 atomic_dec_16(&hmeblkp->hblk_vcnt);
7411                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7412                 /*
7413                  * This is bug 4063182.
7414                  * XXX: fixme
7415                  * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7416                  *      !hmeblkp->hblk_lckcnt);
7417                  */
7418         } else {
7419                 panic("invalid tte? pp %p &tte %p",
7420                     (void *)pp, (void *)&tte);
7421         }
7422 
7423         return (cpuset);
7424 }
7425 
7426 /*
7427  * While relocating a kernel page, this function will move the mappings
7428  * from tpp to dpp and modify any associated data with these mappings.
7429  * It also unsuspends the suspended kernel mapping.
7430  */
7431 static void
7432 hat_pagereload(struct page *tpp, struct page *dpp)
7433 {
7434         struct sf_hment *sfhme;
7435         tte_t tte, ttemod;
7436         int index, cons;
7437 
7438         ASSERT(getpil() == PIL_MAX);
7439         ASSERT(sfmmu_mlist_held(tpp));
7440         ASSERT(sfmmu_mlist_held(dpp));
7441 
7442         index = PP_MAPINDEX(tpp);
7443         cons = TTE8K;
7444 
7445         /* Update real mappings to the page */
7446 retry:
7447         for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7448                 if (IS_PAHME(sfhme))
7449                         continue;
7450                 sfmmu_copytte(&sfhme->hme_tte, &tte);
7451                 ttemod = tte;
7452 
7453                 /*
7454                  * replace old pfn with new pfn in TTE
7455                  */
7456                 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7457 
7458                 /*
7459                  * clear suspend bit
7460                  */
7461                 ASSERT(TTE_IS_SUSPEND(&ttemod));
7462                 TTE_CLR_SUSPEND(&ttemod);
7463 
7464                 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7465                         panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7466 
7467                 /*
7468                  * set hme_page point to new page
7469                  */
7470                 sfhme->hme_page = dpp;
7471         }
7472 
7473         /*
7474          * move p_mapping list from old page to new page
7475          */
7476         dpp->p_mapping = tpp->p_mapping;
7477         tpp->p_mapping = NULL;
7478         dpp->p_share = tpp->p_share;
7479         tpp->p_share = 0;
7480 
7481         while (index != 0) {
7482                 index = index >> 1;
7483                 if (index != 0)
7484                         cons++;
7485                 if (index & 0x1) {
7486                         tpp = PP_GROUPLEADER(tpp, cons);
7487                         dpp = PP_GROUPLEADER(dpp, cons);
7488                         goto retry;
7489                 }
7490         }
7491 
7492         curthread->t_flag &= ~T_DONTDTRACE;
7493         mutex_exit(&kpr_suspendlock);
7494 }
7495 
7496 uint_t
7497 hat_pagesync(struct page *pp, uint_t clearflag)
7498 {
7499         struct sf_hment *sfhme, *tmphme = NULL;
7500         struct hme_blk *hmeblkp;
7501         kmutex_t *pml;
7502         cpuset_t cpuset, tset;
7503         int     index, cons;
7504         extern  ulong_t po_share;
7505         page_t  *save_pp = pp;
7506         int     stop_on_sh = 0;
7507         uint_t  shcnt;
7508 
7509         CPUSET_ZERO(cpuset);
7510 
7511         if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7512                 return (PP_GENERIC_ATTR(pp));
7513         }
7514 
7515         if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7516                 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7517                         return (PP_GENERIC_ATTR(pp));
7518                 }
7519                 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7520                         return (PP_GENERIC_ATTR(pp));
7521                 }
7522                 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7523                         if (pp->p_share > po_share) {
7524                                 hat_page_setattr(pp, P_REF);
7525                                 return (PP_GENERIC_ATTR(pp));
7526                         }
7527                         stop_on_sh = 1;
7528                         shcnt = 0;
7529                 }
7530         }
7531 
7532         clearflag &= ~HAT_SYNC_STOPON_SHARED;
7533         pml = sfmmu_mlist_enter(pp);
7534         index = PP_MAPINDEX(pp);
7535         cons = TTE8K;
7536 retry:
7537         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7538                 /*
7539                  * We need to save the next hment on the list since
7540                  * it is possible for pagesync to remove an invalid hment
7541                  * from the list.
7542                  */
7543                 tmphme = sfhme->hme_next;
7544                 if (IS_PAHME(sfhme))
7545                         continue;
7546                 /*
7547                  * If we are looking for large mappings and this hme doesn't
7548                  * reach the range we are seeking, just ignore it.
7549                  */
7550                 hmeblkp = sfmmu_hmetohblk(sfhme);
7551                 if (hmeblkp->hblk_xhat_bit)
7552                         continue;
7553 
7554                 if (hme_size(sfhme) < cons)
7555                         continue;
7556 
7557                 if (stop_on_sh) {
7558                         if (hmeblkp->hblk_shared) {
7559                                 sf_srd_t *srdp = hblktosrd(hmeblkp);
7560                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7561                                 sf_region_t *rgnp;
7562                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7563                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7564                                 ASSERT(srdp != NULL);
7565                                 rgnp = srdp->srd_hmergnp[rid];
7566                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7567                                     rgnp, rid);
7568                                 shcnt += rgnp->rgn_refcnt;
7569                         } else {
7570                                 shcnt++;
7571                         }
7572                         if (shcnt > po_share) {
7573                                 /*
7574                                  * tell the pager to spare the page this time
7575                                  * around.
7576                                  */
7577                                 hat_page_setattr(save_pp, P_REF);
7578                                 index = 0;
7579                                 break;
7580                         }
7581                 }
7582                 tset = sfmmu_pagesync(pp, sfhme,
7583                     clearflag & ~HAT_SYNC_STOPON_RM);
7584                 CPUSET_OR(cpuset, tset);
7585 
7586                 /*
7587                  * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7588                  * as the "ref" or "mod" is set or share cnt exceeds po_share.
7589                  */
7590                 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7591                     (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7592                     ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7593                         index = 0;
7594                         break;
7595                 }
7596         }
7597 
7598         while (index) {
7599                 index = index >> 1;
7600                 cons++;
7601                 if (index & 0x1) {
7602                         /* Go to leading page */
7603                         pp = PP_GROUPLEADER(pp, cons);
7604                         goto retry;
7605                 }
7606         }
7607 
7608         xt_sync(cpuset);
7609         sfmmu_mlist_exit(pml);
7610         return (PP_GENERIC_ATTR(save_pp));
7611 }
7612 
7613 /*
7614  * Get all the hardware dependent attributes for a page struct
7615  */
7616 static cpuset_t
7617 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7618         uint_t clearflag)
7619 {
7620         caddr_t addr;
7621         tte_t tte, ttemod;
7622         struct hme_blk *hmeblkp;
7623         int ret;
7624         sfmmu_t *sfmmup;
7625         cpuset_t cpuset;
7626 
7627         ASSERT(pp != NULL);
7628         ASSERT(sfmmu_mlist_held(pp));
7629         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7630             (clearflag == HAT_SYNC_ZERORM));
7631 
7632         SFMMU_STAT(sf_pagesync);
7633 
7634         CPUSET_ZERO(cpuset);
7635 
7636 sfmmu_pagesync_retry:
7637 
7638         sfmmu_copytte(&sfhme->hme_tte, &tte);
7639         if (TTE_IS_VALID(&tte)) {
7640                 hmeblkp = sfmmu_hmetohblk(sfhme);
7641                 sfmmup = hblktosfmmu(hmeblkp);
7642                 addr = tte_to_vaddr(hmeblkp, tte);
7643                 if (clearflag == HAT_SYNC_ZERORM) {
7644                         ttemod = tte;
7645                         TTE_CLR_RM(&ttemod);
7646                         ret = sfmmu_modifytte_try(&tte, &ttemod,
7647                             &sfhme->hme_tte);
7648                         if (ret < 0) {
7649                                 /*
7650                                  * cas failed and the new value is not what
7651                                  * we want.
7652                                  */
7653                                 goto sfmmu_pagesync_retry;
7654                         }
7655 
7656                         if (ret > 0) {
7657                                 /* we win the cas */
7658                                 if (hmeblkp->hblk_shared) {
7659                                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7660                                         uint_t rid =
7661                                             hmeblkp->hblk_tag.htag_rid;
7662                                         sf_region_t *rgnp;
7663                                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7664                                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7665                                         ASSERT(srdp != NULL);
7666                                         rgnp = srdp->srd_hmergnp[rid];
7667                                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7668                                             srdp, rgnp, rid);
7669                                         cpuset = sfmmu_rgntlb_demap(addr,
7670                                             rgnp, hmeblkp, 1);
7671                                 } else {
7672                                         sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7673                                             0, 0);
7674                                         cpuset = sfmmup->sfmmu_cpusran;
7675                                 }
7676                         }
7677                 }
7678                 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7679                     &tte, pp);
7680         }
7681         return (cpuset);
7682 }
7683 
7684 /*
7685  * Remove write permission from a mappings to a page, so that
7686  * we can detect the next modification of it. This requires modifying
7687  * the TTE then invalidating (demap) any TLB entry using that TTE.
7688  * This code is similar to sfmmu_pagesync().
7689  */
7690 static cpuset_t
7691 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7692 {
7693         caddr_t addr;
7694         tte_t tte;
7695         tte_t ttemod;
7696         struct hme_blk *hmeblkp;
7697         int ret;
7698         sfmmu_t *sfmmup;
7699         cpuset_t cpuset;
7700 
7701         ASSERT(pp != NULL);
7702         ASSERT(sfmmu_mlist_held(pp));
7703 
7704         CPUSET_ZERO(cpuset);
7705         SFMMU_STAT(sf_clrwrt);
7706 
7707 retry:
7708 
7709         sfmmu_copytte(&sfhme->hme_tte, &tte);
7710         if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7711                 hmeblkp = sfmmu_hmetohblk(sfhme);
7712 
7713                 /*
7714                  * xhat mappings should never be to a VMODSORT page.
7715                  */
7716                 ASSERT(hmeblkp->hblk_xhat_bit == 0);
7717 
7718                 sfmmup = hblktosfmmu(hmeblkp);
7719                 addr = tte_to_vaddr(hmeblkp, tte);
7720 
7721                 ttemod = tte;
7722                 TTE_CLR_WRT(&ttemod);
7723                 TTE_CLR_MOD(&ttemod);
7724                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7725 
7726                 /*
7727                  * if cas failed and the new value is not what
7728                  * we want retry
7729                  */
7730                 if (ret < 0)
7731                         goto retry;
7732 
7733                 /* we win the cas */
7734                 if (ret > 0) {
7735                         if (hmeblkp->hblk_shared) {
7736                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7737                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7738                                 sf_region_t *rgnp;
7739                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7740                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7741                                 ASSERT(srdp != NULL);
7742                                 rgnp = srdp->srd_hmergnp[rid];
7743                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7744                                     srdp, rgnp, rid);
7745                                 cpuset = sfmmu_rgntlb_demap(addr,
7746                                     rgnp, hmeblkp, 1);
7747                         } else {
7748                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7749                                 cpuset = sfmmup->sfmmu_cpusran;
7750                         }
7751                 }
7752         }
7753 
7754         return (cpuset);
7755 }
7756 
7757 /*
7758  * Walk all mappings of a page, removing write permission and clearing the
7759  * ref/mod bits. This code is similar to hat_pagesync()
7760  */
7761 static void
7762 hat_page_clrwrt(page_t *pp)
7763 {
7764         struct sf_hment *sfhme;
7765         struct sf_hment *tmphme = NULL;
7766         kmutex_t *pml;
7767         cpuset_t cpuset;
7768         cpuset_t tset;
7769         int     index;
7770         int      cons;
7771 
7772         CPUSET_ZERO(cpuset);
7773 
7774         pml = sfmmu_mlist_enter(pp);
7775         index = PP_MAPINDEX(pp);
7776         cons = TTE8K;
7777 retry:
7778         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7779                 tmphme = sfhme->hme_next;
7780 
7781                 /*
7782                  * If we are looking for large mappings and this hme doesn't
7783                  * reach the range we are seeking, just ignore its.
7784                  */
7785 
7786                 if (hme_size(sfhme) < cons)
7787                         continue;
7788 
7789                 tset = sfmmu_pageclrwrt(pp, sfhme);
7790                 CPUSET_OR(cpuset, tset);
7791         }
7792 
7793         while (index) {
7794                 index = index >> 1;
7795                 cons++;
7796                 if (index & 0x1) {
7797                         /* Go to leading page */
7798                         pp = PP_GROUPLEADER(pp, cons);
7799                         goto retry;
7800                 }
7801         }
7802 
7803         xt_sync(cpuset);
7804         sfmmu_mlist_exit(pml);
7805 }
7806 
7807 /*
7808  * Set the given REF/MOD/RO bits for the given page.
7809  * For a vnode with a sorted v_pages list, we need to change
7810  * the attributes and the v_pages list together under page_vnode_mutex.
7811  */
7812 void
7813 hat_page_setattr(page_t *pp, uint_t flag)
7814 {
7815         vnode_t         *vp = pp->p_vnode;
7816         page_t          **listp;
7817         kmutex_t        *pmtx;
7818         kmutex_t        *vphm = NULL;
7819         int             noshuffle;
7820 
7821         noshuffle = flag & P_NSH;
7822         flag &= ~P_NSH;
7823 
7824         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7825 
7826         /*
7827          * nothing to do if attribute already set
7828          */
7829         if ((pp->p_nrm & flag) == flag)
7830                 return;
7831 
7832         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7833             !noshuffle) {
7834                 vphm = page_vnode_mutex(vp);
7835                 mutex_enter(vphm);
7836         }
7837 
7838         pmtx = sfmmu_page_enter(pp);
7839         pp->p_nrm |= flag;
7840         sfmmu_page_exit(pmtx);
7841 
7842         if (vphm != NULL) {
7843                 /*
7844                  * Some File Systems examine v_pages for NULL w/o
7845                  * grabbing the vphm mutex. Must not let it become NULL when
7846                  * pp is the only page on the list.
7847                  */
7848                 if (pp->p_vpnext != pp) {
7849                         page_vpsub(&vp->v_pages, pp);
7850                         if (vp->v_pages != NULL)
7851                                 listp = &vp->v_pages->p_vpprev->p_vpnext;
7852                         else
7853                                 listp = &vp->v_pages;
7854                         page_vpadd(listp, pp);
7855                 }
7856                 mutex_exit(vphm);
7857         }
7858 }
7859 
7860 void
7861 hat_page_clrattr(page_t *pp, uint_t flag)
7862 {
7863         vnode_t         *vp = pp->p_vnode;
7864         kmutex_t        *pmtx;
7865 
7866         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7867 
7868         pmtx = sfmmu_page_enter(pp);
7869 
7870         /*
7871          * Caller is expected to hold page's io lock for VMODSORT to work
7872          * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7873          * bit is cleared.
7874          * We don't have assert to avoid tripping some existing third party
7875          * code. The dirty page is moved back to top of the v_page list
7876          * after IO is done in pvn_write_done().
7877          */
7878         pp->p_nrm &= ~flag;
7879         sfmmu_page_exit(pmtx);
7880 
7881         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7882 
7883                 /*
7884                  * VMODSORT works by removing write permissions and getting
7885                  * a fault when a page is made dirty. At this point
7886                  * we need to remove write permission from all mappings
7887                  * to this page.
7888                  */
7889                 hat_page_clrwrt(pp);
7890         }
7891 }
7892 
7893 uint_t
7894 hat_page_getattr(page_t *pp, uint_t flag)
7895 {
7896         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7897         return ((uint_t)(pp->p_nrm & flag));
7898 }
7899 
7900 /*
7901  * DEBUG kernels: verify that a kernel va<->pa translation
7902  * is safe by checking the underlying page_t is in a page
7903  * relocation-safe state.
7904  */
7905 #ifdef  DEBUG
7906 void
7907 sfmmu_check_kpfn(pfn_t pfn)
7908 {
7909         page_t *pp;
7910         int index, cons;
7911 
7912         if (hat_check_vtop == 0)
7913                 return;
7914 
7915         if (kvseg.s_base == NULL || panicstr)
7916                 return;
7917 
7918         pp = page_numtopp_nolock(pfn);
7919         if (!pp)
7920                 return;
7921 
7922         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7923                 return;
7924 
7925         /*
7926          * Handed a large kernel page, we dig up the root page since we
7927          * know the root page might have the lock also.
7928          */
7929         if (pp->p_szc != 0) {
7930                 index = PP_MAPINDEX(pp);
7931                 cons = TTE8K;
7932 again:
7933                 while (index != 0) {
7934                         index >>= 1;
7935                         if (index != 0)
7936                                 cons++;
7937                         if (index & 0x1) {
7938                                 pp = PP_GROUPLEADER(pp, cons);
7939                                 goto again;
7940                         }
7941                 }
7942         }
7943 
7944         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7945                 return;
7946 
7947         /*
7948          * Pages need to be locked or allocated "permanent" (either from
7949          * static_arena arena or explicitly setting PG_NORELOC when calling
7950          * page_create_va()) for VA->PA translations to be valid.
7951          */
7952         if (!PP_ISNORELOC(pp))
7953                 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7954                     (void *)pp);
7955         else
7956                 panic("Illegal VA->PA translation, pp 0x%p not locked",
7957                     (void *)pp);
7958 }
7959 #endif  /* DEBUG */
7960 
7961 /*
7962  * Returns a page frame number for a given virtual address.
7963  * Returns PFN_INVALID to indicate an invalid mapping
7964  */
7965 pfn_t
7966 hat_getpfnum(struct hat *hat, caddr_t addr)
7967 {
7968         pfn_t pfn;
7969         tte_t tte;
7970 
7971         /*
7972          * We would like to
7973          * ASSERT(AS_LOCK_HELD(as));
7974          * but we can't because the iommu driver will call this
7975          * routine at interrupt time and it can't grab the as lock
7976          * or it will deadlock: A thread could have the as lock
7977          * and be waiting for io.  The io can't complete
7978          * because the interrupt thread is blocked trying to grab
7979          * the as lock.
7980          */
7981 
7982         ASSERT(hat->sfmmu_xhat_provider == NULL);
7983 
7984         if (hat == ksfmmup) {
7985                 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7986                         ASSERT(segkmem_lpszc > 0);
7987                         pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7988                         if (pfn != PFN_INVALID) {
7989                                 sfmmu_check_kpfn(pfn);
7990                                 return (pfn);
7991                         }
7992                 } else if (segkpm && IS_KPM_ADDR(addr)) {
7993                         return (sfmmu_kpm_vatopfn(addr));
7994                 }
7995                 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7996                     == PFN_SUSPENDED) {
7997                         sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7998                 }
7999                 sfmmu_check_kpfn(pfn);
8000                 return (pfn);
8001         } else {
8002                 return (sfmmu_uvatopfn(addr, hat, NULL));
8003         }
8004 }
8005 
8006 /*
8007  * This routine will return both pfn and tte for the vaddr.
8008  */
8009 static pfn_t
8010 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
8011 {
8012         struct hmehash_bucket *hmebp;
8013         hmeblk_tag hblktag;
8014         int hmeshift, hashno = 1;
8015         struct hme_blk *hmeblkp = NULL;
8016         tte_t tte;
8017 
8018         struct sf_hment *sfhmep;
8019         pfn_t pfn;
8020 
8021         /* support for ISM */
8022         ism_map_t       *ism_map;
8023         ism_blk_t       *ism_blkp;
8024         int             i;
8025         sfmmu_t *ism_hatid = NULL;
8026         sfmmu_t *locked_hatid = NULL;
8027         sfmmu_t *sv_sfmmup = sfmmup;
8028         caddr_t sv_vaddr = vaddr;
8029         sf_srd_t *srdp;
8030 
8031         if (ttep == NULL) {
8032                 ttep = &tte;
8033         } else {
8034                 ttep->ll = 0;
8035         }
8036 
8037         ASSERT(sfmmup != ksfmmup);
8038         SFMMU_STAT(sf_user_vtop);
8039         /*
8040          * Set ism_hatid if vaddr falls in a ISM segment.
8041          */
8042         ism_blkp = sfmmup->sfmmu_iblk;
8043         if (ism_blkp != NULL) {
8044                 sfmmu_ismhat_enter(sfmmup, 0);
8045                 locked_hatid = sfmmup;
8046         }
8047         while (ism_blkp != NULL && ism_hatid == NULL) {
8048                 ism_map = ism_blkp->iblk_maps;
8049                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
8050                         if (vaddr >= ism_start(ism_map[i]) &&
8051                             vaddr < ism_end(ism_map[i])) {
8052                                 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
8053                                 vaddr = (caddr_t)(vaddr -
8054                                     ism_start(ism_map[i]));
8055                                 break;
8056                         }
8057                 }
8058                 ism_blkp = ism_blkp->iblk_next;
8059         }
8060         if (locked_hatid) {
8061                 sfmmu_ismhat_exit(locked_hatid, 0);
8062         }
8063 
8064         hblktag.htag_id = sfmmup;
8065         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
8066         do {
8067                 hmeshift = HME_HASH_SHIFT(hashno);
8068                 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
8069                 hblktag.htag_rehash = hashno;
8070                 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
8071 
8072                 SFMMU_HASH_LOCK(hmebp);
8073 
8074                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
8075                 if (hmeblkp != NULL) {
8076                         ASSERT(!hmeblkp->hblk_shared);
8077                         HBLKTOHME(sfhmep, hmeblkp, vaddr);
8078                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
8079                         SFMMU_HASH_UNLOCK(hmebp);
8080                         if (TTE_IS_VALID(ttep)) {
8081                                 pfn = TTE_TO_PFN(vaddr, ttep);
8082                                 return (pfn);
8083                         }
8084                         break;
8085                 }
8086                 SFMMU_HASH_UNLOCK(hmebp);
8087                 hashno++;
8088         } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
8089 
8090         if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
8091                 return (PFN_INVALID);
8092         }
8093         srdp = sv_sfmmup->sfmmu_srdp;
8094         ASSERT(srdp != NULL);
8095         ASSERT(srdp->srd_refcnt != 0);
8096         hblktag.htag_id = srdp;
8097         hashno = 1;
8098         do {
8099                 hmeshift = HME_HASH_SHIFT(hashno);
8100                 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
8101                 hblktag.htag_rehash = hashno;
8102                 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
8103 
8104                 SFMMU_HASH_LOCK(hmebp);
8105                 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
8106                     hmeblkp = hmeblkp->hblk_next) {
8107                         uint_t rid;
8108                         sf_region_t *rgnp;
8109                         caddr_t rsaddr;
8110                         caddr_t readdr;
8111 
8112                         if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
8113                             sv_sfmmup->sfmmu_hmeregion_map)) {
8114                                 continue;
8115                         }
8116                         ASSERT(hmeblkp->hblk_shared);
8117                         rid = hmeblkp->hblk_tag.htag_rid;
8118                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8119                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8120                         rgnp = srdp->srd_hmergnp[rid];
8121                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
8122                         HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
8123                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
8124                         rsaddr = rgnp->rgn_saddr;
8125                         readdr = rsaddr + rgnp->rgn_size;
8126 #ifdef DEBUG
8127                         if (TTE_IS_VALID(ttep) ||
8128                             get_hblk_ttesz(hmeblkp) > TTE8K) {
8129                                 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
8130                                 ASSERT(eva > sv_vaddr);
8131                                 ASSERT(sv_vaddr >= rsaddr);
8132                                 ASSERT(sv_vaddr < readdr);
8133                                 ASSERT(eva <= readdr);
8134                         }
8135 #endif /* DEBUG */
8136                         /*
8137                          * Continue the search if we
8138                          * found an invalid 8K tte outside of the area
8139                          * covered by this hmeblk's region.
8140                          */
8141                         if (TTE_IS_VALID(ttep)) {
8142                                 SFMMU_HASH_UNLOCK(hmebp);
8143                                 pfn = TTE_TO_PFN(sv_vaddr, ttep);
8144                                 return (pfn);
8145                         } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
8146                             (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
8147                                 SFMMU_HASH_UNLOCK(hmebp);
8148                                 pfn = PFN_INVALID;
8149                                 return (pfn);
8150                         }
8151                 }
8152                 SFMMU_HASH_UNLOCK(hmebp);
8153                 hashno++;
8154         } while (hashno <= mmu_hashcnt);
8155         return (PFN_INVALID);
8156 }
8157 
8158 
8159 /*
8160  * For compatability with AT&T and later optimizations
8161  */
8162 /* ARGSUSED */
8163 void
8164 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8165 {
8166         ASSERT(hat != NULL);
8167         ASSERT(hat->sfmmu_xhat_provider == NULL);
8168 }
8169 
8170 /*
8171  * Return the number of mappings to a particular page.  This number is an
8172  * approximation of the number of people sharing the page.
8173  *
8174  * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8175  * hat_page_checkshare() can be used to compare threshold to share
8176  * count that reflects the number of region sharers albeit at higher cost.
8177  */
8178 ulong_t
8179 hat_page_getshare(page_t *pp)
8180 {
8181         page_t *spp = pp;       /* start page */
8182         kmutex_t *pml;
8183         ulong_t cnt;
8184         int index, sz = TTE64K;
8185 
8186         /*
8187          * We need to grab the mlist lock to make sure any outstanding
8188          * load/unloads complete.  Otherwise we could return zero
8189          * even though the unload(s) hasn't finished yet.
8190          */
8191         pml = sfmmu_mlist_enter(spp);
8192         cnt = spp->p_share;
8193 
8194 #ifdef VAC
8195         if (kpm_enable)
8196                 cnt += spp->p_kpmref;
8197 #endif
8198         if (vpm_enable && pp->p_vpmref) {
8199                 cnt += 1;
8200         }
8201 
8202         /*
8203          * If we have any large mappings, we count the number of
8204          * mappings that this large page is part of.
8205          */
8206         index = PP_MAPINDEX(spp);
8207         index >>= 1;
8208         while (index) {
8209                 pp = PP_GROUPLEADER(spp, sz);
8210                 if ((index & 0x1) && pp != spp) {
8211                         cnt += pp->p_share;
8212                         spp = pp;
8213                 }
8214                 index >>= 1;
8215                 sz++;
8216         }
8217         sfmmu_mlist_exit(pml);
8218         return (cnt);
8219 }
8220 
8221 /*
8222  * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8223  * otherwise. Count shared hmeblks by region's refcnt.
8224  */
8225 int
8226 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8227 {
8228         kmutex_t *pml;
8229         ulong_t cnt = 0;
8230         int index, sz = TTE8K;
8231         struct sf_hment *sfhme, *tmphme = NULL;
8232         struct hme_blk *hmeblkp;
8233 
8234         pml = sfmmu_mlist_enter(pp);
8235 
8236 #ifdef VAC
8237         if (kpm_enable)
8238                 cnt = pp->p_kpmref;
8239 #endif
8240 
8241         if (vpm_enable && pp->p_vpmref) {
8242                 cnt += 1;
8243         }
8244 
8245         if (pp->p_share + cnt > sh_thresh) {
8246                 sfmmu_mlist_exit(pml);
8247                 return (1);
8248         }
8249 
8250         index = PP_MAPINDEX(pp);
8251 
8252 again:
8253         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8254                 tmphme = sfhme->hme_next;
8255                 if (IS_PAHME(sfhme)) {
8256                         continue;
8257                 }
8258 
8259                 hmeblkp = sfmmu_hmetohblk(sfhme);
8260                 if (hmeblkp->hblk_xhat_bit) {
8261                         cnt++;
8262                         if (cnt > sh_thresh) {
8263                                 sfmmu_mlist_exit(pml);
8264                                 return (1);
8265                         }
8266                         continue;
8267                 }
8268                 if (hme_size(sfhme) != sz) {
8269                         continue;
8270                 }
8271 
8272                 if (hmeblkp->hblk_shared) {
8273                         sf_srd_t *srdp = hblktosrd(hmeblkp);
8274                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
8275                         sf_region_t *rgnp;
8276                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8277                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8278                         ASSERT(srdp != NULL);
8279                         rgnp = srdp->srd_hmergnp[rid];
8280                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8281                             rgnp, rid);
8282                         cnt += rgnp->rgn_refcnt;
8283                 } else {
8284                         cnt++;
8285                 }
8286                 if (cnt > sh_thresh) {
8287                         sfmmu_mlist_exit(pml);
8288                         return (1);
8289                 }
8290         }
8291 
8292         index >>= 1;
8293         sz++;
8294         while (index) {
8295                 pp = PP_GROUPLEADER(pp, sz);
8296                 ASSERT(sfmmu_mlist_held(pp));
8297                 if (index & 0x1) {
8298                         goto again;
8299                 }
8300                 index >>= 1;
8301                 sz++;
8302         }
8303         sfmmu_mlist_exit(pml);
8304         return (0);
8305 }
8306 
8307 /*
8308  * Unload all large mappings to the pp and reset the p_szc field of every
8309  * constituent page according to the remaining mappings.
8310  *
8311  * pp must be locked SE_EXCL. Even though no other constituent pages are
8312  * locked it's legal to unload the large mappings to the pp because all
8313  * constituent pages of large locked mappings have to be locked SE_SHARED.
8314  * This means if we have SE_EXCL lock on one of constituent pages none of the
8315  * large mappings to pp are locked.
8316  *
8317  * Decrease p_szc field starting from the last constituent page and ending
8318  * with the root page. This method is used because other threads rely on the
8319  * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8320  * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8321  * ensures that p_szc changes of the constituent pages appears atomic for all
8322  * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8323  *
8324  * This mechanism is only used for file system pages where it's not always
8325  * possible to get SE_EXCL locks on all constituent pages to demote the size
8326  * code (as is done for anonymous or kernel large pages).
8327  *
8328  * See more comments in front of sfmmu_mlspl_enter().
8329  */
8330 void
8331 hat_page_demote(page_t *pp)
8332 {
8333         int index;
8334         int sz;
8335         cpuset_t cpuset;
8336         int sync = 0;
8337         page_t *rootpp;
8338         struct sf_hment *sfhme;
8339         struct sf_hment *tmphme = NULL;
8340         struct hme_blk *hmeblkp;
8341         uint_t pszc;
8342         page_t *lastpp;
8343         cpuset_t tset;
8344         pgcnt_t npgs;
8345         kmutex_t *pml;
8346         kmutex_t *pmtx = NULL;
8347 
8348         ASSERT(PAGE_EXCL(pp));
8349         ASSERT(!PP_ISFREE(pp));
8350         ASSERT(!PP_ISKAS(pp));
8351         ASSERT(page_szc_lock_assert(pp));
8352         pml = sfmmu_mlist_enter(pp);
8353 
8354         pszc = pp->p_szc;
8355         if (pszc == 0) {
8356                 goto out;
8357         }
8358 
8359         index = PP_MAPINDEX(pp) >> 1;
8360 
8361         if (index) {
8362                 CPUSET_ZERO(cpuset);
8363                 sz = TTE64K;
8364                 sync = 1;
8365         }
8366 
8367         while (index) {
8368                 if (!(index & 0x1)) {
8369                         index >>= 1;
8370                         sz++;
8371                         continue;
8372                 }
8373                 ASSERT(sz <= pszc);
8374                 rootpp = PP_GROUPLEADER(pp, sz);
8375                 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8376                         tmphme = sfhme->hme_next;
8377                         ASSERT(!IS_PAHME(sfhme));
8378                         hmeblkp = sfmmu_hmetohblk(sfhme);
8379                         if (hme_size(sfhme) != sz) {
8380                                 continue;
8381                         }
8382                         if (hmeblkp->hblk_xhat_bit) {
8383                                 cmn_err(CE_PANIC,
8384                                     "hat_page_demote: xhat hmeblk");
8385                         }
8386                         tset = sfmmu_pageunload(rootpp, sfhme, sz);
8387                         CPUSET_OR(cpuset, tset);
8388                 }
8389                 if (index >>= 1) {
8390                         sz++;
8391                 }
8392         }
8393 
8394         ASSERT(!PP_ISMAPPED_LARGE(pp));
8395 
8396         if (sync) {
8397                 xt_sync(cpuset);
8398 #ifdef VAC
8399                 if (PP_ISTNC(pp)) {
8400                         conv_tnc(rootpp, sz);
8401                 }
8402 #endif  /* VAC */
8403         }
8404 
8405         pmtx = sfmmu_page_enter(pp);
8406 
8407         ASSERT(pp->p_szc == pszc);
8408         rootpp = PP_PAGEROOT(pp);
8409         ASSERT(rootpp->p_szc == pszc);
8410         lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8411 
8412         while (lastpp != rootpp) {
8413                 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8414                 ASSERT(sz < pszc);
8415                 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8416                 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8417                 while (--npgs > 0) {
8418                         lastpp->p_szc = (uchar_t)sz;
8419                         lastpp = PP_PAGEPREV(lastpp);
8420                 }
8421                 if (sz) {
8422                         /*
8423                          * make sure before current root's pszc
8424                          * is updated all updates to constituent pages pszc
8425                          * fields are globally visible.
8426                          */
8427                         membar_producer();
8428                 }
8429                 lastpp->p_szc = sz;
8430                 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8431                 if (lastpp != rootpp) {
8432                         lastpp = PP_PAGEPREV(lastpp);
8433                 }
8434         }
8435         if (sz == 0) {
8436                 /* the loop above doesn't cover this case */
8437                 rootpp->p_szc = 0;
8438         }
8439 out:
8440         ASSERT(pp->p_szc == 0);
8441         if (pmtx != NULL) {
8442                 sfmmu_page_exit(pmtx);
8443         }
8444         sfmmu_mlist_exit(pml);
8445 }
8446 
8447 /*
8448  * Refresh the HAT ismttecnt[] element for size szc.
8449  * Caller must have set ISM busy flag to prevent mapping
8450  * lists from changing while we're traversing them.
8451  */
8452 pgcnt_t
8453 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8454 {
8455         ism_blk_t       *ism_blkp = sfmmup->sfmmu_iblk;
8456         ism_map_t       *ism_map;
8457         pgcnt_t         npgs = 0;
8458         pgcnt_t         npgs_scd = 0;
8459         int             j;
8460         sf_scd_t        *scdp;
8461         uchar_t         rid;
8462 
8463         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8464         scdp = sfmmup->sfmmu_scdp;
8465 
8466         for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8467                 ism_map = ism_blkp->iblk_maps;
8468                 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8469                         rid = ism_map[j].imap_rid;
8470                         ASSERT(rid == SFMMU_INVALID_ISMRID ||
8471                             rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8472 
8473                         if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8474                             SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8475                                 /* ISM is in sfmmup's SCD */
8476                                 npgs_scd +=
8477                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8478                         } else {
8479                                 /* ISMs is not in SCD */
8480                                 npgs +=
8481                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8482                         }
8483                 }
8484         }
8485         sfmmup->sfmmu_ismttecnt[szc] = npgs;
8486         sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8487         return (npgs);
8488 }
8489 
8490 /*
8491  * Yield the memory claim requirement for an address space.
8492  *
8493  * This is currently implemented as the number of bytes that have active
8494  * hardware translations that have page structures.  Therefore, it can
8495  * underestimate the traditional resident set size, eg, if the
8496  * physical page is present and the hardware translation is missing;
8497  * and it can overestimate the rss, eg, if there are active
8498  * translations to a frame buffer with page structs.
8499  * Also, it does not take sharing into account.
8500  *
8501  * Note that we don't acquire locks here since this function is most often
8502  * called from the clock thread.
8503  */
8504 size_t
8505 hat_get_mapped_size(struct hat *hat)
8506 {
8507         size_t          assize = 0;
8508         int             i;
8509 
8510         if (hat == NULL)
8511                 return (0);
8512 
8513         ASSERT(hat->sfmmu_xhat_provider == NULL);
8514 
8515         for (i = 0; i < mmu_page_sizes; i++)
8516                 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8517                     (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8518 
8519         if (hat->sfmmu_iblk == NULL)
8520                 return (assize);
8521 
8522         for (i = 0; i < mmu_page_sizes; i++)
8523                 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8524                     (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8525 
8526         return (assize);
8527 }
8528 
8529 int
8530 hat_stats_enable(struct hat *hat)
8531 {
8532         hatlock_t       *hatlockp;
8533 
8534         ASSERT(hat->sfmmu_xhat_provider == NULL);
8535 
8536         hatlockp = sfmmu_hat_enter(hat);
8537         hat->sfmmu_rmstat++;
8538         sfmmu_hat_exit(hatlockp);
8539         return (1);
8540 }
8541 
8542 void
8543 hat_stats_disable(struct hat *hat)
8544 {
8545         hatlock_t       *hatlockp;
8546 
8547         ASSERT(hat->sfmmu_xhat_provider == NULL);
8548 
8549         hatlockp = sfmmu_hat_enter(hat);
8550         hat->sfmmu_rmstat--;
8551         sfmmu_hat_exit(hatlockp);
8552 }
8553 
8554 /*
8555  * Routines for entering or removing  ourselves from the
8556  * ism_hat's mapping list. This is used for both private and
8557  * SCD hats.
8558  */
8559 static void
8560 iment_add(struct ism_ment *iment,  struct hat *ism_hat)
8561 {
8562         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8563 
8564         iment->iment_prev = NULL;
8565         iment->iment_next = ism_hat->sfmmu_iment;
8566         if (ism_hat->sfmmu_iment) {
8567                 ism_hat->sfmmu_iment->iment_prev = iment;
8568         }
8569         ism_hat->sfmmu_iment = iment;
8570 }
8571 
8572 static void
8573 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8574 {
8575         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8576 
8577         if (ism_hat->sfmmu_iment == NULL) {
8578                 panic("ism map entry remove - no entries");
8579         }
8580 
8581         if (iment->iment_prev) {
8582                 ASSERT(ism_hat->sfmmu_iment != iment);
8583                 iment->iment_prev->iment_next = iment->iment_next;
8584         } else {
8585                 ASSERT(ism_hat->sfmmu_iment == iment);
8586                 ism_hat->sfmmu_iment = iment->iment_next;
8587         }
8588 
8589         if (iment->iment_next) {
8590                 iment->iment_next->iment_prev = iment->iment_prev;
8591         }
8592 
8593         /*
8594          * zero out the entry
8595          */
8596         iment->iment_next = NULL;
8597         iment->iment_prev = NULL;
8598         iment->iment_hat =  NULL;
8599         iment->iment_base_va = 0;
8600 }
8601 
8602 /*
8603  * Hat_share()/unshare() return an (non-zero) error
8604  * when saddr and daddr are not properly aligned.
8605  *
8606  * The top level mapping element determines the alignment
8607  * requirement for saddr and daddr, depending on different
8608  * architectures.
8609  *
8610  * When hat_share()/unshare() are not supported,
8611  * HATOP_SHARE()/UNSHARE() return 0
8612  */
8613 int
8614 hat_share(struct hat *sfmmup, caddr_t addr,
8615         struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8616 {
8617         ism_blk_t       *ism_blkp;
8618         ism_blk_t       *new_iblk;
8619         ism_map_t       *ism_map;
8620         ism_ment_t      *ism_ment;
8621         int             i, added;
8622         hatlock_t       *hatlockp;
8623         int             reload_mmu = 0;
8624         uint_t          ismshift = page_get_shift(ismszc);
8625         size_t          ismpgsz = page_get_pagesize(ismszc);
8626         uint_t          ismmask = (uint_t)ismpgsz - 1;
8627         size_t          sh_size = ISM_SHIFT(ismshift, len);
8628         ushort_t        ismhatflag;
8629         hat_region_cookie_t rcookie;
8630         sf_scd_t        *old_scdp;
8631 
8632 #ifdef DEBUG
8633         caddr_t         eaddr = addr + len;
8634 #endif /* DEBUG */
8635 
8636         ASSERT(ism_hatid != NULL && sfmmup != NULL);
8637         ASSERT(sptaddr == ISMID_STARTADDR);
8638         /*
8639          * Check the alignment.
8640          */
8641         if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8642                 return (EINVAL);
8643 
8644         /*
8645          * Check size alignment.
8646          */
8647         if (!ISM_ALIGNED(ismshift, len))
8648                 return (EINVAL);
8649 
8650         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
8651 
8652         /*
8653          * Allocate ism_ment for the ism_hat's mapping list, and an
8654          * ism map blk in case we need one.  We must do our
8655          * allocations before acquiring locks to prevent a deadlock
8656          * in the kmem allocator on the mapping list lock.
8657          */
8658         new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8659         ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8660 
8661         /*
8662          * Serialize ISM mappings with the ISM busy flag, and also the
8663          * trap handlers.
8664          */
8665         sfmmu_ismhat_enter(sfmmup, 0);
8666 
8667         /*
8668          * Allocate an ism map blk if necessary.
8669          */
8670         if (sfmmup->sfmmu_iblk == NULL) {
8671                 sfmmup->sfmmu_iblk = new_iblk;
8672                 bzero(new_iblk, sizeof (*new_iblk));
8673                 new_iblk->iblk_nextpa = (uint64_t)-1;
8674                 membar_stst();  /* make sure next ptr visible to all CPUs */
8675                 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8676                 reload_mmu = 1;
8677                 new_iblk = NULL;
8678         }
8679 
8680 #ifdef DEBUG
8681         /*
8682          * Make sure mapping does not already exist.
8683          */
8684         ism_blkp = sfmmup->sfmmu_iblk;
8685         while (ism_blkp != NULL) {
8686                 ism_map = ism_blkp->iblk_maps;
8687                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8688                         if ((addr >= ism_start(ism_map[i]) &&
8689                             addr < ism_end(ism_map[i])) ||
8690                             eaddr > ism_start(ism_map[i]) &&
8691                             eaddr <= ism_end(ism_map[i])) {
8692                                 panic("sfmmu_share: Already mapped!");
8693                         }
8694                 }
8695                 ism_blkp = ism_blkp->iblk_next;
8696         }
8697 #endif /* DEBUG */
8698 
8699         ASSERT(ismszc >= TTE4M);
8700         if (ismszc == TTE4M) {
8701                 ismhatflag = HAT_4M_FLAG;
8702         } else if (ismszc == TTE32M) {
8703                 ismhatflag = HAT_32M_FLAG;
8704         } else if (ismszc == TTE256M) {
8705                 ismhatflag = HAT_256M_FLAG;
8706         }
8707         /*
8708          * Add mapping to first available mapping slot.
8709          */
8710         ism_blkp = sfmmup->sfmmu_iblk;
8711         added = 0;
8712         while (!added) {
8713                 ism_map = ism_blkp->iblk_maps;
8714                 for (i = 0; i < ISM_MAP_SLOTS; i++)  {
8715                         if (ism_map[i].imap_ismhat == NULL) {
8716 
8717                                 ism_map[i].imap_ismhat = ism_hatid;
8718                                 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8719                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8720                                 ism_map[i].imap_hatflags = ismhatflag;
8721                                 ism_map[i].imap_sz_mask = ismmask;
8722                                 /*
8723                                  * imap_seg is checked in ISM_CHECK to see if
8724                                  * non-NULL, then other info assumed valid.
8725                                  */
8726                                 membar_stst();
8727                                 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8728                                 ism_map[i].imap_ment = ism_ment;
8729 
8730                                 /*
8731                                  * Now add ourselves to the ism_hat's
8732                                  * mapping list.
8733                                  */
8734                                 ism_ment->iment_hat = sfmmup;
8735                                 ism_ment->iment_base_va = addr;
8736                                 ism_hatid->sfmmu_ismhat = 1;
8737                                 mutex_enter(&ism_mlist_lock);
8738                                 iment_add(ism_ment, ism_hatid);
8739                                 mutex_exit(&ism_mlist_lock);
8740                                 added = 1;
8741                                 break;
8742                         }
8743                 }
8744                 if (!added && ism_blkp->iblk_next == NULL) {
8745                         ism_blkp->iblk_next = new_iblk;
8746                         new_iblk = NULL;
8747                         bzero(ism_blkp->iblk_next,
8748                             sizeof (*ism_blkp->iblk_next));
8749                         ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8750                         membar_stst();
8751                         ism_blkp->iblk_nextpa =
8752                             va_to_pa((caddr_t)ism_blkp->iblk_next);
8753                 }
8754                 ism_blkp = ism_blkp->iblk_next;
8755         }
8756 
8757         /*
8758          * After calling hat_join_region, sfmmup may join a new SCD or
8759          * move from the old scd to a new scd, in which case, we want to
8760          * shrink the sfmmup's private tsb size, i.e., pass shrink to
8761          * sfmmu_check_page_sizes at the end of this routine.
8762          */
8763         old_scdp = sfmmup->sfmmu_scdp;
8764 
8765         rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8766             PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8767         if (rcookie != HAT_INVALID_REGION_COOKIE) {
8768                 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8769         }
8770         /*
8771          * Update our counters for this sfmmup's ism mappings.
8772          */
8773         for (i = 0; i <= ismszc; i++) {
8774                 if (!(disable_ism_large_pages & (1 << i)))
8775                         (void) ism_tsb_entries(sfmmup, i);
8776         }
8777 
8778         /*
8779          * For ISM and DISM we do not support 512K pages, so we only only
8780          * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8781          * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8782          *
8783          * Need to set 32M/256M ISM flags to make sure
8784          * sfmmu_check_page_sizes() enables them on Panther.
8785          */
8786         ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8787 
8788         switch (ismszc) {
8789         case TTE256M:
8790                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8791                         hatlockp = sfmmu_hat_enter(sfmmup);
8792                         SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8793                         sfmmu_hat_exit(hatlockp);
8794                 }
8795                 break;
8796         case TTE32M:
8797                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8798                         hatlockp = sfmmu_hat_enter(sfmmup);
8799                         SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8800                         sfmmu_hat_exit(hatlockp);
8801                 }
8802                 break;
8803         default:
8804                 break;
8805         }
8806 
8807         /*
8808          * If we updated the ismblkpa for this HAT we must make
8809          * sure all CPUs running this process reload their tsbmiss area.
8810          * Otherwise they will fail to load the mappings in the tsbmiss
8811          * handler and will loop calling pagefault().
8812          */
8813         if (reload_mmu) {
8814                 hatlockp = sfmmu_hat_enter(sfmmup);
8815                 sfmmu_sync_mmustate(sfmmup);
8816                 sfmmu_hat_exit(hatlockp);
8817         }
8818 
8819         sfmmu_ismhat_exit(sfmmup, 0);
8820 
8821         /*
8822          * Free up ismblk if we didn't use it.
8823          */
8824         if (new_iblk != NULL)
8825                 kmem_cache_free(ism_blk_cache, new_iblk);
8826 
8827         /*
8828          * Check TSB and TLB page sizes.
8829          */
8830         if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8831                 sfmmu_check_page_sizes(sfmmup, 0);
8832         } else {
8833                 sfmmu_check_page_sizes(sfmmup, 1);
8834         }
8835         return (0);
8836 }
8837 
8838 /*
8839  * hat_unshare removes exactly one ism_map from
8840  * this process's as.  It expects multiple calls
8841  * to hat_unshare for multiple shm segments.
8842  */
8843 void
8844 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8845 {
8846         ism_map_t       *ism_map;
8847         ism_ment_t      *free_ment = NULL;
8848         ism_blk_t       *ism_blkp;
8849         struct hat      *ism_hatid;
8850         int             found, i;
8851         hatlock_t       *hatlockp;
8852         struct tsb_info *tsbinfo;
8853         uint_t          ismshift = page_get_shift(ismszc);
8854         size_t          sh_size = ISM_SHIFT(ismshift, len);
8855         uchar_t         ism_rid;
8856         sf_scd_t        *old_scdp;
8857 
8858         ASSERT(ISM_ALIGNED(ismshift, addr));
8859         ASSERT(ISM_ALIGNED(ismshift, len));
8860         ASSERT(sfmmup != NULL);
8861         ASSERT(sfmmup != ksfmmup);
8862 
8863         if (sfmmup->sfmmu_xhat_provider) {
8864                 XHAT_UNSHARE(sfmmup, addr, len);
8865                 return;
8866         } else {
8867                 /*
8868                  * This must be a CPU HAT. If the address space has
8869                  * XHATs attached, inform all XHATs that ISM segment
8870                  * is going away
8871                  */
8872                 ASSERT(sfmmup->sfmmu_as != NULL);
8873                 if (sfmmup->sfmmu_as->a_xhat != NULL)
8874                         xhat_unshare_all(sfmmup->sfmmu_as, addr, len);
8875         }
8876 
8877         /*
8878          * Make sure that during the entire time ISM mappings are removed,
8879          * the trap handlers serialize behind us, and that no one else
8880          * can be mucking with ISM mappings.  This also lets us get away
8881          * with not doing expensive cross calls to flush the TLB -- we
8882          * just discard the context, flush the entire TSB, and call it
8883          * a day.
8884          */
8885         sfmmu_ismhat_enter(sfmmup, 0);
8886 
8887         /*
8888          * Remove the mapping.
8889          *
8890          * We can't have any holes in the ism map.
8891          * The tsb miss code while searching the ism map will
8892          * stop on an empty map slot.  So we must move
8893          * everyone past the hole up 1 if any.
8894          *
8895          * Also empty ism map blks are not freed until the
8896          * process exits. This is to prevent a MT race condition
8897          * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8898          */
8899         found = 0;
8900         ism_blkp = sfmmup->sfmmu_iblk;
8901         while (!found && ism_blkp != NULL) {
8902                 ism_map = ism_blkp->iblk_maps;
8903                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8904                         if (addr == ism_start(ism_map[i]) &&
8905                             sh_size == (size_t)(ism_size(ism_map[i]))) {
8906                                 found = 1;
8907                                 break;
8908                         }
8909                 }
8910                 if (!found)
8911                         ism_blkp = ism_blkp->iblk_next;
8912         }
8913 
8914         if (found) {
8915                 ism_hatid = ism_map[i].imap_ismhat;
8916                 ism_rid = ism_map[i].imap_rid;
8917                 ASSERT(ism_hatid != NULL);
8918                 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8919 
8920                 /*
8921                  * After hat_leave_region, the sfmmup may leave SCD,
8922                  * in which case, we want to grow the private tsb size when
8923                  * calling sfmmu_check_page_sizes at the end of the routine.
8924                  */
8925                 old_scdp = sfmmup->sfmmu_scdp;
8926                 /*
8927                  * Then remove ourselves from the region.
8928                  */
8929                 if (ism_rid != SFMMU_INVALID_ISMRID) {
8930                         hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8931                             HAT_REGION_ISM);
8932                 }
8933 
8934                 /*
8935                  * And now guarantee that any other cpu
8936                  * that tries to process an ISM miss
8937                  * will go to tl=0.
8938                  */
8939                 hatlockp = sfmmu_hat_enter(sfmmup);
8940                 sfmmu_invalidate_ctx(sfmmup);
8941                 sfmmu_hat_exit(hatlockp);
8942 
8943                 /*
8944                  * Remove ourselves from the ism mapping list.
8945                  */
8946                 mutex_enter(&ism_mlist_lock);
8947                 iment_sub(ism_map[i].imap_ment, ism_hatid);
8948                 mutex_exit(&ism_mlist_lock);
8949                 free_ment = ism_map[i].imap_ment;
8950 
8951                 /*
8952                  * We delete the ism map by copying
8953                  * the next map over the current one.
8954                  * We will take the next one in the maps
8955                  * array or from the next ism_blk.
8956                  */
8957                 while (ism_blkp != NULL) {
8958                         ism_map = ism_blkp->iblk_maps;
8959                         while (i < (ISM_MAP_SLOTS - 1)) {
8960                                 ism_map[i] = ism_map[i + 1];
8961                                 i++;
8962                         }
8963                         /* i == (ISM_MAP_SLOTS - 1) */
8964                         ism_blkp = ism_blkp->iblk_next;
8965                         if (ism_blkp != NULL) {
8966                                 ism_map[i] = ism_blkp->iblk_maps[0];
8967                                 i = 0;
8968                         } else {
8969                                 ism_map[i].imap_seg = 0;
8970                                 ism_map[i].imap_vb_shift = 0;
8971                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8972                                 ism_map[i].imap_hatflags = 0;
8973                                 ism_map[i].imap_sz_mask = 0;
8974                                 ism_map[i].imap_ismhat = NULL;
8975                                 ism_map[i].imap_ment = NULL;
8976                         }
8977                 }
8978 
8979                 /*
8980                  * Now flush entire TSB for the process, since
8981                  * demapping page by page can be too expensive.
8982                  * We don't have to flush the TLB here anymore
8983                  * since we switch to a new TLB ctx instead.
8984                  * Also, there is no need to flush if the process
8985                  * is exiting since the TSB will be freed later.
8986                  */
8987                 if (!sfmmup->sfmmu_free) {
8988                         hatlockp = sfmmu_hat_enter(sfmmup);
8989                         for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8990                             tsbinfo = tsbinfo->tsb_next) {
8991                                 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8992                                         continue;
8993                                 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8994                                         tsbinfo->tsb_flags |=
8995                                             TSB_FLUSH_NEEDED;
8996                                         continue;
8997                                 }
8998 
8999                                 sfmmu_inv_tsb(tsbinfo->tsb_va,
9000                                     TSB_BYTES(tsbinfo->tsb_szc));
9001                         }
9002                         sfmmu_hat_exit(hatlockp);
9003                 }
9004         }
9005 
9006         /*
9007          * Update our counters for this sfmmup's ism mappings.
9008          */
9009         for (i = 0; i <= ismszc; i++) {
9010                 if (!(disable_ism_large_pages & (1 << i)))
9011                         (void) ism_tsb_entries(sfmmup, i);
9012         }
9013 
9014         sfmmu_ismhat_exit(sfmmup, 0);
9015 
9016         /*
9017          * We must do our freeing here after dropping locks
9018          * to prevent a deadlock in the kmem allocator on the
9019          * mapping list lock.
9020          */
9021         if (free_ment != NULL)
9022                 kmem_cache_free(ism_ment_cache, free_ment);
9023 
9024         /*
9025          * Check TSB and TLB page sizes if the process isn't exiting.
9026          */
9027         if (!sfmmup->sfmmu_free) {
9028                 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
9029                         sfmmu_check_page_sizes(sfmmup, 1);
9030                 } else {
9031                         sfmmu_check_page_sizes(sfmmup, 0);
9032                 }
9033         }
9034 }
9035 
9036 /* ARGSUSED */
9037 static int
9038 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
9039 {
9040         /* void *buf is sfmmu_t pointer */
9041         bzero(buf, sizeof (sfmmu_t));
9042 
9043         return (0);
9044 }
9045 
9046 /* ARGSUSED */
9047 static void
9048 sfmmu_idcache_destructor(void *buf, void *cdrarg)
9049 {
9050         /* void *buf is sfmmu_t pointer */
9051 }
9052 
9053 /*
9054  * setup kmem hmeblks by bzeroing all members and initializing the nextpa
9055  * field to be the pa of this hmeblk
9056  */
9057 /* ARGSUSED */
9058 static int
9059 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
9060 {
9061         struct hme_blk *hmeblkp;
9062 
9063         bzero(buf, (size_t)cdrarg);
9064         hmeblkp = (struct hme_blk *)buf;
9065         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
9066 
9067 #ifdef  HBLK_TRACE
9068         mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
9069 #endif  /* HBLK_TRACE */
9070 
9071         return (0);
9072 }
9073 
9074 /* ARGSUSED */
9075 static void
9076 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
9077 {
9078 
9079 #ifdef  HBLK_TRACE
9080 
9081         struct hme_blk *hmeblkp;
9082 
9083         hmeblkp = (struct hme_blk *)buf;
9084         mutex_destroy(&hmeblkp->hblk_audit_lock);
9085 
9086 #endif  /* HBLK_TRACE */
9087 }
9088 
9089 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
9090 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
9091 /*
9092  * The kmem allocator will callback into our reclaim routine when the system
9093  * is running low in memory.  We traverse the hash and free up all unused but
9094  * still cached hme_blks.  We also traverse the free list and free them up
9095  * as well.
9096  */
9097 /*ARGSUSED*/
9098 static void
9099 sfmmu_hblkcache_reclaim(void *cdrarg)
9100 {
9101         int i;
9102         struct hmehash_bucket *hmebp;
9103         struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
9104         static struct hmehash_bucket *uhmehash_reclaim_hand;
9105         static struct hmehash_bucket *khmehash_reclaim_hand;
9106         struct hme_blk *list = NULL, *last_hmeblkp;
9107         cpuset_t cpuset = cpu_ready_set;
9108         cpu_hme_pend_t *cpuhp;
9109 
9110         /* Free up hmeblks on the cpu pending lists */
9111         for (i = 0; i < NCPU; i++) {
9112                 cpuhp = &cpu_hme_pend[i];
9113                 if (cpuhp->chp_listp != NULL)  {
9114                         mutex_enter(&cpuhp->chp_mutex);
9115                         if (cpuhp->chp_listp == NULL) {
9116                                 mutex_exit(&cpuhp->chp_mutex);
9117                                 continue;
9118                         }
9119                         for (last_hmeblkp = cpuhp->chp_listp;
9120                             last_hmeblkp->hblk_next != NULL;
9121                             last_hmeblkp = last_hmeblkp->hblk_next)
9122                                 ;
9123                         last_hmeblkp->hblk_next = list;
9124                         list = cpuhp->chp_listp;
9125                         cpuhp->chp_listp = NULL;
9126                         cpuhp->chp_count = 0;
9127                         mutex_exit(&cpuhp->chp_mutex);
9128                 }
9129 
9130         }
9131 
9132         if (list != NULL) {
9133                 kpreempt_disable();
9134                 CPUSET_DEL(cpuset, CPU->cpu_id);
9135                 xt_sync(cpuset);
9136                 xt_sync(cpuset);
9137                 kpreempt_enable();
9138                 sfmmu_hblk_free(&list);
9139                 list = NULL;
9140         }
9141 
9142         hmebp = uhmehash_reclaim_hand;
9143         if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
9144                 uhmehash_reclaim_hand = hmebp = uhme_hash;
9145         uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9146 
9147         for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9148                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9149                         hmeblkp = hmebp->hmeblkp;
9150                         pr_hblk = NULL;
9151                         while (hmeblkp) {
9152                                 nx_hblk = hmeblkp->hblk_next;
9153                                 if (!hmeblkp->hblk_vcnt &&
9154                                     !hmeblkp->hblk_hmecnt) {
9155                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9156                                             pr_hblk, &list, 0);
9157                                 } else {
9158                                         pr_hblk = hmeblkp;
9159                                 }
9160                                 hmeblkp = nx_hblk;
9161                         }
9162                         SFMMU_HASH_UNLOCK(hmebp);
9163                 }
9164                 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
9165                         hmebp = uhme_hash;
9166         }
9167 
9168         hmebp = khmehash_reclaim_hand;
9169         if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
9170                 khmehash_reclaim_hand = hmebp = khme_hash;
9171         khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9172 
9173         for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9174                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9175                         hmeblkp = hmebp->hmeblkp;
9176                         pr_hblk = NULL;
9177                         while (hmeblkp) {
9178                                 nx_hblk = hmeblkp->hblk_next;
9179                                 if (!hmeblkp->hblk_vcnt &&
9180                                     !hmeblkp->hblk_hmecnt) {
9181                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9182                                             pr_hblk, &list, 0);
9183                                 } else {
9184                                         pr_hblk = hmeblkp;
9185                                 }
9186                                 hmeblkp = nx_hblk;
9187                         }
9188                         SFMMU_HASH_UNLOCK(hmebp);
9189                 }
9190                 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9191                         hmebp = khme_hash;
9192         }
9193         sfmmu_hblks_list_purge(&list, 0);
9194 }
9195 
9196 /*
9197  * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9198  * same goes for sfmmu_get_addrvcolor().
9199  *
9200  * This function will return the virtual color for the specified page. The
9201  * virtual color corresponds to this page current mapping or its last mapping.
9202  * It is used by memory allocators to choose addresses with the correct
9203  * alignment so vac consistency is automatically maintained.  If the page
9204  * has no color it returns -1.
9205  */
9206 /*ARGSUSED*/
9207 int
9208 sfmmu_get_ppvcolor(struct page *pp)
9209 {
9210 #ifdef VAC
9211         int color;
9212 
9213         if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9214                 return (-1);
9215         }
9216         color = PP_GET_VCOLOR(pp);
9217         ASSERT(color < mmu_btop(shm_alignment));
9218         return (color);
9219 #else
9220         return (-1);
9221 #endif  /* VAC */
9222 }
9223 
9224 /*
9225  * This function will return the desired alignment for vac consistency
9226  * (vac color) given a virtual address.  If no vac is present it returns -1.
9227  */
9228 /*ARGSUSED*/
9229 int
9230 sfmmu_get_addrvcolor(caddr_t vaddr)
9231 {
9232 #ifdef VAC
9233         if (cache & CACHE_VAC) {
9234                 return (addr_to_vcolor(vaddr));
9235         } else {
9236                 return (-1);
9237         }
9238 #else
9239         return (-1);
9240 #endif  /* VAC */
9241 }
9242 
9243 #ifdef VAC
9244 /*
9245  * Check for conflicts.
9246  * A conflict exists if the new and existent mappings do not match in
9247  * their "shm_alignment fields. If conflicts exist, the existant mappings
9248  * are flushed unless one of them is locked. If one of them is locked, then
9249  * the mappings are flushed and converted to non-cacheable mappings.
9250  */
9251 static void
9252 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9253 {
9254         struct hat *tmphat;
9255         struct sf_hment *sfhmep, *tmphme = NULL;
9256         struct hme_blk *hmeblkp;
9257         int vcolor;
9258         tte_t tte;
9259 
9260         ASSERT(sfmmu_mlist_held(pp));
9261         ASSERT(!PP_ISNC(pp));           /* page better be cacheable */
9262 
9263         vcolor = addr_to_vcolor(addr);
9264         if (PP_NEWPAGE(pp)) {
9265                 PP_SET_VCOLOR(pp, vcolor);
9266                 return;
9267         }
9268 
9269         if (PP_GET_VCOLOR(pp) == vcolor) {
9270                 return;
9271         }
9272 
9273         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9274                 /*
9275                  * Previous user of page had a different color
9276                  * but since there are no current users
9277                  * we just flush the cache and change the color.
9278                  */
9279                 SFMMU_STAT(sf_pgcolor_conflict);
9280                 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9281                 PP_SET_VCOLOR(pp, vcolor);
9282                 return;
9283         }
9284 
9285         /*
9286          * If we get here we have a vac conflict with a current
9287          * mapping.  VAC conflict policy is as follows.
9288          * - The default is to unload the other mappings unless:
9289          * - If we have a large mapping we uncache the page.
9290          * We need to uncache the rest of the large page too.
9291          * - If any of the mappings are locked we uncache the page.
9292          * - If the requested mapping is inconsistent
9293          * with another mapping and that mapping
9294          * is in the same address space we have to
9295          * make it non-cached.  The default thing
9296          * to do is unload the inconsistent mapping
9297          * but if they are in the same address space
9298          * we run the risk of unmapping the pc or the
9299          * stack which we will use as we return to the user,
9300          * in which case we can then fault on the thing
9301          * we just unloaded and get into an infinite loop.
9302          */
9303         if (PP_ISMAPPED_LARGE(pp)) {
9304                 int sz;
9305 
9306                 /*
9307                  * Existing mapping is for big pages. We don't unload
9308                  * existing big mappings to satisfy new mappings.
9309                  * Always convert all mappings to TNC.
9310                  */
9311                 sz = fnd_mapping_sz(pp);
9312                 pp = PP_GROUPLEADER(pp, sz);
9313                 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9314                 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9315                     TTEPAGES(sz));
9316 
9317                 return;
9318         }
9319 
9320         /*
9321          * check if any mapping is in same as or if it is locked
9322          * since in that case we need to uncache.
9323          */
9324         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9325                 tmphme = sfhmep->hme_next;
9326                 if (IS_PAHME(sfhmep))
9327                         continue;
9328                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9329                 if (hmeblkp->hblk_xhat_bit)
9330                         continue;
9331                 tmphat = hblktosfmmu(hmeblkp);
9332                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9333                 ASSERT(TTE_IS_VALID(&tte));
9334                 if (hmeblkp->hblk_shared || tmphat == hat ||
9335                     hmeblkp->hblk_lckcnt) {
9336                         /*
9337                          * We have an uncache conflict
9338                          */
9339                         SFMMU_STAT(sf_uncache_conflict);
9340                         sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9341                         return;
9342                 }
9343         }
9344 
9345         /*
9346          * We have an unload conflict
9347          * We have already checked for LARGE mappings, therefore
9348          * the remaining mapping(s) must be TTE8K.
9349          */
9350         SFMMU_STAT(sf_unload_conflict);
9351 
9352         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9353                 tmphme = sfhmep->hme_next;
9354                 if (IS_PAHME(sfhmep))
9355                         continue;
9356                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9357                 if (hmeblkp->hblk_xhat_bit)
9358                         continue;
9359                 ASSERT(!hmeblkp->hblk_shared);
9360                 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9361         }
9362 
9363         if (PP_ISMAPPED_KPM(pp))
9364                 sfmmu_kpm_vac_unload(pp, addr);
9365 
9366         /*
9367          * Unloads only do TLB flushes so we need to flush the
9368          * cache here.
9369          */
9370         sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9371         PP_SET_VCOLOR(pp, vcolor);
9372 }
9373 
9374 /*
9375  * Whenever a mapping is unloaded and the page is in TNC state,
9376  * we see if the page can be made cacheable again. 'pp' is
9377  * the page that we just unloaded a mapping from, the size
9378  * of mapping that was unloaded is 'ottesz'.
9379  * Remark:
9380  * The recache policy for mpss pages can leave a performance problem
9381  * under the following circumstances:
9382  * . A large page in uncached mode has just been unmapped.
9383  * . All constituent pages are TNC due to a conflicting small mapping.
9384  * . There are many other, non conflicting, small mappings around for
9385  *   a lot of the constituent pages.
9386  * . We're called w/ the "old" groupleader page and the old ottesz,
9387  *   but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9388  *   we end up w/ TTE8K or npages == 1.
9389  * . We call tst_tnc w/ the old groupleader only, and if there is no
9390  *   conflict, we re-cache only this page.
9391  * . All other small mappings are not checked and will be left in TNC mode.
9392  * The problem is not very serious because:
9393  * . mpss is actually only defined for heap and stack, so the probability
9394  *   is not very high that a large page mapping exists in parallel to a small
9395  *   one (this is possible, but seems to be bad programming style in the
9396  *   appl).
9397  * . The problem gets a little bit more serious, when those TNC pages
9398  *   have to be mapped into kernel space, e.g. for networking.
9399  * . When VAC alias conflicts occur in applications, this is regarded
9400  *   as an application bug. So if kstat's show them, the appl should
9401  *   be changed anyway.
9402  */
9403 void
9404 conv_tnc(page_t *pp, int ottesz)
9405 {
9406         int cursz, dosz;
9407         pgcnt_t curnpgs, dopgs;
9408         pgcnt_t pg64k;
9409         page_t *pp2;
9410 
9411         /*
9412          * Determine how big a range we check for TNC and find
9413          * leader page. cursz is the size of the biggest
9414          * mapping that still exist on 'pp'.
9415          */
9416         if (PP_ISMAPPED_LARGE(pp)) {
9417                 cursz = fnd_mapping_sz(pp);
9418         } else {
9419                 cursz = TTE8K;
9420         }
9421 
9422         if (ottesz >= cursz) {
9423                 dosz = ottesz;
9424                 pp2 = pp;
9425         } else {
9426                 dosz = cursz;
9427                 pp2 = PP_GROUPLEADER(pp, dosz);
9428         }
9429 
9430         pg64k = TTEPAGES(TTE64K);
9431         dopgs = TTEPAGES(dosz);
9432 
9433         ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9434 
9435         while (dopgs != 0) {
9436                 curnpgs = TTEPAGES(cursz);
9437                 if (tst_tnc(pp2, curnpgs)) {
9438                         SFMMU_STAT_ADD(sf_recache, curnpgs);
9439                         sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9440                             curnpgs);
9441                 }
9442 
9443                 ASSERT(dopgs >= curnpgs);
9444                 dopgs -= curnpgs;
9445 
9446                 if (dopgs == 0) {
9447                         break;
9448                 }
9449 
9450                 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9451                 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9452                         cursz = fnd_mapping_sz(pp2);
9453                 } else {
9454                         cursz = TTE8K;
9455                 }
9456         }
9457 }
9458 
9459 /*
9460  * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9461  * returns 0 otherwise. Note that oaddr argument is valid for only
9462  * 8k pages.
9463  */
9464 int
9465 tst_tnc(page_t *pp, pgcnt_t npages)
9466 {
9467         struct  sf_hment *sfhme;
9468         struct  hme_blk *hmeblkp;
9469         tte_t   tte;
9470         caddr_t vaddr;
9471         int     clr_valid = 0;
9472         int     color, color1, bcolor;
9473         int     i, ncolors;
9474 
9475         ASSERT(pp != NULL);
9476         ASSERT(!(cache & CACHE_WRITEBACK));
9477 
9478         if (npages > 1) {
9479                 ncolors = CACHE_NUM_COLOR;
9480         }
9481 
9482         for (i = 0; i < npages; i++) {
9483                 ASSERT(sfmmu_mlist_held(pp));
9484                 ASSERT(PP_ISTNC(pp));
9485                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9486 
9487                 if (PP_ISPNC(pp)) {
9488                         return (0);
9489                 }
9490 
9491                 clr_valid = 0;
9492                 if (PP_ISMAPPED_KPM(pp)) {
9493                         caddr_t kpmvaddr;
9494 
9495                         ASSERT(kpm_enable);
9496                         kpmvaddr = hat_kpm_page2va(pp, 1);
9497                         ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9498                         color1 = addr_to_vcolor(kpmvaddr);
9499                         clr_valid = 1;
9500                 }
9501 
9502                 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9503                         if (IS_PAHME(sfhme))
9504                                 continue;
9505                         hmeblkp = sfmmu_hmetohblk(sfhme);
9506                         if (hmeblkp->hblk_xhat_bit)
9507                                 continue;
9508 
9509                         sfmmu_copytte(&sfhme->hme_tte, &tte);
9510                         ASSERT(TTE_IS_VALID(&tte));
9511 
9512                         vaddr = tte_to_vaddr(hmeblkp, tte);
9513                         color = addr_to_vcolor(vaddr);
9514 
9515                         if (npages > 1) {
9516                                 /*
9517                                  * If there is a big mapping, make sure
9518                                  * 8K mapping is consistent with the big
9519                                  * mapping.
9520                                  */
9521                                 bcolor = i % ncolors;
9522                                 if (color != bcolor) {
9523                                         return (0);
9524                                 }
9525                         }
9526                         if (!clr_valid) {
9527                                 clr_valid = 1;
9528                                 color1 = color;
9529                         }
9530 
9531                         if (color1 != color) {
9532                                 return (0);
9533                         }
9534                 }
9535 
9536                 pp = PP_PAGENEXT(pp);
9537         }
9538 
9539         return (1);
9540 }
9541 
9542 void
9543 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9544         pgcnt_t npages)
9545 {
9546         kmutex_t *pmtx;
9547         int i, ncolors, bcolor;
9548         kpm_hlk_t *kpmp;
9549         cpuset_t cpuset;
9550 
9551         ASSERT(pp != NULL);
9552         ASSERT(!(cache & CACHE_WRITEBACK));
9553 
9554         kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9555         pmtx = sfmmu_page_enter(pp);
9556 
9557         /*
9558          * Fast path caching single unmapped page
9559          */
9560         if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9561             flags == HAT_CACHE) {
9562                 PP_CLRTNC(pp);
9563                 PP_CLRPNC(pp);
9564                 sfmmu_page_exit(pmtx);
9565                 sfmmu_kpm_kpmp_exit(kpmp);
9566                 return;
9567         }
9568 
9569         /*
9570          * We need to capture all cpus in order to change cacheability
9571          * because we can't allow one cpu to access the same physical
9572          * page using a cacheable and a non-cachebale mapping at the same
9573          * time. Since we may end up walking the ism mapping list
9574          * have to grab it's lock now since we can't after all the
9575          * cpus have been captured.
9576          */
9577         sfmmu_hat_lock_all();
9578         mutex_enter(&ism_mlist_lock);
9579         kpreempt_disable();
9580         cpuset = cpu_ready_set;
9581         xc_attention(cpuset);
9582 
9583         if (npages > 1) {
9584                 /*
9585                  * Make sure all colors are flushed since the
9586                  * sfmmu_page_cache() only flushes one color-
9587                  * it does not know big pages.
9588                  */
9589                 ncolors = CACHE_NUM_COLOR;
9590                 if (flags & HAT_TMPNC) {
9591                         for (i = 0; i < ncolors; i++) {
9592                                 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9593                         }
9594                         cache_flush_flag = CACHE_NO_FLUSH;
9595                 }
9596         }
9597 
9598         for (i = 0; i < npages; i++) {
9599 
9600                 ASSERT(sfmmu_mlist_held(pp));
9601 
9602                 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9603 
9604                         if (npages > 1) {
9605                                 bcolor = i % ncolors;
9606                         } else {
9607                                 bcolor = NO_VCOLOR;
9608                         }
9609 
9610                         sfmmu_page_cache(pp, flags, cache_flush_flag,
9611                             bcolor);
9612                 }
9613 
9614                 pp = PP_PAGENEXT(pp);
9615         }
9616 
9617         xt_sync(cpuset);
9618         xc_dismissed(cpuset);
9619         mutex_exit(&ism_mlist_lock);
9620         sfmmu_hat_unlock_all();
9621         sfmmu_page_exit(pmtx);
9622         sfmmu_kpm_kpmp_exit(kpmp);
9623         kpreempt_enable();
9624 }
9625 
9626 /*
9627  * This function changes the virtual cacheability of all mappings to a
9628  * particular page.  When changing from uncache to cacheable the mappings will
9629  * only be changed if all of them have the same virtual color.
9630  * We need to flush the cache in all cpus.  It is possible that
9631  * a process referenced a page as cacheable but has sinced exited
9632  * and cleared the mapping list.  We still to flush it but have no
9633  * state so all cpus is the only alternative.
9634  */
9635 static void
9636 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9637 {
9638         struct  sf_hment *sfhme;
9639         struct  hme_blk *hmeblkp;
9640         sfmmu_t *sfmmup;
9641         tte_t   tte, ttemod;
9642         caddr_t vaddr;
9643         int     ret, color;
9644         pfn_t   pfn;
9645 
9646         color = bcolor;
9647         pfn = pp->p_pagenum;
9648 
9649         for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9650 
9651                 if (IS_PAHME(sfhme))
9652                         continue;
9653                 hmeblkp = sfmmu_hmetohblk(sfhme);
9654 
9655                 if (hmeblkp->hblk_xhat_bit)
9656                         continue;
9657 
9658                 sfmmu_copytte(&sfhme->hme_tte, &tte);
9659                 ASSERT(TTE_IS_VALID(&tte));
9660                 vaddr = tte_to_vaddr(hmeblkp, tte);
9661                 color = addr_to_vcolor(vaddr);
9662 
9663 #ifdef DEBUG
9664                 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9665                         ASSERT(color == bcolor);
9666                 }
9667 #endif
9668 
9669                 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9670 
9671                 ttemod = tte;
9672                 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9673                         TTE_CLR_VCACHEABLE(&ttemod);
9674                 } else {        /* flags & HAT_CACHE */
9675                         TTE_SET_VCACHEABLE(&ttemod);
9676                 }
9677                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9678                 if (ret < 0) {
9679                         /*
9680                          * Since all cpus are captured modifytte should not
9681                          * fail.
9682                          */
9683                         panic("sfmmu_page_cache: write to tte failed");
9684                 }
9685 
9686                 sfmmup = hblktosfmmu(hmeblkp);
9687                 if (cache_flush_flag == CACHE_FLUSH) {
9688                         /*
9689                          * Flush TSBs, TLBs and caches
9690                          */
9691                         if (hmeblkp->hblk_shared) {
9692                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9693                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9694                                 sf_region_t *rgnp;
9695                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9696                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9697                                 ASSERT(srdp != NULL);
9698                                 rgnp = srdp->srd_hmergnp[rid];
9699                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9700                                     srdp, rgnp, rid);
9701                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9702                                     hmeblkp, 0);
9703                                 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9704                         } else if (sfmmup->sfmmu_ismhat) {
9705                                 if (flags & HAT_CACHE) {
9706                                         SFMMU_STAT(sf_ism_recache);
9707                                 } else {
9708                                         SFMMU_STAT(sf_ism_uncache);
9709                                 }
9710                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9711                                     pfn, CACHE_FLUSH);
9712                         } else {
9713                                 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9714                                     pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9715                         }
9716 
9717                         /*
9718                          * all cache entries belonging to this pfn are
9719                          * now flushed.
9720                          */
9721                         cache_flush_flag = CACHE_NO_FLUSH;
9722                 } else {
9723                         /*
9724                          * Flush only TSBs and TLBs.
9725                          */
9726                         if (hmeblkp->hblk_shared) {
9727                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9728                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9729                                 sf_region_t *rgnp;
9730                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9731                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9732                                 ASSERT(srdp != NULL);
9733                                 rgnp = srdp->srd_hmergnp[rid];
9734                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9735                                     srdp, rgnp, rid);
9736                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9737                                     hmeblkp, 0);
9738                         } else if (sfmmup->sfmmu_ismhat) {
9739                                 if (flags & HAT_CACHE) {
9740                                         SFMMU_STAT(sf_ism_recache);
9741                                 } else {
9742                                         SFMMU_STAT(sf_ism_uncache);
9743                                 }
9744                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9745                                     pfn, CACHE_NO_FLUSH);
9746                         } else {
9747                                 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9748                         }
9749                 }
9750         }
9751 
9752         if (PP_ISMAPPED_KPM(pp))
9753                 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9754 
9755         switch (flags) {
9756 
9757                 default:
9758                         panic("sfmmu_pagecache: unknown flags");
9759                         break;
9760 
9761                 case HAT_CACHE:
9762                         PP_CLRTNC(pp);
9763                         PP_CLRPNC(pp);
9764                         PP_SET_VCOLOR(pp, color);
9765                         break;
9766 
9767                 case HAT_TMPNC:
9768                         PP_SETTNC(pp);
9769                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9770                         break;
9771 
9772                 case HAT_UNCACHE:
9773                         PP_SETPNC(pp);
9774                         PP_CLRTNC(pp);
9775                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9776                         break;
9777         }
9778 }
9779 #endif  /* VAC */
9780 
9781 
9782 /*
9783  * Wrapper routine used to return a context.
9784  *
9785  * It's the responsibility of the caller to guarantee that the
9786  * process serializes on calls here by taking the HAT lock for
9787  * the hat.
9788  *
9789  */
9790 static void
9791 sfmmu_get_ctx(sfmmu_t *sfmmup)
9792 {
9793         mmu_ctx_t *mmu_ctxp;
9794         uint_t pstate_save;
9795         int ret;
9796 
9797         ASSERT(sfmmu_hat_lock_held(sfmmup));
9798         ASSERT(sfmmup != ksfmmup);
9799 
9800         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9801                 sfmmu_setup_tsbinfo(sfmmup);
9802                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9803         }
9804 
9805         kpreempt_disable();
9806 
9807         mmu_ctxp = CPU_MMU_CTXP(CPU);
9808         ASSERT(mmu_ctxp);
9809         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9810         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9811 
9812         /*
9813          * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9814          */
9815         if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9816                 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9817 
9818         /*
9819          * Let the MMU set up the page sizes to use for
9820          * this context in the TLB. Don't program 2nd dtlb for ism hat.
9821          */
9822         if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9823                 mmu_set_ctx_page_sizes(sfmmup);
9824         }
9825 
9826         /*
9827          * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9828          * interrupts disabled to prevent race condition with wrap-around
9829          * ctx invalidatation. In sun4v, ctx invalidation also involves
9830          * a HV call to set the number of TSBs to 0. If interrupts are not
9831          * disabled until after sfmmu_load_mmustate is complete TSBs may
9832          * become assigned to INVALID_CONTEXT. This is not allowed.
9833          */
9834         pstate_save = sfmmu_disable_intrs();
9835 
9836         if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9837             sfmmup->sfmmu_scdp != NULL) {
9838                 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9839                 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9840                 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9841                 /* debug purpose only */
9842                 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9843                     != INVALID_CONTEXT);
9844         }
9845         sfmmu_load_mmustate(sfmmup);
9846 
9847         sfmmu_enable_intrs(pstate_save);
9848 
9849         kpreempt_enable();
9850 }
9851 
9852 /*
9853  * When all cnums are used up in a MMU, cnum will wrap around to the
9854  * next generation and start from 2.
9855  */
9856 static void
9857 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9858 {
9859 
9860         /* caller must have disabled the preemption */
9861         ASSERT(curthread->t_preempt >= 1);
9862         ASSERT(mmu_ctxp != NULL);
9863 
9864         /* acquire Per-MMU (PM) spin lock */
9865         mutex_enter(&mmu_ctxp->mmu_lock);
9866 
9867         /* re-check to see if wrap-around is needed */
9868         if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9869                 goto done;
9870 
9871         SFMMU_MMU_STAT(mmu_wrap_around);
9872 
9873         /* update gnum */
9874         ASSERT(mmu_ctxp->mmu_gnum != 0);
9875         mmu_ctxp->mmu_gnum++;
9876         if (mmu_ctxp->mmu_gnum == 0 ||
9877             mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9878                 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9879                     (void *)mmu_ctxp);
9880         }
9881 
9882         if (mmu_ctxp->mmu_ncpus > 1) {
9883                 cpuset_t cpuset;
9884 
9885                 membar_enter(); /* make sure updated gnum visible */
9886 
9887                 SFMMU_XCALL_STATS(NULL);
9888 
9889                 /* xcall to others on the same MMU to invalidate ctx */
9890                 cpuset = mmu_ctxp->mmu_cpuset;
9891                 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9892                 CPUSET_DEL(cpuset, CPU->cpu_id);
9893                 CPUSET_AND(cpuset, cpu_ready_set);
9894 
9895                 /*
9896                  * Pass in INVALID_CONTEXT as the first parameter to
9897                  * sfmmu_raise_tsb_exception, which invalidates the context
9898                  * of any process running on the CPUs in the MMU.
9899                  */
9900                 xt_some(cpuset, sfmmu_raise_tsb_exception,
9901                     INVALID_CONTEXT, INVALID_CONTEXT);
9902                 xt_sync(cpuset);
9903 
9904                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9905         }
9906 
9907         if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9908                 sfmmu_setctx_sec(INVALID_CONTEXT);
9909                 sfmmu_clear_utsbinfo();
9910         }
9911 
9912         /*
9913          * No xcall is needed here. For sun4u systems all CPUs in context
9914          * domain share a single physical MMU therefore it's enough to flush
9915          * TLB on local CPU. On sun4v systems we use 1 global context
9916          * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9917          * handler. Note that vtag_flushall_uctxs() is called
9918          * for Ultra II machine, where the equivalent flushall functionality
9919          * is implemented in SW, and only user ctx TLB entries are flushed.
9920          */
9921         if (&vtag_flushall_uctxs != NULL) {
9922                 vtag_flushall_uctxs();
9923         } else {
9924                 vtag_flushall();
9925         }
9926 
9927         /* reset mmu cnum, skips cnum 0 and 1 */
9928         if (reset_cnum == B_TRUE)
9929                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9930 
9931 done:
9932         mutex_exit(&mmu_ctxp->mmu_lock);
9933 }
9934 
9935 
9936 /*
9937  * For multi-threaded process, set the process context to INVALID_CONTEXT
9938  * so that it faults and reloads the MMU state from TL=0. For single-threaded
9939  * process, we can just load the MMU state directly without having to
9940  * set context invalid. Caller must hold the hat lock since we don't
9941  * acquire it here.
9942  */
9943 static void
9944 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9945 {
9946         uint_t cnum;
9947         uint_t pstate_save;
9948 
9949         ASSERT(sfmmup != ksfmmup);
9950         ASSERT(sfmmu_hat_lock_held(sfmmup));
9951 
9952         kpreempt_disable();
9953 
9954         /*
9955          * We check whether the pass'ed-in sfmmup is the same as the
9956          * current running proc. This is to makes sure the current proc
9957          * stays single-threaded if it already is.
9958          */
9959         if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9960             (curthread->t_procp->p_lwpcnt == 1)) {
9961                 /* single-thread */
9962                 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9963                 if (cnum != INVALID_CONTEXT) {
9964                         uint_t curcnum;
9965                         /*
9966                          * Disable interrupts to prevent race condition
9967                          * with sfmmu_ctx_wrap_around ctx invalidation.
9968                          * In sun4v, ctx invalidation involves setting
9969                          * TSB to NULL, hence, interrupts should be disabled
9970                          * untill after sfmmu_load_mmustate is completed.
9971                          */
9972                         pstate_save = sfmmu_disable_intrs();
9973                         curcnum = sfmmu_getctx_sec();
9974                         if (curcnum == cnum)
9975                                 sfmmu_load_mmustate(sfmmup);
9976                         sfmmu_enable_intrs(pstate_save);
9977                         ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9978                 }
9979         } else {
9980                 /*
9981                  * multi-thread
9982                  * or when sfmmup is not the same as the curproc.
9983                  */
9984                 sfmmu_invalidate_ctx(sfmmup);
9985         }
9986 
9987         kpreempt_enable();
9988 }
9989 
9990 
9991 /*
9992  * Replace the specified TSB with a new TSB.  This function gets called when
9993  * we grow, shrink or swapin a TSB.  When swapping in a TSB (TSB_SWAPIN), the
9994  * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9995  * (8K).
9996  *
9997  * Caller must hold the HAT lock, but should assume any tsb_info
9998  * pointers it has are no longer valid after calling this function.
9999  *
10000  * Return values:
10001  *      TSB_ALLOCFAIL   Failed to allocate a TSB, due to memory constraints
10002  *      TSB_LOSTRACE    HAT is busy, i.e. another thread is already doing
10003  *                      something to this tsbinfo/TSB
10004  *      TSB_SUCCESS     Operation succeeded
10005  */
10006 static tsb_replace_rc_t
10007 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
10008     hatlock_t *hatlockp, uint_t flags)
10009 {
10010         struct tsb_info *new_tsbinfo = NULL;
10011         struct tsb_info *curtsb, *prevtsb;
10012         uint_t tte_sz_mask;
10013         int i;
10014 
10015         ASSERT(sfmmup != ksfmmup);
10016         ASSERT(sfmmup->sfmmu_ismhat == 0);
10017         ASSERT(sfmmu_hat_lock_held(sfmmup));
10018         ASSERT(szc <= tsb_max_growsize);
10019 
10020         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
10021                 return (TSB_LOSTRACE);
10022 
10023         /*
10024          * Find the tsb_info ahead of this one in the list, and
10025          * also make sure that the tsb_info passed in really
10026          * exists!
10027          */
10028         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
10029             curtsb != old_tsbinfo && curtsb != NULL;
10030             prevtsb = curtsb, curtsb = curtsb->tsb_next)
10031                 ;
10032         ASSERT(curtsb != NULL);
10033 
10034         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
10035                 /*
10036                  * The process is swapped out, so just set the new size
10037                  * code.  When it swaps back in, we'll allocate a new one
10038                  * of the new chosen size.
10039                  */
10040                 curtsb->tsb_szc = szc;
10041                 return (TSB_SUCCESS);
10042         }
10043         SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
10044 
10045         tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
10046 
10047         /*
10048          * All initialization is done inside of sfmmu_tsbinfo_alloc().
10049          * If we fail to allocate a TSB, exit.
10050          *
10051          * If tsb grows with new tsb size > 4M and old tsb size < 4M,
10052          * then try 4M slab after the initial alloc fails.
10053          *
10054          * If tsb swapin with tsb size > 4M, then try 4M after the
10055          * initial alloc fails.
10056          */
10057         sfmmu_hat_exit(hatlockp);
10058         if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
10059             tte_sz_mask, flags, sfmmup) &&
10060             (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
10061             (!(flags & TSB_SWAPIN) &&
10062             (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
10063             sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
10064             tte_sz_mask, flags, sfmmup))) {
10065                 (void) sfmmu_hat_enter(sfmmup);
10066                 if (!(flags & TSB_SWAPIN))
10067                         SFMMU_STAT(sf_tsb_resize_failures);
10068                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10069                 return (TSB_ALLOCFAIL);
10070         }
10071         (void) sfmmu_hat_enter(sfmmup);
10072 
10073         /*
10074          * Re-check to make sure somebody else didn't muck with us while we
10075          * didn't hold the HAT lock.  If the process swapped out, fine, just
10076          * exit; this can happen if we try to shrink the TSB from the context
10077          * of another process (such as on an ISM unmap), though it is rare.
10078          */
10079         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
10080                 SFMMU_STAT(sf_tsb_resize_failures);
10081                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10082                 sfmmu_hat_exit(hatlockp);
10083                 sfmmu_tsbinfo_free(new_tsbinfo);
10084                 (void) sfmmu_hat_enter(sfmmup);
10085                 return (TSB_LOSTRACE);
10086         }
10087 
10088 #ifdef  DEBUG
10089         /* Reverify that the tsb_info still exists.. for debugging only */
10090         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
10091             curtsb != old_tsbinfo && curtsb != NULL;
10092             prevtsb = curtsb, curtsb = curtsb->tsb_next)
10093                 ;
10094         ASSERT(curtsb != NULL);
10095 #endif  /* DEBUG */
10096 
10097         /*
10098          * Quiesce any CPUs running this process on their next TLB miss
10099          * so they atomically see the new tsb_info.  We temporarily set the
10100          * context to invalid context so new threads that come on processor
10101          * after we do the xcall to cpusran will also serialize behind the
10102          * HAT lock on TLB miss and will see the new TSB.  Since this short
10103          * race with a new thread coming on processor is relatively rare,
10104          * this synchronization mechanism should be cheaper than always
10105          * pausing all CPUs for the duration of the setup, which is what
10106          * the old implementation did.  This is particuarly true if we are
10107          * copying a huge chunk of memory around during that window.
10108          *
10109          * The memory barriers are to make sure things stay consistent
10110          * with resume() since it does not hold the HAT lock while
10111          * walking the list of tsb_info structures.
10112          */
10113         if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
10114                 /* The TSB is either growing or shrinking. */
10115                 sfmmu_invalidate_ctx(sfmmup);
10116         } else {
10117                 /*
10118                  * It is illegal to swap in TSBs from a process other
10119                  * than a process being swapped in.  This in turn
10120                  * implies we do not have a valid MMU context here
10121                  * since a process needs one to resolve translation
10122                  * misses.
10123                  */
10124                 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
10125         }
10126 
10127 #ifdef DEBUG
10128         ASSERT(max_mmu_ctxdoms > 0);
10129 
10130         /*
10131          * Process should have INVALID_CONTEXT on all MMUs
10132          */
10133         for (i = 0; i < max_mmu_ctxdoms; i++) {
10134 
10135                 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
10136         }
10137 #endif
10138 
10139         new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
10140         membar_stst();  /* strict ordering required */
10141         if (prevtsb)
10142                 prevtsb->tsb_next = new_tsbinfo;
10143         else
10144                 sfmmup->sfmmu_tsb = new_tsbinfo;
10145         membar_enter(); /* make sure new TSB globally visible */
10146 
10147         /*
10148          * We need to migrate TSB entries from the old TSB to the new TSB
10149          * if tsb_remap_ttes is set and the TSB is growing.
10150          */
10151         if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
10152                 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
10153 
10154         SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10155 
10156         /*
10157          * Drop the HAT lock to free our old tsb_info.
10158          */
10159         sfmmu_hat_exit(hatlockp);
10160 
10161         if ((flags & TSB_GROW) == TSB_GROW) {
10162                 SFMMU_STAT(sf_tsb_grow);
10163         } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
10164                 SFMMU_STAT(sf_tsb_shrink);
10165         }
10166 
10167         sfmmu_tsbinfo_free(old_tsbinfo);
10168 
10169         (void) sfmmu_hat_enter(sfmmup);
10170         return (TSB_SUCCESS);
10171 }
10172 
10173 /*
10174  * This function will re-program hat pgsz array, and invalidate the
10175  * process' context, forcing the process to switch to another
10176  * context on the next TLB miss, and therefore start using the
10177  * TLB that is reprogrammed for the new page sizes.
10178  */
10179 void
10180 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
10181 {
10182         int i;
10183         hatlock_t *hatlockp = NULL;
10184 
10185         hatlockp = sfmmu_hat_enter(sfmmup);
10186         /* USIII+-IV+ optimization, requires hat lock */
10187         if (tmp_pgsz) {
10188                 for (i = 0; i < mmu_page_sizes; i++)
10189                         sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
10190         }
10191         SFMMU_STAT(sf_tlb_reprog_pgsz);
10192 
10193         sfmmu_invalidate_ctx(sfmmup);
10194 
10195         sfmmu_hat_exit(hatlockp);
10196 }
10197 
10198 /*
10199  * The scd_rttecnt field in the SCD must be updated to take account of the
10200  * regions which it contains.
10201  */
10202 static void
10203 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10204 {
10205         uint_t rid;
10206         uint_t i, j;
10207         ulong_t w;
10208         sf_region_t *rgnp;
10209 
10210         ASSERT(srdp != NULL);
10211 
10212         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10213                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10214                         continue;
10215                 }
10216 
10217                 j = 0;
10218                 while (w) {
10219                         if (!(w & 0x1)) {
10220                                 j++;
10221                                 w >>= 1;
10222                                 continue;
10223                         }
10224                         rid = (i << BT_ULSHIFT) | j;
10225                         j++;
10226                         w >>= 1;
10227 
10228                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10229                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10230                         rgnp = srdp->srd_hmergnp[rid];
10231                         ASSERT(rgnp->rgn_refcnt > 0);
10232                         ASSERT(rgnp->rgn_id == rid);
10233 
10234                         scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10235                             rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10236 
10237                         /*
10238                          * Maintain the tsb0 inflation cnt for the regions
10239                          * in the SCD.
10240                          */
10241                         if (rgnp->rgn_pgszc >= TTE4M) {
10242                                 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10243                                     rgnp->rgn_size >>
10244                                     (TTE_PAGE_SHIFT(TTE8K) + 2);
10245                         }
10246                 }
10247         }
10248 }
10249 
10250 /*
10251  * This function assumes that there are either four or six supported page
10252  * sizes and at most two programmable TLBs, so we need to decide which
10253  * page sizes are most important and then tell the MMU layer so it
10254  * can adjust the TLB page sizes accordingly (if supported).
10255  *
10256  * If these assumptions change, this function will need to be
10257  * updated to support whatever the new limits are.
10258  *
10259  * The growing flag is nonzero if we are growing the address space,
10260  * and zero if it is shrinking.  This allows us to decide whether
10261  * to grow or shrink our TSB, depending upon available memory
10262  * conditions.
10263  */
10264 static void
10265 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10266 {
10267         uint64_t ttecnt[MMU_PAGE_SIZES];
10268         uint64_t tte8k_cnt, tte4m_cnt;
10269         uint8_t i;
10270         int sectsb_thresh;
10271 
10272         /*
10273          * Kernel threads, processes with small address spaces not using
10274          * large pages, and dummy ISM HATs need not apply.
10275          */
10276         if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10277                 return;
10278 
10279         if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10280             sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10281                 return;
10282 
10283         for (i = 0; i < mmu_page_sizes; i++) {
10284                 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10285                     sfmmup->sfmmu_ismttecnt[i];
10286         }
10287 
10288         /* Check pagesizes in use, and possibly reprogram DTLB. */
10289         if (&mmu_check_page_sizes)
10290                 mmu_check_page_sizes(sfmmup, ttecnt);
10291 
10292         /*
10293          * Calculate the number of 8k ttes to represent the span of these
10294          * pages.
10295          */
10296         tte8k_cnt = ttecnt[TTE8K] +
10297             (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10298             (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10299         if (mmu_page_sizes == max_mmu_page_sizes) {
10300                 tte4m_cnt = ttecnt[TTE4M] +
10301                     (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10302                     (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10303         } else {
10304                 tte4m_cnt = ttecnt[TTE4M];
10305         }
10306 
10307         /*
10308          * Inflate tte8k_cnt to allow for region large page allocation failure.
10309          */
10310         tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10311 
10312         /*
10313          * Inflate TSB sizes by a factor of 2 if this process
10314          * uses 4M text pages to minimize extra conflict misses
10315          * in the first TSB since without counting text pages
10316          * 8K TSB may become too small.
10317          *
10318          * Also double the size of the second TSB to minimize
10319          * extra conflict misses due to competition between 4M text pages
10320          * and data pages.
10321          *
10322          * We need to adjust the second TSB allocation threshold by the
10323          * inflation factor, since there is no point in creating a second
10324          * TSB when we know all the mappings can fit in the I/D TLBs.
10325          */
10326         sectsb_thresh = tsb_sectsb_threshold;
10327         if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10328                 tte8k_cnt <<= 1;
10329                 tte4m_cnt <<= 1;
10330                 sectsb_thresh <<= 1;
10331         }
10332 
10333         /*
10334          * Check to see if our TSB is the right size; we may need to
10335          * grow or shrink it.  If the process is small, our work is
10336          * finished at this point.
10337          */
10338         if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10339                 return;
10340         }
10341         sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10342 }
10343 
10344 static void
10345 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10346         uint64_t tte4m_cnt, int sectsb_thresh)
10347 {
10348         int tsb_bits;
10349         uint_t tsb_szc;
10350         struct tsb_info *tsbinfop;
10351         hatlock_t *hatlockp = NULL;
10352 
10353         hatlockp = sfmmu_hat_enter(sfmmup);
10354         ASSERT(hatlockp != NULL);
10355         tsbinfop = sfmmup->sfmmu_tsb;
10356         ASSERT(tsbinfop != NULL);
10357 
10358         /*
10359          * If we're growing, select the size based on RSS.  If we're
10360          * shrinking, leave some room so we don't have to turn around and
10361          * grow again immediately.
10362          */
10363         if (growing)
10364                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10365         else
10366                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10367 
10368         if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10369             (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10370                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10371                     hatlockp, TSB_SHRINK);
10372         } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10373                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10374                     hatlockp, TSB_GROW);
10375         }
10376         tsbinfop = sfmmup->sfmmu_tsb;
10377 
10378         /*
10379          * With the TLB and first TSB out of the way, we need to see if
10380          * we need a second TSB for 4M pages.  If we managed to reprogram
10381          * the TLB page sizes above, the process will start using this new
10382          * TSB right away; otherwise, it will start using it on the next
10383          * context switch.  Either way, it's no big deal so there's no
10384          * synchronization with the trap handlers here unless we grow the
10385          * TSB (in which case it's required to prevent using the old one
10386          * after it's freed). Note: second tsb is required for 32M/256M
10387          * page sizes.
10388          */
10389         if (tte4m_cnt > sectsb_thresh) {
10390                 /*
10391                  * If we're growing, select the size based on RSS.  If we're
10392                  * shrinking, leave some room so we don't have to turn
10393                  * around and grow again immediately.
10394                  */
10395                 if (growing)
10396                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10397                 else
10398                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10399                 if (tsbinfop->tsb_next == NULL) {
10400                         struct tsb_info *newtsb;
10401                         int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10402                             0 : TSB_ALLOC;
10403 
10404                         sfmmu_hat_exit(hatlockp);
10405 
10406                         /*
10407                          * Try to allocate a TSB for 4[32|256]M pages.  If we
10408                          * can't get the size we want, retry w/a minimum sized
10409                          * TSB.  If that still didn't work, give up; we can
10410                          * still run without one.
10411                          */
10412                         tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10413                             TSB4M|TSB32M|TSB256M:TSB4M;
10414                         if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10415                             allocflags, sfmmup)) &&
10416                             (tsb_szc <= TSB_4M_SZCODE ||
10417                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10418                             tsb_bits, allocflags, sfmmup)) &&
10419                             sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10420                             tsb_bits, allocflags, sfmmup)) {
10421                                 return;
10422                         }
10423 
10424                         hatlockp = sfmmu_hat_enter(sfmmup);
10425 
10426                         sfmmu_invalidate_ctx(sfmmup);
10427 
10428                         if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10429                                 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10430                                 SFMMU_STAT(sf_tsb_sectsb_create);
10431                                 sfmmu_hat_exit(hatlockp);
10432                                 return;
10433                         } else {
10434                                 /*
10435                                  * It's annoying, but possible for us
10436                                  * to get here.. we dropped the HAT lock
10437                                  * because of locking order in the kmem
10438                                  * allocator, and while we were off getting
10439                                  * our memory, some other thread decided to
10440                                  * do us a favor and won the race to get a
10441                                  * second TSB for this process.  Sigh.
10442                                  */
10443                                 sfmmu_hat_exit(hatlockp);
10444                                 sfmmu_tsbinfo_free(newtsb);
10445                                 return;
10446                         }
10447                 }
10448 
10449                 /*
10450                  * We have a second TSB, see if it's big enough.
10451                  */
10452                 tsbinfop = tsbinfop->tsb_next;
10453 
10454                 /*
10455                  * Check to see if our second TSB is the right size;
10456                  * we may need to grow or shrink it.
10457                  * To prevent thrashing (e.g. growing the TSB on a
10458                  * subsequent map operation), only try to shrink if
10459                  * the TSB reach exceeds twice the virtual address
10460                  * space size.
10461                  */
10462                 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10463                     (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10464                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10465                             tsb_szc, hatlockp, TSB_SHRINK);
10466                 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10467                     TSB_OK_GROW()) {
10468                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10469                             tsb_szc, hatlockp, TSB_GROW);
10470                 }
10471         }
10472 
10473         sfmmu_hat_exit(hatlockp);
10474 }
10475 
10476 /*
10477  * Free up a sfmmu
10478  * Since the sfmmu is currently embedded in the hat struct we simply zero
10479  * out our fields and free up the ism map blk list if any.
10480  */
10481 static void
10482 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10483 {
10484         ism_blk_t       *blkp, *nx_blkp;
10485 #ifdef  DEBUG
10486         ism_map_t       *map;
10487         int             i;
10488 #endif
10489 
10490         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10491         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10492         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10493         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10494         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10495         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10496         ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10497 
10498         sfmmup->sfmmu_free = 0;
10499         sfmmup->sfmmu_ismhat = 0;
10500 
10501         blkp = sfmmup->sfmmu_iblk;
10502         sfmmup->sfmmu_iblk = NULL;
10503 
10504         while (blkp) {
10505 #ifdef  DEBUG
10506                 map = blkp->iblk_maps;
10507                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10508                         ASSERT(map[i].imap_seg == 0);
10509                         ASSERT(map[i].imap_ismhat == NULL);
10510                         ASSERT(map[i].imap_ment == NULL);
10511                 }
10512 #endif
10513                 nx_blkp = blkp->iblk_next;
10514                 blkp->iblk_next = NULL;
10515                 blkp->iblk_nextpa = (uint64_t)-1;
10516                 kmem_cache_free(ism_blk_cache, blkp);
10517                 blkp = nx_blkp;
10518         }
10519 }
10520 
10521 /*
10522  * Locking primitves accessed by HATLOCK macros
10523  */
10524 
10525 #define SFMMU_SPL_MTX   (0x0)
10526 #define SFMMU_ML_MTX    (0x1)
10527 
10528 #define SFMMU_MLSPL_MTX(type, pg)       (((type) == SFMMU_SPL_MTX) ? \
10529                                             SPL_HASH(pg) : MLIST_HASH(pg))
10530 
10531 kmutex_t *
10532 sfmmu_page_enter(struct page *pp)
10533 {
10534         return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10535 }
10536 
10537 void
10538 sfmmu_page_exit(kmutex_t *spl)
10539 {
10540         mutex_exit(spl);
10541 }
10542 
10543 int
10544 sfmmu_page_spl_held(struct page *pp)
10545 {
10546         return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10547 }
10548 
10549 kmutex_t *
10550 sfmmu_mlist_enter(struct page *pp)
10551 {
10552         return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10553 }
10554 
10555 void
10556 sfmmu_mlist_exit(kmutex_t *mml)
10557 {
10558         mutex_exit(mml);
10559 }
10560 
10561 int
10562 sfmmu_mlist_held(struct page *pp)
10563 {
10564 
10565         return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10566 }
10567 
10568 /*
10569  * Common code for sfmmu_mlist_enter() and sfmmu_page_enter().  For
10570  * sfmmu_mlist_enter() case mml_table lock array is used and for
10571  * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10572  *
10573  * The lock is taken on a root page so that it protects an operation on all
10574  * constituent pages of a large page pp belongs to.
10575  *
10576  * The routine takes a lock from the appropriate array. The lock is determined
10577  * by hashing the root page. After taking the lock this routine checks if the
10578  * root page has the same size code that was used to determine the root (i.e
10579  * that root hasn't changed).  If root page has the expected p_szc field we
10580  * have the right lock and it's returned to the caller. If root's p_szc
10581  * decreased we release the lock and retry from the beginning.  This case can
10582  * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10583  * value and taking the lock. The number of retries due to p_szc decrease is
10584  * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10585  * determined by hashing pp itself.
10586  *
10587  * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10588  * possible that p_szc can increase. To increase p_szc a thread has to lock
10589  * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10590  * callers that don't hold a page locked recheck if hmeblk through which pp
10591  * was found still maps this pp.  If it doesn't map it anymore returned lock
10592  * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10593  * p_szc increase after taking the lock it returns this lock without further
10594  * retries because in this case the caller doesn't care about which lock was
10595  * taken. The caller will drop it right away.
10596  *
10597  * After the routine returns it's guaranteed that hat_page_demote() can't
10598  * change p_szc field of any of constituent pages of a large page pp belongs
10599  * to as long as pp was either locked at least SHARED prior to this call or
10600  * the caller finds that hment that pointed to this pp still references this
10601  * pp (this also assumes that the caller holds hme hash bucket lock so that
10602  * the same pp can't be remapped into the same hmeblk after it was unmapped by
10603  * hat_pageunload()).
10604  */
10605 static kmutex_t *
10606 sfmmu_mlspl_enter(struct page *pp, int type)
10607 {
10608         kmutex_t        *mtx;
10609         uint_t          prev_rszc = UINT_MAX;
10610         page_t          *rootpp;
10611         uint_t          szc;
10612         uint_t          rszc;
10613         uint_t          pszc = pp->p_szc;
10614 
10615         ASSERT(pp != NULL);
10616 
10617 again:
10618         if (pszc == 0) {
10619                 mtx = SFMMU_MLSPL_MTX(type, pp);
10620                 mutex_enter(mtx);
10621                 return (mtx);
10622         }
10623 
10624         /* The lock lives in the root page */
10625         rootpp = PP_GROUPLEADER(pp, pszc);
10626         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10627         mutex_enter(mtx);
10628 
10629         /*
10630          * Return mml in the following 3 cases:
10631          *
10632          * 1) If pp itself is root since if its p_szc decreased before we took
10633          * the lock pp is still the root of smaller szc page. And if its p_szc
10634          * increased it doesn't matter what lock we return (see comment in
10635          * front of this routine).
10636          *
10637          * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10638          * large page we have the right lock since any previous potential
10639          * hat_page_demote() is done demoting from greater than current root's
10640          * p_szc because hat_page_demote() changes root's p_szc last. No
10641          * further hat_page_demote() can start or be in progress since it
10642          * would need the same lock we currently hold.
10643          *
10644          * 3) If rootpp's p_szc increased since previous iteration it doesn't
10645          * matter what lock we return (see comment in front of this routine).
10646          */
10647         if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10648             rszc >= prev_rszc) {
10649                 return (mtx);
10650         }
10651 
10652         /*
10653          * hat_page_demote() could have decreased root's p_szc.
10654          * In this case pp's p_szc must also be smaller than pszc.
10655          * Retry.
10656          */
10657         if (rszc < pszc) {
10658                 szc = pp->p_szc;
10659                 if (szc < pszc) {
10660                         mutex_exit(mtx);
10661                         pszc = szc;
10662                         goto again;
10663                 }
10664                 /*
10665                  * pp's p_szc increased after it was decreased.
10666                  * page cannot be mapped. Return current lock. The caller
10667                  * will drop it right away.
10668                  */
10669                 return (mtx);
10670         }
10671 
10672         /*
10673          * root's p_szc is greater than pp's p_szc.
10674          * hat_page_demote() is not done with all pages
10675          * yet. Wait for it to complete.
10676          */
10677         mutex_exit(mtx);
10678         rootpp = PP_GROUPLEADER(rootpp, rszc);
10679         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10680         mutex_enter(mtx);
10681         mutex_exit(mtx);
10682         prev_rszc = rszc;
10683         goto again;
10684 }
10685 
10686 static int
10687 sfmmu_mlspl_held(struct page *pp, int type)
10688 {
10689         kmutex_t        *mtx;
10690 
10691         ASSERT(pp != NULL);
10692         /* The lock lives in the root page */
10693         pp = PP_PAGEROOT(pp);
10694         ASSERT(pp != NULL);
10695 
10696         mtx = SFMMU_MLSPL_MTX(type, pp);
10697         return (MUTEX_HELD(mtx));
10698 }
10699 
10700 static uint_t
10701 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10702 {
10703         struct  hme_blk *hblkp;
10704 
10705 
10706         if (freehblkp != NULL) {
10707                 mutex_enter(&freehblkp_lock);
10708                 if (freehblkp != NULL) {
10709                         /*
10710                          * If the current thread is owning hblk_reserve OR
10711                          * critical request from sfmmu_hblk_steal()
10712                          * let it succeed even if freehblkcnt is really low.
10713                          */
10714                         if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10715                                 SFMMU_STAT(sf_get_free_throttle);
10716                                 mutex_exit(&freehblkp_lock);
10717                                 return (0);
10718                         }
10719                         freehblkcnt--;
10720                         *hmeblkpp = freehblkp;
10721                         hblkp = *hmeblkpp;
10722                         freehblkp = hblkp->hblk_next;
10723                         mutex_exit(&freehblkp_lock);
10724                         hblkp->hblk_next = NULL;
10725                         SFMMU_STAT(sf_get_free_success);
10726 
10727                         ASSERT(hblkp->hblk_hmecnt == 0);
10728                         ASSERT(hblkp->hblk_vcnt == 0);
10729                         ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10730 
10731                         return (1);
10732                 }
10733                 mutex_exit(&freehblkp_lock);
10734         }
10735 
10736         /* Check cpu hblk pending queues */
10737         if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10738                 hblkp = *hmeblkpp;
10739                 hblkp->hblk_next = NULL;
10740                 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10741 
10742                 ASSERT(hblkp->hblk_hmecnt == 0);
10743                 ASSERT(hblkp->hblk_vcnt == 0);
10744 
10745                 return (1);
10746         }
10747 
10748         SFMMU_STAT(sf_get_free_fail);
10749         return (0);
10750 }
10751 
10752 static uint_t
10753 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10754 {
10755         struct  hme_blk *hblkp;
10756 
10757         ASSERT(hmeblkp->hblk_hmecnt == 0);
10758         ASSERT(hmeblkp->hblk_vcnt == 0);
10759         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10760 
10761         /*
10762          * If the current thread is mapping into kernel space,
10763          * let it succede even if freehblkcnt is max
10764          * so that it will avoid freeing it to kmem.
10765          * This will prevent stack overflow due to
10766          * possible recursion since kmem_cache_free()
10767          * might require creation of a slab which
10768          * in turn needs an hmeblk to map that slab;
10769          * let's break this vicious chain at the first
10770          * opportunity.
10771          */
10772         if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10773                 mutex_enter(&freehblkp_lock);
10774                 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10775                         SFMMU_STAT(sf_put_free_success);
10776                         freehblkcnt++;
10777                         hmeblkp->hblk_next = freehblkp;
10778                         freehblkp = hmeblkp;
10779                         mutex_exit(&freehblkp_lock);
10780                         return (1);
10781                 }
10782                 mutex_exit(&freehblkp_lock);
10783         }
10784 
10785         /*
10786          * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10787          * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10788          * we are not in the process of mapping into kernel space.
10789          */
10790         ASSERT(!critical);
10791         while (freehblkcnt > HBLK_RESERVE_CNT) {
10792                 mutex_enter(&freehblkp_lock);
10793                 if (freehblkcnt > HBLK_RESERVE_CNT) {
10794                         freehblkcnt--;
10795                         hblkp = freehblkp;
10796                         freehblkp = hblkp->hblk_next;
10797                         mutex_exit(&freehblkp_lock);
10798                         ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10799                         kmem_cache_free(sfmmu8_cache, hblkp);
10800                         continue;
10801                 }
10802                 mutex_exit(&freehblkp_lock);
10803         }
10804         SFMMU_STAT(sf_put_free_fail);
10805         return (0);
10806 }
10807 
10808 static void
10809 sfmmu_hblk_swap(struct hme_blk *new)
10810 {
10811         struct hme_blk *old, *hblkp, *prev;
10812         uint64_t newpa;
10813         caddr_t base, vaddr, endaddr;
10814         struct hmehash_bucket *hmebp;
10815         struct sf_hment *osfhme, *nsfhme;
10816         page_t *pp;
10817         kmutex_t *pml;
10818         tte_t tte;
10819         struct hme_blk *list = NULL;
10820 
10821 #ifdef  DEBUG
10822         hmeblk_tag              hblktag;
10823         struct hme_blk          *found;
10824 #endif
10825         old = HBLK_RESERVE;
10826         ASSERT(!old->hblk_shared);
10827 
10828         /*
10829          * save pa before bcopy clobbers it
10830          */
10831         newpa = new->hblk_nextpa;
10832 
10833         base = (caddr_t)get_hblk_base(old);
10834         endaddr = base + get_hblk_span(old);
10835 
10836         /*
10837          * acquire hash bucket lock.
10838          */
10839         hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10840             SFMMU_INVALID_SHMERID);
10841 
10842         /*
10843          * copy contents from old to new
10844          */
10845         bcopy((void *)old, (void *)new, HME8BLK_SZ);
10846 
10847         /*
10848          * add new to hash chain
10849          */
10850         sfmmu_hblk_hash_add(hmebp, new, newpa);
10851 
10852         /*
10853          * search hash chain for hblk_reserve; this needs to be performed
10854          * after adding new, otherwise prev won't correspond to the hblk which
10855          * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10856          * remove old later.
10857          */
10858         for (prev = NULL,
10859             hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10860             prev = hblkp, hblkp = hblkp->hblk_next)
10861                 ;
10862 
10863         if (hblkp != old)
10864                 panic("sfmmu_hblk_swap: hblk_reserve not found");
10865 
10866         /*
10867          * p_mapping list is still pointing to hments in hblk_reserve;
10868          * fix up p_mapping list so that they point to hments in new.
10869          *
10870          * Since all these mappings are created by hblk_reserve_thread
10871          * on the way and it's using at least one of the buffers from each of
10872          * the newly minted slabs, there is no danger of any of these
10873          * mappings getting unloaded by another thread.
10874          *
10875          * tsbmiss could only modify ref/mod bits of hments in old/new.
10876          * Since all of these hments hold mappings established by segkmem
10877          * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10878          * have no meaning for the mappings in hblk_reserve.  hments in
10879          * old and new are identical except for ref/mod bits.
10880          */
10881         for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10882 
10883                 HBLKTOHME(osfhme, old, vaddr);
10884                 sfmmu_copytte(&osfhme->hme_tte, &tte);
10885 
10886                 if (TTE_IS_VALID(&tte)) {
10887                         if ((pp = osfhme->hme_page) == NULL)
10888                                 panic("sfmmu_hblk_swap: page not mapped");
10889 
10890                         pml = sfmmu_mlist_enter(pp);
10891 
10892                         if (pp != osfhme->hme_page)
10893                                 panic("sfmmu_hblk_swap: mapping changed");
10894 
10895                         HBLKTOHME(nsfhme, new, vaddr);
10896 
10897                         HME_ADD(nsfhme, pp);
10898                         HME_SUB(osfhme, pp);
10899 
10900                         sfmmu_mlist_exit(pml);
10901                 }
10902         }
10903 
10904         /*
10905          * remove old from hash chain
10906          */
10907         sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10908 
10909 #ifdef  DEBUG
10910 
10911         hblktag.htag_id = ksfmmup;
10912         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10913         hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10914         hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10915         HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10916 
10917         if (found != new)
10918                 panic("sfmmu_hblk_swap: new hblk not found");
10919 #endif
10920 
10921         SFMMU_HASH_UNLOCK(hmebp);
10922 
10923         /*
10924          * Reset hblk_reserve
10925          */
10926         bzero((void *)old, HME8BLK_SZ);
10927         old->hblk_nextpa = va_to_pa((caddr_t)old);
10928 }
10929 
10930 /*
10931  * Grab the mlist mutex for both pages passed in.
10932  *
10933  * low and high will be returned as pointers to the mutexes for these pages.
10934  * low refers to the mutex residing in the lower bin of the mlist hash, while
10935  * high refers to the mutex residing in the higher bin of the mlist hash.  This
10936  * is due to the locking order restrictions on the same thread grabbing
10937  * multiple mlist mutexes.  The low lock must be acquired before the high lock.
10938  *
10939  * If both pages hash to the same mutex, only grab that single mutex, and
10940  * high will be returned as NULL
10941  * If the pages hash to different bins in the hash, grab the lower addressed
10942  * lock first and then the higher addressed lock in order to follow the locking
10943  * rules involved with the same thread grabbing multiple mlist mutexes.
10944  * low and high will both have non-NULL values.
10945  */
10946 static void
10947 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10948     kmutex_t **low, kmutex_t **high)
10949 {
10950         kmutex_t        *mml_targ, *mml_repl;
10951 
10952         /*
10953          * no need to do the dance around szc as in sfmmu_mlist_enter()
10954          * because this routine is only called by hat_page_relocate() and all
10955          * targ and repl pages are already locked EXCL so szc can't change.
10956          */
10957 
10958         mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10959         mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10960 
10961         if (mml_targ == mml_repl) {
10962                 *low = mml_targ;
10963                 *high = NULL;
10964         } else {
10965                 if (mml_targ < mml_repl) {
10966                         *low = mml_targ;
10967                         *high = mml_repl;
10968                 } else {
10969                         *low = mml_repl;
10970                         *high = mml_targ;
10971                 }
10972         }
10973 
10974         mutex_enter(*low);
10975         if (*high)
10976                 mutex_enter(*high);
10977 }
10978 
10979 static void
10980 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10981 {
10982         if (high)
10983                 mutex_exit(high);
10984         mutex_exit(low);
10985 }
10986 
10987 static hatlock_t *
10988 sfmmu_hat_enter(sfmmu_t *sfmmup)
10989 {
10990         hatlock_t       *hatlockp;
10991 
10992         if (sfmmup != ksfmmup) {
10993                 hatlockp = TSB_HASH(sfmmup);
10994                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10995                 return (hatlockp);
10996         }
10997         return (NULL);
10998 }
10999 
11000 static hatlock_t *
11001 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
11002 {
11003         hatlock_t       *hatlockp;
11004 
11005         if (sfmmup != ksfmmup) {
11006                 hatlockp = TSB_HASH(sfmmup);
11007                 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
11008                         return (NULL);
11009                 return (hatlockp);
11010         }
11011         return (NULL);
11012 }
11013 
11014 static void
11015 sfmmu_hat_exit(hatlock_t *hatlockp)
11016 {
11017         if (hatlockp != NULL)
11018                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
11019 }
11020 
11021 static void
11022 sfmmu_hat_lock_all(void)
11023 {
11024         int i;
11025         for (i = 0; i < SFMMU_NUM_LOCK; i++)
11026                 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
11027 }
11028 
11029 static void
11030 sfmmu_hat_unlock_all(void)
11031 {
11032         int i;
11033         for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
11034                 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
11035 }
11036 
11037 int
11038 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
11039 {
11040         ASSERT(sfmmup != ksfmmup);
11041         return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
11042 }
11043 
11044 /*
11045  * Locking primitives to provide consistency between ISM unmap
11046  * and other operations.  Since ISM unmap can take a long time, we
11047  * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
11048  * contention on the hatlock buckets while ISM segments are being
11049  * unmapped.  The tradeoff is that the flags don't prevent priority
11050  * inversion from occurring, so we must request kernel priority in
11051  * case we have to sleep to keep from getting buried while holding
11052  * the HAT_ISMBUSY flag set, which in turn could block other kernel
11053  * threads from running (for example, in sfmmu_uvatopfn()).
11054  */
11055 static void
11056 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
11057 {
11058         hatlock_t *hatlockp;
11059 
11060         THREAD_KPRI_REQUEST();
11061         if (!hatlock_held)
11062                 hatlockp = sfmmu_hat_enter(sfmmup);
11063         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
11064                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11065         SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
11066         if (!hatlock_held)
11067                 sfmmu_hat_exit(hatlockp);
11068 }
11069 
11070 static void
11071 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
11072 {
11073         hatlock_t *hatlockp;
11074 
11075         if (!hatlock_held)
11076                 hatlockp = sfmmu_hat_enter(sfmmup);
11077         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
11078         SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
11079         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11080         if (!hatlock_held)
11081                 sfmmu_hat_exit(hatlockp);
11082         THREAD_KPRI_RELEASE();
11083 }
11084 
11085 /*
11086  *
11087  * Algorithm:
11088  *
11089  * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
11090  *      hblks.
11091  *
11092  * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
11093  *
11094  *              (a) try to return an hblk from reserve pool of free hblks;
11095  *              (b) if the reserve pool is empty, acquire hblk_reserve_lock
11096  *                  and return hblk_reserve.
11097  *
11098  * (3) call kmem_cache_alloc() to allocate hblk;
11099  *
11100  *              (a) if hblk_reserve_lock is held by the current thread,
11101  *                  atomically replace hblk_reserve by the hblk that is
11102  *                  returned by kmem_cache_alloc; release hblk_reserve_lock
11103  *                  and call kmem_cache_alloc() again.
11104  *              (b) if reserve pool is not full, add the hblk that is
11105  *                  returned by kmem_cache_alloc to reserve pool and
11106  *                  call kmem_cache_alloc again.
11107  *
11108  */
11109 static struct hme_blk *
11110 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
11111         struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
11112         uint_t flags, uint_t rid)
11113 {
11114         struct hme_blk *hmeblkp = NULL;
11115         struct hme_blk *newhblkp;
11116         struct hme_blk *shw_hblkp = NULL;
11117         struct kmem_cache *sfmmu_cache = NULL;
11118         uint64_t hblkpa;
11119         ulong_t index;
11120         uint_t owner;           /* set to 1 if using hblk_reserve */
11121         uint_t forcefree;
11122         int sleep;
11123         sf_srd_t *srdp;
11124         sf_region_t *rgnp;
11125 
11126         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11127         ASSERT(hblktag.htag_rid == rid);
11128         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
11129         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11130             IS_P2ALIGNED(vaddr, TTEBYTES(size)));
11131 
11132         /*
11133          * If segkmem is not created yet, allocate from static hmeblks
11134          * created at the end of startup_modules().  See the block comment
11135          * in startup_modules() describing how we estimate the number of
11136          * static hmeblks that will be needed during re-map.
11137          */
11138         if (!hblk_alloc_dynamic) {
11139 
11140                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11141 
11142                 if (size == TTE8K) {
11143                         index = nucleus_hblk8.index;
11144                         if (index >= nucleus_hblk8.len) {
11145                                 /*
11146                                  * If we panic here, see startup_modules() to
11147                                  * make sure that we are calculating the
11148                                  * number of hblk8's that we need correctly.
11149                                  */
11150                                 prom_panic("no nucleus hblk8 to allocate");
11151                         }
11152                         hmeblkp =
11153                             (struct hme_blk *)&nucleus_hblk8.list[index];
11154                         nucleus_hblk8.index++;
11155                         SFMMU_STAT(sf_hblk8_nalloc);
11156                 } else {
11157                         index = nucleus_hblk1.index;
11158                         if (nucleus_hblk1.index >= nucleus_hblk1.len) {
11159                                 /*
11160                                  * If we panic here, see startup_modules().
11161                                  * Most likely you need to update the
11162                                  * calculation of the number of hblk1 elements
11163                                  * that the kernel needs to boot.
11164                                  */
11165                                 prom_panic("no nucleus hblk1 to allocate");
11166                         }
11167                         hmeblkp =
11168                             (struct hme_blk *)&nucleus_hblk1.list[index];
11169                         nucleus_hblk1.index++;
11170                         SFMMU_STAT(sf_hblk1_nalloc);
11171                 }
11172 
11173                 goto hblk_init;
11174         }
11175 
11176         SFMMU_HASH_UNLOCK(hmebp);
11177 
11178         if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
11179                 if (mmu_page_sizes == max_mmu_page_sizes) {
11180                         if (size < TTE256M)
11181                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11182                                     size, flags);
11183                 } else {
11184                         if (size < TTE4M)
11185                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11186                                     size, flags);
11187                 }
11188         } else if (SFMMU_IS_SHMERID_VALID(rid)) {
11189                 /*
11190                  * Shared hmes use per region bitmaps in rgn_hmeflag
11191                  * rather than shadow hmeblks to keep track of the
11192                  * mapping sizes which have been allocated for the region.
11193                  * Here we cleanup old invalid hmeblks with this rid,
11194                  * which may be left around by pageunload().
11195                  */
11196                 int ttesz;
11197                 caddr_t va;
11198                 caddr_t eva = vaddr + TTEBYTES(size);
11199 
11200                 ASSERT(sfmmup != KHATID);
11201 
11202                 srdp = sfmmup->sfmmu_srdp;
11203                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11204                 rgnp = srdp->srd_hmergnp[rid];
11205                 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11206                 ASSERT(rgnp->rgn_refcnt != 0);
11207                 ASSERT(size <= rgnp->rgn_pgszc);
11208 
11209                 ttesz = HBLK_MIN_TTESZ;
11210                 do {
11211                         if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11212                                 continue;
11213                         }
11214 
11215                         if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11216                                 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11217                         } else if (ttesz < size) {
11218                                 for (va = vaddr; va < eva;
11219                                     va += TTEBYTES(ttesz)) {
11220                                         sfmmu_cleanup_rhblk(srdp, va, rid,
11221                                             ttesz);
11222                                 }
11223                         }
11224                 } while (++ttesz <= rgnp->rgn_pgszc);
11225         }
11226 
11227 fill_hblk:
11228         owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11229 
11230         if (owner && size == TTE8K) {
11231 
11232                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11233                 /*
11234                  * We are really in a tight spot. We already own
11235                  * hblk_reserve and we need another hblk.  In anticipation
11236                  * of this kind of scenario, we specifically set aside
11237                  * HBLK_RESERVE_MIN number of hblks to be used exclusively
11238                  * by owner of hblk_reserve.
11239                  */
11240                 SFMMU_STAT(sf_hblk_recurse_cnt);
11241 
11242                 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11243                         panic("sfmmu_hblk_alloc: reserve list is empty");
11244 
11245                 goto hblk_verify;
11246         }
11247 
11248         ASSERT(!owner);
11249 
11250         if ((flags & HAT_NO_KALLOC) == 0) {
11251 
11252                 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11253                 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11254 
11255                 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11256                         hmeblkp = sfmmu_hblk_steal(size);
11257                 } else {
11258                         /*
11259                          * if we are the owner of hblk_reserve,
11260                          * swap hblk_reserve with hmeblkp and
11261                          * start a fresh life.  Hope things go
11262                          * better this time.
11263                          */
11264                         if (hblk_reserve_thread == curthread) {
11265                                 ASSERT(sfmmu_cache == sfmmu8_cache);
11266                                 sfmmu_hblk_swap(hmeblkp);
11267                                 hblk_reserve_thread = NULL;
11268                                 mutex_exit(&hblk_reserve_lock);
11269                                 goto fill_hblk;
11270                         }
11271                         /*
11272                          * let's donate this hblk to our reserve list if
11273                          * we are not mapping kernel range
11274                          */
11275                         if (size == TTE8K && sfmmup != KHATID) {
11276                                 if (sfmmu_put_free_hblk(hmeblkp, 0))
11277                                         goto fill_hblk;
11278                         }
11279                 }
11280         } else {
11281                 /*
11282                  * We are here to map the slab in sfmmu8_cache; let's
11283                  * check if we could tap our reserve list; if successful,
11284                  * this will avoid the pain of going thru sfmmu_hblk_swap
11285                  */
11286                 SFMMU_STAT(sf_hblk_slab_cnt);
11287                 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11288                         /*
11289                          * let's start hblk_reserve dance
11290                          */
11291                         SFMMU_STAT(sf_hblk_reserve_cnt);
11292                         owner = 1;
11293                         mutex_enter(&hblk_reserve_lock);
11294                         hmeblkp = HBLK_RESERVE;
11295                         hblk_reserve_thread = curthread;
11296                 }
11297         }
11298 
11299 hblk_verify:
11300         ASSERT(hmeblkp != NULL);
11301         set_hblk_sz(hmeblkp, size);
11302         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11303         SFMMU_HASH_LOCK(hmebp);
11304         HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11305         if (newhblkp != NULL) {
11306                 SFMMU_HASH_UNLOCK(hmebp);
11307                 if (hmeblkp != HBLK_RESERVE) {
11308                         /*
11309                          * This is really tricky!
11310                          *
11311                          * vmem_alloc(vmem_seg_arena)
11312                          *  vmem_alloc(vmem_internal_arena)
11313                          *   segkmem_alloc(heap_arena)
11314                          *    vmem_alloc(heap_arena)
11315                          *    page_create()
11316                          *    hat_memload()
11317                          *      kmem_cache_free()
11318                          *       kmem_cache_alloc()
11319                          *        kmem_slab_create()
11320                          *         vmem_alloc(kmem_internal_arena)
11321                          *          segkmem_alloc(heap_arena)
11322                          *              vmem_alloc(heap_arena)
11323                          *              page_create()
11324                          *              hat_memload()
11325                          *                kmem_cache_free()
11326                          *              ...
11327                          *
11328                          * Thus, hat_memload() could call kmem_cache_free
11329                          * for enough number of times that we could easily
11330                          * hit the bottom of the stack or run out of reserve
11331                          * list of vmem_seg structs.  So, we must donate
11332                          * this hblk to reserve list if it's allocated
11333                          * from sfmmu8_cache *and* mapping kernel range.
11334                          * We don't need to worry about freeing hmeblk1's
11335                          * to kmem since they don't map any kmem slabs.
11336                          *
11337                          * Note: When segkmem supports largepages, we must
11338                          * free hmeblk1's to reserve list as well.
11339                          */
11340                         forcefree = (sfmmup == KHATID) ? 1 : 0;
11341                         if (size == TTE8K &&
11342                             sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11343                                 goto re_verify;
11344                         }
11345                         ASSERT(sfmmup != KHATID);
11346                         kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11347                 } else {
11348                         /*
11349                          * Hey! we don't need hblk_reserve any more.
11350                          */
11351                         ASSERT(owner);
11352                         hblk_reserve_thread = NULL;
11353                         mutex_exit(&hblk_reserve_lock);
11354                         owner = 0;
11355                 }
11356 re_verify:
11357                 /*
11358                  * let's check if the goodies are still present
11359                  */
11360                 SFMMU_HASH_LOCK(hmebp);
11361                 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11362                 if (newhblkp != NULL) {
11363                         /*
11364                          * return newhblkp if it's not hblk_reserve;
11365                          * if newhblkp is hblk_reserve, return it
11366                          * _only if_ we are the owner of hblk_reserve.
11367                          */
11368                         if (newhblkp != HBLK_RESERVE || owner) {
11369                                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11370                                     newhblkp->hblk_shared);
11371                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11372                                     !newhblkp->hblk_shared);
11373                                 return (newhblkp);
11374                         } else {
11375                                 /*
11376                                  * we just hit hblk_reserve in the hash and
11377                                  * we are not the owner of that;
11378                                  *
11379                                  * block until hblk_reserve_thread completes
11380                                  * swapping hblk_reserve and try the dance
11381                                  * once again.
11382                                  */
11383                                 SFMMU_HASH_UNLOCK(hmebp);
11384                                 mutex_enter(&hblk_reserve_lock);
11385                                 mutex_exit(&hblk_reserve_lock);
11386                                 SFMMU_STAT(sf_hblk_reserve_hit);
11387                                 goto fill_hblk;
11388                         }
11389                 } else {
11390                         /*
11391                          * it's no more! try the dance once again.
11392                          */
11393                         SFMMU_HASH_UNLOCK(hmebp);
11394                         goto fill_hblk;
11395                 }
11396         }
11397 
11398 hblk_init:
11399         if (SFMMU_IS_SHMERID_VALID(rid)) {
11400                 uint16_t tteflag = 0x1 <<
11401                     ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11402 
11403                 if (!(rgnp->rgn_hmeflags & tteflag)) {
11404                         atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11405                 }
11406                 hmeblkp->hblk_shared = 1;
11407         } else {
11408                 hmeblkp->hblk_shared = 0;
11409         }
11410         set_hblk_sz(hmeblkp, size);
11411         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11412         hmeblkp->hblk_next = (struct hme_blk *)NULL;
11413         hmeblkp->hblk_tag = hblktag;
11414         hmeblkp->hblk_shadow = shw_hblkp;
11415         hblkpa = hmeblkp->hblk_nextpa;
11416         hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11417 
11418         ASSERT(get_hblk_ttesz(hmeblkp) == size);
11419         ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11420         ASSERT(hmeblkp->hblk_hmecnt == 0);
11421         ASSERT(hmeblkp->hblk_vcnt == 0);
11422         ASSERT(hmeblkp->hblk_lckcnt == 0);
11423         ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11424         sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11425         return (hmeblkp);
11426 }
11427 
11428 /*
11429  * This function cleans up the hme_blk and returns it to the free list.
11430  */
11431 /* ARGSUSED */
11432 static void
11433 sfmmu_hblk_free(struct hme_blk **listp)
11434 {
11435         struct hme_blk *hmeblkp, *next_hmeblkp;
11436         int             size;
11437         uint_t          critical;
11438         uint64_t        hblkpa;
11439 
11440         ASSERT(*listp != NULL);
11441 
11442         hmeblkp = *listp;
11443         while (hmeblkp != NULL) {
11444                 next_hmeblkp = hmeblkp->hblk_next;
11445                 ASSERT(!hmeblkp->hblk_hmecnt);
11446                 ASSERT(!hmeblkp->hblk_vcnt);
11447                 ASSERT(!hmeblkp->hblk_lckcnt);
11448                 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11449                 ASSERT(hmeblkp->hblk_shared == 0);
11450                 ASSERT(hmeblkp->hblk_shw_bit == 0);
11451                 ASSERT(hmeblkp->hblk_shadow == NULL);
11452 
11453                 hblkpa = va_to_pa((caddr_t)hmeblkp);
11454                 ASSERT(hblkpa != (uint64_t)-1);
11455                 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11456 
11457                 size = get_hblk_ttesz(hmeblkp);
11458                 hmeblkp->hblk_next = NULL;
11459                 hmeblkp->hblk_nextpa = hblkpa;
11460 
11461                 if (hmeblkp->hblk_nuc_bit == 0) {
11462 
11463                         if (size != TTE8K ||
11464                             !sfmmu_put_free_hblk(hmeblkp, critical))
11465                                 kmem_cache_free(get_hblk_cache(hmeblkp),
11466                                     hmeblkp);
11467                 }
11468                 hmeblkp = next_hmeblkp;
11469         }
11470 }
11471 
11472 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11473 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11474 
11475 static uint_t sfmmu_hblk_steal_twice;
11476 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11477 
11478 /*
11479  * Steal a hmeblk from user or kernel hme hash lists.
11480  * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11481  * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11482  * tap into critical reserve of freehblkp.
11483  * Note: We remain looping in this routine until we find one.
11484  */
11485 static struct hme_blk *
11486 sfmmu_hblk_steal(int size)
11487 {
11488         static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11489         struct hmehash_bucket *hmebp;
11490         struct hme_blk *hmeblkp = NULL, *pr_hblk;
11491         uint64_t hblkpa;
11492         int i;
11493         uint_t loop_cnt = 0, critical;
11494 
11495         for (;;) {
11496                 /* Check cpu hblk pending queues */
11497                 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11498                         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11499                         ASSERT(hmeblkp->hblk_hmecnt == 0);
11500                         ASSERT(hmeblkp->hblk_vcnt == 0);
11501                         return (hmeblkp);
11502                 }
11503 
11504                 if (size == TTE8K) {
11505                         critical =
11506                             (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11507                         if (sfmmu_get_free_hblk(&hmeblkp, critical))
11508                                 return (hmeblkp);
11509                 }
11510 
11511                 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11512                     uhmehash_steal_hand;
11513                 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11514 
11515                 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11516                     BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11517                         SFMMU_HASH_LOCK(hmebp);
11518                         hmeblkp = hmebp->hmeblkp;
11519                         hblkpa = hmebp->hmeh_nextpa;
11520                         pr_hblk = NULL;
11521                         while (hmeblkp) {
11522                                 /*
11523                                  * check if it is a hmeblk that is not locked
11524                                  * and not shared. skip shadow hmeblks with
11525                                  * shadow_mask set i.e valid count non zero.
11526                                  */
11527                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11528                                     (hmeblkp->hblk_shw_bit == 0 ||
11529                                     hmeblkp->hblk_vcnt == 0) &&
11530                                     (hmeblkp->hblk_lckcnt == 0)) {
11531                                         /*
11532                                          * there is a high probability that we
11533                                          * will find a free one. search some
11534                                          * buckets for a free hmeblk initially
11535                                          * before unloading a valid hmeblk.
11536                                          */
11537                                         if ((hmeblkp->hblk_vcnt == 0 &&
11538                                             hmeblkp->hblk_hmecnt == 0) || (i >=
11539                                             BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11540                                                 if (sfmmu_steal_this_hblk(hmebp,
11541                                                     hmeblkp, hblkpa, pr_hblk)) {
11542                                                         /*
11543                                                          * Hblk is unloaded
11544                                                          * successfully
11545                                                          */
11546                                                         break;
11547                                                 }
11548                                         }
11549                                 }
11550                                 pr_hblk = hmeblkp;
11551                                 hblkpa = hmeblkp->hblk_nextpa;
11552                                 hmeblkp = hmeblkp->hblk_next;
11553                         }
11554 
11555                         SFMMU_HASH_UNLOCK(hmebp);
11556                         if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11557                                 hmebp = uhme_hash;
11558                 }
11559                 uhmehash_steal_hand = hmebp;
11560 
11561                 if (hmeblkp != NULL)
11562                         break;
11563 
11564                 /*
11565                  * in the worst case, look for a free one in the kernel
11566                  * hash table.
11567                  */
11568                 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11569                         SFMMU_HASH_LOCK(hmebp);
11570                         hmeblkp = hmebp->hmeblkp;
11571                         hblkpa = hmebp->hmeh_nextpa;
11572                         pr_hblk = NULL;
11573                         while (hmeblkp) {
11574                                 /*
11575                                  * check if it is free hmeblk
11576                                  */
11577                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11578                                     (hmeblkp->hblk_lckcnt == 0) &&
11579                                     (hmeblkp->hblk_vcnt == 0) &&
11580                                     (hmeblkp->hblk_hmecnt == 0)) {
11581                                         if (sfmmu_steal_this_hblk(hmebp,
11582                                             hmeblkp, hblkpa, pr_hblk)) {
11583                                                 break;
11584                                         } else {
11585                                                 /*
11586                                                  * Cannot fail since we have
11587                                                  * hash lock.
11588                                                  */
11589                                                 panic("fail to steal?");
11590                                         }
11591                                 }
11592 
11593                                 pr_hblk = hmeblkp;
11594                                 hblkpa = hmeblkp->hblk_nextpa;
11595                                 hmeblkp = hmeblkp->hblk_next;
11596                         }
11597 
11598                         SFMMU_HASH_UNLOCK(hmebp);
11599                         if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11600                                 hmebp = khme_hash;
11601                 }
11602 
11603                 if (hmeblkp != NULL)
11604                         break;
11605                 sfmmu_hblk_steal_twice++;
11606         }
11607         return (hmeblkp);
11608 }
11609 
11610 /*
11611  * This routine does real work to prepare a hblk to be "stolen" by
11612  * unloading the mappings, updating shadow counts ....
11613  * It returns 1 if the block is ready to be reused (stolen), or 0
11614  * means the block cannot be stolen yet- pageunload is still working
11615  * on this hblk.
11616  */
11617 static int
11618 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11619         uint64_t hblkpa, struct hme_blk *pr_hblk)
11620 {
11621         int shw_size, vshift;
11622         struct hme_blk *shw_hblkp;
11623         caddr_t vaddr;
11624         uint_t shw_mask, newshw_mask;
11625         struct hme_blk *list = NULL;
11626 
11627         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11628 
11629         /*
11630          * check if the hmeblk is free, unload if necessary
11631          */
11632         if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11633                 sfmmu_t *sfmmup;
11634                 demap_range_t dmr;
11635 
11636                 sfmmup = hblktosfmmu(hmeblkp);
11637                 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11638                         return (0);
11639                 }
11640                 DEMAP_RANGE_INIT(sfmmup, &dmr);
11641                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11642                     (caddr_t)get_hblk_base(hmeblkp),
11643                     get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11644                 DEMAP_RANGE_FLUSH(&dmr);
11645                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11646                         /*
11647                          * Pageunload is working on the same hblk.
11648                          */
11649                         return (0);
11650                 }
11651 
11652                 sfmmu_hblk_steal_unload_count++;
11653         }
11654 
11655         ASSERT(hmeblkp->hblk_lckcnt == 0);
11656         ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11657 
11658         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11659         hmeblkp->hblk_nextpa = hblkpa;
11660 
11661         shw_hblkp = hmeblkp->hblk_shadow;
11662         if (shw_hblkp) {
11663                 ASSERT(!hmeblkp->hblk_shared);
11664                 shw_size = get_hblk_ttesz(shw_hblkp);
11665                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11666                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11667                 ASSERT(vshift < 8);
11668                 /*
11669                  * Atomically clear shadow mask bit
11670                  */
11671                 do {
11672                         shw_mask = shw_hblkp->hblk_shw_mask;
11673                         ASSERT(shw_mask & (1 << vshift));
11674                         newshw_mask = shw_mask & ~(1 << vshift);
11675                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11676                             shw_mask, newshw_mask);
11677                 } while (newshw_mask != shw_mask);
11678                 hmeblkp->hblk_shadow = NULL;
11679         }
11680 
11681         /*
11682          * remove shadow bit if we are stealing an unused shadow hmeblk.
11683          * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11684          * we are indeed allocating a shadow hmeblk.
11685          */
11686         hmeblkp->hblk_shw_bit = 0;
11687 
11688         if (hmeblkp->hblk_shared) {
11689                 sf_srd_t        *srdp;
11690                 sf_region_t     *rgnp;
11691                 uint_t          rid;
11692 
11693                 srdp = hblktosrd(hmeblkp);
11694                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11695                 rid = hmeblkp->hblk_tag.htag_rid;
11696                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11697                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11698                 rgnp = srdp->srd_hmergnp[rid];
11699                 ASSERT(rgnp != NULL);
11700                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11701                 hmeblkp->hblk_shared = 0;
11702         }
11703 
11704         sfmmu_hblk_steal_count++;
11705         SFMMU_STAT(sf_steal_count);
11706 
11707         return (1);
11708 }
11709 
11710 struct hme_blk *
11711 sfmmu_hmetohblk(struct sf_hment *sfhme)
11712 {
11713         struct hme_blk *hmeblkp;
11714         struct sf_hment *sfhme0;
11715         struct hme_blk *hblk_dummy = 0;
11716 
11717         /*
11718          * No dummy sf_hments, please.
11719          */
11720         ASSERT(sfhme->hme_tte.ll != 0);
11721 
11722         sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11723         hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11724             (uintptr_t)&hblk_dummy->hblk_hme[0]);
11725 
11726         return (hmeblkp);
11727 }
11728 
11729 /*
11730  * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11731  * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11732  * KM_SLEEP allocation.
11733  *
11734  * Return 0 on success, -1 otherwise.
11735  */
11736 static void
11737 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11738 {
11739         struct tsb_info *tsbinfop, *next;
11740         tsb_replace_rc_t rc;
11741         boolean_t gotfirst = B_FALSE;
11742 
11743         ASSERT(sfmmup != ksfmmup);
11744         ASSERT(sfmmu_hat_lock_held(sfmmup));
11745 
11746         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11747                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11748         }
11749 
11750         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11751                 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11752         } else {
11753                 return;
11754         }
11755 
11756         ASSERT(sfmmup->sfmmu_tsb != NULL);
11757 
11758         /*
11759          * Loop over all tsbinfo's replacing them with ones that actually have
11760          * a TSB.  If any of the replacements ever fail, bail out of the loop.
11761          */
11762         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11763                 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11764                 next = tsbinfop->tsb_next;
11765                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11766                     hatlockp, TSB_SWAPIN);
11767                 if (rc != TSB_SUCCESS) {
11768                         break;
11769                 }
11770                 gotfirst = B_TRUE;
11771         }
11772 
11773         switch (rc) {
11774         case TSB_SUCCESS:
11775                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11776                 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11777                 return;
11778         case TSB_LOSTRACE:
11779                 break;
11780         case TSB_ALLOCFAIL:
11781                 break;
11782         default:
11783                 panic("sfmmu_replace_tsb returned unrecognized failure code "
11784                     "%d", rc);
11785         }
11786 
11787         /*
11788          * In this case, we failed to get one of our TSBs.  If we failed to
11789          * get the first TSB, get one of minimum size (8KB).  Walk the list
11790          * and throw away the tsbinfos, starting where the allocation failed;
11791          * we can get by with just one TSB as long as we don't leave the
11792          * SWAPPED tsbinfo structures lying around.
11793          */
11794         tsbinfop = sfmmup->sfmmu_tsb;
11795         next = tsbinfop->tsb_next;
11796         tsbinfop->tsb_next = NULL;
11797 
11798         sfmmu_hat_exit(hatlockp);
11799         for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11800                 next = tsbinfop->tsb_next;
11801                 sfmmu_tsbinfo_free(tsbinfop);
11802         }
11803         hatlockp = sfmmu_hat_enter(sfmmup);
11804 
11805         /*
11806          * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11807          * pages.
11808          */
11809         if (!gotfirst) {
11810                 tsbinfop = sfmmup->sfmmu_tsb;
11811                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11812                     hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11813                 ASSERT(rc == TSB_SUCCESS);
11814         }
11815 
11816         SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11817         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11818 }
11819 
11820 static int
11821 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11822 {
11823         ulong_t bix = 0;
11824         uint_t rid;
11825         sf_region_t *rgnp;
11826 
11827         ASSERT(srdp != NULL);
11828         ASSERT(srdp->srd_refcnt != 0);
11829 
11830         w <<= BT_ULSHIFT;
11831         while (bmw) {
11832                 if (!(bmw & 0x1)) {
11833                         bix++;
11834                         bmw >>= 1;
11835                         continue;
11836                 }
11837                 rid = w | bix;
11838                 rgnp = srdp->srd_hmergnp[rid];
11839                 ASSERT(rgnp->rgn_refcnt > 0);
11840                 ASSERT(rgnp->rgn_id == rid);
11841                 if (addr < rgnp->rgn_saddr ||
11842                     addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11843                         bix++;
11844                         bmw >>= 1;
11845                 } else {
11846                         return (1);
11847                 }
11848         }
11849         return (0);
11850 }
11851 
11852 /*
11853  * Handle exceptions for low level tsb_handler.
11854  *
11855  * There are many scenarios that could land us here:
11856  *
11857  * If the context is invalid we land here. The context can be invalid
11858  * for 3 reasons: 1) we couldn't allocate a new context and now need to
11859  * perform a wrap around operation in order to allocate a new context.
11860  * 2) Context was invalidated to change pagesize programming 3) ISMs or
11861  * TSBs configuration is changeing for this process and we are forced into
11862  * here to do a syncronization operation. If the context is valid we can
11863  * be here from window trap hanlder. In this case just call trap to handle
11864  * the fault.
11865  *
11866  * Note that the process will run in INVALID_CONTEXT before
11867  * faulting into here and subsequently loading the MMU registers
11868  * (including the TSB base register) associated with this process.
11869  * For this reason, the trap handlers must all test for
11870  * INVALID_CONTEXT before attempting to access any registers other
11871  * than the context registers.
11872  */
11873 void
11874 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11875 {
11876         sfmmu_t *sfmmup, *shsfmmup;
11877         uint_t ctxtype;
11878         klwp_id_t lwp;
11879         char lwp_save_state;
11880         hatlock_t *hatlockp, *shatlockp;
11881         struct tsb_info *tsbinfop;
11882         struct tsbmiss *tsbmp;
11883         sf_scd_t *scdp;
11884 
11885         SFMMU_STAT(sf_tsb_exceptions);
11886         SFMMU_MMU_STAT(mmu_tsb_exceptions);
11887         sfmmup = astosfmmu(curthread->t_procp->p_as);
11888         /*
11889          * note that in sun4u, tagacces register contains ctxnum
11890          * while sun4v passes ctxtype in the tagaccess register.
11891          */
11892         ctxtype = tagaccess & TAGACC_CTX_MASK;
11893 
11894         ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11895         ASSERT(sfmmup->sfmmu_ismhat == 0);
11896         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11897             ctxtype == INVALID_CONTEXT);
11898 
11899         if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11900                 /*
11901                  * We may land here because shme bitmap and pagesize
11902                  * flags are updated lazily in tsbmiss area on other cpus.
11903                  * If we detect here that tsbmiss area is out of sync with
11904                  * sfmmu update it and retry the trapped instruction.
11905                  * Otherwise call trap().
11906                  */
11907                 int ret = 0;
11908                 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11909                 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11910 
11911                 /*
11912                  * Must set lwp state to LWP_SYS before
11913                  * trying to acquire any adaptive lock
11914                  */
11915                 lwp = ttolwp(curthread);
11916                 ASSERT(lwp);
11917                 lwp_save_state = lwp->lwp_state;
11918                 lwp->lwp_state = LWP_SYS;
11919 
11920                 hatlockp = sfmmu_hat_enter(sfmmup);
11921                 kpreempt_disable();
11922                 tsbmp = &tsbmiss_area[CPU->cpu_id];
11923                 ASSERT(sfmmup == tsbmp->usfmmup);
11924                 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11925                     ~tteflag_mask) ||
11926                     ((tsbmp->uhat_rtteflags ^  sfmmup->sfmmu_rtteflags) &
11927                     ~tteflag_mask)) {
11928                         tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11929                         tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11930                         ret = 1;
11931                 }
11932                 if (sfmmup->sfmmu_srdp != NULL) {
11933                         ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11934                         ulong_t *tm = tsbmp->shmermap;
11935                         ulong_t i;
11936                         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11937                                 ulong_t d = tm[i] ^ sm[i];
11938                                 if (d) {
11939                                         if (d & sm[i]) {
11940                                                 if (!ret && sfmmu_is_rgnva(
11941                                                     sfmmup->sfmmu_srdp,
11942                                                     addr, i, d & sm[i])) {
11943                                                         ret = 1;
11944                                                 }
11945                                         }
11946                                         tm[i] = sm[i];
11947                                 }
11948                         }
11949                 }
11950                 kpreempt_enable();
11951                 sfmmu_hat_exit(hatlockp);
11952                 lwp->lwp_state = lwp_save_state;
11953                 if (ret) {
11954                         return;
11955                 }
11956         } else if (ctxtype == INVALID_CONTEXT) {
11957                 /*
11958                  * First, make sure we come out of here with a valid ctx,
11959                  * since if we don't get one we'll simply loop on the
11960                  * faulting instruction.
11961                  *
11962                  * If the ISM mappings are changing, the TSB is relocated,
11963                  * the process is swapped, the process is joining SCD or
11964                  * leaving SCD or shared regions we serialize behind the
11965                  * controlling thread with hat lock, sfmmu_flags and
11966                  * sfmmu_tsb_cv condition variable.
11967                  */
11968 
11969                 /*
11970                  * Must set lwp state to LWP_SYS before
11971                  * trying to acquire any adaptive lock
11972                  */
11973                 lwp = ttolwp(curthread);
11974                 ASSERT(lwp);
11975                 lwp_save_state = lwp->lwp_state;
11976                 lwp->lwp_state = LWP_SYS;
11977 
11978                 hatlockp = sfmmu_hat_enter(sfmmup);
11979 retry:
11980                 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11981                         shsfmmup = scdp->scd_sfmmup;
11982                         ASSERT(shsfmmup != NULL);
11983 
11984                         for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11985                             tsbinfop = tsbinfop->tsb_next) {
11986                                 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11987                                         /* drop the private hat lock */
11988                                         sfmmu_hat_exit(hatlockp);
11989                                         /* acquire the shared hat lock */
11990                                         shatlockp = sfmmu_hat_enter(shsfmmup);
11991                                         /*
11992                                          * recheck to see if anything changed
11993                                          * after we drop the private hat lock.
11994                                          */
11995                                         if (sfmmup->sfmmu_scdp == scdp &&
11996                                             shsfmmup == scdp->scd_sfmmup) {
11997                                                 sfmmu_tsb_chk_reloc(shsfmmup,
11998                                                     shatlockp);
11999                                         }
12000                                         sfmmu_hat_exit(shatlockp);
12001                                         hatlockp = sfmmu_hat_enter(sfmmup);
12002                                         goto retry;
12003                                 }
12004                         }
12005                 }
12006 
12007                 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
12008                     tsbinfop = tsbinfop->tsb_next) {
12009                         if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
12010                                 cv_wait(&sfmmup->sfmmu_tsb_cv,
12011                                     HATLOCK_MUTEXP(hatlockp));
12012                                 goto retry;
12013                         }
12014                 }
12015 
12016                 /*
12017                  * Wait for ISM maps to be updated.
12018                  */
12019                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12020                         cv_wait(&sfmmup->sfmmu_tsb_cv,
12021                             HATLOCK_MUTEXP(hatlockp));
12022                         goto retry;
12023                 }
12024 
12025                 /* Is this process joining an SCD? */
12026                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
12027                         /*
12028                          * Flush private TSB and setup shared TSB.
12029                          * sfmmu_finish_join_scd() does not drop the
12030                          * hat lock.
12031                          */
12032                         sfmmu_finish_join_scd(sfmmup);
12033                         SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
12034                 }
12035 
12036                 /*
12037                  * If we're swapping in, get TSB(s).  Note that we must do
12038                  * this before we get a ctx or load the MMU state.  Once
12039                  * we swap in we have to recheck to make sure the TSB(s) and
12040                  * ISM mappings didn't change while we slept.
12041                  */
12042                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
12043                         sfmmu_tsb_swapin(sfmmup, hatlockp);
12044                         goto retry;
12045                 }
12046 
12047                 sfmmu_get_ctx(sfmmup);
12048 
12049                 sfmmu_hat_exit(hatlockp);
12050                 /*
12051                  * Must restore lwp_state if not calling
12052                  * trap() for further processing. Restore
12053                  * it anyway.
12054                  */
12055                 lwp->lwp_state = lwp_save_state;
12056                 return;
12057         }
12058         trap(rp, (caddr_t)tagaccess, traptype, 0);
12059 }
12060 
12061 static void
12062 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
12063 {
12064         struct tsb_info *tp;
12065 
12066         ASSERT(sfmmu_hat_lock_held(sfmmup));
12067 
12068         for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
12069                 if (tp->tsb_flags & TSB_RELOC_FLAG) {
12070                         cv_wait(&sfmmup->sfmmu_tsb_cv,
12071                             HATLOCK_MUTEXP(hatlockp));
12072                         break;
12073                 }
12074         }
12075 }
12076 
12077 /*
12078  * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
12079  * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
12080  * rather than spinning to avoid send mondo timeouts with
12081  * interrupts enabled. When the lock is acquired it is immediately
12082  * released and we return back to sfmmu_vatopfn just after
12083  * the GET_TTE call.
12084  */
12085 void
12086 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
12087 {
12088         struct page     **pp;
12089 
12090         (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
12091         as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
12092 }
12093 
12094 /*
12095  * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
12096  * TTE_SUSPENDED bit set in tte. We do this so that we can handle
12097  * cross traps which cannot be handled while spinning in the
12098  * trap handlers. Simply enter and exit the kpr_suspendlock spin
12099  * mutex, which is held by the holder of the suspend bit, and then
12100  * retry the trapped instruction after unwinding.
12101  */
12102 /*ARGSUSED*/
12103 void
12104 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
12105 {
12106         ASSERT(curthread != kreloc_thread);
12107         mutex_enter(&kpr_suspendlock);
12108         mutex_exit(&kpr_suspendlock);
12109 }
12110 
12111 /*
12112  * This routine could be optimized to reduce the number of xcalls by flushing
12113  * the entire TLBs if region reference count is above some threshold but the
12114  * tradeoff will depend on the size of the TLB. So for now flush the specific
12115  * page a context at a time.
12116  *
12117  * If uselocks is 0 then it's called after all cpus were captured and all the
12118  * hat locks were taken. In this case don't take the region lock by relying on
12119  * the order of list region update operations in hat_join_region(),
12120  * hat_leave_region() and hat_dup_region(). The ordering in those routines
12121  * guarantees that list is always forward walkable and reaches active sfmmus
12122  * regardless of where xc_attention() captures a cpu.
12123  */
12124 cpuset_t
12125 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
12126     struct hme_blk *hmeblkp, int uselocks)
12127 {
12128         sfmmu_t *sfmmup;
12129         cpuset_t cpuset;
12130         cpuset_t rcpuset;
12131         hatlock_t *hatlockp;
12132         uint_t rid = rgnp->rgn_id;
12133         sf_rgn_link_t *rlink;
12134         sf_scd_t *scdp;
12135 
12136         ASSERT(hmeblkp->hblk_shared);
12137         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
12138         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
12139 
12140         CPUSET_ZERO(rcpuset);
12141         if (uselocks) {
12142                 mutex_enter(&rgnp->rgn_mutex);
12143         }
12144         sfmmup = rgnp->rgn_sfmmu_head;
12145         while (sfmmup != NULL) {
12146                 if (uselocks) {
12147                         hatlockp = sfmmu_hat_enter(sfmmup);
12148                 }
12149 
12150                 /*
12151                  * When an SCD is created the SCD hat is linked on the sfmmu
12152                  * region lists for each hme region which is part of the
12153                  * SCD. If we find an SCD hat, when walking these lists,
12154                  * then we flush the shared TSBs, if we find a private hat,
12155                  * which is part of an SCD, but where the region
12156                  * is not part of the SCD then we flush the private TSBs.
12157                  */
12158                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12159                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
12160                         scdp = sfmmup->sfmmu_scdp;
12161                         if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
12162                                 if (uselocks) {
12163                                         sfmmu_hat_exit(hatlockp);
12164                                 }
12165                                 goto next;
12166                         }
12167                 }
12168 
12169                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12170 
12171                 kpreempt_disable();
12172                 cpuset = sfmmup->sfmmu_cpusran;
12173                 CPUSET_AND(cpuset, cpu_ready_set);
12174                 CPUSET_DEL(cpuset, CPU->cpu_id);
12175                 SFMMU_XCALL_STATS(sfmmup);
12176                 xt_some(cpuset, vtag_flushpage_tl1,
12177                     (uint64_t)addr, (uint64_t)sfmmup);
12178                 vtag_flushpage(addr, (uint64_t)sfmmup);
12179                 if (uselocks) {
12180                         sfmmu_hat_exit(hatlockp);
12181                 }
12182                 kpreempt_enable();
12183                 CPUSET_OR(rcpuset, cpuset);
12184 
12185 next:
12186                 /* LINTED: constant in conditional context */
12187                 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
12188                 ASSERT(rlink != NULL);
12189                 sfmmup = rlink->next;
12190         }
12191         if (uselocks) {
12192                 mutex_exit(&rgnp->rgn_mutex);
12193         }
12194         return (rcpuset);
12195 }
12196 
12197 /*
12198  * This routine takes an sfmmu pointer and the va for an adddress in an
12199  * ISM region as input and returns the corresponding region id in ism_rid.
12200  * The return value of 1 indicates that a region has been found and ism_rid
12201  * is valid, otherwise 0 is returned.
12202  */
12203 static int
12204 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12205 {
12206         ism_blk_t       *ism_blkp;
12207         int             i;
12208         ism_map_t       *ism_map;
12209 #ifdef DEBUG
12210         struct hat      *ism_hatid;
12211 #endif
12212         ASSERT(sfmmu_hat_lock_held(sfmmup));
12213 
12214         ism_blkp = sfmmup->sfmmu_iblk;
12215         while (ism_blkp != NULL) {
12216                 ism_map = ism_blkp->iblk_maps;
12217                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12218                         if ((va >= ism_start(ism_map[i])) &&
12219                             (va < ism_end(ism_map[i]))) {
12220 
12221                                 *ism_rid = ism_map[i].imap_rid;
12222 #ifdef DEBUG
12223                                 ism_hatid = ism_map[i].imap_ismhat;
12224                                 ASSERT(ism_hatid == ism_sfmmup);
12225                                 ASSERT(ism_hatid->sfmmu_ismhat);
12226 #endif
12227                                 return (1);
12228                         }
12229                 }
12230                 ism_blkp = ism_blkp->iblk_next;
12231         }
12232         return (0);
12233 }
12234 
12235 /*
12236  * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12237  * This routine may be called with all cpu's captured. Therefore, the
12238  * caller is responsible for holding all locks and disabling kernel
12239  * preemption.
12240  */
12241 /* ARGSUSED */
12242 static void
12243 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12244         struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12245 {
12246         cpuset_t        cpuset;
12247         caddr_t         va;
12248         ism_ment_t      *ment;
12249         sfmmu_t         *sfmmup;
12250 #ifdef VAC
12251         int             vcolor;
12252 #endif
12253 
12254         sf_scd_t        *scdp;
12255         uint_t          ism_rid;
12256 
12257         ASSERT(!hmeblkp->hblk_shared);
12258         /*
12259          * Walk the ism_hat's mapping list and flush the page
12260          * from every hat sharing this ism_hat. This routine
12261          * may be called while all cpu's have been captured.
12262          * Therefore we can't attempt to grab any locks. For now
12263          * this means we will protect the ism mapping list under
12264          * a single lock which will be grabbed by the caller.
12265          * If hat_share/unshare scalibility becomes a performance
12266          * problem then we may need to re-think ism mapping list locking.
12267          */
12268         ASSERT(ism_sfmmup->sfmmu_ismhat);
12269         ASSERT(MUTEX_HELD(&ism_mlist_lock));
12270         addr = addr - ISMID_STARTADDR;
12271 
12272         for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12273 
12274                 sfmmup = ment->iment_hat;
12275 
12276                 va = ment->iment_base_va;
12277                 va = (caddr_t)((uintptr_t)va  + (uintptr_t)addr);
12278 
12279                 /*
12280                  * When an SCD is created the SCD hat is linked on the ism
12281                  * mapping lists for each ISM segment which is part of the
12282                  * SCD. If we find an SCD hat, when walking these lists,
12283                  * then we flush the shared TSBs, if we find a private hat,
12284                  * which is part of an SCD, but where the region
12285                  * corresponding to this va is not part of the SCD then we
12286                  * flush the private TSBs.
12287                  */
12288                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12289                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12290                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12291                         if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12292                             &ism_rid)) {
12293                                 cmn_err(CE_PANIC,
12294                                     "can't find matching ISM rid!");
12295                         }
12296 
12297                         scdp = sfmmup->sfmmu_scdp;
12298                         if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12299                             SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12300                             ism_rid)) {
12301                                 continue;
12302                         }
12303                 }
12304                 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12305 
12306                 cpuset = sfmmup->sfmmu_cpusran;
12307                 CPUSET_AND(cpuset, cpu_ready_set);
12308                 CPUSET_DEL(cpuset, CPU->cpu_id);
12309                 SFMMU_XCALL_STATS(sfmmup);
12310                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12311                     (uint64_t)sfmmup);
12312                 vtag_flushpage(va, (uint64_t)sfmmup);
12313 
12314 #ifdef VAC
12315                 /*
12316                  * Flush D$
12317                  * When flushing D$ we must flush all
12318                  * cpu's. See sfmmu_cache_flush().
12319                  */
12320                 if (cache_flush_flag == CACHE_FLUSH) {
12321                         cpuset = cpu_ready_set;
12322                         CPUSET_DEL(cpuset, CPU->cpu_id);
12323 
12324                         SFMMU_XCALL_STATS(sfmmup);
12325                         vcolor = addr_to_vcolor(va);
12326                         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12327                         vac_flushpage(pfnum, vcolor);
12328                 }
12329 #endif  /* VAC */
12330         }
12331 }
12332 
12333 /*
12334  * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12335  * a particular virtual address and ctx.  If noflush is set we do not
12336  * flush the TLB/TSB.  This function may or may not be called with the
12337  * HAT lock held.
12338  */
12339 static void
12340 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12341         pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12342         int hat_lock_held)
12343 {
12344 #ifdef VAC
12345         int vcolor;
12346 #endif
12347         cpuset_t cpuset;
12348         hatlock_t *hatlockp;
12349 
12350         ASSERT(!hmeblkp->hblk_shared);
12351 
12352 #if defined(lint) && !defined(VAC)
12353         pfnum = pfnum;
12354         cpu_flag = cpu_flag;
12355         cache_flush_flag = cache_flush_flag;
12356 #endif
12357 
12358         /*
12359          * There is no longer a need to protect against ctx being
12360          * stolen here since we don't store the ctx in the TSB anymore.
12361          */
12362 #ifdef VAC
12363         vcolor = addr_to_vcolor(addr);
12364 #endif
12365 
12366         /*
12367          * We must hold the hat lock during the flush of TLB,
12368          * to avoid a race with sfmmu_invalidate_ctx(), where
12369          * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12370          * causing TLB demap routine to skip flush on that MMU.
12371          * If the context on a MMU has already been set to
12372          * INVALID_CONTEXT, we just get an extra flush on
12373          * that MMU.
12374          */
12375         if (!hat_lock_held && !tlb_noflush)
12376                 hatlockp = sfmmu_hat_enter(sfmmup);
12377 
12378         kpreempt_disable();
12379         if (!tlb_noflush) {
12380                 /*
12381                  * Flush the TSB and TLB.
12382                  */
12383                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12384 
12385                 cpuset = sfmmup->sfmmu_cpusran;
12386                 CPUSET_AND(cpuset, cpu_ready_set);
12387                 CPUSET_DEL(cpuset, CPU->cpu_id);
12388 
12389                 SFMMU_XCALL_STATS(sfmmup);
12390 
12391                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12392                     (uint64_t)sfmmup);
12393 
12394                 vtag_flushpage(addr, (uint64_t)sfmmup);
12395         }
12396 
12397         if (!hat_lock_held && !tlb_noflush)
12398                 sfmmu_hat_exit(hatlockp);
12399 
12400 #ifdef VAC
12401         /*
12402          * Flush the D$
12403          *
12404          * Even if the ctx is stolen, we need to flush the
12405          * cache. Our ctx stealer only flushes the TLBs.
12406          */
12407         if (cache_flush_flag == CACHE_FLUSH) {
12408                 if (cpu_flag & FLUSH_ALL_CPUS) {
12409                         cpuset = cpu_ready_set;
12410                 } else {
12411                         cpuset = sfmmup->sfmmu_cpusran;
12412                         CPUSET_AND(cpuset, cpu_ready_set);
12413                 }
12414                 CPUSET_DEL(cpuset, CPU->cpu_id);
12415                 SFMMU_XCALL_STATS(sfmmup);
12416                 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12417                 vac_flushpage(pfnum, vcolor);
12418         }
12419 #endif  /* VAC */
12420         kpreempt_enable();
12421 }
12422 
12423 /*
12424  * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12425  * address and ctx.  If noflush is set we do not currently do anything.
12426  * This function may or may not be called with the HAT lock held.
12427  */
12428 static void
12429 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12430         int tlb_noflush, int hat_lock_held)
12431 {
12432         cpuset_t cpuset;
12433         hatlock_t *hatlockp;
12434 
12435         ASSERT(!hmeblkp->hblk_shared);
12436 
12437         /*
12438          * If the process is exiting we have nothing to do.
12439          */
12440         if (tlb_noflush)
12441                 return;
12442 
12443         /*
12444          * Flush TSB.
12445          */
12446         if (!hat_lock_held)
12447                 hatlockp = sfmmu_hat_enter(sfmmup);
12448         SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12449 
12450         kpreempt_disable();
12451 
12452         cpuset = sfmmup->sfmmu_cpusran;
12453         CPUSET_AND(cpuset, cpu_ready_set);
12454         CPUSET_DEL(cpuset, CPU->cpu_id);
12455 
12456         SFMMU_XCALL_STATS(sfmmup);
12457         xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12458 
12459         vtag_flushpage(addr, (uint64_t)sfmmup);
12460 
12461         if (!hat_lock_held)
12462                 sfmmu_hat_exit(hatlockp);
12463 
12464         kpreempt_enable();
12465 
12466 }
12467 
12468 /*
12469  * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12470  * call handler that can flush a range of pages to save on xcalls.
12471  */
12472 static int sfmmu_xcall_save;
12473 
12474 /*
12475  * this routine is never used for demaping addresses backed by SRD hmeblks.
12476  */
12477 static void
12478 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12479 {
12480         sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12481         hatlock_t *hatlockp;
12482         cpuset_t cpuset;
12483         uint64_t sfmmu_pgcnt;
12484         pgcnt_t pgcnt = 0;
12485         int pgunload = 0;
12486         int dirtypg = 0;
12487         caddr_t addr = dmrp->dmr_addr;
12488         caddr_t eaddr;
12489         uint64_t bitvec = dmrp->dmr_bitvec;
12490 
12491         ASSERT(bitvec & 1);
12492 
12493         /*
12494          * Flush TSB and calculate number of pages to flush.
12495          */
12496         while (bitvec != 0) {
12497                 dirtypg = 0;
12498                 /*
12499                  * Find the first page to flush and then count how many
12500                  * pages there are after it that also need to be flushed.
12501                  * This way the number of TSB flushes is minimized.
12502                  */
12503                 while ((bitvec & 1) == 0) {
12504                         pgcnt++;
12505                         addr += MMU_PAGESIZE;
12506                         bitvec >>= 1;
12507                 }
12508                 while (bitvec & 1) {
12509                         dirtypg++;
12510                         bitvec >>= 1;
12511                 }
12512                 eaddr = addr + ptob(dirtypg);
12513                 hatlockp = sfmmu_hat_enter(sfmmup);
12514                 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12515                 sfmmu_hat_exit(hatlockp);
12516                 pgunload += dirtypg;
12517                 addr = eaddr;
12518                 pgcnt += dirtypg;
12519         }
12520 
12521         ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12522         if (sfmmup->sfmmu_free == 0) {
12523                 addr = dmrp->dmr_addr;
12524                 bitvec = dmrp->dmr_bitvec;
12525 
12526                 /*
12527                  * make sure it has SFMMU_PGCNT_SHIFT bits only,
12528                  * as it will be used to pack argument for xt_some
12529                  */
12530                 ASSERT((pgcnt > 0) &&
12531                     (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12532 
12533                 /*
12534                  * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12535                  * the low 6 bits of sfmmup. This is doable since pgcnt
12536                  * always >= 1.
12537                  */
12538                 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12539                 sfmmu_pgcnt = (uint64_t)sfmmup |
12540                     ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12541 
12542                 /*
12543                  * We must hold the hat lock during the flush of TLB,
12544                  * to avoid a race with sfmmu_invalidate_ctx(), where
12545                  * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12546                  * causing TLB demap routine to skip flush on that MMU.
12547                  * If the context on a MMU has already been set to
12548                  * INVALID_CONTEXT, we just get an extra flush on
12549                  * that MMU.
12550                  */
12551                 hatlockp = sfmmu_hat_enter(sfmmup);
12552                 kpreempt_disable();
12553 
12554                 cpuset = sfmmup->sfmmu_cpusran;
12555                 CPUSET_AND(cpuset, cpu_ready_set);
12556                 CPUSET_DEL(cpuset, CPU->cpu_id);
12557 
12558                 SFMMU_XCALL_STATS(sfmmup);
12559                 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12560                     sfmmu_pgcnt);
12561 
12562                 for (; bitvec != 0; bitvec >>= 1) {
12563                         if (bitvec & 1)
12564                                 vtag_flushpage(addr, (uint64_t)sfmmup);
12565                         addr += MMU_PAGESIZE;
12566                 }
12567                 kpreempt_enable();
12568                 sfmmu_hat_exit(hatlockp);
12569 
12570                 sfmmu_xcall_save += (pgunload-1);
12571         }
12572         dmrp->dmr_bitvec = 0;
12573 }
12574 
12575 /*
12576  * In cases where we need to synchronize with TLB/TSB miss trap
12577  * handlers, _and_ need to flush the TLB, it's a lot easier to
12578  * throw away the context from the process than to do a
12579  * special song and dance to keep things consistent for the
12580  * handlers.
12581  *
12582  * Since the process suddenly ends up without a context and our caller
12583  * holds the hat lock, threads that fault after this function is called
12584  * will pile up on the lock.  We can then do whatever we need to
12585  * atomically from the context of the caller.  The first blocked thread
12586  * to resume executing will get the process a new context, and the
12587  * process will resume executing.
12588  *
12589  * One added advantage of this approach is that on MMUs that
12590  * support a "flush all" operation, we will delay the flush until
12591  * cnum wrap-around, and then flush the TLB one time.  This
12592  * is rather rare, so it's a lot less expensive than making 8000
12593  * x-calls to flush the TLB 8000 times.
12594  *
12595  * A per-process (PP) lock is used to synchronize ctx allocations in
12596  * resume() and ctx invalidations here.
12597  */
12598 static void
12599 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12600 {
12601         cpuset_t cpuset;
12602         int cnum, currcnum;
12603         mmu_ctx_t *mmu_ctxp;
12604         int i;
12605         uint_t pstate_save;
12606 
12607         SFMMU_STAT(sf_ctx_inv);
12608 
12609         ASSERT(sfmmu_hat_lock_held(sfmmup));
12610         ASSERT(sfmmup != ksfmmup);
12611 
12612         kpreempt_disable();
12613 
12614         mmu_ctxp = CPU_MMU_CTXP(CPU);
12615         ASSERT(mmu_ctxp);
12616         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12617         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12618 
12619         currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12620 
12621         pstate_save = sfmmu_disable_intrs();
12622 
12623         lock_set(&sfmmup->sfmmu_ctx_lock);       /* acquire PP lock */
12624         /* set HAT cnum invalid across all context domains. */
12625         for (i = 0; i < max_mmu_ctxdoms; i++) {
12626 
12627                 cnum =  sfmmup->sfmmu_ctxs[i].cnum;
12628                 if (cnum == INVALID_CONTEXT) {
12629                         continue;
12630                 }
12631 
12632                 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12633         }
12634         membar_enter(); /* make sure globally visible to all CPUs */
12635         lock_clear(&sfmmup->sfmmu_ctx_lock);     /* release PP lock */
12636 
12637         sfmmu_enable_intrs(pstate_save);
12638 
12639         cpuset = sfmmup->sfmmu_cpusran;
12640         CPUSET_DEL(cpuset, CPU->cpu_id);
12641         CPUSET_AND(cpuset, cpu_ready_set);
12642         if (!CPUSET_ISNULL(cpuset)) {
12643                 SFMMU_XCALL_STATS(sfmmup);
12644                 xt_some(cpuset, sfmmu_raise_tsb_exception,
12645                     (uint64_t)sfmmup, INVALID_CONTEXT);
12646                 xt_sync(cpuset);
12647                 SFMMU_STAT(sf_tsb_raise_exception);
12648                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12649         }
12650 
12651         /*
12652          * If the hat to-be-invalidated is the same as the current
12653          * process on local CPU we need to invalidate
12654          * this CPU context as well.
12655          */
12656         if ((sfmmu_getctx_sec() == currcnum) &&
12657             (currcnum != INVALID_CONTEXT)) {
12658                 /* sets shared context to INVALID too */
12659                 sfmmu_setctx_sec(INVALID_CONTEXT);
12660                 sfmmu_clear_utsbinfo();
12661         }
12662 
12663         SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12664 
12665         kpreempt_enable();
12666 
12667         /*
12668          * we hold the hat lock, so nobody should allocate a context
12669          * for us yet
12670          */
12671         ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12672 }
12673 
12674 #ifdef VAC
12675 /*
12676  * We need to flush the cache in all cpus.  It is possible that
12677  * a process referenced a page as cacheable but has sinced exited
12678  * and cleared the mapping list.  We still to flush it but have no
12679  * state so all cpus is the only alternative.
12680  */
12681 void
12682 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12683 {
12684         cpuset_t cpuset;
12685 
12686         kpreempt_disable();
12687         cpuset = cpu_ready_set;
12688         CPUSET_DEL(cpuset, CPU->cpu_id);
12689         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12690         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12691         xt_sync(cpuset);
12692         vac_flushpage(pfnum, vcolor);
12693         kpreempt_enable();
12694 }
12695 
12696 void
12697 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12698 {
12699         cpuset_t cpuset;
12700 
12701         ASSERT(vcolor >= 0);
12702 
12703         kpreempt_disable();
12704         cpuset = cpu_ready_set;
12705         CPUSET_DEL(cpuset, CPU->cpu_id);
12706         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12707         xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12708         xt_sync(cpuset);
12709         vac_flushcolor(vcolor, pfnum);
12710         kpreempt_enable();
12711 }
12712 #endif  /* VAC */
12713 
12714 /*
12715  * We need to prevent processes from accessing the TSB using a cached physical
12716  * address.  It's alright if they try to access the TSB via virtual address
12717  * since they will just fault on that virtual address once the mapping has
12718  * been suspended.
12719  */
12720 #pragma weak sendmondo_in_recover
12721 
12722 /* ARGSUSED */
12723 static int
12724 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12725 {
12726         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12727         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12728         hatlock_t *hatlockp;
12729         sf_scd_t *scdp;
12730 
12731         if (flags != HAT_PRESUSPEND)
12732                 return (0);
12733 
12734         /*
12735          * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12736          * be a shared hat, then set SCD's tsbinfo's flag.
12737          * If tsb is not shared, sfmmup is a private hat, then set
12738          * its private tsbinfo's flag.
12739          */
12740         hatlockp = sfmmu_hat_enter(sfmmup);
12741         tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12742 
12743         if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12744                 sfmmu_tsb_inv_ctx(sfmmup);
12745                 sfmmu_hat_exit(hatlockp);
12746         } else {
12747                 /* release lock on the shared hat */
12748                 sfmmu_hat_exit(hatlockp);
12749                 /* sfmmup is a shared hat */
12750                 ASSERT(sfmmup->sfmmu_scdhat);
12751                 scdp = sfmmup->sfmmu_scdp;
12752                 ASSERT(scdp != NULL);
12753                 /* get private hat from the scd list */
12754                 mutex_enter(&scdp->scd_mutex);
12755                 sfmmup = scdp->scd_sf_list;
12756                 while (sfmmup != NULL) {
12757                         hatlockp = sfmmu_hat_enter(sfmmup);
12758                         /*
12759                          * We do not call sfmmu_tsb_inv_ctx here because
12760                          * sendmondo_in_recover check is only needed for
12761                          * sun4u.
12762                          */
12763                         sfmmu_invalidate_ctx(sfmmup);
12764                         sfmmu_hat_exit(hatlockp);
12765                         sfmmup = sfmmup->sfmmu_scd_link.next;
12766 
12767                 }
12768                 mutex_exit(&scdp->scd_mutex);
12769         }
12770         return (0);
12771 }
12772 
12773 static void
12774 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12775 {
12776         extern uint32_t sendmondo_in_recover;
12777 
12778         ASSERT(sfmmu_hat_lock_held(sfmmup));
12779 
12780         /*
12781          * For Cheetah+ Erratum 25:
12782          * Wait for any active recovery to finish.  We can't risk
12783          * relocating the TSB of the thread running mondo_recover_proc()
12784          * since, if we did that, we would deadlock.  The scenario we are
12785          * trying to avoid is as follows:
12786          *
12787          * THIS CPU                     RECOVER CPU
12788          * --------                     -----------
12789          *                              Begins recovery, walking through TSB
12790          * hat_pagesuspend() TSB TTE
12791          *                              TLB miss on TSB TTE, spins at TL1
12792          * xt_sync()
12793          *      send_mondo_timeout()
12794          *      mondo_recover_proc()
12795          *      ((deadlocked))
12796          *
12797          * The second half of the workaround is that mondo_recover_proc()
12798          * checks to see if the tsb_info has the RELOC flag set, and if it
12799          * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12800          * and hence avoiding the TLB miss that could result in a deadlock.
12801          */
12802         if (&sendmondo_in_recover) {
12803                 membar_enter(); /* make sure RELOC flag visible */
12804                 while (sendmondo_in_recover) {
12805                         drv_usecwait(1);
12806                         membar_consumer();
12807                 }
12808         }
12809 
12810         sfmmu_invalidate_ctx(sfmmup);
12811 }
12812 
12813 /* ARGSUSED */
12814 static int
12815 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12816         void *tsbinfo, pfn_t newpfn)
12817 {
12818         hatlock_t *hatlockp;
12819         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12820         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12821 
12822         if (flags != HAT_POSTUNSUSPEND)
12823                 return (0);
12824 
12825         hatlockp = sfmmu_hat_enter(sfmmup);
12826 
12827         SFMMU_STAT(sf_tsb_reloc);
12828 
12829         /*
12830          * The process may have swapped out while we were relocating one
12831          * of its TSBs.  If so, don't bother doing the setup since the
12832          * process can't be using the memory anymore.
12833          */
12834         if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12835                 ASSERT(va == tsbinfop->tsb_va);
12836                 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12837 
12838                 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12839                         sfmmu_inv_tsb(tsbinfop->tsb_va,
12840                             TSB_BYTES(tsbinfop->tsb_szc));
12841                         tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12842                 }
12843         }
12844 
12845         membar_exit();
12846         tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12847         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12848 
12849         sfmmu_hat_exit(hatlockp);
12850 
12851         return (0);
12852 }
12853 
12854 /*
12855  * Allocate and initialize a tsb_info structure.  Note that we may or may not
12856  * allocate a TSB here, depending on the flags passed in.
12857  */
12858 static int
12859 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12860         uint_t flags, sfmmu_t *sfmmup)
12861 {
12862         int err;
12863 
12864         *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12865             sfmmu_tsbinfo_cache, KM_SLEEP);
12866 
12867         if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12868             tsb_szc, flags, sfmmup)) != 0) {
12869                 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12870                 SFMMU_STAT(sf_tsb_allocfail);
12871                 *tsbinfopp = NULL;
12872                 return (err);
12873         }
12874         SFMMU_STAT(sf_tsb_alloc);
12875 
12876         /*
12877          * Bump the TSB size counters for this TSB size.
12878          */
12879         (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12880         return (0);
12881 }
12882 
12883 static void
12884 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12885 {
12886         caddr_t tsbva = tsbinfo->tsb_va;
12887         uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12888         struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12889         vmem_t  *vmp = tsbinfo->tsb_vmp;
12890 
12891         /*
12892          * If we allocated this TSB from relocatable kernel memory, then we
12893          * need to uninstall the callback handler.
12894          */
12895         if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12896                 uintptr_t slab_mask;
12897                 caddr_t slab_vaddr;
12898                 page_t **ppl;
12899                 int ret;
12900 
12901                 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12902                 if (tsb_size > MMU_PAGESIZE4M)
12903                         slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12904                 else
12905                         slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12906                 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12907 
12908                 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12909                 ASSERT(ret == 0);
12910                 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12911                     0, NULL);
12912                 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12913         }
12914 
12915         if (kmem_cachep != NULL) {
12916                 kmem_cache_free(kmem_cachep, tsbva);
12917         } else {
12918                 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12919         }
12920         tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12921         atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12922 }
12923 
12924 static void
12925 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12926 {
12927         if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12928                 sfmmu_tsb_free(tsbinfo);
12929         }
12930         kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12931 
12932 }
12933 
12934 /*
12935  * Setup all the references to physical memory for this tsbinfo.
12936  * The underlying page(s) must be locked.
12937  */
12938 static void
12939 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12940 {
12941         ASSERT(pfn != PFN_INVALID);
12942         ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12943 
12944 #ifndef sun4v
12945         if (tsbinfo->tsb_szc == 0) {
12946                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12947                     PROT_WRITE|PROT_READ, TTE8K);
12948         } else {
12949                 /*
12950                  * Round down PA and use a large mapping; the handlers will
12951                  * compute the TSB pointer at the correct offset into the
12952                  * big virtual page.  NOTE: this assumes all TSBs larger
12953                  * than 8K must come from physically contiguous slabs of
12954                  * size tsb_slab_size.
12955                  */
12956                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12957                     PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12958         }
12959         tsbinfo->tsb_pa = ptob(pfn);
12960 
12961         TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12962         TTE_SET_MOD(&tsbinfo->tsb_tte);    /* enable writes */
12963 
12964         ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12965         ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12966 #else /* sun4v */
12967         tsbinfo->tsb_pa = ptob(pfn);
12968 #endif /* sun4v */
12969 }
12970 
12971 
12972 /*
12973  * Returns zero on success, ENOMEM if over the high water mark,
12974  * or EAGAIN if the caller needs to retry with a smaller TSB
12975  * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12976  *
12977  * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12978  * is specified and the TSB requested is PAGESIZE, though it
12979  * may sleep waiting for memory if sufficient memory is not
12980  * available.
12981  */
12982 static int
12983 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12984     int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12985 {
12986         caddr_t vaddr = NULL;
12987         caddr_t slab_vaddr;
12988         uintptr_t slab_mask;
12989         int tsbbytes = TSB_BYTES(tsbcode);
12990         int lowmem = 0;
12991         struct kmem_cache *kmem_cachep = NULL;
12992         vmem_t *vmp = NULL;
12993         lgrp_id_t lgrpid = LGRP_NONE;
12994         pfn_t pfn;
12995         uint_t cbflags = HAC_SLEEP;
12996         page_t **pplist;
12997         int ret;
12998 
12999         ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
13000         if (tsbbytes > MMU_PAGESIZE4M)
13001                 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
13002         else
13003                 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
13004 
13005         if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
13006                 flags |= TSB_ALLOC;
13007 
13008         ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
13009 
13010         tsbinfo->tsb_sfmmu = sfmmup;
13011 
13012         /*
13013          * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
13014          * return.
13015          */
13016         if ((flags & TSB_ALLOC) == 0) {
13017                 tsbinfo->tsb_szc = tsbcode;
13018                 tsbinfo->tsb_ttesz_mask = tteszmask;
13019                 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
13020                 tsbinfo->tsb_pa = -1;
13021                 tsbinfo->tsb_tte.ll = 0;
13022                 tsbinfo->tsb_next = NULL;
13023                 tsbinfo->tsb_flags = TSB_SWAPPED;
13024                 tsbinfo->tsb_cache = NULL;
13025                 tsbinfo->tsb_vmp = NULL;
13026                 return (0);
13027         }
13028 
13029 #ifdef DEBUG
13030         /*
13031          * For debugging:
13032          * Randomly force allocation failures every tsb_alloc_mtbf
13033          * tries if TSB_FORCEALLOC is not specified.  This will
13034          * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
13035          * it is even, to allow testing of both failure paths...
13036          */
13037         if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
13038             (tsb_alloc_count++ == tsb_alloc_mtbf)) {
13039                 tsb_alloc_count = 0;
13040                 tsb_alloc_fail_mtbf++;
13041                 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
13042         }
13043 #endif  /* DEBUG */
13044 
13045         /*
13046          * Enforce high water mark if we are not doing a forced allocation
13047          * and are not shrinking a process' TSB.
13048          */
13049         if ((flags & TSB_SHRINK) == 0 &&
13050             (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
13051                 if ((flags & TSB_FORCEALLOC) == 0)
13052                         return (ENOMEM);
13053                 lowmem = 1;
13054         }
13055 
13056         /*
13057          * Allocate from the correct location based upon the size of the TSB
13058          * compared to the base page size, and what memory conditions dictate.
13059          * Note we always do nonblocking allocations from the TSB arena since
13060          * we don't want memory fragmentation to cause processes to block
13061          * indefinitely waiting for memory; until the kernel algorithms that
13062          * coalesce large pages are improved this is our best option.
13063          *
13064          * Algorithm:
13065          *      If allocating a "large" TSB (>8K), allocate from the
13066          *              appropriate kmem_tsb_default_arena vmem arena
13067          *      else if low on memory or the TSB_FORCEALLOC flag is set or
13068          *      tsb_forceheap is set
13069          *              Allocate from kernel heap via sfmmu_tsb8k_cache with
13070          *              KM_SLEEP (never fails)
13071          *      else
13072          *              Allocate from appropriate sfmmu_tsb_cache with
13073          *              KM_NOSLEEP
13074          *      endif
13075          */
13076         if (tsb_lgrp_affinity)
13077                 lgrpid = lgrp_home_id(curthread);
13078         if (lgrpid == LGRP_NONE)
13079                 lgrpid = 0;     /* use lgrp of boot CPU */
13080 
13081         if (tsbbytes > MMU_PAGESIZE) {
13082                 if (tsbbytes > MMU_PAGESIZE4M) {
13083                         vmp = kmem_bigtsb_default_arena[lgrpid];
13084                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
13085                             0, 0, NULL, NULL, VM_NOSLEEP);
13086                 } else {
13087                         vmp = kmem_tsb_default_arena[lgrpid];
13088                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
13089                             0, 0, NULL, NULL, VM_NOSLEEP);
13090                 }
13091 #ifdef  DEBUG
13092         } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
13093 #else   /* !DEBUG */
13094         } else if (lowmem || (flags & TSB_FORCEALLOC)) {
13095 #endif  /* DEBUG */
13096                 kmem_cachep = sfmmu_tsb8k_cache;
13097                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
13098                 ASSERT(vaddr != NULL);
13099         } else {
13100                 kmem_cachep = sfmmu_tsb_cache[lgrpid];
13101                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
13102         }
13103 
13104         tsbinfo->tsb_cache = kmem_cachep;
13105         tsbinfo->tsb_vmp = vmp;
13106 
13107         if (vaddr == NULL) {
13108                 return (EAGAIN);
13109         }
13110 
13111         atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
13112         kmem_cachep = tsbinfo->tsb_cache;
13113 
13114         /*
13115          * If we are allocating from outside the cage, then we need to
13116          * register a relocation callback handler.  Note that for now
13117          * since pseudo mappings always hang off of the slab's root page,
13118          * we need only lock the first 8K of the TSB slab.  This is a bit
13119          * hacky but it is good for performance.
13120          */
13121         if (kmem_cachep != sfmmu_tsb8k_cache) {
13122                 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
13123                 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
13124                 ASSERT(ret == 0);
13125                 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
13126                     cbflags, (void *)tsbinfo, &pfn, NULL);
13127 
13128                 /*
13129                  * Need to free up resources if we could not successfully
13130                  * add the callback function and return an error condition.
13131                  */
13132                 if (ret != 0) {
13133                         if (kmem_cachep) {
13134                                 kmem_cache_free(kmem_cachep, vaddr);
13135                         } else {
13136                                 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
13137                         }
13138                         as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
13139                             S_WRITE);
13140                         return (EAGAIN);
13141                 }
13142         } else {
13143                 /*
13144                  * Since allocation of 8K TSBs from heap is rare and occurs
13145                  * during memory pressure we allocate them from permanent
13146                  * memory rather than using callbacks to get the PFN.
13147                  */
13148                 pfn = hat_getpfnum(kas.a_hat, vaddr);
13149         }
13150 
13151         tsbinfo->tsb_va = vaddr;
13152         tsbinfo->tsb_szc = tsbcode;
13153         tsbinfo->tsb_ttesz_mask = tteszmask;
13154         tsbinfo->tsb_next = NULL;
13155         tsbinfo->tsb_flags = 0;
13156 
13157         sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
13158 
13159         sfmmu_inv_tsb(vaddr, tsbbytes);
13160 
13161         if (kmem_cachep != sfmmu_tsb8k_cache) {
13162                 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
13163         }
13164 
13165         return (0);
13166 }
13167 
13168 /*
13169  * Initialize per cpu tsb and per cpu tsbmiss_area
13170  */
13171 void
13172 sfmmu_init_tsbs(void)
13173 {
13174         int i;
13175         struct tsbmiss  *tsbmissp;
13176         struct kpmtsbm  *kpmtsbmp;
13177 #ifndef sun4v
13178         extern int      dcache_line_mask;
13179 #endif /* sun4v */
13180         extern uint_t   vac_colors;
13181 
13182         /*
13183          * Init. tsb miss area.
13184          */
13185         tsbmissp = tsbmiss_area;
13186 
13187         for (i = 0; i < NCPU; tsbmissp++, i++) {
13188                 /*
13189                  * initialize the tsbmiss area.
13190                  * Do this for all possible CPUs as some may be added
13191                  * while the system is running. There is no cost to this.
13192                  */
13193                 tsbmissp->ksfmmup = ksfmmup;
13194 #ifndef sun4v
13195                 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13196 #endif /* sun4v */
13197                 tsbmissp->khashstart =
13198                     (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13199                 tsbmissp->uhashstart =
13200                     (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13201                 tsbmissp->khashsz = khmehash_num;
13202                 tsbmissp->uhashsz = uhmehash_num;
13203         }
13204 
13205         sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13206             sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13207 
13208         if (kpm_enable == 0)
13209                 return;
13210 
13211         /* -- Begin KPM specific init -- */
13212 
13213         if (kpm_smallpages) {
13214                 /*
13215                  * If we're using base pagesize pages for seg_kpm
13216                  * mappings, we use the kernel TSB since we can't afford
13217                  * to allocate a second huge TSB for these mappings.
13218                  */
13219                 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13220                 kpm_tsbsz = ktsb_szcode;
13221                 kpmsm_tsbbase = kpm_tsbbase;
13222                 kpmsm_tsbsz = kpm_tsbsz;
13223         } else {
13224                 /*
13225                  * In VAC conflict case, just put the entries in the
13226                  * kernel 8K indexed TSB for now so we can find them.
13227                  * This could really be changed in the future if we feel
13228                  * the need...
13229                  */
13230                 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13231                 kpmsm_tsbsz = ktsb_szcode;
13232                 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13233                 kpm_tsbsz = ktsb4m_szcode;
13234         }
13235 
13236         kpmtsbmp = kpmtsbm_area;
13237         for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13238                 /*
13239                  * Initialize the kpmtsbm area.
13240                  * Do this for all possible CPUs as some may be added
13241                  * while the system is running. There is no cost to this.
13242                  */
13243                 kpmtsbmp->vbase = kpm_vbase;
13244                 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13245                 kpmtsbmp->sz_shift = kpm_size_shift;
13246                 kpmtsbmp->kpmp_shift = kpmp_shift;
13247                 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13248                 if (kpm_smallpages == 0) {
13249                         kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13250                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13251                 } else {
13252                         kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13253                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13254                 }
13255                 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13256                 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13257 #ifdef  DEBUG
13258                 kpmtsbmp->flags |= (kpm_tsbmtl) ?  KPMTSBM_TLTSBM_FLAG : 0;
13259 #endif  /* DEBUG */
13260                 if (ktsb_phys)
13261                         kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13262         }
13263 
13264         /* -- End KPM specific init -- */
13265 }
13266 
13267 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13268 struct tsb_info ktsb_info[2];
13269 
13270 /*
13271  * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13272  */
13273 void
13274 sfmmu_init_ktsbinfo()
13275 {
13276         ASSERT(ksfmmup != NULL);
13277         ASSERT(ksfmmup->sfmmu_tsb == NULL);
13278         /*
13279          * Allocate tsbinfos for kernel and copy in data
13280          * to make debug easier and sun4v setup easier.
13281          */
13282         ktsb_info[0].tsb_sfmmu = ksfmmup;
13283         ktsb_info[0].tsb_szc = ktsb_szcode;
13284         ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13285         ktsb_info[0].tsb_va = ktsb_base;
13286         ktsb_info[0].tsb_pa = ktsb_pbase;
13287         ktsb_info[0].tsb_flags = 0;
13288         ktsb_info[0].tsb_tte.ll = 0;
13289         ktsb_info[0].tsb_cache = NULL;
13290 
13291         ktsb_info[1].tsb_sfmmu = ksfmmup;
13292         ktsb_info[1].tsb_szc = ktsb4m_szcode;
13293         ktsb_info[1].tsb_ttesz_mask = TSB4M;
13294         ktsb_info[1].tsb_va = ktsb4m_base;
13295         ktsb_info[1].tsb_pa = ktsb4m_pbase;
13296         ktsb_info[1].tsb_flags = 0;
13297         ktsb_info[1].tsb_tte.ll = 0;
13298         ktsb_info[1].tsb_cache = NULL;
13299 
13300         /* Link them into ksfmmup. */
13301         ktsb_info[0].tsb_next = &ktsb_info[1];
13302         ktsb_info[1].tsb_next = NULL;
13303         ksfmmup->sfmmu_tsb = &ktsb_info[0];
13304 
13305         sfmmu_setup_tsbinfo(ksfmmup);
13306 }
13307 
13308 /*
13309  * Cache the last value returned from va_to_pa().  If the VA specified
13310  * in the current call to cached_va_to_pa() maps to the same Page (as the
13311  * previous call to cached_va_to_pa()), then compute the PA using
13312  * cached info, else call va_to_pa().
13313  *
13314  * Note: this function is neither MT-safe nor consistent in the presence
13315  * of multiple, interleaved threads.  This function was created to enable
13316  * an optimization used during boot (at a point when there's only one thread
13317  * executing on the "boot CPU", and before startup_vm() has been called).
13318  */
13319 static uint64_t
13320 cached_va_to_pa(void *vaddr)
13321 {
13322         static uint64_t prev_vaddr_base = 0;
13323         static uint64_t prev_pfn = 0;
13324 
13325         if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13326                 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13327         } else {
13328                 uint64_t pa = va_to_pa(vaddr);
13329 
13330                 if (pa != ((uint64_t)-1)) {
13331                         /*
13332                          * Computed physical address is valid.  Cache its
13333                          * related info for the next cached_va_to_pa() call.
13334                          */
13335                         prev_pfn = pa & MMU_PAGEMASK;
13336                         prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13337                 }
13338 
13339                 return (pa);
13340         }
13341 }
13342 
13343 /*
13344  * Carve up our nucleus hblk region.  We may allocate more hblks than
13345  * asked due to rounding errors but we are guaranteed to have at least
13346  * enough space to allocate the requested number of hblk8's and hblk1's.
13347  */
13348 void
13349 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13350 {
13351         struct hme_blk *hmeblkp;
13352         size_t hme8blk_sz, hme1blk_sz;
13353         size_t i;
13354         size_t hblk8_bound;
13355         ulong_t j = 0, k = 0;
13356 
13357         ASSERT(addr != NULL && size != 0);
13358 
13359         /* Need to use proper structure alignment */
13360         hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13361         hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13362 
13363         nucleus_hblk8.list = (void *)addr;
13364         nucleus_hblk8.index = 0;
13365 
13366         /*
13367          * Use as much memory as possible for hblk8's since we
13368          * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13369          * We need to hold back enough space for the hblk1's which
13370          * we'll allocate next.
13371          */
13372         hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13373         for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13374                 hmeblkp = (struct hme_blk *)addr;
13375                 addr += hme8blk_sz;
13376                 hmeblkp->hblk_nuc_bit = 1;
13377                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13378         }
13379         nucleus_hblk8.len = j;
13380         ASSERT(j >= nhblk8);
13381         SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13382 
13383         nucleus_hblk1.list = (void *)addr;
13384         nucleus_hblk1.index = 0;
13385         for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13386                 hmeblkp = (struct hme_blk *)addr;
13387                 addr += hme1blk_sz;
13388                 hmeblkp->hblk_nuc_bit = 1;
13389                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13390         }
13391         ASSERT(k >= nhblk1);
13392         nucleus_hblk1.len = k;
13393         SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13394 }
13395 
13396 /*
13397  * This function is currently not supported on this platform. For what
13398  * it's supposed to do, see hat.c and hat_srmmu.c
13399  */
13400 /* ARGSUSED */
13401 faultcode_t
13402 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13403     uint_t flags)
13404 {
13405         ASSERT(hat->sfmmu_xhat_provider == NULL);
13406         return (FC_NOSUPPORT);
13407 }
13408 
13409 /*
13410  * Searchs the mapping list of the page for a mapping of the same size. If not
13411  * found the corresponding bit is cleared in the p_index field. When large
13412  * pages are more prevalent in the system, we can maintain the mapping list
13413  * in order and we don't have to traverse the list each time. Just check the
13414  * next and prev entries, and if both are of different size, we clear the bit.
13415  */
13416 static void
13417 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13418 {
13419         struct sf_hment *sfhmep;
13420         struct hme_blk *hmeblkp;
13421         int     index;
13422         pgcnt_t npgs;
13423 
13424         ASSERT(ttesz > TTE8K);
13425 
13426         ASSERT(sfmmu_mlist_held(pp));
13427 
13428         ASSERT(PP_ISMAPPED_LARGE(pp));
13429 
13430         /*
13431          * Traverse mapping list looking for another mapping of same size.
13432          * since we only want to clear index field if all mappings of
13433          * that size are gone.
13434          */
13435 
13436         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13437                 if (IS_PAHME(sfhmep))
13438                         continue;
13439                 hmeblkp = sfmmu_hmetohblk(sfhmep);
13440                 if (hmeblkp->hblk_xhat_bit)
13441                         continue;
13442                 if (hme_size(sfhmep) == ttesz) {
13443                         /*
13444                          * another mapping of the same size. don't clear index.
13445                          */
13446                         return;
13447                 }
13448         }
13449 
13450         /*
13451          * Clear the p_index bit for large page.
13452          */
13453         index = PAGESZ_TO_INDEX(ttesz);
13454         npgs = TTEPAGES(ttesz);
13455         while (npgs-- > 0) {
13456                 ASSERT(pp->p_index & index);
13457                 pp->p_index &= ~index;
13458                 pp = PP_PAGENEXT(pp);
13459         }
13460 }
13461 
13462 /*
13463  * return supported features
13464  */
13465 /* ARGSUSED */
13466 int
13467 hat_supported(enum hat_features feature, void *arg)
13468 {
13469         switch (feature) {
13470         case    HAT_SHARED_PT:
13471         case    HAT_DYNAMIC_ISM_UNMAP:
13472         case    HAT_VMODSORT:
13473                 return (1);
13474         case    HAT_SHARED_REGIONS:
13475                 if (shctx_on)
13476                         return (1);
13477                 else
13478                         return (0);
13479         default:
13480                 return (0);
13481         }
13482 }
13483 
13484 void
13485 hat_enter(struct hat *hat)
13486 {
13487         hatlock_t       *hatlockp;
13488 
13489         if (hat != ksfmmup) {
13490                 hatlockp = TSB_HASH(hat);
13491                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13492         }
13493 }
13494 
13495 void
13496 hat_exit(struct hat *hat)
13497 {
13498         hatlock_t       *hatlockp;
13499 
13500         if (hat != ksfmmup) {
13501                 hatlockp = TSB_HASH(hat);
13502                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13503         }
13504 }
13505 
13506 /*ARGSUSED*/
13507 void
13508 hat_reserve(struct as *as, caddr_t addr, size_t len)
13509 {
13510 }
13511 
13512 static void
13513 hat_kstat_init(void)
13514 {
13515         kstat_t *ksp;
13516 
13517         ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13518             KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13519             KSTAT_FLAG_VIRTUAL);
13520         if (ksp) {
13521                 ksp->ks_data = (void *) &sfmmu_global_stat;
13522                 kstat_install(ksp);
13523         }
13524         ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13525             KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13526             KSTAT_FLAG_VIRTUAL);
13527         if (ksp) {
13528                 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13529                 kstat_install(ksp);
13530         }
13531         ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13532             KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13533             KSTAT_FLAG_WRITABLE);
13534         if (ksp) {
13535                 ksp->ks_update = sfmmu_kstat_percpu_update;
13536                 kstat_install(ksp);
13537         }
13538 }
13539 
13540 /* ARGSUSED */
13541 static int
13542 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13543 {
13544         struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13545         struct tsbmiss *tsbm = tsbmiss_area;
13546         struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13547         int i;
13548 
13549         ASSERT(cpu_kstat);
13550         if (rw == KSTAT_READ) {
13551                 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13552                         cpu_kstat->sf_itlb_misses = 0;
13553                         cpu_kstat->sf_dtlb_misses = 0;
13554                         cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13555                             tsbm->uprot_traps;
13556                         cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13557                             kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13558                         cpu_kstat->sf_tsb_hits = 0;
13559                         cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13560                         cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13561                 }
13562         } else {
13563                 /* KSTAT_WRITE is used to clear stats */
13564                 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13565                         tsbm->utsb_misses = 0;
13566                         tsbm->ktsb_misses = 0;
13567                         tsbm->uprot_traps = 0;
13568                         tsbm->kprot_traps = 0;
13569                         kpmtsbm->kpm_dtlb_misses = 0;
13570                         kpmtsbm->kpm_tsb_misses = 0;
13571                 }
13572         }
13573         return (0);
13574 }
13575 
13576 #ifdef  DEBUG
13577 
13578 tte_t  *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13579 
13580 /*
13581  * A tte checker. *orig_old is the value we read before cas.
13582  *      *cur is the value returned by cas.
13583  *      *new is the desired value when we do the cas.
13584  *
13585  *      *hmeblkp is currently unused.
13586  */
13587 
13588 /* ARGSUSED */
13589 void
13590 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13591 {
13592         pfn_t i, j, k;
13593         int cpuid = CPU->cpu_id;
13594 
13595         gorig[cpuid] = orig_old;
13596         gcur[cpuid] = cur;
13597         gnew[cpuid] = new;
13598 
13599 #ifdef lint
13600         hmeblkp = hmeblkp;
13601 #endif
13602 
13603         if (TTE_IS_VALID(orig_old)) {
13604                 if (TTE_IS_VALID(cur)) {
13605                         i = TTE_TO_TTEPFN(orig_old);
13606                         j = TTE_TO_TTEPFN(cur);
13607                         k = TTE_TO_TTEPFN(new);
13608                         if (i != j) {
13609                                 /* remap error? */
13610                                 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13611                         }
13612 
13613                         if (i != k) {
13614                                 /* remap error? */
13615                                 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13616                         }
13617                 } else {
13618                         if (TTE_IS_VALID(new)) {
13619                                 panic("chk_tte: invalid cur? ");
13620                         }
13621 
13622                         i = TTE_TO_TTEPFN(orig_old);
13623                         k = TTE_TO_TTEPFN(new);
13624                         if (i != k) {
13625                                 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13626                         }
13627                 }
13628         } else {
13629                 if (TTE_IS_VALID(cur)) {
13630                         j = TTE_TO_TTEPFN(cur);
13631                         if (TTE_IS_VALID(new)) {
13632                                 k = TTE_TO_TTEPFN(new);
13633                                 if (j != k) {
13634                                         panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13635                                             j, k);
13636                                 }
13637                         } else {
13638                                 panic("chk_tte: why here?");
13639                         }
13640                 } else {
13641                         if (!TTE_IS_VALID(new)) {
13642                                 panic("chk_tte: why here2 ?");
13643                         }
13644                 }
13645         }
13646 }
13647 
13648 #endif /* DEBUG */
13649 
13650 extern void prefetch_tsbe_read(struct tsbe *);
13651 extern void prefetch_tsbe_write(struct tsbe *);
13652 
13653 
13654 /*
13655  * We want to prefetch 7 cache lines ahead for our read prefetch.  This gives
13656  * us optimal performance on Cheetah+.  You can only have 8 outstanding
13657  * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13658  * prefetch to make the most utilization of the prefetch capability.
13659  */
13660 #define TSBE_PREFETCH_STRIDE (7)
13661 
13662 void
13663 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13664 {
13665         int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13666         int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13667         int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13668         int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13669         struct tsbe *old;
13670         struct tsbe *new;
13671         struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13672         uint64_t va;
13673         int new_offset;
13674         int i;
13675         int vpshift;
13676         int last_prefetch;
13677 
13678         if (old_bytes == new_bytes) {
13679                 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13680         } else {
13681 
13682                 /*
13683                  * A TSBE is 16 bytes which means there are four TSBE's per
13684                  * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13685                  */
13686                 old = (struct tsbe *)old_tsbinfo->tsb_va;
13687                 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13688                 for (i = 0; i < old_entries; i++, old++) {
13689                         if (((i & (4-1)) == 0) && (i < last_prefetch))
13690                                 prefetch_tsbe_read(old);
13691                         if (!old->tte_tag.tag_invalid) {
13692                                 /*
13693                                  * We have a valid TTE to remap.  Check the
13694                                  * size.  We won't remap 64K or 512K TTEs
13695                                  * because they span more than one TSB entry
13696                                  * and are indexed using an 8K virt. page.
13697                                  * Ditto for 32M and 256M TTEs.
13698                                  */
13699                                 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13700                                     TTE_CSZ(&old->tte_data) == TTE512K)
13701                                         continue;
13702                                 if (mmu_page_sizes == max_mmu_page_sizes) {
13703                                         if (TTE_CSZ(&old->tte_data) == TTE32M ||
13704                                             TTE_CSZ(&old->tte_data) == TTE256M)
13705                                                 continue;
13706                                 }
13707 
13708                                 /* clear the lower 22 bits of the va */
13709                                 va = *(uint64_t *)old << 22;
13710                                 /* turn va into a virtual pfn */
13711                                 va >>= 22 - TSB_START_SIZE;
13712                                 /*
13713                                  * or in bits from the offset in the tsb
13714                                  * to get the real virtual pfn. These
13715                                  * correspond to bits [21:13] in the va
13716                                  */
13717                                 vpshift =
13718                                     TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13719                                     0x1ff;
13720                                 va |= (i << vpshift);
13721                                 va >>= vpshift;
13722                                 new_offset = va & (new_entries - 1);
13723                                 new = new_base + new_offset;
13724                                 prefetch_tsbe_write(new);
13725                                 *new = *old;
13726                         }
13727                 }
13728         }
13729 }
13730 
13731 /*
13732  * unused in sfmmu
13733  */
13734 void
13735 hat_dump(void)
13736 {
13737 }
13738 
13739 /*
13740  * Called when a thread is exiting and we have switched to the kernel address
13741  * space.  Perform the same VM initialization resume() uses when switching
13742  * processes.
13743  *
13744  * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13745  * we call it anyway in case the semantics change in the future.
13746  */
13747 /*ARGSUSED*/
13748 void
13749 hat_thread_exit(kthread_t *thd)
13750 {
13751         uint_t pgsz_cnum;
13752         uint_t pstate_save;
13753 
13754         ASSERT(thd->t_procp->p_as == &kas);
13755 
13756         pgsz_cnum = KCONTEXT;
13757 #ifdef sun4u
13758         pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13759 #endif
13760 
13761         /*
13762          * Note that sfmmu_load_mmustate() is currently a no-op for
13763          * kernel threads. We need to disable interrupts here,
13764          * simply because otherwise sfmmu_load_mmustate() would panic
13765          * if the caller does not disable interrupts.
13766          */
13767         pstate_save = sfmmu_disable_intrs();
13768 
13769         /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13770         sfmmu_setctx_sec(pgsz_cnum);
13771         sfmmu_load_mmustate(ksfmmup);
13772         sfmmu_enable_intrs(pstate_save);
13773 }
13774 
13775 
13776 /*
13777  * SRD support
13778  */
13779 #define SRD_HASH_FUNCTION(vp)   (((((uintptr_t)(vp)) >> 4) ^ \
13780                                     (((uintptr_t)(vp)) >> 11)) & \
13781                                     srd_hashmask)
13782 
13783 /*
13784  * Attach the process to the srd struct associated with the exec vnode
13785  * from which the process is started.
13786  */
13787 void
13788 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13789 {
13790         uint_t hash = SRD_HASH_FUNCTION(evp);
13791         sf_srd_t *srdp;
13792         sf_srd_t *newsrdp;
13793 
13794         ASSERT(sfmmup != ksfmmup);
13795         ASSERT(sfmmup->sfmmu_srdp == NULL);
13796 
13797         if (!shctx_on) {
13798                 return;
13799         }
13800 
13801         VN_HOLD(evp);
13802 
13803         if (srd_buckets[hash].srdb_srdp != NULL) {
13804                 mutex_enter(&srd_buckets[hash].srdb_lock);
13805                 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13806                     srdp = srdp->srd_hash) {
13807                         if (srdp->srd_evp == evp) {
13808                                 ASSERT(srdp->srd_refcnt >= 0);
13809                                 sfmmup->sfmmu_srdp = srdp;
13810                                 atomic_inc_32(
13811                                     (volatile uint_t *)&srdp->srd_refcnt);
13812                                 mutex_exit(&srd_buckets[hash].srdb_lock);
13813                                 return;
13814                         }
13815                 }
13816                 mutex_exit(&srd_buckets[hash].srdb_lock);
13817         }
13818         newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13819         ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13820 
13821         newsrdp->srd_evp = evp;
13822         newsrdp->srd_refcnt = 1;
13823         newsrdp->srd_hmergnfree = NULL;
13824         newsrdp->srd_ismrgnfree = NULL;
13825 
13826         mutex_enter(&srd_buckets[hash].srdb_lock);
13827         for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13828             srdp = srdp->srd_hash) {
13829                 if (srdp->srd_evp == evp) {
13830                         ASSERT(srdp->srd_refcnt >= 0);
13831                         sfmmup->sfmmu_srdp = srdp;
13832                         atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13833                         mutex_exit(&srd_buckets[hash].srdb_lock);
13834                         kmem_cache_free(srd_cache, newsrdp);
13835                         return;
13836                 }
13837         }
13838         newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13839         srd_buckets[hash].srdb_srdp = newsrdp;
13840         sfmmup->sfmmu_srdp = newsrdp;
13841 
13842         mutex_exit(&srd_buckets[hash].srdb_lock);
13843 
13844 }
13845 
13846 static void
13847 sfmmu_leave_srd(sfmmu_t *sfmmup)
13848 {
13849         vnode_t *evp;
13850         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13851         uint_t hash;
13852         sf_srd_t **prev_srdpp;
13853         sf_region_t *rgnp;
13854         sf_region_t *nrgnp;
13855 #ifdef DEBUG
13856         int rgns = 0;
13857 #endif
13858         int i;
13859 
13860         ASSERT(sfmmup != ksfmmup);
13861         ASSERT(srdp != NULL);
13862         ASSERT(srdp->srd_refcnt > 0);
13863         ASSERT(sfmmup->sfmmu_scdp == NULL);
13864         ASSERT(sfmmup->sfmmu_free == 1);
13865 
13866         sfmmup->sfmmu_srdp = NULL;
13867         evp = srdp->srd_evp;
13868         ASSERT(evp != NULL);
13869         if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13870                 VN_RELE(evp);
13871                 return;
13872         }
13873 
13874         hash = SRD_HASH_FUNCTION(evp);
13875         mutex_enter(&srd_buckets[hash].srdb_lock);
13876         for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13877             (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13878                 if (srdp->srd_evp == evp) {
13879                         break;
13880                 }
13881         }
13882         if (srdp == NULL || srdp->srd_refcnt) {
13883                 mutex_exit(&srd_buckets[hash].srdb_lock);
13884                 VN_RELE(evp);
13885                 return;
13886         }
13887         *prev_srdpp = srdp->srd_hash;
13888         mutex_exit(&srd_buckets[hash].srdb_lock);
13889 
13890         ASSERT(srdp->srd_refcnt == 0);
13891         VN_RELE(evp);
13892 
13893 #ifdef DEBUG
13894         for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13895                 ASSERT(srdp->srd_rgnhash[i] == NULL);
13896         }
13897 #endif /* DEBUG */
13898 
13899         /* free each hme regions in the srd */
13900         for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13901                 nrgnp = rgnp->rgn_next;
13902                 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13903                 ASSERT(rgnp->rgn_refcnt == 0);
13904                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13905                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13906                 ASSERT(rgnp->rgn_hmeflags == 0);
13907                 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13908 #ifdef DEBUG
13909                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13910                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13911                 }
13912                 rgns++;
13913 #endif /* DEBUG */
13914                 kmem_cache_free(region_cache, rgnp);
13915         }
13916         ASSERT(rgns == srdp->srd_next_hmerid);
13917 
13918 #ifdef DEBUG
13919         rgns = 0;
13920 #endif
13921         /* free each ism rgns in the srd */
13922         for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13923                 nrgnp = rgnp->rgn_next;
13924                 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13925                 ASSERT(rgnp->rgn_refcnt == 0);
13926                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13927                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13928                 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13929 #ifdef DEBUG
13930                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13931                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13932                 }
13933                 rgns++;
13934 #endif /* DEBUG */
13935                 kmem_cache_free(region_cache, rgnp);
13936         }
13937         ASSERT(rgns == srdp->srd_next_ismrid);
13938         ASSERT(srdp->srd_ismbusyrgns == 0);
13939         ASSERT(srdp->srd_hmebusyrgns == 0);
13940 
13941         srdp->srd_next_ismrid = 0;
13942         srdp->srd_next_hmerid = 0;
13943 
13944         bzero((void *)srdp->srd_ismrgnp,
13945             sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13946         bzero((void *)srdp->srd_hmergnp,
13947             sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13948 
13949         ASSERT(srdp->srd_scdp == NULL);
13950         kmem_cache_free(srd_cache, srdp);
13951 }
13952 
13953 /* ARGSUSED */
13954 static int
13955 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13956 {
13957         sf_srd_t *srdp = (sf_srd_t *)buf;
13958         bzero(buf, sizeof (*srdp));
13959 
13960         mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13961         mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13962         return (0);
13963 }
13964 
13965 /* ARGSUSED */
13966 static void
13967 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13968 {
13969         sf_srd_t *srdp = (sf_srd_t *)buf;
13970 
13971         mutex_destroy(&srdp->srd_mutex);
13972         mutex_destroy(&srdp->srd_scd_mutex);
13973 }
13974 
13975 /*
13976  * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13977  * at the same time for the same process and address range. This is ensured by
13978  * the fact that address space is locked as writer when a process joins the
13979  * regions. Therefore there's no need to hold an srd lock during the entire
13980  * execution of hat_join_region()/hat_leave_region().
13981  */
13982 
13983 #define RGN_HASH_FUNCTION(obj)  (((((uintptr_t)(obj)) >> 4) ^ \
13984                                     (((uintptr_t)(obj)) >> 11)) & \
13985                                         srd_rgn_hashmask)
13986 /*
13987  * This routine implements the shared context functionality required when
13988  * attaching a segment to an address space. It must be called from
13989  * hat_share() for D(ISM) segments and from segvn_create() for segments
13990  * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13991  * which is saved in the private segment data for hme segments and
13992  * the ism_map structure for ism segments.
13993  */
13994 hat_region_cookie_t
13995 hat_join_region(struct hat *sfmmup,
13996         caddr_t r_saddr,
13997         size_t r_size,
13998         void *r_obj,
13999         u_offset_t r_objoff,
14000         uchar_t r_perm,
14001         uchar_t r_pgszc,
14002         hat_rgn_cb_func_t r_cb_function,
14003         uint_t flags)
14004 {
14005         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14006         uint_t rhash;
14007         uint_t rid;
14008         hatlock_t *hatlockp;
14009         sf_region_t *rgnp;
14010         sf_region_t *new_rgnp = NULL;
14011         int i;
14012         uint16_t *nextidp;
14013         sf_region_t **freelistp;
14014         int maxids;
14015         sf_region_t **rarrp;
14016         uint16_t *busyrgnsp;
14017         ulong_t rttecnt;
14018         uchar_t tteflag;
14019         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14020         int text = (r_type == HAT_REGION_TEXT);
14021 
14022         if (srdp == NULL || r_size == 0) {
14023                 return (HAT_INVALID_REGION_COOKIE);
14024         }
14025 
14026         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
14027         ASSERT(sfmmup != ksfmmup);
14028         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14029         ASSERT(srdp->srd_refcnt > 0);
14030         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14031         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14032         ASSERT(r_pgszc < mmu_page_sizes);
14033         if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
14034             !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
14035                 panic("hat_join_region: region addr or size is not aligned\n");
14036         }
14037 
14038 
14039         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14040             SFMMU_REGION_HME;
14041         /*
14042          * Currently only support shared hmes for the read only main text
14043          * region.
14044          */
14045         if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
14046             (r_perm & PROT_WRITE))) {
14047                 return (HAT_INVALID_REGION_COOKIE);
14048         }
14049 
14050         rhash = RGN_HASH_FUNCTION(r_obj);
14051 
14052         if (r_type == SFMMU_REGION_ISM) {
14053                 nextidp = &srdp->srd_next_ismrid;
14054                 freelistp = &srdp->srd_ismrgnfree;
14055                 maxids = SFMMU_MAX_ISM_REGIONS;
14056                 rarrp = srdp->srd_ismrgnp;
14057                 busyrgnsp = &srdp->srd_ismbusyrgns;
14058         } else {
14059                 nextidp = &srdp->srd_next_hmerid;
14060                 freelistp = &srdp->srd_hmergnfree;
14061                 maxids = SFMMU_MAX_HME_REGIONS;
14062                 rarrp = srdp->srd_hmergnp;
14063                 busyrgnsp = &srdp->srd_hmebusyrgns;
14064         }
14065 
14066         mutex_enter(&srdp->srd_mutex);
14067 
14068         for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14069             rgnp = rgnp->rgn_hash) {
14070                 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
14071                     rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
14072                     rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
14073                         break;
14074                 }
14075         }
14076 
14077 rfound:
14078         if (rgnp != NULL) {
14079                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14080                 ASSERT(rgnp->rgn_cb_function == r_cb_function);
14081                 ASSERT(rgnp->rgn_refcnt >= 0);
14082                 rid = rgnp->rgn_id;
14083                 ASSERT(rid < maxids);
14084                 ASSERT(rarrp[rid] == rgnp);
14085                 ASSERT(rid < *nextidp);
14086                 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14087                 mutex_exit(&srdp->srd_mutex);
14088                 if (new_rgnp != NULL) {
14089                         kmem_cache_free(region_cache, new_rgnp);
14090                 }
14091                 if (r_type == SFMMU_REGION_HME) {
14092                         int myjoin =
14093                             (sfmmup == astosfmmu(curthread->t_procp->p_as));
14094 
14095                         sfmmu_link_to_hmeregion(sfmmup, rgnp);
14096                         /*
14097                          * bitmap should be updated after linking sfmmu on
14098                          * region list so that pageunload() doesn't skip
14099                          * TSB/TLB flush. As soon as bitmap is updated another
14100                          * thread in this process can already start accessing
14101                          * this region.
14102                          */
14103                         /*
14104                          * Normally ttecnt accounting is done as part of
14105                          * pagefault handling. But a process may not take any
14106                          * pagefaults on shared hmeblks created by some other
14107                          * process. To compensate for this assume that the
14108                          * entire region will end up faulted in using
14109                          * the region's pagesize.
14110                          *
14111                          */
14112                         if (r_pgszc > TTE8K) {
14113                                 tteflag = 1 << r_pgszc;
14114                                 if (disable_large_pages & tteflag) {
14115                                         tteflag = 0;
14116                                 }
14117                         } else {
14118                                 tteflag = 0;
14119                         }
14120                         if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
14121                                 hatlockp = sfmmu_hat_enter(sfmmup);
14122                                 sfmmup->sfmmu_rtteflags |= tteflag;
14123                                 sfmmu_hat_exit(hatlockp);
14124                         }
14125                         hatlockp = sfmmu_hat_enter(sfmmup);
14126 
14127                         /*
14128                          * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
14129                          * region to allow for large page allocation failure.
14130                          */
14131                         if (r_pgszc >= TTE4M) {
14132                                 sfmmup->sfmmu_tsb0_4minflcnt +=
14133                                     r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14134                         }
14135 
14136                         /* update sfmmu_ttecnt with the shme rgn ttecnt */
14137                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14138                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14139                             rttecnt);
14140 
14141                         if (text && r_pgszc >= TTE4M &&
14142                             (tteflag || ((disable_large_pages >> TTE4M) &
14143                             ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
14144                             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
14145                                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
14146                         }
14147 
14148                         sfmmu_hat_exit(hatlockp);
14149                         /*
14150                          * On Panther we need to make sure TLB is programmed
14151                          * to accept 32M/256M pages.  Call
14152                          * sfmmu_check_page_sizes() now to make sure TLB is
14153                          * setup before making hmeregions visible to other
14154                          * threads.
14155                          */
14156                         sfmmu_check_page_sizes(sfmmup, 1);
14157                         hatlockp = sfmmu_hat_enter(sfmmup);
14158                         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14159 
14160                         /*
14161                          * if context is invalid tsb miss exception code will
14162                          * call sfmmu_check_page_sizes() and update tsbmiss
14163                          * area later.
14164                          */
14165                         kpreempt_disable();
14166                         if (myjoin &&
14167                             (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
14168                             != INVALID_CONTEXT)) {
14169                                 struct tsbmiss *tsbmp;
14170 
14171                                 tsbmp = &tsbmiss_area[CPU->cpu_id];
14172                                 ASSERT(sfmmup == tsbmp->usfmmup);
14173                                 BT_SET(tsbmp->shmermap, rid);
14174                                 if (r_pgszc > TTE64K) {
14175                                         tsbmp->uhat_rtteflags |= tteflag;
14176                                 }
14177 
14178                         }
14179                         kpreempt_enable();
14180 
14181                         sfmmu_hat_exit(hatlockp);
14182                         ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
14183                             HAT_INVALID_REGION_COOKIE);
14184                 } else {
14185                         hatlockp = sfmmu_hat_enter(sfmmup);
14186                         SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
14187                         sfmmu_hat_exit(hatlockp);
14188                 }
14189                 ASSERT(rid < maxids);
14190 
14191                 if (r_type == SFMMU_REGION_ISM) {
14192                         sfmmu_find_scd(sfmmup);
14193                 }
14194                 return ((hat_region_cookie_t)((uint64_t)rid));
14195         }
14196 
14197         ASSERT(new_rgnp == NULL);
14198 
14199         if (*busyrgnsp >= maxids) {
14200                 mutex_exit(&srdp->srd_mutex);
14201                 return (HAT_INVALID_REGION_COOKIE);
14202         }
14203 
14204         ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14205         if (*freelistp != NULL) {
14206                 rgnp = *freelistp;
14207                 *freelistp = rgnp->rgn_next;
14208                 ASSERT(rgnp->rgn_id < *nextidp);
14209                 ASSERT(rgnp->rgn_id < maxids);
14210                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14211                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14212                     == r_type);
14213                 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14214                 ASSERT(rgnp->rgn_hmeflags == 0);
14215         } else {
14216                 /*
14217                  * release local locks before memory allocation.
14218                  */
14219                 mutex_exit(&srdp->srd_mutex);
14220 
14221                 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14222 
14223                 mutex_enter(&srdp->srd_mutex);
14224                 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14225                     rgnp = rgnp->rgn_hash) {
14226                         if (rgnp->rgn_saddr == r_saddr &&
14227                             rgnp->rgn_size == r_size &&
14228                             rgnp->rgn_obj == r_obj &&
14229                             rgnp->rgn_objoff == r_objoff &&
14230                             rgnp->rgn_perm == r_perm &&
14231                             rgnp->rgn_pgszc == r_pgszc) {
14232                                 break;
14233                         }
14234                 }
14235                 if (rgnp != NULL) {
14236                         goto rfound;
14237                 }
14238 
14239                 if (*nextidp >= maxids) {
14240                         mutex_exit(&srdp->srd_mutex);
14241                         goto fail;
14242                 }
14243                 rgnp = new_rgnp;
14244                 new_rgnp = NULL;
14245                 rgnp->rgn_id = (*nextidp)++;
14246                 ASSERT(rgnp->rgn_id < maxids);
14247                 ASSERT(rarrp[rgnp->rgn_id] == NULL);
14248                 rarrp[rgnp->rgn_id] = rgnp;
14249         }
14250 
14251         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14252         ASSERT(rgnp->rgn_hmeflags == 0);
14253 #ifdef DEBUG
14254         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14255                 ASSERT(rgnp->rgn_ttecnt[i] == 0);
14256         }
14257 #endif
14258         rgnp->rgn_saddr = r_saddr;
14259         rgnp->rgn_size = r_size;
14260         rgnp->rgn_obj = r_obj;
14261         rgnp->rgn_objoff = r_objoff;
14262         rgnp->rgn_perm = r_perm;
14263         rgnp->rgn_pgszc = r_pgszc;
14264         rgnp->rgn_flags = r_type;
14265         rgnp->rgn_refcnt = 0;
14266         rgnp->rgn_cb_function = r_cb_function;
14267         rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14268         srdp->srd_rgnhash[rhash] = rgnp;
14269         (*busyrgnsp)++;
14270         ASSERT(*busyrgnsp <= maxids);
14271         goto rfound;
14272 
14273 fail:
14274         ASSERT(new_rgnp != NULL);
14275         kmem_cache_free(region_cache, new_rgnp);
14276         return (HAT_INVALID_REGION_COOKIE);
14277 }
14278 
14279 /*
14280  * This function implements the shared context functionality required
14281  * when detaching a segment from an address space. It must be called
14282  * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14283  * for segments with a valid region_cookie.
14284  * It will also be called from all seg_vn routines which change a
14285  * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14286  * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14287  * from segvn_fault().
14288  */
14289 void
14290 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14291 {
14292         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14293         sf_scd_t *scdp;
14294         uint_t rhash;
14295         uint_t rid = (uint_t)((uint64_t)rcookie);
14296         hatlock_t *hatlockp = NULL;
14297         sf_region_t *rgnp;
14298         sf_region_t **prev_rgnpp;
14299         sf_region_t *cur_rgnp;
14300         void *r_obj;
14301         int i;
14302         caddr_t r_saddr;
14303         caddr_t r_eaddr;
14304         size_t  r_size;
14305         uchar_t r_pgszc;
14306         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14307 
14308         ASSERT(sfmmup != ksfmmup);
14309         ASSERT(srdp != NULL);
14310         ASSERT(srdp->srd_refcnt > 0);
14311         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14312         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14313         ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14314 
14315         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14316             SFMMU_REGION_HME;
14317 
14318         if (r_type == SFMMU_REGION_ISM) {
14319                 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14320                 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14321                 rgnp = srdp->srd_ismrgnp[rid];
14322         } else {
14323                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14324                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14325                 rgnp = srdp->srd_hmergnp[rid];
14326         }
14327         ASSERT(rgnp != NULL);
14328         ASSERT(rgnp->rgn_id == rid);
14329         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14330         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14331         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14332 
14333         ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
14334         if (r_type == SFMMU_REGION_HME && sfmmup->sfmmu_as->a_xhat != NULL) {
14335                 xhat_unload_callback_all(sfmmup->sfmmu_as, rgnp->rgn_saddr,
14336                     rgnp->rgn_size, 0, NULL);
14337         }
14338 
14339         if (sfmmup->sfmmu_free) {
14340                 ulong_t rttecnt;
14341                 r_pgszc = rgnp->rgn_pgszc;
14342                 r_size = rgnp->rgn_size;
14343 
14344                 ASSERT(sfmmup->sfmmu_scdp == NULL);
14345                 if (r_type == SFMMU_REGION_ISM) {
14346                         SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14347                 } else {
14348                         /* update shme rgns ttecnt in sfmmu_ttecnt */
14349                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14350                         ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14351 
14352                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14353                             -rttecnt);
14354 
14355                         SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14356                 }
14357         } else if (r_type == SFMMU_REGION_ISM) {
14358                 hatlockp = sfmmu_hat_enter(sfmmup);
14359                 ASSERT(rid < srdp->srd_next_ismrid);
14360                 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14361                 scdp = sfmmup->sfmmu_scdp;
14362                 if (scdp != NULL &&
14363                     SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14364                         sfmmu_leave_scd(sfmmup, r_type);
14365                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14366                 }
14367                 sfmmu_hat_exit(hatlockp);
14368         } else {
14369                 ulong_t rttecnt;
14370                 r_pgszc = rgnp->rgn_pgszc;
14371                 r_saddr = rgnp->rgn_saddr;
14372                 r_size = rgnp->rgn_size;
14373                 r_eaddr = r_saddr + r_size;
14374 
14375                 ASSERT(r_type == SFMMU_REGION_HME);
14376                 hatlockp = sfmmu_hat_enter(sfmmup);
14377                 ASSERT(rid < srdp->srd_next_hmerid);
14378                 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14379 
14380                 /*
14381                  * If region is part of an SCD call sfmmu_leave_scd().
14382                  * Otherwise if process is not exiting and has valid context
14383                  * just drop the context on the floor to lose stale TLB
14384                  * entries and force the update of tsb miss area to reflect
14385                  * the new region map. After that clean our TSB entries.
14386                  */
14387                 scdp = sfmmup->sfmmu_scdp;
14388                 if (scdp != NULL &&
14389                     SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14390                         sfmmu_leave_scd(sfmmup, r_type);
14391                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14392                 }
14393                 sfmmu_invalidate_ctx(sfmmup);
14394 
14395                 i = TTE8K;
14396                 while (i < mmu_page_sizes) {
14397                         if (rgnp->rgn_ttecnt[i] != 0) {
14398                                 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14399                                     r_eaddr, i);
14400                                 if (i < TTE4M) {
14401                                         i = TTE4M;
14402                                         continue;
14403                                 } else {
14404                                         break;
14405                                 }
14406                         }
14407                         i++;
14408                 }
14409                 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14410                 if (r_pgszc >= TTE4M) {
14411                         rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14412                         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14413                             rttecnt);
14414                         sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14415                 }
14416 
14417                 /* update shme rgns ttecnt in sfmmu_ttecnt */
14418                 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14419                 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14420                 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14421 
14422                 sfmmu_hat_exit(hatlockp);
14423                 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14424                         /* sfmmup left the scd, grow private tsb */
14425                         sfmmu_check_page_sizes(sfmmup, 1);
14426                 } else {
14427                         sfmmu_check_page_sizes(sfmmup, 0);
14428                 }
14429         }
14430 
14431         if (r_type == SFMMU_REGION_HME) {
14432                 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14433         }
14434 
14435         r_obj = rgnp->rgn_obj;
14436         if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14437                 return;
14438         }
14439 
14440         /*
14441          * looks like nobody uses this region anymore. Free it.
14442          */
14443         rhash = RGN_HASH_FUNCTION(r_obj);
14444         mutex_enter(&srdp->srd_mutex);
14445         for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14446             (cur_rgnp = *prev_rgnpp) != NULL;
14447             prev_rgnpp = &cur_rgnp->rgn_hash) {
14448                 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14449                         break;
14450                 }
14451         }
14452 
14453         if (cur_rgnp == NULL) {
14454                 mutex_exit(&srdp->srd_mutex);
14455                 return;
14456         }
14457 
14458         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14459         *prev_rgnpp = rgnp->rgn_hash;
14460         if (r_type == SFMMU_REGION_ISM) {
14461                 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14462                 ASSERT(rid < srdp->srd_next_ismrid);
14463                 rgnp->rgn_next = srdp->srd_ismrgnfree;
14464                 srdp->srd_ismrgnfree = rgnp;
14465                 ASSERT(srdp->srd_ismbusyrgns > 0);
14466                 srdp->srd_ismbusyrgns--;
14467                 mutex_exit(&srdp->srd_mutex);
14468                 return;
14469         }
14470         mutex_exit(&srdp->srd_mutex);
14471 
14472         /*
14473          * Destroy region's hmeblks.
14474          */
14475         sfmmu_unload_hmeregion(srdp, rgnp);
14476 
14477         rgnp->rgn_hmeflags = 0;
14478 
14479         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14480         ASSERT(rgnp->rgn_id == rid);
14481         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14482                 rgnp->rgn_ttecnt[i] = 0;
14483         }
14484         rgnp->rgn_flags |= SFMMU_REGION_FREE;
14485         mutex_enter(&srdp->srd_mutex);
14486         ASSERT(rid < srdp->srd_next_hmerid);
14487         rgnp->rgn_next = srdp->srd_hmergnfree;
14488         srdp->srd_hmergnfree = rgnp;
14489         ASSERT(srdp->srd_hmebusyrgns > 0);
14490         srdp->srd_hmebusyrgns--;
14491         mutex_exit(&srdp->srd_mutex);
14492 }
14493 
14494 /*
14495  * For now only called for hmeblk regions and not for ISM regions.
14496  */
14497 void
14498 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14499 {
14500         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14501         uint_t rid = (uint_t)((uint64_t)rcookie);
14502         sf_region_t *rgnp;
14503         sf_rgn_link_t *rlink;
14504         sf_rgn_link_t *hrlink;
14505         ulong_t rttecnt;
14506 
14507         ASSERT(sfmmup != ksfmmup);
14508         ASSERT(srdp != NULL);
14509         ASSERT(srdp->srd_refcnt > 0);
14510 
14511         ASSERT(rid < srdp->srd_next_hmerid);
14512         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14513         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14514 
14515         rgnp = srdp->srd_hmergnp[rid];
14516         ASSERT(rgnp->rgn_refcnt > 0);
14517         ASSERT(rgnp->rgn_id == rid);
14518         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14519         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14520 
14521         atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14522 
14523         /* LINTED: constant in conditional context */
14524         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14525         ASSERT(rlink != NULL);
14526         mutex_enter(&rgnp->rgn_mutex);
14527         ASSERT(rgnp->rgn_sfmmu_head != NULL);
14528         /* LINTED: constant in conditional context */
14529         SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14530         ASSERT(hrlink != NULL);
14531         ASSERT(hrlink->prev == NULL);
14532         rlink->next = rgnp->rgn_sfmmu_head;
14533         rlink->prev = NULL;
14534         hrlink->prev = sfmmup;
14535         /*
14536          * make sure rlink's next field is correct
14537          * before making this link visible.
14538          */
14539         membar_stst();
14540         rgnp->rgn_sfmmu_head = sfmmup;
14541         mutex_exit(&rgnp->rgn_mutex);
14542 
14543         /* update sfmmu_ttecnt with the shme rgn ttecnt */
14544         rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14545         atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14546         /* update tsb0 inflation count */
14547         if (rgnp->rgn_pgszc >= TTE4M) {
14548                 sfmmup->sfmmu_tsb0_4minflcnt +=
14549                     rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14550         }
14551         /*
14552          * Update regionid bitmask without hat lock since no other thread
14553          * can update this region bitmask right now.
14554          */
14555         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14556 }
14557 
14558 /* ARGSUSED */
14559 static int
14560 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14561 {
14562         sf_region_t *rgnp = (sf_region_t *)buf;
14563         bzero(buf, sizeof (*rgnp));
14564 
14565         mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14566 
14567         return (0);
14568 }
14569 
14570 /* ARGSUSED */
14571 static void
14572 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14573 {
14574         sf_region_t *rgnp = (sf_region_t *)buf;
14575         mutex_destroy(&rgnp->rgn_mutex);
14576 }
14577 
14578 static int
14579 sfrgnmap_isnull(sf_region_map_t *map)
14580 {
14581         int i;
14582 
14583         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14584                 if (map->bitmap[i] != 0) {
14585                         return (0);
14586                 }
14587         }
14588         return (1);
14589 }
14590 
14591 static int
14592 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14593 {
14594         int i;
14595 
14596         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14597                 if (map->bitmap[i] != 0) {
14598                         return (0);
14599                 }
14600         }
14601         return (1);
14602 }
14603 
14604 #ifdef DEBUG
14605 static void
14606 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14607 {
14608         sfmmu_t *sp;
14609         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14610 
14611         for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14612                 ASSERT(srdp == sp->sfmmu_srdp);
14613                 if (sp == sfmmup) {
14614                         if (onlist) {
14615                                 return;
14616                         } else {
14617                                 panic("shctx: sfmmu 0x%p found on scd"
14618                                     "list 0x%p", (void *)sfmmup,
14619                                     (void *)*headp);
14620                         }
14621                 }
14622         }
14623         if (onlist) {
14624                 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14625                     (void *)sfmmup, (void *)*headp);
14626         } else {
14627                 return;
14628         }
14629 }
14630 #else /* DEBUG */
14631 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14632 #endif /* DEBUG */
14633 
14634 /*
14635  * Removes an sfmmu from the SCD sfmmu list.
14636  */
14637 static void
14638 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14639 {
14640         ASSERT(sfmmup->sfmmu_srdp != NULL);
14641         check_scd_sfmmu_list(headp, sfmmup, 1);
14642         if (sfmmup->sfmmu_scd_link.prev != NULL) {
14643                 ASSERT(*headp != sfmmup);
14644                 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14645                     sfmmup->sfmmu_scd_link.next;
14646         } else {
14647                 ASSERT(*headp == sfmmup);
14648                 *headp = sfmmup->sfmmu_scd_link.next;
14649         }
14650         if (sfmmup->sfmmu_scd_link.next != NULL) {
14651                 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14652                     sfmmup->sfmmu_scd_link.prev;
14653         }
14654 }
14655 
14656 
14657 /*
14658  * Adds an sfmmu to the start of the queue.
14659  */
14660 static void
14661 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14662 {
14663         check_scd_sfmmu_list(headp, sfmmup, 0);
14664         sfmmup->sfmmu_scd_link.prev = NULL;
14665         sfmmup->sfmmu_scd_link.next = *headp;
14666         if (*headp != NULL)
14667                 (*headp)->sfmmu_scd_link.prev = sfmmup;
14668         *headp = sfmmup;
14669 }
14670 
14671 /*
14672  * Remove an scd from the start of the queue.
14673  */
14674 static void
14675 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14676 {
14677         if (scdp->scd_prev != NULL) {
14678                 ASSERT(*headp != scdp);
14679                 scdp->scd_prev->scd_next = scdp->scd_next;
14680         } else {
14681                 ASSERT(*headp == scdp);
14682                 *headp = scdp->scd_next;
14683         }
14684 
14685         if (scdp->scd_next != NULL) {
14686                 scdp->scd_next->scd_prev = scdp->scd_prev;
14687         }
14688 }
14689 
14690 /*
14691  * Add an scd to the start of the queue.
14692  */
14693 static void
14694 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14695 {
14696         scdp->scd_prev = NULL;
14697         scdp->scd_next = *headp;
14698         if (*headp != NULL) {
14699                 (*headp)->scd_prev = scdp;
14700         }
14701         *headp = scdp;
14702 }
14703 
14704 static int
14705 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14706 {
14707         uint_t rid;
14708         uint_t i;
14709         uint_t j;
14710         ulong_t w;
14711         sf_region_t *rgnp;
14712         ulong_t tte8k_cnt = 0;
14713         ulong_t tte4m_cnt = 0;
14714         uint_t tsb_szc;
14715         sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14716         sfmmu_t *ism_hatid;
14717         struct tsb_info *newtsb;
14718         int szc;
14719 
14720         ASSERT(srdp != NULL);
14721 
14722         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14723                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14724                         continue;
14725                 }
14726                 j = 0;
14727                 while (w) {
14728                         if (!(w & 0x1)) {
14729                                 j++;
14730                                 w >>= 1;
14731                                 continue;
14732                         }
14733                         rid = (i << BT_ULSHIFT) | j;
14734                         j++;
14735                         w >>= 1;
14736 
14737                         if (rid < SFMMU_MAX_HME_REGIONS) {
14738                                 rgnp = srdp->srd_hmergnp[rid];
14739                                 ASSERT(rgnp->rgn_id == rid);
14740                                 ASSERT(rgnp->rgn_refcnt > 0);
14741 
14742                                 if (rgnp->rgn_pgszc < TTE4M) {
14743                                         tte8k_cnt += rgnp->rgn_size >>
14744                                             TTE_PAGE_SHIFT(TTE8K);
14745                                 } else {
14746                                         ASSERT(rgnp->rgn_pgszc >= TTE4M);
14747                                         tte4m_cnt += rgnp->rgn_size >>
14748                                             TTE_PAGE_SHIFT(TTE4M);
14749                                         /*
14750                                          * Inflate SCD tsb0 by preallocating
14751                                          * 1/4 8k ttecnt for 4M regions to
14752                                          * allow for lgpg alloc failure.
14753                                          */
14754                                         tte8k_cnt += rgnp->rgn_size >>
14755                                             (TTE_PAGE_SHIFT(TTE8K) + 2);
14756                                 }
14757                         } else {
14758                                 rid -= SFMMU_MAX_HME_REGIONS;
14759                                 rgnp = srdp->srd_ismrgnp[rid];
14760                                 ASSERT(rgnp->rgn_id == rid);
14761                                 ASSERT(rgnp->rgn_refcnt > 0);
14762 
14763                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14764                                 ASSERT(ism_hatid->sfmmu_ismhat);
14765 
14766                                 for (szc = 0; szc < TTE4M; szc++) {
14767                                         tte8k_cnt +=
14768                                             ism_hatid->sfmmu_ttecnt[szc] <<
14769                                             TTE_BSZS_SHIFT(szc);
14770                                 }
14771 
14772                                 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14773                                 if (rgnp->rgn_pgszc >= TTE4M) {
14774                                         tte4m_cnt += rgnp->rgn_size >>
14775                                             TTE_PAGE_SHIFT(TTE4M);
14776                                 }
14777                         }
14778                 }
14779         }
14780 
14781         tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14782 
14783         /* Allocate both the SCD TSBs here. */
14784         if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14785             tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14786             (tsb_szc <= TSB_4M_SZCODE ||
14787             sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14788             TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14789             TSB_ALLOC, scsfmmup))) {
14790 
14791                 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14792                 return (TSB_ALLOCFAIL);
14793         } else {
14794                 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14795 
14796                 if (tte4m_cnt) {
14797                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14798                         if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14799                             TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14800                             (tsb_szc <= TSB_4M_SZCODE ||
14801                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14802                             TSB4M|TSB32M|TSB256M,
14803                             TSB_ALLOC, scsfmmup))) {
14804                                 /*
14805                                  * If we fail to allocate the 2nd shared tsb,
14806                                  * just free the 1st tsb, return failure.
14807                                  */
14808                                 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14809                                 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14810                                 return (TSB_ALLOCFAIL);
14811                         } else {
14812                                 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14813                                 newtsb->tsb_flags |= TSB_SHAREDCTX;
14814                                 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14815                                 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14816                         }
14817                 }
14818                 SFMMU_STAT(sf_scd_1sttsb_alloc);
14819         }
14820         return (TSB_SUCCESS);
14821 }
14822 
14823 static void
14824 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14825 {
14826         while (scd_sfmmu->sfmmu_tsb != NULL) {
14827                 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14828                 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14829                 scd_sfmmu->sfmmu_tsb = next;
14830         }
14831 }
14832 
14833 /*
14834  * Link the sfmmu onto the hme region list.
14835  */
14836 void
14837 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14838 {
14839         uint_t rid;
14840         sf_rgn_link_t *rlink;
14841         sfmmu_t *head;
14842         sf_rgn_link_t *hrlink;
14843 
14844         rid = rgnp->rgn_id;
14845         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14846 
14847         /* LINTED: constant in conditional context */
14848         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14849         ASSERT(rlink != NULL);
14850         mutex_enter(&rgnp->rgn_mutex);
14851         if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14852                 rlink->next = NULL;
14853                 rlink->prev = NULL;
14854                 /*
14855                  * make sure rlink's next field is NULL
14856                  * before making this link visible.
14857                  */
14858                 membar_stst();
14859                 rgnp->rgn_sfmmu_head = sfmmup;
14860         } else {
14861                 /* LINTED: constant in conditional context */
14862                 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14863                 ASSERT(hrlink != NULL);
14864                 ASSERT(hrlink->prev == NULL);
14865                 rlink->next = head;
14866                 rlink->prev = NULL;
14867                 hrlink->prev = sfmmup;
14868                 /*
14869                  * make sure rlink's next field is correct
14870                  * before making this link visible.
14871                  */
14872                 membar_stst();
14873                 rgnp->rgn_sfmmu_head = sfmmup;
14874         }
14875         mutex_exit(&rgnp->rgn_mutex);
14876 }
14877 
14878 /*
14879  * Unlink the sfmmu from the hme region list.
14880  */
14881 void
14882 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14883 {
14884         uint_t rid;
14885         sf_rgn_link_t *rlink;
14886 
14887         rid = rgnp->rgn_id;
14888         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14889 
14890         /* LINTED: constant in conditional context */
14891         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14892         ASSERT(rlink != NULL);
14893         mutex_enter(&rgnp->rgn_mutex);
14894         if (rgnp->rgn_sfmmu_head == sfmmup) {
14895                 sfmmu_t *next = rlink->next;
14896                 rgnp->rgn_sfmmu_head = next;
14897                 /*
14898                  * if we are stopped by xc_attention() after this
14899                  * point the forward link walking in
14900                  * sfmmu_rgntlb_demap() will work correctly since the
14901                  * head correctly points to the next element.
14902                  */
14903                 membar_stst();
14904                 rlink->next = NULL;
14905                 ASSERT(rlink->prev == NULL);
14906                 if (next != NULL) {
14907                         sf_rgn_link_t *nrlink;
14908                         /* LINTED: constant in conditional context */
14909                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14910                         ASSERT(nrlink != NULL);
14911                         ASSERT(nrlink->prev == sfmmup);
14912                         nrlink->prev = NULL;
14913                 }
14914         } else {
14915                 sfmmu_t *next = rlink->next;
14916                 sfmmu_t *prev = rlink->prev;
14917                 sf_rgn_link_t *prlink;
14918 
14919                 ASSERT(prev != NULL);
14920                 /* LINTED: constant in conditional context */
14921                 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14922                 ASSERT(prlink != NULL);
14923                 ASSERT(prlink->next == sfmmup);
14924                 prlink->next = next;
14925                 /*
14926                  * if we are stopped by xc_attention()
14927                  * after this point the forward link walking
14928                  * will work correctly since the prev element
14929                  * correctly points to the next element.
14930                  */
14931                 membar_stst();
14932                 rlink->next = NULL;
14933                 rlink->prev = NULL;
14934                 if (next != NULL) {
14935                         sf_rgn_link_t *nrlink;
14936                         /* LINTED: constant in conditional context */
14937                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14938                         ASSERT(nrlink != NULL);
14939                         ASSERT(nrlink->prev == sfmmup);
14940                         nrlink->prev = prev;
14941                 }
14942         }
14943         mutex_exit(&rgnp->rgn_mutex);
14944 }
14945 
14946 /*
14947  * Link scd sfmmu onto ism or hme region list for each region in the
14948  * scd region map.
14949  */
14950 void
14951 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14952 {
14953         uint_t rid;
14954         uint_t i;
14955         uint_t j;
14956         ulong_t w;
14957         sf_region_t *rgnp;
14958         sfmmu_t *scsfmmup;
14959 
14960         scsfmmup = scdp->scd_sfmmup;
14961         ASSERT(scsfmmup->sfmmu_scdhat);
14962         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14963                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14964                         continue;
14965                 }
14966                 j = 0;
14967                 while (w) {
14968                         if (!(w & 0x1)) {
14969                                 j++;
14970                                 w >>= 1;
14971                                 continue;
14972                         }
14973                         rid = (i << BT_ULSHIFT) | j;
14974                         j++;
14975                         w >>= 1;
14976 
14977                         if (rid < SFMMU_MAX_HME_REGIONS) {
14978                                 rgnp = srdp->srd_hmergnp[rid];
14979                                 ASSERT(rgnp->rgn_id == rid);
14980                                 ASSERT(rgnp->rgn_refcnt > 0);
14981                                 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14982                         } else {
14983                                 sfmmu_t *ism_hatid = NULL;
14984                                 ism_ment_t *ism_ment;
14985                                 rid -= SFMMU_MAX_HME_REGIONS;
14986                                 rgnp = srdp->srd_ismrgnp[rid];
14987                                 ASSERT(rgnp->rgn_id == rid);
14988                                 ASSERT(rgnp->rgn_refcnt > 0);
14989 
14990                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14991                                 ASSERT(ism_hatid->sfmmu_ismhat);
14992                                 ism_ment = &scdp->scd_ism_links[rid];
14993                                 ism_ment->iment_hat = scsfmmup;
14994                                 ism_ment->iment_base_va = rgnp->rgn_saddr;
14995                                 mutex_enter(&ism_mlist_lock);
14996                                 iment_add(ism_ment, ism_hatid);
14997                                 mutex_exit(&ism_mlist_lock);
14998 
14999                         }
15000                 }
15001         }
15002 }
15003 /*
15004  * Unlink scd sfmmu from ism or hme region list for each region in the
15005  * scd region map.
15006  */
15007 void
15008 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
15009 {
15010         uint_t rid;
15011         uint_t i;
15012         uint_t j;
15013         ulong_t w;
15014         sf_region_t *rgnp;
15015         sfmmu_t *scsfmmup;
15016 
15017         scsfmmup = scdp->scd_sfmmup;
15018         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
15019                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
15020                         continue;
15021                 }
15022                 j = 0;
15023                 while (w) {
15024                         if (!(w & 0x1)) {
15025                                 j++;
15026                                 w >>= 1;
15027                                 continue;
15028                         }
15029                         rid = (i << BT_ULSHIFT) | j;
15030                         j++;
15031                         w >>= 1;
15032 
15033                         if (rid < SFMMU_MAX_HME_REGIONS) {
15034                                 rgnp = srdp->srd_hmergnp[rid];
15035                                 ASSERT(rgnp->rgn_id == rid);
15036                                 ASSERT(rgnp->rgn_refcnt > 0);
15037                                 sfmmu_unlink_from_hmeregion(scsfmmup,
15038                                     rgnp);
15039 
15040                         } else {
15041                                 sfmmu_t *ism_hatid = NULL;
15042                                 ism_ment_t *ism_ment;
15043                                 rid -= SFMMU_MAX_HME_REGIONS;
15044                                 rgnp = srdp->srd_ismrgnp[rid];
15045                                 ASSERT(rgnp->rgn_id == rid);
15046                                 ASSERT(rgnp->rgn_refcnt > 0);
15047 
15048                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
15049                                 ASSERT(ism_hatid->sfmmu_ismhat);
15050                                 ism_ment = &scdp->scd_ism_links[rid];
15051                                 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
15052                                 ASSERT(ism_ment->iment_base_va ==
15053                                     rgnp->rgn_saddr);
15054                                 mutex_enter(&ism_mlist_lock);
15055                                 iment_sub(ism_ment, ism_hatid);
15056                                 mutex_exit(&ism_mlist_lock);
15057 
15058                         }
15059                 }
15060         }
15061 }
15062 /*
15063  * Allocates and initialises a new SCD structure, this is called with
15064  * the srd_scd_mutex held and returns with the reference count
15065  * initialised to 1.
15066  */
15067 static sf_scd_t *
15068 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
15069 {
15070         sf_scd_t *new_scdp;
15071         sfmmu_t *scsfmmup;
15072         int i;
15073 
15074         ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
15075         new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
15076 
15077         scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
15078         new_scdp->scd_sfmmup = scsfmmup;
15079         scsfmmup->sfmmu_srdp = srdp;
15080         scsfmmup->sfmmu_scdp = new_scdp;
15081         scsfmmup->sfmmu_tsb0_4minflcnt = 0;
15082         scsfmmup->sfmmu_scdhat = 1;
15083         CPUSET_ALL(scsfmmup->sfmmu_cpusran);
15084         bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
15085 
15086         ASSERT(max_mmu_ctxdoms > 0);
15087         for (i = 0; i < max_mmu_ctxdoms; i++) {
15088                 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
15089                 scsfmmup->sfmmu_ctxs[i].gnum = 0;
15090         }
15091 
15092         for (i = 0; i < MMU_PAGE_SIZES; i++) {
15093                 new_scdp->scd_rttecnt[i] = 0;
15094         }
15095 
15096         new_scdp->scd_region_map = *new_map;
15097         new_scdp->scd_refcnt = 1;
15098         if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
15099                 kmem_cache_free(scd_cache, new_scdp);
15100                 kmem_cache_free(sfmmuid_cache, scsfmmup);
15101                 return (NULL);
15102         }
15103         if (&mmu_init_scd) {
15104                 mmu_init_scd(new_scdp);
15105         }
15106         return (new_scdp);
15107 }
15108 
15109 /*
15110  * The first phase of a process joining an SCD. The hat structure is
15111  * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
15112  * and a cross-call with context invalidation is used to cause the
15113  * remaining work to be carried out in the sfmmu_tsbmiss_exception()
15114  * routine.
15115  */
15116 static void
15117 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
15118 {
15119         hatlock_t *hatlockp;
15120         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15121         int i;
15122         sf_scd_t *old_scdp;
15123 
15124         ASSERT(srdp != NULL);
15125         ASSERT(scdp != NULL);
15126         ASSERT(scdp->scd_refcnt > 0);
15127         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15128 
15129         if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
15130                 ASSERT(old_scdp != scdp);
15131 
15132                 mutex_enter(&old_scdp->scd_mutex);
15133                 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
15134                 mutex_exit(&old_scdp->scd_mutex);
15135                 /*
15136                  * sfmmup leaves the old scd. Update sfmmu_ttecnt to
15137                  * include the shme rgn ttecnt for rgns that
15138                  * were in the old SCD
15139                  */
15140                 for (i = 0; i < mmu_page_sizes; i++) {
15141                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15142                             old_scdp->scd_rttecnt[i]);
15143                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15144                             sfmmup->sfmmu_scdrttecnt[i]);
15145                 }
15146         }
15147 
15148         /*
15149          * Move sfmmu to the scd lists.
15150          */
15151         mutex_enter(&scdp->scd_mutex);
15152         sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
15153         mutex_exit(&scdp->scd_mutex);
15154         SF_SCD_INCR_REF(scdp);
15155 
15156         hatlockp = sfmmu_hat_enter(sfmmup);
15157         /*
15158          * For a multi-thread process, we must stop
15159          * all the other threads before joining the scd.
15160          */
15161 
15162         SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
15163 
15164         sfmmu_invalidate_ctx(sfmmup);
15165         sfmmup->sfmmu_scdp = scdp;
15166 
15167         /*
15168          * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
15169          * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
15170          */
15171         for (i = 0; i < mmu_page_sizes; i++) {
15172                 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
15173                 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
15174                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15175                     -sfmmup->sfmmu_scdrttecnt[i]);
15176         }
15177         /* update tsb0 inflation count */
15178         if (old_scdp != NULL) {
15179                 sfmmup->sfmmu_tsb0_4minflcnt +=
15180                     old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15181         }
15182         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
15183             scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
15184         sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15185 
15186         sfmmu_hat_exit(hatlockp);
15187 
15188         if (old_scdp != NULL) {
15189                 SF_SCD_DECR_REF(srdp, old_scdp);
15190         }
15191 
15192 }
15193 
15194 /*
15195  * This routine is called by a process to become part of an SCD. It is called
15196  * from sfmmu_tsbmiss_exception() once most of the initial work has been
15197  * done by sfmmu_join_scd(). This routine must not drop the hat lock.
15198  */
15199 static void
15200 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
15201 {
15202         struct tsb_info *tsbinfop;
15203 
15204         ASSERT(sfmmu_hat_lock_held(sfmmup));
15205         ASSERT(sfmmup->sfmmu_scdp != NULL);
15206         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
15207         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15208         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15209 
15210         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15211             tsbinfop = tsbinfop->tsb_next) {
15212                 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15213                         continue;
15214                 }
15215                 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15216 
15217                 sfmmu_inv_tsb(tsbinfop->tsb_va,
15218                     TSB_BYTES(tsbinfop->tsb_szc));
15219         }
15220 
15221         /* Set HAT_CTX1_FLAG for all SCD ISMs */
15222         sfmmu_ism_hatflags(sfmmup, 1);
15223 
15224         SFMMU_STAT(sf_join_scd);
15225 }
15226 
15227 /*
15228  * This routine is called in order to check if there is an SCD which matches
15229  * the process's region map if not then a new SCD may be created.
15230  */
15231 static void
15232 sfmmu_find_scd(sfmmu_t *sfmmup)
15233 {
15234         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15235         sf_scd_t *scdp, *new_scdp;
15236         int ret;
15237 
15238         ASSERT(srdp != NULL);
15239         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15240 
15241         mutex_enter(&srdp->srd_scd_mutex);
15242         for (scdp = srdp->srd_scdp; scdp != NULL;
15243             scdp = scdp->scd_next) {
15244                 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15245                     &sfmmup->sfmmu_region_map, ret);
15246                 if (ret == 1) {
15247                         SF_SCD_INCR_REF(scdp);
15248                         mutex_exit(&srdp->srd_scd_mutex);
15249                         sfmmu_join_scd(scdp, sfmmup);
15250                         ASSERT(scdp->scd_refcnt >= 2);
15251                         atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
15252                         return;
15253                 } else {
15254                         /*
15255                          * If the sfmmu region map is a subset of the scd
15256                          * region map, then the assumption is that this process
15257                          * will continue attaching to ISM segments until the
15258                          * region maps are equal.
15259                          */
15260                         SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15261                             &sfmmup->sfmmu_region_map, ret);
15262                         if (ret == 1) {
15263                                 mutex_exit(&srdp->srd_scd_mutex);
15264                                 return;
15265                         }
15266                 }
15267         }
15268 
15269         ASSERT(scdp == NULL);
15270         /*
15271          * No matching SCD has been found, create a new one.
15272          */
15273         if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15274             NULL) {
15275                 mutex_exit(&srdp->srd_scd_mutex);
15276                 return;
15277         }
15278 
15279         /*
15280          * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15281          */
15282 
15283         /* Set scd_rttecnt for shme rgns in SCD */
15284         sfmmu_set_scd_rttecnt(srdp, new_scdp);
15285 
15286         /*
15287          * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15288          */
15289         sfmmu_link_scd_to_regions(srdp, new_scdp);
15290         sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15291         SFMMU_STAT_ADD(sf_create_scd, 1);
15292 
15293         mutex_exit(&srdp->srd_scd_mutex);
15294         sfmmu_join_scd(new_scdp, sfmmup);
15295         ASSERT(new_scdp->scd_refcnt >= 2);
15296         atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
15297 }
15298 
15299 /*
15300  * This routine is called by a process to remove itself from an SCD. It is
15301  * either called when the processes has detached from a segment or from
15302  * hat_free_start() as a result of calling exit.
15303  */
15304 static void
15305 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15306 {
15307         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15308         sf_srd_t *srdp =  sfmmup->sfmmu_srdp;
15309         hatlock_t *hatlockp = TSB_HASH(sfmmup);
15310         int i;
15311 
15312         ASSERT(scdp != NULL);
15313         ASSERT(srdp != NULL);
15314 
15315         if (sfmmup->sfmmu_free) {
15316                 /*
15317                  * If the process is part of an SCD the sfmmu is unlinked
15318                  * from scd_sf_list.
15319                  */
15320                 mutex_enter(&scdp->scd_mutex);
15321                 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15322                 mutex_exit(&scdp->scd_mutex);
15323                 /*
15324                  * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15325                  * are about to leave the SCD
15326                  */
15327                 for (i = 0; i < mmu_page_sizes; i++) {
15328                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15329                             scdp->scd_rttecnt[i]);
15330                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15331                             sfmmup->sfmmu_scdrttecnt[i]);
15332                         sfmmup->sfmmu_scdrttecnt[i] = 0;
15333                 }
15334                 sfmmup->sfmmu_scdp = NULL;
15335 
15336                 SF_SCD_DECR_REF(srdp, scdp);
15337                 return;
15338         }
15339 
15340         ASSERT(r_type != SFMMU_REGION_ISM ||
15341             SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15342         ASSERT(scdp->scd_refcnt);
15343         ASSERT(!sfmmup->sfmmu_free);
15344         ASSERT(sfmmu_hat_lock_held(sfmmup));
15345         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15346 
15347         /*
15348          * Wait for ISM maps to be updated.
15349          */
15350         if (r_type != SFMMU_REGION_ISM) {
15351                 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15352                     sfmmup->sfmmu_scdp != NULL) {
15353                         cv_wait(&sfmmup->sfmmu_tsb_cv,
15354                             HATLOCK_MUTEXP(hatlockp));
15355                 }
15356 
15357                 if (sfmmup->sfmmu_scdp == NULL) {
15358                         sfmmu_hat_exit(hatlockp);
15359                         return;
15360                 }
15361                 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15362         }
15363 
15364         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15365                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15366                 /*
15367                  * Since HAT_JOIN_SCD was set our context
15368                  * is still invalid.
15369                  */
15370         } else {
15371                 /*
15372                  * For a multi-thread process, we must stop
15373                  * all the other threads before leaving the scd.
15374                  */
15375 
15376                 sfmmu_invalidate_ctx(sfmmup);
15377         }
15378 
15379         /* Clear all the rid's for ISM, delete flags, etc */
15380         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15381         sfmmu_ism_hatflags(sfmmup, 0);
15382 
15383         /*
15384          * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15385          * are in SCD before this sfmmup leaves the SCD.
15386          */
15387         for (i = 0; i < mmu_page_sizes; i++) {
15388                 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15389                     scdp->scd_rttecnt[i]);
15390                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15391                     sfmmup->sfmmu_scdrttecnt[i]);
15392                 sfmmup->sfmmu_scdrttecnt[i] = 0;
15393                 /* update ismttecnt to include SCD ism before hat leaves SCD */
15394                 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15395                 sfmmup->sfmmu_scdismttecnt[i] = 0;
15396         }
15397         /* update tsb0 inflation count */
15398         sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15399 
15400         if (r_type != SFMMU_REGION_ISM) {
15401                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15402         }
15403         sfmmup->sfmmu_scdp = NULL;
15404 
15405         sfmmu_hat_exit(hatlockp);
15406 
15407         /*
15408          * Unlink sfmmu from scd_sf_list this can be done without holding
15409          * the hat lock as we hold the sfmmu_as lock which prevents
15410          * hat_join_region from adding this thread to the scd again. Other
15411          * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15412          * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15413          * while holding the hat lock.
15414          */
15415         mutex_enter(&scdp->scd_mutex);
15416         sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15417         mutex_exit(&scdp->scd_mutex);
15418         SFMMU_STAT(sf_leave_scd);
15419 
15420         SF_SCD_DECR_REF(srdp, scdp);
15421         hatlockp = sfmmu_hat_enter(sfmmup);
15422 
15423 }
15424 
15425 /*
15426  * Unlink and free up an SCD structure with a reference count of 0.
15427  */
15428 static void
15429 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15430 {
15431         sfmmu_t *scsfmmup;
15432         sf_scd_t *sp;
15433         hatlock_t *shatlockp;
15434         int i, ret;
15435 
15436         mutex_enter(&srdp->srd_scd_mutex);
15437         for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15438                 if (sp == scdp)
15439                         break;
15440         }
15441         if (sp == NULL || sp->scd_refcnt) {
15442                 mutex_exit(&srdp->srd_scd_mutex);
15443                 return;
15444         }
15445 
15446         /*
15447          * It is possible that the scd has been freed and reallocated with a
15448          * different region map while we've been waiting for the srd_scd_mutex.
15449          */
15450         SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15451         if (ret != 1) {
15452                 mutex_exit(&srdp->srd_scd_mutex);
15453                 return;
15454         }
15455 
15456         ASSERT(scdp->scd_sf_list == NULL);
15457         /*
15458          * Unlink scd from srd_scdp list.
15459          */
15460         sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15461         mutex_exit(&srdp->srd_scd_mutex);
15462 
15463         sfmmu_unlink_scd_from_regions(srdp, scdp);
15464 
15465         /* Clear shared context tsb and release ctx */
15466         scsfmmup = scdp->scd_sfmmup;
15467 
15468         /*
15469          * create a barrier so that scd will not be destroyed
15470          * if other thread still holds the same shared hat lock.
15471          * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15472          * shared hat lock before checking the shared tsb reloc flag.
15473          */
15474         shatlockp = sfmmu_hat_enter(scsfmmup);
15475         sfmmu_hat_exit(shatlockp);
15476 
15477         sfmmu_free_scd_tsbs(scsfmmup);
15478 
15479         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15480                 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15481                         kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15482                             SFMMU_L2_HMERLINKS_SIZE);
15483                         scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15484                 }
15485         }
15486         kmem_cache_free(sfmmuid_cache, scsfmmup);
15487         kmem_cache_free(scd_cache, scdp);
15488         SFMMU_STAT(sf_destroy_scd);
15489 }
15490 
15491 /*
15492  * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15493  * bits which are set in the ism_region_map parameter. This flag indicates to
15494  * the tsbmiss handler that mapping for these segments should be loaded using
15495  * the shared context.
15496  */
15497 static void
15498 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15499 {
15500         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15501         ism_blk_t *ism_blkp;
15502         ism_map_t *ism_map;
15503         int i, rid;
15504 
15505         ASSERT(sfmmup->sfmmu_iblk != NULL);
15506         ASSERT(scdp != NULL);
15507         /*
15508          * Note that the caller either set HAT_ISMBUSY flag or checked
15509          * under hat lock that HAT_ISMBUSY was not set by another thread.
15510          */
15511         ASSERT(sfmmu_hat_lock_held(sfmmup));
15512 
15513         ism_blkp = sfmmup->sfmmu_iblk;
15514         while (ism_blkp != NULL) {
15515                 ism_map = ism_blkp->iblk_maps;
15516                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15517                         rid = ism_map[i].imap_rid;
15518                         if (rid == SFMMU_INVALID_ISMRID) {
15519                                 continue;
15520                         }
15521                         ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15522                         if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15523                             addflag) {
15524                                 ism_map[i].imap_hatflags |=
15525                                     HAT_CTX1_FLAG;
15526                         } else {
15527                                 ism_map[i].imap_hatflags &=
15528                                     ~HAT_CTX1_FLAG;
15529                         }
15530                 }
15531                 ism_blkp = ism_blkp->iblk_next;
15532         }
15533 }
15534 
15535 static int
15536 sfmmu_srd_lock_held(sf_srd_t *srdp)
15537 {
15538         return (MUTEX_HELD(&srdp->srd_mutex));
15539 }
15540 
15541 /* ARGSUSED */
15542 static int
15543 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15544 {
15545         sf_scd_t *scdp = (sf_scd_t *)buf;
15546 
15547         bzero(buf, sizeof (sf_scd_t));
15548         mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15549         return (0);
15550 }
15551 
15552 /* ARGSUSED */
15553 static void
15554 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15555 {
15556         sf_scd_t *scdp = (sf_scd_t *)buf;
15557 
15558         mutex_destroy(&scdp->scd_mutex);
15559 }
15560 
15561 /*
15562  * The listp parameter is a pointer to a list of hmeblks which are partially
15563  * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15564  * freeing process is to cross-call all cpus to ensure that there are no
15565  * remaining cached references.
15566  *
15567  * If the local generation number is less than the global then we can free
15568  * hmeblks which are already on the pending queue as another cpu has completed
15569  * the cross-call.
15570  *
15571  * We cross-call to make sure that there are no threads on other cpus accessing
15572  * these hmblks and then complete the process of freeing them under the
15573  * following conditions:
15574  *      The total number of pending hmeblks is greater than the threshold
15575  *      The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15576  *      It is at least 1 second since the last time we cross-called
15577  *
15578  * Otherwise, we add the hmeblks to the per-cpu pending queue.
15579  */
15580 static void
15581 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15582 {
15583         struct hme_blk *hblkp, *pr_hblkp = NULL;
15584         int             count = 0;
15585         cpuset_t        cpuset = cpu_ready_set;
15586         cpu_hme_pend_t  *cpuhp;
15587         timestruc_t     now;
15588         int             one_second_expired = 0;
15589 
15590         gethrestime_lasttick(&now);
15591 
15592         for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15593                 ASSERT(hblkp->hblk_shw_bit == 0);
15594                 ASSERT(hblkp->hblk_shared == 0);
15595                 count++;
15596                 pr_hblkp = hblkp;
15597         }
15598 
15599         cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15600         mutex_enter(&cpuhp->chp_mutex);
15601 
15602         if ((cpuhp->chp_count + count) == 0) {
15603                 mutex_exit(&cpuhp->chp_mutex);
15604                 return;
15605         }
15606 
15607         if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15608                 one_second_expired  = 1;
15609         }
15610 
15611         if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15612             (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15613             one_second_expired)) {
15614                 /* Append global list to local */
15615                 if (pr_hblkp == NULL) {
15616                         *listp = cpuhp->chp_listp;
15617                 } else {
15618                         pr_hblkp->hblk_next = cpuhp->chp_listp;
15619                 }
15620                 cpuhp->chp_listp = NULL;
15621                 cpuhp->chp_count = 0;
15622                 cpuhp->chp_timestamp = now.tv_sec;
15623                 mutex_exit(&cpuhp->chp_mutex);
15624 
15625                 kpreempt_disable();
15626                 CPUSET_DEL(cpuset, CPU->cpu_id);
15627                 xt_sync(cpuset);
15628                 xt_sync(cpuset);
15629                 kpreempt_enable();
15630 
15631                 /*
15632                  * At this stage we know that no trap handlers on other
15633                  * cpus can have references to hmeblks on the list.
15634                  */
15635                 sfmmu_hblk_free(listp);
15636         } else if (*listp != NULL) {
15637                 pr_hblkp->hblk_next = cpuhp->chp_listp;
15638                 cpuhp->chp_listp = *listp;
15639                 cpuhp->chp_count += count;
15640                 *listp = NULL;
15641                 mutex_exit(&cpuhp->chp_mutex);
15642         } else {
15643                 mutex_exit(&cpuhp->chp_mutex);
15644         }
15645 }
15646 
15647 /*
15648  * Add an hmeblk to the the hash list.
15649  */
15650 void
15651 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15652         uint64_t hblkpa)
15653 {
15654         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15655 #ifdef  DEBUG
15656         if (hmebp->hmeblkp == NULL) {
15657                 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15658         }
15659 #endif /* DEBUG */
15660 
15661         hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15662         /*
15663          * Since the TSB miss handler now does not lock the hash chain before
15664          * walking it, make sure that the hmeblks nextpa is globally visible
15665          * before we make the hmeblk globally visible by updating the chain root
15666          * pointer in the hash bucket.
15667          */
15668         membar_producer();
15669         hmebp->hmeh_nextpa = hblkpa;
15670         hmeblkp->hblk_next = hmebp->hmeblkp;
15671         hmebp->hmeblkp = hmeblkp;
15672 
15673 }
15674 
15675 /*
15676  * This function is the first part of a 2 part process to remove an hmeblk
15677  * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15678  * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15679  * a per-cpu pending list using the virtual address pointer.
15680  *
15681  * TSB miss trap handlers that start after this phase will no longer see
15682  * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15683  * can still use it for further chain traversal because we haven't yet modifed
15684  * the next physical pointer or freed it.
15685  *
15686  * In the second phase of hmeblk removal we'll issue a barrier xcall before
15687  * we reuse or free this hmeblk. This will make sure all lingering references to
15688  * the hmeblk after first phase disappear before we finally reclaim it.
15689  * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15690  * during their traversal.
15691  *
15692  * The hmehash_mutex must be held when calling this function.
15693  *
15694  * Input:
15695  *       hmebp - hme hash bucket pointer
15696  *       hmeblkp - address of hmeblk to be removed
15697  *       pr_hblk - virtual address of previous hmeblkp
15698  *       listp - pointer to list of hmeblks linked by virtual address
15699  *       free_now flag - indicates that a complete removal from the hash chains
15700  *                       is necessary.
15701  *
15702  * It is inefficient to use the free_now flag as a cross-call is required to
15703  * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15704  * in short supply.
15705  */
15706 void
15707 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15708     struct hme_blk *pr_hblk, struct hme_blk **listp,
15709     int free_now)
15710 {
15711         int shw_size, vshift;
15712         struct hme_blk *shw_hblkp;
15713         uint_t          shw_mask, newshw_mask;
15714         caddr_t         vaddr;
15715         int             size;
15716         cpuset_t cpuset = cpu_ready_set;
15717 
15718         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15719 
15720         if (hmebp->hmeblkp == hmeblkp) {
15721                 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15722                 hmebp->hmeblkp = hmeblkp->hblk_next;
15723         } else {
15724                 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15725                 pr_hblk->hblk_next = hmeblkp->hblk_next;
15726         }
15727 
15728         size = get_hblk_ttesz(hmeblkp);
15729         shw_hblkp = hmeblkp->hblk_shadow;
15730         if (shw_hblkp) {
15731                 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15732                 ASSERT(!hmeblkp->hblk_shared);
15733 #ifdef  DEBUG
15734                 if (mmu_page_sizes == max_mmu_page_sizes) {
15735                         ASSERT(size < TTE256M);
15736                 } else {
15737                         ASSERT(size < TTE4M);
15738                 }
15739 #endif /* DEBUG */
15740 
15741                 shw_size = get_hblk_ttesz(shw_hblkp);
15742                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15743                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15744                 ASSERT(vshift < 8);
15745                 /*
15746                  * Atomically clear shadow mask bit
15747                  */
15748                 do {
15749                         shw_mask = shw_hblkp->hblk_shw_mask;
15750                         ASSERT(shw_mask & (1 << vshift));
15751                         newshw_mask = shw_mask & ~(1 << vshift);
15752                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15753                             shw_mask, newshw_mask);
15754                 } while (newshw_mask != shw_mask);
15755                 hmeblkp->hblk_shadow = NULL;
15756         }
15757         hmeblkp->hblk_shw_bit = 0;
15758 
15759         if (hmeblkp->hblk_shared) {
15760 #ifdef  DEBUG
15761                 sf_srd_t        *srdp;
15762                 sf_region_t     *rgnp;
15763                 uint_t          rid;
15764 
15765                 srdp = hblktosrd(hmeblkp);
15766                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15767                 rid = hmeblkp->hblk_tag.htag_rid;
15768                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15769                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15770                 rgnp = srdp->srd_hmergnp[rid];
15771                 ASSERT(rgnp != NULL);
15772                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15773 #endif /* DEBUG */
15774                 hmeblkp->hblk_shared = 0;
15775         }
15776         if (free_now) {
15777                 kpreempt_disable();
15778                 CPUSET_DEL(cpuset, CPU->cpu_id);
15779                 xt_sync(cpuset);
15780                 xt_sync(cpuset);
15781                 kpreempt_enable();
15782 
15783                 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15784                 hmeblkp->hblk_next = NULL;
15785         } else {
15786                 /* Append hmeblkp to listp for processing later. */
15787                 hmeblkp->hblk_next = *listp;
15788                 *listp = hmeblkp;
15789         }
15790 }
15791 
15792 /*
15793  * This routine is called when memory is in short supply and returns a free
15794  * hmeblk of the requested size from the cpu pending lists.
15795  */
15796 static struct hme_blk *
15797 sfmmu_check_pending_hblks(int size)
15798 {
15799         int i;
15800         struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15801         int found_hmeblk;
15802         cpuset_t cpuset = cpu_ready_set;
15803         cpu_hme_pend_t *cpuhp;
15804 
15805         /* Flush cpu hblk pending queues */
15806         for (i = 0; i < NCPU; i++) {
15807                 cpuhp = &cpu_hme_pend[i];
15808                 if (cpuhp->chp_listp != NULL)  {
15809                         mutex_enter(&cpuhp->chp_mutex);
15810                         if (cpuhp->chp_listp == NULL)  {
15811                                 mutex_exit(&cpuhp->chp_mutex);
15812                                 continue;
15813                         }
15814                         found_hmeblk = 0;
15815                         last_hmeblkp = NULL;
15816                         for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15817                             hmeblkp = hmeblkp->hblk_next) {
15818                                 if (get_hblk_ttesz(hmeblkp) == size) {
15819                                         if (last_hmeblkp == NULL) {
15820                                                 cpuhp->chp_listp =
15821                                                     hmeblkp->hblk_next;
15822                                         } else {
15823                                                 last_hmeblkp->hblk_next =
15824                                                     hmeblkp->hblk_next;
15825                                         }
15826                                         ASSERT(cpuhp->chp_count > 0);
15827                                         cpuhp->chp_count--;
15828                                         found_hmeblk = 1;
15829                                         break;
15830                                 } else {
15831                                         last_hmeblkp = hmeblkp;
15832                                 }
15833                         }
15834                         mutex_exit(&cpuhp->chp_mutex);
15835 
15836                         if (found_hmeblk) {
15837                                 kpreempt_disable();
15838                                 CPUSET_DEL(cpuset, CPU->cpu_id);
15839                                 xt_sync(cpuset);
15840                                 xt_sync(cpuset);
15841                                 kpreempt_enable();
15842                                 return (hmeblkp);
15843                         }
15844                 }
15845         }
15846         return (NULL);
15847 }