1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1987, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 
  25 /*
  26  * VM - Hardware Address Translation management.
  27  *
  28  * This file describes the contents of the sun-reference-mmu(sfmmu)-
  29  * specific hat data structures and the sfmmu-specific hat procedures.
  30  * The machine-independent interface is described in <vm/hat.h>.
  31  */
  32 
  33 #ifndef _VM_HAT_SFMMU_H
  34 #define _VM_HAT_SFMMU_H
  35 
  36 #ifdef  __cplusplus
  37 extern "C" {
  38 #endif
  39 
  40 #ifndef _ASM
  41 
  42 #include <sys/types.h>
  43 
  44 #endif /* _ASM */
  45 
  46 #ifdef  _KERNEL
  47 
  48 #include <sys/pte.h>
  49 #include <vm/mach_sfmmu.h>
  50 #include <sys/mmu.h>
  51 
  52 /*
  53  * Don't alter these without considering changes to ism_map_t.
  54  */
  55 #define DEFAULT_ISM_PAGESIZE            MMU_PAGESIZE4M
  56 #define DEFAULT_ISM_PAGESZC             TTE4M
  57 #define ISM_PG_SIZE(ism_vbshift)        (1 << ism_vbshift)
  58 #define ISM_SZ_MASK(ism_vbshift)        (ISM_PG_SIZE(ism_vbshift) - 1)
  59 #define ISM_MAP_SLOTS   8       /* Change this carefully. */
  60 
  61 #ifndef _ASM
  62 
  63 #include <sys/t_lock.h>
  64 #include <vm/hat.h>
  65 #include <vm/seg.h>
  66 #include <sys/machparam.h>
  67 #include <sys/systm.h>
  68 #include <sys/x_call.h>
  69 #include <vm/page.h>
  70 #include <sys/ksynch.h>
  71 
  72 typedef struct hat sfmmu_t;
  73 typedef struct sf_scd sf_scd_t;
  74 
  75 /*
  76  * SFMMU attributes for hat_memload/hat_devload
  77  */
  78 #define SFMMU_UNCACHEPTTE       0x01000000      /* unencache in physical $ */
  79 #define SFMMU_UNCACHEVTTE       0x02000000      /* unencache in virtual $ */
  80 #define SFMMU_SIDEFFECT         0x04000000      /* set side effect bit */
  81 #define SFMMU_LOAD_ALLATTR      (HAT_PROT_MASK | HAT_ORDER_MASK |       \
  82                 HAT_ENDIAN_MASK | HAT_NOFAULT | HAT_NOSYNC |            \
  83                 SFMMU_UNCACHEPTTE | SFMMU_UNCACHEVTTE | SFMMU_SIDEFFECT)
  84 
  85 
  86 /*
  87  * sfmmu flags for hat_memload/hat_devload
  88  */
  89 #define SFMMU_NO_TSBLOAD        0x08000000      /* do not preload tsb */
  90 #define SFMMU_LOAD_ALLFLAG      (HAT_LOAD | HAT_LOAD_LOCK |             \
  91                 HAT_LOAD_ADV | HAT_LOAD_CONTIG | HAT_LOAD_NOCONSIST |   \
  92                 HAT_LOAD_SHARE | HAT_LOAD_REMAP | SFMMU_NO_TSBLOAD |    \
  93                 HAT_RELOAD_SHARE | HAT_NO_KALLOC | HAT_LOAD_TEXT)
  94 
  95 /*
  96  * sfmmu internal flag to hat_pageunload that spares locked mappings
  97  */
  98 #define SFMMU_KERNEL_RELOC      0x8000
  99 
 100 /*
 101  * mode for sfmmu_chgattr
 102  */
 103 #define SFMMU_SETATTR   0x0
 104 #define SFMMU_CLRATTR   0x1
 105 #define SFMMU_CHGATTR   0x2
 106 
 107 /*
 108  * sfmmu specific flags for page_t
 109  */
 110 #define P_PNC   0x8             /* non-caching is permanent bit */
 111 #define P_TNC   0x10            /* non-caching is temporary bit */
 112 #define P_KPMS  0x20            /* kpm mapped small (vac alias prevention) */
 113 #define P_KPMC  0x40            /* kpm conflict page (vac alias prevention) */
 114 
 115 #define PP_GENERIC_ATTR(pp)     ((pp)->p_nrm & (P_MOD | P_REF | P_RO))
 116 #define PP_ISMOD(pp)            ((pp)->p_nrm & P_MOD)
 117 #define PP_ISREF(pp)            ((pp)->p_nrm & P_REF)
 118 #define PP_ISRO(pp)             ((pp)->p_nrm & P_RO)
 119 #define PP_ISNC(pp)             ((pp)->p_nrm & (P_PNC|P_TNC))
 120 #define PP_ISPNC(pp)            ((pp)->p_nrm & P_PNC)
 121 #ifdef VAC
 122 #define PP_ISTNC(pp)            ((pp)->p_nrm & P_TNC)
 123 #endif
 124 #define PP_ISKPMS(pp)           ((pp)->p_nrm & P_KPMS)
 125 #define PP_ISKPMC(pp)           ((pp)->p_nrm & P_KPMC)
 126 
 127 #define PP_SETMOD(pp)           ((pp)->p_nrm |= P_MOD)
 128 #define PP_SETREF(pp)           ((pp)->p_nrm |= P_REF)
 129 #define PP_SETREFMOD(pp)        ((pp)->p_nrm |= (P_REF|P_MOD))
 130 #define PP_SETRO(pp)            ((pp)->p_nrm |= P_RO)
 131 #define PP_SETREFRO(pp)         ((pp)->p_nrm |= (P_REF|P_RO))
 132 #define PP_SETPNC(pp)           ((pp)->p_nrm |= P_PNC)
 133 #ifdef VAC
 134 #define PP_SETTNC(pp)           ((pp)->p_nrm |= P_TNC)
 135 #endif
 136 #define PP_SETKPMS(pp)          ((pp)->p_nrm |= P_KPMS)
 137 #define PP_SETKPMC(pp)          ((pp)->p_nrm |= P_KPMC)
 138 
 139 #define PP_CLRMOD(pp)           ((pp)->p_nrm &= ~P_MOD)
 140 #define PP_CLRREF(pp)           ((pp)->p_nrm &= ~P_REF)
 141 #define PP_CLRREFMOD(pp)        ((pp)->p_nrm &= ~(P_REF|P_MOD))
 142 #define PP_CLRRO(pp)            ((pp)->p_nrm &= ~P_RO)
 143 #define PP_CLRPNC(pp)           ((pp)->p_nrm &= ~P_PNC)
 144 #ifdef VAC
 145 #define PP_CLRTNC(pp)           ((pp)->p_nrm &= ~P_TNC)
 146 #endif
 147 #define PP_CLRKPMS(pp)          ((pp)->p_nrm &= ~P_KPMS)
 148 #define PP_CLRKPMC(pp)          ((pp)->p_nrm &= ~P_KPMC)
 149 
 150 /*
 151  * All shared memory segments attached with the SHM_SHARE_MMU flag (ISM)
 152  * will be constrained to a 4M, 32M or 256M alignment. Also since every newly-
 153  * created ISM segment is created out of a new address space at base va
 154  * of 0 we don't need to store it.
 155  */
 156 #define ISM_ALIGN(shift)        (1 << shift)      /* base va aligned to <n>M  */
 157 #define ISM_ALIGNED(shift, va)  (((uintptr_t)va & (ISM_ALIGN(shift) - 1)) == 0)
 158 #define ISM_SHIFT(shift, x)     ((uintptr_t)x >> (shift))
 159 
 160 /*
 161  * Pad locks out to cache sub-block boundaries to prevent
 162  * false sharing, so several processes don't contend for
 163  * the same line if they aren't using the same lock.  Since
 164  * this is a typedef we also have a bit of freedom in
 165  * changing lock implementations later if we decide it
 166  * is necessary.
 167  */
 168 typedef struct hat_lock {
 169         kmutex_t hl_mutex;
 170         uchar_t hl_pad[64 - sizeof (kmutex_t)];
 171 } hatlock_t;
 172 
 173 #define HATLOCK_MUTEXP(hatlockp)        (&((hatlockp)->hl_mutex))
 174 
 175 /*
 176  * All segments mapped with ISM are guaranteed to be 4M, 32M or 256M aligned.
 177  * Also size is guaranteed to be in 4M, 32M or 256M chunks.
 178  * ism_seg consists of the following members:
 179  * [XX..22] base address of ism segment. XX is 63 or 31 depending whether
 180  *      caddr_t is 64 bits or 32 bits.
 181  * [21..0] size of segment.
 182  *
 183  * NOTE: Don't alter this structure without changing defines above and
 184  * the tsb_miss and protection handlers.
 185  */
 186 typedef struct ism_map {
 187         uintptr_t       imap_seg;       /* base va + sz of ISM segment */
 188         uchar_t         imap_vb_shift;  /* mmu_pageshift for ism page size */
 189         uchar_t         imap_rid;       /* region id for ism */
 190         ushort_t        imap_hatflags;  /* primary ism page size */
 191         uint_t          imap_sz_mask;   /* mmu_pagemask for ism page size */
 192         sfmmu_t         *imap_ismhat;   /* hat id of dummy ISM as */
 193         struct ism_ment *imap_ment;     /* pointer to mapping list entry */
 194 } ism_map_t;
 195 
 196 #define ism_start(map)  ((caddr_t)((map).imap_seg & \
 197                                 ~ISM_SZ_MASK((map).imap_vb_shift)))
 198 #define ism_size(map)   ((map).imap_seg & ISM_SZ_MASK((map).imap_vb_shift))
 199 #define ism_end(map)    ((caddr_t)(ism_start(map) + (ism_size(map) * \
 200                                 ISM_PG_SIZE((map).imap_vb_shift))))
 201 /*
 202  * ISM mapping entry. Used to link all hat's sharing a ism_hat.
 203  * Same function as the p_mapping list for a page.
 204  */
 205 typedef struct ism_ment {
 206         sfmmu_t         *iment_hat;     /* back pointer to hat_share() hat */
 207         caddr_t         iment_base_va;  /* hat's va base for this ism seg */
 208         struct ism_ment *iment_next;    /* next ism map entry */
 209         struct ism_ment *iment_prev;    /* prev ism map entry */
 210 } ism_ment_t;
 211 
 212 /*
 213  * ISM segment block. One will be hung off the sfmmu structure if a
 214  * a process uses ISM.  More will be linked using ismblk_next if more
 215  * than ISM_MAP_SLOTS segments are attached to this proc.
 216  *
 217  * All modifications to fields in this structure will be protected
 218  * by the hat mutex.  In order to avoid grabbing this lock in low level
 219  * routines (tsb miss/protection handlers and vatopfn) while not
 220  * introducing any race conditions with hat_unshare, we will set
 221  * CTX_ISM_BUSY bit in the ctx struct. Any mmu traps that occur
 222  * for this ctx while this bit is set will be handled in sfmmu_tsb_excption
 223  * where it will synchronize behind the hat mutex.
 224  */
 225 typedef struct ism_blk {
 226         ism_map_t               iblk_maps[ISM_MAP_SLOTS];
 227         struct ism_blk          *iblk_next;
 228         uint64_t                iblk_nextpa;
 229 } ism_blk_t;
 230 
 231 /*
 232  * TSB access information.  All fields are protected by the process's
 233  * hat lock.
 234  */
 235 
 236 struct tsb_info {
 237         caddr_t         tsb_va;         /* tsb base virtual address */
 238         uint64_t        tsb_pa;         /* tsb base physical address */
 239         struct tsb_info *tsb_next;      /* next tsb used by this process */
 240         uint16_t        tsb_szc;        /* tsb size code */
 241         uint16_t        tsb_flags;      /* flags for this tsb; see below */
 242         uint_t          tsb_ttesz_mask; /* page size masks; see below */
 243 
 244         tte_t           tsb_tte;        /* tte to lock into DTLB */
 245         sfmmu_t         *tsb_sfmmu;     /* sfmmu */
 246         kmem_cache_t    *tsb_cache;     /* cache from which mem allocated */
 247         vmem_t          *tsb_vmp;       /* vmem arena from which mem alloc'd */
 248 };
 249 
 250 /*
 251  * Values for "tsb_ttesz_mask" bitmask.
 252  */
 253 #define TSB8K   (1 << TTE8K)
 254 #define TSB64K  (1 << TTE64K)
 255 #define TSB512K (1 << TTE512K)
 256 #define TSB4M   (1 << TTE4M)
 257 #define TSB32M  (1 << TTE32M)
 258 #define TSB256M (1 << TTE256M)
 259 
 260 /*
 261  * Values for "tsb_flags" field.
 262  */
 263 #define TSB_RELOC_FLAG          0x1
 264 #define TSB_FLUSH_NEEDED        0x2
 265 #define TSB_SWAPPED     0x4
 266 #define TSB_SHAREDCTX           0x8
 267 
 268 #endif  /* !_ASM */
 269 
 270 /*
 271  * Data structures for shared hmeblk support.
 272  */
 273 
 274 /*
 275  * Do not increase the maximum number of ism/hme regions without checking first
 276  * the impact on ism_map_t, TSB miss area, hblk tag and region id type in
 277  * sf_region structure.
 278  * Initially, shared hmes will only be used for the main text segment
 279  * therefore this value will be set to 64, it will be increased when shared
 280  * libraries are included.
 281  */
 282 
 283 #define SFMMU_MAX_HME_REGIONS           (64)
 284 #define SFMMU_HMERGNMAP_WORDS           BT_BITOUL(SFMMU_MAX_HME_REGIONS)
 285 
 286 #define SFMMU_PRIVATE   0
 287 #define SFMMU_SHARED    1
 288 
 289 #define HMEBLK_ENDPA    1
 290 
 291 #ifndef _ASM
 292 
 293 #define SFMMU_MAX_ISM_REGIONS           (64)
 294 #define SFMMU_ISMRGNMAP_WORDS           BT_BITOUL(SFMMU_MAX_ISM_REGIONS)
 295 
 296 #define SFMMU_RGNMAP_WORDS      (SFMMU_HMERGNMAP_WORDS + SFMMU_ISMRGNMAP_WORDS)
 297 
 298 #define SFMMU_MAX_REGION_BUCKETS        (128)
 299 #define SFMMU_MAX_SRD_BUCKETS           (2048)
 300 
 301 typedef struct sf_hmeregion_map {
 302         ulong_t bitmap[SFMMU_HMERGNMAP_WORDS];
 303 } sf_hmeregion_map_t;
 304 
 305 typedef struct sf_ismregion_map {
 306         ulong_t bitmap[SFMMU_ISMRGNMAP_WORDS];
 307 } sf_ismregion_map_t;
 308 
 309 typedef union sf_region_map_u {
 310         struct _h_rmap_s {
 311                 sf_hmeregion_map_t hmeregion_map;
 312                 sf_ismregion_map_t ismregion_map;
 313         } h_rmap_s;
 314         ulong_t bitmap[SFMMU_RGNMAP_WORDS];
 315 } sf_region_map_t;
 316 
 317 #define SF_RGNMAP_ZERO(map) {                           \
 318         int _i;                                         \
 319         for (_i = 0; _i < SFMMU_RGNMAP_WORDS; _i++) {        \
 320                 (map).bitmap[_i] = 0;                   \
 321         }                                               \
 322 }
 323 
 324 /*
 325  * Returns 1 if map1 and map2 are equal.
 326  */
 327 #define SF_RGNMAP_EQUAL(map1, map2, rval)       {               \
 328         int _i;                                                 \
 329         for (_i = 0; _i < SFMMU_RGNMAP_WORDS; _i++) {                \
 330                 if ((map1)->bitmap[_i] != (map2)->bitmap[_i])     \
 331                         break;                                  \
 332         }                                                       \
 333         if (_i < SFMMU_RGNMAP_WORDS)                         \
 334                 rval = 0;                                       \
 335         else                                                    \
 336                 rval = 1;                                       \
 337 }
 338 
 339 #define SF_RGNMAP_ADD(map, r)           BT_SET((map).bitmap, r)
 340 #define SF_RGNMAP_DEL(map, r)           BT_CLEAR((map).bitmap, r)
 341 #define SF_RGNMAP_TEST(map, r)          BT_TEST((map).bitmap, r)
 342 
 343 /*
 344  * Tests whether map2 is a subset of map1, returns 1 if
 345  * this assertion is true.
 346  */
 347 #define SF_RGNMAP_IS_SUBSET(map1, map2, rval)   {               \
 348         int _i;                                                 \
 349         for (_i = 0; _i < SFMMU_RGNMAP_WORDS; _i++) {                \
 350                 if (((map1)->bitmap[_i]      & (map2)->bitmap[_i])    \
 351                     != (map2)->bitmap[_i])  {                        \
 352                         break;                                  \
 353                 }                                               \
 354         }                                                       \
 355         if (_i < SFMMU_RGNMAP_WORDS)                         \
 356                 rval = 0;                                       \
 357         else                                                    \
 358                 rval = 1;                                       \
 359 }
 360 
 361 #define SF_SCD_INCR_REF(scdp) {                                         \
 362         atomic_add_32((volatile uint32_t *)&(scdp)->scd_refcnt, 1);      \
 363 }
 364 
 365 #define SF_SCD_DECR_REF(srdp, scdp) {                           \
 366         sf_region_map_t _scd_rmap = (scdp)->scd_region_map;  \
 367         if (!atomic_add_32_nv(                                  \
 368             (volatile uint32_t *)&(scdp)->scd_refcnt, -1)) {     \
 369                 sfmmu_destroy_scd((srdp), (scdp), &_scd_rmap);      \
 370         }                                                       \
 371 }
 372 
 373 /*
 374  * A sfmmup link in the link list of sfmmups that share the same region.
 375  */
 376 typedef struct sf_rgn_link {
 377         sfmmu_t *next;
 378         sfmmu_t *prev;
 379 } sf_rgn_link_t;
 380 
 381 /*
 382  * rgn_flags values.
 383  */
 384 #define SFMMU_REGION_HME        0x1
 385 #define SFMMU_REGION_ISM        0x2
 386 #define SFMMU_REGION_FREE       0x8
 387 
 388 #define SFMMU_REGION_TYPE_MASK  (0x3)
 389 
 390 /*
 391  * sf_region defines a text or (D)ISM segment which map
 392  * the same underlying physical object.
 393  */
 394 typedef struct sf_region {
 395         caddr_t                 rgn_saddr;   /* base addr of attached seg */
 396         size_t                  rgn_size;    /* size of attached seg */
 397         void                    *rgn_obj;    /* the underlying object id */
 398         u_offset_t              rgn_objoff;  /* offset in the object mapped */
 399         uchar_t                 rgn_perm;    /* PROT_READ/WRITE/EXEC */
 400         uchar_t                 rgn_pgszc;   /* page size of the region */
 401         uchar_t                 rgn_flags;   /* region type, free flag */
 402         uchar_t                 rgn_id;
 403         int                     rgn_refcnt;  /* # of hats sharing the region */
 404         /* callback function for hat_unload_callback */
 405         hat_rgn_cb_func_t       rgn_cb_function;
 406         struct sf_region        *rgn_hash;   /* hash chain linking the rgns */
 407         kmutex_t                rgn_mutex;   /* protect region sfmmu list */
 408         /* A link list of processes attached to this region */
 409         sfmmu_t                 *rgn_sfmmu_head;
 410         ulong_t                 rgn_ttecnt[MMU_PAGE_SIZES];
 411         uint16_t                rgn_hmeflags; /* rgn tte size flags */
 412 } sf_region_t;
 413 
 414 #define rgn_next        rgn_hash
 415 
 416 /* srd */
 417 typedef struct sf_shared_region_domain {
 418         vnode_t                 *srd_evp;       /* executable vnode */
 419         /* hme region table */
 420         sf_region_t             *srd_hmergnp[SFMMU_MAX_HME_REGIONS];
 421         /* ism region table */
 422         sf_region_t             *srd_ismrgnp[SFMMU_MAX_ISM_REGIONS];
 423         /* hash chain linking srds */
 424         struct sf_shared_region_domain *srd_hash;
 425         /* pointer to the next free hme region */
 426         sf_region_t             *srd_hmergnfree;
 427         /* pointer to the next free ism region */
 428         sf_region_t             *srd_ismrgnfree;
 429         /* id of next ism region created */
 430         uint16_t                srd_next_ismrid;
 431         /* id of next hme region created */
 432         uint16_t                srd_next_hmerid;
 433         uint16_t                srd_ismbusyrgns; /* # of ism rgns in use */
 434         uint16_t                srd_hmebusyrgns; /* # of hme rgns in use */
 435         int                     srd_refcnt;      /* # of procs in the srd */
 436         kmutex_t                srd_mutex;       /* sync add/remove rgns */
 437         kmutex_t                srd_scd_mutex;
 438         sf_scd_t                *srd_scdp;       /* list of scds in srd */
 439         /* hash of regions associated with the same executable */
 440         sf_region_t             *srd_rgnhash[SFMMU_MAX_REGION_BUCKETS];
 441 } sf_srd_t;
 442 
 443 typedef struct sf_srd_bucket {
 444         kmutex_t        srdb_lock;
 445         sf_srd_t        *srdb_srdp;
 446 } sf_srd_bucket_t;
 447 
 448 /*
 449  * The value of SFMMU_L1_HMERLINKS and SFMMU_L2_HMERLINKS will be increased
 450  * to 16 when the use of shared hmes for shared libraries is enabled.
 451  */
 452 
 453 #define SFMMU_L1_HMERLINKS              (8)
 454 #define SFMMU_L2_HMERLINKS              (8)
 455 #define SFMMU_L1_HMERLINKS_SHIFT        (3)
 456 #define SFMMU_L1_HMERLINKS_MASK         (SFMMU_L1_HMERLINKS - 1)
 457 #define SFMMU_L2_HMERLINKS_MASK         (SFMMU_L2_HMERLINKS - 1)
 458 #define SFMMU_L1_HMERLINKS_SIZE         \
 459         (SFMMU_L1_HMERLINKS * sizeof (sf_rgn_link_t *))
 460 #define SFMMU_L2_HMERLINKS_SIZE         \
 461         (SFMMU_L2_HMERLINKS * sizeof (sf_rgn_link_t))
 462 
 463 #if (SFMMU_L1_HMERLINKS * SFMMU_L2_HMERLINKS < SFMMU_MAX_HME_REGIONS)
 464 #error Not Enough HMERLINKS
 465 #endif
 466 
 467 /*
 468  * This macro grabs hat lock and allocates level 2 hat chain
 469  * associated with a shme rgn. In the majority of cases, the macro
 470  * is called with alloc = 0, and lock = 0.
 471  * A pointer to the level 2 sf_rgn_link_t structure is returned in the lnkp
 472  * parameter.
 473  */
 474 #define SFMMU_HMERID2RLINKP(sfmmup, rid, lnkp, alloc, lock)             \
 475 {                                                                       \
 476         int _l1ix = ((rid) >> SFMMU_L1_HMERLINKS_SHIFT) &             \
 477             SFMMU_L1_HMERLINKS_MASK;                                    \
 478         int _l2ix = ((rid) & SFMMU_L2_HMERLINKS_MASK);                      \
 479         hatlock_t *_hatlockp;                                           \
 480         lnkp = (sfmmup)->sfmmu_hmeregion_links[_l1ix];                       \
 481         if (lnkp != NULL) {                                             \
 482                 lnkp = &lnkp[_l2ix];                                        \
 483         } else if (alloc && lock) {                                     \
 484                 lnkp = kmem_zalloc(SFMMU_L2_HMERLINKS_SIZE, KM_SLEEP);  \
 485                 _hatlockp = sfmmu_hat_enter(sfmmup);                    \
 486                 if ((sfmmup)->sfmmu_hmeregion_links[_l1ix] != NULL) {        \
 487                         sfmmu_hat_exit(_hatlockp);                      \
 488                         kmem_free(lnkp, SFMMU_L2_HMERLINKS_SIZE);       \
 489                         lnkp = (sfmmup)->sfmmu_hmeregion_links[_l1ix];       \
 490                         ASSERT(lnkp != NULL);                           \
 491                 } else {                                                \
 492                         (sfmmup)->sfmmu_hmeregion_links[_l1ix] = lnkp;       \
 493                         sfmmu_hat_exit(_hatlockp);                      \
 494                 }                                                       \
 495                 lnkp = &lnkp[_l2ix];                                        \
 496         } else if (alloc) {                                             \
 497                 lnkp = kmem_zalloc(SFMMU_L2_HMERLINKS_SIZE, KM_SLEEP);  \
 498                 ASSERT((sfmmup)->sfmmu_hmeregion_links[_l1ix] == NULL);      \
 499                 (sfmmup)->sfmmu_hmeregion_links[_l1ix] = lnkp;               \
 500                 lnkp = &lnkp[_l2ix];                                        \
 501         }                                                               \
 502 }
 503 
 504 /*
 505  *  Per cpu pending freelist of hmeblks.
 506  */
 507 typedef struct cpu_hme_pend {
 508         struct   hme_blk *chp_listp;
 509         kmutex_t chp_mutex;
 510         time_t   chp_timestamp;
 511         uint_t   chp_count;
 512         uint8_t  chp_pad[36];           /* pad to 64 bytes */
 513 } cpu_hme_pend_t;
 514 
 515 /*
 516  * The default value of the threshold for the per cpu pending queues of hmeblks.
 517  * The queues are flushed if either the number of hmeblks on the queue is above
 518  * the threshold, or one second has elapsed since the last flush.
 519  */
 520 #define CPU_HME_PEND_THRESH 1000
 521 
 522 /*
 523  * Per-MMU context domain kstats.
 524  *
 525  * TSB Miss Exceptions
 526  *      Number of times a TSB miss exception is handled in an MMU. See
 527  *      sfmmu_tsbmiss_exception() for more details.
 528  * TSB Raise Exception
 529  *      Number of times the CPUs within an MMU are cross-called
 530  *      to invalidate either a specific process context (when the process
 531  *      switches MMU contexts) or the context of any process that is
 532  *      running on those CPUs (as part of the MMU context wrap-around).
 533  * Wrap Around
 534  *      The number of times a wrap-around of MMU context happens.
 535  */
 536 typedef enum mmu_ctx_stat_types {
 537         MMU_CTX_TSB_EXCEPTIONS,         /* TSB miss exceptions handled */
 538         MMU_CTX_TSB_RAISE_EXCEPTION,    /* ctx invalidation cross calls */
 539         MMU_CTX_WRAP_AROUND,            /* wraparounds */
 540         MMU_CTX_NUM_STATS
 541 } mmu_ctx_stat_t;
 542 
 543 /*
 544  * Per-MMU context domain structure. This is instantiated the first time a CPU
 545  * belonging to the MMU context domain is configured into the system, at boot
 546  * time or at DR time.
 547  *
 548  * mmu_gnum
 549  *      The current generation number for the context IDs on this MMU context
 550  *      domain. It is protected by mmu_lock.
 551  * mmu_cnum
 552  *      The current cnum to be allocated on this MMU context domain. It
 553  *      is protected via CAS.
 554  * mmu_nctxs
 555  *      The max number of context IDs supported on every CPU in this
 556  *      MMU context domain. This is needed here in case the system supports
 557  *      mixed type of processors/MMUs. It also helps to make ctx switch code
 558  *      access fewer cache lines i.e. no need to retrieve it from some global
 559  *      nctxs.
 560  * mmu_lock
 561  *      The mutex spin lock used to serialize context ID wrap around
 562  * mmu_idx
 563  *      The index for this MMU context domain structure in the global array
 564  *      mmu_ctxdoms.
 565  * mmu_ncpus
 566  *      The actual number of CPUs that have been configured in this
 567  *      MMU context domain. This also acts as a reference count for the
 568  *      structure. When the last CPU in an MMU context domain is unconfigured,
 569  *      the structure is freed. It is protected by mmu_lock.
 570  * mmu_cpuset
 571  *      The CPU set of configured CPUs for this MMU context domain. Used
 572  *      to cross-call all the CPUs in the MMU context domain to invalidate
 573  *      context IDs during a wraparound operation. It is protected by mmu_lock.
 574  */
 575 
 576 typedef struct mmu_ctx {
 577         uint64_t        mmu_gnum;
 578         uint_t          mmu_cnum;
 579         uint_t          mmu_nctxs;
 580         kmutex_t        mmu_lock;
 581         uint_t          mmu_idx;
 582         uint_t          mmu_ncpus;
 583         cpuset_t        mmu_cpuset;
 584         kstat_t         *mmu_kstat;
 585         kstat_named_t   mmu_kstat_data[MMU_CTX_NUM_STATS];
 586 } mmu_ctx_t;
 587 
 588 #define mmu_tsb_exceptions      \
 589                 mmu_kstat_data[MMU_CTX_TSB_EXCEPTIONS].value.ui64
 590 #define mmu_tsb_raise_exception \
 591                 mmu_kstat_data[MMU_CTX_TSB_RAISE_EXCEPTION].value.ui64
 592 #define mmu_wrap_around         \
 593                 mmu_kstat_data[MMU_CTX_WRAP_AROUND].value.ui64
 594 
 595 extern uint_t           max_mmu_ctxdoms;
 596 extern mmu_ctx_t        **mmu_ctxs_tbl;
 597 
 598 extern void     sfmmu_cpu_init(cpu_t *);
 599 extern void     sfmmu_cpu_cleanup(cpu_t *);
 600 
 601 extern uint_t   sfmmu_ctxdom_nctxs(int);
 602 
 603 #ifdef sun4v
 604 extern void     sfmmu_ctxdoms_remove(void);
 605 extern void     sfmmu_ctxdoms_lock(void);
 606 extern void     sfmmu_ctxdoms_unlock(void);
 607 extern void     sfmmu_ctxdoms_update(void);
 608 #endif
 609 
 610 /*
 611  * The following structure is used to get MMU context domain information for
 612  * a CPU from the platform.
 613  *
 614  * mmu_idx
 615  *      The MMU context domain index within the global array mmu_ctxs
 616  * mmu_nctxs
 617  *      The number of context IDs supported in the MMU context domain
 618  */
 619 typedef struct mmu_ctx_info {
 620         uint_t          mmu_idx;
 621         uint_t          mmu_nctxs;
 622 } mmu_ctx_info_t;
 623 
 624 #pragma weak plat_cpuid_to_mmu_ctx_info
 625 
 626 extern void     plat_cpuid_to_mmu_ctx_info(processorid_t, mmu_ctx_info_t *);
 627 
 628 /*
 629  * Each address space has an array of sfmmu_ctx_t structures, one structure
 630  * per MMU context domain.
 631  *
 632  * cnum
 633  *      The context ID allocated for an address space on an MMU context domain
 634  * gnum
 635  *      The generation number for the context ID in the MMU context domain.
 636  *
 637  * This structure needs to be a power-of-two in size.
 638  */
 639 typedef struct sfmmu_ctx {
 640         uint64_t        gnum:48;
 641         uint64_t        cnum:16;
 642 } sfmmu_ctx_t;
 643 
 644 
 645 /*
 646  * The platform dependent hat structure.
 647  * tte counts should be protected by cas.
 648  * cpuset is protected by cas.
 649  *
 650  * ttecnt accounting for mappings which do not use shared hme is carried out
 651  * during pagefault handling. In the shared hme case, only the first process
 652  * to access a mapping generates a pagefault, subsequent processes simply
 653  * find the shared hme entry during trap handling and therefore there is no
 654  * corresponding event to initiate ttecnt accounting. Currently, as shared
 655  * hmes are only used for text segments, when joining a region we assume the
 656  * worst case and add the the number of ttes required to map the entire region
 657  * to the ttecnt corresponding to the region pagesize. However, if the region
 658  * has a 4M pagesize, and memory is low, the allocation of 4M pages may fail
 659  * then 8K pages will be allocated instead and the first TSB which stores 8K
 660  * mappings will potentially be undersized. To compensate for the potential
 661  * underaccounting in this case we always add 1/4 of the region size to the 8K
 662  * ttecnt.
 663  *
 664  * Note that sfmmu_xhat_provider MUST be the first element.
 665  */
 666 
 667 struct hat {
 668         void            *sfmmu_xhat_provider;   /* NULL for CPU hat */
 669         cpuset_t        sfmmu_cpusran;  /* cpu bit mask for efficient xcalls */
 670         struct  as      *sfmmu_as;      /* as this hat provides mapping for */
 671         /* per pgsz private ttecnt + shme rgns ttecnt for rgns not in SCD */
 672         ulong_t         sfmmu_ttecnt[MMU_PAGE_SIZES];
 673         /* shme rgns ttecnt for rgns in SCD */
 674         ulong_t         sfmmu_scdrttecnt[MMU_PAGE_SIZES];
 675         /* est. ism ttes that are NOT in a SCD */
 676         ulong_t         sfmmu_ismttecnt[MMU_PAGE_SIZES];
 677         /* ttecnt for isms that are in a SCD */
 678         ulong_t         sfmmu_scdismttecnt[MMU_PAGE_SIZES];
 679         /* inflate tsb0 to allow for large page alloc failure in region */
 680         ulong_t         sfmmu_tsb0_4minflcnt;
 681         union _h_un {
 682                 ism_blk_t       *sfmmu_iblkp;  /* maps to ismhat(s) */
 683                 ism_ment_t      *sfmmu_imentp; /* ism hat's mapping list */
 684         } h_un;
 685         uint_t          sfmmu_free:1;   /* hat to be freed - set on as_free */
 686         uint_t          sfmmu_ismhat:1; /* hat is dummy ism hatid */
 687         uint_t          sfmmu_scdhat:1; /* hat is dummy scd hatid */
 688         uchar_t         sfmmu_rmstat;   /* refmod stats refcnt */
 689         ushort_t        sfmmu_clrstart; /* start color bin for page coloring */
 690         ushort_t        sfmmu_clrbin;   /* per as phys page coloring bin */
 691         ushort_t        sfmmu_flags;    /* flags */
 692         uchar_t         sfmmu_tteflags; /* pgsz flags */
 693         uchar_t         sfmmu_rtteflags; /* pgsz flags for SRD hmes */
 694         struct tsb_info *sfmmu_tsb;     /* list of per as tsbs */
 695         uint64_t        sfmmu_ismblkpa; /* pa of sfmmu_iblkp, or -1 */
 696         lock_t          sfmmu_ctx_lock; /* sync ctx alloc and invalidation */
 697         kcondvar_t      sfmmu_tsb_cv;   /* signals TSB swapin or relocation */
 698         uchar_t         sfmmu_cext;     /* context page size encoding */
 699         uint8_t         sfmmu_pgsz[MMU_PAGE_SIZES];  /* ranking for MMU */
 700         sf_srd_t        *sfmmu_srdp;
 701         sf_scd_t        *sfmmu_scdp;    /* scd this address space belongs to */
 702         sf_region_map_t sfmmu_region_map;
 703         sf_rgn_link_t   *sfmmu_hmeregion_links[SFMMU_L1_HMERLINKS];
 704         sf_rgn_link_t   sfmmu_scd_link; /* link to scd or pending queue */
 705 #ifdef sun4v
 706         struct hv_tsb_block sfmmu_hvblock;
 707 #endif
 708         /*
 709          * sfmmu_ctxs is a variable length array of max_mmu_ctxdoms # of
 710          * elements. max_mmu_ctxdoms is determined at run-time.
 711          * sfmmu_ctxs[1] is just the fist element of an array, it always
 712          * has to be the last field to ensure that the memory allocated
 713          * for sfmmu_ctxs is consecutive with the memory of the rest of
 714          * the hat data structure.
 715          */
 716         sfmmu_ctx_t     sfmmu_ctxs[1];
 717 
 718 };
 719 
 720 #define sfmmu_iblk      h_un.sfmmu_iblkp
 721 #define sfmmu_iment     h_un.sfmmu_imentp
 722 
 723 #define sfmmu_hmeregion_map     sfmmu_region_map.h_rmap_s.hmeregion_map
 724 #define sfmmu_ismregion_map     sfmmu_region_map.h_rmap_s.ismregion_map
 725 
 726 #define SF_RGNMAP_ISNULL(sfmmup)        \
 727         (sfrgnmap_isnull(&(sfmmup)->sfmmu_region_map))
 728 #define SF_HMERGNMAP_ISNULL(sfmmup)     \
 729         (sfhmergnmap_isnull(&(sfmmup)->sfmmu_hmeregion_map))
 730 
 731 struct sf_scd {
 732         sfmmu_t         *scd_sfmmup;    /* shared context hat */
 733         /* per pgsz ttecnt for shme rgns in SCD */
 734         ulong_t         scd_rttecnt[MMU_PAGE_SIZES];
 735         uint_t          scd_refcnt;     /* address spaces attached to scd */
 736         sf_region_map_t scd_region_map; /* bit mask of attached segments */
 737         sf_scd_t        *scd_next;      /* link pointers for srd_scd list */
 738         sf_scd_t        *scd_prev;
 739         sfmmu_t         *scd_sf_list;   /* list of doubly linked hat structs */
 740         kmutex_t        scd_mutex;
 741         /*
 742          * Link used to add an scd to the sfmmu_iment list.
 743          */
 744         ism_ment_t      scd_ism_links[SFMMU_MAX_ISM_REGIONS];
 745 };
 746 
 747 #define scd_hmeregion_map       scd_region_map.h_rmap_s.hmeregion_map
 748 #define scd_ismregion_map       scd_region_map.h_rmap_s.ismregion_map
 749 
 750 extern int disable_shctx;
 751 extern int shctx_on;
 752 
 753 /*
 754  * bit mask for managing vac conflicts on large pages.
 755  * bit 1 is for uncache flag.
 756  * bits 2 through min(num of cache colors + 1,31) are
 757  * for cache colors that have already been flushed.
 758  */
 759 #ifdef VAC
 760 #define CACHE_NUM_COLOR         (shm_alignment >> MMU_PAGESHIFT)
 761 #else
 762 #define CACHE_NUM_COLOR         1
 763 #endif
 764 
 765 #define CACHE_VCOLOR_MASK(vcolor)       (2 << (vcolor & (CACHE_NUM_COLOR - 1)))
 766 
 767 #define CacheColor_IsFlushed(flag, vcolor) \
 768                                         ((flag) & CACHE_VCOLOR_MASK(vcolor))
 769 
 770 #define CacheColor_SetFlushed(flag, vcolor) \
 771                                         ((flag) |= CACHE_VCOLOR_MASK(vcolor))
 772 /*
 773  * Flags passed to sfmmu_page_cache to flush page from vac or not.
 774  */
 775 #define CACHE_FLUSH     0
 776 #define CACHE_NO_FLUSH  1
 777 
 778 /*
 779  * Flags passed to sfmmu_tlbcache_demap
 780  */
 781 #define FLUSH_NECESSARY_CPUS    0
 782 #define FLUSH_ALL_CPUS          1
 783 
 784 #ifdef  DEBUG
 785 /*
 786  * For debugging purpose only. Maybe removed later.
 787  */
 788 struct ctx_trace {
 789         sfmmu_t         *sc_sfmmu_stolen;
 790         sfmmu_t         *sc_sfmmu_stealing;
 791         clock_t         sc_time;
 792         ushort_t        sc_type;
 793         ushort_t        sc_cnum;
 794 };
 795 #define CTX_TRC_STEAL   0x1
 796 #define CTX_TRC_FREE    0x0
 797 #define TRSIZE  0x400
 798 #define NEXT_CTXTR(ptr) (((ptr) >= ctx_trace_last) ? \
 799                 ctx_trace_first : ((ptr) + 1))
 800 #define TRACE_CTXS(mutex, ptr, cnum, stolen_sfmmu, stealing_sfmmu, type) \
 801         mutex_enter(mutex);                                             \
 802         (ptr)->sc_sfmmu_stolen = (stolen_sfmmu);                     \
 803         (ptr)->sc_sfmmu_stealing = (stealing_sfmmu);                 \
 804         (ptr)->sc_cnum = (cnum);                                     \
 805         (ptr)->sc_type = (type);                                     \
 806         (ptr)->sc_time = ddi_get_lbolt();                            \
 807         (ptr) = NEXT_CTXTR(ptr);                                        \
 808         num_ctx_stolen += (type);                                       \
 809         mutex_exit(mutex);
 810 #else
 811 
 812 #define TRACE_CTXS(mutex, ptr, cnum, stolen_sfmmu, stealing_sfmmu, type)
 813 
 814 #endif  /* DEBUG */
 815 
 816 #endif  /* !_ASM */
 817 
 818 /*
 819  * Macros for sfmmup->sfmmu_flags access.  The macros that change the flags
 820  * ASSERT() that we're holding the HAT lock before changing the flags;
 821  * however callers that read the flags may do so without acquiring the lock
 822  * in a fast path, and then recheck the flag after acquiring the lock in
 823  * a slow path.
 824  */
 825 #define SFMMU_FLAGS_ISSET(sfmmup, flags) \
 826         (((sfmmup)->sfmmu_flags & (flags)) == (flags))
 827 
 828 #define SFMMU_FLAGS_CLEAR(sfmmup, flags) \
 829         (ASSERT(sfmmu_hat_lock_held((sfmmup))), \
 830         (sfmmup)->sfmmu_flags &= ~(flags))
 831 
 832 #define SFMMU_FLAGS_SET(sfmmup, flags) \
 833         (ASSERT(sfmmu_hat_lock_held((sfmmup))), \
 834         (sfmmup)->sfmmu_flags |= (flags))
 835 
 836 #define SFMMU_TTEFLAGS_ISSET(sfmmup, flags) \
 837         ((((sfmmup)->sfmmu_tteflags | (sfmmup)->sfmmu_rtteflags) & (flags)) == \
 838             (flags))
 839 
 840 
 841 /*
 842  * sfmmu tte HAT flags, must fit in 8 bits
 843  */
 844 #define HAT_CHKCTX1_FLAG 0x1
 845 #define HAT_64K_FLAG    (0x1 << TTE64K)
 846 #define HAT_512K_FLAG   (0x1 << TTE512K)
 847 #define HAT_4M_FLAG     (0x1 << TTE4M)
 848 #define HAT_32M_FLAG    (0x1 << TTE32M)
 849 #define HAT_256M_FLAG   (0x1 << TTE256M)
 850 
 851 /*
 852  * sfmmu HAT flags, 16 bits at the moment.
 853  */
 854 #define HAT_4MTEXT_FLAG         0x01
 855 #define HAT_32M_ISM             0x02
 856 #define HAT_256M_ISM            0x04
 857 #define HAT_SWAPPED             0x08 /* swapped out */
 858 #define HAT_SWAPIN              0x10 /* swapping in */
 859 #define HAT_BUSY                0x20 /* replacing TSB(s) */
 860 #define HAT_ISMBUSY             0x40 /* adding/removing/traversing ISM maps */
 861 
 862 #define HAT_CTX1_FLAG           0x100 /* ISM imap hatflag for ctx1 */
 863 #define HAT_JOIN_SCD            0x200 /* region is joining scd */
 864 #define HAT_ALLCTX_INVALID      0x400 /* all per-MMU ctxs are invalidated */
 865 
 866 #define SFMMU_LGPGS_INUSE(sfmmup)                                       \
 867         (((sfmmup)->sfmmu_tteflags | (sfmmup)->sfmmu_rtteflags) ||        \
 868             ((sfmmup)->sfmmu_iblk != NULL))
 869 
 870 /*
 871  * Starting with context 0, the first NUM_LOCKED_CTXS contexts
 872  * are locked so that sfmmu_getctx can't steal any of these
 873  * contexts.  At the time this software was being developed, the
 874  * only context that needs to be locked is context 0 (the kernel
 875  * context), and context 1 (reserved for stolen context). So this constant
 876  * was originally defined to be 2.
 877  *
 878  * For sun4v only, USER_CONTEXT_TYPE represents any user context.  Many
 879  * routines only care whether the context is kernel, invalid or user.
 880  */
 881 
 882 #define NUM_LOCKED_CTXS 2
 883 #define INVALID_CONTEXT 1
 884 
 885 #ifdef sun4v
 886 #define USER_CONTEXT_TYPE       NUM_LOCKED_CTXS
 887 #endif
 888 #if defined(sun4v) || defined(UTSB_PHYS)
 889 /*
 890  * Get the location in the 4MB base TSB of the tsbe for this fault.
 891  * Assumes that the second TSB only contains 4M mappings.
 892  *
 893  * In:
 894  *   tagacc = tag access register (not clobbered)
 895  *   tsbe = 2nd TSB base register
 896  *   tmp1, tmp2 = scratch registers
 897  * Out:
 898  *   tsbe = pointer to the tsbe in the 2nd TSB
 899  */
 900 
 901 #define GET_4MBASE_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)                   \
 902         and     tsbe, TSB_SOFTSZ_MASK, tmp2;    /* tmp2=szc */          \
 903         andn    tsbe, TSB_SOFTSZ_MASK, tsbe;    /* tsbbase */           \
 904         mov     TSB_ENTRIES(0), tmp1;   /* nentries in TSB size 0 */    \
 905         sllx    tmp1, tmp2, tmp1;       /* tmp1 = nentries in TSB */    \
 906         sub     tmp1, 1, tmp1;          /* mask = nentries - 1 */       \
 907         srlx    tagacc, MMU_PAGESHIFT4M, tmp2;                          \
 908         and     tmp2, tmp1, tmp1;       /* tsbent = virtpage & mask */      \
 909         sllx    tmp1, TSB_ENTRY_SHIFT, tmp1;    /* entry num --> ptr */      \
 910         add     tsbe, tmp1, tsbe        /* add entry offset to TSB base */
 911 
 912 #define GET_2ND_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)                      \
 913         GET_4MBASE_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)
 914 
 915 /*
 916  * Get the location in the 3rd TSB of the tsbe for this fault.
 917  * The 3rd TSB corresponds to the shared context, and is used
 918  * for 8K - 512k pages.
 919  *
 920  * In:
 921  *   tagacc = tag access register (not clobbered)
 922  *   tsbe, tmp1, tmp2 = scratch registers
 923  * Out:
 924  *   tsbe = pointer to the tsbe in the 3rd TSB
 925  */
 926 
 927 #define GET_3RD_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)                      \
 928         and     tsbe, TSB_SOFTSZ_MASK, tmp2;    /* tmp2=szc */          \
 929         andn    tsbe, TSB_SOFTSZ_MASK, tsbe;    /* tsbbase */           \
 930         mov     TSB_ENTRIES(0), tmp1;   /* nentries in TSB size 0 */    \
 931         sllx    tmp1, tmp2, tmp1;       /* tmp1 = nentries in TSB */    \
 932         sub     tmp1, 1, tmp1;          /* mask = nentries - 1 */       \
 933         srlx    tagacc, MMU_PAGESHIFT, tmp2;                            \
 934         and     tmp2, tmp1, tmp1;       /* tsbent = virtpage & mask */      \
 935         sllx    tmp1, TSB_ENTRY_SHIFT, tmp1;    /* entry num --> ptr */      \
 936         add     tsbe, tmp1, tsbe        /* add entry offset to TSB base */
 937 
 938 #define GET_4TH_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)                      \
 939         GET_4MBASE_TSBE_PTR(tagacc, tsbe, tmp1, tmp2)
 940 /*
 941  * Copy the sfmmu_region_map or scd_region_map to the tsbmiss
 942  * shmermap or scd_shmermap, from sfmmu_load_mmustate.
 943  */
 944 #define SET_REGION_MAP(rgn_map, tsbmiss_map, cnt, tmp, label)           \
 945         /* BEGIN CSTYLED */                                             \
 946 label:                                                                  ;\
 947         ldx     [rgn_map], tmp                                          ;\
 948         dec     cnt                                                     ;\
 949         add     rgn_map, CLONGSIZE, rgn_map                             ;\
 950         stx     tmp, [tsbmiss_map]                                      ;\
 951         brnz,pt cnt, label                                              ;\
 952             add   tsbmiss_map, CLONGSIZE, tsbmiss_map                    \
 953         /* END CSTYLED */
 954 
 955 /*
 956  * If there is no scd, then zero the tsbmiss scd_shmermap,
 957  * from sfmmu_load_mmustate.
 958  */
 959 #define ZERO_REGION_MAP(tsbmiss_map, cnt, label)                        \
 960         /* BEGIN CSTYLED */                                             \
 961 label:                                                                  ;\
 962         dec     cnt                                                     ;\
 963         stx     %g0, [tsbmiss_map]                                      ;\
 964         brnz,pt cnt, label                                              ;\
 965             add   tsbmiss_map, CLONGSIZE, tsbmiss_map                    
 966         /* END CSTYLED */
 967 
 968 /*
 969  * Set hmemisc to 1 if the shared hme is also part of an scd.
 970  * In:
 971  *   tsbarea = tsbmiss area (not clobbered)
 972  *   hmeblkpa  = hmeblkpa +  hmentoff + SFHME_TTE (not clobbered)
 973  *   hmentoff = hmentoff + SFHME_TTE = tte offset(clobbered)
 974  * Out:
 975  *   use_shctx = 1 if shme is in scd and 0 otherwise
 976  */
 977 #define GET_SCDSHMERMAP(tsbarea, hmeblkpa, hmentoff, use_shctx)               \
 978         /* BEGIN CSTYLED */                                                   \
 979         sub     hmeblkpa, hmentoff, hmentoff    /* hmentofff = hmeblkpa */   ;\
 980         add     hmentoff, HMEBLK_TAG, hmentoff                               ;\
 981         ldxa    [hmentoff]ASI_MEM, hmentoff     /* read 1st part of tag */   ;\
 982         and     hmentoff, HTAG_RID_MASK, hmentoff       /* mask off rid */   ;\
 983         and     hmentoff, BT_ULMASK, use_shctx  /* mask bit index */         ;\
 984         srlx    hmentoff, BT_ULSHIFT, hmentoff  /* extract word */           ;\
 985         sllx    hmentoff, CLONGSHIFT, hmentoff  /* index */                  ;\
 986         add     tsbarea, hmentoff, hmentoff             /* add to tsbarea */ ;\
 987         ldx     [hmentoff + TSBMISS_SCDSHMERMAP], hmentoff      /* scdrgn */ ;\
 988         srlx    hmentoff, use_shctx, use_shctx                               ;\
 989         and     use_shctx, 0x1, use_shctx                                     \
 990         /* END CSTYLED */
 991 
 992 /*
 993  * Synthesize a TSB base register contents for a process.
 994  *
 995  * In:
 996  *   tsbinfo = TSB info pointer (ro)
 997  *   tsbreg, tmp1 = scratch registers
 998  * Out:
 999  *   tsbreg = value to program into TSB base register
1000  */
1001 
1002 #define MAKE_UTSBREG(tsbinfo, tsbreg, tmp1)                     \
1003         ldx     [tsbinfo + TSBINFO_PADDR], tsbreg;              \
1004         lduh    [tsbinfo + TSBINFO_SZCODE], tmp1;               \
1005         and     tmp1, TSB_SOFTSZ_MASK, tmp1;                    \
1006         or      tsbreg, tmp1, tsbreg;
1007 
1008 
1009 /*
1010  * Load TSB base register to TSBMISS area for privte contexts.
1011  * This register contains utsb_pabase in bits 63:13, and TSB size
1012  * code in bits 2:0.
1013  *
1014  * For private context
1015  * In:
1016  *   tsbreg = value to load (ro)
1017  *   regnum = constant or register
1018  *   tmp1 = scratch register
1019  * Out:
1020  *   Specified scratchpad register updated
1021  *
1022  */
1023 #define SET_UTSBREG(regnum, tsbreg, tmp1)                               \
1024         mov     regnum, tmp1;                                           \
1025         stxa    tsbreg, [tmp1]ASI_SCRATCHPAD    /* save tsbreg */
1026 /*
1027  * Get TSB base register from the scratchpad for private contexts
1028  *
1029  * In:
1030  *   regnum = constant or register
1031  *   tsbreg = scratch
1032  * Out:
1033  *   tsbreg = tsbreg from the specified scratchpad register
1034  */
1035 #define GET_UTSBREG(regnum, tsbreg)                                     \
1036         mov     regnum, tsbreg;                                         \
1037         ldxa    [tsbreg]ASI_SCRATCHPAD, tsbreg
1038 
1039 /*
1040  * Load TSB base register to TSBMISS area for shared contexts.
1041  * This register contains utsb_pabase in bits 63:13, and TSB size
1042  * code in bits 2:0.
1043  *
1044  * In:
1045  *   tsbmiss = pointer to tsbmiss area
1046  *   tsbmissoffset = offset to right tsb pointer
1047  *   tsbreg = value to load (ro)
1048  * Out:
1049  *   Specified tsbmiss area updated
1050  *
1051  */
1052 #define SET_UTSBREG_SHCTX(tsbmiss, tsbmissoffset, tsbreg)               \
1053         stx     tsbreg, [tsbmiss + tsbmissoffset]       /* save tsbreg */
1054 
1055 /*
1056  * Get TSB base register from the scratchpad for
1057  * shared contexts
1058  *
1059  * In:
1060  *   tsbmiss = pointer to tsbmiss area
1061  *   tsbmissoffset = offset to right tsb pointer
1062  *   tsbreg = scratch
1063  * Out:
1064  *   tsbreg = tsbreg from the specified scratchpad register
1065  */
1066 #define GET_UTSBREG_SHCTX(tsbmiss, tsbmissoffset, tsbreg)               \
1067         ldx     [tsbmiss + tsbmissoffset], tsbreg
1068 
1069 #endif /* defined(sun4v) || defined(UTSB_PHYS) */
1070 
1071 #ifndef _ASM
1072 
1073 /*
1074  * Kernel page relocation stuff.
1075  */
1076 struct sfmmu_callback {
1077         int key;
1078         int (*prehandler)(caddr_t, uint_t, uint_t, void *);
1079         int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t);
1080         int (*errhandler)(caddr_t, uint_t, uint_t, void *);
1081         int capture_cpus;
1082 };
1083 
1084 extern int sfmmu_max_cb_id;
1085 extern struct sfmmu_callback *sfmmu_cb_table;
1086 
1087 struct pa_hment;
1088 
1089 /*
1090  * RFE: With multihat gone we gain back an int.  We could use this to
1091  * keep ref bits on a per cpu basis to eliminate xcalls.
1092  */
1093 struct sf_hment {
1094         tte_t hme_tte;                  /* tte for this hment */
1095 
1096         union {
1097                 struct page *page;      /* what page this maps */
1098                 struct pa_hment *data;  /* pa_hment */
1099         } sf_hment_un;
1100 
1101         struct  sf_hment *hme_next;     /* next hment */
1102         struct  sf_hment *hme_prev;     /* prev hment */
1103 };
1104 
1105 struct pa_hment {
1106         caddr_t         addr;           /* va */
1107         uint_t          len;            /* bytes */
1108         ushort_t        flags;          /* internal flags */
1109         ushort_t        refcnt;         /* reference count */
1110         id_t            cb_id;          /* callback id, table index */
1111         void            *pvt;           /* handler's private data */
1112         struct sf_hment sfment;         /* corresponding dummy sf_hment */
1113 };
1114 
1115 #define hme_page                sf_hment_un.page
1116 #define hme_data                sf_hment_un.data
1117 #define hme_size(sfhmep)        ((int)(TTE_CSZ(&(sfhmep)->hme_tte)))
1118 #define PAHME_SZ                (sizeof (struct pa_hment))
1119 #define SFHME_SZ                (sizeof (struct sf_hment))
1120 
1121 #define IS_PAHME(hme)   ((hme)->hme_tte.ll == 0)
1122 
1123 /*
1124  * hmeblk_tag structure
1125  * structure used to obtain a match on a hme_blk.  Currently consists of
1126  * the address of the sfmmu struct (or hatid), the base page address of the
1127  * hme_blk, and the rehash count.  The rehash count is actually only 2 bits
1128  * and has the following meaning:
1129  * 1 = 8k or 64k hash sequence.
1130  * 2 = 512k hash sequence.
1131  * 3 = 4M hash sequence.
1132  * We require this count because we don't want to get a false hit on a 512K or
1133  * 4M rehash with a base address corresponding to a 8k or 64k hmeblk.
1134  * Note:  The ordering and size of the hmeblk_tag members are implictly known
1135  * by the tsb miss handlers written in assembly.  Do not change this structure
1136  * without checking those routines.  See HTAG_SFMMUPSZ define.
1137  */
1138 
1139 /*
1140  * In private hmeblks hblk_rid field must be SFMMU_INVALID_RID.
1141  */
1142 typedef union {
1143         struct {
1144                 uint64_t        hblk_basepg: 51,        /* hme_blk base pg # */
1145                                 hblk_rehash: 3,         /* rehash number */
1146                                 hblk_rid: 10;           /* hme_blk region id */
1147                 void            *hblk_id;
1148         } hblk_tag_un;
1149         uint64_t                htag_tag[2];
1150 } hmeblk_tag;
1151 
1152 #define htag_id         hblk_tag_un.hblk_id
1153 #define htag_bspage     hblk_tag_un.hblk_basepg
1154 #define htag_rehash     hblk_tag_un.hblk_rehash
1155 #define htag_rid        hblk_tag_un.hblk_rid
1156 
1157 #endif /* !_ASM */
1158 
1159 #define HTAG_REHASH_SHIFT       10
1160 #define HTAG_MAX_RID    (((0x1 << HTAG_REHASH_SHIFT) - 1))
1161 #define HTAG_RID_MASK   HTAG_MAX_RID
1162 
1163 /* used for tagging all per sfmmu (i.e. non SRD) private hmeblks */
1164 #define SFMMU_INVALID_SHMERID   HTAG_MAX_RID
1165 
1166 #if SFMMU_INVALID_SHMERID < SFMMU_MAX_HME_REGIONS
1167 #error SFMMU_INVALID_SHMERID < SFMMU_MAX_HME_REGIONS
1168 #endif
1169 
1170 #define SFMMU_IS_SHMERID_VALID(rid)     ((rid) != SFMMU_INVALID_SHMERID)
1171 
1172 /* ISM regions */
1173 #define SFMMU_INVALID_ISMRID    0xff
1174 
1175 #if SFMMU_INVALID_ISMRID < SFMMU_MAX_ISM_REGIONS
1176 #error SFMMU_INVALID_ISMRID < SFMMU_MAX_ISM_REGIONS
1177 #endif
1178 
1179 #define SFMMU_IS_ISMRID_VALID(rid)      ((rid) != SFMMU_INVALID_ISMRID)
1180 
1181 
1182 #define HTAGS_EQ(tag1, tag2)    (((tag1.htag_tag[0] ^ tag2.htag_tag[0]) | \
1183                                 (tag1.htag_tag[1] ^ tag2.htag_tag[1])) == 0)
1184 
1185 /*
1186  * this macro must only be used for comparing tags in shared hmeblks.
1187  */
1188 #define HTAGS_EQ_SHME(hmetag, tag, hrmap)                               \
1189         (((hmetag).htag_rid != SFMMU_INVALID_SHMERID) &&                \
1190         (((((hmetag).htag_tag[0] ^ (tag).htag_tag[0]) &                     \
1191                 ~HTAG_RID_MASK) |                                       \
1192             ((hmetag).htag_tag[1] ^ (tag).htag_tag[1])) == 0) &&        \
1193         SF_RGNMAP_TEST(hrmap, hmetag.htag_rid))
1194 
1195 #define HME_REHASH(sfmmup)                                              \
1196         ((sfmmup)->sfmmu_ttecnt[TTE512K] != 0 ||                     \
1197         (sfmmup)->sfmmu_ttecnt[TTE4M] != 0 ||                                \
1198         (sfmmup)->sfmmu_ttecnt[TTE32M] != 0 ||                               \
1199         (sfmmup)->sfmmu_ttecnt[TTE256M] != 0)
1200 
1201 #define NHMENTS         8               /* # of hments in an 8k hme_blk */
1202                                         /* needs to be multiple of 2 */
1203 
1204 #ifndef _ASM
1205 
1206 #ifdef  HBLK_TRACE
1207 
1208 #define HBLK_LOCK               1
1209 #define HBLK_UNLOCK             0
1210 #define HBLK_STACK_DEPTH        6
1211 #define HBLK_AUDIT_CACHE_SIZE   16
1212 #define HBLK_LOCK_PATTERN       0xaaaaaaaa
1213 #define HBLK_UNLOCK_PATTERN     0xbbbbbbbb
1214 
1215 struct hblk_lockcnt_audit {
1216         int             flag;           /* lock or unlock */
1217         kthread_id_t    thread;
1218         int             depth;
1219         pc_t            stack[HBLK_STACK_DEPTH];
1220 };
1221 
1222 #endif  /* HBLK_TRACE */
1223 
1224 
1225 /*
1226  * Hment block structure.
1227  * The hme_blk is the node data structure which the hash structure
1228  * mantains. An hme_blk can have 2 different sizes depending on the
1229  * number of hments it implicitly contains.  When dealing with 64K, 512K,
1230  * or 4M hments there is one hment per hme_blk.  When dealing with
1231  * 8k hments we allocate an hme_blk plus an additional 7 hments to
1232  * give us a total of 8 (NHMENTS) hments that can be referenced through a
1233  * hme_blk.
1234  *
1235  * The hmeblk structure contains 2 tte reference counters used to determine if
1236  * it is ok to free up the hmeblk.  Both counters have to be zero in order
1237  * to be able to free up hmeblk.  They are protected by cas.
1238  * hblk_hmecnt is the number of hments present on pp mapping lists.
1239  * hblk_vcnt reflects number of valid ttes in hmeblk.
1240  *
1241  * The hmeblk now also has per tte lock cnts.  This is required because
1242  * the counts can be high and there are not enough bits in the tte. When
1243  * physio is fixed to not lock the translations we should be able to move
1244  * the lock cnt back to the tte.  See bug id 1198554.
1245  *
1246  * Note that xhat_hme_blk's layout follows this structure: hme_blk_misc
1247  * and sf_hment are at the same offsets in both structures. Whenever
1248  * hme_blk is changed, xhat_hme_blk may need to be updated as well.
1249  */
1250 
1251 struct hme_blk_misc {
1252         uint_t  notused:25;
1253         uint_t  shared_bit:1;   /* set for SRD shared hmeblk */
1254         uint_t  xhat_bit:1;     /* set for an xhat hme_blk */
1255         uint_t  shadow_bit:1;   /* set for a shadow hme_blk */
1256         uint_t  nucleus_bit:1;  /* set for a nucleus hme_blk */
1257         uint_t  ttesize:3;      /* contains ttesz of hmeblk */
1258 };
1259 
1260 struct hme_blk {
1261         volatile uint64_t hblk_nextpa;  /* physical address for hash list */
1262 
1263         hmeblk_tag      hblk_tag;       /* tag used to obtain an hmeblk match */
1264 
1265         struct hme_blk  *hblk_next;     /* on free list or on hash list */
1266                                         /* protected by hash lock */
1267 
1268         struct hme_blk  *hblk_shadow;   /* pts to shadow hblk */
1269                                         /* protected by hash lock */
1270         uint_t          hblk_span;      /* span of memory hmeblk maps */
1271 
1272         struct hme_blk_misc     hblk_misc;
1273 
1274         union {
1275                 struct {
1276                         ushort_t hblk_hmecount; /* hment on mlists counter */
1277                         ushort_t hblk_validcnt; /* valid tte reference count */
1278                 } hblk_counts;
1279                 uint_t          hblk_shadow_mask;
1280         } hblk_un;
1281 
1282         uint_t          hblk_lckcnt;
1283 
1284 #ifdef  HBLK_TRACE
1285         kmutex_t        hblk_audit_lock;        /* lock to protect index */
1286         uint_t          hblk_audit_index;       /* index into audit_cache */
1287         struct  hblk_lockcnt_audit hblk_audit_cache[HBLK_AUDIT_CACHE_SIZE];
1288 #endif  /* HBLK_AUDIT */
1289 
1290         struct sf_hment hblk_hme[1];    /* hment array */
1291 };
1292 
1293 #define hblk_shared     hblk_misc.shared_bit
1294 #define hblk_xhat_bit   hblk_misc.xhat_bit
1295 #define hblk_shw_bit    hblk_misc.shadow_bit
1296 #define hblk_nuc_bit    hblk_misc.nucleus_bit
1297 #define hblk_ttesz      hblk_misc.ttesize
1298 #define hblk_hmecnt     hblk_un.hblk_counts.hblk_hmecount
1299 #define hblk_vcnt       hblk_un.hblk_counts.hblk_validcnt
1300 #define hblk_shw_mask   hblk_un.hblk_shadow_mask
1301 
1302 #define MAX_HBLK_LCKCNT 0xFFFFFFFF
1303 #define HMEBLK_ALIGN    0x8             /* hmeblk has to be double aligned */
1304 
1305 #ifdef  HBLK_TRACE
1306 
1307 #define HBLK_STACK_TRACE(hmeblkp, lock)                                 \
1308 {                                                                       \
1309         int flag = lock;        /* to pacify lint */                    \
1310         int audit_index;                                                \
1311                                                                         \
1312         mutex_enter(&hmeblkp->hblk_audit_lock);                          \
1313         audit_index = hmeblkp->hblk_audit_index;                     \
1314         hmeblkp->hblk_audit_index = ((hmeblkp->hblk_audit_index + 1) &        \
1315             (HBLK_AUDIT_CACHE_SIZE - 1));                               \
1316         mutex_exit(&hmeblkp->hblk_audit_lock);                           \
1317                                                                         \
1318         if (flag)                                                       \
1319                 hmeblkp->hblk_audit_cache[audit_index].flag =                \
1320                     HBLK_LOCK_PATTERN;                                  \
1321         else                                                            \
1322                 hmeblkp->hblk_audit_cache[audit_index].flag =                \
1323                     HBLK_UNLOCK_PATTERN;                                \
1324                                                                         \
1325         hmeblkp->hblk_audit_cache[audit_index].thread = curthread;   \
1326         hmeblkp->hblk_audit_cache[audit_index].depth =                       \
1327             getpcstack(hmeblkp->hblk_audit_cache[audit_index].stack, \
1328             HBLK_STACK_DEPTH);                                          \
1329 }
1330 
1331 #else
1332 
1333 #define HBLK_STACK_TRACE(hmeblkp, lock)
1334 
1335 #endif  /* HBLK_TRACE */
1336 
1337 #define HMEHASH_FACTOR  16      /* used to calc # of buckets in hme hash */
1338 
1339 /*
1340  * A maximum number of user hmeblks is defined in order to place an upper
1341  * limit on how much nucleus memory is required and to avoid overflowing the
1342  * tsbmiss uhashsz and khashsz data areas. The number below corresponds to
1343  * the number of buckets required, for an average hash chain length of 4 on
1344  * a 16TB machine.
1345  */
1346 
1347 #define MAX_UHME_BUCKETS        (0x1 << 30)
1348 #define MAX_KHME_BUCKETS        (0x1 << 30)
1349 
1350 /*
1351  * The minimum number of kernel hash buckets.
1352  */
1353 #define MIN_KHME_BUCKETS        0x800
1354 
1355 /*
1356  * The number of hash buckets must be a power of 2. If the initial calculated
1357  * value is less than USER_BUCKETS_THRESHOLD we round up to the next greater
1358  * power of 2, otherwise we round down to avoid huge over allocations.
1359  */
1360 #define USER_BUCKETS_THRESHOLD  (1<<22)
1361 
1362 #define MAX_NUCUHME_BUCKETS     0x4000
1363 #define MAX_NUCKHME_BUCKETS     0x2000
1364 
1365 /*
1366  * There are 2 locks in the hmehash bucket.  The hmehash_mutex is
1367  * a regular mutex used to make sure operations on a hash link are only
1368  * done by one thread.  Any operation which comes into the hat with
1369  * a <vaddr, as> will grab the hmehash_mutex.  Normally one would expect
1370  * the tsb miss handlers to grab the hash lock to make sure the hash list
1371  * is consistent while we traverse it.  Unfortunately this can lead to
1372  * deadlocks or recursive mutex enters since it is possible for
1373  * someone holding the lock to take a tlb/tsb miss.
1374  * To solve this problem we have added the hmehash_listlock.  This lock
1375  * is only grabbed by the tsb miss handlers, vatopfn, and while
1376  * adding/removing a hmeblk from the hash list. The code is written to
1377  * guarantee we won't take a tlb miss while holding this lock.
1378  */
1379 struct hmehash_bucket {
1380         kmutex_t        hmehash_mutex;
1381         volatile uint64_t hmeh_nextpa;  /* physical address for hash list */
1382         struct hme_blk *hmeblkp;
1383         uint_t          hmeh_listlock;
1384 };
1385 
1386 #endif /* !_ASM */
1387 
1388 #define SFMMU_PGCNT_MASK        0x3f
1389 #define SFMMU_PGCNT_SHIFT       6
1390 #define INVALID_MMU_ID          -1
1391 #define SFMMU_MMU_GNUM_RSHIFT   16
1392 #define SFMMU_MMU_CNUM_LSHIFT   (64 - SFMMU_MMU_GNUM_RSHIFT)
1393 #define MAX_SFMMU_CTX_VAL       ((1 << 16) - 1) /* for sanity check */
1394 #define MAX_SFMMU_GNUM_VAL      ((0x1UL << 48) - 1)
1395 
1396 /*
1397  * The tsb miss handlers written in assembly know that sfmmup
1398  * is a 64 bit ptr.
1399  *
1400  * The bspage and re-hash part is 64 bits, with the sfmmup being another 64
1401  * bits.
1402  */
1403 #define HTAG_SFMMUPSZ           0       /* Not really used for LP64 */
1404 #define HTAG_BSPAGE_SHIFT       13
1405 
1406 /*
1407  * Assembly routines need to be able to get to ttesz
1408  */
1409 #define HBLK_SZMASK             0x7
1410 
1411 #ifndef _ASM
1412 
1413 /*
1414  * Returns the number of bytes that an hmeblk spans given its tte size
1415  */
1416 #define get_hblk_span(hmeblkp) ((hmeblkp)->hblk_span)
1417 #define get_hblk_ttesz(hmeblkp) ((hmeblkp)->hblk_ttesz)
1418 #define get_hblk_cache(hmeblkp) (((hmeblkp)->hblk_ttesz == TTE8K) ? \
1419         sfmmu8_cache : sfmmu1_cache)
1420 #define HMEBLK_SPAN(ttesz)                                              \
1421         ((ttesz == TTE8K)? (TTEBYTES(ttesz) * NHMENTS) : TTEBYTES(ttesz))
1422 
1423 #define set_hblk_sz(hmeblkp, ttesz)                             \
1424         (hmeblkp)->hblk_ttesz = (ttesz);                     \
1425         (hmeblkp)->hblk_span = HMEBLK_SPAN(ttesz)
1426 
1427 #define get_hblk_base(hmeblkp)                                  \
1428         ((uintptr_t)(hmeblkp)->hblk_tag.htag_bspage << MMU_PAGESHIFT)
1429 
1430 #define get_hblk_endaddr(hmeblkp)                               \
1431         ((caddr_t)(get_hblk_base(hmeblkp) + get_hblk_span(hmeblkp)))
1432 
1433 #define in_hblk_range(hmeblkp, vaddr)                                   \
1434         (((uintptr_t)(vaddr) >= get_hblk_base(hmeblkp)) &&           \
1435         ((uintptr_t)(vaddr) < (get_hblk_base(hmeblkp) +                      \
1436         get_hblk_span(hmeblkp))))
1437 
1438 #define tte_to_vaddr(hmeblkp, tte)      ((caddr_t)(get_hblk_base(hmeblkp) \
1439         + (TTEBYTES(TTE_CSZ(&tte)) * (tte).tte_hmenum)))
1440 
1441 #define tte_to_evaddr(hmeblkp, ttep)    ((caddr_t)(get_hblk_base(hmeblkp) \
1442         + (TTEBYTES(TTE_CSZ(ttep)) * ((ttep)->tte_hmenum + 1))))
1443 
1444 #define vaddr_to_vshift(hblktag, vaddr, shwsz)                          \
1445         ((((uintptr_t)(vaddr) >> MMU_PAGESHIFT) - (hblktag.htag_bspage)) >>\
1446         TTE_BSZS_SHIFT((shwsz) - 1))
1447 
1448 #define HME8BLK_SZ      (sizeof (struct hme_blk) + \
1449                         (NHMENTS - 1) * sizeof (struct sf_hment))
1450 #define HME1BLK_SZ      (sizeof (struct hme_blk))
1451 #define H1MIN           (2 + MAX_BIGKTSB_TTES)  /* nucleus text+data, ktsb */
1452 
1453 /*
1454  * Hme_blk hash structure
1455  * Active mappings are kept in a hash structure of hme_blks.  The hash
1456  * function is based on (ctx, vaddr) The size of the hash table size is a
1457  * power of 2 such that the average hash chain lenth is HMENT_HASHAVELEN.
1458  * The hash actually consists of 2 separate hashes.  One hash is for the user
1459  * address space and the other hash is for the kernel address space.
1460  * The number of buckets are calculated at boot time and stored in the global
1461  * variables "uhmehash_num" and "khmehash_num".  By making the hash table size
1462  * a power of 2 we can use a simply & function to derive an index instead of
1463  * a divide.
1464  *
1465  * HME_HASH_FUNCTION(hatid, vaddr, shift) returns a pointer to a hme_hash
1466  * bucket.
1467  * An hme hash bucket contains a pointer to an hme_blk and the mutex that
1468  * protects the link list.
1469  * Spitfire supports 4 page sizes.  8k and 64K pages only need one hash.
1470  * 512K pages need 2 hashes and 4M pages need 3 hashes.
1471  * The 'shift' parameter controls how many bits the vaddr will be shifted in
1472  * the hash function. It is calculated in the HME_HASH_SHIFT(ttesz) function
1473  * and it varies depending on the page size as follows:
1474  *      8k pages:       HBLK_RANGE_SHIFT
1475  *      64k pages:      MMU_PAGESHIFT64K
1476  *      512K pages:     MMU_PAGESHIFT512K
1477  *      4M pages:       MMU_PAGESHIFT4M
1478  * An assembly version of the hash function exists in sfmmu_ktsb_miss(). All
1479  * changes should be reflected in both versions.  This function and the TSB
1480  * miss handlers are the only places which know about the two hashes.
1481  *
1482  * HBLK_RANGE_SHIFT controls range of virtual addresses that will fall
1483  * into the same bucket for a particular process.  It is currently set to
1484  * be equivalent to 64K range or one hme_blk.
1485  *
1486  * The hme_blks in the hash are protected by a per hash bucket mutex
1487  * known as SFMMU_HASH_LOCK.
1488  * You need to acquire this lock before traversing the hash bucket link
1489  * list, while adding/removing a hme_blk to the list, and while
1490  * modifying an hme_blk.  A possible optimization is to replace these
1491  * mutexes by readers/writer lock but right now it is not clear whether
1492  * this is a win or not.
1493  *
1494  * The HME_HASH_TABLE_SEARCH will search the hash table for the
1495  * hme_blk that contains the hment that corresponds to the passed
1496  * ctx and vaddr.  It assumed the SFMMU_HASH_LOCK is held.
1497  */
1498 
1499 #endif /* ! _ASM */
1500 
1501 #define KHATID                  ksfmmup
1502 #define UHMEHASH_SZ             uhmehash_num
1503 #define KHMEHASH_SZ             khmehash_num
1504 #define HMENT_HASHAVELEN        4
1505 #define HBLK_RANGE_SHIFT        MMU_PAGESHIFT64K /* shift for HBLK_BS_MASK */
1506 #define HBLK_MIN_TTESZ          1
1507 #define HBLK_MIN_BYTES          MMU_PAGESIZE64K
1508 #define HBLK_MIN_SHIFT          MMU_PAGESHIFT64K
1509 #define MAX_HASHCNT             5
1510 #define DEFAULT_MAX_HASHCNT     3
1511 
1512 #ifndef _ASM
1513 
1514 #define HASHADDR_MASK(hashno)   TTE_PAGEMASK(hashno)
1515 
1516 #define HME_HASH_SHIFT(ttesz)                                           \
1517         ((ttesz == TTE8K)? HBLK_RANGE_SHIFT : TTE_PAGE_SHIFT(ttesz))
1518 
1519 #define HME_HASH_ADDR(vaddr, hmeshift)                                  \
1520         ((caddr_t)(((uintptr_t)(vaddr) >> (hmeshift)) << (hmeshift)))
1521 
1522 #define HME_HASH_BSPAGE(vaddr, hmeshift)                                \
1523         (((uintptr_t)(vaddr) >> (hmeshift)) << ((hmeshift) - MMU_PAGESHIFT))
1524 
1525 #define HME_HASH_REHASH(ttesz)                                          \
1526         (((ttesz) < TTE512K)? 1 : (ttesz))
1527 
1528 #define HME_HASH_FUNCTION(hatid, vaddr, shift)                               \
1529         ((((void *)hatid) != ((void *)KHATID)) ?                             \
1530         (&uhme_hash[ (((uintptr_t)(hatid) ^ ((uintptr_t)vaddr >> (shift))) & \
1531             UHMEHASH_SZ) ]):                                                 \
1532         (&khme_hash[ (((uintptr_t)(hatid) ^ ((uintptr_t)vaddr >> (shift))) & \
1533             KHMEHASH_SZ) ]))
1534 
1535 /*
1536  * This macro will traverse a hmeblk hash link list looking for an hme_blk
1537  * that owns the specified vaddr and hatid.  If if doesn't find one , hmeblkp
1538  * will be set to NULL, otherwise it will point to the correct hme_blk.
1539  * This macro also cleans empty hblks.
1540  */
1541 #define HME_HASH_SEARCH_PREV(hmebp, hblktag, hblkp, pr_hblk, listp)     \
1542 {                                                                       \
1543         struct hme_blk *nx_hblk;                                        \
1544                                                                         \
1545         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));                          \
1546         hblkp = hmebp->hmeblkp;                                              \
1547         pr_hblk = NULL;                                                 \
1548         while (hblkp) {                                                 \
1549                 if (HTAGS_EQ(hblkp->hblk_tag, hblktag)) {            \
1550                         /* found hme_blk */                             \
1551                         break;                                          \
1552                 }                                                       \
1553                 nx_hblk = hblkp->hblk_next;                          \
1554                 if (!hblkp->hblk_vcnt && !hblkp->hblk_hmecnt) {           \
1555                         sfmmu_hblk_hash_rm(hmebp, hblkp, pr_hblk,       \
1556                             listp, 0);                                  \
1557                 } else {                                                \
1558                         pr_hblk = hblkp;                                \
1559                 }                                                       \
1560                 hblkp = nx_hblk;                                        \
1561         }                                                               \
1562 }
1563 
1564 #define HME_HASH_SEARCH(hmebp, hblktag, hblkp, listp)                   \
1565 {                                                                       \
1566         struct hme_blk *pr_hblk;                                        \
1567                                                                         \
1568         HME_HASH_SEARCH_PREV(hmebp, hblktag, hblkp,  pr_hblk, listp);   \
1569 }
1570 
1571 /*
1572  * This macro will traverse a hmeblk hash link list looking for an hme_blk
1573  * that owns the specified vaddr and hatid.  If if doesn't find one , hmeblkp
1574  * will be set to NULL, otherwise it will point to the correct hme_blk.
1575  * It doesn't remove empty hblks.
1576  */
1577 #define HME_HASH_FAST_SEARCH(hmebp, hblktag, hblkp)                     \
1578         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));                          \
1579         for (hblkp = hmebp->hmeblkp; hblkp;                          \
1580             hblkp = hblkp->hblk_next) {                                      \
1581                 if (HTAGS_EQ(hblkp->hblk_tag, hblktag)) {            \
1582                         /* found hme_blk */                             \
1583                         break;                                          \
1584                 }                                                       \
1585         }
1586 
1587 #define SFMMU_HASH_LOCK(hmebp)                                          \
1588                 (mutex_enter(&hmebp->hmehash_mutex))
1589 
1590 #define SFMMU_HASH_UNLOCK(hmebp)                                        \
1591                 (mutex_exit(&hmebp->hmehash_mutex))
1592 
1593 #define SFMMU_HASH_LOCK_TRYENTER(hmebp)                                 \
1594                 (mutex_tryenter(&hmebp->hmehash_mutex))
1595 
1596 #define SFMMU_HASH_LOCK_ISHELD(hmebp)                                   \
1597                 (mutex_owned(&hmebp->hmehash_mutex))
1598 
1599 #define SFMMU_XCALL_STATS(sfmmup)                                       \
1600 {                                                                       \
1601         if (sfmmup == ksfmmup) {                                        \
1602                 SFMMU_STAT(sf_kernel_xcalls);                           \
1603         } else {                                                        \
1604                 SFMMU_STAT(sf_user_xcalls);                             \
1605         }                                                               \
1606 }
1607 
1608 #define astosfmmu(as)           ((as)->a_hat)
1609 #define hblktosfmmu(hmeblkp)    ((sfmmu_t *)(hmeblkp)->hblk_tag.htag_id)
1610 #define hblktosrd(hmeblkp)      ((sf_srd_t *)(hmeblkp)->hblk_tag.htag_id)
1611 #define sfmmutoas(sfmmup)       ((sfmmup)->sfmmu_as)
1612 
1613 #define sfmmutohtagid(sfmmup, rid)                         \
1614         (((rid) == SFMMU_INVALID_SHMERID) ? (void *)(sfmmup) : \
1615         (void *)((sfmmup)->sfmmu_srdp))
1616 
1617 /*
1618  * We use the sfmmu data structure to keep the per as page coloring info.
1619  */
1620 #define as_color_bin(as)        (astosfmmu(as)->sfmmu_clrbin)
1621 #define as_color_start(as)      (astosfmmu(as)->sfmmu_clrstart)
1622 
1623 typedef struct {
1624         char    h8[HME8BLK_SZ];
1625 } hblk8_t;
1626 
1627 typedef struct {
1628         char    h1[HME1BLK_SZ];
1629 } hblk1_t;
1630 
1631 typedef struct {
1632         ulong_t         index;
1633         ulong_t         len;
1634         hblk8_t         *list;
1635 } nucleus_hblk8_info_t;
1636 
1637 typedef struct {
1638         ulong_t         index;
1639         ulong_t         len;
1640         hblk1_t         *list;
1641 } nucleus_hblk1_info_t;
1642 
1643 /*
1644  * This struct is used for accumlating information about a range
1645  * of pages that are unloading so that a single xcall can flush
1646  * the entire range from remote tlbs. A function that must demap
1647  * a range of virtual addresses declares one of these structures
1648  * and initializes using DEMP_RANGE_INIT(). It then passes a pointer to this
1649  * struct to the appropriate sfmmu_hblk_* level function which does
1650  * all the bookkeeping using the other macros. When the function has
1651  * finished the virtual address range, it needs to call DEMAP_RANGE_FLUSH()
1652  * macro to take care of any remaining unflushed mappings.
1653  *
1654  * The maximum range this struct can represent is the number of bits
1655  * in the dmr_bitvec field times the pagesize in dmr_pgsz. Currently, only
1656  * MMU_PAGESIZE pages are supported.
1657  *
1658  * Since there are now cases where it's no longer necessary to do
1659  * flushes (e.g. when the process isn't runnable because it's swapping
1660  * out or exiting) we allow these macros to take a NULL dmr input and do
1661  * nothing in that case.
1662  */
1663 typedef struct {
1664         sfmmu_t         *dmr_sfmmup;    /* relevant hat */
1665         caddr_t         dmr_addr;       /* beginning address */
1666         caddr_t         dmr_endaddr;    /* ending  address */
1667         ulong_t         dmr_bitvec;     /* valid pages found */
1668         ulong_t         dmr_bit;        /* next page to examine */
1669         ulong_t         dmr_maxbit;     /* highest page in range */
1670         ulong_t         dmr_pgsz;       /* page size in range */
1671 } demap_range_t;
1672 
1673 #define DMR_MAXBIT ((ulong_t)1<<63) /* dmr_bit high bit */
1674 
1675 #define DEMAP_RANGE_INIT(sfmmup, dmrp) \
1676         (dmrp)->dmr_sfmmup = (sfmmup); \
1677         (dmrp)->dmr_bitvec = 0; \
1678         (dmrp)->dmr_maxbit = sfmmu_dmr_maxbit; \
1679         (dmrp)->dmr_pgsz = MMU_PAGESIZE;
1680 
1681 #define DEMAP_RANGE_PGSZ(dmrp) ((dmrp)? (dmrp)->dmr_pgsz : MMU_PAGESIZE)
1682 
1683 #define DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr) \
1684         if ((dmrp) != NULL) { \
1685         if ((dmrp)->dmr_bitvec != 0 && (dmrp)->dmr_endaddr != (addr)) \
1686                 sfmmu_tlb_range_demap(dmrp); \
1687         (dmrp)->dmr_endaddr = (endaddr); \
1688         }
1689 
1690 #define DEMAP_RANGE_FLUSH(dmrp) \
1691         if ((dmrp)->dmr_bitvec != 0)                 \
1692                 sfmmu_tlb_range_demap(dmrp);
1693 
1694 
1695 #define DEMAP_RANGE_MARKPG(dmrp, addr) \
1696         if ((dmrp) != NULL) { \
1697                 if ((dmrp)->dmr_bitvec == 0) { \
1698                         (dmrp)->dmr_addr = (addr); \
1699                         (dmrp)->dmr_bit = 1; \
1700                 } \
1701                 (dmrp)->dmr_bitvec |= (dmrp)->dmr_bit; \
1702         }
1703 
1704 #define DEMAP_RANGE_NEXTPG(dmrp) \
1705         if ((dmrp) != NULL && (dmrp)->dmr_bitvec != 0) { \
1706                 if ((dmrp)->dmr_bit & (dmrp)->dmr_maxbit) { \
1707                         sfmmu_tlb_range_demap(dmrp); \
1708                 } else { \
1709                         (dmrp)->dmr_bit <<= 1; \
1710                 } \
1711         }
1712 
1713 /*
1714  * TSB related structures
1715  *
1716  * The TSB is made up of tte entries.  Both the tag and data are present
1717  * in the TSB.  The TSB locking is managed as follows:
1718  * A software bit in the tsb tag is used to indicate that entry is locked.
1719  * If a cpu servicing a tsb miss reads a locked entry the tag compare will
1720  * fail forcing the cpu to go to the hat hash for the translation.
1721  * The cpu who holds the lock can then modify the data side, and the tag side.
1722  * The last write should be to the word containing the lock bit which will
1723  * clear the lock and allow the tsb entry to be read.  It is assumed that all
1724  * cpus reading the tsb will do so with atomic 128-bit loads.  An atomic 128
1725  * bit load is required to prevent the following from happening:
1726  *
1727  * cpu 0                        cpu 1                   comments
1728  *
1729  * ldx tag                                              tag unlocked
1730  *                              ldstub lock             set lock
1731  *                              stx data
1732  *                              stx tag                 unlock
1733  * ldx tag                                              incorrect tte!!!
1734  *
1735  * The software also maintains a bit in the tag to indicate an invalid
1736  * tsb entry.  The purpose of this bit is to allow the tsb invalidate code
1737  * to invalidate a tsb entry with a single cas.  See code for details.
1738  */
1739 
1740 union tsb_tag {
1741         struct {
1742                 uint32_t        tag_res0:16;    /* reserved - context area */
1743                 uint32_t        tag_inv:1;      /* sw - invalid tsb entry */
1744                 uint32_t        tag_lock:1;     /* sw - locked tsb entry */
1745                 uint32_t        tag_res1:4;     /* reserved */
1746                 uint32_t        tag_va_hi:10;   /* va[63:54] */
1747                 uint32_t        tag_va_lo;      /* va[53:22] */
1748         } tagbits;
1749         struct tsb_tagints {
1750                 uint32_t        inthi;
1751                 uint32_t        intlo;
1752         } tagints;
1753 };
1754 #define tag_invalid             tagbits.tag_inv
1755 #define tag_locked              tagbits.tag_lock
1756 #define tag_vahi                tagbits.tag_va_hi
1757 #define tag_valo                tagbits.tag_va_lo
1758 #define tag_inthi               tagints.inthi
1759 #define tag_intlo               tagints.intlo
1760 
1761 struct tsbe {
1762         union tsb_tag   tte_tag;
1763         tte_t           tte_data;
1764 };
1765 
1766 /*
1767  * A per cpu struct is kept that duplicates some info
1768  * used by the tl>0 tsb miss handlers plus it provides
1769  * a scratch area.  Its purpose is to minimize cache misses
1770  * in the tsb miss handler and is 128 bytes (2 e$ lines).
1771  *
1772  * There should be one allocated per cpu in nucleus memory
1773  * and should be aligned on an ecache line boundary.
1774  */
1775 struct tsbmiss {
1776         sfmmu_t                 *ksfmmup;       /* kernel hat id */
1777         sfmmu_t                 *usfmmup;       /* user hat id */
1778         sf_srd_t                *usrdp;         /* user's SRD hat id */
1779         struct tsbe             *tsbptr;        /* hardware computed ptr */
1780         struct tsbe             *tsbptr4m;      /* hardware computed ptr */
1781         struct tsbe             *tsbscdptr;     /* hardware computed ptr */
1782         struct tsbe             *tsbscdptr4m;   /* hardware computed ptr */
1783         uint64_t                ismblkpa;
1784         struct hmehash_bucket   *khashstart;
1785         struct hmehash_bucket   *uhashstart;
1786         uint_t                  khashsz;
1787         uint_t                  uhashsz;
1788         uint16_t                dcache_line_mask; /* used to flush dcache */
1789         uchar_t                 uhat_tteflags;  /* private page sizes */
1790         uchar_t                 uhat_rtteflags; /* SHME pagesizes */
1791         uint32_t                utsb_misses;
1792         uint32_t                ktsb_misses;
1793         uint16_t                uprot_traps;
1794         uint16_t                kprot_traps;
1795         /*
1796          * scratch[0] -> TSB_TAGACC
1797          * scratch[1] -> TSBMISS_HMEBP
1798          * scratch[2] -> TSBMISS_HATID
1799          */
1800         uintptr_t               scratch[3];
1801         ulong_t         shmermap[SFMMU_HMERGNMAP_WORDS];        /* 8 bytes */
1802         ulong_t         scd_shmermap[SFMMU_HMERGNMAP_WORDS];    /* 8 bytes */
1803         uint8_t         pad[48];                        /* pad to 64 bytes */
1804 };
1805 
1806 /*
1807  * A per cpu struct is kept for the use within the tl>0 kpm tsb
1808  * miss handler. Some members are duplicates of common data or
1809  * the physical addresses of common data. A few members are also
1810  * written by the tl>0 kpm tsb miss handler. Its purpose is to
1811  * minimize cache misses in the kpm tsb miss handler and occupies
1812  * one ecache line. There should be one allocated per cpu in
1813  * nucleus memory and it should be aligned on an ecache line
1814  * boundary. It is not merged w/ struct tsbmiss since there is
1815  * not much to share and the tsbmiss pathes are different, so
1816  * a kpm tlbmiss/tsbmiss only touches one cacheline, except for
1817  * (DEBUG || SFMMU_STAT_GATHER) where the dtlb_misses counter
1818  * of struct tsbmiss is used on every dtlb miss.
1819  */
1820 struct kpmtsbm {
1821         caddr_t         vbase;          /* start of address kpm range */
1822         caddr_t         vend;           /* end of address kpm range */
1823         uchar_t         flags;          /* flags needed in TL tsbmiss handler */
1824         uchar_t         sz_shift;       /* for single kpm window */
1825         uchar_t         kpmp_shift;     /* hash lock shift */
1826         uchar_t         kpmp2pshft;     /* kpm page to page shift */
1827         uint_t          kpmp_table_sz;  /* size of kpmp_table or kpmp_stable */
1828         uint64_t        kpmp_tablepa;   /* paddr of kpmp_table or kpmp_stable */
1829         uint64_t        msegphashpa;    /* paddr of memseg_phash */
1830         struct tsbe     *tsbptr;        /* saved ktsb pointer */
1831         uint_t          kpm_dtlb_misses; /* kpm tlbmiss counter */
1832         uint_t          kpm_tsb_misses; /* kpm tsbmiss counter */
1833         uintptr_t       pad[1];
1834 };
1835 
1836 extern size_t   tsb_slab_size;
1837 extern uint_t   tsb_slab_shift;
1838 extern size_t   tsb_slab_mask;
1839 
1840 #endif /* !_ASM */
1841 
1842 /*
1843  * Flags for TL kpm tsbmiss handler
1844  */
1845 #define KPMTSBM_ENABLE_FLAG     0x01    /* bit copy of kpm_enable */
1846 #define KPMTSBM_TLTSBM_FLAG     0x02    /* use TL tsbmiss handler */
1847 #define KPMTSBM_TSBPHYS_FLAG    0x04    /* use ASI_MEM for TSB update */
1848 
1849 /*
1850  * The TSB
1851  * All TSB sizes supported by the hardware are now supported (8K - 1M).
1852  * For kernel TSBs we may go beyond the hardware supported sizes and support
1853  * larger TSBs via software.
1854  * All TTE sizes are supported in the TSB; the manner in which this is
1855  * done is cpu dependent.
1856  */
1857 #define TSB_MIN_SZCODE          TSB_8K_SZCODE   /* min. supported TSB size */
1858 #define TSB_MIN_OFFSET_MASK     (TSB_OFFSET_MASK(TSB_MIN_SZCODE))
1859 
1860 #ifdef sun4v
1861 #define UTSB_MAX_SZCODE         TSB_256M_SZCODE /* max. supported TSB size */
1862 #else /* sun4u */
1863 #define UTSB_MAX_SZCODE         TSB_1M_SZCODE   /* max. supported TSB size */
1864 #endif /* sun4v */
1865 
1866 #define UTSB_MAX_OFFSET_MASK    (TSB_OFFSET_MASK(UTSB_MAX_SZCODE))
1867 
1868 #define TSB_FREEMEM_MIN         0x1000          /* 32 mb */
1869 #define TSB_FREEMEM_LARGE       0x10000         /* 512 mb */
1870 #define TSB_8K_SZCODE           0               /* 512 entries */
1871 #define TSB_16K_SZCODE          1               /* 1k entries */
1872 #define TSB_32K_SZCODE          2               /* 2k entries */
1873 #define TSB_64K_SZCODE          3               /* 4k entries */
1874 #define TSB_128K_SZCODE         4               /* 8k entries */
1875 #define TSB_256K_SZCODE         5               /* 16k entries */
1876 #define TSB_512K_SZCODE         6               /* 32k entries */
1877 #define TSB_1M_SZCODE           7               /* 64k entries */
1878 #define TSB_2M_SZCODE           8               /* 128k entries */
1879 #define TSB_4M_SZCODE           9               /* 256k entries */
1880 #define TSB_8M_SZCODE           10              /* 512k entries */
1881 #define TSB_16M_SZCODE          11              /* 1M entries */
1882 #define TSB_32M_SZCODE          12              /* 2M entries */
1883 #define TSB_64M_SZCODE          13              /* 4M entries */
1884 #define TSB_128M_SZCODE         14              /* 8M entries */
1885 #define TSB_256M_SZCODE         15              /* 16M entries */
1886 #define TSB_ENTRY_SHIFT         4       /* each entry = 128 bits = 16 bytes */
1887 #define TSB_ENTRY_SIZE          (1 << 4)
1888 #define TSB_START_SIZE          9
1889 #define TSB_ENTRIES(tsbsz)      (1 << (TSB_START_SIZE + tsbsz))
1890 #define TSB_BYTES(tsbsz)        (TSB_ENTRIES(tsbsz) << TSB_ENTRY_SHIFT)
1891 #define TSB_OFFSET_MASK(tsbsz)  (TSB_ENTRIES(tsbsz) - 1)
1892 #define TSB_BASEADDR_MASK       ((1 << 12) - 1)
1893 
1894 /*
1895  * sun4u platforms
1896  * ---------------
1897  * We now support two user TSBs with one TSB base register.
1898  * Hence the TSB base register is split up as follows:
1899  *
1900  * When only one TSB present:
1901  *   [63  62..42  41..13  12..4  3..0]
1902  *     ^   ^       ^       ^     ^
1903  *     |   |       |       |     |
1904  *     |   |       |       |     |_ TSB size code
1905  *     |   |       |       |
1906  *     |   |       |       |_ Reserved 0
1907  *     |   |       |
1908  *     |   |       |_ TSB VA[41..13]
1909  *     |   |
1910  *     |   |_ VA hole (Spitfire), zeros (Cheetah and beyond)
1911  *     |
1912  *     |_ 0
1913  *
1914  * When second TSB present:
1915  *   [63  62..42  41..33  32..29  28..22  21..13  12..4  3..0]
1916  *     ^   ^       ^       ^       ^       ^       ^     ^
1917  *     |   |       |       |       |       |       |     |
1918  *     |   |       |       |       |       |       |     |_ First TSB size code
1919  *     |   |       |       |       |       |       |
1920  *     |   |       |       |       |       |       |_ Reserved 0
1921  *     |   |       |       |       |       |
1922  *     |   |       |       |       |       |_ First TSB's VA[21..13]
1923  *     |   |       |       |       |
1924  *     |   |       |       |       |_ Reserved for future use
1925  *     |   |       |       |
1926  *     |   |       |       |_ Second TSB's size code
1927  *     |   |       |
1928  *     |   |       |_ Second TSB's VA[21..13]
1929  *     |   |
1930  *     |   |_ VA hole (Spitfire) / ones (Cheetah and beyond)
1931  *     |
1932  *     |_ 1
1933  *
1934  * Note that since we store 21..13 of each TSB's VA, TSBs and their slabs
1935  * may be up to 4M in size.  For now, only hardware supported TSB sizes
1936  * are supported, though the slabs are usually 4M in size.
1937  *
1938  * sun4u platforms that define UTSB_PHYS use physical addressing to access
1939  * the user TSBs at TL>0.  The first user TSB base is in the MMU I/D TSB Base
1940  * registers.  The second TSB base uses a dedicated scratchpad register which
1941  * requires a definition of SCRATCHPAD_UTSBREG2 in mach_sfmmu.h.  The layout for
1942  * both registers is equivalent to sun4v below, except the TSB PA range is
1943  * [46..13] for sun4u.
1944  *
1945  * sun4v platforms
1946  * ---------------
1947  * On sun4v platforms, we use two dedicated scratchpad registers as pseudo
1948  * hardware TSB base registers to hold up to two different user TSBs.
1949  *
1950  * Each register contains TSB's physical base and size code information
1951  * as follows:
1952  *
1953  *   [63..56  55..13  12..4  3..0]
1954  *      ^       ^       ^     ^
1955  *      |       |       |     |
1956  *      |       |       |     |_ TSB size code
1957  *      |       |       |
1958  *      |       |       |_ Reserved 0
1959  *      |       |
1960  *      |       |_ TSB PA[55..13]
1961  *      |
1962  *      |
1963  *      |
1964  *      |_ 0 for valid TSB
1965  *
1966  * Absence of a user TSB (primarily the second user TSB) is indicated by
1967  * storing a negative value in the TSB base register. This allows us to
1968  * check for presence of a user TSB by simply checking bit# 63.
1969  */
1970 #define TSBREG_MSB_SHIFT        32              /* set upper bits */
1971 #define TSBREG_MSB_CONST        0xfffff800      /* set bits 63..43 */
1972 #define TSBREG_FIRTSB_SHIFT     42              /* to clear bits 63:22 */
1973 #define TSBREG_SECTSB_MKSHIFT   20              /* 21:13 --> 41:33 */
1974 #define TSBREG_SECTSB_LSHIFT    22              /* to clear bits 63:42 */
1975 #define TSBREG_SECTSB_RSHIFT    (TSBREG_SECTSB_MKSHIFT + TSBREG_SECTSB_LSHIFT)
1976                                                 /* sectsb va -> bits 21:13 */
1977                                                 /* after clearing upper bits */
1978 #define TSBREG_SECSZ_SHIFT      29              /* to get sectsb szc to 3:0 */
1979 #define TSBREG_VAMASK_SHIFT     13              /* set up VA mask */
1980 
1981 #define BIGKTSB_SZ_MASK         0xf
1982 #define TSB_SOFTSZ_MASK         BIGKTSB_SZ_MASK
1983 #define MIN_BIGKTSB_SZCODE      9       /* 256k entries */
1984 #define MAX_BIGKTSB_SZCODE      11      /* 1024k entries */
1985 #define MAX_BIGKTSB_TTES        (TSB_BYTES(MAX_BIGKTSB_SZCODE) / MMU_PAGESIZE4M)
1986 
1987 #define TAG_VALO_SHIFT          22              /* tag's va are bits 63-22 */
1988 /*
1989  * sw bits used on tsb_tag - bit masks used only in assembly
1990  * use only a sethi for these fields.
1991  */
1992 #define TSBTAG_INVALID  0x00008000              /* tsb_tag.tag_invalid */
1993 #define TSBTAG_LOCKED   0x00004000              /* tsb_tag.tag_locked */
1994 
1995 #ifdef  _ASM
1996 
1997 /*
1998  * Marker to indicate that this instruction will be hot patched at runtime
1999  * to some other value.
2000  * This value must be zero since it fills in the imm bits of the target
2001  * instructions to be patched
2002  */
2003 #define RUNTIME_PATCH   (0)
2004 
2005 /*
2006  * V9 defines nop instruction as the following, which we use
2007  * at runtime to nullify some instructions we don't want to
2008  * execute in the trap handlers on certain platforms.
2009  */
2010 #define MAKE_NOP_INSTR(reg)     \
2011         sethi   %hi(0x1000000), reg
2012 
2013 /*
2014  * This macro constructs a SPARC V9 "jmpl <source reg>, %g0"
2015  * instruction, with the source register specified by the jump_reg_number.
2016  * The jmp opcode [24:19] = 11 1000 and source register is bits [18:14].
2017  * The instruction is returned in reg. The macro is used to patch in a jmpl
2018  * instruction at runtime.
2019  */
2020 #define MAKE_JMP_INSTR(jump_reg_number, reg, tmp)       \
2021         sethi   %hi(0x81c00000), reg;                   \
2022         mov     jump_reg_number, tmp;                   \
2023         sll     tmp, 14, tmp;                           \
2024         or      reg, tmp, reg
2025 
2026 /*
2027  * Macro to get hat per-MMU cnum on this CPU.
2028  * sfmmu - In, pass in "sfmmup" from the caller.
2029  * cnum - Out, return 'cnum' to the caller
2030  * scr  - scratch
2031  */
2032 #define SFMMU_CPU_CNUM(sfmmu, cnum, scr)                                      \
2033         CPU_ADDR(scr, cnum);    /* scr = load CPU struct addr */              \
2034         ld      [scr + CPU_MMU_IDX], cnum;      /* cnum = mmuid */            \
2035         add     sfmmu, SFMMU_CTXS, scr; /* scr = sfmmup->sfmmu_ctxs[] */      \
2036         sllx    cnum, SFMMU_MMU_CTX_SHIFT, cnum;                              \
2037         add     scr, cnum, scr;         /* scr = sfmmup->sfmmu_ctxs[id] */    \
2038         ldx     [scr + SFMMU_MMU_GC_NUM], scr;  /* sfmmu_ctxs[id].gcnum */    \
2039         sllx    scr, SFMMU_MMU_CNUM_LSHIFT, scr;                              \
2040         srlx    scr, SFMMU_MMU_CNUM_LSHIFT, cnum;       /* cnum = sfmmu cnum */
2041 
2042 /*
2043  * Macro to get hat gnum & cnum assocaited with sfmmu_ctx[mmuid] entry
2044  * entry - In,  pass in (&sfmmu_ctxs[mmuid] - SFMMU_CTXS) from the caller.
2045  * gnum - Out, return sfmmu gnum
2046  * cnum - Out, return sfmmu cnum
2047  * reg  - scratch
2048  */
2049 #define SFMMU_MMUID_GNUM_CNUM(entry, gnum, cnum, reg)                        \
2050         ldx     [entry + SFMMU_CTXS], reg;  /* reg = sfmmu (gnum | cnum) */  \
2051         srlx    reg, SFMMU_MMU_GNUM_RSHIFT, gnum;    /* gnum = sfmmu gnum */ \
2052         sllx    reg, SFMMU_MMU_CNUM_LSHIFT, cnum;                            \
2053         srlx    cnum, SFMMU_MMU_CNUM_LSHIFT, cnum;   /* cnum = sfmmu cnum */
2054 
2055 /*
2056  * Macro to get this CPU's tsbmiss area.
2057  */
2058 #define CPU_TSBMISS_AREA(tsbmiss, tmp1)                                 \
2059         CPU_INDEX(tmp1, tsbmiss);               /* tmp1 = cpu idx */    \
2060         sethi   %hi(tsbmiss_area), tsbmiss;     /* tsbmiss base ptr */  \
2061         mulx    tmp1, TSBMISS_SIZE, tmp1;       /* byte offset */       \
2062         or      tsbmiss, %lo(tsbmiss_area), tsbmiss;                    \
2063         add     tsbmiss, tmp1, tsbmiss          /* tsbmiss area of CPU */
2064 
2065 
2066 /*
2067  * Macro to set kernel context + page size codes in DMMU primary context
2068  * register. It is only necessary for sun4u because sun4v does not need
2069  * page size codes
2070  */
2071 #ifdef sun4v
2072 
2073 #define SET_KCONTEXTREG(reg0, reg1, reg2, reg3, reg4, label1, label2, label3)
2074 
2075 #else
2076 
2077 #define SET_KCONTEXTREG(reg0, reg1, reg2, reg3, reg4, label1, label2, label3) \
2078         sethi   %hi(kcontextreg), reg0;                                 \
2079         ldx     [reg0 + %lo(kcontextreg)], reg0;                        \
2080         mov     MMU_PCONTEXT, reg1;                                     \
2081         ldxa    [reg1]ASI_MMU_CTX, reg2;                                \
2082         xor     reg0, reg2, reg2;                                       \
2083         brz     reg2, label3;                                           \
2084         srlx    reg2, CTXREG_NEXT_SHIFT, reg2;                          \
2085         rdpr    %pstate, reg3;          /* disable interrupts */        \
2086         btst    PSTATE_IE, reg3;                                        \
2087 /*CSTYLED*/                                                             \
2088         bnz,a,pt %icc, label1;                                          \
2089         wrpr    reg3, PSTATE_IE, %pstate;                               \
2090 /*CSTYLED*/                                                             \
2091 label1:;                                                                \
2092         brz     reg2, label2;      /* need demap if N_pgsz0/1 change */ \
2093         sethi   %hi(FLUSH_ADDR), reg4;                                  \
2094         mov     DEMAP_ALL_TYPE, reg2;                                   \
2095         stxa    %g0, [reg2]ASI_DTLB_DEMAP;                              \
2096         stxa    %g0, [reg2]ASI_ITLB_DEMAP;                              \
2097 /*CSTYLED*/                                                             \
2098 label2:;                                                                \
2099         stxa    reg0, [reg1]ASI_MMU_CTX;                                \
2100         flush   reg4;                                                   \
2101         btst    PSTATE_IE, reg3;                                        \
2102 /*CSTYLED*/                                                             \
2103         bnz,a,pt %icc, label3;                                          \
2104         wrpr    %g0, reg3, %pstate;     /* restore interrupt state */   \
2105 label3:;
2106 
2107 #endif
2108 
2109 /*
2110  * Macro to setup arguments with kernel sfmmup context + page size before
2111  * calling sfmmu_setctx_sec()
2112  */
2113 #ifdef sun4v
2114 #define SET_KAS_CTXSEC_ARGS(sfmmup, arg0, arg1)                 \
2115         set     KCONTEXT, arg0;                                 \
2116         set     0, arg1;
2117 #else
2118 #define SET_KAS_CTXSEC_ARGS(sfmmup, arg0, arg1)                 \
2119         ldub    [sfmmup + SFMMU_CEXT], arg1;                    \
2120         set     KCONTEXT, arg0;                                 \
2121         sll     arg1, CTXREG_EXT_SHIFT, arg1;
2122 #endif
2123 
2124 #define PANIC_IF_INTR_DISABLED_PSTR(pstatereg, label, scr)              \
2125         andcc   pstatereg, PSTATE_IE, %g0;      /* panic if intrs */    \
2126 /*CSTYLED*/                                                             \
2127         bnz,pt  %icc, label;                    /* already disabled */  \
2128         nop;                                                            \
2129                                                                         \
2130         sethi   %hi(panicstr), scr;                                     \
2131         ldx     [scr + %lo(panicstr)], scr;                             \
2132         tst     scr;                                                    \
2133 /*CSTYLED*/                                                             \
2134         bnz,pt  %xcc, label;                                            \
2135         nop;                                                            \
2136                                                                         \
2137         save    %sp, -SA(MINFRAME), %sp;                                \
2138         sethi   %hi(sfmmu_panic1), %o0;                                 \
2139         call    panic;                                                  \
2140         or      %o0, %lo(sfmmu_panic1), %o0;                            \
2141 /*CSTYLED*/                                                             \
2142 label:
2143 
2144 #define PANIC_IF_INTR_ENABLED_PSTR(label, scr)                          \
2145         /*                                                              \
2146          * The caller must have disabled interrupts.                    \
2147          * If interrupts are not disabled, panic                        \
2148          */                                                             \
2149         rdpr    %pstate, scr;                                           \
2150         andcc   scr, PSTATE_IE, %g0;                                    \
2151 /*CSTYLED*/                                                             \
2152         bz,pt   %icc, label;                                            \
2153         nop;                                                            \
2154                                                                         \
2155         sethi   %hi(panicstr), scr;                                     \
2156         ldx     [scr + %lo(panicstr)], scr;                             \
2157         tst     scr;                                                    \
2158 /*CSTYLED*/                                                             \
2159         bnz,pt  %xcc, label;                                            \
2160         nop;                                                            \
2161                                                                         \
2162         sethi   %hi(sfmmu_panic6), %o0;                                 \
2163         call    panic;                                                  \
2164         or      %o0, %lo(sfmmu_panic6), %o0;                            \
2165 /*CSTYLED*/                                                             \
2166 label:
2167 
2168 #endif  /* _ASM */
2169 
2170 #ifndef _ASM
2171 
2172 #ifdef VAC
2173 /*
2174  * Page coloring
2175  * The p_vcolor field of the page struct (1 byte) is used to store the
2176  * virtual page color.  This provides for 255 colors.  The value zero is
2177  * used to mean the page has no color - never been mapped or somehow
2178  * purified.
2179  */
2180 
2181 #define PP_GET_VCOLOR(pp)       (((pp)->p_vcolor) - 1)
2182 #define PP_NEWPAGE(pp)          (!(pp)->p_vcolor)
2183 #define PP_SET_VCOLOR(pp, color)                                          \
2184         ((pp)->p_vcolor = ((color) + 1))
2185 
2186 /*
2187  * As mentioned p_vcolor == 0 means there is no color for this page.
2188  * But PP_SET_VCOLOR(pp, color) expects 'color' to be real color minus
2189  * one so we define this constant.
2190  */
2191 #define NO_VCOLOR       (-1)
2192 
2193 #define addr_to_vcolor(addr) \
2194         (((uint_t)(uintptr_t)(addr) >> MMU_PAGESHIFT) & vac_colors_mask)
2195 #else   /* VAC */
2196 #define addr_to_vcolor(addr)    (0)
2197 #endif  /* VAC */
2198 
2199 /*
2200  * The field p_index in the psm page structure is for large pages support.
2201  * P_index is a bit-vector of the different mapping sizes that a given page
2202  * is part of. An hme structure for a large mapping is only added in the
2203  * group leader page (first page). All pages covered by a given large mapping
2204  * have the corrosponding mapping bit set in their p_index field. This allows
2205  * us to only store an explicit hme structure in the leading page which
2206  * simplifies the mapping link list management. Furthermore, it provides us
2207  * a fast mechanism for determining the largest mapping a page is part of. For
2208  * exmaple, a page with a 64K and a 4M mappings has a p_index value of 0x0A.
2209  *
2210  * Implementation note: even though the first bit in p_index is reserved
2211  * for 8K mappings, it is NOT USED by the code and SHOULD NOT be set.
2212  * In addition, the upper four bits of the p_index field are used by the
2213  * code as temporaries
2214  */
2215 
2216 /*
2217  * Defines for psm page struct fields and large page support
2218  */
2219 #define SFMMU_INDEX_SHIFT               6
2220 #define SFMMU_INDEX_MASK                ((1 << SFMMU_INDEX_SHIFT) - 1)
2221 
2222 /* Return the mapping index */
2223 #define PP_MAPINDEX(pp) ((pp)->p_index & SFMMU_INDEX_MASK)
2224 
2225 /*
2226  * These macros rely on the following property:
2227  * All pages constituting a large page are covered by a virtually
2228  * contiguous set of page_t's.
2229  */
2230 
2231 /* Return the leader for this mapping size */
2232 #define PP_GROUPLEADER(pp, sz) \
2233         (&(pp)[-(int)(pp->p_pagenum & (TTEPAGES(sz)-1))])
2234 
2235 /* Return the root page for this page based on p_szc */
2236 #define PP_PAGEROOT(pp) ((pp)->p_szc == 0 ? (pp) : \
2237         PP_GROUPLEADER((pp), (pp)->p_szc))
2238 
2239 #define PP_PAGENEXT_N(pp, n)    ((pp) + (n))
2240 #define PP_PAGENEXT(pp)         PP_PAGENEXT_N((pp), 1)
2241 
2242 #define PP_PAGEPREV_N(pp, n)    ((pp) - (n))
2243 #define PP_PAGEPREV(pp)         PP_PAGEPREV_N((pp), 1)
2244 
2245 #define PP_ISMAPPED_LARGE(pp)   (PP_MAPINDEX(pp) != 0)
2246 
2247 /* Need function to test the page mappping which takes p_index into account */
2248 #define PP_ISMAPPED(pp) ((pp)->p_mapping || PP_ISMAPPED_LARGE(pp))
2249 
2250 /*
2251  * Don't call this macro with sz equal to zero. 8K mappings SHOULD NOT
2252  * set p_index field.
2253  */
2254 #define PAGESZ_TO_INDEX(sz)     (1 << (sz))
2255 
2256 
2257 /*
2258  * prototypes for hat assembly routines.  Some of these are
2259  * known to machine dependent VM code.
2260  */
2261 extern uint64_t sfmmu_make_tsbtag(caddr_t);
2262 extern struct tsbe *
2263                 sfmmu_get_tsbe(uint64_t, caddr_t, int, int);
2264 extern void     sfmmu_load_tsbe(struct tsbe *, uint64_t, tte_t *, int);
2265 extern void     sfmmu_unload_tsbe(struct tsbe *, uint64_t, int);
2266 extern void     sfmmu_load_mmustate(sfmmu_t *);
2267 extern void     sfmmu_raise_tsb_exception(uint64_t, uint64_t);
2268 #ifndef sun4v
2269 extern void     sfmmu_itlb_ld_kva(caddr_t, tte_t *);
2270 extern void     sfmmu_dtlb_ld_kva(caddr_t, tte_t *);
2271 #endif /* sun4v */
2272 extern void     sfmmu_copytte(tte_t *, tte_t *);
2273 extern int      sfmmu_modifytte(tte_t *, tte_t *, tte_t *);
2274 extern int      sfmmu_modifytte_try(tte_t *, tte_t *, tte_t *);
2275 extern pfn_t    sfmmu_ttetopfn(tte_t *, caddr_t);
2276 extern uint_t   sfmmu_disable_intrs(void);
2277 extern void     sfmmu_enable_intrs(uint_t);
2278 /*
2279  * functions exported to machine dependent VM code
2280  */
2281 extern void     sfmmu_patch_ktsb(void);
2282 #ifndef UTSB_PHYS
2283 extern void     sfmmu_patch_utsb(void);
2284 #endif /* UTSB_PHYS */
2285 extern pfn_t    sfmmu_vatopfn(caddr_t, sfmmu_t *, tte_t *);
2286 extern void     sfmmu_vatopfn_suspended(caddr_t, sfmmu_t *, tte_t *);
2287 extern pfn_t    sfmmu_kvaszc2pfn(caddr_t, int);
2288 #ifdef  DEBUG
2289 extern void     sfmmu_check_kpfn(pfn_t);
2290 #else
2291 #define         sfmmu_check_kpfn(pfn)   /* disabled */
2292 #endif  /* DEBUG */
2293 extern void     sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
2294 extern void     sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *, uint_t);
2295 extern void     sfmmu_tsbmiss_exception(struct regs *, uintptr_t, uint_t);
2296 extern void     sfmmu_init_tsbs(void);
2297 extern caddr_t  sfmmu_ktsb_alloc(caddr_t);
2298 extern int      sfmmu_getctx_pri(void);
2299 extern int      sfmmu_getctx_sec(void);
2300 extern void     sfmmu_setctx_sec(uint_t);
2301 extern void     sfmmu_inv_tsb(caddr_t, uint_t);
2302 extern void     sfmmu_init_ktsbinfo(void);
2303 extern int      sfmmu_setup_4lp(void);
2304 extern void     sfmmu_patch_mmu_asi(int);
2305 extern void     sfmmu_init_nucleus_hblks(caddr_t, size_t, int, int);
2306 extern void     sfmmu_cache_flushall(void);
2307 extern pgcnt_t  sfmmu_tte_cnt(sfmmu_t *, uint_t);
2308 extern void     *sfmmu_tsb_segkmem_alloc(vmem_t *, size_t, int);
2309 extern void     sfmmu_tsb_segkmem_free(vmem_t *, void *, size_t);
2310 extern void     sfmmu_reprog_pgsz_arr(sfmmu_t *, uint8_t *);
2311 
2312 extern void     hat_kern_setup(void);
2313 extern int      hat_page_relocate(page_t **, page_t **, spgcnt_t *);
2314 extern int      sfmmu_get_ppvcolor(struct page *);
2315 extern int      sfmmu_get_addrvcolor(caddr_t);
2316 extern int      sfmmu_hat_lock_held(sfmmu_t *);
2317 extern int      sfmmu_alloc_ctx(sfmmu_t *, int, struct cpu *, int);
2318 
2319 /*
2320  * Functions exported to xhat_sfmmu.c
2321  */
2322 extern kmutex_t *sfmmu_mlist_enter(page_t *);
2323 extern void     sfmmu_mlist_exit(kmutex_t *);
2324 extern int      sfmmu_mlist_held(struct page *);
2325 extern struct hme_blk *sfmmu_hmetohblk(struct sf_hment *);
2326 
2327 /*
2328  * MMU-specific functions optionally imported from the CPU module
2329  */
2330 #pragma weak mmu_init_scd
2331 #pragma weak mmu_large_pages_disabled
2332 #pragma weak mmu_set_ctx_page_sizes
2333 #pragma weak mmu_check_page_sizes
2334 
2335 extern void mmu_init_scd(sf_scd_t *);
2336 extern uint_t mmu_large_pages_disabled(uint_t);
2337 extern void mmu_set_ctx_page_sizes(sfmmu_t *);
2338 extern void mmu_check_page_sizes(sfmmu_t *, uint64_t *);
2339 
2340 extern sfmmu_t          *ksfmmup;
2341 extern caddr_t          ktsb_base;
2342 extern uint64_t         ktsb_pbase;
2343 extern int              ktsb_sz;
2344 extern int              ktsb_szcode;
2345 extern caddr_t          ktsb4m_base;
2346 extern uint64_t         ktsb4m_pbase;
2347 extern int              ktsb4m_sz;
2348 extern int              ktsb4m_szcode;
2349 extern uint64_t         kpm_tsbbase;
2350 extern int              kpm_tsbsz;
2351 extern int              ktsb_phys;
2352 extern int              enable_bigktsb;
2353 #ifndef sun4v
2354 extern int              utsb_dtlb_ttenum;
2355 extern int              utsb4m_dtlb_ttenum;
2356 #endif /* sun4v */
2357 extern int              uhmehash_num;
2358 extern int              khmehash_num;
2359 extern struct hmehash_bucket *uhme_hash;
2360 extern struct hmehash_bucket *khme_hash;
2361 extern uint_t           hblk_alloc_dynamic;
2362 extern struct tsbmiss   tsbmiss_area[NCPU];
2363 extern struct kpmtsbm   kpmtsbm_area[NCPU];
2364 
2365 #ifndef sun4v
2366 extern int              dtlb_resv_ttenum;
2367 extern caddr_t          utsb_vabase;
2368 extern caddr_t          utsb4m_vabase;
2369 #endif /* sun4v */
2370 extern vmem_t           *kmem_tsb_default_arena[];
2371 extern int              tsb_lgrp_affinity;
2372 
2373 extern uint_t           disable_large_pages;
2374 extern uint_t           disable_ism_large_pages;
2375 extern uint_t           disable_auto_data_large_pages;
2376 extern uint_t           disable_auto_text_large_pages;
2377 
2378 /* kpm externals */
2379 extern pfn_t            sfmmu_kpm_vatopfn(caddr_t);
2380 extern void             sfmmu_kpm_patch_tlbm(void);
2381 extern void             sfmmu_kpm_patch_tsbm(void);
2382 extern void             sfmmu_patch_shctx(void);
2383 extern void             sfmmu_kpm_load_tsb(caddr_t, tte_t *, int);
2384 extern void             sfmmu_kpm_unload_tsb(caddr_t, int);
2385 extern void             sfmmu_kpm_tsbmtl(short *, uint_t *, int);
2386 extern int              sfmmu_kpm_stsbmtl(uchar_t *, uint_t *, int);
2387 extern caddr_t          kpm_vbase;
2388 extern size_t           kpm_size;
2389 extern struct memseg    *memseg_hash[];
2390 extern uint64_t         memseg_phash[];
2391 extern kpm_hlk_t        *kpmp_table;
2392 extern kpm_shlk_t       *kpmp_stable;
2393 extern uint_t           kpmp_table_sz;
2394 extern uint_t           kpmp_stable_sz;
2395 extern uchar_t          kpmp_shift;
2396 
2397 #define PP_ISMAPPED_KPM(pp)     ((pp)->p_kpmref > 0)
2398 
2399 #define IS_KPM_ALIAS_RANGE(vaddr)                                       \
2400         (((vaddr) - kpm_vbase) >> (uintptr_t)kpm_size_shift > 0)
2401 
2402 #endif /* !_ASM */
2403 
2404 /* sfmmu_kpm_tsbmtl flags */
2405 #define KPMTSBM_STOP            0
2406 #define KPMTSBM_START           1
2407 
2408 /*
2409  * For kpm_smallpages, the state about how a kpm page is mapped and whether
2410  * it is ready to go is indicated by the two 4-bit fields defined in the
2411  * kpm_spage structure as follows:
2412  * kp_mapped_flag bit[0:3] - the page is mapped cacheable or not
2413  * kp_mapped_flag bit[4:7] - the mapping is ready to go or not
2414  * If the bit KPM_MAPPED_GO is on, it indicates that the assembly tsb miss
2415  * handler can drop the mapping in regardless of the caching state of the
2416  * mapping. Otherwise, we will have C handler resolve the VAC conflict no
2417  * matter the page is currently mapped cacheable or non-cacheable.
2418  */
2419 #define KPM_MAPPEDS             0x1     /* small mapping valid, no conflict */
2420 #define KPM_MAPPEDSC            0x2     /* small mapping valid, conflict */
2421 #define KPM_MAPPED_GO           0x10    /* the mapping is ready to go */
2422 #define KPM_MAPPED_MASK         0xf
2423 
2424 /* Physical memseg address NULL marker */
2425 #define MSEG_NULLPTR_PA         -1
2426 
2427 /*
2428  * Memseg hash defines for kpm trap level tsbmiss handler.
2429  * Must be in sync w/ page.h .
2430  */
2431 #define SFMMU_MEM_HASH_SHIFT            0x9
2432 #define SFMMU_N_MEM_SLOTS               0x200
2433 #define SFMMU_MEM_HASH_ENTRY_SHIFT      3
2434 
2435 #ifndef _ASM
2436 #if (SFMMU_MEM_HASH_SHIFT != MEM_HASH_SHIFT)
2437 #error SFMMU_MEM_HASH_SHIFT != MEM_HASH_SHIFT
2438 #endif
2439 #if (SFMMU_N_MEM_SLOTS != N_MEM_SLOTS)
2440 #error SFMMU_N_MEM_SLOTS != N_MEM_SLOTS
2441 #endif
2442 
2443 /* Physical memseg address NULL marker */
2444 #define SFMMU_MEMSEG_NULLPTR_PA         -1
2445 
2446 /*
2447  * Check KCONTEXT to be zero, asm parts depend on that assumption.
2448  */
2449 #if (KCONTEXT != 0)
2450 #error KCONTEXT != 0
2451 #endif
2452 #endif  /* !_ASM */
2453 
2454 
2455 #endif /* _KERNEL */
2456 
2457 #ifndef _ASM
2458 /*
2459  * ctx, hmeblk, mlistlock and other stats for sfmmu
2460  */
2461 struct sfmmu_global_stat {
2462         int             sf_tsb_exceptions;      /* # of tsb exceptions */
2463         int             sf_tsb_raise_exception; /* # tsb exc. w/o TLB flush */
2464 
2465         int             sf_pagefaults;          /* # of pagefaults */
2466 
2467         int             sf_uhash_searches;      /* # of user hash searches */
2468         int             sf_uhash_links;         /* # of user hash links */
2469         int             sf_khash_searches;      /* # of kernel hash searches */
2470         int             sf_khash_links;         /* # of kernel hash links */
2471 
2472         int             sf_swapout;             /* # times hat swapped out */
2473 
2474         int             sf_tsb_alloc;           /* # TSB allocations */
2475         int             sf_tsb_allocfail;       /* # times TSB alloc fail */
2476         int             sf_tsb_sectsb_create;   /* # times second TSB added */
2477 
2478         int             sf_scd_1sttsb_alloc;    /* # SCD 1st TSB allocations */
2479         int             sf_scd_2ndtsb_alloc;    /* # SCD 2nd TSB allocations */
2480         int             sf_scd_1sttsb_allocfail; /* # SCD 1st TSB alloc fail */
2481         int             sf_scd_2ndtsb_allocfail; /* # SCD 2nd TSB alloc fail */
2482 
2483 
2484         int             sf_tteload8k;           /* calls to sfmmu_tteload */
2485         int             sf_tteload64k;          /* calls to sfmmu_tteload */
2486         int             sf_tteload512k;         /* calls to sfmmu_tteload */
2487         int             sf_tteload4m;           /* calls to sfmmu_tteload */
2488         int             sf_tteload32m;          /* calls to sfmmu_tteload */
2489         int             sf_tteload256m;         /* calls to sfmmu_tteload */
2490 
2491         int             sf_tsb_load8k;          /* # times loaded 8K tsbent */
2492         int             sf_tsb_load4m;          /* # times loaded 4M tsbent */
2493 
2494         int             sf_hblk_hit;            /* found hblk during tteload */
2495         int             sf_hblk8_ncreate;       /* static hblk8's created */
2496         int             sf_hblk8_nalloc;        /* static hblk8's allocated */
2497         int             sf_hblk1_ncreate;       /* static hblk1's created */
2498         int             sf_hblk1_nalloc;        /* static hblk1's allocated */
2499         int             sf_hblk_slab_cnt;       /* sfmmu8_cache slab creates */
2500         int             sf_hblk_reserve_cnt;    /* hblk_reserve usage */
2501         int             sf_hblk_recurse_cnt;    /* hblk_reserve owner reqs */
2502         int             sf_hblk_reserve_hit;    /* hblk_reserve hash hits */
2503         int             sf_get_free_success;    /* reserve list allocs */
2504         int             sf_get_free_throttle;   /* fails due to throttling */
2505         int             sf_get_free_fail;       /* fails due to empty list */
2506         int             sf_put_free_success;    /* reserve list frees */
2507         int             sf_put_free_fail;       /* fails due to full list */
2508 
2509         int             sf_pgcolor_conflict;    /* VAC conflict resolution */
2510         int             sf_uncache_conflict;    /* VAC conflict resolution */
2511         int             sf_unload_conflict;     /* VAC unload resolution */
2512         int             sf_ism_uncache;         /* VAC conflict resolution */
2513         int             sf_ism_recache;         /* VAC conflict resolution */
2514         int             sf_recache;             /* VAC conflict resolution */
2515 
2516         int             sf_steal_count;         /* # of hblks stolen */
2517 
2518         int             sf_pagesync;            /* # of pagesyncs */
2519         int             sf_clrwrt;              /* # of clear write perms */
2520         int             sf_pagesync_invalid;    /* pagesync with inv tte */
2521 
2522         int             sf_kernel_xcalls;       /* # of kernel cross calls */
2523         int             sf_user_xcalls;         /* # of user cross calls */
2524 
2525         int             sf_tsb_grow;            /* # of user tsb grows */
2526         int             sf_tsb_shrink;          /* # of user tsb shrinks */
2527         int             sf_tsb_resize_failures; /* # of user tsb resize */
2528         int             sf_tsb_reloc;           /* # of user tsb relocations */
2529 
2530         int             sf_user_vtop;           /* # of user vatopfn calls */
2531 
2532         int             sf_ctx_inv;             /* #times invalidate MMU ctx */
2533 
2534         int             sf_tlb_reprog_pgsz;     /* # times switch TLB pgsz */
2535 
2536         int             sf_region_remap_demap;  /* # times shme remap demap */
2537 
2538         int             sf_create_scd;          /* # times SCD is created */
2539         int             sf_join_scd;            /* # process joined scd */
2540         int             sf_leave_scd;           /* # process left scd */
2541         int             sf_destroy_scd;         /* # times SCD is destroyed */
2542 };
2543 
2544 struct sfmmu_tsbsize_stat {
2545         int             sf_tsbsz_8k;
2546         int             sf_tsbsz_16k;
2547         int             sf_tsbsz_32k;
2548         int             sf_tsbsz_64k;
2549         int             sf_tsbsz_128k;
2550         int             sf_tsbsz_256k;
2551         int             sf_tsbsz_512k;
2552         int             sf_tsbsz_1m;
2553         int             sf_tsbsz_2m;
2554         int             sf_tsbsz_4m;
2555         int             sf_tsbsz_8m;
2556         int             sf_tsbsz_16m;
2557         int             sf_tsbsz_32m;
2558         int             sf_tsbsz_64m;
2559         int             sf_tsbsz_128m;
2560         int             sf_tsbsz_256m;
2561 };
2562 
2563 struct sfmmu_percpu_stat {
2564         int     sf_itlb_misses;         /* # of itlb misses */
2565         int     sf_dtlb_misses;         /* # of dtlb misses */
2566         int     sf_utsb_misses;         /* # of user tsb misses */
2567         int     sf_ktsb_misses;         /* # of kernel tsb misses */
2568         int     sf_tsb_hits;            /* # of tsb hits */
2569         int     sf_umod_faults;         /* # of mod (prot viol) flts */
2570         int     sf_kmod_faults;         /* # of mod (prot viol) flts */
2571 };
2572 
2573 #define SFMMU_STAT(stat)                sfmmu_global_stat.stat++
2574 #define SFMMU_STAT_ADD(stat, amount)    sfmmu_global_stat.stat += (amount)
2575 #define SFMMU_STAT_SET(stat, count)     sfmmu_global_stat.stat = (count)
2576 
2577 #define SFMMU_MMU_STAT(stat)            {               \
2578         mmu_ctx_t *ctx = CPU->cpu_m.cpu_mmu_ctxp;    \
2579         if (ctx)                                        \
2580                 ctx->stat++;                         \
2581 }
2582 
2583 #endif /* !_ASM */
2584 
2585 #ifdef  __cplusplus
2586 }
2587 #endif
2588 
2589 #endif  /* _VM_HAT_SFMMU_H */