1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 /*
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  */
  27 
  28 /*
  29  * VM - Hardware Address Translation management for Spitfire MMU.
  30  *
  31  * This file implements the machine specific hardware translation
  32  * needed by the VM system.  The machine independent interface is
  33  * described in <vm/hat.h> while the machine dependent interface
  34  * and data structures are described in <vm/hat_sfmmu.h>.
  35  *
  36  * The hat layer manages the address translation hardware as a cache
  37  * driven by calls from the higher levels in the VM system.
  38  */
  39 
  40 #include <sys/types.h>
  41 #include <sys/kstat.h>
  42 #include <vm/hat.h>
  43 #include <vm/hat_sfmmu.h>
  44 #include <vm/page.h>
  45 #include <sys/pte.h>
  46 #include <sys/systm.h>
  47 #include <sys/mman.h>
  48 #include <sys/sysmacros.h>
  49 #include <sys/machparam.h>
  50 #include <sys/vtrace.h>
  51 #include <sys/kmem.h>
  52 #include <sys/mmu.h>
  53 #include <sys/cmn_err.h>
  54 #include <sys/cpu.h>
  55 #include <sys/cpuvar.h>
  56 #include <sys/debug.h>
  57 #include <sys/lgrp.h>
  58 #include <sys/archsystm.h>
  59 #include <sys/machsystm.h>
  60 #include <sys/vmsystm.h>
  61 #include <vm/as.h>
  62 #include <vm/seg.h>
  63 #include <vm/seg_kp.h>
  64 #include <vm/seg_kmem.h>
  65 #include <vm/seg_kpm.h>
  66 #include <vm/rm.h>
  67 #include <sys/t_lock.h>
  68 #include <sys/obpdefs.h>
  69 #include <sys/vm_machparam.h>
  70 #include <sys/var.h>
  71 #include <sys/trap.h>
  72 #include <sys/machtrap.h>
  73 #include <sys/scb.h>
  74 #include <sys/bitmap.h>
  75 #include <sys/machlock.h>
  76 #include <sys/membar.h>
  77 #include <sys/atomic.h>
  78 #include <sys/cpu_module.h>
  79 #include <sys/prom_debug.h>
  80 #include <sys/ksynch.h>
  81 #include <sys/mem_config.h>
  82 #include <sys/mem_cage.h>
  83 #include <vm/vm_dep.h>
  84 #include <sys/fpu/fpusystm.h>
  85 #include <vm/mach_kpm.h>
  86 #include <sys/callb.h>
  87 
  88 #ifdef  DEBUG
  89 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)                     \
  90         if (SFMMU_IS_SHMERID_VALID(rid)) {                              \
  91                 caddr_t _eaddr = (saddr) + (len);                       \
  92                 sf_srd_t *_srdp;                                        \
  93                 sf_region_t *_rgnp;                                     \
  94                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                       \
  95                 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid));       \
  96                 ASSERT((hat) != ksfmmup);                               \
  97                 _srdp = (hat)->sfmmu_srdp;                           \
  98                 ASSERT(_srdp != NULL);                                  \
  99                 ASSERT(_srdp->srd_refcnt != 0);                              \
 100                 _rgnp = _srdp->srd_hmergnp[(rid)];                   \
 101                 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid);               \
 102                 ASSERT(_rgnp->rgn_refcnt != 0);                              \
 103                 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
 104                 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 105                     SFMMU_REGION_HME);                                  \
 106                 ASSERT((saddr) >= _rgnp->rgn_saddr);                      \
 107                 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 108                 ASSERT(_eaddr > _rgnp->rgn_saddr);                        \
 109                 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 110         }
 111 
 112 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)              \
 113 {                                                                        \
 114                 caddr_t _hsva;                                           \
 115                 caddr_t _heva;                                           \
 116                 caddr_t _rsva;                                           \
 117                 caddr_t _reva;                                           \
 118                 int     _ttesz = get_hblk_ttesz(hmeblkp);                \
 119                 int     _flagtte;                                        \
 120                 ASSERT((srdp)->srd_refcnt != 0);                      \
 121                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                        \
 122                 ASSERT((rgnp)->rgn_id == rid);                                \
 123                 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE));         \
 124                 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 125                     SFMMU_REGION_HME);                                   \
 126                 ASSERT(_ttesz <= (rgnp)->rgn_pgszc);                       \
 127                 _hsva = (caddr_t)get_hblk_base(hmeblkp);                 \
 128                 _heva = get_hblk_endaddr(hmeblkp);                       \
 129                 _rsva = (caddr_t)P2ALIGN(                                \
 130                     (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES);    \
 131                 _reva = (caddr_t)P2ROUNDUP(                              \
 132                     (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size),     \
 133                     HBLK_MIN_BYTES);                                     \
 134                 ASSERT(_hsva >= _rsva);                                       \
 135                 ASSERT(_hsva < _reva);                                        \
 136                 ASSERT(_heva > _rsva);                                        \
 137                 ASSERT(_heva <= _reva);                                       \
 138                 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ :  \
 139                         _ttesz;                                          \
 140                 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte));             \
 141 }
 142 
 143 #else /* DEBUG */
 144 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
 145 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
 146 #endif /* DEBUG */
 147 
 148 #if defined(SF_ERRATA_57)
 149 extern caddr_t errata57_limit;
 150 #endif
 151 
 152 #define HME8BLK_SZ_RND          ((roundup(HME8BLK_SZ, sizeof (int64_t))) /  \
 153                                 (sizeof (int64_t)))
 154 #define HBLK_RESERVE            ((struct hme_blk *)hblk_reserve)
 155 
 156 #define HBLK_RESERVE_CNT        128
 157 #define HBLK_RESERVE_MIN        20
 158 
 159 static struct hme_blk           *freehblkp;
 160 static kmutex_t                 freehblkp_lock;
 161 static int                      freehblkcnt;
 162 
 163 static int64_t                  hblk_reserve[HME8BLK_SZ_RND];
 164 static kmutex_t                 hblk_reserve_lock;
 165 static kthread_t                *hblk_reserve_thread;
 166 
 167 static nucleus_hblk8_info_t     nucleus_hblk8;
 168 static nucleus_hblk1_info_t     nucleus_hblk1;
 169 
 170 /*
 171  * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
 172  * after the initial phase of removing an hmeblk from the hash chain, see
 173  * the detailed comment in sfmmu_hblk_hash_rm() for further details.
 174  */
 175 static cpu_hme_pend_t           *cpu_hme_pend;
 176 static uint_t                   cpu_hme_pend_thresh;
 177 /*
 178  * SFMMU specific hat functions
 179  */
 180 void    hat_pagecachectl(struct page *, int);
 181 
 182 /* flags for hat_pagecachectl */
 183 #define HAT_CACHE       0x1
 184 #define HAT_UNCACHE     0x2
 185 #define HAT_TMPNC       0x4
 186 
 187 /*
 188  * Flag to allow the creation of non-cacheable translations
 189  * to system memory. It is off by default. At the moment this
 190  * flag is used by the ecache error injector. The error injector
 191  * will turn it on when creating such a translation then shut it
 192  * off when it's finished.
 193  */
 194 
 195 int     sfmmu_allow_nc_trans = 0;
 196 
 197 /*
 198  * Flag to disable large page support.
 199  *      value of 1 => disable all large pages.
 200  *      bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
 201  *
 202  * For example, use the value 0x4 to disable 512K pages.
 203  *
 204  */
 205 #define LARGE_PAGES_OFF         0x1
 206 
 207 /*
 208  * The disable_large_pages and disable_ism_large_pages variables control
 209  * hat_memload_array and the page sizes to be used by ISM and the kernel.
 210  *
 211  * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
 212  * are only used to control which OOB pages to use at upper VM segment creation
 213  * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
 214  * Their values may come from platform or CPU specific code to disable page
 215  * sizes that should not be used.
 216  *
 217  * WARNING: 512K pages are currently not supported for ISM/DISM.
 218  */
 219 uint_t  disable_large_pages = 0;
 220 uint_t  disable_ism_large_pages = (1 << TTE512K);
 221 uint_t  disable_auto_data_large_pages = 0;
 222 uint_t  disable_auto_text_large_pages = 0;
 223 
 224 /*
 225  * Private sfmmu data structures for hat management
 226  */
 227 static struct kmem_cache *sfmmuid_cache;
 228 static struct kmem_cache *mmuctxdom_cache;
 229 
 230 /*
 231  * Private sfmmu data structures for tsb management
 232  */
 233 static struct kmem_cache *sfmmu_tsbinfo_cache;
 234 static struct kmem_cache *sfmmu_tsb8k_cache;
 235 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
 236 static vmem_t *kmem_bigtsb_arena;
 237 static vmem_t *kmem_tsb_arena;
 238 
 239 /*
 240  * sfmmu static variables for hmeblk resource management.
 241  */
 242 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
 243 static struct kmem_cache *sfmmu8_cache;
 244 static struct kmem_cache *sfmmu1_cache;
 245 static struct kmem_cache *pa_hment_cache;
 246 
 247 static kmutex_t         ism_mlist_lock; /* mutex for ism mapping list */
 248 /*
 249  * private data for ism
 250  */
 251 static struct kmem_cache *ism_blk_cache;
 252 static struct kmem_cache *ism_ment_cache;
 253 #define ISMID_STARTADDR NULL
 254 
 255 /*
 256  * Region management data structures and function declarations.
 257  */
 258 
 259 static void     sfmmu_leave_srd(sfmmu_t *);
 260 static int      sfmmu_srdcache_constructor(void *, void *, int);
 261 static void     sfmmu_srdcache_destructor(void *, void *);
 262 static int      sfmmu_rgncache_constructor(void *, void *, int);
 263 static void     sfmmu_rgncache_destructor(void *, void *);
 264 static int      sfrgnmap_isnull(sf_region_map_t *);
 265 static int      sfhmergnmap_isnull(sf_hmeregion_map_t *);
 266 static int      sfmmu_scdcache_constructor(void *, void *, int);
 267 static void     sfmmu_scdcache_destructor(void *, void *);
 268 static void     sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
 269     size_t, void *, u_offset_t);
 270 
 271 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
 272 static sf_srd_bucket_t *srd_buckets;
 273 static struct kmem_cache *srd_cache;
 274 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
 275 static struct kmem_cache *region_cache;
 276 static struct kmem_cache *scd_cache;
 277 
 278 #ifdef sun4v
 279 int use_bigtsb_arena = 1;
 280 #else
 281 int use_bigtsb_arena = 0;
 282 #endif
 283 
 284 /* External /etc/system tunable, for turning on&off the shctx support */
 285 int disable_shctx = 0;
 286 /* Internal variable, set by MD if the HW supports shctx feature */
 287 int shctx_on = 0;
 288 
 289 #ifdef DEBUG
 290 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
 291 #endif
 292 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
 293 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
 294 
 295 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
 296 static void sfmmu_find_scd(sfmmu_t *);
 297 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
 298 static void sfmmu_finish_join_scd(sfmmu_t *);
 299 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
 300 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
 301 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
 302 static void sfmmu_free_scd_tsbs(sfmmu_t *);
 303 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
 304 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
 305 static void sfmmu_ism_hatflags(sfmmu_t *, int);
 306 static int sfmmu_srd_lock_held(sf_srd_t *);
 307 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
 308 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
 309 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
 310 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
 311 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
 312 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
 313 
 314 /*
 315  * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
 316  * HAT flags, synchronizing TLB/TSB coherency, and context management.
 317  * The lock is hashed on the sfmmup since the case where we need to lock
 318  * all processes is rare but does occur (e.g. we need to unload a shared
 319  * mapping from all processes using the mapping).  We have a lot of buckets,
 320  * and each slab of sfmmu_t's can use about a quarter of them, giving us
 321  * a fairly good distribution without wasting too much space and overhead
 322  * when we have to grab them all.
 323  */
 324 #define SFMMU_NUM_LOCK  128             /* must be power of two */
 325 hatlock_t       hat_lock[SFMMU_NUM_LOCK];
 326 
 327 /*
 328  * Hash algorithm optimized for a small number of slabs.
 329  *  7 is (highbit((sizeof sfmmu_t)) - 1)
 330  * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
 331  * kmem_cache, and thus they will be sequential within that cache.  In
 332  * addition, each new slab will have a different "color" up to cache_maxcolor
 333  * which will skew the hashing for each successive slab which is allocated.
 334  * If the size of sfmmu_t changed to a larger size, this algorithm may need
 335  * to be revisited.
 336  */
 337 #define TSB_HASH_SHIFT_BITS (7)
 338 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
 339 
 340 #ifdef DEBUG
 341 int tsb_hash_debug = 0;
 342 #define TSB_HASH(sfmmup)        \
 343         (tsb_hash_debug ? &hat_lock[0] : \
 344         &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
 345 #else   /* DEBUG */
 346 #define TSB_HASH(sfmmup)        &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
 347 #endif  /* DEBUG */
 348 
 349 
 350 /* sfmmu_replace_tsb() return codes. */
 351 typedef enum tsb_replace_rc {
 352         TSB_SUCCESS,
 353         TSB_ALLOCFAIL,
 354         TSB_LOSTRACE,
 355         TSB_ALREADY_SWAPPED,
 356         TSB_CANTGROW
 357 } tsb_replace_rc_t;
 358 
 359 /*
 360  * Flags for TSB allocation routines.
 361  */
 362 #define TSB_ALLOC       0x01
 363 #define TSB_FORCEALLOC  0x02
 364 #define TSB_GROW        0x04
 365 #define TSB_SHRINK      0x08
 366 #define TSB_SWAPIN      0x10
 367 
 368 /*
 369  * Support for HAT callbacks.
 370  */
 371 #define SFMMU_MAX_RELOC_CALLBACKS       10
 372 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
 373 static id_t sfmmu_cb_nextid = 0;
 374 static id_t sfmmu_tsb_cb_id;
 375 struct sfmmu_callback *sfmmu_cb_table;
 376 
 377 kmutex_t        kpr_mutex;
 378 kmutex_t        kpr_suspendlock;
 379 kthread_t       *kreloc_thread;
 380 
 381 /*
 382  * Enable VA->PA translation sanity checking on DEBUG kernels.
 383  * Disabled by default.  This is incompatible with some
 384  * drivers (error injector, RSM) so if it breaks you get
 385  * to keep both pieces.
 386  */
 387 int hat_check_vtop = 0;
 388 
 389 /*
 390  * Private sfmmu routines (prototypes)
 391  */
 392 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
 393 static struct   hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
 394                         struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
 395                         uint_t);
 396 static caddr_t  sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
 397                         caddr_t, demap_range_t *, uint_t);
 398 static caddr_t  sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
 399                         caddr_t, int);
 400 static void     sfmmu_hblk_free(struct hme_blk **);
 401 static void     sfmmu_hblks_list_purge(struct hme_blk **, int);
 402 static uint_t   sfmmu_get_free_hblk(struct hme_blk **, uint_t);
 403 static uint_t   sfmmu_put_free_hblk(struct hme_blk *, uint_t);
 404 static struct hme_blk *sfmmu_hblk_steal(int);
 405 static int      sfmmu_steal_this_hblk(struct hmehash_bucket *,
 406                         struct hme_blk *, uint64_t, struct hme_blk *);
 407 static caddr_t  sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
 408 
 409 static void     hat_do_memload_array(struct hat *, caddr_t, size_t,
 410                     struct page **, uint_t, uint_t, uint_t);
 411 static void     hat_do_memload(struct hat *, caddr_t, struct page *,
 412                     uint_t, uint_t, uint_t);
 413 static void     sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
 414                     uint_t, uint_t, pgcnt_t, uint_t);
 415 void            sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
 416                         uint_t);
 417 static int      sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
 418                         uint_t, uint_t);
 419 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
 420                                         caddr_t, int, uint_t);
 421 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
 422                         struct hmehash_bucket *, caddr_t, uint_t, uint_t,
 423                         uint_t);
 424 static int      sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
 425                         caddr_t, page_t **, uint_t, uint_t);
 426 static void     sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
 427 
 428 static int      sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
 429 static pfn_t    sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
 430 void            sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
 431 #ifdef VAC
 432 static void     sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
 433 static int      sfmmu_vacconflict_array(caddr_t, page_t *, int *);
 434 int     tst_tnc(page_t *pp, pgcnt_t);
 435 void    conv_tnc(page_t *pp, int);
 436 #endif
 437 
 438 static void     sfmmu_get_ctx(sfmmu_t *);
 439 static void     sfmmu_free_sfmmu(sfmmu_t *);
 440 
 441 static void     sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
 442 static void     sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
 443 
 444 cpuset_t        sfmmu_pageunload(page_t *, struct sf_hment *, int);
 445 static void     hat_pagereload(struct page *, struct page *);
 446 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
 447 #ifdef VAC
 448 void    sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
 449 static void     sfmmu_page_cache(page_t *, int, int, int);
 450 #endif
 451 
 452 cpuset_t        sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
 453     struct hme_blk *, int);
 454 static void     sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 455                         pfn_t, int, int, int, int);
 456 static void     sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 457                         pfn_t, int);
 458 static void     sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
 459 static void     sfmmu_tlb_range_demap(demap_range_t *);
 460 static void     sfmmu_invalidate_ctx(sfmmu_t *);
 461 static void     sfmmu_sync_mmustate(sfmmu_t *);
 462 
 463 static void     sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
 464 static int      sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
 465                         sfmmu_t *);
 466 static void     sfmmu_tsb_free(struct tsb_info *);
 467 static void     sfmmu_tsbinfo_free(struct tsb_info *);
 468 static int      sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
 469                         sfmmu_t *);
 470 static void     sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
 471 static void     sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
 472 static int      sfmmu_select_tsb_szc(pgcnt_t);
 473 static void     sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
 474 #define         sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
 475         sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
 476 #define         sfmmu_unload_tsb(sfmmup, vaddr, szc)    \
 477         sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
 478 static void     sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
 479 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
 480     hatlock_t *, uint_t);
 481 static void     sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
 482 
 483 #ifdef VAC
 484 void    sfmmu_cache_flush(pfn_t, int);
 485 void    sfmmu_cache_flushcolor(int, pfn_t);
 486 #endif
 487 static caddr_t  sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
 488                         caddr_t, demap_range_t *, uint_t, int);
 489 
 490 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
 491 static uint_t   sfmmu_ptov_attr(tte_t *);
 492 static caddr_t  sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
 493                         caddr_t, demap_range_t *, uint_t);
 494 static uint_t   sfmmu_vtop_prot(uint_t, uint_t *);
 495 static int      sfmmu_idcache_constructor(void *, void *, int);
 496 static void     sfmmu_idcache_destructor(void *, void *);
 497 static int      sfmmu_hblkcache_constructor(void *, void *, int);
 498 static void     sfmmu_hblkcache_destructor(void *, void *);
 499 static void     sfmmu_hblkcache_reclaim(void *);
 500 static void     sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
 501                         struct hmehash_bucket *);
 502 static void     sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
 503                         struct hme_blk *, struct hme_blk **, int);
 504 static void     sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
 505                         uint64_t);
 506 static struct hme_blk *sfmmu_check_pending_hblks(int);
 507 static void     sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
 508 static void     sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
 509 static void     sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
 510                         int, caddr_t *);
 511 static void     sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
 512 
 513 static void     sfmmu_rm_large_mappings(page_t *, int);
 514 
 515 static void     hat_lock_init(void);
 516 static void     hat_kstat_init(void);
 517 static int      sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
 518 static void     sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
 519 static  int     sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
 520 static void     sfmmu_check_page_sizes(sfmmu_t *, int);
 521 int     fnd_mapping_sz(page_t *);
 522 static void     iment_add(struct ism_ment *,  struct hat *);
 523 static void     iment_sub(struct ism_ment *, struct hat *);
 524 static pgcnt_t  ism_tsb_entries(sfmmu_t *, int szc);
 525 extern void     sfmmu_setup_tsbinfo(sfmmu_t *);
 526 extern void     sfmmu_clear_utsbinfo(void);
 527 
 528 static void             sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
 529 
 530 extern int vpm_enable;
 531 
 532 /* kpm globals */
 533 #ifdef  DEBUG
 534 /*
 535  * Enable trap level tsbmiss handling
 536  */
 537 int     kpm_tsbmtl = 1;
 538 
 539 /*
 540  * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
 541  * required TLB shootdowns in this case, so handle w/ care. Off by default.
 542  */
 543 int     kpm_tlb_flush;
 544 #endif  /* DEBUG */
 545 
 546 static void     *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
 547 
 548 #ifdef DEBUG
 549 static void     sfmmu_check_hblk_flist();
 550 #endif
 551 
 552 /*
 553  * Semi-private sfmmu data structures.  Some of them are initialize in
 554  * startup or in hat_init. Some of them are private but accessed by
 555  * assembly code or mach_sfmmu.c
 556  */
 557 struct hmehash_bucket *uhme_hash;       /* user hmeblk hash table */
 558 struct hmehash_bucket *khme_hash;       /* kernel hmeblk hash table */
 559 uint64_t        uhme_hash_pa;           /* PA of uhme_hash */
 560 uint64_t        khme_hash_pa;           /* PA of khme_hash */
 561 int             uhmehash_num;           /* # of buckets in user hash table */
 562 int             khmehash_num;           /* # of buckets in kernel hash table */
 563 
 564 uint_t          max_mmu_ctxdoms = 0;    /* max context domains in the system */
 565 mmu_ctx_t       **mmu_ctxs_tbl;         /* global array of context domains */
 566 uint64_t        mmu_saved_gnum = 0;     /* to init incoming MMUs' gnums */
 567 
 568 #define DEFAULT_NUM_CTXS_PER_MMU 8192
 569 static uint_t   nctxs = DEFAULT_NUM_CTXS_PER_MMU;
 570 
 571 int             cache;                  /* describes system cache */
 572 
 573 caddr_t         ktsb_base;              /* kernel 8k-indexed tsb base address */
 574 uint64_t        ktsb_pbase;             /* kernel 8k-indexed tsb phys address */
 575 int             ktsb_szcode;            /* kernel 8k-indexed tsb size code */
 576 int             ktsb_sz;                /* kernel 8k-indexed tsb size */
 577 
 578 caddr_t         ktsb4m_base;            /* kernel 4m-indexed tsb base address */
 579 uint64_t        ktsb4m_pbase;           /* kernel 4m-indexed tsb phys address */
 580 int             ktsb4m_szcode;          /* kernel 4m-indexed tsb size code */
 581 int             ktsb4m_sz;              /* kernel 4m-indexed tsb size */
 582 
 583 uint64_t        kpm_tsbbase;            /* kernel seg_kpm 4M TSB base address */
 584 int             kpm_tsbsz;              /* kernel seg_kpm 4M TSB size code */
 585 uint64_t        kpmsm_tsbbase;          /* kernel seg_kpm 8K TSB base address */
 586 int             kpmsm_tsbsz;            /* kernel seg_kpm 8K TSB size code */
 587 
 588 #ifndef sun4v
 589 int             utsb_dtlb_ttenum = -1;  /* index in TLB for utsb locked TTE */
 590 int             utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
 591 int             dtlb_resv_ttenum;       /* index in TLB of first reserved TTE */
 592 caddr_t         utsb_vabase;            /* reserved kernel virtual memory */
 593 caddr_t         utsb4m_vabase;          /* for trap handler TSB accesses */
 594 #endif /* sun4v */
 595 uint64_t        tsb_alloc_bytes = 0;    /* bytes allocated to TSBs */
 596 vmem_t          *kmem_tsb_default_arena[NLGRPS_MAX];    /* For dynamic TSBs */
 597 vmem_t          *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
 598 
 599 /*
 600  * Size to use for TSB slabs.  Future platforms that support page sizes
 601  * larger than 4M may wish to change these values, and provide their own
 602  * assembly macros for building and decoding the TSB base register contents.
 603  * Note disable_large_pages will override the value set here.
 604  */
 605 static  uint_t tsb_slab_ttesz = TTE4M;
 606 size_t  tsb_slab_size = MMU_PAGESIZE4M;
 607 uint_t  tsb_slab_shift = MMU_PAGESHIFT4M;
 608 /* PFN mask for TTE */
 609 size_t  tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
 610 
 611 /*
 612  * Size to use for TSB slabs.  These are used only when 256M tsb arenas
 613  * exist.
 614  */
 615 static uint_t   bigtsb_slab_ttesz = TTE256M;
 616 static size_t   bigtsb_slab_size = MMU_PAGESIZE256M;
 617 static uint_t   bigtsb_slab_shift = MMU_PAGESHIFT256M;
 618 /* 256M page alignment for 8K pfn */
 619 static size_t   bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
 620 
 621 /* largest TSB size to grow to, will be smaller on smaller memory systems */
 622 static int      tsb_max_growsize = 0;
 623 
 624 /*
 625  * Tunable parameters dealing with TSB policies.
 626  */
 627 
 628 /*
 629  * This undocumented tunable forces all 8K TSBs to be allocated from
 630  * the kernel heap rather than from the kmem_tsb_default_arena arenas.
 631  */
 632 #ifdef  DEBUG
 633 int     tsb_forceheap = 0;
 634 #endif  /* DEBUG */
 635 
 636 /*
 637  * Decide whether to use per-lgroup arenas, or one global set of
 638  * TSB arenas.  The default is not to break up per-lgroup, since
 639  * most platforms don't recognize any tangible benefit from it.
 640  */
 641 int     tsb_lgrp_affinity = 0;
 642 
 643 /*
 644  * Used for growing the TSB based on the process RSS.
 645  * tsb_rss_factor is based on the smallest TSB, and is
 646  * shifted by the TSB size to determine if we need to grow.
 647  * The default will grow the TSB if the number of TTEs for
 648  * this page size exceeds 75% of the number of TSB entries,
 649  * which should _almost_ eliminate all conflict misses
 650  * (at the expense of using up lots and lots of memory).
 651  */
 652 #define TSB_RSS_FACTOR          (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
 653 #define SFMMU_RSS_TSBSIZE(tsbszc)       (tsb_rss_factor << tsbszc)
 654 #define SELECT_TSB_SIZECODE(pgcnt) ( \
 655         (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
 656         default_tsb_size)
 657 #define TSB_OK_SHRINK() \
 658         (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
 659 #define TSB_OK_GROW()   \
 660         (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
 661 
 662 int     enable_tsb_rss_sizing = 1;
 663 int     tsb_rss_factor  = (int)TSB_RSS_FACTOR;
 664 
 665 /* which TSB size code to use for new address spaces or if rss sizing off */
 666 int default_tsb_size = TSB_8K_SZCODE;
 667 
 668 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
 669 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
 670 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT        32
 671 
 672 #ifdef DEBUG
 673 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
 674 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
 675 static int tsb_alloc_mtbf = 0;  /* fail allocation every n attempts */
 676 static int tsb_alloc_fail_mtbf = 0;
 677 static int tsb_alloc_count = 0;
 678 #endif /* DEBUG */
 679 
 680 /* if set to 1, will remap valid TTEs when growing TSB. */
 681 int tsb_remap_ttes = 1;
 682 
 683 /*
 684  * If we have more than this many mappings, allocate a second TSB.
 685  * This default is chosen because the I/D fully associative TLBs are
 686  * assumed to have at least 8 available entries. Platforms with a
 687  * larger fully-associative TLB could probably override the default.
 688  */
 689 
 690 #ifdef sun4v
 691 int tsb_sectsb_threshold = 0;
 692 #else
 693 int tsb_sectsb_threshold = 8;
 694 #endif
 695 
 696 /*
 697  * kstat data
 698  */
 699 struct sfmmu_global_stat sfmmu_global_stat;
 700 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
 701 
 702 /*
 703  * Global data
 704  */
 705 sfmmu_t         *ksfmmup;               /* kernel's hat id */
 706 
 707 #ifdef DEBUG
 708 static void     chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
 709 #endif
 710 
 711 /* sfmmu locking operations */
 712 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
 713 static int      sfmmu_mlspl_held(struct page *, int);
 714 
 715 kmutex_t *sfmmu_page_enter(page_t *);
 716 void    sfmmu_page_exit(kmutex_t *);
 717 int     sfmmu_page_spl_held(struct page *);
 718 
 719 /* sfmmu internal locking operations - accessed directly */
 720 static void     sfmmu_mlist_reloc_enter(page_t *, page_t *,
 721                                 kmutex_t **, kmutex_t **);
 722 static void     sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
 723 static hatlock_t *
 724                 sfmmu_hat_enter(sfmmu_t *);
 725 static hatlock_t *
 726                 sfmmu_hat_tryenter(sfmmu_t *);
 727 static void     sfmmu_hat_exit(hatlock_t *);
 728 static void     sfmmu_hat_lock_all(void);
 729 static void     sfmmu_hat_unlock_all(void);
 730 static void     sfmmu_ismhat_enter(sfmmu_t *, int);
 731 static void     sfmmu_ismhat_exit(sfmmu_t *, int);
 732 
 733 kpm_hlk_t       *kpmp_table;
 734 uint_t          kpmp_table_sz;  /* must be a power of 2 */
 735 uchar_t         kpmp_shift;
 736 
 737 kpm_shlk_t      *kpmp_stable;
 738 uint_t          kpmp_stable_sz; /* must be a power of 2 */
 739 
 740 /*
 741  * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
 742  * SPL_SHIFT is log2(SPL_TABLE_SIZE).
 743  */
 744 #if ((2*NCPU_P2) > 128)
 745 #define SPL_SHIFT       ((unsigned)(NCPU_LOG2 + 1))
 746 #else
 747 #define SPL_SHIFT       7U
 748 #endif
 749 #define SPL_TABLE_SIZE  (1U << SPL_SHIFT)
 750 #define SPL_MASK        (SPL_TABLE_SIZE - 1)
 751 
 752 /*
 753  * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
 754  * and by multiples of SPL_SHIFT to get as many varied bits as we can.
 755  */
 756 #define SPL_INDEX(pp) \
 757         ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
 758         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
 759         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
 760         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
 761         SPL_MASK)
 762 
 763 #define SPL_HASH(pp)    \
 764         (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
 765 
 766 static  pad_mutex_t     sfmmu_page_lock[SPL_TABLE_SIZE];
 767 
 768 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
 769 
 770 #define MML_TABLE_SIZE  SPL_TABLE_SIZE
 771 #define MLIST_HASH(pp)  (&mml_table[SPL_INDEX(pp)].pad_mutex)
 772 
 773 static pad_mutex_t      mml_table[MML_TABLE_SIZE];
 774 
 775 /*
 776  * hat_unload_callback() will group together callbacks in order
 777  * to avoid xt_sync() calls.  This is the maximum size of the group.
 778  */
 779 #define MAX_CB_ADDR     32
 780 
 781 tte_t   hw_tte;
 782 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
 783 
 784 static char     *mmu_ctx_kstat_names[] = {
 785         "mmu_ctx_tsb_exceptions",
 786         "mmu_ctx_tsb_raise_exception",
 787         "mmu_ctx_wrap_around",
 788 };
 789 
 790 /*
 791  * Wrapper for vmem_xalloc since vmem_create only allows limited
 792  * parameters for vm_source_alloc functions.  This function allows us
 793  * to specify alignment consistent with the size of the object being
 794  * allocated.
 795  */
 796 static void *
 797 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
 798 {
 799         return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
 800 }
 801 
 802 /* Common code for setting tsb_alloc_hiwater. */
 803 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages)      tsb_alloc_hiwater = \
 804                 ptob(pages) / tsb_alloc_hiwater_factor
 805 
 806 /*
 807  * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
 808  * a single TSB.  physmem is the number of physical pages so we need physmem 8K
 809  * TTEs to represent all those physical pages.  We round this up by using
 810  * 1<<highbit().  To figure out which size code to use, remember that the size
 811  * code is just an amount to shift the smallest TSB size to get the size of
 812  * this TSB.  So we subtract that size, TSB_START_SIZE, from highbit() (or
 813  * highbit() - 1) to get the size code for the smallest TSB that can represent
 814  * all of physical memory, while erring on the side of too much.
 815  *
 816  * Restrict tsb_max_growsize to make sure that:
 817  *      1) TSBs can't grow larger than the TSB slab size
 818  *      2) TSBs can't grow larger than UTSB_MAX_SZCODE.
 819  */
 820 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) {                             \
 821         int     _i, _szc, _slabszc, _tsbszc;                            \
 822                                                                         \
 823         _i = highbit(pages);                                            \
 824         if ((1 << (_i - 1)) == (pages))                                   \
 825                 _i--;           /* 2^n case, round down */              \
 826         _szc = _i - TSB_START_SIZE;                                     \
 827         _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
 828         _tsbszc = MIN(_szc, _slabszc);                                  \
 829         tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE);               \
 830 }
 831 
 832 /*
 833  * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
 834  * tsb_info which handles that TTE size.
 835  */
 836 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) {                  \
 837         (tsbinfop) = (sfmmup)->sfmmu_tsb;                            \
 838         ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) ||                \
 839             sfmmu_hat_lock_held(sfmmup));                               \
 840         if ((tte_szc) >= TTE4M)      {                                       \
 841                 ASSERT((tsbinfop) != NULL);                             \
 842                 (tsbinfop) = (tsbinfop)->tsb_next;                   \
 843         }                                                               \
 844 }
 845 
 846 /*
 847  * Macro to use to unload entries from the TSB.
 848  * It has knowledge of which page sizes get replicated in the TSB
 849  * and will call the appropriate unload routine for the appropriate size.
 850  */
 851 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat)         \
 852 {                                                                       \
 853         int ttesz = get_hblk_ttesz(hmeblkp);                            \
 854         if (ttesz == TTE8K || ttesz == TTE4M) {                         \
 855                 sfmmu_unload_tsb(sfmmup, addr, ttesz);                  \
 856         } else {                                                        \
 857                 caddr_t sva = ismhat ? addr :                           \
 858                     (caddr_t)get_hblk_base(hmeblkp);                    \
 859                 caddr_t eva = sva + get_hblk_span(hmeblkp);             \
 860                 ASSERT(addr >= sva && addr < eva);                        \
 861                 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz);        \
 862         }                                                               \
 863 }
 864 
 865 
 866 /* Update tsb_alloc_hiwater after memory is configured. */
 867 /*ARGSUSED*/
 868 static void
 869 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
 870 {
 871         /* Assumes physmem has already been updated. */
 872         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 873         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 874 }
 875 
 876 /*
 877  * Update tsb_alloc_hiwater before memory is deleted.  We'll do nothing here
 878  * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
 879  * deleted.
 880  */
 881 /*ARGSUSED*/
 882 static int
 883 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
 884 {
 885         return (0);
 886 }
 887 
 888 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
 889 /*ARGSUSED*/
 890 static void
 891 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
 892 {
 893         /*
 894          * Whether the delete was cancelled or not, just go ahead and update
 895          * tsb_alloc_hiwater and tsb_max_growsize.
 896          */
 897         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 898         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 899 }
 900 
 901 static kphysm_setup_vector_t sfmmu_update_vec = {
 902         KPHYSM_SETUP_VECTOR_VERSION,    /* version */
 903         sfmmu_update_post_add,          /* post_add */
 904         sfmmu_update_pre_del,           /* pre_del */
 905         sfmmu_update_post_del           /* post_del */
 906 };
 907 
 908 
 909 /*
 910  * HME_BLK HASH PRIMITIVES
 911  */
 912 
 913 /*
 914  * Enter a hme on the mapping list for page pp.
 915  * When large pages are more prevalent in the system we might want to
 916  * keep the mapping list in ascending order by the hment size. For now,
 917  * small pages are more frequent, so don't slow it down.
 918  */
 919 #define HME_ADD(hme, pp)                                        \
 920 {                                                               \
 921         ASSERT(sfmmu_mlist_held(pp));                           \
 922                                                                 \
 923         hme->hme_prev = NULL;                                        \
 924         hme->hme_next = pp->p_mapping;                            \
 925         hme->hme_page = pp;                                  \
 926         if (pp->p_mapping) {                                 \
 927                 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
 928                 ASSERT(pp->p_share > 0);                  \
 929         } else  {                                               \
 930                 /* EMPTY */                                     \
 931                 ASSERT(pp->p_share == 0);                    \
 932         }                                                       \
 933         pp->p_mapping = hme;                                 \
 934         pp->p_share++;                                               \
 935 }
 936 
 937 /*
 938  * Enter a hme on the mapping list for page pp.
 939  * If we are unmapping a large translation, we need to make sure that the
 940  * change is reflect in the corresponding bit of the p_index field.
 941  */
 942 #define HME_SUB(hme, pp)                                        \
 943 {                                                               \
 944         ASSERT(sfmmu_mlist_held(pp));                           \
 945         ASSERT(hme->hme_page == pp || IS_PAHME(hme));                \
 946                                                                 \
 947         if (pp->p_mapping == NULL) {                         \
 948                 panic("hme_remove - no mappings");              \
 949         }                                                       \
 950                                                                 \
 951         membar_stst();  /* ensure previous stores finish */     \
 952                                                                 \
 953         ASSERT(pp->p_share > 0);                          \
 954         pp->p_share--;                                               \
 955                                                                 \
 956         if (hme->hme_prev) {                                 \
 957                 ASSERT(pp->p_mapping != hme);                        \
 958                 ASSERT(hme->hme_prev->hme_page == pp ||           \
 959                         IS_PAHME(hme->hme_prev));            \
 960                 hme->hme_prev->hme_next = hme->hme_next;       \
 961         } else {                                                \
 962                 ASSERT(pp->p_mapping == hme);                        \
 963                 pp->p_mapping = hme->hme_next;                    \
 964                 ASSERT((pp->p_mapping == NULL) ?             \
 965                         (pp->p_share == 0) : 1);             \
 966         }                                                       \
 967                                                                 \
 968         if (hme->hme_next) {                                 \
 969                 ASSERT(hme->hme_next->hme_page == pp ||           \
 970                         IS_PAHME(hme->hme_next));            \
 971                 hme->hme_next->hme_prev = hme->hme_prev;       \
 972         }                                                       \
 973                                                                 \
 974         /* zero out the entry */                                \
 975         hme->hme_next = NULL;                                        \
 976         hme->hme_prev = NULL;                                        \
 977         hme->hme_page = NULL;                                        \
 978                                                                 \
 979         if (hme_size(hme) > TTE8K) {                         \
 980                 /* remove mappings for remainder of large pg */ \
 981                 sfmmu_rm_large_mappings(pp, hme_size(hme));     \
 982         }                                                       \
 983 }
 984 
 985 /*
 986  * This function returns the hment given the hme_blk and a vaddr.
 987  * It assumes addr has already been checked to belong to hme_blk's
 988  * range.
 989  */
 990 #define HBLKTOHME(hment, hmeblkp, addr)                                 \
 991 {                                                                       \
 992         int index;                                                      \
 993         HBLKTOHME_IDX(hment, hmeblkp, addr, index)                      \
 994 }
 995 
 996 /*
 997  * Version of HBLKTOHME that also returns the index in hmeblkp
 998  * of the hment.
 999  */
1000 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx)                        \
1001 {                                                                       \
1002         ASSERT(in_hblk_range((hmeblkp), (addr)));                       \
1003                                                                         \
1004         if (get_hblk_ttesz(hmeblkp) == TTE8K) {                         \
1005                 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1006         } else                                                          \
1007                 idx = 0;                                                \
1008                                                                         \
1009         (hment) = &(hmeblkp)->hblk_hme[idx];                             \
1010 }
1011 
1012 /*
1013  * Disable any page sizes not supported by the CPU
1014  */
1015 void
1016 hat_init_pagesizes()
1017 {
1018         int             i;
1019 
1020         mmu_exported_page_sizes = 0;
1021         for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1022 
1023                 szc_2_userszc[i] = (uint_t)-1;
1024                 userszc_2_szc[i] = (uint_t)-1;
1025 
1026                 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1027                         disable_large_pages |= (1 << i);
1028                 } else {
1029                         szc_2_userszc[i] = mmu_exported_page_sizes;
1030                         userszc_2_szc[mmu_exported_page_sizes] = i;
1031                         mmu_exported_page_sizes++;
1032                 }
1033         }
1034 
1035         disable_ism_large_pages |= disable_large_pages;
1036         disable_auto_data_large_pages = disable_large_pages;
1037         disable_auto_text_large_pages = disable_large_pages;
1038 
1039         /*
1040          * Initialize mmu-specific large page sizes.
1041          */
1042         if (&mmu_large_pages_disabled) {
1043                 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1044                 disable_ism_large_pages |=
1045                     mmu_large_pages_disabled(HAT_LOAD_SHARE);
1046                 disable_auto_data_large_pages |=
1047                     mmu_large_pages_disabled(HAT_AUTO_DATA);
1048                 disable_auto_text_large_pages |=
1049                     mmu_large_pages_disabled(HAT_AUTO_TEXT);
1050         }
1051 }
1052 
1053 /*
1054  * Initialize the hardware address translation structures.
1055  */
1056 void
1057 hat_init(void)
1058 {
1059         int             i;
1060         uint_t          sz;
1061         size_t          size;
1062 
1063         hat_lock_init();
1064         hat_kstat_init();
1065 
1066         /*
1067          * Hardware-only bits in a TTE
1068          */
1069         MAKE_TTE_MASK(&hw_tte);
1070 
1071         hat_init_pagesizes();
1072 
1073         /* Initialize the hash locks */
1074         for (i = 0; i < khmehash_num; i++) {
1075                 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1076                     MUTEX_DEFAULT, NULL);
1077                 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1078         }
1079         for (i = 0; i < uhmehash_num; i++) {
1080                 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1081                     MUTEX_DEFAULT, NULL);
1082                 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1083         }
1084         khmehash_num--;         /* make sure counter starts from 0 */
1085         uhmehash_num--;         /* make sure counter starts from 0 */
1086 
1087         /*
1088          * Allocate context domain structures.
1089          *
1090          * A platform may choose to modify max_mmu_ctxdoms in
1091          * set_platform_defaults(). If a platform does not define
1092          * a set_platform_defaults() or does not choose to modify
1093          * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1094          *
1095          * For all platforms that have CPUs sharing MMUs, this
1096          * value must be defined.
1097          */
1098         if (max_mmu_ctxdoms == 0)
1099                 max_mmu_ctxdoms = max_ncpus;
1100 
1101         size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1102         mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1103 
1104         /* mmu_ctx_t is 64 bytes aligned */
1105         mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1106             sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1107         /*
1108          * MMU context domain initialization for the Boot CPU.
1109          * This needs the context domains array allocated above.
1110          */
1111         mutex_enter(&cpu_lock);
1112         sfmmu_cpu_init(CPU);
1113         mutex_exit(&cpu_lock);
1114 
1115         /*
1116          * Intialize ism mapping list lock.
1117          */
1118 
1119         mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1120 
1121         /*
1122          * Each sfmmu structure carries an array of MMU context info
1123          * structures, one per context domain. The size of this array depends
1124          * on the maximum number of context domains. So, the size of the
1125          * sfmmu structure varies per platform.
1126          *
1127          * sfmmu is allocated from static arena, because trap
1128          * handler at TL > 0 is not allowed to touch kernel relocatable
1129          * memory. sfmmu's alignment is changed to 64 bytes from
1130          * default 8 bytes, as the lower 6 bits will be used to pass
1131          * pgcnt to vtag_flush_pgcnt_tl1.
1132          */
1133         size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1134 
1135         sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1136             64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1137             NULL, NULL, static_arena, 0);
1138 
1139         sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1140             sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1141 
1142         /*
1143          * Since we only use the tsb8k cache to "borrow" pages for TSBs
1144          * from the heap when low on memory or when TSB_FORCEALLOC is
1145          * specified, don't use magazines to cache them--we want to return
1146          * them to the system as quickly as possible.
1147          */
1148         sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1149             MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1150             static_arena, KMC_NOMAGAZINE);
1151 
1152         /*
1153          * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1154          * memory, which corresponds to the old static reserve for TSBs.
1155          * tsb_alloc_hiwater_factor defaults to 32.  This caps the amount of
1156          * memory we'll allocate for TSB slabs; beyond this point TSB
1157          * allocations will be taken from the kernel heap (via
1158          * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1159          * consumer.
1160          */
1161         if (tsb_alloc_hiwater_factor == 0) {
1162                 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1163         }
1164         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1165 
1166         for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1167                 if (!(disable_large_pages & (1 << sz)))
1168                         break;
1169         }
1170 
1171         if (sz < tsb_slab_ttesz) {
1172                 tsb_slab_ttesz = sz;
1173                 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1174                 tsb_slab_size = 1 << tsb_slab_shift;
1175                 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1176                 use_bigtsb_arena = 0;
1177         } else if (use_bigtsb_arena &&
1178             (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1179                 use_bigtsb_arena = 0;
1180         }
1181 
1182         if (!use_bigtsb_arena) {
1183                 bigtsb_slab_shift = tsb_slab_shift;
1184         }
1185         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1186 
1187         /*
1188          * On smaller memory systems, allocate TSB memory in smaller chunks
1189          * than the default 4M slab size. We also honor disable_large_pages
1190          * here.
1191          *
1192          * The trap handlers need to be patched with the final slab shift,
1193          * since they need to be able to construct the TSB pointer at runtime.
1194          */
1195         if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1196             !(disable_large_pages & (1 << TTE512K))) {
1197                 tsb_slab_ttesz = TTE512K;
1198                 tsb_slab_shift = MMU_PAGESHIFT512K;
1199                 tsb_slab_size = MMU_PAGESIZE512K;
1200                 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1201                 use_bigtsb_arena = 0;
1202         }
1203 
1204         if (!use_bigtsb_arena) {
1205                 bigtsb_slab_ttesz = tsb_slab_ttesz;
1206                 bigtsb_slab_shift = tsb_slab_shift;
1207                 bigtsb_slab_size = tsb_slab_size;
1208                 bigtsb_slab_mask = tsb_slab_mask;
1209         }
1210 
1211 
1212         /*
1213          * Set up memory callback to update tsb_alloc_hiwater and
1214          * tsb_max_growsize.
1215          */
1216         i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1217         ASSERT(i == 0);
1218 
1219         /*
1220          * kmem_tsb_arena is the source from which large TSB slabs are
1221          * drawn.  The quantum of this arena corresponds to the largest
1222          * TSB size we can dynamically allocate for user processes.
1223          * Currently it must also be a supported page size since we
1224          * use exactly one translation entry to map each slab page.
1225          *
1226          * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1227          * which most TSBs are allocated.  Since most TSB allocations are
1228          * typically 8K we have a kmem cache we stack on top of each
1229          * kmem_tsb_default_arena to speed up those allocations.
1230          *
1231          * Note the two-level scheme of arenas is required only
1232          * because vmem_create doesn't allow us to specify alignment
1233          * requirements.  If this ever changes the code could be
1234          * simplified to use only one level of arenas.
1235          *
1236          * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1237          * will be provided in addition to the 4M kmem_tsb_arena.
1238          */
1239         if (use_bigtsb_arena) {
1240                 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1241                     bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1242                     vmem_xfree, heap_arena, 0, VM_SLEEP);
1243         }
1244 
1245         kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1246             sfmmu_vmem_xalloc_aligned_wrapper,
1247             vmem_xfree, heap_arena, 0, VM_SLEEP);
1248 
1249         if (tsb_lgrp_affinity) {
1250                 char s[50];
1251                 for (i = 0; i < NLGRPS_MAX; i++) {
1252                         if (use_bigtsb_arena) {
1253                                 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1254                                 kmem_bigtsb_default_arena[i] = vmem_create(s,
1255                                     NULL, 0, 2 * tsb_slab_size,
1256                                     sfmmu_tsb_segkmem_alloc,
1257                                     sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1258                                     0, VM_SLEEP | VM_BESTFIT);
1259                         }
1260 
1261                         (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1262                         kmem_tsb_default_arena[i] = vmem_create(s,
1263                             NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1264                             sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1265                             VM_SLEEP | VM_BESTFIT);
1266 
1267                         (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1268                         sfmmu_tsb_cache[i] = kmem_cache_create(s,
1269                             PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1270                             kmem_tsb_default_arena[i], 0);
1271                 }
1272         } else {
1273                 if (use_bigtsb_arena) {
1274                         kmem_bigtsb_default_arena[0] =
1275                             vmem_create("kmem_bigtsb_default", NULL, 0,
1276                             2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1277                             sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1278                             VM_SLEEP | VM_BESTFIT);
1279                 }
1280 
1281                 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1282                     NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1283                     sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1284                     VM_SLEEP | VM_BESTFIT);
1285                 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1286                     PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1287                     kmem_tsb_default_arena[0], 0);
1288         }
1289 
1290         sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1291             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1292             sfmmu_hblkcache_destructor,
1293             sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1294             hat_memload_arena, KMC_NOHASH);
1295 
1296         hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1297             segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1298             VMC_DUMPSAFE | VM_SLEEP);
1299 
1300         sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1301             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1302             sfmmu_hblkcache_destructor,
1303             NULL, (void *)HME1BLK_SZ,
1304             hat_memload1_arena, KMC_NOHASH);
1305 
1306         pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1307             0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1308 
1309         ism_blk_cache = kmem_cache_create("ism_blk_cache",
1310             sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1311             NULL, NULL, static_arena, KMC_NOHASH);
1312 
1313         ism_ment_cache = kmem_cache_create("ism_ment_cache",
1314             sizeof (ism_ment_t), 0, NULL, NULL,
1315             NULL, NULL, NULL, 0);
1316 
1317         /*
1318          * We grab the first hat for the kernel,
1319          */
1320         AS_LOCK_ENTER(&kas, RW_WRITER);
1321         kas.a_hat = hat_alloc(&kas);
1322         AS_LOCK_EXIT(&kas);
1323 
1324         /*
1325          * Initialize hblk_reserve.
1326          */
1327         ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1328             va_to_pa((caddr_t)hblk_reserve);
1329 
1330 #ifndef UTSB_PHYS
1331         /*
1332          * Reserve some kernel virtual address space for the locked TTEs
1333          * that allow us to probe the TSB from TL>0.
1334          */
1335         utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1336             0, 0, NULL, NULL, VM_SLEEP);
1337         utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1338             0, 0, NULL, NULL, VM_SLEEP);
1339 #endif
1340 
1341 #ifdef VAC
1342         /*
1343          * The big page VAC handling code assumes VAC
1344          * will not be bigger than the smallest big
1345          * page- which is 64K.
1346          */
1347         if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1348                 cmn_err(CE_PANIC, "VAC too big!");
1349         }
1350 #endif
1351 
1352         uhme_hash_pa = va_to_pa(uhme_hash);
1353         khme_hash_pa = va_to_pa(khme_hash);
1354 
1355         /*
1356          * Initialize relocation locks. kpr_suspendlock is held
1357          * at PIL_MAX to prevent interrupts from pinning the holder
1358          * of a suspended TTE which may access it leading to a
1359          * deadlock condition.
1360          */
1361         mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1362         mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1363 
1364         /*
1365          * If Shared context support is disabled via /etc/system
1366          * set shctx_on to 0 here if it was set to 1 earlier in boot
1367          * sequence by cpu module initialization code.
1368          */
1369         if (shctx_on && disable_shctx) {
1370                 shctx_on = 0;
1371         }
1372 
1373         if (shctx_on) {
1374                 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1375                     sizeof (srd_buckets[0]), KM_SLEEP);
1376                 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1377                         mutex_init(&srd_buckets[i].srdb_lock, NULL,
1378                             MUTEX_DEFAULT, NULL);
1379                 }
1380 
1381                 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1382                     0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1383                     NULL, NULL, NULL, 0);
1384                 region_cache = kmem_cache_create("region_cache",
1385                     sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1386                     sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1387                 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1388                     0, sfmmu_scdcache_constructor,  sfmmu_scdcache_destructor,
1389                     NULL, NULL, NULL, 0);
1390         }
1391 
1392         /*
1393          * Pre-allocate hrm_hashtab before enabling the collection of
1394          * refmod statistics.  Allocating on the fly would mean us
1395          * running the risk of suffering recursive mutex enters or
1396          * deadlocks.
1397          */
1398         hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1399             KM_SLEEP);
1400 
1401         /* Allocate per-cpu pending freelist of hmeblks */
1402         cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1403             KM_SLEEP);
1404         cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1405             (uintptr_t)cpu_hme_pend, 64);
1406 
1407         for (i = 0; i < NCPU; i++) {
1408                 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1409                     NULL);
1410         }
1411 
1412         if (cpu_hme_pend_thresh == 0) {
1413                 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1414         }
1415 }
1416 
1417 /*
1418  * Initialize locking for the hat layer, called early during boot.
1419  */
1420 static void
1421 hat_lock_init()
1422 {
1423         int i;
1424 
1425         /*
1426          * initialize the array of mutexes protecting a page's mapping
1427          * list and p_nrm field.
1428          */
1429         for (i = 0; i < MML_TABLE_SIZE; i++)
1430                 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1431 
1432         if (kpm_enable) {
1433                 for (i = 0; i < kpmp_table_sz; i++) {
1434                         mutex_init(&kpmp_table[i].khl_mutex, NULL,
1435                             MUTEX_DEFAULT, NULL);
1436                 }
1437         }
1438 
1439         /*
1440          * Initialize array of mutex locks that protects sfmmu fields and
1441          * TSB lists.
1442          */
1443         for (i = 0; i < SFMMU_NUM_LOCK; i++)
1444                 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1445                     NULL);
1446 }
1447 
1448 #define SFMMU_KERNEL_MAXVA \
1449         (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1450 
1451 /*
1452  * Allocate a hat structure.
1453  * Called when an address space first uses a hat.
1454  */
1455 struct hat *
1456 hat_alloc(struct as *as)
1457 {
1458         sfmmu_t *sfmmup;
1459         int i;
1460         uint64_t cnum;
1461         extern uint_t get_color_start(struct as *);
1462 
1463         ASSERT(AS_WRITE_HELD(as));
1464         sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1465         sfmmup->sfmmu_as = as;
1466         sfmmup->sfmmu_flags = 0;
1467         sfmmup->sfmmu_tteflags = 0;
1468         sfmmup->sfmmu_rtteflags = 0;
1469         LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1470 
1471         if (as == &kas) {
1472                 ksfmmup = sfmmup;
1473                 sfmmup->sfmmu_cext = 0;
1474                 cnum = KCONTEXT;
1475 
1476                 sfmmup->sfmmu_clrstart = 0;
1477                 sfmmup->sfmmu_tsb = NULL;
1478                 /*
1479                  * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1480                  * to setup tsb_info for ksfmmup.
1481                  */
1482         } else {
1483 
1484                 /*
1485                  * Just set to invalid ctx. When it faults, it will
1486                  * get a valid ctx. This would avoid the situation
1487                  * where we get a ctx, but it gets stolen and then
1488                  * we fault when we try to run and so have to get
1489                  * another ctx.
1490                  */
1491                 sfmmup->sfmmu_cext = 0;
1492                 cnum = INVALID_CONTEXT;
1493 
1494                 /* initialize original physical page coloring bin */
1495                 sfmmup->sfmmu_clrstart = get_color_start(as);
1496 #ifdef DEBUG
1497                 if (tsb_random_size) {
1498                         uint32_t randval = (uint32_t)gettick() >> 4;
1499                         int size = randval % (tsb_max_growsize + 1);
1500 
1501                         /* chose a random tsb size for stress testing */
1502                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1503                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1504                 } else
1505 #endif /* DEBUG */
1506                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1507                             default_tsb_size,
1508                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1509                 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1510                 ASSERT(sfmmup->sfmmu_tsb != NULL);
1511         }
1512 
1513         ASSERT(max_mmu_ctxdoms > 0);
1514         for (i = 0; i < max_mmu_ctxdoms; i++) {
1515                 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1516                 sfmmup->sfmmu_ctxs[i].gnum = 0;
1517         }
1518 
1519         for (i = 0; i < max_mmu_page_sizes; i++) {
1520                 sfmmup->sfmmu_ttecnt[i] = 0;
1521                 sfmmup->sfmmu_scdrttecnt[i] = 0;
1522                 sfmmup->sfmmu_ismttecnt[i] = 0;
1523                 sfmmup->sfmmu_scdismttecnt[i] = 0;
1524                 sfmmup->sfmmu_pgsz[i] = TTE8K;
1525         }
1526         sfmmup->sfmmu_tsb0_4minflcnt = 0;
1527         sfmmup->sfmmu_iblk = NULL;
1528         sfmmup->sfmmu_ismhat = 0;
1529         sfmmup->sfmmu_scdhat = 0;
1530         sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1531         if (sfmmup == ksfmmup) {
1532                 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1533         } else {
1534                 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1535         }
1536         sfmmup->sfmmu_free = 0;
1537         sfmmup->sfmmu_rmstat = 0;
1538         sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1539         cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1540         sfmmup->sfmmu_srdp = NULL;
1541         SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1542         bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1543         sfmmup->sfmmu_scdp = NULL;
1544         sfmmup->sfmmu_scd_link.next = NULL;
1545         sfmmup->sfmmu_scd_link.prev = NULL;
1546         return (sfmmup);
1547 }
1548 
1549 /*
1550  * Create per-MMU context domain kstats for a given MMU ctx.
1551  */
1552 static void
1553 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1554 {
1555         mmu_ctx_stat_t  stat;
1556         kstat_t         *mmu_kstat;
1557 
1558         ASSERT(MUTEX_HELD(&cpu_lock));
1559         ASSERT(mmu_ctxp->mmu_kstat == NULL);
1560 
1561         mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1562             "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1563 
1564         if (mmu_kstat == NULL) {
1565                 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1566                     mmu_ctxp->mmu_idx);
1567         } else {
1568                 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1569                 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1570                         kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1571                             mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1572                 mmu_ctxp->mmu_kstat = mmu_kstat;
1573                 kstat_install(mmu_kstat);
1574         }
1575 }
1576 
1577 /*
1578  * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1579  * context domain information for a given CPU. If a platform does not
1580  * specify that interface, then the function below is used instead to return
1581  * default information. The defaults are as follows:
1582  *
1583  *      - The number of MMU context IDs supported on any CPU in the
1584  *        system is 8K.
1585  *      - There is one MMU context domain per CPU.
1586  */
1587 /*ARGSUSED*/
1588 static void
1589 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1590 {
1591         infop->mmu_nctxs = nctxs;
1592         infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1593 }
1594 
1595 /*
1596  * Called during CPU initialization to set the MMU context-related information
1597  * for a CPU.
1598  *
1599  * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1600  */
1601 void
1602 sfmmu_cpu_init(cpu_t *cp)
1603 {
1604         mmu_ctx_info_t  info;
1605         mmu_ctx_t       *mmu_ctxp;
1606 
1607         ASSERT(MUTEX_HELD(&cpu_lock));
1608 
1609         if (&plat_cpuid_to_mmu_ctx_info == NULL)
1610                 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1611         else
1612                 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1613 
1614         ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1615 
1616         if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1617                 /* Each mmu_ctx is cacheline aligned. */
1618                 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1619                 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1620 
1621                 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1622                     (void *)ipltospl(DISP_LEVEL));
1623                 mmu_ctxp->mmu_idx = info.mmu_idx;
1624                 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1625                 /*
1626                  * Globally for lifetime of a system,
1627                  * gnum must always increase.
1628                  * mmu_saved_gnum is protected by the cpu_lock.
1629                  */
1630                 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1631                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1632 
1633                 sfmmu_mmu_kstat_create(mmu_ctxp);
1634 
1635                 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1636         } else {
1637                 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1638                 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1639         }
1640 
1641         /*
1642          * The mmu_lock is acquired here to prevent races with
1643          * the wrap-around code.
1644          */
1645         mutex_enter(&mmu_ctxp->mmu_lock);
1646 
1647 
1648         mmu_ctxp->mmu_ncpus++;
1649         CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1650         CPU_MMU_IDX(cp) = info.mmu_idx;
1651         CPU_MMU_CTXP(cp) = mmu_ctxp;
1652 
1653         mutex_exit(&mmu_ctxp->mmu_lock);
1654 }
1655 
1656 static void
1657 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1658 {
1659         ASSERT(MUTEX_HELD(&cpu_lock));
1660         ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1661 
1662         mutex_destroy(&mmu_ctxp->mmu_lock);
1663 
1664         if (mmu_ctxp->mmu_kstat)
1665                 kstat_delete(mmu_ctxp->mmu_kstat);
1666 
1667         /* mmu_saved_gnum is protected by the cpu_lock. */
1668         if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1669                 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1670 
1671         kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1672 }
1673 
1674 /*
1675  * Called to perform MMU context-related cleanup for a CPU.
1676  */
1677 void
1678 sfmmu_cpu_cleanup(cpu_t *cp)
1679 {
1680         mmu_ctx_t       *mmu_ctxp;
1681 
1682         ASSERT(MUTEX_HELD(&cpu_lock));
1683 
1684         mmu_ctxp = CPU_MMU_CTXP(cp);
1685         ASSERT(mmu_ctxp != NULL);
1686 
1687         /*
1688          * The mmu_lock is acquired here to prevent races with
1689          * the wrap-around code.
1690          */
1691         mutex_enter(&mmu_ctxp->mmu_lock);
1692 
1693         CPU_MMU_CTXP(cp) = NULL;
1694 
1695         CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1696         if (--mmu_ctxp->mmu_ncpus == 0) {
1697                 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1698                 mutex_exit(&mmu_ctxp->mmu_lock);
1699                 sfmmu_ctxdom_free(mmu_ctxp);
1700                 return;
1701         }
1702 
1703         mutex_exit(&mmu_ctxp->mmu_lock);
1704 }
1705 
1706 uint_t
1707 sfmmu_ctxdom_nctxs(int idx)
1708 {
1709         return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1710 }
1711 
1712 #ifdef sun4v
1713 /*
1714  * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1715  * consistant after suspend/resume on system that can resume on a different
1716  * hardware than it was suspended.
1717  *
1718  * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1719  * from being allocated.  It acquires all hat_locks, which blocks most access to
1720  * context data, except for a few cases that are handled separately or are
1721  * harmless.  It wraps each domain to increment gnum and invalidate on-CPU
1722  * contexts, and forces cnum to its max.  As a result of this call all user
1723  * threads that are running on CPUs trap and try to perform wrap around but
1724  * can't because hat_locks are taken.  Threads that were not on CPUs but started
1725  * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1726  * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1727  * on hat_lock trying to wrap.  sfmmu_ctxdom_lock() must be called before CPUs
1728  * are paused, else it could deadlock acquiring locks held by paused CPUs.
1729  *
1730  * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1731  * the CPUs that had them.  It must be called after CPUs have been paused. This
1732  * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1733  * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1734  * runs with interrupts disabled.  When CPUs are later resumed, they may enter
1735  * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1736  * return failure.  Or, they will be blocked trying to acquire hat_lock. Thus
1737  * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1738  * accessing the old context domains.
1739  *
1740  * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1741  * allocates new context domains based on hardware layout.  It initializes
1742  * every CPU that had context domain before migration to have one again.
1743  * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1744  * could deadlock acquiring locks held by paused CPUs.
1745  *
1746  * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1747  * acquire new context ids and continue execution.
1748  *
1749  * Therefore functions should be called in the following order:
1750  *       suspend_routine()
1751  *              sfmmu_ctxdom_lock()
1752  *              pause_cpus()
1753  *              suspend()
1754  *                      if (suspend failed)
1755  *                              sfmmu_ctxdom_unlock()
1756  *              ...
1757  *              sfmmu_ctxdom_remove()
1758  *              resume_cpus()
1759  *              sfmmu_ctxdom_update()
1760  *              sfmmu_ctxdom_unlock()
1761  */
1762 static cpuset_t sfmmu_ctxdoms_pset;
1763 
1764 void
1765 sfmmu_ctxdoms_remove()
1766 {
1767         processorid_t   id;
1768         cpu_t           *cp;
1769 
1770         /*
1771          * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1772          * be restored post-migration. A CPU may be powered off and not have a
1773          * domain, for example.
1774          */
1775         CPUSET_ZERO(sfmmu_ctxdoms_pset);
1776 
1777         for (id = 0; id < NCPU; id++) {
1778                 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1779                         CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1780                         CPU_MMU_CTXP(cp) = NULL;
1781                 }
1782         }
1783 }
1784 
1785 void
1786 sfmmu_ctxdoms_lock(void)
1787 {
1788         int             idx;
1789         mmu_ctx_t       *mmu_ctxp;
1790 
1791         sfmmu_hat_lock_all();
1792 
1793         /*
1794          * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1795          * hat_lock is always taken before calling it.
1796          *
1797          * For each domain, set mmu_cnum to max so no more contexts can be
1798          * allocated, and wrap to flush on-CPU contexts and force threads to
1799          * acquire a new context when we later drop hat_lock after migration.
1800          * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1801          * but the latter uses CAS and will miscompare and not overwrite it.
1802          */
1803         kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1804         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1805                 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1806                         mutex_enter(&mmu_ctxp->mmu_lock);
1807                         mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1808                         /* make sure updated cnum visible */
1809                         membar_enter();
1810                         mutex_exit(&mmu_ctxp->mmu_lock);
1811                         sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1812                 }
1813         }
1814         kpreempt_enable();
1815 }
1816 
1817 void
1818 sfmmu_ctxdoms_unlock(void)
1819 {
1820         sfmmu_hat_unlock_all();
1821 }
1822 
1823 void
1824 sfmmu_ctxdoms_update(void)
1825 {
1826         processorid_t   id;
1827         cpu_t           *cp;
1828         uint_t          idx;
1829         mmu_ctx_t       *mmu_ctxp;
1830 
1831         /*
1832          * Free all context domains.  As side effect, this increases
1833          * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1834          * init gnum in the new domains, which therefore will be larger than the
1835          * sfmmu gnum for any process, guaranteeing that every process will see
1836          * a new generation and allocate a new context regardless of what new
1837          * domain it runs in.
1838          */
1839         mutex_enter(&cpu_lock);
1840 
1841         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1842                 if (mmu_ctxs_tbl[idx] != NULL) {
1843                         mmu_ctxp = mmu_ctxs_tbl[idx];
1844                         mmu_ctxs_tbl[idx] = NULL;
1845                         sfmmu_ctxdom_free(mmu_ctxp);
1846                 }
1847         }
1848 
1849         for (id = 0; id < NCPU; id++) {
1850                 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1851                     (cp = cpu[id]) != NULL)
1852                         sfmmu_cpu_init(cp);
1853         }
1854         mutex_exit(&cpu_lock);
1855 }
1856 #endif
1857 
1858 /*
1859  * Hat_setup, makes an address space context the current active one.
1860  * In sfmmu this translates to setting the secondary context with the
1861  * corresponding context.
1862  */
1863 void
1864 hat_setup(struct hat *sfmmup, int allocflag)
1865 {
1866         hatlock_t *hatlockp;
1867 
1868         /* Init needs some special treatment. */
1869         if (allocflag == HAT_INIT) {
1870                 /*
1871                  * Make sure that we have
1872                  * 1. a TSB
1873                  * 2. a valid ctx that doesn't get stolen after this point.
1874                  */
1875                 hatlockp = sfmmu_hat_enter(sfmmup);
1876 
1877                 /*
1878                  * Swap in the TSB.  hat_init() allocates tsbinfos without
1879                  * TSBs, but we need one for init, since the kernel does some
1880                  * special things to set up its stack and needs the TSB to
1881                  * resolve page faults.
1882                  */
1883                 sfmmu_tsb_swapin(sfmmup, hatlockp);
1884 
1885                 sfmmu_get_ctx(sfmmup);
1886 
1887                 sfmmu_hat_exit(hatlockp);
1888         } else {
1889                 ASSERT(allocflag == HAT_ALLOC);
1890 
1891                 hatlockp = sfmmu_hat_enter(sfmmup);
1892                 kpreempt_disable();
1893 
1894                 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1895                 /*
1896                  * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1897                  * pagesize bits don't matter in this case since we are passing
1898                  * INVALID_CONTEXT to it.
1899                  * Compatibility Note: hw takes care of MMU_SCONTEXT1
1900                  */
1901                 sfmmu_setctx_sec(INVALID_CONTEXT);
1902                 sfmmu_clear_utsbinfo();
1903 
1904                 kpreempt_enable();
1905                 sfmmu_hat_exit(hatlockp);
1906         }
1907 }
1908 
1909 /*
1910  * Free all the translation resources for the specified address space.
1911  * Called from as_free when an address space is being destroyed.
1912  */
1913 void
1914 hat_free_start(struct hat *sfmmup)
1915 {
1916         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1917         ASSERT(sfmmup != ksfmmup);
1918 
1919         sfmmup->sfmmu_free = 1;
1920         if (sfmmup->sfmmu_scdp != NULL) {
1921                 sfmmu_leave_scd(sfmmup, 0);
1922         }
1923 
1924         ASSERT(sfmmup->sfmmu_scdp == NULL);
1925 }
1926 
1927 void
1928 hat_free_end(struct hat *sfmmup)
1929 {
1930         int i;
1931 
1932         ASSERT(sfmmup->sfmmu_free == 1);
1933         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1934         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1935         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1936         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1937         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1938         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1939 
1940         if (sfmmup->sfmmu_rmstat) {
1941                 hat_freestat(sfmmup->sfmmu_as, NULL);
1942         }
1943 
1944         while (sfmmup->sfmmu_tsb != NULL) {
1945                 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1946                 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1947                 sfmmup->sfmmu_tsb = next;
1948         }
1949 
1950         if (sfmmup->sfmmu_srdp != NULL) {
1951                 sfmmu_leave_srd(sfmmup);
1952                 ASSERT(sfmmup->sfmmu_srdp == NULL);
1953                 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1954                         if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1955                                 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1956                                     SFMMU_L2_HMERLINKS_SIZE);
1957                                 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1958                         }
1959                 }
1960         }
1961         sfmmu_free_sfmmu(sfmmup);
1962 
1963 #ifdef DEBUG
1964         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1965                 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1966         }
1967 #endif
1968 
1969         kmem_cache_free(sfmmuid_cache, sfmmup);
1970 }
1971 
1972 /*
1973  * Duplicate the translations of an as into another newas
1974  */
1975 /* ARGSUSED */
1976 int
1977 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
1978         uint_t flag)
1979 {
1980         sf_srd_t *srdp;
1981         sf_scd_t *scdp;
1982         int i;
1983         extern uint_t get_color_start(struct as *);
1984 
1985         ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
1986             (flag == HAT_DUP_SRD));
1987         ASSERT(hat != ksfmmup);
1988         ASSERT(newhat != ksfmmup);
1989         ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
1990 
1991         if (flag == HAT_DUP_COW) {
1992                 panic("hat_dup: HAT_DUP_COW not supported");
1993         }
1994 
1995         if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
1996                 ASSERT(srdp->srd_evp != NULL);
1997                 VN_HOLD(srdp->srd_evp);
1998                 ASSERT(srdp->srd_refcnt > 0);
1999                 newhat->sfmmu_srdp = srdp;
2000                 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2001         }
2002 
2003         /*
2004          * HAT_DUP_ALL flag is used after as duplication is done.
2005          */
2006         if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2007                 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2008                 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2009                 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2010                         newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2011                 }
2012 
2013                 /* check if need to join scd */
2014                 if ((scdp = hat->sfmmu_scdp) != NULL &&
2015                     newhat->sfmmu_scdp != scdp) {
2016                         int ret;
2017                         SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2018                             &scdp->scd_region_map, ret);
2019                         ASSERT(ret);
2020                         sfmmu_join_scd(scdp, newhat);
2021                         ASSERT(newhat->sfmmu_scdp == scdp &&
2022                             scdp->scd_refcnt >= 2);
2023                         for (i = 0; i < max_mmu_page_sizes; i++) {
2024                                 newhat->sfmmu_ismttecnt[i] =
2025                                     hat->sfmmu_ismttecnt[i];
2026                                 newhat->sfmmu_scdismttecnt[i] =
2027                                     hat->sfmmu_scdismttecnt[i];
2028                         }
2029                 }
2030 
2031                 sfmmu_check_page_sizes(newhat, 1);
2032         }
2033 
2034         if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2035             update_proc_pgcolorbase_after_fork != 0) {
2036                 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2037         }
2038         return (0);
2039 }
2040 
2041 void
2042 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2043         uint_t attr, uint_t flags)
2044 {
2045         hat_do_memload(hat, addr, pp, attr, flags,
2046             SFMMU_INVALID_SHMERID);
2047 }
2048 
2049 void
2050 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2051         uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2052 {
2053         uint_t rid;
2054         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2055                 hat_do_memload(hat, addr, pp, attr, flags,
2056                     SFMMU_INVALID_SHMERID);
2057                 return;
2058         }
2059         rid = (uint_t)((uint64_t)rcookie);
2060         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2061         hat_do_memload(hat, addr, pp, attr, flags, rid);
2062 }
2063 
2064 /*
2065  * Set up addr to map to page pp with protection prot.
2066  * As an optimization we also load the TSB with the
2067  * corresponding tte but it is no big deal if  the tte gets kicked out.
2068  */
2069 static void
2070 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2071         uint_t attr, uint_t flags, uint_t rid)
2072 {
2073         tte_t tte;
2074 
2075 
2076         ASSERT(hat != NULL);
2077         ASSERT(PAGE_LOCKED(pp));
2078         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2079         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2080         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2081         SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2082 
2083         if (PP_ISFREE(pp)) {
2084                 panic("hat_memload: loading a mapping to free page %p",
2085                     (void *)pp);
2086         }
2087 
2088         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2089 
2090         if (flags & ~SFMMU_LOAD_ALLFLAG)
2091                 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2092                     flags & ~SFMMU_LOAD_ALLFLAG);
2093 
2094         if (hat->sfmmu_rmstat)
2095                 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2096 
2097 #if defined(SF_ERRATA_57)
2098         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2099             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2100             !(flags & HAT_LOAD_SHARE)) {
2101                 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2102                     " page executable");
2103                 attr &= ~PROT_EXEC;
2104         }
2105 #endif
2106 
2107         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2108         (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2109 
2110         /*
2111          * Check TSB and TLB page sizes.
2112          */
2113         if ((flags & HAT_LOAD_SHARE) == 0) {
2114                 sfmmu_check_page_sizes(hat, 1);
2115         }
2116 }
2117 
2118 /*
2119  * hat_devload can be called to map real memory (e.g.
2120  * /dev/kmem) and even though hat_devload will determine pf is
2121  * for memory, it will be unable to get a shared lock on the
2122  * page (because someone else has it exclusively) and will
2123  * pass dp = NULL.  If tteload doesn't get a non-NULL
2124  * page pointer it can't cache memory.
2125  */
2126 void
2127 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2128         uint_t attr, int flags)
2129 {
2130         tte_t tte;
2131         struct page *pp = NULL;
2132         int use_lgpg = 0;
2133 
2134         ASSERT(hat != NULL);
2135 
2136         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2137         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2138         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2139         if (len == 0)
2140                 panic("hat_devload: zero len");
2141         if (flags & ~SFMMU_LOAD_ALLFLAG)
2142                 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2143                     flags & ~SFMMU_LOAD_ALLFLAG);
2144 
2145 #if defined(SF_ERRATA_57)
2146         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2147             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2148             !(flags & HAT_LOAD_SHARE)) {
2149                 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2150                     " page executable");
2151                 attr &= ~PROT_EXEC;
2152         }
2153 #endif
2154 
2155         /*
2156          * If it's a memory page find its pp
2157          */
2158         if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2159                 pp = page_numtopp_nolock(pfn);
2160                 if (pp == NULL) {
2161                         flags |= HAT_LOAD_NOCONSIST;
2162                 } else {
2163                         if (PP_ISFREE(pp)) {
2164                                 panic("hat_memload: loading "
2165                                     "a mapping to free page %p",
2166                                     (void *)pp);
2167                         }
2168                         if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2169                                 panic("hat_memload: loading a mapping "
2170                                     "to unlocked relocatable page %p",
2171                                     (void *)pp);
2172                         }
2173                         ASSERT(len == MMU_PAGESIZE);
2174                 }
2175         }
2176 
2177         if (hat->sfmmu_rmstat)
2178                 hat_resvstat(len, hat->sfmmu_as, addr);
2179 
2180         if (flags & HAT_LOAD_NOCONSIST) {
2181                 attr |= SFMMU_UNCACHEVTTE;
2182                 use_lgpg = 1;
2183         }
2184         if (!pf_is_memory(pfn)) {
2185                 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2186                 use_lgpg = 1;
2187                 switch (attr & HAT_ORDER_MASK) {
2188                         case HAT_STRICTORDER:
2189                         case HAT_UNORDERED_OK:
2190                                 /*
2191                                  * we set the side effect bit for all non
2192                                  * memory mappings unless merging is ok
2193                                  */
2194                                 attr |= SFMMU_SIDEFFECT;
2195                                 break;
2196                         case HAT_MERGING_OK:
2197                         case HAT_LOADCACHING_OK:
2198                         case HAT_STORECACHING_OK:
2199                                 break;
2200                         default:
2201                                 panic("hat_devload: bad attr");
2202                                 break;
2203                 }
2204         }
2205         while (len) {
2206                 if (!use_lgpg) {
2207                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2208                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2209                             flags, SFMMU_INVALID_SHMERID);
2210                         len -= MMU_PAGESIZE;
2211                         addr += MMU_PAGESIZE;
2212                         pfn++;
2213                         continue;
2214                 }
2215                 /*
2216                  *  try to use large pages, check va/pa alignments
2217                  *  Note that 32M/256M page sizes are not (yet) supported.
2218                  */
2219                 if ((len >= MMU_PAGESIZE4M) &&
2220                     !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2221                     !(disable_large_pages & (1 << TTE4M)) &&
2222                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2223                         sfmmu_memtte(&tte, pfn, attr, TTE4M);
2224                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2225                             flags, SFMMU_INVALID_SHMERID);
2226                         len -= MMU_PAGESIZE4M;
2227                         addr += MMU_PAGESIZE4M;
2228                         pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2229                 } else if ((len >= MMU_PAGESIZE512K) &&
2230                     !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2231                     !(disable_large_pages & (1 << TTE512K)) &&
2232                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2233                         sfmmu_memtte(&tte, pfn, attr, TTE512K);
2234                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2235                             flags, SFMMU_INVALID_SHMERID);
2236                         len -= MMU_PAGESIZE512K;
2237                         addr += MMU_PAGESIZE512K;
2238                         pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2239                 } else if ((len >= MMU_PAGESIZE64K) &&
2240                     !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2241                     !(disable_large_pages & (1 << TTE64K)) &&
2242                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2243                         sfmmu_memtte(&tte, pfn, attr, TTE64K);
2244                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2245                             flags, SFMMU_INVALID_SHMERID);
2246                         len -= MMU_PAGESIZE64K;
2247                         addr += MMU_PAGESIZE64K;
2248                         pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2249                 } else {
2250                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2251                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2252                             flags, SFMMU_INVALID_SHMERID);
2253                         len -= MMU_PAGESIZE;
2254                         addr += MMU_PAGESIZE;
2255                         pfn++;
2256                 }
2257         }
2258 
2259         /*
2260          * Check TSB and TLB page sizes.
2261          */
2262         if ((flags & HAT_LOAD_SHARE) == 0) {
2263                 sfmmu_check_page_sizes(hat, 1);
2264         }
2265 }
2266 
2267 void
2268 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2269         struct page **pps, uint_t attr, uint_t flags)
2270 {
2271         hat_do_memload_array(hat, addr, len, pps, attr, flags,
2272             SFMMU_INVALID_SHMERID);
2273 }
2274 
2275 void
2276 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2277         struct page **pps, uint_t attr, uint_t flags,
2278         hat_region_cookie_t rcookie)
2279 {
2280         uint_t rid;
2281         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2282                 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2283                     SFMMU_INVALID_SHMERID);
2284                 return;
2285         }
2286         rid = (uint_t)((uint64_t)rcookie);
2287         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2288         hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2289 }
2290 
2291 /*
2292  * Map the largest extend possible out of the page array. The array may NOT
2293  * be in order.  The largest possible mapping a page can have
2294  * is specified in the p_szc field.  The p_szc field
2295  * cannot change as long as there any mappings (large or small)
2296  * to any of the pages that make up the large page. (ie. any
2297  * promotion/demotion of page size is not up to the hat but up to
2298  * the page free list manager).  The array
2299  * should consist of properly aligned contigous pages that are
2300  * part of a big page for a large mapping to be created.
2301  */
2302 static void
2303 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2304         struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2305 {
2306         int  ttesz;
2307         size_t mapsz;
2308         pgcnt_t numpg, npgs;
2309         tte_t tte;
2310         page_t *pp;
2311         uint_t large_pages_disable;
2312 
2313         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2314         SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2315 
2316         if (hat->sfmmu_rmstat)
2317                 hat_resvstat(len, hat->sfmmu_as, addr);
2318 
2319 #if defined(SF_ERRATA_57)
2320         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2321             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2322             !(flags & HAT_LOAD_SHARE)) {
2323                 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2324                     "user page executable");
2325                 attr &= ~PROT_EXEC;
2326         }
2327 #endif
2328 
2329         /* Get number of pages */
2330         npgs = len >> MMU_PAGESHIFT;
2331 
2332         if (flags & HAT_LOAD_SHARE) {
2333                 large_pages_disable = disable_ism_large_pages;
2334         } else {
2335                 large_pages_disable = disable_large_pages;
2336         }
2337 
2338         if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2339                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2340                     rid);
2341                 return;
2342         }
2343 
2344         while (npgs >= NHMENTS) {
2345                 pp = *pps;
2346                 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2347                         /*
2348                          * Check if this page size is disabled.
2349                          */
2350                         if (large_pages_disable & (1 << ttesz))
2351                                 continue;
2352 
2353                         numpg = TTEPAGES(ttesz);
2354                         mapsz = numpg << MMU_PAGESHIFT;
2355                         if ((npgs >= numpg) &&
2356                             IS_P2ALIGNED(addr, mapsz) &&
2357                             IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2358                                 /*
2359                                  * At this point we have enough pages and
2360                                  * we know the virtual address and the pfn
2361                                  * are properly aligned.  We still need
2362                                  * to check for physical contiguity but since
2363                                  * it is very likely that this is the case
2364                                  * we will assume they are so and undo
2365                                  * the request if necessary.  It would
2366                                  * be great if we could get a hint flag
2367                                  * like HAT_CONTIG which would tell us
2368                                  * the pages are contigous for sure.
2369                                  */
2370                                 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2371                                     attr, ttesz);
2372                                 if (!sfmmu_tteload_array(hat, &tte, addr,
2373                                     pps, flags, rid)) {
2374                                         break;
2375                                 }
2376                         }
2377                 }
2378                 if (ttesz == TTE8K) {
2379                         /*
2380                          * We were not able to map array using a large page
2381                          * batch a hmeblk or fraction at a time.
2382                          */
2383                         numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2384                             & (NHMENTS-1);
2385                         numpg = NHMENTS - numpg;
2386                         ASSERT(numpg <= npgs);
2387                         mapsz = numpg * MMU_PAGESIZE;
2388                         sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2389                             numpg, rid);
2390                 }
2391                 addr += mapsz;
2392                 npgs -= numpg;
2393                 pps += numpg;
2394         }
2395 
2396         if (npgs) {
2397                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2398                     rid);
2399         }
2400 
2401         /*
2402          * Check TSB and TLB page sizes.
2403          */
2404         if ((flags & HAT_LOAD_SHARE) == 0) {
2405                 sfmmu_check_page_sizes(hat, 1);
2406         }
2407 }
2408 
2409 /*
2410  * Function tries to batch 8K pages into the same hme blk.
2411  */
2412 static void
2413 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2414                     uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2415 {
2416         tte_t   tte;
2417         page_t *pp;
2418         struct hmehash_bucket *hmebp;
2419         struct hme_blk *hmeblkp;
2420         int     index;
2421 
2422         while (npgs) {
2423                 /*
2424                  * Acquire the hash bucket.
2425                  */
2426                 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2427                     rid);
2428                 ASSERT(hmebp);
2429 
2430                 /*
2431                  * Find the hment block.
2432                  */
2433                 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2434                     TTE8K, flags, rid);
2435                 ASSERT(hmeblkp);
2436 
2437                 do {
2438                         /*
2439                          * Make the tte.
2440                          */
2441                         pp = *pps;
2442                         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2443 
2444                         /*
2445                          * Add the translation.
2446                          */
2447                         (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2448                             vaddr, pps, flags, rid);
2449 
2450                         /*
2451                          * Goto next page.
2452                          */
2453                         pps++;
2454                         npgs--;
2455 
2456                         /*
2457                          * Goto next address.
2458                          */
2459                         vaddr += MMU_PAGESIZE;
2460 
2461                         /*
2462                          * Don't crossover into a different hmentblk.
2463                          */
2464                         index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2465                             (NHMENTS-1));
2466 
2467                 } while (index != 0 && npgs != 0);
2468 
2469                 /*
2470                  * Release the hash bucket.
2471                  */
2472 
2473                 sfmmu_tteload_release_hashbucket(hmebp);
2474         }
2475 }
2476 
2477 /*
2478  * Construct a tte for a page:
2479  *
2480  * tte_valid = 1
2481  * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2482  * tte_size = size
2483  * tte_nfo = attr & HAT_NOFAULT
2484  * tte_ie = attr & HAT_STRUCTURE_LE
2485  * tte_hmenum = hmenum
2486  * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2487  * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2488  * tte_ref = 1 (optimization)
2489  * tte_wr_perm = attr & PROT_WRITE;
2490  * tte_no_sync = attr & HAT_NOSYNC
2491  * tte_lock = attr & SFMMU_LOCKTTE
2492  * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2493  * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2494  * tte_e = attr & SFMMU_SIDEFFECT
2495  * tte_priv = !(attr & PROT_USER)
2496  * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2497  * tte_glb = 0
2498  */
2499 void
2500 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2501 {
2502         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2503 
2504         ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2505         ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2506 
2507         if (TTE_IS_NOSYNC(ttep)) {
2508                 TTE_SET_REF(ttep);
2509                 if (TTE_IS_WRITABLE(ttep)) {
2510                         TTE_SET_MOD(ttep);
2511                 }
2512         }
2513         if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2514                 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2515         }
2516 }
2517 
2518 /*
2519  * This function will add a translation to the hme_blk and allocate the
2520  * hme_blk if one does not exist.
2521  * If a page structure is specified then it will add the
2522  * corresponding hment to the mapping list.
2523  * It will also update the hmenum field for the tte.
2524  *
2525  * Currently this function is only used for kernel mappings.
2526  * So pass invalid region to sfmmu_tteload_array().
2527  */
2528 void
2529 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2530         uint_t flags)
2531 {
2532         ASSERT(sfmmup == ksfmmup);
2533         (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2534             SFMMU_INVALID_SHMERID);
2535 }
2536 
2537 /*
2538  * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2539  * Assumes that a particular page size may only be resident in one TSB.
2540  */
2541 static void
2542 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2543 {
2544         struct tsb_info *tsbinfop = NULL;
2545         uint64_t tag;
2546         struct tsbe *tsbe_addr;
2547         uint64_t tsb_base;
2548         uint_t tsb_size;
2549         int vpshift = MMU_PAGESHIFT;
2550         int phys = 0;
2551 
2552         if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2553                 phys = ktsb_phys;
2554                 if (ttesz >= TTE4M) {
2555 #ifndef sun4v
2556                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2557 #endif
2558                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2559                         tsb_size = ktsb4m_szcode;
2560                 } else {
2561                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2562                         tsb_size = ktsb_szcode;
2563                 }
2564         } else {
2565                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2566 
2567                 /*
2568                  * If there isn't a TSB for this page size, or the TSB is
2569                  * swapped out, there is nothing to do.  Note that the latter
2570                  * case seems impossible but can occur if hat_pageunload()
2571                  * is called on an ISM mapping while the process is swapped
2572                  * out.
2573                  */
2574                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2575                         return;
2576 
2577                 /*
2578                  * If another thread is in the middle of relocating a TSB
2579                  * we can't unload the entry so set a flag so that the
2580                  * TSB will be flushed before it can be accessed by the
2581                  * process.
2582                  */
2583                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2584                         if (ttep == NULL)
2585                                 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2586                         return;
2587                 }
2588 #if defined(UTSB_PHYS)
2589                 phys = 1;
2590                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2591 #else
2592                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2593 #endif
2594                 tsb_size = tsbinfop->tsb_szc;
2595         }
2596         if (ttesz >= TTE4M)
2597                 vpshift = MMU_PAGESHIFT4M;
2598 
2599         tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2600         tag = sfmmu_make_tsbtag(vaddr);
2601 
2602         if (ttep == NULL) {
2603                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2604         } else {
2605                 if (ttesz >= TTE4M) {
2606                         SFMMU_STAT(sf_tsb_load4m);
2607                 } else {
2608                         SFMMU_STAT(sf_tsb_load8k);
2609                 }
2610 
2611                 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2612         }
2613 }
2614 
2615 /*
2616  * Unmap all entries from [start, end) matching the given page size.
2617  *
2618  * This function is used primarily to unmap replicated 64K or 512K entries
2619  * from the TSB that are inserted using the base page size TSB pointer, but
2620  * it may also be called to unmap a range of addresses from the TSB.
2621  */
2622 void
2623 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2624 {
2625         struct tsb_info *tsbinfop;
2626         uint64_t tag;
2627         struct tsbe *tsbe_addr;
2628         caddr_t vaddr;
2629         uint64_t tsb_base;
2630         int vpshift, vpgsz;
2631         uint_t tsb_size;
2632         int phys = 0;
2633 
2634         /*
2635          * Assumptions:
2636          *  If ttesz == 8K, 64K or 512K, we walk through the range 8K
2637          *  at a time shooting down any valid entries we encounter.
2638          *
2639          *  If ttesz >= 4M we walk the range 4M at a time shooting
2640          *  down any valid mappings we find.
2641          */
2642         if (sfmmup == ksfmmup) {
2643                 phys = ktsb_phys;
2644                 if (ttesz >= TTE4M) {
2645 #ifndef sun4v
2646                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2647 #endif
2648                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2649                         tsb_size = ktsb4m_szcode;
2650                 } else {
2651                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2652                         tsb_size = ktsb_szcode;
2653                 }
2654         } else {
2655                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2656 
2657                 /*
2658                  * If there isn't a TSB for this page size, or the TSB is
2659                  * swapped out, there is nothing to do.  Note that the latter
2660                  * case seems impossible but can occur if hat_pageunload()
2661                  * is called on an ISM mapping while the process is swapped
2662                  * out.
2663                  */
2664                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2665                         return;
2666 
2667                 /*
2668                  * If another thread is in the middle of relocating a TSB
2669                  * we can't unload the entry so set a flag so that the
2670                  * TSB will be flushed before it can be accessed by the
2671                  * process.
2672                  */
2673                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2674                         tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2675                         return;
2676                 }
2677 #if defined(UTSB_PHYS)
2678                 phys = 1;
2679                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2680 #else
2681                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2682 #endif
2683                 tsb_size = tsbinfop->tsb_szc;
2684         }
2685         if (ttesz >= TTE4M) {
2686                 vpshift = MMU_PAGESHIFT4M;
2687                 vpgsz = MMU_PAGESIZE4M;
2688         } else {
2689                 vpshift = MMU_PAGESHIFT;
2690                 vpgsz = MMU_PAGESIZE;
2691         }
2692 
2693         for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2694                 tag = sfmmu_make_tsbtag(vaddr);
2695                 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2696                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2697         }
2698 }
2699 
2700 /*
2701  * Select the optimum TSB size given the number of mappings
2702  * that need to be cached.
2703  */
2704 static int
2705 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2706 {
2707         int szc = 0;
2708 
2709 #ifdef DEBUG
2710         if (tsb_grow_stress) {
2711                 uint32_t randval = (uint32_t)gettick() >> 4;
2712                 return (randval % (tsb_max_growsize + 1));
2713         }
2714 #endif  /* DEBUG */
2715 
2716         while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2717                 szc++;
2718         return (szc);
2719 }
2720 
2721 /*
2722  * This function will add a translation to the hme_blk and allocate the
2723  * hme_blk if one does not exist.
2724  * If a page structure is specified then it will add the
2725  * corresponding hment to the mapping list.
2726  * It will also update the hmenum field for the tte.
2727  * Furthermore, it attempts to create a large page translation
2728  * for <addr,hat> at page array pps.  It assumes addr and first
2729  * pp is correctly aligned.  It returns 0 if successful and 1 otherwise.
2730  */
2731 static int
2732 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2733         page_t **pps, uint_t flags, uint_t rid)
2734 {
2735         struct hmehash_bucket *hmebp;
2736         struct hme_blk *hmeblkp;
2737         int     ret;
2738         uint_t  size;
2739 
2740         /*
2741          * Get mapping size.
2742          */
2743         size = TTE_CSZ(ttep);
2744         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2745 
2746         /*
2747          * Acquire the hash bucket.
2748          */
2749         hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2750         ASSERT(hmebp);
2751 
2752         /*
2753          * Find the hment block.
2754          */
2755         hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2756             rid);
2757         ASSERT(hmeblkp);
2758 
2759         /*
2760          * Add the translation.
2761          */
2762         ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2763             rid);
2764 
2765         /*
2766          * Release the hash bucket.
2767          */
2768         sfmmu_tteload_release_hashbucket(hmebp);
2769 
2770         return (ret);
2771 }
2772 
2773 /*
2774  * Function locks and returns a pointer to the hash bucket for vaddr and size.
2775  */
2776 static struct hmehash_bucket *
2777 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2778     uint_t rid)
2779 {
2780         struct hmehash_bucket *hmebp;
2781         int hmeshift;
2782         void *htagid = sfmmutohtagid(sfmmup, rid);
2783 
2784         ASSERT(htagid != NULL);
2785 
2786         hmeshift = HME_HASH_SHIFT(size);
2787 
2788         hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2789 
2790         SFMMU_HASH_LOCK(hmebp);
2791 
2792         return (hmebp);
2793 }
2794 
2795 /*
2796  * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2797  * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2798  * allocated.
2799  */
2800 static struct hme_blk *
2801 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2802         caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2803 {
2804         hmeblk_tag hblktag;
2805         int hmeshift;
2806         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2807 
2808         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2809 
2810         hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2811         ASSERT(hblktag.htag_id != NULL);
2812         hmeshift = HME_HASH_SHIFT(size);
2813         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2814         hblktag.htag_rehash = HME_HASH_REHASH(size);
2815         hblktag.htag_rid = rid;
2816 
2817 ttearray_realloc:
2818 
2819         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2820 
2821         /*
2822          * We block until hblk_reserve_lock is released; it's held by
2823          * the thread, temporarily using hblk_reserve, until hblk_reserve is
2824          * replaced by a hblk from sfmmu8_cache.
2825          */
2826         if (hmeblkp == (struct hme_blk *)hblk_reserve &&
2827             hblk_reserve_thread != curthread) {
2828                 SFMMU_HASH_UNLOCK(hmebp);
2829                 mutex_enter(&hblk_reserve_lock);
2830                 mutex_exit(&hblk_reserve_lock);
2831                 SFMMU_STAT(sf_hblk_reserve_hit);
2832                 SFMMU_HASH_LOCK(hmebp);
2833                 goto ttearray_realloc;
2834         }
2835 
2836         if (hmeblkp == NULL) {
2837                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
2838                     hblktag, flags, rid);
2839                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2840                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2841         } else {
2842                 /*
2843                  * It is possible for 8k and 64k hblks to collide since they
2844                  * have the same rehash value. This is because we
2845                  * lazily free hblks and 8K/64K blks could be lingering.
2846                  * If we find size mismatch we free the block and & try again.
2847                  */
2848                 if (get_hblk_ttesz(hmeblkp) != size) {
2849                         ASSERT(!hmeblkp->hblk_vcnt);
2850                         ASSERT(!hmeblkp->hblk_hmecnt);
2851                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2852                             &list, 0);
2853                         goto ttearray_realloc;
2854                 }
2855                 if (hmeblkp->hblk_shw_bit) {
2856                         /*
2857                          * if the hblk was previously used as a shadow hblk then
2858                          * we will change it to a normal hblk
2859                          */
2860                         ASSERT(!hmeblkp->hblk_shared);
2861                         if (hmeblkp->hblk_shw_mask) {
2862                                 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
2863                                 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
2864                                 goto ttearray_realloc;
2865                         } else {
2866                                 hmeblkp->hblk_shw_bit = 0;
2867                         }
2868                 }
2869                 SFMMU_STAT(sf_hblk_hit);
2870         }
2871 
2872         /*
2873          * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
2874          * see block comment showing the stacktrace in sfmmu_hblk_alloc();
2875          * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
2876          * just add these hmeblks to the per-cpu pending queue.
2877          */
2878         sfmmu_hblks_list_purge(&list, 1);
2879 
2880         ASSERT(get_hblk_ttesz(hmeblkp) == size);
2881         ASSERT(!hmeblkp->hblk_shw_bit);
2882         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2883         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2884         ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
2885 
2886         return (hmeblkp);
2887 }
2888 
2889 /*
2890  * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
2891  * otherwise.
2892  */
2893 static int
2894 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
2895         caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
2896 {
2897         page_t *pp = *pps;
2898         int hmenum, size, remap;
2899         tte_t tteold, flush_tte;
2900 #ifdef DEBUG
2901         tte_t orig_old;
2902 #endif /* DEBUG */
2903         struct sf_hment *sfhme;
2904         kmutex_t *pml, *pmtx;
2905         hatlock_t *hatlockp;
2906         int myflt;
2907 
2908         /*
2909          * remove this panic when we decide to let user virtual address
2910          * space be >= USERLIMIT.
2911          */
2912         if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
2913                 panic("user addr %p in kernel space", (void *)vaddr);
2914 #if defined(TTE_IS_GLOBAL)
2915         if (TTE_IS_GLOBAL(ttep))
2916                 panic("sfmmu_tteload: creating global tte");
2917 #endif
2918 
2919 #ifdef DEBUG
2920         if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
2921             !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
2922                 panic("sfmmu_tteload: non cacheable memory tte");
2923 #endif /* DEBUG */
2924 
2925         /* don't simulate dirty bit for writeable ISM/DISM mappings */
2926         if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
2927                 TTE_SET_REF(ttep);
2928                 TTE_SET_MOD(ttep);
2929         }
2930 
2931         if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
2932             !TTE_IS_MOD(ttep)) {
2933                 /*
2934                  * Don't load TSB for dummy as in ISM.  Also don't preload
2935                  * the TSB if the TTE isn't writable since we're likely to
2936                  * fault on it again -- preloading can be fairly expensive.
2937                  */
2938                 flags |= SFMMU_NO_TSBLOAD;
2939         }
2940 
2941         size = TTE_CSZ(ttep);
2942         switch (size) {
2943         case TTE8K:
2944                 SFMMU_STAT(sf_tteload8k);
2945                 break;
2946         case TTE64K:
2947                 SFMMU_STAT(sf_tteload64k);
2948                 break;
2949         case TTE512K:
2950                 SFMMU_STAT(sf_tteload512k);
2951                 break;
2952         case TTE4M:
2953                 SFMMU_STAT(sf_tteload4m);
2954                 break;
2955         case (TTE32M):
2956                 SFMMU_STAT(sf_tteload32m);
2957                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
2958                 break;
2959         case (TTE256M):
2960                 SFMMU_STAT(sf_tteload256m);
2961                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
2962                 break;
2963         }
2964 
2965         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2966         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2967         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2968         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2969 
2970         HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
2971 
2972         /*
2973          * Need to grab mlist lock here so that pageunload
2974          * will not change tte behind us.
2975          */
2976         if (pp) {
2977                 pml = sfmmu_mlist_enter(pp);
2978         }
2979 
2980         sfmmu_copytte(&sfhme->hme_tte, &tteold);
2981         /*
2982          * Look for corresponding hment and if valid verify
2983          * pfns are equal.
2984          */
2985         remap = TTE_IS_VALID(&tteold);
2986         if (remap) {
2987                 pfn_t   new_pfn, old_pfn;
2988 
2989                 old_pfn = TTE_TO_PFN(vaddr, &tteold);
2990                 new_pfn = TTE_TO_PFN(vaddr, ttep);
2991 
2992                 if (flags & HAT_LOAD_REMAP) {
2993                         /* make sure we are remapping same type of pages */
2994                         if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
2995                                 panic("sfmmu_tteload - tte remap io<->memory");
2996                         }
2997                         if (old_pfn != new_pfn &&
2998                             (pp != NULL || sfhme->hme_page != NULL)) {
2999                                 panic("sfmmu_tteload - tte remap pp != NULL");
3000                         }
3001                 } else if (old_pfn != new_pfn) {
3002                         panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3003                             (void *)hmeblkp);
3004                 }
3005                 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3006         }
3007 
3008         if (pp) {
3009                 if (size == TTE8K) {
3010 #ifdef VAC
3011                         /*
3012                          * Handle VAC consistency
3013                          */
3014                         if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3015                                 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3016                         }
3017 #endif
3018 
3019                         if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3020                                 pmtx = sfmmu_page_enter(pp);
3021                                 PP_CLRRO(pp);
3022                                 sfmmu_page_exit(pmtx);
3023                         } else if (!PP_ISMAPPED(pp) &&
3024                             (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3025                                 pmtx = sfmmu_page_enter(pp);
3026                                 if (!(PP_ISMOD(pp))) {
3027                                         PP_SETRO(pp);
3028                                 }
3029                                 sfmmu_page_exit(pmtx);
3030                         }
3031 
3032                 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3033                         /*
3034                          * sfmmu_pagearray_setup failed so return
3035                          */
3036                         sfmmu_mlist_exit(pml);
3037                         return (1);
3038                 }
3039         }
3040 
3041         /*
3042          * Make sure hment is not on a mapping list.
3043          */
3044         ASSERT(remap || (sfhme->hme_page == NULL));
3045 
3046         /* if it is not a remap then hme->next better be NULL */
3047         ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3048 
3049         if (flags & HAT_LOAD_LOCK) {
3050                 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3051                         panic("too high lckcnt-hmeblk %p",
3052                             (void *)hmeblkp);
3053                 }
3054                 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3055 
3056                 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3057         }
3058 
3059 #ifdef VAC
3060         if (pp && PP_ISNC(pp)) {
3061                 /*
3062                  * If the physical page is marked to be uncacheable, like
3063                  * by a vac conflict, make sure the new mapping is also
3064                  * uncacheable.
3065                  */
3066                 TTE_CLR_VCACHEABLE(ttep);
3067                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3068         }
3069 #endif
3070         ttep->tte_hmenum = hmenum;
3071 
3072 #ifdef DEBUG
3073         orig_old = tteold;
3074 #endif /* DEBUG */
3075 
3076         while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3077                 if ((sfmmup == KHATID) &&
3078                     (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3079                         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3080                 }
3081 #ifdef DEBUG
3082                 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3083 #endif /* DEBUG */
3084         }
3085         ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3086 
3087         if (!TTE_IS_VALID(&tteold)) {
3088 
3089                 atomic_inc_16(&hmeblkp->hblk_vcnt);
3090                 if (rid == SFMMU_INVALID_SHMERID) {
3091                         atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3092                 } else {
3093                         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3094                         sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3095                         /*
3096                          * We already accounted for region ttecnt's in sfmmu
3097                          * during hat_join_region() processing. Here we
3098                          * only update ttecnt's in region struture.
3099                          */
3100                         atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3101                 }
3102         }
3103 
3104         myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3105         if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3106             sfmmup != ksfmmup) {
3107                 uchar_t tteflag = 1 << size;
3108                 if (rid == SFMMU_INVALID_SHMERID) {
3109                         if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3110                                 hatlockp = sfmmu_hat_enter(sfmmup);
3111                                 sfmmup->sfmmu_tteflags |= tteflag;
3112                                 sfmmu_hat_exit(hatlockp);
3113                         }
3114                 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3115                         hatlockp = sfmmu_hat_enter(sfmmup);
3116                         sfmmup->sfmmu_rtteflags |= tteflag;
3117                         sfmmu_hat_exit(hatlockp);
3118                 }
3119                 /*
3120                  * Update the current CPU tsbmiss area, so the current thread
3121                  * won't need to take the tsbmiss for the new pagesize.
3122                  * The other threads in the process will update their tsb
3123                  * miss area lazily in sfmmu_tsbmiss_exception() when they
3124                  * fail to find the translation for a newly added pagesize.
3125                  */
3126                 if (size > TTE64K && myflt) {
3127                         struct tsbmiss *tsbmp;
3128                         kpreempt_disable();
3129                         tsbmp = &tsbmiss_area[CPU->cpu_id];
3130                         if (rid == SFMMU_INVALID_SHMERID) {
3131                                 if (!(tsbmp->uhat_tteflags & tteflag)) {
3132                                         tsbmp->uhat_tteflags |= tteflag;
3133                                 }
3134                         } else {
3135                                 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3136                                         tsbmp->uhat_rtteflags |= tteflag;
3137                                 }
3138                         }
3139                         kpreempt_enable();
3140                 }
3141         }
3142 
3143         if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3144             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3145                 hatlockp = sfmmu_hat_enter(sfmmup);
3146                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3147                 sfmmu_hat_exit(hatlockp);
3148         }
3149 
3150         flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3151             hw_tte.tte_intlo;
3152         flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3153             hw_tte.tte_inthi;
3154 
3155         if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3156                 /*
3157                  * If remap and new tte differs from old tte we need
3158                  * to sync the mod bit and flush TLB/TSB.  We don't
3159                  * need to sync ref bit because we currently always set
3160                  * ref bit in tteload.
3161                  */
3162                 ASSERT(TTE_IS_REF(ttep));
3163                 if (TTE_IS_MOD(&tteold)) {
3164                         sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3165                 }
3166                 /*
3167                  * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3168                  * hmes are only used for read only text. Adding this code for
3169                  * completeness and future use of shared hmeblks with writable
3170                  * mappings of VMODSORT vnodes.
3171                  */
3172                 if (hmeblkp->hblk_shared) {
3173                         cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3174                             sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3175                         xt_sync(cpuset);
3176                         SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3177                 } else {
3178                         sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3179                         xt_sync(sfmmup->sfmmu_cpusran);
3180                 }
3181         }
3182 
3183         if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3184                 /*
3185                  * We only preload 8K and 4M mappings into the TSB, since
3186                  * 64K and 512K mappings are replicated and hence don't
3187                  * have a single, unique TSB entry. Ditto for 32M/256M.
3188                  */
3189                 if (size == TTE8K || size == TTE4M) {
3190                         sf_scd_t *scdp;
3191                         hatlockp = sfmmu_hat_enter(sfmmup);
3192                         /*
3193                          * Don't preload private TSB if the mapping is used
3194                          * by the shctx in the SCD.
3195                          */
3196                         scdp = sfmmup->sfmmu_scdp;
3197                         if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3198                             !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3199                                 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3200                                     size);
3201                         }
3202                         sfmmu_hat_exit(hatlockp);
3203                 }
3204         }
3205         if (pp) {
3206                 if (!remap) {
3207                         HME_ADD(sfhme, pp);
3208                         atomic_inc_16(&hmeblkp->hblk_hmecnt);
3209                         ASSERT(hmeblkp->hblk_hmecnt > 0);
3210 
3211                         /*
3212                          * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3213                          * see pageunload() for comment.
3214                          */
3215                 }
3216                 sfmmu_mlist_exit(pml);
3217         }
3218 
3219         return (0);
3220 }
3221 /*
3222  * Function unlocks hash bucket.
3223  */
3224 static void
3225 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3226 {
3227         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3228         SFMMU_HASH_UNLOCK(hmebp);
3229 }
3230 
3231 /*
3232  * function which checks and sets up page array for a large
3233  * translation.  Will set p_vcolor, p_index, p_ro fields.
3234  * Assumes addr and pfnum of first page are properly aligned.
3235  * Will check for physical contiguity. If check fails it return
3236  * non null.
3237  */
3238 static int
3239 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3240 {
3241         int     i, index, ttesz;
3242         pfn_t   pfnum;
3243         pgcnt_t npgs;
3244         page_t *pp, *pp1;
3245         kmutex_t *pmtx;
3246 #ifdef VAC
3247         int osz;
3248         int cflags = 0;
3249         int vac_err = 0;
3250 #endif
3251         int newidx = 0;
3252 
3253         ttesz = TTE_CSZ(ttep);
3254 
3255         ASSERT(ttesz > TTE8K);
3256 
3257         npgs = TTEPAGES(ttesz);
3258         index = PAGESZ_TO_INDEX(ttesz);
3259 
3260         pfnum = (*pps)->p_pagenum;
3261         ASSERT(IS_P2ALIGNED(pfnum, npgs));
3262 
3263         /*
3264          * Save the first pp so we can do HAT_TMPNC at the end.
3265          */
3266         pp1 = *pps;
3267 #ifdef VAC
3268         osz = fnd_mapping_sz(pp1);
3269 #endif
3270 
3271         for (i = 0; i < npgs; i++, pps++) {
3272                 pp = *pps;
3273                 ASSERT(PAGE_LOCKED(pp));
3274                 ASSERT(pp->p_szc >= ttesz);
3275                 ASSERT(pp->p_szc == pp1->p_szc);
3276                 ASSERT(sfmmu_mlist_held(pp));
3277 
3278                 /*
3279                  * XXX is it possible to maintain P_RO on the root only?
3280                  */
3281                 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3282                         pmtx = sfmmu_page_enter(pp);
3283                         PP_CLRRO(pp);
3284                         sfmmu_page_exit(pmtx);
3285                 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3286                     !PP_ISMOD(pp)) {
3287                         pmtx = sfmmu_page_enter(pp);
3288                         if (!(PP_ISMOD(pp))) {
3289                                 PP_SETRO(pp);
3290                         }
3291                         sfmmu_page_exit(pmtx);
3292                 }
3293 
3294                 /*
3295                  * If this is a remap we skip vac & contiguity checks.
3296                  */
3297                 if (remap)
3298                         continue;
3299 
3300                 /*
3301                  * set p_vcolor and detect any vac conflicts.
3302                  */
3303 #ifdef VAC
3304                 if (vac_err == 0) {
3305                         vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3306 
3307                 }
3308 #endif
3309 
3310                 /*
3311                  * Save current index in case we need to undo it.
3312                  * Note: "PAGESZ_TO_INDEX(sz)   (1 << (sz))"
3313                  *      "SFMMU_INDEX_SHIFT      6"
3314                  *       "SFMMU_INDEX_MASK      ((1 << SFMMU_INDEX_SHIFT) - 1)"
3315                  *       "PP_MAPINDEX(p_index)  (p_index & SFMMU_INDEX_MASK)"
3316                  *
3317                  * So:  index = PAGESZ_TO_INDEX(ttesz);
3318                  *      if ttesz == 1 then index = 0x2
3319                  *                  2 then index = 0x4
3320                  *                  3 then index = 0x8
3321                  *                  4 then index = 0x10
3322                  *                  5 then index = 0x20
3323                  * The code below checks if it's a new pagesize (ie, newidx)
3324                  * in case we need to take it back out of p_index,
3325                  * and then or's the new index into the existing index.
3326                  */
3327                 if ((PP_MAPINDEX(pp) & index) == 0)
3328                         newidx = 1;
3329                 pp->p_index = (PP_MAPINDEX(pp) | index);
3330 
3331                 /*
3332                  * contiguity check
3333                  */
3334                 if (pp->p_pagenum != pfnum) {
3335                         /*
3336                          * If we fail the contiguity test then
3337                          * the only thing we need to fix is the p_index field.
3338                          * We might get a few extra flushes but since this
3339                          * path is rare that is ok.  The p_ro field will
3340                          * get automatically fixed on the next tteload to
3341                          * the page.  NO TNC bit is set yet.
3342                          */
3343                         while (i >= 0) {
3344                                 pp = *pps;
3345                                 if (newidx)
3346                                         pp->p_index = (PP_MAPINDEX(pp) &
3347                                             ~index);
3348                                 pps--;
3349                                 i--;
3350                         }
3351                         return (1);
3352                 }
3353                 pfnum++;
3354                 addr += MMU_PAGESIZE;
3355         }
3356 
3357 #ifdef VAC
3358         if (vac_err) {
3359                 if (ttesz > osz) {
3360                         /*
3361                          * There are some smaller mappings that causes vac
3362                          * conflicts. Convert all existing small mappings to
3363                          * TNC.
3364                          */
3365                         SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3366                         sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3367                             npgs);
3368                 } else {
3369                         /* EMPTY */
3370                         /*
3371                          * If there exists an big page mapping,
3372                          * that means the whole existing big page
3373                          * has TNC setting already. No need to covert to
3374                          * TNC again.
3375                          */
3376                         ASSERT(PP_ISTNC(pp1));
3377                 }
3378         }
3379 #endif  /* VAC */
3380 
3381         return (0);
3382 }
3383 
3384 #ifdef VAC
3385 /*
3386  * Routine that detects vac consistency for a large page. It also
3387  * sets virtual color for all pp's for this big mapping.
3388  */
3389 static int
3390 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3391 {
3392         int vcolor, ocolor;
3393 
3394         ASSERT(sfmmu_mlist_held(pp));
3395 
3396         if (PP_ISNC(pp)) {
3397                 return (HAT_TMPNC);
3398         }
3399 
3400         vcolor = addr_to_vcolor(addr);
3401         if (PP_NEWPAGE(pp)) {
3402                 PP_SET_VCOLOR(pp, vcolor);
3403                 return (0);
3404         }
3405 
3406         ocolor = PP_GET_VCOLOR(pp);
3407         if (ocolor == vcolor) {
3408                 return (0);
3409         }
3410 
3411         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3412                 /*
3413                  * Previous user of page had a differnet color
3414                  * but since there are no current users
3415                  * we just flush the cache and change the color.
3416                  * As an optimization for large pages we flush the
3417                  * entire cache of that color and set a flag.
3418                  */
3419                 SFMMU_STAT(sf_pgcolor_conflict);
3420                 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3421                         CacheColor_SetFlushed(*cflags, ocolor);
3422                         sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3423                 }
3424                 PP_SET_VCOLOR(pp, vcolor);
3425                 return (0);
3426         }
3427 
3428         /*
3429          * We got a real conflict with a current mapping.
3430          * set flags to start unencaching all mappings
3431          * and return failure so we restart looping
3432          * the pp array from the beginning.
3433          */
3434         return (HAT_TMPNC);
3435 }
3436 #endif  /* VAC */
3437 
3438 /*
3439  * creates a large page shadow hmeblk for a tte.
3440  * The purpose of this routine is to allow us to do quick unloads because
3441  * the vm layer can easily pass a very large but sparsely populated range.
3442  */
3443 static struct hme_blk *
3444 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3445 {
3446         struct hmehash_bucket *hmebp;
3447         hmeblk_tag hblktag;
3448         int hmeshift, size, vshift;
3449         uint_t shw_mask, newshw_mask;
3450         struct hme_blk *hmeblkp;
3451 
3452         ASSERT(sfmmup != KHATID);
3453         if (mmu_page_sizes == max_mmu_page_sizes) {
3454                 ASSERT(ttesz < TTE256M);
3455         } else {
3456                 ASSERT(ttesz < TTE4M);
3457                 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3458                 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3459         }
3460 
3461         if (ttesz == TTE8K) {
3462                 size = TTE512K;
3463         } else {
3464                 size = ++ttesz;
3465         }
3466 
3467         hblktag.htag_id = sfmmup;
3468         hmeshift = HME_HASH_SHIFT(size);
3469         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3470         hblktag.htag_rehash = HME_HASH_REHASH(size);
3471         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3472         hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3473 
3474         SFMMU_HASH_LOCK(hmebp);
3475 
3476         HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3477         ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3478         if (hmeblkp == NULL) {
3479                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3480                     hblktag, flags, SFMMU_INVALID_SHMERID);
3481         }
3482         ASSERT(hmeblkp);
3483         if (!hmeblkp->hblk_shw_mask) {
3484                 /*
3485                  * if this is a unused hblk it was just allocated or could
3486                  * potentially be a previous large page hblk so we need to
3487                  * set the shadow bit.
3488                  */
3489                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3490                 hmeblkp->hblk_shw_bit = 1;
3491         } else if (hmeblkp->hblk_shw_bit == 0) {
3492                 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3493                     (void *)hmeblkp);
3494         }
3495         ASSERT(hmeblkp->hblk_shw_bit == 1);
3496         ASSERT(!hmeblkp->hblk_shared);
3497         vshift = vaddr_to_vshift(hblktag, vaddr, size);
3498         ASSERT(vshift < 8);
3499         /*
3500          * Atomically set shw mask bit
3501          */
3502         do {
3503                 shw_mask = hmeblkp->hblk_shw_mask;
3504                 newshw_mask = shw_mask | (1 << vshift);
3505                 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3506                     newshw_mask);
3507         } while (newshw_mask != shw_mask);
3508 
3509         SFMMU_HASH_UNLOCK(hmebp);
3510 
3511         return (hmeblkp);
3512 }
3513 
3514 /*
3515  * This routine cleanup a previous shadow hmeblk and changes it to
3516  * a regular hblk.  This happens rarely but it is possible
3517  * when a process wants to use large pages and there are hblks still
3518  * lying around from the previous as that used these hmeblks.
3519  * The alternative was to cleanup the shadow hblks at unload time
3520  * but since so few user processes actually use large pages, it is
3521  * better to be lazy and cleanup at this time.
3522  */
3523 static void
3524 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3525         struct hmehash_bucket *hmebp)
3526 {
3527         caddr_t addr, endaddr;
3528         int hashno, size;
3529 
3530         ASSERT(hmeblkp->hblk_shw_bit);
3531         ASSERT(!hmeblkp->hblk_shared);
3532 
3533         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3534 
3535         if (!hmeblkp->hblk_shw_mask) {
3536                 hmeblkp->hblk_shw_bit = 0;
3537                 return;
3538         }
3539         addr = (caddr_t)get_hblk_base(hmeblkp);
3540         endaddr = get_hblk_endaddr(hmeblkp);
3541         size = get_hblk_ttesz(hmeblkp);
3542         hashno = size - 1;
3543         ASSERT(hashno > 0);
3544         SFMMU_HASH_UNLOCK(hmebp);
3545 
3546         sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3547 
3548         SFMMU_HASH_LOCK(hmebp);
3549 }
3550 
3551 static void
3552 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3553         int hashno)
3554 {
3555         int hmeshift, shadow = 0;
3556         hmeblk_tag hblktag;
3557         struct hmehash_bucket *hmebp;
3558         struct hme_blk *hmeblkp;
3559         struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3560 
3561         ASSERT(hashno > 0);
3562         hblktag.htag_id = sfmmup;
3563         hblktag.htag_rehash = hashno;
3564         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3565 
3566         hmeshift = HME_HASH_SHIFT(hashno);
3567 
3568         while (addr < endaddr) {
3569                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3570                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3571                 SFMMU_HASH_LOCK(hmebp);
3572                 /* inline HME_HASH_SEARCH */
3573                 hmeblkp = hmebp->hmeblkp;
3574                 pr_hblk = NULL;
3575                 while (hmeblkp) {
3576                         if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3577                                 /* found hme_blk */
3578                                 ASSERT(!hmeblkp->hblk_shared);
3579                                 if (hmeblkp->hblk_shw_bit) {
3580                                         if (hmeblkp->hblk_shw_mask) {
3581                                                 shadow = 1;
3582                                                 sfmmu_shadow_hcleanup(sfmmup,
3583                                                     hmeblkp, hmebp);
3584                                                 break;
3585                                         } else {
3586                                                 hmeblkp->hblk_shw_bit = 0;
3587                                         }
3588                                 }
3589 
3590                                 /*
3591                                  * Hblk_hmecnt and hblk_vcnt could be non zero
3592                                  * since hblk_unload() does not gurantee that.
3593                                  *
3594                                  * XXX - this could cause tteload() to spin
3595                                  * where sfmmu_shadow_hcleanup() is called.
3596                                  */
3597                         }
3598 
3599                         nx_hblk = hmeblkp->hblk_next;
3600                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3601                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3602                                     &list, 0);
3603                         } else {
3604                                 pr_hblk = hmeblkp;
3605                         }
3606                         hmeblkp = nx_hblk;
3607                 }
3608 
3609                 SFMMU_HASH_UNLOCK(hmebp);
3610 
3611                 if (shadow) {
3612                         /*
3613                          * We found another shadow hblk so cleaned its
3614                          * children.  We need to go back and cleanup
3615                          * the original hblk so we don't change the
3616                          * addr.
3617                          */
3618                         shadow = 0;
3619                 } else {
3620                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
3621                             (1 << hmeshift));
3622                 }
3623         }
3624         sfmmu_hblks_list_purge(&list, 0);
3625 }
3626 
3627 /*
3628  * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3629  * may still linger on after pageunload.
3630  */
3631 static void
3632 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3633 {
3634         int hmeshift;
3635         hmeblk_tag hblktag;
3636         struct hmehash_bucket *hmebp;
3637         struct hme_blk *hmeblkp;
3638         struct hme_blk *pr_hblk;
3639         struct hme_blk *list = NULL;
3640 
3641         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3642         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3643 
3644         hmeshift = HME_HASH_SHIFT(ttesz);
3645         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3646         hblktag.htag_rehash = ttesz;
3647         hblktag.htag_rid = rid;
3648         hblktag.htag_id = srdp;
3649         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3650 
3651         SFMMU_HASH_LOCK(hmebp);
3652         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3653         if (hmeblkp != NULL) {
3654                 ASSERT(hmeblkp->hblk_shared);
3655                 ASSERT(!hmeblkp->hblk_shw_bit);
3656                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3657                         panic("sfmmu_cleanup_rhblk: valid hmeblk");
3658                 }
3659                 ASSERT(!hmeblkp->hblk_lckcnt);
3660                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3661                     &list, 0);
3662         }
3663         SFMMU_HASH_UNLOCK(hmebp);
3664         sfmmu_hblks_list_purge(&list, 0);
3665 }
3666 
3667 /* ARGSUSED */
3668 static void
3669 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3670     size_t r_size, void *r_obj, u_offset_t r_objoff)
3671 {
3672 }
3673 
3674 /*
3675  * Searches for an hmeblk which maps addr, then unloads this mapping
3676  * and updates *eaddrp, if the hmeblk is found.
3677  */
3678 static void
3679 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3680     caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3681 {
3682         int hmeshift;
3683         hmeblk_tag hblktag;
3684         struct hmehash_bucket *hmebp;
3685         struct hme_blk *hmeblkp;
3686         struct hme_blk *pr_hblk;
3687         struct hme_blk *list = NULL;
3688 
3689         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3690         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3691         ASSERT(ttesz >= HBLK_MIN_TTESZ);
3692 
3693         hmeshift = HME_HASH_SHIFT(ttesz);
3694         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3695         hblktag.htag_rehash = ttesz;
3696         hblktag.htag_rid = rid;
3697         hblktag.htag_id = srdp;
3698         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3699 
3700         SFMMU_HASH_LOCK(hmebp);
3701         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3702         if (hmeblkp != NULL) {
3703                 ASSERT(hmeblkp->hblk_shared);
3704                 ASSERT(!hmeblkp->hblk_lckcnt);
3705                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3706                         *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3707                             eaddr, NULL, HAT_UNLOAD);
3708                         ASSERT(*eaddrp > addr);
3709                 }
3710                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3711                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3712                     &list, 0);
3713         }
3714         SFMMU_HASH_UNLOCK(hmebp);
3715         sfmmu_hblks_list_purge(&list, 0);
3716 }
3717 
3718 static void
3719 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3720 {
3721         int ttesz = rgnp->rgn_pgszc;
3722         size_t rsz = rgnp->rgn_size;
3723         caddr_t rsaddr = rgnp->rgn_saddr;
3724         caddr_t readdr = rsaddr + rsz;
3725         caddr_t rhsaddr;
3726         caddr_t va;
3727         uint_t rid = rgnp->rgn_id;
3728         caddr_t cbsaddr;
3729         caddr_t cbeaddr;
3730         hat_rgn_cb_func_t rcbfunc;
3731         ulong_t cnt;
3732 
3733         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3734         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3735 
3736         ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3737         ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3738         if (ttesz < HBLK_MIN_TTESZ) {
3739                 ttesz = HBLK_MIN_TTESZ;
3740                 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3741         } else {
3742                 rhsaddr = rsaddr;
3743         }
3744 
3745         if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3746                 rcbfunc = sfmmu_rgn_cb_noop;
3747         }
3748 
3749         while (ttesz >= HBLK_MIN_TTESZ) {
3750                 cbsaddr = rsaddr;
3751                 cbeaddr = rsaddr;
3752                 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3753                         ttesz--;
3754                         continue;
3755                 }
3756                 cnt = 0;
3757                 va = rsaddr;
3758                 while (va < readdr) {
3759                         ASSERT(va >= rhsaddr);
3760                         if (va != cbeaddr) {
3761                                 if (cbeaddr != cbsaddr) {
3762                                         ASSERT(cbeaddr > cbsaddr);
3763                                         (*rcbfunc)(cbsaddr, cbeaddr,
3764                                             rsaddr, rsz, rgnp->rgn_obj,
3765                                             rgnp->rgn_objoff);
3766                                 }
3767                                 cbsaddr = va;
3768                                 cbeaddr = va;
3769                         }
3770                         sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3771                             ttesz, &cbeaddr);
3772                         cnt++;
3773                         va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3774                 }
3775                 if (cbeaddr != cbsaddr) {
3776                         ASSERT(cbeaddr > cbsaddr);
3777                         (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3778                             rsz, rgnp->rgn_obj,
3779                             rgnp->rgn_objoff);
3780                 }
3781                 ttesz--;
3782         }
3783 }
3784 
3785 /*
3786  * Release one hardware address translation lock on the given address range.
3787  */
3788 void
3789 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3790 {
3791         struct hmehash_bucket *hmebp;
3792         hmeblk_tag hblktag;
3793         int hmeshift, hashno = 1;
3794         struct hme_blk *hmeblkp, *list = NULL;
3795         caddr_t endaddr;
3796 
3797         ASSERT(sfmmup != NULL);
3798 
3799         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3800         ASSERT((len & MMU_PAGEOFFSET) == 0);
3801         endaddr = addr + len;
3802         hblktag.htag_id = sfmmup;
3803         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3804 
3805         /*
3806          * Spitfire supports 4 page sizes.
3807          * Most pages are expected to be of the smallest page size (8K) and
3808          * these will not need to be rehashed. 64K pages also don't need to be
3809          * rehashed because an hmeblk spans 64K of address space. 512K pages
3810          * might need 1 rehash and and 4M pages might need 2 rehashes.
3811          */
3812         while (addr < endaddr) {
3813                 hmeshift = HME_HASH_SHIFT(hashno);
3814                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3815                 hblktag.htag_rehash = hashno;
3816                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3817 
3818                 SFMMU_HASH_LOCK(hmebp);
3819 
3820                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3821                 if (hmeblkp != NULL) {
3822                         ASSERT(!hmeblkp->hblk_shared);
3823                         /*
3824                          * If we encounter a shadow hmeblk then
3825                          * we know there are no valid hmeblks mapping
3826                          * this address at this size or larger.
3827                          * Just increment address by the smallest
3828                          * page size.
3829                          */
3830                         if (hmeblkp->hblk_shw_bit) {
3831                                 addr += MMU_PAGESIZE;
3832                         } else {
3833                                 addr = sfmmu_hblk_unlock(hmeblkp, addr,
3834                                     endaddr);
3835                         }
3836                         SFMMU_HASH_UNLOCK(hmebp);
3837                         hashno = 1;
3838                         continue;
3839                 }
3840                 SFMMU_HASH_UNLOCK(hmebp);
3841 
3842                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
3843                         /*
3844                          * We have traversed the whole list and rehashed
3845                          * if necessary without finding the address to unlock
3846                          * which should never happen.
3847                          */
3848                         panic("sfmmu_unlock: addr not found. "
3849                             "addr %p hat %p", (void *)addr, (void *)sfmmup);
3850                 } else {
3851                         hashno++;
3852                 }
3853         }
3854 
3855         sfmmu_hblks_list_purge(&list, 0);
3856 }
3857 
3858 void
3859 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
3860     hat_region_cookie_t rcookie)
3861 {
3862         sf_srd_t *srdp;
3863         sf_region_t *rgnp;
3864         int ttesz;
3865         uint_t rid;
3866         caddr_t eaddr;
3867         caddr_t va;
3868         int hmeshift;
3869         hmeblk_tag hblktag;
3870         struct hmehash_bucket *hmebp;
3871         struct hme_blk *hmeblkp;
3872         struct hme_blk *pr_hblk;
3873         struct hme_blk *list;
3874 
3875         if (rcookie == HAT_INVALID_REGION_COOKIE) {
3876                 hat_unlock(sfmmup, addr, len);
3877                 return;
3878         }
3879 
3880         ASSERT(sfmmup != NULL);
3881         ASSERT(sfmmup != ksfmmup);
3882 
3883         srdp = sfmmup->sfmmu_srdp;
3884         rid = (uint_t)((uint64_t)rcookie);
3885         VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
3886         eaddr = addr + len;
3887         va = addr;
3888         list = NULL;
3889         rgnp = srdp->srd_hmergnp[rid];
3890         SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
3891 
3892         ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
3893         ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
3894         if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
3895                 ttesz = HBLK_MIN_TTESZ;
3896         } else {
3897                 ttesz = rgnp->rgn_pgszc;
3898         }
3899         while (va < eaddr) {
3900                 while (ttesz < rgnp->rgn_pgszc &&
3901                     IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
3902                         ttesz++;
3903                 }
3904                 while (ttesz >= HBLK_MIN_TTESZ) {
3905                         if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3906                                 ttesz--;
3907                                 continue;
3908                         }
3909                         hmeshift = HME_HASH_SHIFT(ttesz);
3910                         hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
3911                         hblktag.htag_rehash = ttesz;
3912                         hblktag.htag_rid = rid;
3913                         hblktag.htag_id = srdp;
3914                         hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
3915                         SFMMU_HASH_LOCK(hmebp);
3916                         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
3917                             &list);
3918                         if (hmeblkp == NULL) {
3919                                 SFMMU_HASH_UNLOCK(hmebp);
3920                                 ttesz--;
3921                                 continue;
3922                         }
3923                         ASSERT(hmeblkp->hblk_shared);
3924                         va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
3925                         ASSERT(va >= eaddr ||
3926                             IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
3927                         SFMMU_HASH_UNLOCK(hmebp);
3928                         break;
3929                 }
3930                 if (ttesz < HBLK_MIN_TTESZ) {
3931                         panic("hat_unlock_region: addr not found "
3932                             "addr %p hat %p", (void *)va, (void *)sfmmup);
3933                 }
3934         }
3935         sfmmu_hblks_list_purge(&list, 0);
3936 }
3937 
3938 /*
3939  * Function to unlock a range of addresses in an hmeblk.  It returns the
3940  * next address that needs to be unlocked.
3941  * Should be called with the hash lock held.
3942  */
3943 static caddr_t
3944 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
3945 {
3946         struct sf_hment *sfhme;
3947         tte_t tteold, ttemod;
3948         int ttesz, ret;
3949 
3950         ASSERT(in_hblk_range(hmeblkp, addr));
3951         ASSERT(hmeblkp->hblk_shw_bit == 0);
3952 
3953         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
3954         ttesz = get_hblk_ttesz(hmeblkp);
3955 
3956         HBLKTOHME(sfhme, hmeblkp, addr);
3957         while (addr < endaddr) {
3958 readtte:
3959                 sfmmu_copytte(&sfhme->hme_tte, &tteold);
3960                 if (TTE_IS_VALID(&tteold)) {
3961 
3962                         ttemod = tteold;
3963 
3964                         ret = sfmmu_modifytte_try(&tteold, &ttemod,
3965                             &sfhme->hme_tte);
3966 
3967                         if (ret < 0)
3968                                 goto readtte;
3969 
3970                         if (hmeblkp->hblk_lckcnt == 0)
3971                                 panic("zero hblk lckcnt");
3972 
3973                         if (((uintptr_t)addr + TTEBYTES(ttesz)) >
3974                             (uintptr_t)endaddr)
3975                                 panic("can't unlock large tte");
3976 
3977                         ASSERT(hmeblkp->hblk_lckcnt > 0);
3978                         atomic_dec_32(&hmeblkp->hblk_lckcnt);
3979                         HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
3980                 } else {
3981                         panic("sfmmu_hblk_unlock: invalid tte");
3982                 }
3983                 addr += TTEBYTES(ttesz);
3984                 sfhme++;
3985         }
3986         return (addr);
3987 }
3988 
3989 /*
3990  * Physical Address Mapping Framework
3991  *
3992  * General rules:
3993  *
3994  * (1) Applies only to seg_kmem memory pages. To make things easier,
3995  *     seg_kpm addresses are also accepted by the routines, but nothing
3996  *     is done with them since by definition their PA mappings are static.
3997  * (2) hat_add_callback() may only be called while holding the page lock
3998  *     SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
3999  *     or passing HAC_PAGELOCK flag.
4000  * (3) prehandler() and posthandler() may not call hat_add_callback() or
4001  *     hat_delete_callback(), nor should they allocate memory. Post quiesce
4002  *     callbacks may not sleep or acquire adaptive mutex locks.
4003  * (4) Either prehandler() or posthandler() (but not both) may be specified
4004  *     as being NULL.  Specifying an errhandler() is optional.
4005  *
4006  * Details of using the framework:
4007  *
4008  * registering a callback (hat_register_callback())
4009  *
4010  *      Pass prehandler, posthandler, errhandler addresses
4011  *      as described below. If capture_cpus argument is nonzero,
4012  *      suspend callback to the prehandler will occur with CPUs
4013  *      captured and executing xc_loop() and CPUs will remain
4014  *      captured until after the posthandler suspend callback
4015  *      occurs.
4016  *
4017  * adding a callback (hat_add_callback())
4018  *
4019  *      as_pagelock();
4020  *      hat_add_callback();
4021  *      save returned pfn in private data structures or program registers;
4022  *      as_pageunlock();
4023  *
4024  * prehandler()
4025  *
4026  *      Stop all accesses by physical address to this memory page.
4027  *      Called twice: the first, PRESUSPEND, is a context safe to acquire
4028  *      adaptive locks. The second, SUSPEND, is called at high PIL with
4029  *      CPUs captured so adaptive locks may NOT be acquired (and all spin
4030  *      locks must be XCALL_PIL or higher locks).
4031  *
4032  *      May return the following errors:
4033  *              EIO:    A fatal error has occurred. This will result in panic.
4034  *              EAGAIN: The page cannot be suspended. This will fail the
4035  *                      relocation.
4036  *              0:      Success.
4037  *
4038  * posthandler()
4039  *
4040  *      Save new pfn in private data structures or program registers;
4041  *      not allowed to fail (non-zero return values will result in panic).
4042  *
4043  * errhandler()
4044  *
4045  *      called when an error occurs related to the callback.  Currently
4046  *      the only such error is HAT_CB_ERR_LEAKED which indicates that
4047  *      a page is being freed, but there are still outstanding callback(s)
4048  *      registered on the page.
4049  *
4050  * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4051  *
4052  *      stop using physical address
4053  *      hat_delete_callback();
4054  *
4055  */
4056 
4057 /*
4058  * Register a callback class.  Each subsystem should do this once and
4059  * cache the id_t returned for use in setting up and tearing down callbacks.
4060  *
4061  * There is no facility for removing callback IDs once they are created;
4062  * the "key" should be unique for each module, so in case a module is unloaded
4063  * and subsequently re-loaded, we can recycle the module's previous entry.
4064  */
4065 id_t
4066 hat_register_callback(int key,
4067         int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4068         int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4069         int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4070         int capture_cpus)
4071 {
4072         id_t id;
4073 
4074         /*
4075          * Search the table for a pre-existing callback associated with
4076          * the identifier "key".  If one exists, we re-use that entry in
4077          * the table for this instance, otherwise we assign the next
4078          * available table slot.
4079          */
4080         for (id = 0; id < sfmmu_max_cb_id; id++) {
4081                 if (sfmmu_cb_table[id].key == key)
4082                         break;
4083         }
4084 
4085         if (id == sfmmu_max_cb_id) {
4086                 id = sfmmu_cb_nextid++;
4087                 if (id >= sfmmu_max_cb_id)
4088                         panic("hat_register_callback: out of callback IDs");
4089         }
4090 
4091         ASSERT(prehandler != NULL || posthandler != NULL);
4092 
4093         sfmmu_cb_table[id].key = key;
4094         sfmmu_cb_table[id].prehandler = prehandler;
4095         sfmmu_cb_table[id].posthandler = posthandler;
4096         sfmmu_cb_table[id].errhandler = errhandler;
4097         sfmmu_cb_table[id].capture_cpus = capture_cpus;
4098 
4099         return (id);
4100 }
4101 
4102 #define HAC_COOKIE_NONE (void *)-1
4103 
4104 /*
4105  * Add relocation callbacks to the specified addr/len which will be called
4106  * when relocating the associated page. See the description of pre and
4107  * posthandler above for more details.
4108  *
4109  * If HAC_PAGELOCK is included in flags, the underlying memory page is
4110  * locked internally so the caller must be able to deal with the callback
4111  * running even before this function has returned.  If HAC_PAGELOCK is not
4112  * set, it is assumed that the underlying memory pages are locked.
4113  *
4114  * Since the caller must track the individual page boundaries anyway,
4115  * we only allow a callback to be added to a single page (large
4116  * or small).  Thus [addr, addr + len) MUST be contained within a single
4117  * page.
4118  *
4119  * Registering multiple callbacks on the same [addr, addr+len) is supported,
4120  * _provided_that_ a unique parameter is specified for each callback.
4121  * If multiple callbacks are registered on the same range the callback will
4122  * be invoked with each unique parameter. Registering the same callback with
4123  * the same argument more than once will result in corrupted kernel state.
4124  *
4125  * Returns the pfn of the underlying kernel page in *rpfn
4126  * on success, or PFN_INVALID on failure.
4127  *
4128  * cookiep (if passed) provides storage space for an opaque cookie
4129  * to return later to hat_delete_callback(). This cookie makes the callback
4130  * deletion significantly quicker by avoiding a potentially lengthy hash
4131  * search.
4132  *
4133  * Returns values:
4134  *    0:      success
4135  *    ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4136  *    EINVAL: callback ID is not valid
4137  *    ENXIO:  ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4138  *            space
4139  *    ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4140  */
4141 int
4142 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4143         void *pvt, pfn_t *rpfn, void **cookiep)
4144 {
4145         struct          hmehash_bucket *hmebp;
4146         hmeblk_tag      hblktag;
4147         struct hme_blk  *hmeblkp;
4148         int             hmeshift, hashno;
4149         caddr_t         saddr, eaddr, baseaddr;
4150         struct pa_hment *pahmep;
4151         struct sf_hment *sfhmep, *osfhmep;
4152         kmutex_t        *pml;
4153         tte_t           tte;
4154         page_t          *pp;
4155         vnode_t         *vp;
4156         u_offset_t      off;
4157         pfn_t           pfn;
4158         int             kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4159         int             locked = 0;
4160 
4161         /*
4162          * For KPM mappings, just return the physical address since we
4163          * don't need to register any callbacks.
4164          */
4165         if (IS_KPM_ADDR(vaddr)) {
4166                 uint64_t paddr;
4167                 SFMMU_KPM_VTOP(vaddr, paddr);
4168                 *rpfn = btop(paddr);
4169                 if (cookiep != NULL)
4170                         *cookiep = HAC_COOKIE_NONE;
4171                 return (0);
4172         }
4173 
4174         if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4175                 *rpfn = PFN_INVALID;
4176                 return (EINVAL);
4177         }
4178 
4179         if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4180                 *rpfn = PFN_INVALID;
4181                 return (ENOMEM);
4182         }
4183 
4184         sfhmep = &pahmep->sfment;
4185 
4186         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4187         eaddr = saddr + len;
4188 
4189 rehash:
4190         /* Find the mapping(s) for this page */
4191         for (hashno = TTE64K, hmeblkp = NULL;
4192             hmeblkp == NULL && hashno <= mmu_hashcnt;
4193             hashno++) {
4194                 hmeshift = HME_HASH_SHIFT(hashno);
4195                 hblktag.htag_id = ksfmmup;
4196                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4197                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4198                 hblktag.htag_rehash = hashno;
4199                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4200 
4201                 SFMMU_HASH_LOCK(hmebp);
4202 
4203                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4204 
4205                 if (hmeblkp == NULL)
4206                         SFMMU_HASH_UNLOCK(hmebp);
4207         }
4208 
4209         if (hmeblkp == NULL) {
4210                 kmem_cache_free(pa_hment_cache, pahmep);
4211                 *rpfn = PFN_INVALID;
4212                 return (ENXIO);
4213         }
4214 
4215         ASSERT(!hmeblkp->hblk_shared);
4216 
4217         HBLKTOHME(osfhmep, hmeblkp, saddr);
4218         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4219 
4220         if (!TTE_IS_VALID(&tte)) {
4221                 SFMMU_HASH_UNLOCK(hmebp);
4222                 kmem_cache_free(pa_hment_cache, pahmep);
4223                 *rpfn = PFN_INVALID;
4224                 return (ENXIO);
4225         }
4226 
4227         /*
4228          * Make sure the boundaries for the callback fall within this
4229          * single mapping.
4230          */
4231         baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4232         ASSERT(saddr >= baseaddr);
4233         if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4234                 SFMMU_HASH_UNLOCK(hmebp);
4235                 kmem_cache_free(pa_hment_cache, pahmep);
4236                 *rpfn = PFN_INVALID;
4237                 return (ERANGE);
4238         }
4239 
4240         pfn = sfmmu_ttetopfn(&tte, vaddr);
4241 
4242         /*
4243          * The pfn may not have a page_t underneath in which case we
4244          * just return it. This can happen if we are doing I/O to a
4245          * static portion of the kernel's address space, for instance.
4246          */
4247         pp = osfhmep->hme_page;
4248         if (pp == NULL) {
4249                 SFMMU_HASH_UNLOCK(hmebp);
4250                 kmem_cache_free(pa_hment_cache, pahmep);
4251                 *rpfn = pfn;
4252                 if (cookiep)
4253                         *cookiep = HAC_COOKIE_NONE;
4254                 return (0);
4255         }
4256         ASSERT(pp == PP_PAGEROOT(pp));
4257 
4258         vp = pp->p_vnode;
4259         off = pp->p_offset;
4260 
4261         pml = sfmmu_mlist_enter(pp);
4262 
4263         if (flags & HAC_PAGELOCK) {
4264                 if (!page_trylock(pp, SE_SHARED)) {
4265                         /*
4266                          * Somebody is holding SE_EXCL lock. Might
4267                          * even be hat_page_relocate(). Drop all
4268                          * our locks, lookup the page in &kvp, and
4269                          * retry. If it doesn't exist in &kvp and &zvp,
4270                          * then we must be dealing with a kernel mapped
4271                          * page which doesn't actually belong to
4272                          * segkmem so we punt.
4273                          */
4274                         sfmmu_mlist_exit(pml);
4275                         SFMMU_HASH_UNLOCK(hmebp);
4276                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4277 
4278                         /* check zvp before giving up */
4279                         if (pp == NULL)
4280                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4281                                     SE_SHARED);
4282 
4283                         /* Okay, we didn't find it, give up */
4284                         if (pp == NULL) {
4285                                 kmem_cache_free(pa_hment_cache, pahmep);
4286                                 *rpfn = pfn;
4287                                 if (cookiep)
4288                                         *cookiep = HAC_COOKIE_NONE;
4289                                 return (0);
4290                         }
4291                         page_unlock(pp);
4292                         goto rehash;
4293                 }
4294                 locked = 1;
4295         }
4296 
4297         if (!PAGE_LOCKED(pp) && !panicstr)
4298                 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4299 
4300         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4301             pp->p_offset != off) {
4302                 /*
4303                  * The page moved before we got our hands on it.  Drop
4304                  * all the locks and try again.
4305                  */
4306                 ASSERT((flags & HAC_PAGELOCK) != 0);
4307                 sfmmu_mlist_exit(pml);
4308                 SFMMU_HASH_UNLOCK(hmebp);
4309                 page_unlock(pp);
4310                 locked = 0;
4311                 goto rehash;
4312         }
4313 
4314         if (!VN_ISKAS(vp)) {
4315                 /*
4316                  * This is not a segkmem page but another page which
4317                  * has been kernel mapped. It had better have at least
4318                  * a share lock on it. Return the pfn.
4319                  */
4320                 sfmmu_mlist_exit(pml);
4321                 SFMMU_HASH_UNLOCK(hmebp);
4322                 if (locked)
4323                         page_unlock(pp);
4324                 kmem_cache_free(pa_hment_cache, pahmep);
4325                 ASSERT(PAGE_LOCKED(pp));
4326                 *rpfn = pfn;
4327                 if (cookiep)
4328                         *cookiep = HAC_COOKIE_NONE;
4329                 return (0);
4330         }
4331 
4332         /*
4333          * Setup this pa_hment and link its embedded dummy sf_hment into
4334          * the mapping list.
4335          */
4336         pp->p_share++;
4337         pahmep->cb_id = callback_id;
4338         pahmep->addr = vaddr;
4339         pahmep->len = len;
4340         pahmep->refcnt = 1;
4341         pahmep->flags = 0;
4342         pahmep->pvt = pvt;
4343 
4344         sfhmep->hme_tte.ll = 0;
4345         sfhmep->hme_data = pahmep;
4346         sfhmep->hme_prev = osfhmep;
4347         sfhmep->hme_next = osfhmep->hme_next;
4348 
4349         if (osfhmep->hme_next)
4350                 osfhmep->hme_next->hme_prev = sfhmep;
4351 
4352         osfhmep->hme_next = sfhmep;
4353 
4354         sfmmu_mlist_exit(pml);
4355         SFMMU_HASH_UNLOCK(hmebp);
4356 
4357         if (locked)
4358                 page_unlock(pp);
4359 
4360         *rpfn = pfn;
4361         if (cookiep)
4362                 *cookiep = (void *)pahmep;
4363 
4364         return (0);
4365 }
4366 
4367 /*
4368  * Remove the relocation callbacks from the specified addr/len.
4369  */
4370 void
4371 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4372         void *cookie)
4373 {
4374         struct          hmehash_bucket *hmebp;
4375         hmeblk_tag      hblktag;
4376         struct hme_blk  *hmeblkp;
4377         int             hmeshift, hashno;
4378         caddr_t         saddr;
4379         struct pa_hment *pahmep;
4380         struct sf_hment *sfhmep, *osfhmep;
4381         kmutex_t        *pml;
4382         tte_t           tte;
4383         page_t          *pp;
4384         vnode_t         *vp;
4385         u_offset_t      off;
4386         int             locked = 0;
4387 
4388         /*
4389          * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4390          * remove so just return.
4391          */
4392         if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4393                 return;
4394 
4395         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4396 
4397 rehash:
4398         /* Find the mapping(s) for this page */
4399         for (hashno = TTE64K, hmeblkp = NULL;
4400             hmeblkp == NULL && hashno <= mmu_hashcnt;
4401             hashno++) {
4402                 hmeshift = HME_HASH_SHIFT(hashno);
4403                 hblktag.htag_id = ksfmmup;
4404                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4405                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4406                 hblktag.htag_rehash = hashno;
4407                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4408 
4409                 SFMMU_HASH_LOCK(hmebp);
4410 
4411                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4412 
4413                 if (hmeblkp == NULL)
4414                         SFMMU_HASH_UNLOCK(hmebp);
4415         }
4416 
4417         if (hmeblkp == NULL)
4418                 return;
4419 
4420         ASSERT(!hmeblkp->hblk_shared);
4421 
4422         HBLKTOHME(osfhmep, hmeblkp, saddr);
4423 
4424         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4425         if (!TTE_IS_VALID(&tte)) {
4426                 SFMMU_HASH_UNLOCK(hmebp);
4427                 return;
4428         }
4429 
4430         pp = osfhmep->hme_page;
4431         if (pp == NULL) {
4432                 SFMMU_HASH_UNLOCK(hmebp);
4433                 ASSERT(cookie == NULL);
4434                 return;
4435         }
4436 
4437         vp = pp->p_vnode;
4438         off = pp->p_offset;
4439 
4440         pml = sfmmu_mlist_enter(pp);
4441 
4442         if (flags & HAC_PAGELOCK) {
4443                 if (!page_trylock(pp, SE_SHARED)) {
4444                         /*
4445                          * Somebody is holding SE_EXCL lock. Might
4446                          * even be hat_page_relocate(). Drop all
4447                          * our locks, lookup the page in &kvp, and
4448                          * retry. If it doesn't exist in &kvp and &zvp,
4449                          * then we must be dealing with a kernel mapped
4450                          * page which doesn't actually belong to
4451                          * segkmem so we punt.
4452                          */
4453                         sfmmu_mlist_exit(pml);
4454                         SFMMU_HASH_UNLOCK(hmebp);
4455                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4456                         /* check zvp before giving up */
4457                         if (pp == NULL)
4458                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4459                                     SE_SHARED);
4460 
4461                         if (pp == NULL) {
4462                                 ASSERT(cookie == NULL);
4463                                 return;
4464                         }
4465                         page_unlock(pp);
4466                         goto rehash;
4467                 }
4468                 locked = 1;
4469         }
4470 
4471         ASSERT(PAGE_LOCKED(pp));
4472 
4473         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4474             pp->p_offset != off) {
4475                 /*
4476                  * The page moved before we got our hands on it.  Drop
4477                  * all the locks and try again.
4478                  */
4479                 ASSERT((flags & HAC_PAGELOCK) != 0);
4480                 sfmmu_mlist_exit(pml);
4481                 SFMMU_HASH_UNLOCK(hmebp);
4482                 page_unlock(pp);
4483                 locked = 0;
4484                 goto rehash;
4485         }
4486 
4487         if (!VN_ISKAS(vp)) {
4488                 /*
4489                  * This is not a segkmem page but another page which
4490                  * has been kernel mapped.
4491                  */
4492                 sfmmu_mlist_exit(pml);
4493                 SFMMU_HASH_UNLOCK(hmebp);
4494                 if (locked)
4495                         page_unlock(pp);
4496                 ASSERT(cookie == NULL);
4497                 return;
4498         }
4499 
4500         if (cookie != NULL) {
4501                 pahmep = (struct pa_hment *)cookie;
4502                 sfhmep = &pahmep->sfment;
4503         } else {
4504                 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4505                     sfhmep = sfhmep->hme_next) {
4506 
4507                         /*
4508                          * skip va<->pa mappings
4509                          */
4510                         if (!IS_PAHME(sfhmep))
4511                                 continue;
4512 
4513                         pahmep = sfhmep->hme_data;
4514                         ASSERT(pahmep != NULL);
4515 
4516                         /*
4517                          * if pa_hment matches, remove it
4518                          */
4519                         if ((pahmep->pvt == pvt) &&
4520                             (pahmep->addr == vaddr) &&
4521                             (pahmep->len == len)) {
4522                                 break;
4523                         }
4524                 }
4525         }
4526 
4527         if (sfhmep == NULL) {
4528                 if (!panicstr) {
4529                         panic("hat_delete_callback: pa_hment not found, pp %p",
4530                             (void *)pp);
4531                 }
4532                 return;
4533         }
4534 
4535         /*
4536          * Note: at this point a valid kernel mapping must still be
4537          * present on this page.
4538          */
4539         pp->p_share--;
4540         if (pp->p_share <= 0)
4541                 panic("hat_delete_callback: zero p_share");
4542 
4543         if (--pahmep->refcnt == 0) {
4544                 if (pahmep->flags != 0)
4545                         panic("hat_delete_callback: pa_hment is busy");
4546 
4547                 /*
4548                  * Remove sfhmep from the mapping list for the page.
4549                  */
4550                 if (sfhmep->hme_prev) {
4551                         sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4552                 } else {
4553                         pp->p_mapping = sfhmep->hme_next;
4554                 }
4555 
4556                 if (sfhmep->hme_next)
4557                         sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4558 
4559                 sfmmu_mlist_exit(pml);
4560                 SFMMU_HASH_UNLOCK(hmebp);
4561 
4562                 if (locked)
4563                         page_unlock(pp);
4564 
4565                 kmem_cache_free(pa_hment_cache, pahmep);
4566                 return;
4567         }
4568 
4569         sfmmu_mlist_exit(pml);
4570         SFMMU_HASH_UNLOCK(hmebp);
4571         if (locked)
4572                 page_unlock(pp);
4573 }
4574 
4575 /*
4576  * hat_probe returns 1 if the translation for the address 'addr' is
4577  * loaded, zero otherwise.
4578  *
4579  * hat_probe should be used only for advisorary purposes because it may
4580  * occasionally return the wrong value. The implementation must guarantee that
4581  * returning the wrong value is a very rare event. hat_probe is used
4582  * to implement optimizations in the segment drivers.
4583  *
4584  */
4585 int
4586 hat_probe(struct hat *sfmmup, caddr_t addr)
4587 {
4588         pfn_t pfn;
4589         tte_t tte;
4590 
4591         ASSERT(sfmmup != NULL);
4592 
4593         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4594 
4595         if (sfmmup == ksfmmup) {
4596                 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4597                     == PFN_SUSPENDED) {
4598                         sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4599                 }
4600         } else {
4601                 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4602         }
4603 
4604         if (pfn != PFN_INVALID)
4605                 return (1);
4606         else
4607                 return (0);
4608 }
4609 
4610 ssize_t
4611 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4612 {
4613         tte_t tte;
4614 
4615         if (sfmmup == ksfmmup) {
4616                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4617                         return (-1);
4618                 }
4619         } else {
4620                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4621                         return (-1);
4622                 }
4623         }
4624 
4625         ASSERT(TTE_IS_VALID(&tte));
4626         return (TTEBYTES(TTE_CSZ(&tte)));
4627 }
4628 
4629 uint_t
4630 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4631 {
4632         tte_t tte;
4633 
4634         if (sfmmup == ksfmmup) {
4635                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4636                         tte.ll = 0;
4637                 }
4638         } else {
4639                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4640                         tte.ll = 0;
4641                 }
4642         }
4643         if (TTE_IS_VALID(&tte)) {
4644                 *attr = sfmmu_ptov_attr(&tte);
4645                 return (0);
4646         }
4647         *attr = 0;
4648         return ((uint_t)0xffffffff);
4649 }
4650 
4651 /*
4652  * Enables more attributes on specified address range (ie. logical OR)
4653  */
4654 void
4655 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4656 {
4657         ASSERT(hat->sfmmu_as != NULL);
4658 
4659         sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4660 }
4661 
4662 /*
4663  * Assigns attributes to the specified address range.  All the attributes
4664  * are specified.
4665  */
4666 void
4667 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4668 {
4669         ASSERT(hat->sfmmu_as != NULL);
4670 
4671         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4672 }
4673 
4674 /*
4675  * Remove attributes on the specified address range (ie. loginal NAND)
4676  */
4677 void
4678 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4679 {
4680         ASSERT(hat->sfmmu_as != NULL);
4681 
4682         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4683 }
4684 
4685 /*
4686  * Change attributes on an address range to that specified by attr and mode.
4687  */
4688 static void
4689 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4690         int mode)
4691 {
4692         struct hmehash_bucket *hmebp;
4693         hmeblk_tag hblktag;
4694         int hmeshift, hashno = 1;
4695         struct hme_blk *hmeblkp, *list = NULL;
4696         caddr_t endaddr;
4697         cpuset_t cpuset;
4698         demap_range_t dmr;
4699 
4700         CPUSET_ZERO(cpuset);
4701 
4702         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4703         ASSERT((len & MMU_PAGEOFFSET) == 0);
4704         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4705 
4706         if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4707             ((addr + len) > (caddr_t)USERLIMIT)) {
4708                 panic("user addr %p in kernel space",
4709                     (void *)addr);
4710         }
4711 
4712         endaddr = addr + len;
4713         hblktag.htag_id = sfmmup;
4714         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4715         DEMAP_RANGE_INIT(sfmmup, &dmr);
4716 
4717         while (addr < endaddr) {
4718                 hmeshift = HME_HASH_SHIFT(hashno);
4719                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4720                 hblktag.htag_rehash = hashno;
4721                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4722 
4723                 SFMMU_HASH_LOCK(hmebp);
4724 
4725                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4726                 if (hmeblkp != NULL) {
4727                         ASSERT(!hmeblkp->hblk_shared);
4728                         /*
4729                          * We've encountered a shadow hmeblk so skip the range
4730                          * of the next smaller mapping size.
4731                          */
4732                         if (hmeblkp->hblk_shw_bit) {
4733                                 ASSERT(sfmmup != ksfmmup);
4734                                 ASSERT(hashno > 1);
4735                                 addr = (caddr_t)P2END((uintptr_t)addr,
4736                                     TTEBYTES(hashno - 1));
4737                         } else {
4738                                 addr = sfmmu_hblk_chgattr(sfmmup,
4739                                     hmeblkp, addr, endaddr, &dmr, attr, mode);
4740                         }
4741                         SFMMU_HASH_UNLOCK(hmebp);
4742                         hashno = 1;
4743                         continue;
4744                 }
4745                 SFMMU_HASH_UNLOCK(hmebp);
4746 
4747                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4748                         /*
4749                          * We have traversed the whole list and rehashed
4750                          * if necessary without finding the address to chgattr.
4751                          * This is ok, so we increment the address by the
4752                          * smallest hmeblk range for kernel mappings or for
4753                          * user mappings with no large pages, and the largest
4754                          * hmeblk range, to account for shadow hmeblks, for
4755                          * user mappings with large pages and continue.
4756                          */
4757                         if (sfmmup == ksfmmup)
4758                                 addr = (caddr_t)P2END((uintptr_t)addr,
4759                                     TTEBYTES(1));
4760                         else
4761                                 addr = (caddr_t)P2END((uintptr_t)addr,
4762                                     TTEBYTES(hashno));
4763                         hashno = 1;
4764                 } else {
4765                         hashno++;
4766                 }
4767         }
4768 
4769         sfmmu_hblks_list_purge(&list, 0);
4770         DEMAP_RANGE_FLUSH(&dmr);
4771         cpuset = sfmmup->sfmmu_cpusran;
4772         xt_sync(cpuset);
4773 }
4774 
4775 /*
4776  * This function chgattr on a range of addresses in an hmeblk.  It returns the
4777  * next addres that needs to be chgattr.
4778  * It should be called with the hash lock held.
4779  * XXX It should be possible to optimize chgattr by not flushing every time but
4780  * on the other hand:
4781  * 1. do one flush crosscall.
4782  * 2. only flush if we are increasing permissions (make sure this will work)
4783  */
4784 static caddr_t
4785 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
4786         caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
4787 {
4788         tte_t tte, tteattr, tteflags, ttemod;
4789         struct sf_hment *sfhmep;
4790         int ttesz;
4791         struct page *pp = NULL;
4792         kmutex_t *pml, *pmtx;
4793         int ret;
4794         int use_demap_range;
4795 #if defined(SF_ERRATA_57)
4796         int check_exec;
4797 #endif
4798 
4799         ASSERT(in_hblk_range(hmeblkp, addr));
4800         ASSERT(hmeblkp->hblk_shw_bit == 0);
4801         ASSERT(!hmeblkp->hblk_shared);
4802 
4803         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4804         ttesz = get_hblk_ttesz(hmeblkp);
4805 
4806         /*
4807          * Flush the current demap region if addresses have been
4808          * skipped or the page size doesn't match.
4809          */
4810         use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
4811         if (use_demap_range) {
4812                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
4813         } else if (dmrp != NULL) {
4814                 DEMAP_RANGE_FLUSH(dmrp);
4815         }
4816 
4817         tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
4818 #if defined(SF_ERRATA_57)
4819         check_exec = (sfmmup != ksfmmup) &&
4820             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
4821             TTE_IS_EXECUTABLE(&tteattr);
4822 #endif
4823         HBLKTOHME(sfhmep, hmeblkp, addr);
4824         while (addr < endaddr) {
4825                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
4826                 if (TTE_IS_VALID(&tte)) {
4827                         if ((tte.ll & tteflags.ll) == tteattr.ll) {
4828                                 /*
4829                                  * if the new attr is the same as old
4830                                  * continue
4831                                  */
4832                                 goto next_addr;
4833                         }
4834                         if (!TTE_IS_WRITABLE(&tteattr)) {
4835                                 /*
4836                                  * make sure we clear hw modify bit if we
4837                                  * removing write protections
4838                                  */
4839                                 tteflags.tte_intlo |= TTE_HWWR_INT;
4840                         }
4841 
4842                         pml = NULL;
4843                         pp = sfhmep->hme_page;
4844                         if (pp) {
4845                                 pml = sfmmu_mlist_enter(pp);
4846                         }
4847 
4848                         if (pp != sfhmep->hme_page) {
4849                                 /*
4850                                  * tte must have been unloaded.
4851                                  */
4852                                 ASSERT(pml);
4853                                 sfmmu_mlist_exit(pml);
4854                                 continue;
4855                         }
4856 
4857                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
4858 
4859                         ttemod = tte;
4860                         ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
4861                         ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
4862 
4863 #if defined(SF_ERRATA_57)
4864                         if (check_exec && addr < errata57_limit)
4865                                 ttemod.tte_exec_perm = 0;
4866 #endif
4867                         ret = sfmmu_modifytte_try(&tte, &ttemod,
4868                             &sfhmep->hme_tte);
4869 
4870                         if (ret < 0) {
4871                                 /* tte changed underneath us */
4872                                 if (pml) {
4873                                         sfmmu_mlist_exit(pml);
4874                                 }
4875                                 continue;
4876                         }
4877 
4878                         if (tteflags.tte_intlo & TTE_HWWR_INT) {
4879                                 /*
4880                                  * need to sync if we are clearing modify bit.
4881                                  */
4882                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
4883                         }
4884 
4885                         if (pp && PP_ISRO(pp)) {
4886                                 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
4887                                         pmtx = sfmmu_page_enter(pp);
4888                                         PP_CLRRO(pp);
4889                                         sfmmu_page_exit(pmtx);
4890                                 }
4891                         }
4892 
4893                         if (ret > 0 && use_demap_range) {
4894                                 DEMAP_RANGE_MARKPG(dmrp, addr);
4895                         } else if (ret > 0) {
4896                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
4897                         }
4898 
4899                         if (pml) {
4900                                 sfmmu_mlist_exit(pml);
4901                         }
4902                 }
4903 next_addr:
4904                 addr += TTEBYTES(ttesz);
4905                 sfhmep++;
4906                 DEMAP_RANGE_NEXTPG(dmrp);
4907         }
4908         return (addr);
4909 }
4910 
4911 /*
4912  * This routine converts virtual attributes to physical ones.  It will
4913  * update the tteflags field with the tte mask corresponding to the attributes
4914  * affected and it returns the new attributes.  It will also clear the modify
4915  * bit if we are taking away write permission.  This is necessary since the
4916  * modify bit is the hardware permission bit and we need to clear it in order
4917  * to detect write faults.
4918  */
4919 static uint64_t
4920 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
4921 {
4922         tte_t ttevalue;
4923 
4924         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
4925 
4926         switch (mode) {
4927         case SFMMU_CHGATTR:
4928                 /* all attributes specified */
4929                 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
4930                 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
4931                 ttemaskp->tte_inthi = TTEINTHI_ATTR;
4932                 ttemaskp->tte_intlo = TTEINTLO_ATTR;
4933                 break;
4934         case SFMMU_SETATTR:
4935                 ASSERT(!(attr & ~HAT_PROT_MASK));
4936                 ttemaskp->ll = 0;
4937                 ttevalue.ll = 0;
4938                 /*
4939                  * a valid tte implies exec and read for sfmmu
4940                  * so no need to do anything about them.
4941                  * since priviledged access implies user access
4942                  * PROT_USER doesn't make sense either.
4943                  */
4944                 if (attr & PROT_WRITE) {
4945                         ttemaskp->tte_intlo |= TTE_WRPRM_INT;
4946                         ttevalue.tte_intlo |= TTE_WRPRM_INT;
4947                 }
4948                 break;
4949         case SFMMU_CLRATTR:
4950                 /* attributes will be nand with current ones */
4951                 if (attr & ~(PROT_WRITE | PROT_USER)) {
4952                         panic("sfmmu: attr %x not supported", attr);
4953                 }
4954                 ttemaskp->ll = 0;
4955                 ttevalue.ll = 0;
4956                 if (attr & PROT_WRITE) {
4957                         /* clear both writable and modify bit */
4958                         ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
4959                 }
4960                 if (attr & PROT_USER) {
4961                         ttemaskp->tte_intlo |= TTE_PRIV_INT;
4962                         ttevalue.tte_intlo |= TTE_PRIV_INT;
4963                 }
4964                 break;
4965         default:
4966                 panic("sfmmu_vtop_attr: bad mode %x", mode);
4967         }
4968         ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
4969         return (ttevalue.ll);
4970 }
4971 
4972 static uint_t
4973 sfmmu_ptov_attr(tte_t *ttep)
4974 {
4975         uint_t attr;
4976 
4977         ASSERT(TTE_IS_VALID(ttep));
4978 
4979         attr = PROT_READ;
4980 
4981         if (TTE_IS_WRITABLE(ttep)) {
4982                 attr |= PROT_WRITE;
4983         }
4984         if (TTE_IS_EXECUTABLE(ttep)) {
4985                 attr |= PROT_EXEC;
4986         }
4987         if (!TTE_IS_PRIVILEGED(ttep)) {
4988                 attr |= PROT_USER;
4989         }
4990         if (TTE_IS_NFO(ttep)) {
4991                 attr |= HAT_NOFAULT;
4992         }
4993         if (TTE_IS_NOSYNC(ttep)) {
4994                 attr |= HAT_NOSYNC;
4995         }
4996         if (TTE_IS_SIDEFFECT(ttep)) {
4997                 attr |= SFMMU_SIDEFFECT;
4998         }
4999         if (!TTE_IS_VCACHEABLE(ttep)) {
5000                 attr |= SFMMU_UNCACHEVTTE;
5001         }
5002         if (!TTE_IS_PCACHEABLE(ttep)) {
5003                 attr |= SFMMU_UNCACHEPTTE;
5004         }
5005         return (attr);
5006 }
5007 
5008 /*
5009  * hat_chgprot is a deprecated hat call.  New segment drivers
5010  * should store all attributes and use hat_*attr calls.
5011  *
5012  * Change the protections in the virtual address range
5013  * given to the specified virtual protection.  If vprot is ~PROT_WRITE,
5014  * then remove write permission, leaving the other
5015  * permissions unchanged.  If vprot is ~PROT_USER, remove user permissions.
5016  *
5017  */
5018 void
5019 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5020 {
5021         struct hmehash_bucket *hmebp;
5022         hmeblk_tag hblktag;
5023         int hmeshift, hashno = 1;
5024         struct hme_blk *hmeblkp, *list = NULL;
5025         caddr_t endaddr;
5026         cpuset_t cpuset;
5027         demap_range_t dmr;
5028 
5029         ASSERT((len & MMU_PAGEOFFSET) == 0);
5030         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5031 
5032         ASSERT(sfmmup->sfmmu_as != NULL);
5033 
5034         CPUSET_ZERO(cpuset);
5035 
5036         if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5037             ((addr + len) > (caddr_t)USERLIMIT)) {
5038                 panic("user addr %p vprot %x in kernel space",
5039                     (void *)addr, vprot);
5040         }
5041         endaddr = addr + len;
5042         hblktag.htag_id = sfmmup;
5043         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5044         DEMAP_RANGE_INIT(sfmmup, &dmr);
5045 
5046         while (addr < endaddr) {
5047                 hmeshift = HME_HASH_SHIFT(hashno);
5048                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5049                 hblktag.htag_rehash = hashno;
5050                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5051 
5052                 SFMMU_HASH_LOCK(hmebp);
5053 
5054                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5055                 if (hmeblkp != NULL) {
5056                         ASSERT(!hmeblkp->hblk_shared);
5057                         /*
5058                          * We've encountered a shadow hmeblk so skip the range
5059                          * of the next smaller mapping size.
5060                          */
5061                         if (hmeblkp->hblk_shw_bit) {
5062                                 ASSERT(sfmmup != ksfmmup);
5063                                 ASSERT(hashno > 1);
5064                                 addr = (caddr_t)P2END((uintptr_t)addr,
5065                                     TTEBYTES(hashno - 1));
5066                         } else {
5067                                 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5068                                     addr, endaddr, &dmr, vprot);
5069                         }
5070                         SFMMU_HASH_UNLOCK(hmebp);
5071                         hashno = 1;
5072                         continue;
5073                 }
5074                 SFMMU_HASH_UNLOCK(hmebp);
5075 
5076                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5077                         /*
5078                          * We have traversed the whole list and rehashed
5079                          * if necessary without finding the address to chgprot.
5080                          * This is ok so we increment the address by the
5081                          * smallest hmeblk range for kernel mappings and the
5082                          * largest hmeblk range, to account for shadow hmeblks,
5083                          * for user mappings and continue.
5084                          */
5085                         if (sfmmup == ksfmmup)
5086                                 addr = (caddr_t)P2END((uintptr_t)addr,
5087                                     TTEBYTES(1));
5088                         else
5089                                 addr = (caddr_t)P2END((uintptr_t)addr,
5090                                     TTEBYTES(hashno));
5091                         hashno = 1;
5092                 } else {
5093                         hashno++;
5094                 }
5095         }
5096 
5097         sfmmu_hblks_list_purge(&list, 0);
5098         DEMAP_RANGE_FLUSH(&dmr);
5099         cpuset = sfmmup->sfmmu_cpusran;
5100         xt_sync(cpuset);
5101 }
5102 
5103 /*
5104  * This function chgprots a range of addresses in an hmeblk.  It returns the
5105  * next addres that needs to be chgprot.
5106  * It should be called with the hash lock held.
5107  * XXX It shold be possible to optimize chgprot by not flushing every time but
5108  * on the other hand:
5109  * 1. do one flush crosscall.
5110  * 2. only flush if we are increasing permissions (make sure this will work)
5111  */
5112 static caddr_t
5113 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5114         caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5115 {
5116         uint_t pprot;
5117         tte_t tte, ttemod;
5118         struct sf_hment *sfhmep;
5119         uint_t tteflags;
5120         int ttesz;
5121         struct page *pp = NULL;
5122         kmutex_t *pml, *pmtx;
5123         int ret;
5124         int use_demap_range;
5125 #if defined(SF_ERRATA_57)
5126         int check_exec;
5127 #endif
5128 
5129         ASSERT(in_hblk_range(hmeblkp, addr));
5130         ASSERT(hmeblkp->hblk_shw_bit == 0);
5131         ASSERT(!hmeblkp->hblk_shared);
5132 
5133 #ifdef DEBUG
5134         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5135             (endaddr < get_hblk_endaddr(hmeblkp))) {
5136                 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5137         }
5138 #endif /* DEBUG */
5139 
5140         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5141         ttesz = get_hblk_ttesz(hmeblkp);
5142 
5143         pprot = sfmmu_vtop_prot(vprot, &tteflags);
5144 #if defined(SF_ERRATA_57)
5145         check_exec = (sfmmup != ksfmmup) &&
5146             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5147             ((vprot & PROT_EXEC) == PROT_EXEC);
5148 #endif
5149         HBLKTOHME(sfhmep, hmeblkp, addr);
5150 
5151         /*
5152          * Flush the current demap region if addresses have been
5153          * skipped or the page size doesn't match.
5154          */
5155         use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5156         if (use_demap_range) {
5157                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5158         } else if (dmrp != NULL) {
5159                 DEMAP_RANGE_FLUSH(dmrp);
5160         }
5161 
5162         while (addr < endaddr) {
5163                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5164                 if (TTE_IS_VALID(&tte)) {
5165                         if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5166                                 /*
5167                                  * if the new protection is the same as old
5168                                  * continue
5169                                  */
5170                                 goto next_addr;
5171                         }
5172                         pml = NULL;
5173                         pp = sfhmep->hme_page;
5174                         if (pp) {
5175                                 pml = sfmmu_mlist_enter(pp);
5176                         }
5177                         if (pp != sfhmep->hme_page) {
5178                                 /*
5179                                  * tte most have been unloaded
5180                                  * underneath us.  Recheck
5181                                  */
5182                                 ASSERT(pml);
5183                                 sfmmu_mlist_exit(pml);
5184                                 continue;
5185                         }
5186 
5187                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5188 
5189                         ttemod = tte;
5190                         TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5191 #if defined(SF_ERRATA_57)
5192                         if (check_exec && addr < errata57_limit)
5193                                 ttemod.tte_exec_perm = 0;
5194 #endif
5195                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5196                             &sfhmep->hme_tte);
5197 
5198                         if (ret < 0) {
5199                                 /* tte changed underneath us */
5200                                 if (pml) {
5201                                         sfmmu_mlist_exit(pml);
5202                                 }
5203                                 continue;
5204                         }
5205 
5206                         if (tteflags & TTE_HWWR_INT) {
5207                                 /*
5208                                  * need to sync if we are clearing modify bit.
5209                                  */
5210                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5211                         }
5212 
5213                         if (pp && PP_ISRO(pp)) {
5214                                 if (pprot & TTE_WRPRM_INT) {
5215                                         pmtx = sfmmu_page_enter(pp);
5216                                         PP_CLRRO(pp);
5217                                         sfmmu_page_exit(pmtx);
5218                                 }
5219                         }
5220 
5221                         if (ret > 0 && use_demap_range) {
5222                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5223                         } else if (ret > 0) {
5224                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5225                         }
5226 
5227                         if (pml) {
5228                                 sfmmu_mlist_exit(pml);
5229                         }
5230                 }
5231 next_addr:
5232                 addr += TTEBYTES(ttesz);
5233                 sfhmep++;
5234                 DEMAP_RANGE_NEXTPG(dmrp);
5235         }
5236         return (addr);
5237 }
5238 
5239 /*
5240  * This routine is deprecated and should only be used by hat_chgprot.
5241  * The correct routine is sfmmu_vtop_attr.
5242  * This routine converts virtual page protections to physical ones.  It will
5243  * update the tteflags field with the tte mask corresponding to the protections
5244  * affected and it returns the new protections.  It will also clear the modify
5245  * bit if we are taking away write permission.  This is necessary since the
5246  * modify bit is the hardware permission bit and we need to clear it in order
5247  * to detect write faults.
5248  * It accepts the following special protections:
5249  * ~PROT_WRITE = remove write permissions.
5250  * ~PROT_USER = remove user permissions.
5251  */
5252 static uint_t
5253 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5254 {
5255         if (vprot == (uint_t)~PROT_WRITE) {
5256                 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5257                 return (0);             /* will cause wrprm to be cleared */
5258         }
5259         if (vprot == (uint_t)~PROT_USER) {
5260                 *tteflagsp = TTE_PRIV_INT;
5261                 return (0);             /* will cause privprm to be cleared */
5262         }
5263         if ((vprot == 0) || (vprot == PROT_USER) ||
5264             ((vprot & PROT_ALL) != vprot)) {
5265                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5266         }
5267 
5268         switch (vprot) {
5269         case (PROT_READ):
5270         case (PROT_EXEC):
5271         case (PROT_EXEC | PROT_READ):
5272                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5273                 return (TTE_PRIV_INT);          /* set prv and clr wrt */
5274         case (PROT_WRITE):
5275         case (PROT_WRITE | PROT_READ):
5276         case (PROT_EXEC | PROT_WRITE):
5277         case (PROT_EXEC | PROT_WRITE | PROT_READ):
5278                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5279                 return (TTE_PRIV_INT | TTE_WRPRM_INT);  /* set prv and wrt */
5280         case (PROT_USER | PROT_READ):
5281         case (PROT_USER | PROT_EXEC):
5282         case (PROT_USER | PROT_EXEC | PROT_READ):
5283                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5284                 return (0);                     /* clr prv and wrt */
5285         case (PROT_USER | PROT_WRITE):
5286         case (PROT_USER | PROT_WRITE | PROT_READ):
5287         case (PROT_USER | PROT_EXEC | PROT_WRITE):
5288         case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5289                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5290                 return (TTE_WRPRM_INT);         /* clr prv and set wrt */
5291         default:
5292                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5293         }
5294         return (0);
5295 }
5296 
5297 /*
5298  * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5299  * the normal algorithm would take too long for a very large VA range with
5300  * few real mappings. This routine just walks thru all HMEs in the global
5301  * hash table to find and remove mappings.
5302  */
5303 static void
5304 hat_unload_large_virtual(
5305         struct hat              *sfmmup,
5306         caddr_t                 startaddr,
5307         size_t                  len,
5308         uint_t                  flags,
5309         hat_callback_t          *callback)
5310 {
5311         struct hmehash_bucket *hmebp;
5312         struct hme_blk *hmeblkp;
5313         struct hme_blk *pr_hblk = NULL;
5314         struct hme_blk *nx_hblk;
5315         struct hme_blk *list = NULL;
5316         int i;
5317         demap_range_t dmr, *dmrp;
5318         cpuset_t cpuset;
5319         caddr_t endaddr = startaddr + len;
5320         caddr_t sa;
5321         caddr_t ea;
5322         caddr_t cb_sa[MAX_CB_ADDR];
5323         caddr_t cb_ea[MAX_CB_ADDR];
5324         int     addr_cnt = 0;
5325         int     a = 0;
5326 
5327         if (sfmmup->sfmmu_free) {
5328                 dmrp = NULL;
5329         } else {
5330                 dmrp = &dmr;
5331                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5332         }
5333 
5334         /*
5335          * Loop through all the hash buckets of HME blocks looking for matches.
5336          */
5337         for (i = 0; i <= UHMEHASH_SZ; i++) {
5338                 hmebp = &uhme_hash[i];
5339                 SFMMU_HASH_LOCK(hmebp);
5340                 hmeblkp = hmebp->hmeblkp;
5341                 pr_hblk = NULL;
5342                 while (hmeblkp) {
5343                         nx_hblk = hmeblkp->hblk_next;
5344 
5345                         /*
5346                          * skip if not this context, if a shadow block or
5347                          * if the mapping is not in the requested range
5348                          */
5349                         if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5350                             hmeblkp->hblk_shw_bit ||
5351                             (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5352                             (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5353                                 pr_hblk = hmeblkp;
5354                                 goto next_block;
5355                         }
5356 
5357                         ASSERT(!hmeblkp->hblk_shared);
5358                         /*
5359                          * unload if there are any current valid mappings
5360                          */
5361                         if (hmeblkp->hblk_vcnt != 0 ||
5362                             hmeblkp->hblk_hmecnt != 0)
5363                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5364                                     sa, ea, dmrp, flags);
5365 
5366                         /*
5367                          * on unmap we also release the HME block itself, once
5368                          * all mappings are gone.
5369                          */
5370                         if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5371                             !hmeblkp->hblk_vcnt &&
5372                             !hmeblkp->hblk_hmecnt) {
5373                                 ASSERT(!hmeblkp->hblk_lckcnt);
5374                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5375                                     &list, 0);
5376                         } else {
5377                                 pr_hblk = hmeblkp;
5378                         }
5379 
5380                         if (callback == NULL)
5381                                 goto next_block;
5382 
5383                         /*
5384                          * HME blocks may span more than one page, but we may be
5385                          * unmapping only one page, so check for a smaller range
5386                          * for the callback
5387                          */
5388                         if (sa < startaddr)
5389                                 sa = startaddr;
5390                         if (--ea > endaddr)
5391                                 ea = endaddr - 1;
5392 
5393                         cb_sa[addr_cnt] = sa;
5394                         cb_ea[addr_cnt] = ea;
5395                         if (++addr_cnt == MAX_CB_ADDR) {
5396                                 if (dmrp != NULL) {
5397                                         DEMAP_RANGE_FLUSH(dmrp);
5398                                         cpuset = sfmmup->sfmmu_cpusran;
5399                                         xt_sync(cpuset);
5400                                 }
5401 
5402                                 for (a = 0; a < MAX_CB_ADDR; ++a) {
5403                                         callback->hcb_start_addr = cb_sa[a];
5404                                         callback->hcb_end_addr = cb_ea[a];
5405                                         callback->hcb_function(callback);
5406                                 }
5407                                 addr_cnt = 0;
5408                         }
5409 
5410 next_block:
5411                         hmeblkp = nx_hblk;
5412                 }
5413                 SFMMU_HASH_UNLOCK(hmebp);
5414         }
5415 
5416         sfmmu_hblks_list_purge(&list, 0);
5417         if (dmrp != NULL) {
5418                 DEMAP_RANGE_FLUSH(dmrp);
5419                 cpuset = sfmmup->sfmmu_cpusran;
5420                 xt_sync(cpuset);
5421         }
5422 
5423         for (a = 0; a < addr_cnt; ++a) {
5424                 callback->hcb_start_addr = cb_sa[a];
5425                 callback->hcb_end_addr = cb_ea[a];
5426                 callback->hcb_function(callback);
5427         }
5428 
5429         /*
5430          * Check TSB and TLB page sizes if the process isn't exiting.
5431          */
5432         if (!sfmmup->sfmmu_free)
5433                 sfmmu_check_page_sizes(sfmmup, 0);
5434 }
5435 
5436 /*
5437  * Unload all the mappings in the range [addr..addr+len). addr and len must
5438  * be MMU_PAGESIZE aligned.
5439  */
5440 
5441 extern struct seg *segkmap;
5442 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5443 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5444 
5445 
5446 void
5447 hat_unload_callback(
5448         struct hat *sfmmup,
5449         caddr_t addr,
5450         size_t len,
5451         uint_t flags,
5452         hat_callback_t *callback)
5453 {
5454         struct hmehash_bucket *hmebp;
5455         hmeblk_tag hblktag;
5456         int hmeshift, hashno, iskernel;
5457         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5458         caddr_t endaddr;
5459         cpuset_t cpuset;
5460         int addr_count = 0;
5461         int a;
5462         caddr_t cb_start_addr[MAX_CB_ADDR];
5463         caddr_t cb_end_addr[MAX_CB_ADDR];
5464         int issegkmap = ISSEGKMAP(sfmmup, addr);
5465         demap_range_t dmr, *dmrp;
5466 
5467         ASSERT(sfmmup->sfmmu_as != NULL);
5468 
5469         ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5470             AS_LOCK_HELD(sfmmup->sfmmu_as));
5471 
5472         ASSERT(sfmmup != NULL);
5473         ASSERT((len & MMU_PAGEOFFSET) == 0);
5474         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5475 
5476         /*
5477          * Probing through a large VA range (say 63 bits) will be slow, even
5478          * at 4 Meg steps between the probes. So, when the virtual address range
5479          * is very large, search the HME entries for what to unload.
5480          *
5481          *      len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5482          *
5483          *      UHMEHASH_SZ is number of hash buckets to examine
5484          *
5485          */
5486         if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5487                 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5488                 return;
5489         }
5490 
5491         CPUSET_ZERO(cpuset);
5492 
5493         /*
5494          * If the process is exiting, we can save a lot of fuss since
5495          * we'll flush the TLB when we free the ctx anyway.
5496          */
5497         if (sfmmup->sfmmu_free) {
5498                 dmrp = NULL;
5499         } else {
5500                 dmrp = &dmr;
5501                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5502         }
5503 
5504         endaddr = addr + len;
5505         hblktag.htag_id = sfmmup;
5506         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5507 
5508         /*
5509          * It is likely for the vm to call unload over a wide range of
5510          * addresses that are actually very sparsely populated by
5511          * translations.  In order to speed this up the sfmmu hat supports
5512          * the concept of shadow hmeblks. Dummy large page hmeblks that
5513          * correspond to actual small translations are allocated at tteload
5514          * time and are referred to as shadow hmeblks.  Now, during unload
5515          * time, we first check if we have a shadow hmeblk for that
5516          * translation.  The absence of one means the corresponding address
5517          * range is empty and can be skipped.
5518          *
5519          * The kernel is an exception to above statement and that is why
5520          * we don't use shadow hmeblks and hash starting from the smallest
5521          * page size.
5522          */
5523         if (sfmmup == KHATID) {
5524                 iskernel = 1;
5525                 hashno = TTE64K;
5526         } else {
5527                 iskernel = 0;
5528                 if (mmu_page_sizes == max_mmu_page_sizes) {
5529                         hashno = TTE256M;
5530                 } else {
5531                         hashno = TTE4M;
5532                 }
5533         }
5534         while (addr < endaddr) {
5535                 hmeshift = HME_HASH_SHIFT(hashno);
5536                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5537                 hblktag.htag_rehash = hashno;
5538                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5539 
5540                 SFMMU_HASH_LOCK(hmebp);
5541 
5542                 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5543                 if (hmeblkp == NULL) {
5544                         /*
5545                          * didn't find an hmeblk. skip the appropiate
5546                          * address range.
5547                          */
5548                         SFMMU_HASH_UNLOCK(hmebp);
5549                         if (iskernel) {
5550                                 if (hashno < mmu_hashcnt) {
5551                                         hashno++;
5552                                         continue;
5553                                 } else {
5554                                         hashno = TTE64K;
5555                                         addr = (caddr_t)roundup((uintptr_t)addr
5556                                             + 1, MMU_PAGESIZE64K);
5557                                         continue;
5558                                 }
5559                         }
5560                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5561                             (1 << hmeshift));
5562                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5563                                 ASSERT(hashno == TTE64K);
5564                                 continue;
5565                         }
5566                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5567                                 hashno = TTE512K;
5568                                 continue;
5569                         }
5570                         if (mmu_page_sizes == max_mmu_page_sizes) {
5571                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5572                                         hashno = TTE4M;
5573                                         continue;
5574                                 }
5575                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5576                                         hashno = TTE32M;
5577                                         continue;
5578                                 }
5579                                 hashno = TTE256M;
5580                                 continue;
5581                         } else {
5582                                 hashno = TTE4M;
5583                                 continue;
5584                         }
5585                 }
5586                 ASSERT(hmeblkp);
5587                 ASSERT(!hmeblkp->hblk_shared);
5588                 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5589                         /*
5590                          * If the valid count is zero we can skip the range
5591                          * mapped by this hmeblk.
5592                          * We free hblks in the case of HAT_UNMAP.  HAT_UNMAP
5593                          * is used by segment drivers as a hint
5594                          * that the mapping resource won't be used any longer.
5595                          * The best example of this is during exit().
5596                          */
5597                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5598                             get_hblk_span(hmeblkp));
5599                         if ((flags & HAT_UNLOAD_UNMAP) ||
5600                             (iskernel && !issegkmap)) {
5601                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5602                                     &list, 0);
5603                         }
5604                         SFMMU_HASH_UNLOCK(hmebp);
5605 
5606                         if (iskernel) {
5607                                 hashno = TTE64K;
5608                                 continue;
5609                         }
5610                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5611                                 ASSERT(hashno == TTE64K);
5612                                 continue;
5613                         }
5614                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5615                                 hashno = TTE512K;
5616                                 continue;
5617                         }
5618                         if (mmu_page_sizes == max_mmu_page_sizes) {
5619                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5620                                         hashno = TTE4M;
5621                                         continue;
5622                                 }
5623                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5624                                         hashno = TTE32M;
5625                                         continue;
5626                                 }
5627                                 hashno = TTE256M;
5628                                 continue;
5629                         } else {
5630                                 hashno = TTE4M;
5631                                 continue;
5632                         }
5633                 }
5634                 if (hmeblkp->hblk_shw_bit) {
5635                         /*
5636                          * If we encounter a shadow hmeblk we know there is
5637                          * smaller sized hmeblks mapping the same address space.
5638                          * Decrement the hash size and rehash.
5639                          */
5640                         ASSERT(sfmmup != KHATID);
5641                         hashno--;
5642                         SFMMU_HASH_UNLOCK(hmebp);
5643                         continue;
5644                 }
5645 
5646                 /*
5647                  * track callback address ranges.
5648                  * only start a new range when it's not contiguous
5649                  */
5650                 if (callback != NULL) {
5651                         if (addr_count > 0 &&
5652                             addr == cb_end_addr[addr_count - 1])
5653                                 --addr_count;
5654                         else
5655                                 cb_start_addr[addr_count] = addr;
5656                 }
5657 
5658                 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5659                     dmrp, flags);
5660 
5661                 if (callback != NULL)
5662                         cb_end_addr[addr_count++] = addr;
5663 
5664                 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5665                     !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5666                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5667                 }
5668                 SFMMU_HASH_UNLOCK(hmebp);
5669 
5670                 /*
5671                  * Notify our caller as to exactly which pages
5672                  * have been unloaded. We do these in clumps,
5673                  * to minimize the number of xt_sync()s that need to occur.
5674                  */
5675                 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5676                         if (dmrp != NULL) {
5677                                 DEMAP_RANGE_FLUSH(dmrp);
5678                                 cpuset = sfmmup->sfmmu_cpusran;
5679                                 xt_sync(cpuset);
5680                         }
5681 
5682                         for (a = 0; a < MAX_CB_ADDR; ++a) {
5683                                 callback->hcb_start_addr = cb_start_addr[a];
5684                                 callback->hcb_end_addr = cb_end_addr[a];
5685                                 callback->hcb_function(callback);
5686                         }
5687                         addr_count = 0;
5688                 }
5689                 if (iskernel) {
5690                         hashno = TTE64K;
5691                         continue;
5692                 }
5693                 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5694                         ASSERT(hashno == TTE64K);
5695                         continue;
5696                 }
5697                 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5698                         hashno = TTE512K;
5699                         continue;
5700                 }
5701                 if (mmu_page_sizes == max_mmu_page_sizes) {
5702                         if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5703                                 hashno = TTE4M;
5704                                 continue;
5705                         }
5706                         if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5707                                 hashno = TTE32M;
5708                                 continue;
5709                         }
5710                         hashno = TTE256M;
5711                 } else {
5712                         hashno = TTE4M;
5713                 }
5714         }
5715 
5716         sfmmu_hblks_list_purge(&list, 0);
5717         if (dmrp != NULL) {
5718                 DEMAP_RANGE_FLUSH(dmrp);
5719                 cpuset = sfmmup->sfmmu_cpusran;
5720                 xt_sync(cpuset);
5721         }
5722         if (callback && addr_count != 0) {
5723                 for (a = 0; a < addr_count; ++a) {
5724                         callback->hcb_start_addr = cb_start_addr[a];
5725                         callback->hcb_end_addr = cb_end_addr[a];
5726                         callback->hcb_function(callback);
5727                 }
5728         }
5729 
5730         /*
5731          * Check TSB and TLB page sizes if the process isn't exiting.
5732          */
5733         if (!sfmmup->sfmmu_free)
5734                 sfmmu_check_page_sizes(sfmmup, 0);
5735 }
5736 
5737 /*
5738  * Unload all the mappings in the range [addr..addr+len). addr and len must
5739  * be MMU_PAGESIZE aligned.
5740  */
5741 void
5742 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5743 {
5744         hat_unload_callback(sfmmup, addr, len, flags, NULL);
5745 }
5746 
5747 
5748 /*
5749  * Find the largest mapping size for this page.
5750  */
5751 int
5752 fnd_mapping_sz(page_t *pp)
5753 {
5754         int sz;
5755         int p_index;
5756 
5757         p_index = PP_MAPINDEX(pp);
5758 
5759         sz = 0;
5760         p_index >>= 1;    /* don't care about 8K bit */
5761         for (; p_index; p_index >>= 1) {
5762                 sz++;
5763         }
5764 
5765         return (sz);
5766 }
5767 
5768 /*
5769  * This function unloads a range of addresses for an hmeblk.
5770  * It returns the next address to be unloaded.
5771  * It should be called with the hash lock held.
5772  */
5773 static caddr_t
5774 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5775         caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
5776 {
5777         tte_t   tte, ttemod;
5778         struct  sf_hment *sfhmep;
5779         int     ttesz;
5780         long    ttecnt;
5781         page_t *pp;
5782         kmutex_t *pml;
5783         int ret;
5784         int use_demap_range;
5785 
5786         ASSERT(in_hblk_range(hmeblkp, addr));
5787         ASSERT(!hmeblkp->hblk_shw_bit);
5788         ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
5789         ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
5790         ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
5791 
5792 #ifdef DEBUG
5793         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5794             (endaddr < get_hblk_endaddr(hmeblkp))) {
5795                 panic("sfmmu_hblk_unload: partial unload of large page");
5796         }
5797 #endif /* DEBUG */
5798 
5799         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5800         ttesz = get_hblk_ttesz(hmeblkp);
5801 
5802         use_demap_range = ((dmrp == NULL) ||
5803             (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
5804 
5805         if (use_demap_range) {
5806                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5807         } else if (dmrp != NULL) {
5808                 DEMAP_RANGE_FLUSH(dmrp);
5809         }
5810         ttecnt = 0;
5811         HBLKTOHME(sfhmep, hmeblkp, addr);
5812 
5813         while (addr < endaddr) {
5814                 pml = NULL;
5815                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5816                 if (TTE_IS_VALID(&tte)) {
5817                         pp = sfhmep->hme_page;
5818                         if (pp != NULL) {
5819                                 pml = sfmmu_mlist_enter(pp);
5820                         }
5821 
5822                         /*
5823                          * Verify if hme still points to 'pp' now that
5824                          * we have p_mapping lock.
5825                          */
5826                         if (sfhmep->hme_page != pp) {
5827                                 if (pp != NULL && sfhmep->hme_page != NULL) {
5828                                         ASSERT(pml != NULL);
5829                                         sfmmu_mlist_exit(pml);
5830                                         /* Re-start this iteration. */
5831                                         continue;
5832                                 }
5833                                 ASSERT((pp != NULL) &&
5834                                     (sfhmep->hme_page == NULL));
5835                                 goto tte_unloaded;
5836                         }
5837 
5838                         /*
5839                          * This point on we have both HASH and p_mapping
5840                          * lock.
5841                          */
5842                         ASSERT(pp == sfhmep->hme_page);
5843                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5844 
5845                         /*
5846                          * We need to loop on modify tte because it is
5847                          * possible for pagesync to come along and
5848                          * change the software bits beneath us.
5849                          *
5850                          * Page_unload can also invalidate the tte after
5851                          * we read tte outside of p_mapping lock.
5852                          */
5853 again:
5854                         ttemod = tte;
5855 
5856                         TTE_SET_INVALID(&ttemod);
5857                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5858                             &sfhmep->hme_tte);
5859 
5860                         if (ret <= 0) {
5861                                 if (TTE_IS_VALID(&tte)) {
5862                                         ASSERT(ret < 0);
5863                                         goto again;
5864                                 }
5865                                 if (pp != NULL) {
5866                                         panic("sfmmu_hblk_unload: pp = 0x%p "
5867                                             "tte became invalid under mlist"
5868                                             " lock = 0x%p", (void *)pp,
5869                                             (void *)pml);
5870                                 }
5871                                 continue;
5872                         }
5873 
5874                         if (!(flags & HAT_UNLOAD_NOSYNC)) {
5875                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5876                         }
5877 
5878                         /*
5879                          * Ok- we invalidated the tte. Do the rest of the job.
5880                          */
5881                         ttecnt++;
5882 
5883                         if (flags & HAT_UNLOAD_UNLOCK) {
5884                                 ASSERT(hmeblkp->hblk_lckcnt > 0);
5885                                 atomic_dec_32(&hmeblkp->hblk_lckcnt);
5886                                 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
5887                         }
5888 
5889                         /*
5890                          * Normally we would need to flush the page
5891                          * from the virtual cache at this point in
5892                          * order to prevent a potential cache alias
5893                          * inconsistency.
5894                          * The particular scenario we need to worry
5895                          * about is:
5896                          * Given:  va1 and va2 are two virtual address
5897                          * that alias and map the same physical
5898                          * address.
5899                          * 1.   mapping exists from va1 to pa and data
5900                          * has been read into the cache.
5901                          * 2.   unload va1.
5902                          * 3.   load va2 and modify data using va2.
5903                          * 4    unload va2.
5904                          * 5.   load va1 and reference data.  Unless we
5905                          * flush the data cache when we unload we will
5906                          * get stale data.
5907                          * Fortunately, page coloring eliminates the
5908                          * above scenario by remembering the color a
5909                          * physical page was last or is currently
5910                          * mapped to.  Now, we delay the flush until
5911                          * the loading of translations.  Only when the
5912                          * new translation is of a different color
5913                          * are we forced to flush.
5914                          */
5915                         if (use_demap_range) {
5916                                 /*
5917                                  * Mark this page as needing a demap.
5918                                  */
5919                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5920                         } else {
5921                                 ASSERT(sfmmup != NULL);
5922                                 ASSERT(!hmeblkp->hblk_shared);
5923                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
5924                                     sfmmup->sfmmu_free, 0);
5925                         }
5926 
5927                         if (pp) {
5928                                 /*
5929                                  * Remove the hment from the mapping list
5930                                  */
5931                                 ASSERT(hmeblkp->hblk_hmecnt > 0);
5932 
5933                                 /*
5934                                  * Again, we cannot
5935                                  * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
5936                                  */
5937                                 HME_SUB(sfhmep, pp);
5938                                 membar_stst();
5939                                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
5940                         }
5941 
5942                         ASSERT(hmeblkp->hblk_vcnt > 0);
5943                         atomic_dec_16(&hmeblkp->hblk_vcnt);
5944 
5945                         ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
5946                             !hmeblkp->hblk_lckcnt);
5947 
5948 #ifdef VAC
5949                         if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
5950                                 if (PP_ISTNC(pp)) {
5951                                         /*
5952                                          * If page was temporary
5953                                          * uncached, try to recache
5954                                          * it. Note that HME_SUB() was
5955                                          * called above so p_index and
5956                                          * mlist had been updated.
5957                                          */
5958                                         conv_tnc(pp, ttesz);
5959                                 } else if (pp->p_mapping == NULL) {
5960                                         ASSERT(kpm_enable);
5961                                         /*
5962                                          * Page is marked to be in VAC conflict
5963                                          * to an existing kpm mapping and/or is
5964                                          * kpm mapped using only the regular
5965                                          * pagesize.
5966                                          */
5967                                         sfmmu_kpm_hme_unload(pp);
5968                                 }
5969                         }
5970 #endif  /* VAC */
5971                 } else if ((pp = sfhmep->hme_page) != NULL) {
5972                                 /*
5973                                  * TTE is invalid but the hme
5974                                  * still exists. let pageunload
5975                                  * complete its job.
5976                                  */
5977                                 ASSERT(pml == NULL);
5978                                 pml = sfmmu_mlist_enter(pp);
5979                                 if (sfhmep->hme_page != NULL) {
5980                                         sfmmu_mlist_exit(pml);
5981                                         continue;
5982                                 }
5983                                 ASSERT(sfhmep->hme_page == NULL);
5984                 } else if (hmeblkp->hblk_hmecnt != 0) {
5985                         /*
5986                          * pageunload may have not finished decrementing
5987                          * hblk_vcnt and hblk_hmecnt. Find page_t if any and
5988                          * wait for pageunload to finish. Rely on pageunload
5989                          * to decrement hblk_hmecnt after hblk_vcnt.
5990                          */
5991                         pfn_t pfn = TTE_TO_TTEPFN(&tte);
5992                         ASSERT(pml == NULL);
5993                         if (pf_is_memory(pfn)) {
5994                                 pp = page_numtopp_nolock(pfn);
5995                                 if (pp != NULL) {
5996                                         pml = sfmmu_mlist_enter(pp);
5997                                         sfmmu_mlist_exit(pml);
5998                                         pml = NULL;
5999                                 }
6000                         }
6001                 }
6002 
6003 tte_unloaded:
6004                 /*
6005                  * At this point, the tte we are looking at
6006                  * should be unloaded, and hme has been unlinked
6007                  * from page too. This is important because in
6008                  * pageunload, it does ttesync() then HME_SUB.
6009                  * We need to make sure HME_SUB has been completed
6010                  * so we know ttesync() has been completed. Otherwise,
6011                  * at exit time, after return from hat layer, VM will
6012                  * release as structure which hat_setstat() (called
6013                  * by ttesync()) needs.
6014                  */
6015 #ifdef DEBUG
6016                 {
6017                         tte_t   dtte;
6018 
6019                         ASSERT(sfhmep->hme_page == NULL);
6020 
6021                         sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6022                         ASSERT(!TTE_IS_VALID(&dtte));
6023                 }
6024 #endif
6025 
6026                 if (pml) {
6027                         sfmmu_mlist_exit(pml);
6028                 }
6029 
6030                 addr += TTEBYTES(ttesz);
6031                 sfhmep++;
6032                 DEMAP_RANGE_NEXTPG(dmrp);
6033         }
6034         /*
6035          * For shared hmeblks this routine is only called when region is freed
6036          * and no longer referenced.  So no need to decrement ttecnt
6037          * in the region structure here.
6038          */
6039         if (ttecnt > 0 && sfmmup != NULL) {
6040                 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6041         }
6042         return (addr);
6043 }
6044 
6045 /*
6046  * Invalidate a virtual address range for the local CPU.
6047  * For best performance ensure that the va range is completely
6048  * mapped, otherwise the entire TLB will be flushed.
6049  */
6050 void
6051 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6052 {
6053         ssize_t sz;
6054         caddr_t endva = va + size;
6055 
6056         while (va < endva) {
6057                 sz = hat_getpagesize(sfmmup, va);
6058                 if (sz < 0) {
6059                         vtag_flushall();
6060                         break;
6061                 }
6062                 vtag_flushpage(va, (uint64_t)sfmmup);
6063                 va += sz;
6064         }
6065 }
6066 
6067 /*
6068  * Synchronize all the mappings in the range [addr..addr+len).
6069  * Can be called with clearflag having two states:
6070  * HAT_SYNC_DONTZERO means just return the rm stats
6071  * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6072  */
6073 void
6074 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6075 {
6076         struct hmehash_bucket *hmebp;
6077         hmeblk_tag hblktag;
6078         int hmeshift, hashno = 1;
6079         struct hme_blk *hmeblkp, *list = NULL;
6080         caddr_t endaddr;
6081         cpuset_t cpuset;
6082 
6083         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6084         ASSERT((len & MMU_PAGEOFFSET) == 0);
6085         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6086             (clearflag == HAT_SYNC_ZERORM));
6087 
6088         CPUSET_ZERO(cpuset);
6089 
6090         endaddr = addr + len;
6091         hblktag.htag_id = sfmmup;
6092         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6093 
6094         /*
6095          * Spitfire supports 4 page sizes.
6096          * Most pages are expected to be of the smallest page
6097          * size (8K) and these will not need to be rehashed. 64K
6098          * pages also don't need to be rehashed because the an hmeblk
6099          * spans 64K of address space. 512K pages might need 1 rehash and
6100          * and 4M pages 2 rehashes.
6101          */
6102         while (addr < endaddr) {
6103                 hmeshift = HME_HASH_SHIFT(hashno);
6104                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6105                 hblktag.htag_rehash = hashno;
6106                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6107 
6108                 SFMMU_HASH_LOCK(hmebp);
6109 
6110                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6111                 if (hmeblkp != NULL) {
6112                         ASSERT(!hmeblkp->hblk_shared);
6113                         /*
6114                          * We've encountered a shadow hmeblk so skip the range
6115                          * of the next smaller mapping size.
6116                          */
6117                         if (hmeblkp->hblk_shw_bit) {
6118                                 ASSERT(sfmmup != ksfmmup);
6119                                 ASSERT(hashno > 1);
6120                                 addr = (caddr_t)P2END((uintptr_t)addr,
6121                                     TTEBYTES(hashno - 1));
6122                         } else {
6123                                 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6124                                     addr, endaddr, clearflag);
6125                         }
6126                         SFMMU_HASH_UNLOCK(hmebp);
6127                         hashno = 1;
6128                         continue;
6129                 }
6130                 SFMMU_HASH_UNLOCK(hmebp);
6131 
6132                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6133                         /*
6134                          * We have traversed the whole list and rehashed
6135                          * if necessary without finding the address to sync.
6136                          * This is ok so we increment the address by the
6137                          * smallest hmeblk range for kernel mappings and the
6138                          * largest hmeblk range, to account for shadow hmeblks,
6139                          * for user mappings and continue.
6140                          */
6141                         if (sfmmup == ksfmmup)
6142                                 addr = (caddr_t)P2END((uintptr_t)addr,
6143                                     TTEBYTES(1));
6144                         else
6145                                 addr = (caddr_t)P2END((uintptr_t)addr,
6146                                     TTEBYTES(hashno));
6147                         hashno = 1;
6148                 } else {
6149                         hashno++;
6150                 }
6151         }
6152         sfmmu_hblks_list_purge(&list, 0);
6153         cpuset = sfmmup->sfmmu_cpusran;
6154         xt_sync(cpuset);
6155 }
6156 
6157 static caddr_t
6158 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6159         caddr_t endaddr, int clearflag)
6160 {
6161         tte_t   tte, ttemod;
6162         struct sf_hment *sfhmep;
6163         int ttesz;
6164         struct page *pp;
6165         kmutex_t *pml;
6166         int ret;
6167 
6168         ASSERT(hmeblkp->hblk_shw_bit == 0);
6169         ASSERT(!hmeblkp->hblk_shared);
6170 
6171         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6172 
6173         ttesz = get_hblk_ttesz(hmeblkp);
6174         HBLKTOHME(sfhmep, hmeblkp, addr);
6175 
6176         while (addr < endaddr) {
6177                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6178                 if (TTE_IS_VALID(&tte)) {
6179                         pml = NULL;
6180                         pp = sfhmep->hme_page;
6181                         if (pp) {
6182                                 pml = sfmmu_mlist_enter(pp);
6183                         }
6184                         if (pp != sfhmep->hme_page) {
6185                                 /*
6186                                  * tte most have been unloaded
6187                                  * underneath us.  Recheck
6188                                  */
6189                                 ASSERT(pml);
6190                                 sfmmu_mlist_exit(pml);
6191                                 continue;
6192                         }
6193 
6194                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6195 
6196                         if (clearflag == HAT_SYNC_ZERORM) {
6197                                 ttemod = tte;
6198                                 TTE_CLR_RM(&ttemod);
6199                                 ret = sfmmu_modifytte_try(&tte, &ttemod,
6200                                     &sfhmep->hme_tte);
6201                                 if (ret < 0) {
6202                                         if (pml) {
6203                                                 sfmmu_mlist_exit(pml);
6204                                         }
6205                                         continue;
6206                                 }
6207 
6208                                 if (ret > 0) {
6209                                         sfmmu_tlb_demap(addr, sfmmup,
6210                                             hmeblkp, 0, 0);
6211                                 }
6212                         }
6213                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
6214                         if (pml) {
6215                                 sfmmu_mlist_exit(pml);
6216                         }
6217                 }
6218                 addr += TTEBYTES(ttesz);
6219                 sfhmep++;
6220         }
6221         return (addr);
6222 }
6223 
6224 /*
6225  * This function will sync a tte to the page struct and it will
6226  * update the hat stats. Currently it allows us to pass a NULL pp
6227  * and we will simply update the stats.  We may want to change this
6228  * so we only keep stats for pages backed by pp's.
6229  */
6230 static void
6231 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6232 {
6233         uint_t rm = 0;
6234         int     sz;
6235         pgcnt_t npgs;
6236 
6237         ASSERT(TTE_IS_VALID(ttep));
6238 
6239         if (TTE_IS_NOSYNC(ttep)) {
6240                 return;
6241         }
6242 
6243         if (TTE_IS_REF(ttep))  {
6244                 rm = P_REF;
6245         }
6246         if (TTE_IS_MOD(ttep))  {
6247                 rm |= P_MOD;
6248         }
6249 
6250         if (rm == 0) {
6251                 return;
6252         }
6253 
6254         sz = TTE_CSZ(ttep);
6255         if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6256                 int i;
6257                 caddr_t vaddr = addr;
6258 
6259                 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6260                         hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6261                 }
6262 
6263         }
6264 
6265         /*
6266          * XXX I want to use cas to update nrm bits but they
6267          * currently belong in common/vm and not in hat where
6268          * they should be.
6269          * The nrm bits are protected by the same mutex as
6270          * the one that protects the page's mapping list.
6271          */
6272         if (!pp)
6273                 return;
6274         ASSERT(sfmmu_mlist_held(pp));
6275         /*
6276          * If the tte is for a large page, we need to sync all the
6277          * pages covered by the tte.
6278          */
6279         if (sz != TTE8K) {
6280                 ASSERT(pp->p_szc != 0);
6281                 pp = PP_GROUPLEADER(pp, sz);
6282                 ASSERT(sfmmu_mlist_held(pp));
6283         }
6284 
6285         /* Get number of pages from tte size. */
6286         npgs = TTEPAGES(sz);
6287 
6288         do {
6289                 ASSERT(pp);
6290                 ASSERT(sfmmu_mlist_held(pp));
6291                 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6292                     ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6293                         hat_page_setattr(pp, rm);
6294 
6295                 /*
6296                  * Are we done? If not, we must have a large mapping.
6297                  * For large mappings we need to sync the rest of the pages
6298                  * covered by this tte; goto the next page.
6299                  */
6300         } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6301 }
6302 
6303 /*
6304  * Execute pre-callback handler of each pa_hment linked to pp
6305  *
6306  * Inputs:
6307  *   flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6308  *   capture_cpus: pointer to return value (below)
6309  *
6310  * Returns:
6311  *   Propagates the subsystem callback return values back to the caller;
6312  *   returns 0 on success.  If capture_cpus is non-NULL, the value returned
6313  *   is zero if all of the pa_hments are of a type that do not require
6314  *   capturing CPUs prior to suspending the mapping, else it is 1.
6315  */
6316 static int
6317 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6318 {
6319         struct sf_hment *sfhmep;
6320         struct pa_hment *pahmep;
6321         int (*f)(caddr_t, uint_t, uint_t, void *);
6322         int             ret;
6323         id_t            id;
6324         int             locked = 0;
6325         kmutex_t        *pml;
6326 
6327         ASSERT(PAGE_EXCL(pp));
6328         if (!sfmmu_mlist_held(pp)) {
6329                 pml = sfmmu_mlist_enter(pp);
6330                 locked = 1;
6331         }
6332 
6333         if (capture_cpus)
6334                 *capture_cpus = 0;
6335 
6336 top:
6337         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6338                 /*
6339                  * skip sf_hments corresponding to VA<->PA mappings;
6340                  * for pa_hment's, hme_tte.ll is zero
6341                  */
6342                 if (!IS_PAHME(sfhmep))
6343                         continue;
6344 
6345                 pahmep = sfhmep->hme_data;
6346                 ASSERT(pahmep != NULL);
6347 
6348                 /*
6349                  * skip if pre-handler has been called earlier in this loop
6350                  */
6351                 if (pahmep->flags & flag)
6352                         continue;
6353 
6354                 id = pahmep->cb_id;
6355                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6356                 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6357                         *capture_cpus = 1;
6358                 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6359                         pahmep->flags |= flag;
6360                         continue;
6361                 }
6362 
6363                 /*
6364                  * Drop the mapping list lock to avoid locking order issues.
6365                  */
6366                 if (locked)
6367                         sfmmu_mlist_exit(pml);
6368 
6369                 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6370                 if (ret != 0)
6371                         return (ret);   /* caller must do the cleanup */
6372 
6373                 if (locked) {
6374                         pml = sfmmu_mlist_enter(pp);
6375                         pahmep->flags |= flag;
6376                         goto top;
6377                 }
6378 
6379                 pahmep->flags |= flag;
6380         }
6381 
6382         if (locked)
6383                 sfmmu_mlist_exit(pml);
6384 
6385         return (0);
6386 }
6387 
6388 /*
6389  * Execute post-callback handler of each pa_hment linked to pp
6390  *
6391  * Same overall assumptions and restrictions apply as for
6392  * hat_pageprocess_precallbacks().
6393  */
6394 static void
6395 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6396 {
6397         pfn_t pgpfn = pp->p_pagenum;
6398         pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6399         pfn_t newpfn;
6400         struct sf_hment *sfhmep;
6401         struct pa_hment *pahmep;
6402         int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6403         id_t    id;
6404         int     locked = 0;
6405         kmutex_t *pml;
6406 
6407         ASSERT(PAGE_EXCL(pp));
6408         if (!sfmmu_mlist_held(pp)) {
6409                 pml = sfmmu_mlist_enter(pp);
6410                 locked = 1;
6411         }
6412 
6413 top:
6414         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6415                 /*
6416                  * skip sf_hments corresponding to VA<->PA mappings;
6417                  * for pa_hment's, hme_tte.ll is zero
6418                  */
6419                 if (!IS_PAHME(sfhmep))
6420                         continue;
6421 
6422                 pahmep = sfhmep->hme_data;
6423                 ASSERT(pahmep != NULL);
6424 
6425                 if ((pahmep->flags & flag) == 0)
6426                         continue;
6427 
6428                 pahmep->flags &= ~flag;
6429 
6430                 id = pahmep->cb_id;
6431                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6432                 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6433                         continue;
6434 
6435                 /*
6436                  * Convert the base page PFN into the constituent PFN
6437                  * which is needed by the callback handler.
6438                  */
6439                 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6440 
6441                 /*
6442                  * Drop the mapping list lock to avoid locking order issues.
6443                  */
6444                 if (locked)
6445                         sfmmu_mlist_exit(pml);
6446 
6447                 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6448                     != 0)
6449                         panic("sfmmu: posthandler failed");
6450 
6451                 if (locked) {
6452                         pml = sfmmu_mlist_enter(pp);
6453                         goto top;
6454                 }
6455         }
6456 
6457         if (locked)
6458                 sfmmu_mlist_exit(pml);
6459 }
6460 
6461 /*
6462  * Suspend locked kernel mapping
6463  */
6464 void
6465 hat_pagesuspend(struct page *pp)
6466 {
6467         struct sf_hment *sfhmep;
6468         sfmmu_t *sfmmup;
6469         tte_t tte, ttemod;
6470         struct hme_blk *hmeblkp;
6471         caddr_t addr;
6472         int index, cons;
6473         cpuset_t cpuset;
6474 
6475         ASSERT(PAGE_EXCL(pp));
6476         ASSERT(sfmmu_mlist_held(pp));
6477 
6478         mutex_enter(&kpr_suspendlock);
6479 
6480         /*
6481          * We're about to suspend a kernel mapping so mark this thread as
6482          * non-traceable by DTrace. This prevents us from running into issues
6483          * with probe context trying to touch a suspended page
6484          * in the relocation codepath itself.
6485          */
6486         curthread->t_flag |= T_DONTDTRACE;
6487 
6488         index = PP_MAPINDEX(pp);
6489         cons = TTE8K;
6490 
6491 retry:
6492         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6493 
6494                 if (IS_PAHME(sfhmep))
6495                         continue;
6496 
6497                 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6498                         continue;
6499 
6500                 /*
6501                  * Loop until we successfully set the suspend bit in
6502                  * the TTE.
6503                  */
6504 again:
6505                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6506                 ASSERT(TTE_IS_VALID(&tte));
6507 
6508                 ttemod = tte;
6509                 TTE_SET_SUSPEND(&ttemod);
6510                 if (sfmmu_modifytte_try(&tte, &ttemod,
6511                     &sfhmep->hme_tte) < 0)
6512                         goto again;
6513 
6514                 /*
6515                  * Invalidate TSB entry
6516                  */
6517                 hmeblkp = sfmmu_hmetohblk(sfhmep);
6518 
6519                 sfmmup = hblktosfmmu(hmeblkp);
6520                 ASSERT(sfmmup == ksfmmup);
6521                 ASSERT(!hmeblkp->hblk_shared);
6522 
6523                 addr = tte_to_vaddr(hmeblkp, tte);
6524 
6525                 /*
6526                  * No need to make sure that the TSB for this sfmmu is
6527                  * not being relocated since it is ksfmmup and thus it
6528                  * will never be relocated.
6529                  */
6530                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6531 
6532                 /*
6533                  * Update xcall stats
6534                  */
6535                 cpuset = cpu_ready_set;
6536                 CPUSET_DEL(cpuset, CPU->cpu_id);
6537 
6538                 /* LINTED: constant in conditional context */
6539                 SFMMU_XCALL_STATS(ksfmmup);
6540 
6541                 /*
6542                  * Flush TLB entry on remote CPU's
6543                  */
6544                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6545                     (uint64_t)ksfmmup);
6546                 xt_sync(cpuset);
6547 
6548                 /*
6549                  * Flush TLB entry on local CPU
6550                  */
6551                 vtag_flushpage(addr, (uint64_t)ksfmmup);
6552         }
6553 
6554         while (index != 0) {
6555                 index = index >> 1;
6556                 if (index != 0)
6557                         cons++;
6558                 if (index & 0x1) {
6559                         pp = PP_GROUPLEADER(pp, cons);
6560                         goto retry;
6561                 }
6562         }
6563 }
6564 
6565 #ifdef  DEBUG
6566 
6567 #define N_PRLE  1024
6568 struct prle {
6569         page_t *targ;
6570         page_t *repl;
6571         int status;
6572         int pausecpus;
6573         hrtime_t whence;
6574 };
6575 
6576 static struct prle page_relocate_log[N_PRLE];
6577 static int prl_entry;
6578 static kmutex_t prl_mutex;
6579 
6580 #define PAGE_RELOCATE_LOG(t, r, s, p)                                   \
6581         mutex_enter(&prl_mutex);                                    \
6582         page_relocate_log[prl_entry].targ = *(t);                       \
6583         page_relocate_log[prl_entry].repl = *(r);                       \
6584         page_relocate_log[prl_entry].status = (s);                      \
6585         page_relocate_log[prl_entry].pausecpus = (p);                   \
6586         page_relocate_log[prl_entry].whence = gethrtime();              \
6587         prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1;     \
6588         mutex_exit(&prl_mutex);
6589 
6590 #else   /* !DEBUG */
6591 #define PAGE_RELOCATE_LOG(t, r, s, p)
6592 #endif
6593 
6594 /*
6595  * Core Kernel Page Relocation Algorithm
6596  *
6597  * Input:
6598  *
6599  * target :     constituent pages are SE_EXCL locked.
6600  * replacement: constituent pages are SE_EXCL locked.
6601  *
6602  * Output:
6603  *
6604  * nrelocp:     number of pages relocated
6605  */
6606 int
6607 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6608 {
6609         page_t          *targ, *repl;
6610         page_t          *tpp, *rpp;
6611         kmutex_t        *low, *high;
6612         spgcnt_t        npages, i;
6613         page_t          *pl = NULL;
6614         int             old_pil;
6615         cpuset_t        cpuset;
6616         int             cap_cpus;
6617         int             ret;
6618 #ifdef VAC
6619         int             cflags = 0;
6620 #endif
6621 
6622         if (!kcage_on || PP_ISNORELOC(*target)) {
6623                 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6624                 return (EAGAIN);
6625         }
6626 
6627         mutex_enter(&kpr_mutex);
6628         kreloc_thread = curthread;
6629 
6630         targ = *target;
6631         repl = *replacement;
6632         ASSERT(repl != NULL);
6633         ASSERT(targ->p_szc == repl->p_szc);
6634 
6635         npages = page_get_pagecnt(targ->p_szc);
6636 
6637         /*
6638          * unload VA<->PA mappings that are not locked
6639          */
6640         tpp = targ;
6641         for (i = 0; i < npages; i++) {
6642                 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6643                 tpp++;
6644         }
6645 
6646         /*
6647          * Do "presuspend" callbacks, in a context from which we can still
6648          * block as needed. Note that we don't hold the mapping list lock
6649          * of "targ" at this point due to potential locking order issues;
6650          * we assume that between the hat_pageunload() above and holding
6651          * the SE_EXCL lock that the mapping list *cannot* change at this
6652          * point.
6653          */
6654         ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6655         if (ret != 0) {
6656                 /*
6657                  * EIO translates to fatal error, for all others cleanup
6658                  * and return EAGAIN.
6659                  */
6660                 ASSERT(ret != EIO);
6661                 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6662                 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6663                 kreloc_thread = NULL;
6664                 mutex_exit(&kpr_mutex);
6665                 return (EAGAIN);
6666         }
6667 
6668         /*
6669          * acquire p_mapping list lock for both the target and replacement
6670          * root pages.
6671          *
6672          * low and high refer to the need to grab the mlist locks in a
6673          * specific order in order to prevent race conditions.  Thus the
6674          * lower lock must be grabbed before the higher lock.
6675          *
6676          * This will block hat_unload's accessing p_mapping list.  Since
6677          * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6678          * blocked.  Thus, no one else will be accessing the p_mapping list
6679          * while we suspend and reload the locked mapping below.
6680          */
6681         tpp = targ;
6682         rpp = repl;
6683         sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6684 
6685         kpreempt_disable();
6686 
6687         /*
6688          * We raise our PIL to 13 so that we don't get captured by
6689          * another CPU or pinned by an interrupt thread.  We can't go to
6690          * PIL 14 since the nexus driver(s) may need to interrupt at
6691          * that level in the case of IOMMU pseudo mappings.
6692          */
6693         cpuset = cpu_ready_set;
6694         CPUSET_DEL(cpuset, CPU->cpu_id);
6695         if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6696                 old_pil = splr(XCALL_PIL);
6697         } else {
6698                 old_pil = -1;
6699                 xc_attention(cpuset);
6700         }
6701         ASSERT(getpil() == XCALL_PIL);
6702 
6703         /*
6704          * Now do suspend callbacks. In the case of an IOMMU mapping
6705          * this will suspend all DMA activity to the page while it is
6706          * being relocated. Since we are well above LOCK_LEVEL and CPUs
6707          * may be captured at this point we should have acquired any needed
6708          * locks in the presuspend callback.
6709          */
6710         ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6711         if (ret != 0) {
6712                 repl = targ;
6713                 goto suspend_fail;
6714         }
6715 
6716         /*
6717          * Raise the PIL yet again, this time to block all high-level
6718          * interrupts on this CPU. This is necessary to prevent an
6719          * interrupt routine from pinning the thread which holds the
6720          * mapping suspended and then touching the suspended page.
6721          *
6722          * Once the page is suspended we also need to be careful to
6723          * avoid calling any functions which touch any seg_kmem memory
6724          * since that memory may be backed by the very page we are
6725          * relocating in here!
6726          */
6727         hat_pagesuspend(targ);
6728 
6729         /*
6730          * Now that we are confident everybody has stopped using this page,
6731          * copy the page contents.  Note we use a physical copy to prevent
6732          * locking issues and to avoid fpRAS because we can't handle it in
6733          * this context.
6734          */
6735         for (i = 0; i < npages; i++, tpp++, rpp++) {
6736 #ifdef VAC
6737                 /*
6738                  * If the replacement has a different vcolor than
6739                  * the one being replacd, we need to handle VAC
6740                  * consistency for it just as we were setting up
6741                  * a new mapping to it.
6742                  */
6743                 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6744                     (tpp->p_vcolor != rpp->p_vcolor) &&
6745                     !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6746                         CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6747                         sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6748                             rpp->p_pagenum);
6749                 }
6750 #endif
6751                 /*
6752                  * Copy the contents of the page.
6753                  */
6754                 ppcopy_kernel(tpp, rpp);
6755         }
6756 
6757         tpp = targ;
6758         rpp = repl;
6759         for (i = 0; i < npages; i++, tpp++, rpp++) {
6760                 /*
6761                  * Copy attributes.  VAC consistency was handled above,
6762                  * if required.
6763                  */
6764                 rpp->p_nrm = tpp->p_nrm;
6765                 tpp->p_nrm = 0;
6766                 rpp->p_index = tpp->p_index;
6767                 tpp->p_index = 0;
6768 #ifdef VAC
6769                 rpp->p_vcolor = tpp->p_vcolor;
6770 #endif
6771         }
6772 
6773         /*
6774          * First, unsuspend the page, if we set the suspend bit, and transfer
6775          * the mapping list from the target page to the replacement page.
6776          * Next process postcallbacks; since pa_hment's are linked only to the
6777          * p_mapping list of root page, we don't iterate over the constituent
6778          * pages.
6779          */
6780         hat_pagereload(targ, repl);
6781 
6782 suspend_fail:
6783         hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
6784 
6785         /*
6786          * Now lower our PIL and release any captured CPUs since we
6787          * are out of the "danger zone".  After this it will again be
6788          * safe to acquire adaptive mutex locks, or to drop them...
6789          */
6790         if (old_pil != -1) {
6791                 splx(old_pil);
6792         } else {
6793                 xc_dismissed(cpuset);
6794         }
6795 
6796         kpreempt_enable();
6797 
6798         sfmmu_mlist_reloc_exit(low, high);
6799 
6800         /*
6801          * Postsuspend callbacks should drop any locks held across
6802          * the suspend callbacks.  As before, we don't hold the mapping
6803          * list lock at this point.. our assumption is that the mapping
6804          * list still can't change due to our holding SE_EXCL lock and
6805          * there being no unlocked mappings left. Hence the restriction
6806          * on calling context to hat_delete_callback()
6807          */
6808         hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
6809         if (ret != 0) {
6810                 /*
6811                  * The second presuspend call failed: we got here through
6812                  * the suspend_fail label above.
6813                  */
6814                 ASSERT(ret != EIO);
6815                 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
6816                 kreloc_thread = NULL;
6817                 mutex_exit(&kpr_mutex);
6818                 return (EAGAIN);
6819         }
6820 
6821         /*
6822          * Now that we're out of the performance critical section we can
6823          * take care of updating the hash table, since we still
6824          * hold all the pages locked SE_EXCL at this point we
6825          * needn't worry about things changing out from under us.
6826          */
6827         tpp = targ;
6828         rpp = repl;
6829         for (i = 0; i < npages; i++, tpp++, rpp++) {
6830 
6831                 /*
6832                  * replace targ with replacement in page_hash table
6833                  */
6834                 targ = tpp;
6835                 page_relocate_hash(rpp, targ);
6836 
6837                 /*
6838                  * concatenate target; caller of platform_page_relocate()
6839                  * expects target to be concatenated after returning.
6840                  */
6841                 ASSERT(targ->p_next == targ);
6842                 ASSERT(targ->p_prev == targ);
6843                 page_list_concat(&pl, &targ);
6844         }
6845 
6846         ASSERT(*target == pl);
6847         *nrelocp = npages;
6848         PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
6849         kreloc_thread = NULL;
6850         mutex_exit(&kpr_mutex);
6851         return (0);
6852 }
6853 
6854 /*
6855  * Called when stray pa_hments are found attached to a page which is
6856  * being freed.  Notify the subsystem which attached the pa_hment of
6857  * the error if it registered a suitable handler, else panic.
6858  */
6859 static void
6860 sfmmu_pahment_leaked(struct pa_hment *pahmep)
6861 {
6862         id_t cb_id = pahmep->cb_id;
6863 
6864         ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
6865         if (sfmmu_cb_table[cb_id].errhandler != NULL) {
6866                 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
6867                     HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
6868                         return;         /* non-fatal */
6869         }
6870         panic("pa_hment leaked: 0x%p", (void *)pahmep);
6871 }
6872 
6873 /*
6874  * Remove all mappings to page 'pp'.
6875  */
6876 int
6877 hat_pageunload(struct page *pp, uint_t forceflag)
6878 {
6879         struct page *origpp = pp;
6880         struct sf_hment *sfhme, *tmphme;
6881         struct hme_blk *hmeblkp;
6882         kmutex_t *pml;
6883 #ifdef VAC
6884         kmutex_t *pmtx;
6885 #endif
6886         cpuset_t cpuset, tset;
6887         int index, cons;
6888         int pa_hments;
6889 
6890         ASSERT(PAGE_EXCL(pp));
6891 
6892         tmphme = NULL;
6893         pa_hments = 0;
6894         CPUSET_ZERO(cpuset);
6895 
6896         pml = sfmmu_mlist_enter(pp);
6897 
6898 #ifdef VAC
6899         if (pp->p_kpmref)
6900                 sfmmu_kpm_pageunload(pp);
6901         ASSERT(!PP_ISMAPPED_KPM(pp));
6902 #endif
6903         /*
6904          * Clear vpm reference. Since the page is exclusively locked
6905          * vpm cannot be referencing it.
6906          */
6907         if (vpm_enable) {
6908                 pp->p_vpmref = 0;
6909         }
6910 
6911         index = PP_MAPINDEX(pp);
6912         cons = TTE8K;
6913 retry:
6914         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
6915                 tmphme = sfhme->hme_next;
6916 
6917                 if (IS_PAHME(sfhme)) {
6918                         ASSERT(sfhme->hme_data != NULL);
6919                         pa_hments++;
6920                         continue;
6921                 }
6922 
6923                 hmeblkp = sfmmu_hmetohblk(sfhme);
6924 
6925                 /*
6926                  * If there are kernel mappings don't unload them, they will
6927                  * be suspended.
6928                  */
6929                 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
6930                     hmeblkp->hblk_tag.htag_id == ksfmmup)
6931                         continue;
6932 
6933                 tset = sfmmu_pageunload(pp, sfhme, cons);
6934                 CPUSET_OR(cpuset, tset);
6935         }
6936 
6937         while (index != 0) {
6938                 index = index >> 1;
6939                 if (index != 0)
6940                         cons++;
6941                 if (index & 0x1) {
6942                         /* Go to leading page */
6943                         pp = PP_GROUPLEADER(pp, cons);
6944                         ASSERT(sfmmu_mlist_held(pp));
6945                         goto retry;
6946                 }
6947         }
6948 
6949         /*
6950          * cpuset may be empty if the page was only mapped by segkpm,
6951          * in which case we won't actually cross-trap.
6952          */
6953         xt_sync(cpuset);
6954 
6955         /*
6956          * The page should have no mappings at this point, unless
6957          * we were called from hat_page_relocate() in which case we
6958          * leave the locked mappings which will be suspended later.
6959          */
6960         ASSERT(!PP_ISMAPPED(origpp) || pa_hments ||
6961             (forceflag == SFMMU_KERNEL_RELOC));
6962 
6963 #ifdef VAC
6964         if (PP_ISTNC(pp)) {
6965                 if (cons == TTE8K) {
6966                         pmtx = sfmmu_page_enter(pp);
6967                         PP_CLRTNC(pp);
6968                         sfmmu_page_exit(pmtx);
6969                 } else {
6970                         conv_tnc(pp, cons);
6971                 }
6972         }
6973 #endif  /* VAC */
6974 
6975         if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
6976                 /*
6977                  * Unlink any pa_hments and free them, calling back
6978                  * the responsible subsystem to notify it of the error.
6979                  * This can occur in situations such as drivers leaking
6980                  * DMA handles: naughty, but common enough that we'd like
6981                  * to keep the system running rather than bringing it
6982                  * down with an obscure error like "pa_hment leaked"
6983                  * which doesn't aid the user in debugging their driver.
6984                  */
6985                 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
6986                         tmphme = sfhme->hme_next;
6987                         if (IS_PAHME(sfhme)) {
6988                                 struct pa_hment *pahmep = sfhme->hme_data;
6989                                 sfmmu_pahment_leaked(pahmep);
6990                                 HME_SUB(sfhme, pp);
6991                                 kmem_cache_free(pa_hment_cache, pahmep);
6992                         }
6993                 }
6994 
6995                 ASSERT(!PP_ISMAPPED(origpp));
6996         }
6997 
6998         sfmmu_mlist_exit(pml);
6999 
7000         return (0);
7001 }
7002 
7003 cpuset_t
7004 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7005 {
7006         struct hme_blk *hmeblkp;
7007         sfmmu_t *sfmmup;
7008         tte_t tte, ttemod;
7009 #ifdef DEBUG
7010         tte_t orig_old;
7011 #endif /* DEBUG */
7012         caddr_t addr;
7013         int ttesz;
7014         int ret;
7015         cpuset_t cpuset;
7016 
7017         ASSERT(pp != NULL);
7018         ASSERT(sfmmu_mlist_held(pp));
7019         ASSERT(!PP_ISKAS(pp));
7020 
7021         CPUSET_ZERO(cpuset);
7022 
7023         hmeblkp = sfmmu_hmetohblk(sfhme);
7024 
7025 readtte:
7026         sfmmu_copytte(&sfhme->hme_tte, &tte);
7027         if (TTE_IS_VALID(&tte)) {
7028                 sfmmup = hblktosfmmu(hmeblkp);
7029                 ttesz = get_hblk_ttesz(hmeblkp);
7030                 /*
7031                  * Only unload mappings of 'cons' size.
7032                  */
7033                 if (ttesz != cons)
7034                         return (cpuset);
7035 
7036                 /*
7037                  * Note that we have p_mapping lock, but no hash lock here.
7038                  * hblk_unload() has to have both hash lock AND p_mapping
7039                  * lock before it tries to modify tte. So, the tte could
7040                  * not become invalid in the sfmmu_modifytte_try() below.
7041                  */
7042                 ttemod = tte;
7043 #ifdef DEBUG
7044                 orig_old = tte;
7045 #endif /* DEBUG */
7046 
7047                 TTE_SET_INVALID(&ttemod);
7048                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7049                 if (ret < 0) {
7050 #ifdef DEBUG
7051                         /* only R/M bits can change. */
7052                         chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7053 #endif /* DEBUG */
7054                         goto readtte;
7055                 }
7056 
7057                 if (ret == 0) {
7058                         panic("pageunload: cas failed?");
7059                 }
7060 
7061                 addr = tte_to_vaddr(hmeblkp, tte);
7062 
7063                 if (hmeblkp->hblk_shared) {
7064                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7065                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
7066                         sf_region_t *rgnp;
7067                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7068                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7069                         ASSERT(srdp != NULL);
7070                         rgnp = srdp->srd_hmergnp[rid];
7071                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7072                         cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7073                         sfmmu_ttesync(NULL, addr, &tte, pp);
7074                         ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7075                         atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7076                 } else {
7077                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
7078                         atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7079 
7080                         /*
7081                          * We need to flush the page from the virtual cache
7082                          * in order to prevent a virtual cache alias
7083                          * inconsistency. The particular scenario we need
7084                          * to worry about is:
7085                          * Given:  va1 and va2 are two virtual address that
7086                          * alias and will map the same physical address.
7087                          * 1.   mapping exists from va1 to pa and data has
7088                          *      been read into the cache.
7089                          * 2.   unload va1.
7090                          * 3.   load va2 and modify data using va2.
7091                          * 4    unload va2.
7092                          * 5.   load va1 and reference data.  Unless we flush
7093                          *      the data cache when we unload we will get
7094                          *      stale data.
7095                          * This scenario is taken care of by using virtual
7096                          * page coloring.
7097                          */
7098                         if (sfmmup->sfmmu_ismhat) {
7099                                 /*
7100                                  * Flush TSBs, TLBs and caches
7101                                  * of every process
7102                                  * sharing this ism segment.
7103                                  */
7104                                 sfmmu_hat_lock_all();
7105                                 mutex_enter(&ism_mlist_lock);
7106                                 kpreempt_disable();
7107                                 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7108                                     pp->p_pagenum, CACHE_NO_FLUSH);
7109                                 kpreempt_enable();
7110                                 mutex_exit(&ism_mlist_lock);
7111                                 sfmmu_hat_unlock_all();
7112                                 cpuset = cpu_ready_set;
7113                         } else {
7114                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7115                                 cpuset = sfmmup->sfmmu_cpusran;
7116                         }
7117                 }
7118 
7119                 /*
7120                  * Hme_sub has to run after ttesync() and a_rss update.
7121                  * See hblk_unload().
7122                  */
7123                 HME_SUB(sfhme, pp);
7124                 membar_stst();
7125 
7126                 /*
7127                  * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7128                  * since pteload may have done a HME_ADD() right after
7129                  * we did the HME_SUB() above. Hmecnt is now maintained
7130                  * by cas only. no lock guranteed its value. The only
7131                  * gurantee we have is the hmecnt should not be less than
7132                  * what it should be so the hblk will not be taken away.
7133                  * It's also important that we decremented the hmecnt after
7134                  * we are done with hmeblkp so that this hmeblk won't be
7135                  * stolen.
7136                  */
7137                 ASSERT(hmeblkp->hblk_hmecnt > 0);
7138                 ASSERT(hmeblkp->hblk_vcnt > 0);
7139                 atomic_dec_16(&hmeblkp->hblk_vcnt);
7140                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7141                 /*
7142                  * This is bug 4063182.
7143                  * XXX: fixme
7144                  * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7145                  *      !hmeblkp->hblk_lckcnt);
7146                  */
7147         } else {
7148                 panic("invalid tte? pp %p &tte %p",
7149                     (void *)pp, (void *)&tte);
7150         }
7151 
7152         return (cpuset);
7153 }
7154 
7155 /*
7156  * While relocating a kernel page, this function will move the mappings
7157  * from tpp to dpp and modify any associated data with these mappings.
7158  * It also unsuspends the suspended kernel mapping.
7159  */
7160 static void
7161 hat_pagereload(struct page *tpp, struct page *dpp)
7162 {
7163         struct sf_hment *sfhme;
7164         tte_t tte, ttemod;
7165         int index, cons;
7166 
7167         ASSERT(getpil() == PIL_MAX);
7168         ASSERT(sfmmu_mlist_held(tpp));
7169         ASSERT(sfmmu_mlist_held(dpp));
7170 
7171         index = PP_MAPINDEX(tpp);
7172         cons = TTE8K;
7173 
7174         /* Update real mappings to the page */
7175 retry:
7176         for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7177                 if (IS_PAHME(sfhme))
7178                         continue;
7179                 sfmmu_copytte(&sfhme->hme_tte, &tte);
7180                 ttemod = tte;
7181 
7182                 /*
7183                  * replace old pfn with new pfn in TTE
7184                  */
7185                 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7186 
7187                 /*
7188                  * clear suspend bit
7189                  */
7190                 ASSERT(TTE_IS_SUSPEND(&ttemod));
7191                 TTE_CLR_SUSPEND(&ttemod);
7192 
7193                 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7194                         panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7195 
7196                 /*
7197                  * set hme_page point to new page
7198                  */
7199                 sfhme->hme_page = dpp;
7200         }
7201 
7202         /*
7203          * move p_mapping list from old page to new page
7204          */
7205         dpp->p_mapping = tpp->p_mapping;
7206         tpp->p_mapping = NULL;
7207         dpp->p_share = tpp->p_share;
7208         tpp->p_share = 0;
7209 
7210         while (index != 0) {
7211                 index = index >> 1;
7212                 if (index != 0)
7213                         cons++;
7214                 if (index & 0x1) {
7215                         tpp = PP_GROUPLEADER(tpp, cons);
7216                         dpp = PP_GROUPLEADER(dpp, cons);
7217                         goto retry;
7218                 }
7219         }
7220 
7221         curthread->t_flag &= ~T_DONTDTRACE;
7222         mutex_exit(&kpr_suspendlock);
7223 }
7224 
7225 uint_t
7226 hat_pagesync(struct page *pp, uint_t clearflag)
7227 {
7228         struct sf_hment *sfhme, *tmphme = NULL;
7229         struct hme_blk *hmeblkp;
7230         kmutex_t *pml;
7231         cpuset_t cpuset, tset;
7232         int     index, cons;
7233         extern  ulong_t po_share;
7234         page_t  *save_pp = pp;
7235         int     stop_on_sh = 0;
7236         uint_t  shcnt;
7237 
7238         CPUSET_ZERO(cpuset);
7239 
7240         if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7241                 return (PP_GENERIC_ATTR(pp));
7242         }
7243 
7244         if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7245                 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7246                         return (PP_GENERIC_ATTR(pp));
7247                 }
7248                 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7249                         return (PP_GENERIC_ATTR(pp));
7250                 }
7251                 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7252                         if (pp->p_share > po_share) {
7253                                 hat_page_setattr(pp, P_REF);
7254                                 return (PP_GENERIC_ATTR(pp));
7255                         }
7256                         stop_on_sh = 1;
7257                         shcnt = 0;
7258                 }
7259         }
7260 
7261         clearflag &= ~HAT_SYNC_STOPON_SHARED;
7262         pml = sfmmu_mlist_enter(pp);
7263         index = PP_MAPINDEX(pp);
7264         cons = TTE8K;
7265 retry:
7266         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7267                 /*
7268                  * We need to save the next hment on the list since
7269                  * it is possible for pagesync to remove an invalid hment
7270                  * from the list.
7271                  */
7272                 tmphme = sfhme->hme_next;
7273                 if (IS_PAHME(sfhme))
7274                         continue;
7275                 /*
7276                  * If we are looking for large mappings and this hme doesn't
7277                  * reach the range we are seeking, just ignore it.
7278                  */
7279                 hmeblkp = sfmmu_hmetohblk(sfhme);
7280 
7281                 if (hme_size(sfhme) < cons)
7282                         continue;
7283 
7284                 if (stop_on_sh) {
7285                         if (hmeblkp->hblk_shared) {
7286                                 sf_srd_t *srdp = hblktosrd(hmeblkp);
7287                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7288                                 sf_region_t *rgnp;
7289                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7290                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7291                                 ASSERT(srdp != NULL);
7292                                 rgnp = srdp->srd_hmergnp[rid];
7293                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7294                                     rgnp, rid);
7295                                 shcnt += rgnp->rgn_refcnt;
7296                         } else {
7297                                 shcnt++;
7298                         }
7299                         if (shcnt > po_share) {
7300                                 /*
7301                                  * tell the pager to spare the page this time
7302                                  * around.
7303                                  */
7304                                 hat_page_setattr(save_pp, P_REF);
7305                                 index = 0;
7306                                 break;
7307                         }
7308                 }
7309                 tset = sfmmu_pagesync(pp, sfhme,
7310                     clearflag & ~HAT_SYNC_STOPON_RM);
7311                 CPUSET_OR(cpuset, tset);
7312 
7313                 /*
7314                  * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7315                  * as the "ref" or "mod" is set or share cnt exceeds po_share.
7316                  */
7317                 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7318                     (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7319                     ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7320                         index = 0;
7321                         break;
7322                 }
7323         }
7324 
7325         while (index) {
7326                 index = index >> 1;
7327                 cons++;
7328                 if (index & 0x1) {
7329                         /* Go to leading page */
7330                         pp = PP_GROUPLEADER(pp, cons);
7331                         goto retry;
7332                 }
7333         }
7334 
7335         xt_sync(cpuset);
7336         sfmmu_mlist_exit(pml);
7337         return (PP_GENERIC_ATTR(save_pp));
7338 }
7339 
7340 /*
7341  * Get all the hardware dependent attributes for a page struct
7342  */
7343 static cpuset_t
7344 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7345         uint_t clearflag)
7346 {
7347         caddr_t addr;
7348         tte_t tte, ttemod;
7349         struct hme_blk *hmeblkp;
7350         int ret;
7351         sfmmu_t *sfmmup;
7352         cpuset_t cpuset;
7353 
7354         ASSERT(pp != NULL);
7355         ASSERT(sfmmu_mlist_held(pp));
7356         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7357             (clearflag == HAT_SYNC_ZERORM));
7358 
7359         SFMMU_STAT(sf_pagesync);
7360 
7361         CPUSET_ZERO(cpuset);
7362 
7363 sfmmu_pagesync_retry:
7364 
7365         sfmmu_copytte(&sfhme->hme_tte, &tte);
7366         if (TTE_IS_VALID(&tte)) {
7367                 hmeblkp = sfmmu_hmetohblk(sfhme);
7368                 sfmmup = hblktosfmmu(hmeblkp);
7369                 addr = tte_to_vaddr(hmeblkp, tte);
7370                 if (clearflag == HAT_SYNC_ZERORM) {
7371                         ttemod = tte;
7372                         TTE_CLR_RM(&ttemod);
7373                         ret = sfmmu_modifytte_try(&tte, &ttemod,
7374                             &sfhme->hme_tte);
7375                         if (ret < 0) {
7376                                 /*
7377                                  * cas failed and the new value is not what
7378                                  * we want.
7379                                  */
7380                                 goto sfmmu_pagesync_retry;
7381                         }
7382 
7383                         if (ret > 0) {
7384                                 /* we win the cas */
7385                                 if (hmeblkp->hblk_shared) {
7386                                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7387                                         uint_t rid =
7388                                             hmeblkp->hblk_tag.htag_rid;
7389                                         sf_region_t *rgnp;
7390                                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7391                                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7392                                         ASSERT(srdp != NULL);
7393                                         rgnp = srdp->srd_hmergnp[rid];
7394                                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7395                                             srdp, rgnp, rid);
7396                                         cpuset = sfmmu_rgntlb_demap(addr,
7397                                             rgnp, hmeblkp, 1);
7398                                 } else {
7399                                         sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7400                                             0, 0);
7401                                         cpuset = sfmmup->sfmmu_cpusran;
7402                                 }
7403                         }
7404                 }
7405                 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7406                     &tte, pp);
7407         }
7408         return (cpuset);
7409 }
7410 
7411 /*
7412  * Remove write permission from a mappings to a page, so that
7413  * we can detect the next modification of it. This requires modifying
7414  * the TTE then invalidating (demap) any TLB entry using that TTE.
7415  * This code is similar to sfmmu_pagesync().
7416  */
7417 static cpuset_t
7418 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7419 {
7420         caddr_t addr;
7421         tte_t tte;
7422         tte_t ttemod;
7423         struct hme_blk *hmeblkp;
7424         int ret;
7425         sfmmu_t *sfmmup;
7426         cpuset_t cpuset;
7427 
7428         ASSERT(pp != NULL);
7429         ASSERT(sfmmu_mlist_held(pp));
7430 
7431         CPUSET_ZERO(cpuset);
7432         SFMMU_STAT(sf_clrwrt);
7433 
7434 retry:
7435 
7436         sfmmu_copytte(&sfhme->hme_tte, &tte);
7437         if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7438                 hmeblkp = sfmmu_hmetohblk(sfhme);
7439                 sfmmup = hblktosfmmu(hmeblkp);
7440                 addr = tte_to_vaddr(hmeblkp, tte);
7441 
7442                 ttemod = tte;
7443                 TTE_CLR_WRT(&ttemod);
7444                 TTE_CLR_MOD(&ttemod);
7445                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7446 
7447                 /*
7448                  * if cas failed and the new value is not what
7449                  * we want retry
7450                  */
7451                 if (ret < 0)
7452                         goto retry;
7453 
7454                 /* we win the cas */
7455                 if (ret > 0) {
7456                         if (hmeblkp->hblk_shared) {
7457                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7458                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7459                                 sf_region_t *rgnp;
7460                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7461                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7462                                 ASSERT(srdp != NULL);
7463                                 rgnp = srdp->srd_hmergnp[rid];
7464                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7465                                     srdp, rgnp, rid);
7466                                 cpuset = sfmmu_rgntlb_demap(addr,
7467                                     rgnp, hmeblkp, 1);
7468                         } else {
7469                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7470                                 cpuset = sfmmup->sfmmu_cpusran;
7471                         }
7472                 }
7473         }
7474 
7475         return (cpuset);
7476 }
7477 
7478 /*
7479  * Walk all mappings of a page, removing write permission and clearing the
7480  * ref/mod bits. This code is similar to hat_pagesync()
7481  */
7482 static void
7483 hat_page_clrwrt(page_t *pp)
7484 {
7485         struct sf_hment *sfhme;
7486         struct sf_hment *tmphme = NULL;
7487         kmutex_t *pml;
7488         cpuset_t cpuset;
7489         cpuset_t tset;
7490         int     index;
7491         int      cons;
7492 
7493         CPUSET_ZERO(cpuset);
7494 
7495         pml = sfmmu_mlist_enter(pp);
7496         index = PP_MAPINDEX(pp);
7497         cons = TTE8K;
7498 retry:
7499         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7500                 tmphme = sfhme->hme_next;
7501 
7502                 /*
7503                  * If we are looking for large mappings and this hme doesn't
7504                  * reach the range we are seeking, just ignore its.
7505                  */
7506 
7507                 if (hme_size(sfhme) < cons)
7508                         continue;
7509 
7510                 tset = sfmmu_pageclrwrt(pp, sfhme);
7511                 CPUSET_OR(cpuset, tset);
7512         }
7513 
7514         while (index) {
7515                 index = index >> 1;
7516                 cons++;
7517                 if (index & 0x1) {
7518                         /* Go to leading page */
7519                         pp = PP_GROUPLEADER(pp, cons);
7520                         goto retry;
7521                 }
7522         }
7523 
7524         xt_sync(cpuset);
7525         sfmmu_mlist_exit(pml);
7526 }
7527 
7528 /*
7529  * Set the given REF/MOD/RO bits for the given page.
7530  * For a vnode with a sorted v_pages list, we need to change
7531  * the attributes and the v_pages list together under page_vnode_mutex.
7532  */
7533 void
7534 hat_page_setattr(page_t *pp, uint_t flag)
7535 {
7536         vnode_t         *vp = pp->p_vnode;
7537         page_t          **listp;
7538         kmutex_t        *pmtx;
7539         kmutex_t        *vphm = NULL;
7540         int             noshuffle;
7541 
7542         noshuffle = flag & P_NSH;
7543         flag &= ~P_NSH;
7544 
7545         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7546 
7547         /*
7548          * nothing to do if attribute already set
7549          */
7550         if ((pp->p_nrm & flag) == flag)
7551                 return;
7552 
7553         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7554             !noshuffle) {
7555                 vphm = page_vnode_mutex(vp);
7556                 mutex_enter(vphm);
7557         }
7558 
7559         pmtx = sfmmu_page_enter(pp);
7560         pp->p_nrm |= flag;
7561         sfmmu_page_exit(pmtx);
7562 
7563         if (vphm != NULL) {
7564                 /*
7565                  * Some File Systems examine v_pages for NULL w/o
7566                  * grabbing the vphm mutex. Must not let it become NULL when
7567                  * pp is the only page on the list.
7568                  */
7569                 if (pp->p_vpnext != pp) {
7570                         page_vpsub(&vp->v_pages, pp);
7571                         if (vp->v_pages != NULL)
7572                                 listp = &vp->v_pages->p_vpprev->p_vpnext;
7573                         else
7574                                 listp = &vp->v_pages;
7575                         page_vpadd(listp, pp);
7576                 }
7577                 mutex_exit(vphm);
7578         }
7579 }
7580 
7581 void
7582 hat_page_clrattr(page_t *pp, uint_t flag)
7583 {
7584         vnode_t         *vp = pp->p_vnode;
7585         kmutex_t        *pmtx;
7586 
7587         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7588 
7589         pmtx = sfmmu_page_enter(pp);
7590 
7591         /*
7592          * Caller is expected to hold page's io lock for VMODSORT to work
7593          * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7594          * bit is cleared.
7595          * We don't have assert to avoid tripping some existing third party
7596          * code. The dirty page is moved back to top of the v_page list
7597          * after IO is done in pvn_write_done().
7598          */
7599         pp->p_nrm &= ~flag;
7600         sfmmu_page_exit(pmtx);
7601 
7602         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7603 
7604                 /*
7605                  * VMODSORT works by removing write permissions and getting
7606                  * a fault when a page is made dirty. At this point
7607                  * we need to remove write permission from all mappings
7608                  * to this page.
7609                  */
7610                 hat_page_clrwrt(pp);
7611         }
7612 }
7613 
7614 uint_t
7615 hat_page_getattr(page_t *pp, uint_t flag)
7616 {
7617         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7618         return ((uint_t)(pp->p_nrm & flag));
7619 }
7620 
7621 /*
7622  * DEBUG kernels: verify that a kernel va<->pa translation
7623  * is safe by checking the underlying page_t is in a page
7624  * relocation-safe state.
7625  */
7626 #ifdef  DEBUG
7627 void
7628 sfmmu_check_kpfn(pfn_t pfn)
7629 {
7630         page_t *pp;
7631         int index, cons;
7632 
7633         if (hat_check_vtop == 0)
7634                 return;
7635 
7636         if (kvseg.s_base == NULL || panicstr)
7637                 return;
7638 
7639         pp = page_numtopp_nolock(pfn);
7640         if (!pp)
7641                 return;
7642 
7643         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7644                 return;
7645 
7646         /*
7647          * Handed a large kernel page, we dig up the root page since we
7648          * know the root page might have the lock also.
7649          */
7650         if (pp->p_szc != 0) {
7651                 index = PP_MAPINDEX(pp);
7652                 cons = TTE8K;
7653 again:
7654                 while (index != 0) {
7655                         index >>= 1;
7656                         if (index != 0)
7657                                 cons++;
7658                         if (index & 0x1) {
7659                                 pp = PP_GROUPLEADER(pp, cons);
7660                                 goto again;
7661                         }
7662                 }
7663         }
7664 
7665         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7666                 return;
7667 
7668         /*
7669          * Pages need to be locked or allocated "permanent" (either from
7670          * static_arena arena or explicitly setting PG_NORELOC when calling
7671          * page_create_va()) for VA->PA translations to be valid.
7672          */
7673         if (!PP_ISNORELOC(pp))
7674                 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7675                     (void *)pp);
7676         else
7677                 panic("Illegal VA->PA translation, pp 0x%p not locked",
7678                     (void *)pp);
7679 }
7680 #endif  /* DEBUG */
7681 
7682 /*
7683  * Returns a page frame number for a given virtual address.
7684  * Returns PFN_INVALID to indicate an invalid mapping
7685  */
7686 pfn_t
7687 hat_getpfnum(struct hat *hat, caddr_t addr)
7688 {
7689         pfn_t pfn;
7690         tte_t tte;
7691 
7692         /*
7693          * We would like to
7694          * ASSERT(AS_LOCK_HELD(as));
7695          * but we can't because the iommu driver will call this
7696          * routine at interrupt time and it can't grab the as lock
7697          * or it will deadlock: A thread could have the as lock
7698          * and be waiting for io.  The io can't complete
7699          * because the interrupt thread is blocked trying to grab
7700          * the as lock.
7701          */
7702 
7703         if (hat == ksfmmup) {
7704                 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7705                         ASSERT(segkmem_lpszc > 0);
7706                         pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7707                         if (pfn != PFN_INVALID) {
7708                                 sfmmu_check_kpfn(pfn);
7709                                 return (pfn);
7710                         }
7711                 } else if (segkpm && IS_KPM_ADDR(addr)) {
7712                         return (sfmmu_kpm_vatopfn(addr));
7713                 }
7714                 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7715                     == PFN_SUSPENDED) {
7716                         sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7717                 }
7718                 sfmmu_check_kpfn(pfn);
7719                 return (pfn);
7720         } else {
7721                 return (sfmmu_uvatopfn(addr, hat, NULL));
7722         }
7723 }
7724 
7725 /*
7726  * This routine will return both pfn and tte for the vaddr.
7727  */
7728 static pfn_t
7729 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
7730 {
7731         struct hmehash_bucket *hmebp;
7732         hmeblk_tag hblktag;
7733         int hmeshift, hashno = 1;
7734         struct hme_blk *hmeblkp = NULL;
7735         tte_t tte;
7736 
7737         struct sf_hment *sfhmep;
7738         pfn_t pfn;
7739 
7740         /* support for ISM */
7741         ism_map_t       *ism_map;
7742         ism_blk_t       *ism_blkp;
7743         int             i;
7744         sfmmu_t *ism_hatid = NULL;
7745         sfmmu_t *locked_hatid = NULL;
7746         sfmmu_t *sv_sfmmup = sfmmup;
7747         caddr_t sv_vaddr = vaddr;
7748         sf_srd_t *srdp;
7749 
7750         if (ttep == NULL) {
7751                 ttep = &tte;
7752         } else {
7753                 ttep->ll = 0;
7754         }
7755 
7756         ASSERT(sfmmup != ksfmmup);
7757         SFMMU_STAT(sf_user_vtop);
7758         /*
7759          * Set ism_hatid if vaddr falls in a ISM segment.
7760          */
7761         ism_blkp = sfmmup->sfmmu_iblk;
7762         if (ism_blkp != NULL) {
7763                 sfmmu_ismhat_enter(sfmmup, 0);
7764                 locked_hatid = sfmmup;
7765         }
7766         while (ism_blkp != NULL && ism_hatid == NULL) {
7767                 ism_map = ism_blkp->iblk_maps;
7768                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
7769                         if (vaddr >= ism_start(ism_map[i]) &&
7770                             vaddr < ism_end(ism_map[i])) {
7771                                 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
7772                                 vaddr = (caddr_t)(vaddr -
7773                                     ism_start(ism_map[i]));
7774                                 break;
7775                         }
7776                 }
7777                 ism_blkp = ism_blkp->iblk_next;
7778         }
7779         if (locked_hatid) {
7780                 sfmmu_ismhat_exit(locked_hatid, 0);
7781         }
7782 
7783         hblktag.htag_id = sfmmup;
7784         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
7785         do {
7786                 hmeshift = HME_HASH_SHIFT(hashno);
7787                 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
7788                 hblktag.htag_rehash = hashno;
7789                 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
7790 
7791                 SFMMU_HASH_LOCK(hmebp);
7792 
7793                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
7794                 if (hmeblkp != NULL) {
7795                         ASSERT(!hmeblkp->hblk_shared);
7796                         HBLKTOHME(sfhmep, hmeblkp, vaddr);
7797                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7798                         SFMMU_HASH_UNLOCK(hmebp);
7799                         if (TTE_IS_VALID(ttep)) {
7800                                 pfn = TTE_TO_PFN(vaddr, ttep);
7801                                 return (pfn);
7802                         }
7803                         break;
7804                 }
7805                 SFMMU_HASH_UNLOCK(hmebp);
7806                 hashno++;
7807         } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
7808 
7809         if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
7810                 return (PFN_INVALID);
7811         }
7812         srdp = sv_sfmmup->sfmmu_srdp;
7813         ASSERT(srdp != NULL);
7814         ASSERT(srdp->srd_refcnt != 0);
7815         hblktag.htag_id = srdp;
7816         hashno = 1;
7817         do {
7818                 hmeshift = HME_HASH_SHIFT(hashno);
7819                 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
7820                 hblktag.htag_rehash = hashno;
7821                 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
7822 
7823                 SFMMU_HASH_LOCK(hmebp);
7824                 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
7825                     hmeblkp = hmeblkp->hblk_next) {
7826                         uint_t rid;
7827                         sf_region_t *rgnp;
7828                         caddr_t rsaddr;
7829                         caddr_t readdr;
7830 
7831                         if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
7832                             sv_sfmmup->sfmmu_hmeregion_map)) {
7833                                 continue;
7834                         }
7835                         ASSERT(hmeblkp->hblk_shared);
7836                         rid = hmeblkp->hblk_tag.htag_rid;
7837                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7838                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7839                         rgnp = srdp->srd_hmergnp[rid];
7840                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7841                         HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
7842                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7843                         rsaddr = rgnp->rgn_saddr;
7844                         readdr = rsaddr + rgnp->rgn_size;
7845 #ifdef DEBUG
7846                         if (TTE_IS_VALID(ttep) ||
7847                             get_hblk_ttesz(hmeblkp) > TTE8K) {
7848                                 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
7849                                 ASSERT(eva > sv_vaddr);
7850                                 ASSERT(sv_vaddr >= rsaddr);
7851                                 ASSERT(sv_vaddr < readdr);
7852                                 ASSERT(eva <= readdr);
7853                         }
7854 #endif /* DEBUG */
7855                         /*
7856                          * Continue the search if we
7857                          * found an invalid 8K tte outside of the area
7858                          * covered by this hmeblk's region.
7859                          */
7860                         if (TTE_IS_VALID(ttep)) {
7861                                 SFMMU_HASH_UNLOCK(hmebp);
7862                                 pfn = TTE_TO_PFN(sv_vaddr, ttep);
7863                                 return (pfn);
7864                         } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
7865                             (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
7866                                 SFMMU_HASH_UNLOCK(hmebp);
7867                                 pfn = PFN_INVALID;
7868                                 return (pfn);
7869                         }
7870                 }
7871                 SFMMU_HASH_UNLOCK(hmebp);
7872                 hashno++;
7873         } while (hashno <= mmu_hashcnt);
7874         return (PFN_INVALID);
7875 }
7876 
7877 
7878 /*
7879  * For compatability with AT&T and later optimizations
7880  */
7881 /* ARGSUSED */
7882 void
7883 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
7884 {
7885         ASSERT(hat != NULL);
7886 }
7887 
7888 /*
7889  * Return the number of mappings to a particular page.  This number is an
7890  * approximation of the number of people sharing the page.
7891  *
7892  * shared hmeblks or ism hmeblks are counted as 1 mapping here.
7893  * hat_page_checkshare() can be used to compare threshold to share
7894  * count that reflects the number of region sharers albeit at higher cost.
7895  */
7896 ulong_t
7897 hat_page_getshare(page_t *pp)
7898 {
7899         page_t *spp = pp;       /* start page */
7900         kmutex_t *pml;
7901         ulong_t cnt;
7902         int index, sz = TTE64K;
7903 
7904         /*
7905          * We need to grab the mlist lock to make sure any outstanding
7906          * load/unloads complete.  Otherwise we could return zero
7907          * even though the unload(s) hasn't finished yet.
7908          */
7909         pml = sfmmu_mlist_enter(spp);
7910         cnt = spp->p_share;
7911 
7912 #ifdef VAC
7913         if (kpm_enable)
7914                 cnt += spp->p_kpmref;
7915 #endif
7916         if (vpm_enable && pp->p_vpmref) {
7917                 cnt += 1;
7918         }
7919 
7920         /*
7921          * If we have any large mappings, we count the number of
7922          * mappings that this large page is part of.
7923          */
7924         index = PP_MAPINDEX(spp);
7925         index >>= 1;
7926         while (index) {
7927                 pp = PP_GROUPLEADER(spp, sz);
7928                 if ((index & 0x1) && pp != spp) {
7929                         cnt += pp->p_share;
7930                         spp = pp;
7931                 }
7932                 index >>= 1;
7933                 sz++;
7934         }
7935         sfmmu_mlist_exit(pml);
7936         return (cnt);
7937 }
7938 
7939 /*
7940  * Return 1 if the number of mappings exceeds sh_thresh. Return 0
7941  * otherwise. Count shared hmeblks by region's refcnt.
7942  */
7943 int
7944 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
7945 {
7946         kmutex_t *pml;
7947         ulong_t cnt = 0;
7948         int index, sz = TTE8K;
7949         struct sf_hment *sfhme, *tmphme = NULL;
7950         struct hme_blk *hmeblkp;
7951 
7952         pml = sfmmu_mlist_enter(pp);
7953 
7954 #ifdef VAC
7955         if (kpm_enable)
7956                 cnt = pp->p_kpmref;
7957 #endif
7958 
7959         if (vpm_enable && pp->p_vpmref) {
7960                 cnt += 1;
7961         }
7962 
7963         if (pp->p_share + cnt > sh_thresh) {
7964                 sfmmu_mlist_exit(pml);
7965                 return (1);
7966         }
7967 
7968         index = PP_MAPINDEX(pp);
7969 
7970 again:
7971         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7972                 tmphme = sfhme->hme_next;
7973                 if (IS_PAHME(sfhme)) {
7974                         continue;
7975                 }
7976 
7977                 hmeblkp = sfmmu_hmetohblk(sfhme);
7978                 if (hme_size(sfhme) != sz) {
7979                         continue;
7980                 }
7981 
7982                 if (hmeblkp->hblk_shared) {
7983                         sf_srd_t *srdp = hblktosrd(hmeblkp);
7984                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
7985                         sf_region_t *rgnp;
7986                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7987                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7988                         ASSERT(srdp != NULL);
7989                         rgnp = srdp->srd_hmergnp[rid];
7990                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7991                             rgnp, rid);
7992                         cnt += rgnp->rgn_refcnt;
7993                 } else {
7994                         cnt++;
7995                 }
7996                 if (cnt > sh_thresh) {
7997                         sfmmu_mlist_exit(pml);
7998                         return (1);
7999                 }
8000         }
8001 
8002         index >>= 1;
8003         sz++;
8004         while (index) {
8005                 pp = PP_GROUPLEADER(pp, sz);
8006                 ASSERT(sfmmu_mlist_held(pp));
8007                 if (index & 0x1) {
8008                         goto again;
8009                 }
8010                 index >>= 1;
8011                 sz++;
8012         }
8013         sfmmu_mlist_exit(pml);
8014         return (0);
8015 }
8016 
8017 /*
8018  * Unload all large mappings to the pp and reset the p_szc field of every
8019  * constituent page according to the remaining mappings.
8020  *
8021  * pp must be locked SE_EXCL. Even though no other constituent pages are
8022  * locked it's legal to unload the large mappings to the pp because all
8023  * constituent pages of large locked mappings have to be locked SE_SHARED.
8024  * This means if we have SE_EXCL lock on one of constituent pages none of the
8025  * large mappings to pp are locked.
8026  *
8027  * Decrease p_szc field starting from the last constituent page and ending
8028  * with the root page. This method is used because other threads rely on the
8029  * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8030  * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8031  * ensures that p_szc changes of the constituent pages appears atomic for all
8032  * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8033  *
8034  * This mechanism is only used for file system pages where it's not always
8035  * possible to get SE_EXCL locks on all constituent pages to demote the size
8036  * code (as is done for anonymous or kernel large pages).
8037  *
8038  * See more comments in front of sfmmu_mlspl_enter().
8039  */
8040 void
8041 hat_page_demote(page_t *pp)
8042 {
8043         int index;
8044         int sz;
8045         cpuset_t cpuset;
8046         int sync = 0;
8047         page_t *rootpp;
8048         struct sf_hment *sfhme;
8049         struct sf_hment *tmphme = NULL;
8050         struct hme_blk *hmeblkp;
8051         uint_t pszc;
8052         page_t *lastpp;
8053         cpuset_t tset;
8054         pgcnt_t npgs;
8055         kmutex_t *pml;
8056         kmutex_t *pmtx = NULL;
8057 
8058         ASSERT(PAGE_EXCL(pp));
8059         ASSERT(!PP_ISFREE(pp));
8060         ASSERT(!PP_ISKAS(pp));
8061         ASSERT(page_szc_lock_assert(pp));
8062         pml = sfmmu_mlist_enter(pp);
8063 
8064         pszc = pp->p_szc;
8065         if (pszc == 0) {
8066                 goto out;
8067         }
8068 
8069         index = PP_MAPINDEX(pp) >> 1;
8070 
8071         if (index) {
8072                 CPUSET_ZERO(cpuset);
8073                 sz = TTE64K;
8074                 sync = 1;
8075         }
8076 
8077         while (index) {
8078                 if (!(index & 0x1)) {
8079                         index >>= 1;
8080                         sz++;
8081                         continue;
8082                 }
8083                 ASSERT(sz <= pszc);
8084                 rootpp = PP_GROUPLEADER(pp, sz);
8085                 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8086                         tmphme = sfhme->hme_next;
8087                         ASSERT(!IS_PAHME(sfhme));
8088                         hmeblkp = sfmmu_hmetohblk(sfhme);
8089                         if (hme_size(sfhme) != sz) {
8090                                 continue;
8091                         }
8092                         tset = sfmmu_pageunload(rootpp, sfhme, sz);
8093                         CPUSET_OR(cpuset, tset);
8094                 }
8095                 if (index >>= 1) {
8096                         sz++;
8097                 }
8098         }
8099 
8100         ASSERT(!PP_ISMAPPED_LARGE(pp));
8101 
8102         if (sync) {
8103                 xt_sync(cpuset);
8104 #ifdef VAC
8105                 if (PP_ISTNC(pp)) {
8106                         conv_tnc(rootpp, sz);
8107                 }
8108 #endif  /* VAC */
8109         }
8110 
8111         pmtx = sfmmu_page_enter(pp);
8112 
8113         ASSERT(pp->p_szc == pszc);
8114         rootpp = PP_PAGEROOT(pp);
8115         ASSERT(rootpp->p_szc == pszc);
8116         lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8117 
8118         while (lastpp != rootpp) {
8119                 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8120                 ASSERT(sz < pszc);
8121                 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8122                 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8123                 while (--npgs > 0) {
8124                         lastpp->p_szc = (uchar_t)sz;
8125                         lastpp = PP_PAGEPREV(lastpp);
8126                 }
8127                 if (sz) {
8128                         /*
8129                          * make sure before current root's pszc
8130                          * is updated all updates to constituent pages pszc
8131                          * fields are globally visible.
8132                          */
8133                         membar_producer();
8134                 }
8135                 lastpp->p_szc = sz;
8136                 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8137                 if (lastpp != rootpp) {
8138                         lastpp = PP_PAGEPREV(lastpp);
8139                 }
8140         }
8141         if (sz == 0) {
8142                 /* the loop above doesn't cover this case */
8143                 rootpp->p_szc = 0;
8144         }
8145 out:
8146         ASSERT(pp->p_szc == 0);
8147         if (pmtx != NULL) {
8148                 sfmmu_page_exit(pmtx);
8149         }
8150         sfmmu_mlist_exit(pml);
8151 }
8152 
8153 /*
8154  * Refresh the HAT ismttecnt[] element for size szc.
8155  * Caller must have set ISM busy flag to prevent mapping
8156  * lists from changing while we're traversing them.
8157  */
8158 pgcnt_t
8159 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8160 {
8161         ism_blk_t       *ism_blkp = sfmmup->sfmmu_iblk;
8162         ism_map_t       *ism_map;
8163         pgcnt_t         npgs = 0;
8164         pgcnt_t         npgs_scd = 0;
8165         int             j;
8166         sf_scd_t        *scdp;
8167         uchar_t         rid;
8168 
8169         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8170         scdp = sfmmup->sfmmu_scdp;
8171 
8172         for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8173                 ism_map = ism_blkp->iblk_maps;
8174                 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8175                         rid = ism_map[j].imap_rid;
8176                         ASSERT(rid == SFMMU_INVALID_ISMRID ||
8177                             rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8178 
8179                         if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8180                             SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8181                                 /* ISM is in sfmmup's SCD */
8182                                 npgs_scd +=
8183                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8184                         } else {
8185                                 /* ISMs is not in SCD */
8186                                 npgs +=
8187                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8188                         }
8189                 }
8190         }
8191         sfmmup->sfmmu_ismttecnt[szc] = npgs;
8192         sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8193         return (npgs);
8194 }
8195 
8196 /*
8197  * Yield the memory claim requirement for an address space.
8198  *
8199  * This is currently implemented as the number of bytes that have active
8200  * hardware translations that have page structures.  Therefore, it can
8201  * underestimate the traditional resident set size, eg, if the
8202  * physical page is present and the hardware translation is missing;
8203  * and it can overestimate the rss, eg, if there are active
8204  * translations to a frame buffer with page structs.
8205  * Also, it does not take sharing into account.
8206  *
8207  * Note that we don't acquire locks here since this function is most often
8208  * called from the clock thread.
8209  */
8210 size_t
8211 hat_get_mapped_size(struct hat *hat)
8212 {
8213         size_t          assize = 0;
8214         int             i;
8215 
8216         if (hat == NULL)
8217                 return (0);
8218 
8219         for (i = 0; i < mmu_page_sizes; i++)
8220                 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8221                     (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8222 
8223         if (hat->sfmmu_iblk == NULL)
8224                 return (assize);
8225 
8226         for (i = 0; i < mmu_page_sizes; i++)
8227                 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8228                     (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8229 
8230         return (assize);
8231 }
8232 
8233 int
8234 hat_stats_enable(struct hat *hat)
8235 {
8236         hatlock_t       *hatlockp;
8237 
8238         hatlockp = sfmmu_hat_enter(hat);
8239         hat->sfmmu_rmstat++;
8240         sfmmu_hat_exit(hatlockp);
8241         return (1);
8242 }
8243 
8244 void
8245 hat_stats_disable(struct hat *hat)
8246 {
8247         hatlock_t       *hatlockp;
8248 
8249         hatlockp = sfmmu_hat_enter(hat);
8250         hat->sfmmu_rmstat--;
8251         sfmmu_hat_exit(hatlockp);
8252 }
8253 
8254 /*
8255  * Routines for entering or removing  ourselves from the
8256  * ism_hat's mapping list. This is used for both private and
8257  * SCD hats.
8258  */
8259 static void
8260 iment_add(struct ism_ment *iment,  struct hat *ism_hat)
8261 {
8262         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8263 
8264         iment->iment_prev = NULL;
8265         iment->iment_next = ism_hat->sfmmu_iment;
8266         if (ism_hat->sfmmu_iment) {
8267                 ism_hat->sfmmu_iment->iment_prev = iment;
8268         }
8269         ism_hat->sfmmu_iment = iment;
8270 }
8271 
8272 static void
8273 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8274 {
8275         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8276 
8277         if (ism_hat->sfmmu_iment == NULL) {
8278                 panic("ism map entry remove - no entries");
8279         }
8280 
8281         if (iment->iment_prev) {
8282                 ASSERT(ism_hat->sfmmu_iment != iment);
8283                 iment->iment_prev->iment_next = iment->iment_next;
8284         } else {
8285                 ASSERT(ism_hat->sfmmu_iment == iment);
8286                 ism_hat->sfmmu_iment = iment->iment_next;
8287         }
8288 
8289         if (iment->iment_next) {
8290                 iment->iment_next->iment_prev = iment->iment_prev;
8291         }
8292 
8293         /*
8294          * zero out the entry
8295          */
8296         iment->iment_next = NULL;
8297         iment->iment_prev = NULL;
8298         iment->iment_hat =  NULL;
8299         iment->iment_base_va = 0;
8300 }
8301 
8302 /*
8303  * Hat_share()/unshare() return an (non-zero) error
8304  * when saddr and daddr are not properly aligned.
8305  *
8306  * The top level mapping element determines the alignment
8307  * requirement for saddr and daddr, depending on different
8308  * architectures.
8309  *
8310  * When hat_share()/unshare() are not supported,
8311  * HATOP_SHARE()/UNSHARE() return 0
8312  */
8313 int
8314 hat_share(struct hat *sfmmup, caddr_t addr,
8315         struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8316 {
8317         ism_blk_t       *ism_blkp;
8318         ism_blk_t       *new_iblk;
8319         ism_map_t       *ism_map;
8320         ism_ment_t      *ism_ment;
8321         int             i, added;
8322         hatlock_t       *hatlockp;
8323         int             reload_mmu = 0;
8324         uint_t          ismshift = page_get_shift(ismszc);
8325         size_t          ismpgsz = page_get_pagesize(ismszc);
8326         uint_t          ismmask = (uint_t)ismpgsz - 1;
8327         size_t          sh_size = ISM_SHIFT(ismshift, len);
8328         ushort_t        ismhatflag;
8329         hat_region_cookie_t rcookie;
8330         sf_scd_t        *old_scdp;
8331 
8332 #ifdef DEBUG
8333         caddr_t         eaddr = addr + len;
8334 #endif /* DEBUG */
8335 
8336         ASSERT(ism_hatid != NULL && sfmmup != NULL);
8337         ASSERT(sptaddr == ISMID_STARTADDR);
8338         /*
8339          * Check the alignment.
8340          */
8341         if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8342                 return (EINVAL);
8343 
8344         /*
8345          * Check size alignment.
8346          */
8347         if (!ISM_ALIGNED(ismshift, len))
8348                 return (EINVAL);
8349 
8350         /*
8351          * Allocate ism_ment for the ism_hat's mapping list, and an
8352          * ism map blk in case we need one.  We must do our
8353          * allocations before acquiring locks to prevent a deadlock
8354          * in the kmem allocator on the mapping list lock.
8355          */
8356         new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8357         ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8358 
8359         /*
8360          * Serialize ISM mappings with the ISM busy flag, and also the
8361          * trap handlers.
8362          */
8363         sfmmu_ismhat_enter(sfmmup, 0);
8364 
8365         /*
8366          * Allocate an ism map blk if necessary.
8367          */
8368         if (sfmmup->sfmmu_iblk == NULL) {
8369                 sfmmup->sfmmu_iblk = new_iblk;
8370                 bzero(new_iblk, sizeof (*new_iblk));
8371                 new_iblk->iblk_nextpa = (uint64_t)-1;
8372                 membar_stst();  /* make sure next ptr visible to all CPUs */
8373                 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8374                 reload_mmu = 1;
8375                 new_iblk = NULL;
8376         }
8377 
8378 #ifdef DEBUG
8379         /*
8380          * Make sure mapping does not already exist.
8381          */
8382         ism_blkp = sfmmup->sfmmu_iblk;
8383         while (ism_blkp != NULL) {
8384                 ism_map = ism_blkp->iblk_maps;
8385                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8386                         if ((addr >= ism_start(ism_map[i]) &&
8387                             addr < ism_end(ism_map[i])) ||
8388                             eaddr > ism_start(ism_map[i]) &&
8389                             eaddr <= ism_end(ism_map[i])) {
8390                                 panic("sfmmu_share: Already mapped!");
8391                         }
8392                 }
8393                 ism_blkp = ism_blkp->iblk_next;
8394         }
8395 #endif /* DEBUG */
8396 
8397         ASSERT(ismszc >= TTE4M);
8398         if (ismszc == TTE4M) {
8399                 ismhatflag = HAT_4M_FLAG;
8400         } else if (ismszc == TTE32M) {
8401                 ismhatflag = HAT_32M_FLAG;
8402         } else if (ismszc == TTE256M) {
8403                 ismhatflag = HAT_256M_FLAG;
8404         }
8405         /*
8406          * Add mapping to first available mapping slot.
8407          */
8408         ism_blkp = sfmmup->sfmmu_iblk;
8409         added = 0;
8410         while (!added) {
8411                 ism_map = ism_blkp->iblk_maps;
8412                 for (i = 0; i < ISM_MAP_SLOTS; i++)  {
8413                         if (ism_map[i].imap_ismhat == NULL) {
8414 
8415                                 ism_map[i].imap_ismhat = ism_hatid;
8416                                 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8417                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8418                                 ism_map[i].imap_hatflags = ismhatflag;
8419                                 ism_map[i].imap_sz_mask = ismmask;
8420                                 /*
8421                                  * imap_seg is checked in ISM_CHECK to see if
8422                                  * non-NULL, then other info assumed valid.
8423                                  */
8424                                 membar_stst();
8425                                 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8426                                 ism_map[i].imap_ment = ism_ment;
8427 
8428                                 /*
8429                                  * Now add ourselves to the ism_hat's
8430                                  * mapping list.
8431                                  */
8432                                 ism_ment->iment_hat = sfmmup;
8433                                 ism_ment->iment_base_va = addr;
8434                                 ism_hatid->sfmmu_ismhat = 1;
8435                                 mutex_enter(&ism_mlist_lock);
8436                                 iment_add(ism_ment, ism_hatid);
8437                                 mutex_exit(&ism_mlist_lock);
8438                                 added = 1;
8439                                 break;
8440                         }
8441                 }
8442                 if (!added && ism_blkp->iblk_next == NULL) {
8443                         ism_blkp->iblk_next = new_iblk;
8444                         new_iblk = NULL;
8445                         bzero(ism_blkp->iblk_next,
8446                             sizeof (*ism_blkp->iblk_next));
8447                         ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8448                         membar_stst();
8449                         ism_blkp->iblk_nextpa =
8450                             va_to_pa((caddr_t)ism_blkp->iblk_next);
8451                 }
8452                 ism_blkp = ism_blkp->iblk_next;
8453         }
8454 
8455         /*
8456          * After calling hat_join_region, sfmmup may join a new SCD or
8457          * move from the old scd to a new scd, in which case, we want to
8458          * shrink the sfmmup's private tsb size, i.e., pass shrink to
8459          * sfmmu_check_page_sizes at the end of this routine.
8460          */
8461         old_scdp = sfmmup->sfmmu_scdp;
8462 
8463         rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8464             PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8465         if (rcookie != HAT_INVALID_REGION_COOKIE) {
8466                 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8467         }
8468         /*
8469          * Update our counters for this sfmmup's ism mappings.
8470          */
8471         for (i = 0; i <= ismszc; i++) {
8472                 if (!(disable_ism_large_pages & (1 << i)))
8473                         (void) ism_tsb_entries(sfmmup, i);
8474         }
8475 
8476         /*
8477          * For ISM and DISM we do not support 512K pages, so we only only
8478          * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8479          * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8480          *
8481          * Need to set 32M/256M ISM flags to make sure
8482          * sfmmu_check_page_sizes() enables them on Panther.
8483          */
8484         ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8485 
8486         switch (ismszc) {
8487         case TTE256M:
8488                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8489                         hatlockp = sfmmu_hat_enter(sfmmup);
8490                         SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8491                         sfmmu_hat_exit(hatlockp);
8492                 }
8493                 break;
8494         case TTE32M:
8495                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8496                         hatlockp = sfmmu_hat_enter(sfmmup);
8497                         SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8498                         sfmmu_hat_exit(hatlockp);
8499                 }
8500                 break;
8501         default:
8502                 break;
8503         }
8504 
8505         /*
8506          * If we updated the ismblkpa for this HAT we must make
8507          * sure all CPUs running this process reload their tsbmiss area.
8508          * Otherwise they will fail to load the mappings in the tsbmiss
8509          * handler and will loop calling pagefault().
8510          */
8511         if (reload_mmu) {
8512                 hatlockp = sfmmu_hat_enter(sfmmup);
8513                 sfmmu_sync_mmustate(sfmmup);
8514                 sfmmu_hat_exit(hatlockp);
8515         }
8516 
8517         sfmmu_ismhat_exit(sfmmup, 0);
8518 
8519         /*
8520          * Free up ismblk if we didn't use it.
8521          */
8522         if (new_iblk != NULL)
8523                 kmem_cache_free(ism_blk_cache, new_iblk);
8524 
8525         /*
8526          * Check TSB and TLB page sizes.
8527          */
8528         if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8529                 sfmmu_check_page_sizes(sfmmup, 0);
8530         } else {
8531                 sfmmu_check_page_sizes(sfmmup, 1);
8532         }
8533         return (0);
8534 }
8535 
8536 /*
8537  * hat_unshare removes exactly one ism_map from
8538  * this process's as.  It expects multiple calls
8539  * to hat_unshare for multiple shm segments.
8540  */
8541 void
8542 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8543 {
8544         ism_map_t       *ism_map;
8545         ism_ment_t      *free_ment = NULL;
8546         ism_blk_t       *ism_blkp;
8547         struct hat      *ism_hatid;
8548         int             found, i;
8549         hatlock_t       *hatlockp;
8550         struct tsb_info *tsbinfo;
8551         uint_t          ismshift = page_get_shift(ismszc);
8552         size_t          sh_size = ISM_SHIFT(ismshift, len);
8553         uchar_t         ism_rid;
8554         sf_scd_t        *old_scdp;
8555 
8556         ASSERT(ISM_ALIGNED(ismshift, addr));
8557         ASSERT(ISM_ALIGNED(ismshift, len));
8558         ASSERT(sfmmup != NULL);
8559         ASSERT(sfmmup != ksfmmup);
8560 
8561         ASSERT(sfmmup->sfmmu_as != NULL);
8562 
8563         /*
8564          * Make sure that during the entire time ISM mappings are removed,
8565          * the trap handlers serialize behind us, and that no one else
8566          * can be mucking with ISM mappings.  This also lets us get away
8567          * with not doing expensive cross calls to flush the TLB -- we
8568          * just discard the context, flush the entire TSB, and call it
8569          * a day.
8570          */
8571         sfmmu_ismhat_enter(sfmmup, 0);
8572 
8573         /*
8574          * Remove the mapping.
8575          *
8576          * We can't have any holes in the ism map.
8577          * The tsb miss code while searching the ism map will
8578          * stop on an empty map slot.  So we must move
8579          * everyone past the hole up 1 if any.
8580          *
8581          * Also empty ism map blks are not freed until the
8582          * process exits. This is to prevent a MT race condition
8583          * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8584          */
8585         found = 0;
8586         ism_blkp = sfmmup->sfmmu_iblk;
8587         while (!found && ism_blkp != NULL) {
8588                 ism_map = ism_blkp->iblk_maps;
8589                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8590                         if (addr == ism_start(ism_map[i]) &&
8591                             sh_size == (size_t)(ism_size(ism_map[i]))) {
8592                                 found = 1;
8593                                 break;
8594                         }
8595                 }
8596                 if (!found)
8597                         ism_blkp = ism_blkp->iblk_next;
8598         }
8599 
8600         if (found) {
8601                 ism_hatid = ism_map[i].imap_ismhat;
8602                 ism_rid = ism_map[i].imap_rid;
8603                 ASSERT(ism_hatid != NULL);
8604                 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8605 
8606                 /*
8607                  * After hat_leave_region, the sfmmup may leave SCD,
8608                  * in which case, we want to grow the private tsb size when
8609                  * calling sfmmu_check_page_sizes at the end of the routine.
8610                  */
8611                 old_scdp = sfmmup->sfmmu_scdp;
8612                 /*
8613                  * Then remove ourselves from the region.
8614                  */
8615                 if (ism_rid != SFMMU_INVALID_ISMRID) {
8616                         hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8617                             HAT_REGION_ISM);
8618                 }
8619 
8620                 /*
8621                  * And now guarantee that any other cpu
8622                  * that tries to process an ISM miss
8623                  * will go to tl=0.
8624                  */
8625                 hatlockp = sfmmu_hat_enter(sfmmup);
8626                 sfmmu_invalidate_ctx(sfmmup);
8627                 sfmmu_hat_exit(hatlockp);
8628 
8629                 /*
8630                  * Remove ourselves from the ism mapping list.
8631                  */
8632                 mutex_enter(&ism_mlist_lock);
8633                 iment_sub(ism_map[i].imap_ment, ism_hatid);
8634                 mutex_exit(&ism_mlist_lock);
8635                 free_ment = ism_map[i].imap_ment;
8636 
8637                 /*
8638                  * We delete the ism map by copying
8639                  * the next map over the current one.
8640                  * We will take the next one in the maps
8641                  * array or from the next ism_blk.
8642                  */
8643                 while (ism_blkp != NULL) {
8644                         ism_map = ism_blkp->iblk_maps;
8645                         while (i < (ISM_MAP_SLOTS - 1)) {
8646                                 ism_map[i] = ism_map[i + 1];
8647                                 i++;
8648                         }
8649                         /* i == (ISM_MAP_SLOTS - 1) */
8650                         ism_blkp = ism_blkp->iblk_next;
8651                         if (ism_blkp != NULL) {
8652                                 ism_map[i] = ism_blkp->iblk_maps[0];
8653                                 i = 0;
8654                         } else {
8655                                 ism_map[i].imap_seg = 0;
8656                                 ism_map[i].imap_vb_shift = 0;
8657                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8658                                 ism_map[i].imap_hatflags = 0;
8659                                 ism_map[i].imap_sz_mask = 0;
8660                                 ism_map[i].imap_ismhat = NULL;
8661                                 ism_map[i].imap_ment = NULL;
8662                         }
8663                 }
8664 
8665                 /*
8666                  * Now flush entire TSB for the process, since
8667                  * demapping page by page can be too expensive.
8668                  * We don't have to flush the TLB here anymore
8669                  * since we switch to a new TLB ctx instead.
8670                  * Also, there is no need to flush if the process
8671                  * is exiting since the TSB will be freed later.
8672                  */
8673                 if (!sfmmup->sfmmu_free) {
8674                         hatlockp = sfmmu_hat_enter(sfmmup);
8675                         for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8676                             tsbinfo = tsbinfo->tsb_next) {
8677                                 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8678                                         continue;
8679                                 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8680                                         tsbinfo->tsb_flags |=
8681                                             TSB_FLUSH_NEEDED;
8682                                         continue;
8683                                 }
8684 
8685                                 sfmmu_inv_tsb(tsbinfo->tsb_va,
8686                                     TSB_BYTES(tsbinfo->tsb_szc));
8687                         }
8688                         sfmmu_hat_exit(hatlockp);
8689                 }
8690         }
8691 
8692         /*
8693          * Update our counters for this sfmmup's ism mappings.
8694          */
8695         for (i = 0; i <= ismszc; i++) {
8696                 if (!(disable_ism_large_pages & (1 << i)))
8697                         (void) ism_tsb_entries(sfmmup, i);
8698         }
8699 
8700         sfmmu_ismhat_exit(sfmmup, 0);
8701 
8702         /*
8703          * We must do our freeing here after dropping locks
8704          * to prevent a deadlock in the kmem allocator on the
8705          * mapping list lock.
8706          */
8707         if (free_ment != NULL)
8708                 kmem_cache_free(ism_ment_cache, free_ment);
8709 
8710         /*
8711          * Check TSB and TLB page sizes if the process isn't exiting.
8712          */
8713         if (!sfmmup->sfmmu_free) {
8714                 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
8715                         sfmmu_check_page_sizes(sfmmup, 1);
8716                 } else {
8717                         sfmmu_check_page_sizes(sfmmup, 0);
8718                 }
8719         }
8720 }
8721 
8722 /* ARGSUSED */
8723 static int
8724 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
8725 {
8726         /* void *buf is sfmmu_t pointer */
8727         bzero(buf, sizeof (sfmmu_t));
8728 
8729         return (0);
8730 }
8731 
8732 /* ARGSUSED */
8733 static void
8734 sfmmu_idcache_destructor(void *buf, void *cdrarg)
8735 {
8736         /* void *buf is sfmmu_t pointer */
8737 }
8738 
8739 /*
8740  * setup kmem hmeblks by bzeroing all members and initializing the nextpa
8741  * field to be the pa of this hmeblk
8742  */
8743 /* ARGSUSED */
8744 static int
8745 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
8746 {
8747         struct hme_blk *hmeblkp;
8748 
8749         bzero(buf, (size_t)cdrarg);
8750         hmeblkp = (struct hme_blk *)buf;
8751         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
8752 
8753 #ifdef  HBLK_TRACE
8754         mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
8755 #endif  /* HBLK_TRACE */
8756 
8757         return (0);
8758 }
8759 
8760 /* ARGSUSED */
8761 static void
8762 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
8763 {
8764 
8765 #ifdef  HBLK_TRACE
8766 
8767         struct hme_blk *hmeblkp;
8768 
8769         hmeblkp = (struct hme_blk *)buf;
8770         mutex_destroy(&hmeblkp->hblk_audit_lock);
8771 
8772 #endif  /* HBLK_TRACE */
8773 }
8774 
8775 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
8776 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
8777 /*
8778  * The kmem allocator will callback into our reclaim routine when the system
8779  * is running low in memory.  We traverse the hash and free up all unused but
8780  * still cached hme_blks.  We also traverse the free list and free them up
8781  * as well.
8782  */
8783 /*ARGSUSED*/
8784 static void
8785 sfmmu_hblkcache_reclaim(void *cdrarg)
8786 {
8787         int i;
8788         struct hmehash_bucket *hmebp;
8789         struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
8790         static struct hmehash_bucket *uhmehash_reclaim_hand;
8791         static struct hmehash_bucket *khmehash_reclaim_hand;
8792         struct hme_blk *list = NULL, *last_hmeblkp;
8793         cpuset_t cpuset = cpu_ready_set;
8794         cpu_hme_pend_t *cpuhp;
8795 
8796         /* Free up hmeblks on the cpu pending lists */
8797         for (i = 0; i < NCPU; i++) {
8798                 cpuhp = &cpu_hme_pend[i];
8799                 if (cpuhp->chp_listp != NULL)  {
8800                         mutex_enter(&cpuhp->chp_mutex);
8801                         if (cpuhp->chp_listp == NULL) {
8802                                 mutex_exit(&cpuhp->chp_mutex);
8803                                 continue;
8804                         }
8805                         for (last_hmeblkp = cpuhp->chp_listp;
8806                             last_hmeblkp->hblk_next != NULL;
8807                             last_hmeblkp = last_hmeblkp->hblk_next)
8808                                 ;
8809                         last_hmeblkp->hblk_next = list;
8810                         list = cpuhp->chp_listp;
8811                         cpuhp->chp_listp = NULL;
8812                         cpuhp->chp_count = 0;
8813                         mutex_exit(&cpuhp->chp_mutex);
8814                 }
8815 
8816         }
8817 
8818         if (list != NULL) {
8819                 kpreempt_disable();
8820                 CPUSET_DEL(cpuset, CPU->cpu_id);
8821                 xt_sync(cpuset);
8822                 xt_sync(cpuset);
8823                 kpreempt_enable();
8824                 sfmmu_hblk_free(&list);
8825                 list = NULL;
8826         }
8827 
8828         hmebp = uhmehash_reclaim_hand;
8829         if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
8830                 uhmehash_reclaim_hand = hmebp = uhme_hash;
8831         uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8832 
8833         for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8834                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8835                         hmeblkp = hmebp->hmeblkp;
8836                         pr_hblk = NULL;
8837                         while (hmeblkp) {
8838                                 nx_hblk = hmeblkp->hblk_next;
8839                                 if (!hmeblkp->hblk_vcnt &&
8840                                     !hmeblkp->hblk_hmecnt) {
8841                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8842                                             pr_hblk, &list, 0);
8843                                 } else {
8844                                         pr_hblk = hmeblkp;
8845                                 }
8846                                 hmeblkp = nx_hblk;
8847                         }
8848                         SFMMU_HASH_UNLOCK(hmebp);
8849                 }
8850                 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
8851                         hmebp = uhme_hash;
8852         }
8853 
8854         hmebp = khmehash_reclaim_hand;
8855         if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
8856                 khmehash_reclaim_hand = hmebp = khme_hash;
8857         khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8858 
8859         for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8860                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8861                         hmeblkp = hmebp->hmeblkp;
8862                         pr_hblk = NULL;
8863                         while (hmeblkp) {
8864                                 nx_hblk = hmeblkp->hblk_next;
8865                                 if (!hmeblkp->hblk_vcnt &&
8866                                     !hmeblkp->hblk_hmecnt) {
8867                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8868                                             pr_hblk, &list, 0);
8869                                 } else {
8870                                         pr_hblk = hmeblkp;
8871                                 }
8872                                 hmeblkp = nx_hblk;
8873                         }
8874                         SFMMU_HASH_UNLOCK(hmebp);
8875                 }
8876                 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
8877                         hmebp = khme_hash;
8878         }
8879         sfmmu_hblks_list_purge(&list, 0);
8880 }
8881 
8882 /*
8883  * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
8884  * same goes for sfmmu_get_addrvcolor().
8885  *
8886  * This function will return the virtual color for the specified page. The
8887  * virtual color corresponds to this page current mapping or its last mapping.
8888  * It is used by memory allocators to choose addresses with the correct
8889  * alignment so vac consistency is automatically maintained.  If the page
8890  * has no color it returns -1.
8891  */
8892 /*ARGSUSED*/
8893 int
8894 sfmmu_get_ppvcolor(struct page *pp)
8895 {
8896 #ifdef VAC
8897         int color;
8898 
8899         if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
8900                 return (-1);
8901         }
8902         color = PP_GET_VCOLOR(pp);
8903         ASSERT(color < mmu_btop(shm_alignment));
8904         return (color);
8905 #else
8906         return (-1);
8907 #endif  /* VAC */
8908 }
8909 
8910 /*
8911  * This function will return the desired alignment for vac consistency
8912  * (vac color) given a virtual address.  If no vac is present it returns -1.
8913  */
8914 /*ARGSUSED*/
8915 int
8916 sfmmu_get_addrvcolor(caddr_t vaddr)
8917 {
8918 #ifdef VAC
8919         if (cache & CACHE_VAC) {
8920                 return (addr_to_vcolor(vaddr));
8921         } else {
8922                 return (-1);
8923         }
8924 #else
8925         return (-1);
8926 #endif  /* VAC */
8927 }
8928 
8929 #ifdef VAC
8930 /*
8931  * Check for conflicts.
8932  * A conflict exists if the new and existent mappings do not match in
8933  * their "shm_alignment fields. If conflicts exist, the existant mappings
8934  * are flushed unless one of them is locked. If one of them is locked, then
8935  * the mappings are flushed and converted to non-cacheable mappings.
8936  */
8937 static void
8938 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
8939 {
8940         struct hat *tmphat;
8941         struct sf_hment *sfhmep, *tmphme = NULL;
8942         struct hme_blk *hmeblkp;
8943         int vcolor;
8944         tte_t tte;
8945 
8946         ASSERT(sfmmu_mlist_held(pp));
8947         ASSERT(!PP_ISNC(pp));           /* page better be cacheable */
8948 
8949         vcolor = addr_to_vcolor(addr);
8950         if (PP_NEWPAGE(pp)) {
8951                 PP_SET_VCOLOR(pp, vcolor);
8952                 return;
8953         }
8954 
8955         if (PP_GET_VCOLOR(pp) == vcolor) {
8956                 return;
8957         }
8958 
8959         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
8960                 /*
8961                  * Previous user of page had a different color
8962                  * but since there are no current users
8963                  * we just flush the cache and change the color.
8964                  */
8965                 SFMMU_STAT(sf_pgcolor_conflict);
8966                 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
8967                 PP_SET_VCOLOR(pp, vcolor);
8968                 return;
8969         }
8970 
8971         /*
8972          * If we get here we have a vac conflict with a current
8973          * mapping.  VAC conflict policy is as follows.
8974          * - The default is to unload the other mappings unless:
8975          * - If we have a large mapping we uncache the page.
8976          * We need to uncache the rest of the large page too.
8977          * - If any of the mappings are locked we uncache the page.
8978          * - If the requested mapping is inconsistent
8979          * with another mapping and that mapping
8980          * is in the same address space we have to
8981          * make it non-cached.  The default thing
8982          * to do is unload the inconsistent mapping
8983          * but if they are in the same address space
8984          * we run the risk of unmapping the pc or the
8985          * stack which we will use as we return to the user,
8986          * in which case we can then fault on the thing
8987          * we just unloaded and get into an infinite loop.
8988          */
8989         if (PP_ISMAPPED_LARGE(pp)) {
8990                 int sz;
8991 
8992                 /*
8993                  * Existing mapping is for big pages. We don't unload
8994                  * existing big mappings to satisfy new mappings.
8995                  * Always convert all mappings to TNC.
8996                  */
8997                 sz = fnd_mapping_sz(pp);
8998                 pp = PP_GROUPLEADER(pp, sz);
8999                 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9000                 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9001                     TTEPAGES(sz));
9002 
9003                 return;
9004         }
9005 
9006         /*
9007          * check if any mapping is in same as or if it is locked
9008          * since in that case we need to uncache.
9009          */
9010         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9011                 tmphme = sfhmep->hme_next;
9012                 if (IS_PAHME(sfhmep))
9013                         continue;
9014                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9015                 tmphat = hblktosfmmu(hmeblkp);
9016                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9017                 ASSERT(TTE_IS_VALID(&tte));
9018                 if (hmeblkp->hblk_shared || tmphat == hat ||
9019                     hmeblkp->hblk_lckcnt) {
9020                         /*
9021                          * We have an uncache conflict
9022                          */
9023                         SFMMU_STAT(sf_uncache_conflict);
9024                         sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9025                         return;
9026                 }
9027         }
9028 
9029         /*
9030          * We have an unload conflict
9031          * We have already checked for LARGE mappings, therefore
9032          * the remaining mapping(s) must be TTE8K.
9033          */
9034         SFMMU_STAT(sf_unload_conflict);
9035 
9036         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9037                 tmphme = sfhmep->hme_next;
9038                 if (IS_PAHME(sfhmep))
9039                         continue;
9040                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9041                 ASSERT(!hmeblkp->hblk_shared);
9042                 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9043         }
9044 
9045         if (PP_ISMAPPED_KPM(pp))
9046                 sfmmu_kpm_vac_unload(pp, addr);
9047 
9048         /*
9049          * Unloads only do TLB flushes so we need to flush the
9050          * cache here.
9051          */
9052         sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9053         PP_SET_VCOLOR(pp, vcolor);
9054 }
9055 
9056 /*
9057  * Whenever a mapping is unloaded and the page is in TNC state,
9058  * we see if the page can be made cacheable again. 'pp' is
9059  * the page that we just unloaded a mapping from, the size
9060  * of mapping that was unloaded is 'ottesz'.
9061  * Remark:
9062  * The recache policy for mpss pages can leave a performance problem
9063  * under the following circumstances:
9064  * . A large page in uncached mode has just been unmapped.
9065  * . All constituent pages are TNC due to a conflicting small mapping.
9066  * . There are many other, non conflicting, small mappings around for
9067  *   a lot of the constituent pages.
9068  * . We're called w/ the "old" groupleader page and the old ottesz,
9069  *   but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9070  *   we end up w/ TTE8K or npages == 1.
9071  * . We call tst_tnc w/ the old groupleader only, and if there is no
9072  *   conflict, we re-cache only this page.
9073  * . All other small mappings are not checked and will be left in TNC mode.
9074  * The problem is not very serious because:
9075  * . mpss is actually only defined for heap and stack, so the probability
9076  *   is not very high that a large page mapping exists in parallel to a small
9077  *   one (this is possible, but seems to be bad programming style in the
9078  *   appl).
9079  * . The problem gets a little bit more serious, when those TNC pages
9080  *   have to be mapped into kernel space, e.g. for networking.
9081  * . When VAC alias conflicts occur in applications, this is regarded
9082  *   as an application bug. So if kstat's show them, the appl should
9083  *   be changed anyway.
9084  */
9085 void
9086 conv_tnc(page_t *pp, int ottesz)
9087 {
9088         int cursz, dosz;
9089         pgcnt_t curnpgs, dopgs;
9090         pgcnt_t pg64k;
9091         page_t *pp2;
9092 
9093         /*
9094          * Determine how big a range we check for TNC and find
9095          * leader page. cursz is the size of the biggest
9096          * mapping that still exist on 'pp'.
9097          */
9098         if (PP_ISMAPPED_LARGE(pp)) {
9099                 cursz = fnd_mapping_sz(pp);
9100         } else {
9101                 cursz = TTE8K;
9102         }
9103 
9104         if (ottesz >= cursz) {
9105                 dosz = ottesz;
9106                 pp2 = pp;
9107         } else {
9108                 dosz = cursz;
9109                 pp2 = PP_GROUPLEADER(pp, dosz);
9110         }
9111 
9112         pg64k = TTEPAGES(TTE64K);
9113         dopgs = TTEPAGES(dosz);
9114 
9115         ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9116 
9117         while (dopgs != 0) {
9118                 curnpgs = TTEPAGES(cursz);
9119                 if (tst_tnc(pp2, curnpgs)) {
9120                         SFMMU_STAT_ADD(sf_recache, curnpgs);
9121                         sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9122                             curnpgs);
9123                 }
9124 
9125                 ASSERT(dopgs >= curnpgs);
9126                 dopgs -= curnpgs;
9127 
9128                 if (dopgs == 0) {
9129                         break;
9130                 }
9131 
9132                 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9133                 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9134                         cursz = fnd_mapping_sz(pp2);
9135                 } else {
9136                         cursz = TTE8K;
9137                 }
9138         }
9139 }
9140 
9141 /*
9142  * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9143  * returns 0 otherwise. Note that oaddr argument is valid for only
9144  * 8k pages.
9145  */
9146 int
9147 tst_tnc(page_t *pp, pgcnt_t npages)
9148 {
9149         struct  sf_hment *sfhme;
9150         struct  hme_blk *hmeblkp;
9151         tte_t   tte;
9152         caddr_t vaddr;
9153         int     clr_valid = 0;
9154         int     color, color1, bcolor;
9155         int     i, ncolors;
9156 
9157         ASSERT(pp != NULL);
9158         ASSERT(!(cache & CACHE_WRITEBACK));
9159 
9160         if (npages > 1) {
9161                 ncolors = CACHE_NUM_COLOR;
9162         }
9163 
9164         for (i = 0; i < npages; i++) {
9165                 ASSERT(sfmmu_mlist_held(pp));
9166                 ASSERT(PP_ISTNC(pp));
9167                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9168 
9169                 if (PP_ISPNC(pp)) {
9170                         return (0);
9171                 }
9172 
9173                 clr_valid = 0;
9174                 if (PP_ISMAPPED_KPM(pp)) {
9175                         caddr_t kpmvaddr;
9176 
9177                         ASSERT(kpm_enable);
9178                         kpmvaddr = hat_kpm_page2va(pp, 1);
9179                         ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9180                         color1 = addr_to_vcolor(kpmvaddr);
9181                         clr_valid = 1;
9182                 }
9183 
9184                 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9185                         if (IS_PAHME(sfhme))
9186                                 continue;
9187                         hmeblkp = sfmmu_hmetohblk(sfhme);
9188 
9189                         sfmmu_copytte(&sfhme->hme_tte, &tte);
9190                         ASSERT(TTE_IS_VALID(&tte));
9191 
9192                         vaddr = tte_to_vaddr(hmeblkp, tte);
9193                         color = addr_to_vcolor(vaddr);
9194 
9195                         if (npages > 1) {
9196                                 /*
9197                                  * If there is a big mapping, make sure
9198                                  * 8K mapping is consistent with the big
9199                                  * mapping.
9200                                  */
9201                                 bcolor = i % ncolors;
9202                                 if (color != bcolor) {
9203                                         return (0);
9204                                 }
9205                         }
9206                         if (!clr_valid) {
9207                                 clr_valid = 1;
9208                                 color1 = color;
9209                         }
9210 
9211                         if (color1 != color) {
9212                                 return (0);
9213                         }
9214                 }
9215 
9216                 pp = PP_PAGENEXT(pp);
9217         }
9218 
9219         return (1);
9220 }
9221 
9222 void
9223 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9224         pgcnt_t npages)
9225 {
9226         kmutex_t *pmtx;
9227         int i, ncolors, bcolor;
9228         kpm_hlk_t *kpmp;
9229         cpuset_t cpuset;
9230 
9231         ASSERT(pp != NULL);
9232         ASSERT(!(cache & CACHE_WRITEBACK));
9233 
9234         kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9235         pmtx = sfmmu_page_enter(pp);
9236 
9237         /*
9238          * Fast path caching single unmapped page
9239          */
9240         if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9241             flags == HAT_CACHE) {
9242                 PP_CLRTNC(pp);
9243                 PP_CLRPNC(pp);
9244                 sfmmu_page_exit(pmtx);
9245                 sfmmu_kpm_kpmp_exit(kpmp);
9246                 return;
9247         }
9248 
9249         /*
9250          * We need to capture all cpus in order to change cacheability
9251          * because we can't allow one cpu to access the same physical
9252          * page using a cacheable and a non-cachebale mapping at the same
9253          * time. Since we may end up walking the ism mapping list
9254          * have to grab it's lock now since we can't after all the
9255          * cpus have been captured.
9256          */
9257         sfmmu_hat_lock_all();
9258         mutex_enter(&ism_mlist_lock);
9259         kpreempt_disable();
9260         cpuset = cpu_ready_set;
9261         xc_attention(cpuset);
9262 
9263         if (npages > 1) {
9264                 /*
9265                  * Make sure all colors are flushed since the
9266                  * sfmmu_page_cache() only flushes one color-
9267                  * it does not know big pages.
9268                  */
9269                 ncolors = CACHE_NUM_COLOR;
9270                 if (flags & HAT_TMPNC) {
9271                         for (i = 0; i < ncolors; i++) {
9272                                 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9273                         }
9274                         cache_flush_flag = CACHE_NO_FLUSH;
9275                 }
9276         }
9277 
9278         for (i = 0; i < npages; i++) {
9279 
9280                 ASSERT(sfmmu_mlist_held(pp));
9281 
9282                 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9283 
9284                         if (npages > 1) {
9285                                 bcolor = i % ncolors;
9286                         } else {
9287                                 bcolor = NO_VCOLOR;
9288                         }
9289 
9290                         sfmmu_page_cache(pp, flags, cache_flush_flag,
9291                             bcolor);
9292                 }
9293 
9294                 pp = PP_PAGENEXT(pp);
9295         }
9296 
9297         xt_sync(cpuset);
9298         xc_dismissed(cpuset);
9299         mutex_exit(&ism_mlist_lock);
9300         sfmmu_hat_unlock_all();
9301         sfmmu_page_exit(pmtx);
9302         sfmmu_kpm_kpmp_exit(kpmp);
9303         kpreempt_enable();
9304 }
9305 
9306 /*
9307  * This function changes the virtual cacheability of all mappings to a
9308  * particular page.  When changing from uncache to cacheable the mappings will
9309  * only be changed if all of them have the same virtual color.
9310  * We need to flush the cache in all cpus.  It is possible that
9311  * a process referenced a page as cacheable but has sinced exited
9312  * and cleared the mapping list.  We still to flush it but have no
9313  * state so all cpus is the only alternative.
9314  */
9315 static void
9316 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9317 {
9318         struct  sf_hment *sfhme;
9319         struct  hme_blk *hmeblkp;
9320         sfmmu_t *sfmmup;
9321         tte_t   tte, ttemod;
9322         caddr_t vaddr;
9323         int     ret, color;
9324         pfn_t   pfn;
9325 
9326         color = bcolor;
9327         pfn = pp->p_pagenum;
9328 
9329         for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9330 
9331                 if (IS_PAHME(sfhme))
9332                         continue;
9333                 hmeblkp = sfmmu_hmetohblk(sfhme);
9334 
9335                 sfmmu_copytte(&sfhme->hme_tte, &tte);
9336                 ASSERT(TTE_IS_VALID(&tte));
9337                 vaddr = tte_to_vaddr(hmeblkp, tte);
9338                 color = addr_to_vcolor(vaddr);
9339 
9340 #ifdef DEBUG
9341                 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9342                         ASSERT(color == bcolor);
9343                 }
9344 #endif
9345 
9346                 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9347 
9348                 ttemod = tte;
9349                 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9350                         TTE_CLR_VCACHEABLE(&ttemod);
9351                 } else {        /* flags & HAT_CACHE */
9352                         TTE_SET_VCACHEABLE(&ttemod);
9353                 }
9354                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9355                 if (ret < 0) {
9356                         /*
9357                          * Since all cpus are captured modifytte should not
9358                          * fail.
9359                          */
9360                         panic("sfmmu_page_cache: write to tte failed");
9361                 }
9362 
9363                 sfmmup = hblktosfmmu(hmeblkp);
9364                 if (cache_flush_flag == CACHE_FLUSH) {
9365                         /*
9366                          * Flush TSBs, TLBs and caches
9367                          */
9368                         if (hmeblkp->hblk_shared) {
9369                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9370                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9371                                 sf_region_t *rgnp;
9372                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9373                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9374                                 ASSERT(srdp != NULL);
9375                                 rgnp = srdp->srd_hmergnp[rid];
9376                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9377                                     srdp, rgnp, rid);
9378                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9379                                     hmeblkp, 0);
9380                                 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9381                         } else if (sfmmup->sfmmu_ismhat) {
9382                                 if (flags & HAT_CACHE) {
9383                                         SFMMU_STAT(sf_ism_recache);
9384                                 } else {
9385                                         SFMMU_STAT(sf_ism_uncache);
9386                                 }
9387                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9388                                     pfn, CACHE_FLUSH);
9389                         } else {
9390                                 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9391                                     pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9392                         }
9393 
9394                         /*
9395                          * all cache entries belonging to this pfn are
9396                          * now flushed.
9397                          */
9398                         cache_flush_flag = CACHE_NO_FLUSH;
9399                 } else {
9400                         /*
9401                          * Flush only TSBs and TLBs.
9402                          */
9403                         if (hmeblkp->hblk_shared) {
9404                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9405                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9406                                 sf_region_t *rgnp;
9407                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9408                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9409                                 ASSERT(srdp != NULL);
9410                                 rgnp = srdp->srd_hmergnp[rid];
9411                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9412                                     srdp, rgnp, rid);
9413                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9414                                     hmeblkp, 0);
9415                         } else if (sfmmup->sfmmu_ismhat) {
9416                                 if (flags & HAT_CACHE) {
9417                                         SFMMU_STAT(sf_ism_recache);
9418                                 } else {
9419                                         SFMMU_STAT(sf_ism_uncache);
9420                                 }
9421                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9422                                     pfn, CACHE_NO_FLUSH);
9423                         } else {
9424                                 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9425                         }
9426                 }
9427         }
9428 
9429         if (PP_ISMAPPED_KPM(pp))
9430                 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9431 
9432         switch (flags) {
9433 
9434                 default:
9435                         panic("sfmmu_pagecache: unknown flags");
9436                         break;
9437 
9438                 case HAT_CACHE:
9439                         PP_CLRTNC(pp);
9440                         PP_CLRPNC(pp);
9441                         PP_SET_VCOLOR(pp, color);
9442                         break;
9443 
9444                 case HAT_TMPNC:
9445                         PP_SETTNC(pp);
9446                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9447                         break;
9448 
9449                 case HAT_UNCACHE:
9450                         PP_SETPNC(pp);
9451                         PP_CLRTNC(pp);
9452                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9453                         break;
9454         }
9455 }
9456 #endif  /* VAC */
9457 
9458 
9459 /*
9460  * Wrapper routine used to return a context.
9461  *
9462  * It's the responsibility of the caller to guarantee that the
9463  * process serializes on calls here by taking the HAT lock for
9464  * the hat.
9465  *
9466  */
9467 static void
9468 sfmmu_get_ctx(sfmmu_t *sfmmup)
9469 {
9470         mmu_ctx_t *mmu_ctxp;
9471         uint_t pstate_save;
9472         int ret;
9473 
9474         ASSERT(sfmmu_hat_lock_held(sfmmup));
9475         ASSERT(sfmmup != ksfmmup);
9476 
9477         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9478                 sfmmu_setup_tsbinfo(sfmmup);
9479                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9480         }
9481 
9482         kpreempt_disable();
9483 
9484         mmu_ctxp = CPU_MMU_CTXP(CPU);
9485         ASSERT(mmu_ctxp);
9486         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9487         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9488 
9489         /*
9490          * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9491          */
9492         if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9493                 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9494 
9495         /*
9496          * Let the MMU set up the page sizes to use for
9497          * this context in the TLB. Don't program 2nd dtlb for ism hat.
9498          */
9499         if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9500                 mmu_set_ctx_page_sizes(sfmmup);
9501         }
9502 
9503         /*
9504          * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9505          * interrupts disabled to prevent race condition with wrap-around
9506          * ctx invalidatation. In sun4v, ctx invalidation also involves
9507          * a HV call to set the number of TSBs to 0. If interrupts are not
9508          * disabled until after sfmmu_load_mmustate is complete TSBs may
9509          * become assigned to INVALID_CONTEXT. This is not allowed.
9510          */
9511         pstate_save = sfmmu_disable_intrs();
9512 
9513         if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9514             sfmmup->sfmmu_scdp != NULL) {
9515                 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9516                 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9517                 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9518                 /* debug purpose only */
9519                 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9520                     != INVALID_CONTEXT);
9521         }
9522         sfmmu_load_mmustate(sfmmup);
9523 
9524         sfmmu_enable_intrs(pstate_save);
9525 
9526         kpreempt_enable();
9527 }
9528 
9529 /*
9530  * When all cnums are used up in a MMU, cnum will wrap around to the
9531  * next generation and start from 2.
9532  */
9533 static void
9534 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9535 {
9536 
9537         /* caller must have disabled the preemption */
9538         ASSERT(curthread->t_preempt >= 1);
9539         ASSERT(mmu_ctxp != NULL);
9540 
9541         /* acquire Per-MMU (PM) spin lock */
9542         mutex_enter(&mmu_ctxp->mmu_lock);
9543 
9544         /* re-check to see if wrap-around is needed */
9545         if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9546                 goto done;
9547 
9548         SFMMU_MMU_STAT(mmu_wrap_around);
9549 
9550         /* update gnum */
9551         ASSERT(mmu_ctxp->mmu_gnum != 0);
9552         mmu_ctxp->mmu_gnum++;
9553         if (mmu_ctxp->mmu_gnum == 0 ||
9554             mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9555                 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9556                     (void *)mmu_ctxp);
9557         }
9558 
9559         if (mmu_ctxp->mmu_ncpus > 1) {
9560                 cpuset_t cpuset;
9561 
9562                 membar_enter(); /* make sure updated gnum visible */
9563 
9564                 SFMMU_XCALL_STATS(NULL);
9565 
9566                 /* xcall to others on the same MMU to invalidate ctx */
9567                 cpuset = mmu_ctxp->mmu_cpuset;
9568                 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9569                 CPUSET_DEL(cpuset, CPU->cpu_id);
9570                 CPUSET_AND(cpuset, cpu_ready_set);
9571 
9572                 /*
9573                  * Pass in INVALID_CONTEXT as the first parameter to
9574                  * sfmmu_raise_tsb_exception, which invalidates the context
9575                  * of any process running on the CPUs in the MMU.
9576                  */
9577                 xt_some(cpuset, sfmmu_raise_tsb_exception,
9578                     INVALID_CONTEXT, INVALID_CONTEXT);
9579                 xt_sync(cpuset);
9580 
9581                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9582         }
9583 
9584         if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9585                 sfmmu_setctx_sec(INVALID_CONTEXT);
9586                 sfmmu_clear_utsbinfo();
9587         }
9588 
9589         /*
9590          * No xcall is needed here. For sun4u systems all CPUs in context
9591          * domain share a single physical MMU therefore it's enough to flush
9592          * TLB on local CPU. On sun4v systems we use 1 global context
9593          * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9594          * handler. Note that vtag_flushall_uctxs() is called
9595          * for Ultra II machine, where the equivalent flushall functionality
9596          * is implemented in SW, and only user ctx TLB entries are flushed.
9597          */
9598         if (&vtag_flushall_uctxs != NULL) {
9599                 vtag_flushall_uctxs();
9600         } else {
9601                 vtag_flushall();
9602         }
9603 
9604         /* reset mmu cnum, skips cnum 0 and 1 */
9605         if (reset_cnum == B_TRUE)
9606                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9607 
9608 done:
9609         mutex_exit(&mmu_ctxp->mmu_lock);
9610 }
9611 
9612 
9613 /*
9614  * For multi-threaded process, set the process context to INVALID_CONTEXT
9615  * so that it faults and reloads the MMU state from TL=0. For single-threaded
9616  * process, we can just load the MMU state directly without having to
9617  * set context invalid. Caller must hold the hat lock since we don't
9618  * acquire it here.
9619  */
9620 static void
9621 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9622 {
9623         uint_t cnum;
9624         uint_t pstate_save;
9625 
9626         ASSERT(sfmmup != ksfmmup);
9627         ASSERT(sfmmu_hat_lock_held(sfmmup));
9628 
9629         kpreempt_disable();
9630 
9631         /*
9632          * We check whether the pass'ed-in sfmmup is the same as the
9633          * current running proc. This is to makes sure the current proc
9634          * stays single-threaded if it already is.
9635          */
9636         if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9637             (curthread->t_procp->p_lwpcnt == 1)) {
9638                 /* single-thread */
9639                 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9640                 if (cnum != INVALID_CONTEXT) {
9641                         uint_t curcnum;
9642                         /*
9643                          * Disable interrupts to prevent race condition
9644                          * with sfmmu_ctx_wrap_around ctx invalidation.
9645                          * In sun4v, ctx invalidation involves setting
9646                          * TSB to NULL, hence, interrupts should be disabled
9647                          * untill after sfmmu_load_mmustate is completed.
9648                          */
9649                         pstate_save = sfmmu_disable_intrs();
9650                         curcnum = sfmmu_getctx_sec();
9651                         if (curcnum == cnum)
9652                                 sfmmu_load_mmustate(sfmmup);
9653                         sfmmu_enable_intrs(pstate_save);
9654                         ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9655                 }
9656         } else {
9657                 /*
9658                  * multi-thread
9659                  * or when sfmmup is not the same as the curproc.
9660                  */
9661                 sfmmu_invalidate_ctx(sfmmup);
9662         }
9663 
9664         kpreempt_enable();
9665 }
9666 
9667 
9668 /*
9669  * Replace the specified TSB with a new TSB.  This function gets called when
9670  * we grow, or shrink a TSB.  When swapping in a TSB (TSB_SWAPIN), the
9671  * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9672  * (8K).
9673  *
9674  * Caller must hold the HAT lock, but should assume any tsb_info
9675  * pointers it has are no longer valid after calling this function.
9676  *
9677  * Return values:
9678  *      TSB_ALLOCFAIL   Failed to allocate a TSB, due to memory constraints
9679  *      TSB_LOSTRACE    HAT is busy, i.e. another thread is already doing
9680  *                      something to this tsbinfo/TSB
9681  *      TSB_SUCCESS     Operation succeeded
9682  */
9683 static tsb_replace_rc_t
9684 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
9685     hatlock_t *hatlockp, uint_t flags)
9686 {
9687         struct tsb_info *new_tsbinfo = NULL;
9688         struct tsb_info *curtsb, *prevtsb;
9689         uint_t tte_sz_mask;
9690         int i;
9691 
9692         ASSERT(sfmmup != ksfmmup);
9693         ASSERT(sfmmup->sfmmu_ismhat == 0);
9694         ASSERT(sfmmu_hat_lock_held(sfmmup));
9695         ASSERT(szc <= tsb_max_growsize);
9696 
9697         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
9698                 return (TSB_LOSTRACE);
9699 
9700         /*
9701          * Find the tsb_info ahead of this one in the list, and
9702          * also make sure that the tsb_info passed in really
9703          * exists!
9704          */
9705         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9706             curtsb != old_tsbinfo && curtsb != NULL;
9707             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9708                 ;
9709         ASSERT(curtsb != NULL);
9710 
9711         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9712                 /*
9713                  * The process is swapped out, so just set the new size
9714                  * code.  When it swaps back in, we'll allocate a new one
9715                  * of the new chosen size.
9716                  */
9717                 curtsb->tsb_szc = szc;
9718                 return (TSB_SUCCESS);
9719         }
9720         SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
9721 
9722         tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
9723 
9724         /*
9725          * All initialization is done inside of sfmmu_tsbinfo_alloc().
9726          * If we fail to allocate a TSB, exit.
9727          *
9728          * If tsb grows with new tsb size > 4M and old tsb size < 4M,
9729          * then try 4M slab after the initial alloc fails.
9730          *
9731          * If tsb swapin with tsb size > 4M, then try 4M after the
9732          * initial alloc fails.
9733          */
9734         sfmmu_hat_exit(hatlockp);
9735         if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
9736             tte_sz_mask, flags, sfmmup) &&
9737             (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
9738             (!(flags & TSB_SWAPIN) &&
9739             (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
9740             sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
9741             tte_sz_mask, flags, sfmmup))) {
9742                 (void) sfmmu_hat_enter(sfmmup);
9743                 if (!(flags & TSB_SWAPIN))
9744                         SFMMU_STAT(sf_tsb_resize_failures);
9745                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9746                 return (TSB_ALLOCFAIL);
9747         }
9748         (void) sfmmu_hat_enter(sfmmup);
9749 
9750         /*
9751          * Re-check to make sure somebody else didn't muck with us while we
9752          * didn't hold the HAT lock.  If the process swapped out, fine, just
9753          * exit; this can happen if we try to shrink the TSB from the context
9754          * of another process (such as on an ISM unmap), though it is rare.
9755          */
9756         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9757                 SFMMU_STAT(sf_tsb_resize_failures);
9758                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9759                 sfmmu_hat_exit(hatlockp);
9760                 sfmmu_tsbinfo_free(new_tsbinfo);
9761                 (void) sfmmu_hat_enter(sfmmup);
9762                 return (TSB_LOSTRACE);
9763         }
9764 
9765 #ifdef  DEBUG
9766         /* Reverify that the tsb_info still exists.. for debugging only */
9767         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9768             curtsb != old_tsbinfo && curtsb != NULL;
9769             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9770                 ;
9771         ASSERT(curtsb != NULL);
9772 #endif  /* DEBUG */
9773 
9774         /*
9775          * Quiesce any CPUs running this process on their next TLB miss
9776          * so they atomically see the new tsb_info.  We temporarily set the
9777          * context to invalid context so new threads that come on processor
9778          * after we do the xcall to cpusran will also serialize behind the
9779          * HAT lock on TLB miss and will see the new TSB.  Since this short
9780          * race with a new thread coming on processor is relatively rare,
9781          * this synchronization mechanism should be cheaper than always
9782          * pausing all CPUs for the duration of the setup, which is what
9783          * the old implementation did.  This is particuarly true if we are
9784          * copying a huge chunk of memory around during that window.
9785          *
9786          * The memory barriers are to make sure things stay consistent
9787          * with resume() since it does not hold the HAT lock while
9788          * walking the list of tsb_info structures.
9789          */
9790         if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
9791                 /* The TSB is either growing or shrinking. */
9792                 sfmmu_invalidate_ctx(sfmmup);
9793         } else {
9794                 /*
9795                  * It is illegal to swap in TSBs from a process other
9796                  * than a process being swapped in.  This in turn
9797                  * implies we do not have a valid MMU context here
9798                  * since a process needs one to resolve translation
9799                  * misses.
9800                  */
9801                 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
9802         }
9803 
9804 #ifdef DEBUG
9805         ASSERT(max_mmu_ctxdoms > 0);
9806 
9807         /*
9808          * Process should have INVALID_CONTEXT on all MMUs
9809          */
9810         for (i = 0; i < max_mmu_ctxdoms; i++) {
9811 
9812                 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
9813         }
9814 #endif
9815 
9816         new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
9817         membar_stst();  /* strict ordering required */
9818         if (prevtsb)
9819                 prevtsb->tsb_next = new_tsbinfo;
9820         else
9821                 sfmmup->sfmmu_tsb = new_tsbinfo;
9822         membar_enter(); /* make sure new TSB globally visible */
9823 
9824         /*
9825          * We need to migrate TSB entries from the old TSB to the new TSB
9826          * if tsb_remap_ttes is set and the TSB is growing.
9827          */
9828         if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
9829                 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
9830 
9831         SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9832 
9833         /*
9834          * Drop the HAT lock to free our old tsb_info.
9835          */
9836         sfmmu_hat_exit(hatlockp);
9837 
9838         if ((flags & TSB_GROW) == TSB_GROW) {
9839                 SFMMU_STAT(sf_tsb_grow);
9840         } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
9841                 SFMMU_STAT(sf_tsb_shrink);
9842         }
9843 
9844         sfmmu_tsbinfo_free(old_tsbinfo);
9845 
9846         (void) sfmmu_hat_enter(sfmmup);
9847         return (TSB_SUCCESS);
9848 }
9849 
9850 /*
9851  * This function will re-program hat pgsz array, and invalidate the
9852  * process' context, forcing the process to switch to another
9853  * context on the next TLB miss, and therefore start using the
9854  * TLB that is reprogrammed for the new page sizes.
9855  */
9856 void
9857 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
9858 {
9859         int i;
9860         hatlock_t *hatlockp = NULL;
9861 
9862         hatlockp = sfmmu_hat_enter(sfmmup);
9863         /* USIII+-IV+ optimization, requires hat lock */
9864         if (tmp_pgsz) {
9865                 for (i = 0; i < mmu_page_sizes; i++)
9866                         sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
9867         }
9868         SFMMU_STAT(sf_tlb_reprog_pgsz);
9869 
9870         sfmmu_invalidate_ctx(sfmmup);
9871 
9872         sfmmu_hat_exit(hatlockp);
9873 }
9874 
9875 /*
9876  * The scd_rttecnt field in the SCD must be updated to take account of the
9877  * regions which it contains.
9878  */
9879 static void
9880 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
9881 {
9882         uint_t rid;
9883         uint_t i, j;
9884         ulong_t w;
9885         sf_region_t *rgnp;
9886 
9887         ASSERT(srdp != NULL);
9888 
9889         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
9890                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
9891                         continue;
9892                 }
9893 
9894                 j = 0;
9895                 while (w) {
9896                         if (!(w & 0x1)) {
9897                                 j++;
9898                                 w >>= 1;
9899                                 continue;
9900                         }
9901                         rid = (i << BT_ULSHIFT) | j;
9902                         j++;
9903                         w >>= 1;
9904 
9905                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9906                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9907                         rgnp = srdp->srd_hmergnp[rid];
9908                         ASSERT(rgnp->rgn_refcnt > 0);
9909                         ASSERT(rgnp->rgn_id == rid);
9910 
9911                         scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
9912                             rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
9913 
9914                         /*
9915                          * Maintain the tsb0 inflation cnt for the regions
9916                          * in the SCD.
9917                          */
9918                         if (rgnp->rgn_pgszc >= TTE4M) {
9919                                 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
9920                                     rgnp->rgn_size >>
9921                                     (TTE_PAGE_SHIFT(TTE8K) + 2);
9922                         }
9923                 }
9924         }
9925 }
9926 
9927 /*
9928  * This function assumes that there are either four or six supported page
9929  * sizes and at most two programmable TLBs, so we need to decide which
9930  * page sizes are most important and then tell the MMU layer so it
9931  * can adjust the TLB page sizes accordingly (if supported).
9932  *
9933  * If these assumptions change, this function will need to be
9934  * updated to support whatever the new limits are.
9935  *
9936  * The growing flag is nonzero if we are growing the address space,
9937  * and zero if it is shrinking.  This allows us to decide whether
9938  * to grow or shrink our TSB, depending upon available memory
9939  * conditions.
9940  */
9941 static void
9942 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
9943 {
9944         uint64_t ttecnt[MMU_PAGE_SIZES];
9945         uint64_t tte8k_cnt, tte4m_cnt;
9946         uint8_t i;
9947         int sectsb_thresh;
9948 
9949         /*
9950          * Kernel threads, processes with small address spaces not using
9951          * large pages, and dummy ISM HATs need not apply.
9952          */
9953         if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
9954                 return;
9955 
9956         if (!SFMMU_LGPGS_INUSE(sfmmup) &&
9957             sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
9958                 return;
9959 
9960         for (i = 0; i < mmu_page_sizes; i++) {
9961                 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
9962                     sfmmup->sfmmu_ismttecnt[i];
9963         }
9964 
9965         /* Check pagesizes in use, and possibly reprogram DTLB. */
9966         if (&mmu_check_page_sizes)
9967                 mmu_check_page_sizes(sfmmup, ttecnt);
9968 
9969         /*
9970          * Calculate the number of 8k ttes to represent the span of these
9971          * pages.
9972          */
9973         tte8k_cnt = ttecnt[TTE8K] +
9974             (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
9975             (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
9976         if (mmu_page_sizes == max_mmu_page_sizes) {
9977                 tte4m_cnt = ttecnt[TTE4M] +
9978                     (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
9979                     (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
9980         } else {
9981                 tte4m_cnt = ttecnt[TTE4M];
9982         }
9983 
9984         /*
9985          * Inflate tte8k_cnt to allow for region large page allocation failure.
9986          */
9987         tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
9988 
9989         /*
9990          * Inflate TSB sizes by a factor of 2 if this process
9991          * uses 4M text pages to minimize extra conflict misses
9992          * in the first TSB since without counting text pages
9993          * 8K TSB may become too small.
9994          *
9995          * Also double the size of the second TSB to minimize
9996          * extra conflict misses due to competition between 4M text pages
9997          * and data pages.
9998          *
9999          * We need to adjust the second TSB allocation threshold by the
10000          * inflation factor, since there is no point in creating a second
10001          * TSB when we know all the mappings can fit in the I/D TLBs.
10002          */
10003         sectsb_thresh = tsb_sectsb_threshold;
10004         if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10005                 tte8k_cnt <<= 1;
10006                 tte4m_cnt <<= 1;
10007                 sectsb_thresh <<= 1;
10008         }
10009 
10010         /*
10011          * Check to see if our TSB is the right size; we may need to
10012          * grow or shrink it.  If the process is small, our work is
10013          * finished at this point.
10014          */
10015         if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10016                 return;
10017         }
10018         sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10019 }
10020 
10021 static void
10022 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10023         uint64_t tte4m_cnt, int sectsb_thresh)
10024 {
10025         int tsb_bits;
10026         uint_t tsb_szc;
10027         struct tsb_info *tsbinfop;
10028         hatlock_t *hatlockp = NULL;
10029 
10030         hatlockp = sfmmu_hat_enter(sfmmup);
10031         ASSERT(hatlockp != NULL);
10032         tsbinfop = sfmmup->sfmmu_tsb;
10033         ASSERT(tsbinfop != NULL);
10034 
10035         /*
10036          * If we're growing, select the size based on RSS.  If we're
10037          * shrinking, leave some room so we don't have to turn around and
10038          * grow again immediately.
10039          */
10040         if (growing)
10041                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10042         else
10043                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10044 
10045         if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10046             (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10047                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10048                     hatlockp, TSB_SHRINK);
10049         } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10050                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10051                     hatlockp, TSB_GROW);
10052         }
10053         tsbinfop = sfmmup->sfmmu_tsb;
10054 
10055         /*
10056          * With the TLB and first TSB out of the way, we need to see if
10057          * we need a second TSB for 4M pages.  If we managed to reprogram
10058          * the TLB page sizes above, the process will start using this new
10059          * TSB right away; otherwise, it will start using it on the next
10060          * context switch.  Either way, it's no big deal so there's no
10061          * synchronization with the trap handlers here unless we grow the
10062          * TSB (in which case it's required to prevent using the old one
10063          * after it's freed). Note: second tsb is required for 32M/256M
10064          * page sizes.
10065          */
10066         if (tte4m_cnt > sectsb_thresh) {
10067                 /*
10068                  * If we're growing, select the size based on RSS.  If we're
10069                  * shrinking, leave some room so we don't have to turn
10070                  * around and grow again immediately.
10071                  */
10072                 if (growing)
10073                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10074                 else
10075                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10076                 if (tsbinfop->tsb_next == NULL) {
10077                         struct tsb_info *newtsb;
10078                         int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10079                             0 : TSB_ALLOC;
10080 
10081                         sfmmu_hat_exit(hatlockp);
10082 
10083                         /*
10084                          * Try to allocate a TSB for 4[32|256]M pages.  If we
10085                          * can't get the size we want, retry w/a minimum sized
10086                          * TSB.  If that still didn't work, give up; we can
10087                          * still run without one.
10088                          */
10089                         tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10090                             TSB4M|TSB32M|TSB256M:TSB4M;
10091                         if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10092                             allocflags, sfmmup)) &&
10093                             (tsb_szc <= TSB_4M_SZCODE ||
10094                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10095                             tsb_bits, allocflags, sfmmup)) &&
10096                             sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10097                             tsb_bits, allocflags, sfmmup)) {
10098                                 return;
10099                         }
10100 
10101                         hatlockp = sfmmu_hat_enter(sfmmup);
10102 
10103                         sfmmu_invalidate_ctx(sfmmup);
10104 
10105                         if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10106                                 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10107                                 SFMMU_STAT(sf_tsb_sectsb_create);
10108                                 sfmmu_hat_exit(hatlockp);
10109                                 return;
10110                         } else {
10111                                 /*
10112                                  * It's annoying, but possible for us
10113                                  * to get here.. we dropped the HAT lock
10114                                  * because of locking order in the kmem
10115                                  * allocator, and while we were off getting
10116                                  * our memory, some other thread decided to
10117                                  * do us a favor and won the race to get a
10118                                  * second TSB for this process.  Sigh.
10119                                  */
10120                                 sfmmu_hat_exit(hatlockp);
10121                                 sfmmu_tsbinfo_free(newtsb);
10122                                 return;
10123                         }
10124                 }
10125 
10126                 /*
10127                  * We have a second TSB, see if it's big enough.
10128                  */
10129                 tsbinfop = tsbinfop->tsb_next;
10130 
10131                 /*
10132                  * Check to see if our second TSB is the right size;
10133                  * we may need to grow or shrink it.
10134                  * To prevent thrashing (e.g. growing the TSB on a
10135                  * subsequent map operation), only try to shrink if
10136                  * the TSB reach exceeds twice the virtual address
10137                  * space size.
10138                  */
10139                 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10140                     (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10141                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10142                             tsb_szc, hatlockp, TSB_SHRINK);
10143                 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10144                     TSB_OK_GROW()) {
10145                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10146                             tsb_szc, hatlockp, TSB_GROW);
10147                 }
10148         }
10149 
10150         sfmmu_hat_exit(hatlockp);
10151 }
10152 
10153 /*
10154  * Free up a sfmmu
10155  * Since the sfmmu is currently embedded in the hat struct we simply zero
10156  * out our fields and free up the ism map blk list if any.
10157  */
10158 static void
10159 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10160 {
10161         ism_blk_t       *blkp, *nx_blkp;
10162 #ifdef  DEBUG
10163         ism_map_t       *map;
10164         int             i;
10165 #endif
10166 
10167         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10168         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10169         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10170         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10171         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10172         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10173         ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10174 
10175         sfmmup->sfmmu_free = 0;
10176         sfmmup->sfmmu_ismhat = 0;
10177 
10178         blkp = sfmmup->sfmmu_iblk;
10179         sfmmup->sfmmu_iblk = NULL;
10180 
10181         while (blkp) {
10182 #ifdef  DEBUG
10183                 map = blkp->iblk_maps;
10184                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10185                         ASSERT(map[i].imap_seg == 0);
10186                         ASSERT(map[i].imap_ismhat == NULL);
10187                         ASSERT(map[i].imap_ment == NULL);
10188                 }
10189 #endif
10190                 nx_blkp = blkp->iblk_next;
10191                 blkp->iblk_next = NULL;
10192                 blkp->iblk_nextpa = (uint64_t)-1;
10193                 kmem_cache_free(ism_blk_cache, blkp);
10194                 blkp = nx_blkp;
10195         }
10196 }
10197 
10198 /*
10199  * Locking primitves accessed by HATLOCK macros
10200  */
10201 
10202 #define SFMMU_SPL_MTX   (0x0)
10203 #define SFMMU_ML_MTX    (0x1)
10204 
10205 #define SFMMU_MLSPL_MTX(type, pg)       (((type) == SFMMU_SPL_MTX) ? \
10206                                             SPL_HASH(pg) : MLIST_HASH(pg))
10207 
10208 kmutex_t *
10209 sfmmu_page_enter(struct page *pp)
10210 {
10211         return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10212 }
10213 
10214 void
10215 sfmmu_page_exit(kmutex_t *spl)
10216 {
10217         mutex_exit(spl);
10218 }
10219 
10220 int
10221 sfmmu_page_spl_held(struct page *pp)
10222 {
10223         return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10224 }
10225 
10226 kmutex_t *
10227 sfmmu_mlist_enter(struct page *pp)
10228 {
10229         return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10230 }
10231 
10232 void
10233 sfmmu_mlist_exit(kmutex_t *mml)
10234 {
10235         mutex_exit(mml);
10236 }
10237 
10238 int
10239 sfmmu_mlist_held(struct page *pp)
10240 {
10241 
10242         return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10243 }
10244 
10245 /*
10246  * Common code for sfmmu_mlist_enter() and sfmmu_page_enter().  For
10247  * sfmmu_mlist_enter() case mml_table lock array is used and for
10248  * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10249  *
10250  * The lock is taken on a root page so that it protects an operation on all
10251  * constituent pages of a large page pp belongs to.
10252  *
10253  * The routine takes a lock from the appropriate array. The lock is determined
10254  * by hashing the root page. After taking the lock this routine checks if the
10255  * root page has the same size code that was used to determine the root (i.e
10256  * that root hasn't changed).  If root page has the expected p_szc field we
10257  * have the right lock and it's returned to the caller. If root's p_szc
10258  * decreased we release the lock and retry from the beginning.  This case can
10259  * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10260  * value and taking the lock. The number of retries due to p_szc decrease is
10261  * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10262  * determined by hashing pp itself.
10263  *
10264  * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10265  * possible that p_szc can increase. To increase p_szc a thread has to lock
10266  * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10267  * callers that don't hold a page locked recheck if hmeblk through which pp
10268  * was found still maps this pp.  If it doesn't map it anymore returned lock
10269  * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10270  * p_szc increase after taking the lock it returns this lock without further
10271  * retries because in this case the caller doesn't care about which lock was
10272  * taken. The caller will drop it right away.
10273  *
10274  * After the routine returns it's guaranteed that hat_page_demote() can't
10275  * change p_szc field of any of constituent pages of a large page pp belongs
10276  * to as long as pp was either locked at least SHARED prior to this call or
10277  * the caller finds that hment that pointed to this pp still references this
10278  * pp (this also assumes that the caller holds hme hash bucket lock so that
10279  * the same pp can't be remapped into the same hmeblk after it was unmapped by
10280  * hat_pageunload()).
10281  */
10282 static kmutex_t *
10283 sfmmu_mlspl_enter(struct page *pp, int type)
10284 {
10285         kmutex_t        *mtx;
10286         uint_t          prev_rszc = UINT_MAX;
10287         page_t          *rootpp;
10288         uint_t          szc;
10289         uint_t          rszc;
10290         uint_t          pszc = pp->p_szc;
10291 
10292         ASSERT(pp != NULL);
10293 
10294 again:
10295         if (pszc == 0) {
10296                 mtx = SFMMU_MLSPL_MTX(type, pp);
10297                 mutex_enter(mtx);
10298                 return (mtx);
10299         }
10300 
10301         /* The lock lives in the root page */
10302         rootpp = PP_GROUPLEADER(pp, pszc);
10303         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10304         mutex_enter(mtx);
10305 
10306         /*
10307          * Return mml in the following 3 cases:
10308          *
10309          * 1) If pp itself is root since if its p_szc decreased before we took
10310          * the lock pp is still the root of smaller szc page. And if its p_szc
10311          * increased it doesn't matter what lock we return (see comment in
10312          * front of this routine).
10313          *
10314          * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10315          * large page we have the right lock since any previous potential
10316          * hat_page_demote() is done demoting from greater than current root's
10317          * p_szc because hat_page_demote() changes root's p_szc last. No
10318          * further hat_page_demote() can start or be in progress since it
10319          * would need the same lock we currently hold.
10320          *
10321          * 3) If rootpp's p_szc increased since previous iteration it doesn't
10322          * matter what lock we return (see comment in front of this routine).
10323          */
10324         if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10325             rszc >= prev_rszc) {
10326                 return (mtx);
10327         }
10328 
10329         /*
10330          * hat_page_demote() could have decreased root's p_szc.
10331          * In this case pp's p_szc must also be smaller than pszc.
10332          * Retry.
10333          */
10334         if (rszc < pszc) {
10335                 szc = pp->p_szc;
10336                 if (szc < pszc) {
10337                         mutex_exit(mtx);
10338                         pszc = szc;
10339                         goto again;
10340                 }
10341                 /*
10342                  * pp's p_szc increased after it was decreased.
10343                  * page cannot be mapped. Return current lock. The caller
10344                  * will drop it right away.
10345                  */
10346                 return (mtx);
10347         }
10348 
10349         /*
10350          * root's p_szc is greater than pp's p_szc.
10351          * hat_page_demote() is not done with all pages
10352          * yet. Wait for it to complete.
10353          */
10354         mutex_exit(mtx);
10355         rootpp = PP_GROUPLEADER(rootpp, rszc);
10356         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10357         mutex_enter(mtx);
10358         mutex_exit(mtx);
10359         prev_rszc = rszc;
10360         goto again;
10361 }
10362 
10363 static int
10364 sfmmu_mlspl_held(struct page *pp, int type)
10365 {
10366         kmutex_t        *mtx;
10367 
10368         ASSERT(pp != NULL);
10369         /* The lock lives in the root page */
10370         pp = PP_PAGEROOT(pp);
10371         ASSERT(pp != NULL);
10372 
10373         mtx = SFMMU_MLSPL_MTX(type, pp);
10374         return (MUTEX_HELD(mtx));
10375 }
10376 
10377 static uint_t
10378 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10379 {
10380         struct  hme_blk *hblkp;
10381 
10382 
10383         if (freehblkp != NULL) {
10384                 mutex_enter(&freehblkp_lock);
10385                 if (freehblkp != NULL) {
10386                         /*
10387                          * If the current thread is owning hblk_reserve OR
10388                          * critical request from sfmmu_hblk_steal()
10389                          * let it succeed even if freehblkcnt is really low.
10390                          */
10391                         if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10392                                 SFMMU_STAT(sf_get_free_throttle);
10393                                 mutex_exit(&freehblkp_lock);
10394                                 return (0);
10395                         }
10396                         freehblkcnt--;
10397                         *hmeblkpp = freehblkp;
10398                         hblkp = *hmeblkpp;
10399                         freehblkp = hblkp->hblk_next;
10400                         mutex_exit(&freehblkp_lock);
10401                         hblkp->hblk_next = NULL;
10402                         SFMMU_STAT(sf_get_free_success);
10403 
10404                         ASSERT(hblkp->hblk_hmecnt == 0);
10405                         ASSERT(hblkp->hblk_vcnt == 0);
10406                         ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10407 
10408                         return (1);
10409                 }
10410                 mutex_exit(&freehblkp_lock);
10411         }
10412 
10413         /* Check cpu hblk pending queues */
10414         if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10415                 hblkp = *hmeblkpp;
10416                 hblkp->hblk_next = NULL;
10417                 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10418 
10419                 ASSERT(hblkp->hblk_hmecnt == 0);
10420                 ASSERT(hblkp->hblk_vcnt == 0);
10421 
10422                 return (1);
10423         }
10424 
10425         SFMMU_STAT(sf_get_free_fail);
10426         return (0);
10427 }
10428 
10429 static uint_t
10430 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10431 {
10432         struct  hme_blk *hblkp;
10433 
10434         ASSERT(hmeblkp->hblk_hmecnt == 0);
10435         ASSERT(hmeblkp->hblk_vcnt == 0);
10436         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10437 
10438         /*
10439          * If the current thread is mapping into kernel space,
10440          * let it succede even if freehblkcnt is max
10441          * so that it will avoid freeing it to kmem.
10442          * This will prevent stack overflow due to
10443          * possible recursion since kmem_cache_free()
10444          * might require creation of a slab which
10445          * in turn needs an hmeblk to map that slab;
10446          * let's break this vicious chain at the first
10447          * opportunity.
10448          */
10449         if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10450                 mutex_enter(&freehblkp_lock);
10451                 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10452                         SFMMU_STAT(sf_put_free_success);
10453                         freehblkcnt++;
10454                         hmeblkp->hblk_next = freehblkp;
10455                         freehblkp = hmeblkp;
10456                         mutex_exit(&freehblkp_lock);
10457                         return (1);
10458                 }
10459                 mutex_exit(&freehblkp_lock);
10460         }
10461 
10462         /*
10463          * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10464          * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10465          * we are not in the process of mapping into kernel space.
10466          */
10467         ASSERT(!critical);
10468         while (freehblkcnt > HBLK_RESERVE_CNT) {
10469                 mutex_enter(&freehblkp_lock);
10470                 if (freehblkcnt > HBLK_RESERVE_CNT) {
10471                         freehblkcnt--;
10472                         hblkp = freehblkp;
10473                         freehblkp = hblkp->hblk_next;
10474                         mutex_exit(&freehblkp_lock);
10475                         ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10476                         kmem_cache_free(sfmmu8_cache, hblkp);
10477                         continue;
10478                 }
10479                 mutex_exit(&freehblkp_lock);
10480         }
10481         SFMMU_STAT(sf_put_free_fail);
10482         return (0);
10483 }
10484 
10485 static void
10486 sfmmu_hblk_swap(struct hme_blk *new)
10487 {
10488         struct hme_blk *old, *hblkp, *prev;
10489         uint64_t newpa;
10490         caddr_t base, vaddr, endaddr;
10491         struct hmehash_bucket *hmebp;
10492         struct sf_hment *osfhme, *nsfhme;
10493         page_t *pp;
10494         kmutex_t *pml;
10495         tte_t tte;
10496         struct hme_blk *list = NULL;
10497 
10498 #ifdef  DEBUG
10499         hmeblk_tag              hblktag;
10500         struct hme_blk          *found;
10501 #endif
10502         old = HBLK_RESERVE;
10503         ASSERT(!old->hblk_shared);
10504 
10505         /*
10506          * save pa before bcopy clobbers it
10507          */
10508         newpa = new->hblk_nextpa;
10509 
10510         base = (caddr_t)get_hblk_base(old);
10511         endaddr = base + get_hblk_span(old);
10512 
10513         /*
10514          * acquire hash bucket lock.
10515          */
10516         hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10517             SFMMU_INVALID_SHMERID);
10518 
10519         /*
10520          * copy contents from old to new
10521          */
10522         bcopy((void *)old, (void *)new, HME8BLK_SZ);
10523 
10524         /*
10525          * add new to hash chain
10526          */
10527         sfmmu_hblk_hash_add(hmebp, new, newpa);
10528 
10529         /*
10530          * search hash chain for hblk_reserve; this needs to be performed
10531          * after adding new, otherwise prev won't correspond to the hblk which
10532          * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10533          * remove old later.
10534          */
10535         for (prev = NULL,
10536             hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10537             prev = hblkp, hblkp = hblkp->hblk_next)
10538                 ;
10539 
10540         if (hblkp != old)
10541                 panic("sfmmu_hblk_swap: hblk_reserve not found");
10542 
10543         /*
10544          * p_mapping list is still pointing to hments in hblk_reserve;
10545          * fix up p_mapping list so that they point to hments in new.
10546          *
10547          * Since all these mappings are created by hblk_reserve_thread
10548          * on the way and it's using at least one of the buffers from each of
10549          * the newly minted slabs, there is no danger of any of these
10550          * mappings getting unloaded by another thread.
10551          *
10552          * tsbmiss could only modify ref/mod bits of hments in old/new.
10553          * Since all of these hments hold mappings established by segkmem
10554          * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10555          * have no meaning for the mappings in hblk_reserve.  hments in
10556          * old and new are identical except for ref/mod bits.
10557          */
10558         for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10559 
10560                 HBLKTOHME(osfhme, old, vaddr);
10561                 sfmmu_copytte(&osfhme->hme_tte, &tte);
10562 
10563                 if (TTE_IS_VALID(&tte)) {
10564                         if ((pp = osfhme->hme_page) == NULL)
10565                                 panic("sfmmu_hblk_swap: page not mapped");
10566 
10567                         pml = sfmmu_mlist_enter(pp);
10568 
10569                         if (pp != osfhme->hme_page)
10570                                 panic("sfmmu_hblk_swap: mapping changed");
10571 
10572                         HBLKTOHME(nsfhme, new, vaddr);
10573 
10574                         HME_ADD(nsfhme, pp);
10575                         HME_SUB(osfhme, pp);
10576 
10577                         sfmmu_mlist_exit(pml);
10578                 }
10579         }
10580 
10581         /*
10582          * remove old from hash chain
10583          */
10584         sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10585 
10586 #ifdef  DEBUG
10587 
10588         hblktag.htag_id = ksfmmup;
10589         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10590         hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10591         hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10592         HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10593 
10594         if (found != new)
10595                 panic("sfmmu_hblk_swap: new hblk not found");
10596 #endif
10597 
10598         SFMMU_HASH_UNLOCK(hmebp);
10599 
10600         /*
10601          * Reset hblk_reserve
10602          */
10603         bzero((void *)old, HME8BLK_SZ);
10604         old->hblk_nextpa = va_to_pa((caddr_t)old);
10605 }
10606 
10607 /*
10608  * Grab the mlist mutex for both pages passed in.
10609  *
10610  * low and high will be returned as pointers to the mutexes for these pages.
10611  * low refers to the mutex residing in the lower bin of the mlist hash, while
10612  * high refers to the mutex residing in the higher bin of the mlist hash.  This
10613  * is due to the locking order restrictions on the same thread grabbing
10614  * multiple mlist mutexes.  The low lock must be acquired before the high lock.
10615  *
10616  * If both pages hash to the same mutex, only grab that single mutex, and
10617  * high will be returned as NULL
10618  * If the pages hash to different bins in the hash, grab the lower addressed
10619  * lock first and then the higher addressed lock in order to follow the locking
10620  * rules involved with the same thread grabbing multiple mlist mutexes.
10621  * low and high will both have non-NULL values.
10622  */
10623 static void
10624 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10625     kmutex_t **low, kmutex_t **high)
10626 {
10627         kmutex_t        *mml_targ, *mml_repl;
10628 
10629         /*
10630          * no need to do the dance around szc as in sfmmu_mlist_enter()
10631          * because this routine is only called by hat_page_relocate() and all
10632          * targ and repl pages are already locked EXCL so szc can't change.
10633          */
10634 
10635         mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10636         mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10637 
10638         if (mml_targ == mml_repl) {
10639                 *low = mml_targ;
10640                 *high = NULL;
10641         } else {
10642                 if (mml_targ < mml_repl) {
10643                         *low = mml_targ;
10644                         *high = mml_repl;
10645                 } else {
10646                         *low = mml_repl;
10647                         *high = mml_targ;
10648                 }
10649         }
10650 
10651         mutex_enter(*low);
10652         if (*high)
10653                 mutex_enter(*high);
10654 }
10655 
10656 static void
10657 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10658 {
10659         if (high)
10660                 mutex_exit(high);
10661         mutex_exit(low);
10662 }
10663 
10664 static hatlock_t *
10665 sfmmu_hat_enter(sfmmu_t *sfmmup)
10666 {
10667         hatlock_t       *hatlockp;
10668 
10669         if (sfmmup != ksfmmup) {
10670                 hatlockp = TSB_HASH(sfmmup);
10671                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10672                 return (hatlockp);
10673         }
10674         return (NULL);
10675 }
10676 
10677 static hatlock_t *
10678 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
10679 {
10680         hatlock_t       *hatlockp;
10681 
10682         if (sfmmup != ksfmmup) {
10683                 hatlockp = TSB_HASH(sfmmup);
10684                 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
10685                         return (NULL);
10686                 return (hatlockp);
10687         }
10688         return (NULL);
10689 }
10690 
10691 static void
10692 sfmmu_hat_exit(hatlock_t *hatlockp)
10693 {
10694         if (hatlockp != NULL)
10695                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
10696 }
10697 
10698 static void
10699 sfmmu_hat_lock_all(void)
10700 {
10701         int i;
10702         for (i = 0; i < SFMMU_NUM_LOCK; i++)
10703                 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
10704 }
10705 
10706 static void
10707 sfmmu_hat_unlock_all(void)
10708 {
10709         int i;
10710         for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
10711                 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
10712 }
10713 
10714 int
10715 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
10716 {
10717         ASSERT(sfmmup != ksfmmup);
10718         return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
10719 }
10720 
10721 /*
10722  * Locking primitives to provide consistency between ISM unmap
10723  * and other operations.  Since ISM unmap can take a long time, we
10724  * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
10725  * contention on the hatlock buckets while ISM segments are being
10726  * unmapped.  The tradeoff is that the flags don't prevent priority
10727  * inversion from occurring, so we must request kernel priority in
10728  * case we have to sleep to keep from getting buried while holding
10729  * the HAT_ISMBUSY flag set, which in turn could block other kernel
10730  * threads from running (for example, in sfmmu_uvatopfn()).
10731  */
10732 static void
10733 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
10734 {
10735         hatlock_t *hatlockp;
10736 
10737         THREAD_KPRI_REQUEST();
10738         if (!hatlock_held)
10739                 hatlockp = sfmmu_hat_enter(sfmmup);
10740         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
10741                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
10742         SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
10743         if (!hatlock_held)
10744                 sfmmu_hat_exit(hatlockp);
10745 }
10746 
10747 static void
10748 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
10749 {
10750         hatlock_t *hatlockp;
10751 
10752         if (!hatlock_held)
10753                 hatlockp = sfmmu_hat_enter(sfmmup);
10754         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
10755         SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
10756         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
10757         if (!hatlock_held)
10758                 sfmmu_hat_exit(hatlockp);
10759         THREAD_KPRI_RELEASE();
10760 }
10761 
10762 /*
10763  *
10764  * Algorithm:
10765  *
10766  * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
10767  *      hblks.
10768  *
10769  * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
10770  *
10771  *              (a) try to return an hblk from reserve pool of free hblks;
10772  *              (b) if the reserve pool is empty, acquire hblk_reserve_lock
10773  *                  and return hblk_reserve.
10774  *
10775  * (3) call kmem_cache_alloc() to allocate hblk;
10776  *
10777  *              (a) if hblk_reserve_lock is held by the current thread,
10778  *                  atomically replace hblk_reserve by the hblk that is
10779  *                  returned by kmem_cache_alloc; release hblk_reserve_lock
10780  *                  and call kmem_cache_alloc() again.
10781  *              (b) if reserve pool is not full, add the hblk that is
10782  *                  returned by kmem_cache_alloc to reserve pool and
10783  *                  call kmem_cache_alloc again.
10784  *
10785  */
10786 static struct hme_blk *
10787 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
10788         struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
10789         uint_t flags, uint_t rid)
10790 {
10791         struct hme_blk *hmeblkp = NULL;
10792         struct hme_blk *newhblkp;
10793         struct hme_blk *shw_hblkp = NULL;
10794         struct kmem_cache *sfmmu_cache = NULL;
10795         uint64_t hblkpa;
10796         ulong_t index;
10797         uint_t owner;           /* set to 1 if using hblk_reserve */
10798         uint_t forcefree;
10799         int sleep;
10800         sf_srd_t *srdp;
10801         sf_region_t *rgnp;
10802 
10803         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
10804         ASSERT(hblktag.htag_rid == rid);
10805         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
10806         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
10807             IS_P2ALIGNED(vaddr, TTEBYTES(size)));
10808 
10809         /*
10810          * If segkmem is not created yet, allocate from static hmeblks
10811          * created at the end of startup_modules().  See the block comment
10812          * in startup_modules() describing how we estimate the number of
10813          * static hmeblks that will be needed during re-map.
10814          */
10815         if (!hblk_alloc_dynamic) {
10816 
10817                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10818 
10819                 if (size == TTE8K) {
10820                         index = nucleus_hblk8.index;
10821                         if (index >= nucleus_hblk8.len) {
10822                                 /*
10823                                  * If we panic here, see startup_modules() to
10824                                  * make sure that we are calculating the
10825                                  * number of hblk8's that we need correctly.
10826                                  */
10827                                 prom_panic("no nucleus hblk8 to allocate");
10828                         }
10829                         hmeblkp =
10830                             (struct hme_blk *)&nucleus_hblk8.list[index];
10831                         nucleus_hblk8.index++;
10832                         SFMMU_STAT(sf_hblk8_nalloc);
10833                 } else {
10834                         index = nucleus_hblk1.index;
10835                         if (nucleus_hblk1.index >= nucleus_hblk1.len) {
10836                                 /*
10837                                  * If we panic here, see startup_modules().
10838                                  * Most likely you need to update the
10839                                  * calculation of the number of hblk1 elements
10840                                  * that the kernel needs to boot.
10841                                  */
10842                                 prom_panic("no nucleus hblk1 to allocate");
10843                         }
10844                         hmeblkp =
10845                             (struct hme_blk *)&nucleus_hblk1.list[index];
10846                         nucleus_hblk1.index++;
10847                         SFMMU_STAT(sf_hblk1_nalloc);
10848                 }
10849 
10850                 goto hblk_init;
10851         }
10852 
10853         SFMMU_HASH_UNLOCK(hmebp);
10854 
10855         if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
10856                 if (mmu_page_sizes == max_mmu_page_sizes) {
10857                         if (size < TTE256M)
10858                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10859                                     size, flags);
10860                 } else {
10861                         if (size < TTE4M)
10862                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10863                                     size, flags);
10864                 }
10865         } else if (SFMMU_IS_SHMERID_VALID(rid)) {
10866                 /*
10867                  * Shared hmes use per region bitmaps in rgn_hmeflag
10868                  * rather than shadow hmeblks to keep track of the
10869                  * mapping sizes which have been allocated for the region.
10870                  * Here we cleanup old invalid hmeblks with this rid,
10871                  * which may be left around by pageunload().
10872                  */
10873                 int ttesz;
10874                 caddr_t va;
10875                 caddr_t eva = vaddr + TTEBYTES(size);
10876 
10877                 ASSERT(sfmmup != KHATID);
10878 
10879                 srdp = sfmmup->sfmmu_srdp;
10880                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
10881                 rgnp = srdp->srd_hmergnp[rid];
10882                 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
10883                 ASSERT(rgnp->rgn_refcnt != 0);
10884                 ASSERT(size <= rgnp->rgn_pgszc);
10885 
10886                 ttesz = HBLK_MIN_TTESZ;
10887                 do {
10888                         if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
10889                                 continue;
10890                         }
10891 
10892                         if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
10893                                 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
10894                         } else if (ttesz < size) {
10895                                 for (va = vaddr; va < eva;
10896                                     va += TTEBYTES(ttesz)) {
10897                                         sfmmu_cleanup_rhblk(srdp, va, rid,
10898                                             ttesz);
10899                                 }
10900                         }
10901                 } while (++ttesz <= rgnp->rgn_pgszc);
10902         }
10903 
10904 fill_hblk:
10905         owner = (hblk_reserve_thread == curthread) ? 1 : 0;
10906 
10907         if (owner && size == TTE8K) {
10908 
10909                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10910                 /*
10911                  * We are really in a tight spot. We already own
10912                  * hblk_reserve and we need another hblk.  In anticipation
10913                  * of this kind of scenario, we specifically set aside
10914                  * HBLK_RESERVE_MIN number of hblks to be used exclusively
10915                  * by owner of hblk_reserve.
10916                  */
10917                 SFMMU_STAT(sf_hblk_recurse_cnt);
10918 
10919                 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
10920                         panic("sfmmu_hblk_alloc: reserve list is empty");
10921 
10922                 goto hblk_verify;
10923         }
10924 
10925         ASSERT(!owner);
10926 
10927         if ((flags & HAT_NO_KALLOC) == 0) {
10928 
10929                 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
10930                 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
10931 
10932                 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
10933                         hmeblkp = sfmmu_hblk_steal(size);
10934                 } else {
10935                         /*
10936                          * if we are the owner of hblk_reserve,
10937                          * swap hblk_reserve with hmeblkp and
10938                          * start a fresh life.  Hope things go
10939                          * better this time.
10940                          */
10941                         if (hblk_reserve_thread == curthread) {
10942                                 ASSERT(sfmmu_cache == sfmmu8_cache);
10943                                 sfmmu_hblk_swap(hmeblkp);
10944                                 hblk_reserve_thread = NULL;
10945                                 mutex_exit(&hblk_reserve_lock);
10946                                 goto fill_hblk;
10947                         }
10948                         /*
10949                          * let's donate this hblk to our reserve list if
10950                          * we are not mapping kernel range
10951                          */
10952                         if (size == TTE8K && sfmmup != KHATID) {
10953                                 if (sfmmu_put_free_hblk(hmeblkp, 0))
10954                                         goto fill_hblk;
10955                         }
10956                 }
10957         } else {
10958                 /*
10959                  * We are here to map the slab in sfmmu8_cache; let's
10960                  * check if we could tap our reserve list; if successful,
10961                  * this will avoid the pain of going thru sfmmu_hblk_swap
10962                  */
10963                 SFMMU_STAT(sf_hblk_slab_cnt);
10964                 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
10965                         /*
10966                          * let's start hblk_reserve dance
10967                          */
10968                         SFMMU_STAT(sf_hblk_reserve_cnt);
10969                         owner = 1;
10970                         mutex_enter(&hblk_reserve_lock);
10971                         hmeblkp = HBLK_RESERVE;
10972                         hblk_reserve_thread = curthread;
10973                 }
10974         }
10975 
10976 hblk_verify:
10977         ASSERT(hmeblkp != NULL);
10978         set_hblk_sz(hmeblkp, size);
10979         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10980         SFMMU_HASH_LOCK(hmebp);
10981         HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
10982         if (newhblkp != NULL) {
10983                 SFMMU_HASH_UNLOCK(hmebp);
10984                 if (hmeblkp != HBLK_RESERVE) {
10985                         /*
10986                          * This is really tricky!
10987                          *
10988                          * vmem_alloc(vmem_seg_arena)
10989                          *  vmem_alloc(vmem_internal_arena)
10990                          *   segkmem_alloc(heap_arena)
10991                          *    vmem_alloc(heap_arena)
10992                          *    page_create()
10993                          *    hat_memload()
10994                          *      kmem_cache_free()
10995                          *       kmem_cache_alloc()
10996                          *        kmem_slab_create()
10997                          *         vmem_alloc(kmem_internal_arena)
10998                          *          segkmem_alloc(heap_arena)
10999                          *              vmem_alloc(heap_arena)
11000                          *              page_create()
11001                          *              hat_memload()
11002                          *                kmem_cache_free()
11003                          *              ...
11004                          *
11005                          * Thus, hat_memload() could call kmem_cache_free
11006                          * for enough number of times that we could easily
11007                          * hit the bottom of the stack or run out of reserve
11008                          * list of vmem_seg structs.  So, we must donate
11009                          * this hblk to reserve list if it's allocated
11010                          * from sfmmu8_cache *and* mapping kernel range.
11011                          * We don't need to worry about freeing hmeblk1's
11012                          * to kmem since they don't map any kmem slabs.
11013                          *
11014                          * Note: When segkmem supports largepages, we must
11015                          * free hmeblk1's to reserve list as well.
11016                          */
11017                         forcefree = (sfmmup == KHATID) ? 1 : 0;
11018                         if (size == TTE8K &&
11019                             sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11020                                 goto re_verify;
11021                         }
11022                         ASSERT(sfmmup != KHATID);
11023                         kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11024                 } else {
11025                         /*
11026                          * Hey! we don't need hblk_reserve any more.
11027                          */
11028                         ASSERT(owner);
11029                         hblk_reserve_thread = NULL;
11030                         mutex_exit(&hblk_reserve_lock);
11031                         owner = 0;
11032                 }
11033 re_verify:
11034                 /*
11035                  * let's check if the goodies are still present
11036                  */
11037                 SFMMU_HASH_LOCK(hmebp);
11038                 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11039                 if (newhblkp != NULL) {
11040                         /*
11041                          * return newhblkp if it's not hblk_reserve;
11042                          * if newhblkp is hblk_reserve, return it
11043                          * _only if_ we are the owner of hblk_reserve.
11044                          */
11045                         if (newhblkp != HBLK_RESERVE || owner) {
11046                                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11047                                     newhblkp->hblk_shared);
11048                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11049                                     !newhblkp->hblk_shared);
11050                                 return (newhblkp);
11051                         } else {
11052                                 /*
11053                                  * we just hit hblk_reserve in the hash and
11054                                  * we are not the owner of that;
11055                                  *
11056                                  * block until hblk_reserve_thread completes
11057                                  * swapping hblk_reserve and try the dance
11058                                  * once again.
11059                                  */
11060                                 SFMMU_HASH_UNLOCK(hmebp);
11061                                 mutex_enter(&hblk_reserve_lock);
11062                                 mutex_exit(&hblk_reserve_lock);
11063                                 SFMMU_STAT(sf_hblk_reserve_hit);
11064                                 goto fill_hblk;
11065                         }
11066                 } else {
11067                         /*
11068                          * it's no more! try the dance once again.
11069                          */
11070                         SFMMU_HASH_UNLOCK(hmebp);
11071                         goto fill_hblk;
11072                 }
11073         }
11074 
11075 hblk_init:
11076         if (SFMMU_IS_SHMERID_VALID(rid)) {
11077                 uint16_t tteflag = 0x1 <<
11078                     ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11079 
11080                 if (!(rgnp->rgn_hmeflags & tteflag)) {
11081                         atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11082                 }
11083                 hmeblkp->hblk_shared = 1;
11084         } else {
11085                 hmeblkp->hblk_shared = 0;
11086         }
11087         set_hblk_sz(hmeblkp, size);
11088         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11089         hmeblkp->hblk_next = (struct hme_blk *)NULL;
11090         hmeblkp->hblk_tag = hblktag;
11091         hmeblkp->hblk_shadow = shw_hblkp;
11092         hblkpa = hmeblkp->hblk_nextpa;
11093         hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11094 
11095         ASSERT(get_hblk_ttesz(hmeblkp) == size);
11096         ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11097         ASSERT(hmeblkp->hblk_hmecnt == 0);
11098         ASSERT(hmeblkp->hblk_vcnt == 0);
11099         ASSERT(hmeblkp->hblk_lckcnt == 0);
11100         ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11101         sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11102         return (hmeblkp);
11103 }
11104 
11105 /*
11106  * This function cleans up the hme_blk and returns it to the free list.
11107  */
11108 /* ARGSUSED */
11109 static void
11110 sfmmu_hblk_free(struct hme_blk **listp)
11111 {
11112         struct hme_blk *hmeblkp, *next_hmeblkp;
11113         int             size;
11114         uint_t          critical;
11115         uint64_t        hblkpa;
11116 
11117         ASSERT(*listp != NULL);
11118 
11119         hmeblkp = *listp;
11120         while (hmeblkp != NULL) {
11121                 next_hmeblkp = hmeblkp->hblk_next;
11122                 ASSERT(!hmeblkp->hblk_hmecnt);
11123                 ASSERT(!hmeblkp->hblk_vcnt);
11124                 ASSERT(!hmeblkp->hblk_lckcnt);
11125                 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11126                 ASSERT(hmeblkp->hblk_shared == 0);
11127                 ASSERT(hmeblkp->hblk_shw_bit == 0);
11128                 ASSERT(hmeblkp->hblk_shadow == NULL);
11129 
11130                 hblkpa = va_to_pa((caddr_t)hmeblkp);
11131                 ASSERT(hblkpa != (uint64_t)-1);
11132                 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11133 
11134                 size = get_hblk_ttesz(hmeblkp);
11135                 hmeblkp->hblk_next = NULL;
11136                 hmeblkp->hblk_nextpa = hblkpa;
11137 
11138                 if (hmeblkp->hblk_nuc_bit == 0) {
11139 
11140                         if (size != TTE8K ||
11141                             !sfmmu_put_free_hblk(hmeblkp, critical))
11142                                 kmem_cache_free(get_hblk_cache(hmeblkp),
11143                                     hmeblkp);
11144                 }
11145                 hmeblkp = next_hmeblkp;
11146         }
11147 }
11148 
11149 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11150 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11151 
11152 static uint_t sfmmu_hblk_steal_twice;
11153 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11154 
11155 /*
11156  * Steal a hmeblk from user or kernel hme hash lists.
11157  * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11158  * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11159  * tap into critical reserve of freehblkp.
11160  * Note: We remain looping in this routine until we find one.
11161  */
11162 static struct hme_blk *
11163 sfmmu_hblk_steal(int size)
11164 {
11165         static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11166         struct hmehash_bucket *hmebp;
11167         struct hme_blk *hmeblkp = NULL, *pr_hblk;
11168         uint64_t hblkpa;
11169         int i;
11170         uint_t loop_cnt = 0, critical;
11171 
11172         for (;;) {
11173                 /* Check cpu hblk pending queues */
11174                 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11175                         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11176                         ASSERT(hmeblkp->hblk_hmecnt == 0);
11177                         ASSERT(hmeblkp->hblk_vcnt == 0);
11178                         return (hmeblkp);
11179                 }
11180 
11181                 if (size == TTE8K) {
11182                         critical =
11183                             (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11184                         if (sfmmu_get_free_hblk(&hmeblkp, critical))
11185                                 return (hmeblkp);
11186                 }
11187 
11188                 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11189                     uhmehash_steal_hand;
11190                 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11191 
11192                 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11193                     BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11194                         SFMMU_HASH_LOCK(hmebp);
11195                         hmeblkp = hmebp->hmeblkp;
11196                         hblkpa = hmebp->hmeh_nextpa;
11197                         pr_hblk = NULL;
11198                         while (hmeblkp) {
11199                                 /*
11200                                  * check if it is a hmeblk that is not locked
11201                                  * and not shared. skip shadow hmeblks with
11202                                  * shadow_mask set i.e valid count non zero.
11203                                  */
11204                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11205                                     (hmeblkp->hblk_shw_bit == 0 ||
11206                                     hmeblkp->hblk_vcnt == 0) &&
11207                                     (hmeblkp->hblk_lckcnt == 0)) {
11208                                         /*
11209                                          * there is a high probability that we
11210                                          * will find a free one. search some
11211                                          * buckets for a free hmeblk initially
11212                                          * before unloading a valid hmeblk.
11213                                          */
11214                                         if ((hmeblkp->hblk_vcnt == 0 &&
11215                                             hmeblkp->hblk_hmecnt == 0) || (i >=
11216                                             BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11217                                                 if (sfmmu_steal_this_hblk(hmebp,
11218                                                     hmeblkp, hblkpa, pr_hblk)) {
11219                                                         /*
11220                                                          * Hblk is unloaded
11221                                                          * successfully
11222                                                          */
11223                                                         break;
11224                                                 }
11225                                         }
11226                                 }
11227                                 pr_hblk = hmeblkp;
11228                                 hblkpa = hmeblkp->hblk_nextpa;
11229                                 hmeblkp = hmeblkp->hblk_next;
11230                         }
11231 
11232                         SFMMU_HASH_UNLOCK(hmebp);
11233                         if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11234                                 hmebp = uhme_hash;
11235                 }
11236                 uhmehash_steal_hand = hmebp;
11237 
11238                 if (hmeblkp != NULL)
11239                         break;
11240 
11241                 /*
11242                  * in the worst case, look for a free one in the kernel
11243                  * hash table.
11244                  */
11245                 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11246                         SFMMU_HASH_LOCK(hmebp);
11247                         hmeblkp = hmebp->hmeblkp;
11248                         hblkpa = hmebp->hmeh_nextpa;
11249                         pr_hblk = NULL;
11250                         while (hmeblkp) {
11251                                 /*
11252                                  * check if it is free hmeblk
11253                                  */
11254                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11255                                     (hmeblkp->hblk_lckcnt == 0) &&
11256                                     (hmeblkp->hblk_vcnt == 0) &&
11257                                     (hmeblkp->hblk_hmecnt == 0)) {
11258                                         if (sfmmu_steal_this_hblk(hmebp,
11259                                             hmeblkp, hblkpa, pr_hblk)) {
11260                                                 break;
11261                                         } else {
11262                                                 /*
11263                                                  * Cannot fail since we have
11264                                                  * hash lock.
11265                                                  */
11266                                                 panic("fail to steal?");
11267                                         }
11268                                 }
11269 
11270                                 pr_hblk = hmeblkp;
11271                                 hblkpa = hmeblkp->hblk_nextpa;
11272                                 hmeblkp = hmeblkp->hblk_next;
11273                         }
11274 
11275                         SFMMU_HASH_UNLOCK(hmebp);
11276                         if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11277                                 hmebp = khme_hash;
11278                 }
11279 
11280                 if (hmeblkp != NULL)
11281                         break;
11282                 sfmmu_hblk_steal_twice++;
11283         }
11284         return (hmeblkp);
11285 }
11286 
11287 /*
11288  * This routine does real work to prepare a hblk to be "stolen" by
11289  * unloading the mappings, updating shadow counts ....
11290  * It returns 1 if the block is ready to be reused (stolen), or 0
11291  * means the block cannot be stolen yet- pageunload is still working
11292  * on this hblk.
11293  */
11294 static int
11295 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11296         uint64_t hblkpa, struct hme_blk *pr_hblk)
11297 {
11298         int shw_size, vshift;
11299         struct hme_blk *shw_hblkp;
11300         caddr_t vaddr;
11301         uint_t shw_mask, newshw_mask;
11302         struct hme_blk *list = NULL;
11303 
11304         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11305 
11306         /*
11307          * check if the hmeblk is free, unload if necessary
11308          */
11309         if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11310                 sfmmu_t *sfmmup;
11311                 demap_range_t dmr;
11312 
11313                 sfmmup = hblktosfmmu(hmeblkp);
11314                 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11315                         return (0);
11316                 }
11317                 DEMAP_RANGE_INIT(sfmmup, &dmr);
11318                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11319                     (caddr_t)get_hblk_base(hmeblkp),
11320                     get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11321                 DEMAP_RANGE_FLUSH(&dmr);
11322                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11323                         /*
11324                          * Pageunload is working on the same hblk.
11325                          */
11326                         return (0);
11327                 }
11328 
11329                 sfmmu_hblk_steal_unload_count++;
11330         }
11331 
11332         ASSERT(hmeblkp->hblk_lckcnt == 0);
11333         ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11334 
11335         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11336         hmeblkp->hblk_nextpa = hblkpa;
11337 
11338         shw_hblkp = hmeblkp->hblk_shadow;
11339         if (shw_hblkp) {
11340                 ASSERT(!hmeblkp->hblk_shared);
11341                 shw_size = get_hblk_ttesz(shw_hblkp);
11342                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11343                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11344                 ASSERT(vshift < 8);
11345                 /*
11346                  * Atomically clear shadow mask bit
11347                  */
11348                 do {
11349                         shw_mask = shw_hblkp->hblk_shw_mask;
11350                         ASSERT(shw_mask & (1 << vshift));
11351                         newshw_mask = shw_mask & ~(1 << vshift);
11352                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11353                             shw_mask, newshw_mask);
11354                 } while (newshw_mask != shw_mask);
11355                 hmeblkp->hblk_shadow = NULL;
11356         }
11357 
11358         /*
11359          * remove shadow bit if we are stealing an unused shadow hmeblk.
11360          * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11361          * we are indeed allocating a shadow hmeblk.
11362          */
11363         hmeblkp->hblk_shw_bit = 0;
11364 
11365         if (hmeblkp->hblk_shared) {
11366                 sf_srd_t        *srdp;
11367                 sf_region_t     *rgnp;
11368                 uint_t          rid;
11369 
11370                 srdp = hblktosrd(hmeblkp);
11371                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11372                 rid = hmeblkp->hblk_tag.htag_rid;
11373                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11374                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11375                 rgnp = srdp->srd_hmergnp[rid];
11376                 ASSERT(rgnp != NULL);
11377                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11378                 hmeblkp->hblk_shared = 0;
11379         }
11380 
11381         sfmmu_hblk_steal_count++;
11382         SFMMU_STAT(sf_steal_count);
11383 
11384         return (1);
11385 }
11386 
11387 struct hme_blk *
11388 sfmmu_hmetohblk(struct sf_hment *sfhme)
11389 {
11390         struct hme_blk *hmeblkp;
11391         struct sf_hment *sfhme0;
11392         struct hme_blk *hblk_dummy = 0;
11393 
11394         /*
11395          * No dummy sf_hments, please.
11396          */
11397         ASSERT(sfhme->hme_tte.ll != 0);
11398 
11399         sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11400         hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11401             (uintptr_t)&hblk_dummy->hblk_hme[0]);
11402 
11403         return (hmeblkp);
11404 }
11405 
11406 /*
11407  * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11408  * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11409  * KM_SLEEP allocation.
11410  *
11411  * Return 0 on success, -1 otherwise.
11412  */
11413 static void
11414 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11415 {
11416         struct tsb_info *tsbinfop, *next;
11417         tsb_replace_rc_t rc;
11418         boolean_t gotfirst = B_FALSE;
11419 
11420         ASSERT(sfmmup != ksfmmup);
11421         ASSERT(sfmmu_hat_lock_held(sfmmup));
11422 
11423         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11424                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11425         }
11426 
11427         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11428                 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11429         } else {
11430                 return;
11431         }
11432 
11433         ASSERT(sfmmup->sfmmu_tsb != NULL);
11434 
11435         /*
11436          * Loop over all tsbinfo's replacing them with ones that actually have
11437          * a TSB.  If any of the replacements ever fail, bail out of the loop.
11438          */
11439         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11440                 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11441                 next = tsbinfop->tsb_next;
11442                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11443                     hatlockp, TSB_SWAPIN);
11444                 if (rc != TSB_SUCCESS) {
11445                         break;
11446                 }
11447                 gotfirst = B_TRUE;
11448         }
11449 
11450         switch (rc) {
11451         case TSB_SUCCESS:
11452                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11453                 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11454                 return;
11455         case TSB_LOSTRACE:
11456                 break;
11457         case TSB_ALLOCFAIL:
11458                 break;
11459         default:
11460                 panic("sfmmu_replace_tsb returned unrecognized failure code "
11461                     "%d", rc);
11462         }
11463 
11464         /*
11465          * In this case, we failed to get one of our TSBs.  If we failed to
11466          * get the first TSB, get one of minimum size (8KB).  Walk the list
11467          * and throw away the tsbinfos, starting where the allocation failed;
11468          * we can get by with just one TSB as long as we don't leave the
11469          * SWAPPED tsbinfo structures lying around.
11470          */
11471         tsbinfop = sfmmup->sfmmu_tsb;
11472         next = tsbinfop->tsb_next;
11473         tsbinfop->tsb_next = NULL;
11474 
11475         sfmmu_hat_exit(hatlockp);
11476         for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11477                 next = tsbinfop->tsb_next;
11478                 sfmmu_tsbinfo_free(tsbinfop);
11479         }
11480         hatlockp = sfmmu_hat_enter(sfmmup);
11481 
11482         /*
11483          * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11484          * pages.
11485          */
11486         if (!gotfirst) {
11487                 tsbinfop = sfmmup->sfmmu_tsb;
11488                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11489                     hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11490                 ASSERT(rc == TSB_SUCCESS);
11491         }
11492 
11493         SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11494         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11495 }
11496 
11497 static int
11498 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11499 {
11500         ulong_t bix = 0;
11501         uint_t rid;
11502         sf_region_t *rgnp;
11503 
11504         ASSERT(srdp != NULL);
11505         ASSERT(srdp->srd_refcnt != 0);
11506 
11507         w <<= BT_ULSHIFT;
11508         while (bmw) {
11509                 if (!(bmw & 0x1)) {
11510                         bix++;
11511                         bmw >>= 1;
11512                         continue;
11513                 }
11514                 rid = w | bix;
11515                 rgnp = srdp->srd_hmergnp[rid];
11516                 ASSERT(rgnp->rgn_refcnt > 0);
11517                 ASSERT(rgnp->rgn_id == rid);
11518                 if (addr < rgnp->rgn_saddr ||
11519                     addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11520                         bix++;
11521                         bmw >>= 1;
11522                 } else {
11523                         return (1);
11524                 }
11525         }
11526         return (0);
11527 }
11528 
11529 /*
11530  * Handle exceptions for low level tsb_handler.
11531  *
11532  * There are many scenarios that could land us here:
11533  *
11534  * If the context is invalid we land here. The context can be invalid
11535  * for 3 reasons: 1) we couldn't allocate a new context and now need to
11536  * perform a wrap around operation in order to allocate a new context.
11537  * 2) Context was invalidated to change pagesize programming 3) ISMs or
11538  * TSBs configuration is changeing for this process and we are forced into
11539  * here to do a syncronization operation. If the context is valid we can
11540  * be here from window trap hanlder. In this case just call trap to handle
11541  * the fault.
11542  *
11543  * Note that the process will run in INVALID_CONTEXT before
11544  * faulting into here and subsequently loading the MMU registers
11545  * (including the TSB base register) associated with this process.
11546  * For this reason, the trap handlers must all test for
11547  * INVALID_CONTEXT before attempting to access any registers other
11548  * than the context registers.
11549  */
11550 void
11551 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11552 {
11553         sfmmu_t *sfmmup, *shsfmmup;
11554         uint_t ctxtype;
11555         klwp_id_t lwp;
11556         char lwp_save_state;
11557         hatlock_t *hatlockp, *shatlockp;
11558         struct tsb_info *tsbinfop;
11559         struct tsbmiss *tsbmp;
11560         sf_scd_t *scdp;
11561 
11562         SFMMU_STAT(sf_tsb_exceptions);
11563         SFMMU_MMU_STAT(mmu_tsb_exceptions);
11564         sfmmup = astosfmmu(curthread->t_procp->p_as);
11565         /*
11566          * note that in sun4u, tagacces register contains ctxnum
11567          * while sun4v passes ctxtype in the tagaccess register.
11568          */
11569         ctxtype = tagaccess & TAGACC_CTX_MASK;
11570 
11571         ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11572         ASSERT(sfmmup->sfmmu_ismhat == 0);
11573         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11574             ctxtype == INVALID_CONTEXT);
11575 
11576         if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11577                 /*
11578                  * We may land here because shme bitmap and pagesize
11579                  * flags are updated lazily in tsbmiss area on other cpus.
11580                  * If we detect here that tsbmiss area is out of sync with
11581                  * sfmmu update it and retry the trapped instruction.
11582                  * Otherwise call trap().
11583                  */
11584                 int ret = 0;
11585                 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11586                 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11587 
11588                 /*
11589                  * Must set lwp state to LWP_SYS before
11590                  * trying to acquire any adaptive lock
11591                  */
11592                 lwp = ttolwp(curthread);
11593                 ASSERT(lwp);
11594                 lwp_save_state = lwp->lwp_state;
11595                 lwp->lwp_state = LWP_SYS;
11596 
11597                 hatlockp = sfmmu_hat_enter(sfmmup);
11598                 kpreempt_disable();
11599                 tsbmp = &tsbmiss_area[CPU->cpu_id];
11600                 ASSERT(sfmmup == tsbmp->usfmmup);
11601                 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11602                     ~tteflag_mask) ||
11603                     ((tsbmp->uhat_rtteflags ^  sfmmup->sfmmu_rtteflags) &
11604                     ~tteflag_mask)) {
11605                         tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11606                         tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11607                         ret = 1;
11608                 }
11609                 if (sfmmup->sfmmu_srdp != NULL) {
11610                         ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11611                         ulong_t *tm = tsbmp->shmermap;
11612                         ulong_t i;
11613                         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11614                                 ulong_t d = tm[i] ^ sm[i];
11615                                 if (d) {
11616                                         if (d & sm[i]) {
11617                                                 if (!ret && sfmmu_is_rgnva(
11618                                                     sfmmup->sfmmu_srdp,
11619                                                     addr, i, d & sm[i])) {
11620                                                         ret = 1;
11621                                                 }
11622                                         }
11623                                         tm[i] = sm[i];
11624                                 }
11625                         }
11626                 }
11627                 kpreempt_enable();
11628                 sfmmu_hat_exit(hatlockp);
11629                 lwp->lwp_state = lwp_save_state;
11630                 if (ret) {
11631                         return;
11632                 }
11633         } else if (ctxtype == INVALID_CONTEXT) {
11634                 /*
11635                  * First, make sure we come out of here with a valid ctx,
11636                  * since if we don't get one we'll simply loop on the
11637                  * faulting instruction.
11638                  *
11639                  * If the ISM mappings are changing, the TSB is relocated,
11640                  * the process is swapped, the process is joining SCD or
11641                  * leaving SCD or shared regions we serialize behind the
11642                  * controlling thread with hat lock, sfmmu_flags and
11643                  * sfmmu_tsb_cv condition variable.
11644                  */
11645 
11646                 /*
11647                  * Must set lwp state to LWP_SYS before
11648                  * trying to acquire any adaptive lock
11649                  */
11650                 lwp = ttolwp(curthread);
11651                 ASSERT(lwp);
11652                 lwp_save_state = lwp->lwp_state;
11653                 lwp->lwp_state = LWP_SYS;
11654 
11655                 hatlockp = sfmmu_hat_enter(sfmmup);
11656 retry:
11657                 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11658                         shsfmmup = scdp->scd_sfmmup;
11659                         ASSERT(shsfmmup != NULL);
11660 
11661                         for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11662                             tsbinfop = tsbinfop->tsb_next) {
11663                                 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11664                                         /* drop the private hat lock */
11665                                         sfmmu_hat_exit(hatlockp);
11666                                         /* acquire the shared hat lock */
11667                                         shatlockp = sfmmu_hat_enter(shsfmmup);
11668                                         /*
11669                                          * recheck to see if anything changed
11670                                          * after we drop the private hat lock.
11671                                          */
11672                                         if (sfmmup->sfmmu_scdp == scdp &&
11673                                             shsfmmup == scdp->scd_sfmmup) {
11674                                                 sfmmu_tsb_chk_reloc(shsfmmup,
11675                                                     shatlockp);
11676                                         }
11677                                         sfmmu_hat_exit(shatlockp);
11678                                         hatlockp = sfmmu_hat_enter(sfmmup);
11679                                         goto retry;
11680                                 }
11681                         }
11682                 }
11683 
11684                 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
11685                     tsbinfop = tsbinfop->tsb_next) {
11686                         if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11687                                 cv_wait(&sfmmup->sfmmu_tsb_cv,
11688                                     HATLOCK_MUTEXP(hatlockp));
11689                                 goto retry;
11690                         }
11691                 }
11692 
11693                 /*
11694                  * Wait for ISM maps to be updated.
11695                  */
11696                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11697                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11698                             HATLOCK_MUTEXP(hatlockp));
11699                         goto retry;
11700                 }
11701 
11702                 /* Is this process joining an SCD? */
11703                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11704                         /*
11705                          * Flush private TSB and setup shared TSB.
11706                          * sfmmu_finish_join_scd() does not drop the
11707                          * hat lock.
11708                          */
11709                         sfmmu_finish_join_scd(sfmmup);
11710                         SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
11711                 }
11712 
11713                 /*
11714                  * If we're swapping in, get TSB(s).  Note that we must do
11715                  * this before we get a ctx or load the MMU state.  Once
11716                  * we swap in we have to recheck to make sure the TSB(s) and
11717                  * ISM mappings didn't change while we slept.
11718                  */
11719                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11720                         sfmmu_tsb_swapin(sfmmup, hatlockp);
11721                         goto retry;
11722                 }
11723 
11724                 sfmmu_get_ctx(sfmmup);
11725 
11726                 sfmmu_hat_exit(hatlockp);
11727                 /*
11728                  * Must restore lwp_state if not calling
11729                  * trap() for further processing. Restore
11730                  * it anyway.
11731                  */
11732                 lwp->lwp_state = lwp_save_state;
11733                 return;
11734         }
11735         trap(rp, (caddr_t)tagaccess, traptype, 0);
11736 }
11737 
11738 static void
11739 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11740 {
11741         struct tsb_info *tp;
11742 
11743         ASSERT(sfmmu_hat_lock_held(sfmmup));
11744 
11745         for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
11746                 if (tp->tsb_flags & TSB_RELOC_FLAG) {
11747                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11748                             HATLOCK_MUTEXP(hatlockp));
11749                         break;
11750                 }
11751         }
11752 }
11753 
11754 /*
11755  * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
11756  * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
11757  * rather than spinning to avoid send mondo timeouts with
11758  * interrupts enabled. When the lock is acquired it is immediately
11759  * released and we return back to sfmmu_vatopfn just after
11760  * the GET_TTE call.
11761  */
11762 void
11763 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
11764 {
11765         struct page     **pp;
11766 
11767         (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11768         as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11769 }
11770 
11771 /*
11772  * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
11773  * TTE_SUSPENDED bit set in tte. We do this so that we can handle
11774  * cross traps which cannot be handled while spinning in the
11775  * trap handlers. Simply enter and exit the kpr_suspendlock spin
11776  * mutex, which is held by the holder of the suspend bit, and then
11777  * retry the trapped instruction after unwinding.
11778  */
11779 /*ARGSUSED*/
11780 void
11781 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
11782 {
11783         ASSERT(curthread != kreloc_thread);
11784         mutex_enter(&kpr_suspendlock);
11785         mutex_exit(&kpr_suspendlock);
11786 }
11787 
11788 /*
11789  * This routine could be optimized to reduce the number of xcalls by flushing
11790  * the entire TLBs if region reference count is above some threshold but the
11791  * tradeoff will depend on the size of the TLB. So for now flush the specific
11792  * page a context at a time.
11793  *
11794  * If uselocks is 0 then it's called after all cpus were captured and all the
11795  * hat locks were taken. In this case don't take the region lock by relying on
11796  * the order of list region update operations in hat_join_region(),
11797  * hat_leave_region() and hat_dup_region(). The ordering in those routines
11798  * guarantees that list is always forward walkable and reaches active sfmmus
11799  * regardless of where xc_attention() captures a cpu.
11800  */
11801 cpuset_t
11802 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
11803     struct hme_blk *hmeblkp, int uselocks)
11804 {
11805         sfmmu_t *sfmmup;
11806         cpuset_t cpuset;
11807         cpuset_t rcpuset;
11808         hatlock_t *hatlockp;
11809         uint_t rid = rgnp->rgn_id;
11810         sf_rgn_link_t *rlink;
11811         sf_scd_t *scdp;
11812 
11813         ASSERT(hmeblkp->hblk_shared);
11814         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11815         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11816 
11817         CPUSET_ZERO(rcpuset);
11818         if (uselocks) {
11819                 mutex_enter(&rgnp->rgn_mutex);
11820         }
11821         sfmmup = rgnp->rgn_sfmmu_head;
11822         while (sfmmup != NULL) {
11823                 if (uselocks) {
11824                         hatlockp = sfmmu_hat_enter(sfmmup);
11825                 }
11826 
11827                 /*
11828                  * When an SCD is created the SCD hat is linked on the sfmmu
11829                  * region lists for each hme region which is part of the
11830                  * SCD. If we find an SCD hat, when walking these lists,
11831                  * then we flush the shared TSBs, if we find a private hat,
11832                  * which is part of an SCD, but where the region
11833                  * is not part of the SCD then we flush the private TSBs.
11834                  */
11835                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11836                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11837                         scdp = sfmmup->sfmmu_scdp;
11838                         if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
11839                                 if (uselocks) {
11840                                         sfmmu_hat_exit(hatlockp);
11841                                 }
11842                                 goto next;
11843                         }
11844                 }
11845 
11846                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
11847 
11848                 kpreempt_disable();
11849                 cpuset = sfmmup->sfmmu_cpusran;
11850                 CPUSET_AND(cpuset, cpu_ready_set);
11851                 CPUSET_DEL(cpuset, CPU->cpu_id);
11852                 SFMMU_XCALL_STATS(sfmmup);
11853                 xt_some(cpuset, vtag_flushpage_tl1,
11854                     (uint64_t)addr, (uint64_t)sfmmup);
11855                 vtag_flushpage(addr, (uint64_t)sfmmup);
11856                 if (uselocks) {
11857                         sfmmu_hat_exit(hatlockp);
11858                 }
11859                 kpreempt_enable();
11860                 CPUSET_OR(rcpuset, cpuset);
11861 
11862 next:
11863                 /* LINTED: constant in conditional context */
11864                 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
11865                 ASSERT(rlink != NULL);
11866                 sfmmup = rlink->next;
11867         }
11868         if (uselocks) {
11869                 mutex_exit(&rgnp->rgn_mutex);
11870         }
11871         return (rcpuset);
11872 }
11873 
11874 /*
11875  * This routine takes an sfmmu pointer and the va for an adddress in an
11876  * ISM region as input and returns the corresponding region id in ism_rid.
11877  * The return value of 1 indicates that a region has been found and ism_rid
11878  * is valid, otherwise 0 is returned.
11879  */
11880 static int
11881 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
11882 {
11883         ism_blk_t       *ism_blkp;
11884         int             i;
11885         ism_map_t       *ism_map;
11886 #ifdef DEBUG
11887         struct hat      *ism_hatid;
11888 #endif
11889         ASSERT(sfmmu_hat_lock_held(sfmmup));
11890 
11891         ism_blkp = sfmmup->sfmmu_iblk;
11892         while (ism_blkp != NULL) {
11893                 ism_map = ism_blkp->iblk_maps;
11894                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
11895                         if ((va >= ism_start(ism_map[i])) &&
11896                             (va < ism_end(ism_map[i]))) {
11897 
11898                                 *ism_rid = ism_map[i].imap_rid;
11899 #ifdef DEBUG
11900                                 ism_hatid = ism_map[i].imap_ismhat;
11901                                 ASSERT(ism_hatid == ism_sfmmup);
11902                                 ASSERT(ism_hatid->sfmmu_ismhat);
11903 #endif
11904                                 return (1);
11905                         }
11906                 }
11907                 ism_blkp = ism_blkp->iblk_next;
11908         }
11909         return (0);
11910 }
11911 
11912 /*
11913  * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
11914  * This routine may be called with all cpu's captured. Therefore, the
11915  * caller is responsible for holding all locks and disabling kernel
11916  * preemption.
11917  */
11918 /* ARGSUSED */
11919 static void
11920 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
11921         struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
11922 {
11923         cpuset_t        cpuset;
11924         caddr_t         va;
11925         ism_ment_t      *ment;
11926         sfmmu_t         *sfmmup;
11927 #ifdef VAC
11928         int             vcolor;
11929 #endif
11930 
11931         sf_scd_t        *scdp;
11932         uint_t          ism_rid;
11933 
11934         ASSERT(!hmeblkp->hblk_shared);
11935         /*
11936          * Walk the ism_hat's mapping list and flush the page
11937          * from every hat sharing this ism_hat. This routine
11938          * may be called while all cpu's have been captured.
11939          * Therefore we can't attempt to grab any locks. For now
11940          * this means we will protect the ism mapping list under
11941          * a single lock which will be grabbed by the caller.
11942          * If hat_share/unshare scalibility becomes a performance
11943          * problem then we may need to re-think ism mapping list locking.
11944          */
11945         ASSERT(ism_sfmmup->sfmmu_ismhat);
11946         ASSERT(MUTEX_HELD(&ism_mlist_lock));
11947         addr = addr - ISMID_STARTADDR;
11948 
11949         for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
11950 
11951                 sfmmup = ment->iment_hat;
11952 
11953                 va = ment->iment_base_va;
11954                 va = (caddr_t)((uintptr_t)va  + (uintptr_t)addr);
11955 
11956                 /*
11957                  * When an SCD is created the SCD hat is linked on the ism
11958                  * mapping lists for each ISM segment which is part of the
11959                  * SCD. If we find an SCD hat, when walking these lists,
11960                  * then we flush the shared TSBs, if we find a private hat,
11961                  * which is part of an SCD, but where the region
11962                  * corresponding to this va is not part of the SCD then we
11963                  * flush the private TSBs.
11964                  */
11965                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11966                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
11967                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11968                         if (!find_ism_rid(sfmmup, ism_sfmmup, va,
11969                             &ism_rid)) {
11970                                 cmn_err(CE_PANIC,
11971                                     "can't find matching ISM rid!");
11972                         }
11973 
11974                         scdp = sfmmup->sfmmu_scdp;
11975                         if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
11976                             SF_RGNMAP_TEST(scdp->scd_ismregion_map,
11977                             ism_rid)) {
11978                                 continue;
11979                         }
11980                 }
11981                 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
11982 
11983                 cpuset = sfmmup->sfmmu_cpusran;
11984                 CPUSET_AND(cpuset, cpu_ready_set);
11985                 CPUSET_DEL(cpuset, CPU->cpu_id);
11986                 SFMMU_XCALL_STATS(sfmmup);
11987                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
11988                     (uint64_t)sfmmup);
11989                 vtag_flushpage(va, (uint64_t)sfmmup);
11990 
11991 #ifdef VAC
11992                 /*
11993                  * Flush D$
11994                  * When flushing D$ we must flush all
11995                  * cpu's. See sfmmu_cache_flush().
11996                  */
11997                 if (cache_flush_flag == CACHE_FLUSH) {
11998                         cpuset = cpu_ready_set;
11999                         CPUSET_DEL(cpuset, CPU->cpu_id);
12000 
12001                         SFMMU_XCALL_STATS(sfmmup);
12002                         vcolor = addr_to_vcolor(va);
12003                         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12004                         vac_flushpage(pfnum, vcolor);
12005                 }
12006 #endif  /* VAC */
12007         }
12008 }
12009 
12010 /*
12011  * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12012  * a particular virtual address and ctx.  If noflush is set we do not
12013  * flush the TLB/TSB.  This function may or may not be called with the
12014  * HAT lock held.
12015  */
12016 static void
12017 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12018         pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12019         int hat_lock_held)
12020 {
12021 #ifdef VAC
12022         int vcolor;
12023 #endif
12024         cpuset_t cpuset;
12025         hatlock_t *hatlockp;
12026 
12027         ASSERT(!hmeblkp->hblk_shared);
12028 
12029 #if defined(lint) && !defined(VAC)
12030         pfnum = pfnum;
12031         cpu_flag = cpu_flag;
12032         cache_flush_flag = cache_flush_flag;
12033 #endif
12034 
12035         /*
12036          * There is no longer a need to protect against ctx being
12037          * stolen here since we don't store the ctx in the TSB anymore.
12038          */
12039 #ifdef VAC
12040         vcolor = addr_to_vcolor(addr);
12041 #endif
12042 
12043         /*
12044          * We must hold the hat lock during the flush of TLB,
12045          * to avoid a race with sfmmu_invalidate_ctx(), where
12046          * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12047          * causing TLB demap routine to skip flush on that MMU.
12048          * If the context on a MMU has already been set to
12049          * INVALID_CONTEXT, we just get an extra flush on
12050          * that MMU.
12051          */
12052         if (!hat_lock_held && !tlb_noflush)
12053                 hatlockp = sfmmu_hat_enter(sfmmup);
12054 
12055         kpreempt_disable();
12056         if (!tlb_noflush) {
12057                 /*
12058                  * Flush the TSB and TLB.
12059                  */
12060                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12061 
12062                 cpuset = sfmmup->sfmmu_cpusran;
12063                 CPUSET_AND(cpuset, cpu_ready_set);
12064                 CPUSET_DEL(cpuset, CPU->cpu_id);
12065 
12066                 SFMMU_XCALL_STATS(sfmmup);
12067 
12068                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12069                     (uint64_t)sfmmup);
12070 
12071                 vtag_flushpage(addr, (uint64_t)sfmmup);
12072         }
12073 
12074         if (!hat_lock_held && !tlb_noflush)
12075                 sfmmu_hat_exit(hatlockp);
12076 
12077 #ifdef VAC
12078         /*
12079          * Flush the D$
12080          *
12081          * Even if the ctx is stolen, we need to flush the
12082          * cache. Our ctx stealer only flushes the TLBs.
12083          */
12084         if (cache_flush_flag == CACHE_FLUSH) {
12085                 if (cpu_flag & FLUSH_ALL_CPUS) {
12086                         cpuset = cpu_ready_set;
12087                 } else {
12088                         cpuset = sfmmup->sfmmu_cpusran;
12089                         CPUSET_AND(cpuset, cpu_ready_set);
12090                 }
12091                 CPUSET_DEL(cpuset, CPU->cpu_id);
12092                 SFMMU_XCALL_STATS(sfmmup);
12093                 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12094                 vac_flushpage(pfnum, vcolor);
12095         }
12096 #endif  /* VAC */
12097         kpreempt_enable();
12098 }
12099 
12100 /*
12101  * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12102  * address and ctx.  If noflush is set we do not currently do anything.
12103  * This function may or may not be called with the HAT lock held.
12104  */
12105 static void
12106 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12107         int tlb_noflush, int hat_lock_held)
12108 {
12109         cpuset_t cpuset;
12110         hatlock_t *hatlockp;
12111 
12112         ASSERT(!hmeblkp->hblk_shared);
12113 
12114         /*
12115          * If the process is exiting we have nothing to do.
12116          */
12117         if (tlb_noflush)
12118                 return;
12119 
12120         /*
12121          * Flush TSB.
12122          */
12123         if (!hat_lock_held)
12124                 hatlockp = sfmmu_hat_enter(sfmmup);
12125         SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12126 
12127         kpreempt_disable();
12128 
12129         cpuset = sfmmup->sfmmu_cpusran;
12130         CPUSET_AND(cpuset, cpu_ready_set);
12131         CPUSET_DEL(cpuset, CPU->cpu_id);
12132 
12133         SFMMU_XCALL_STATS(sfmmup);
12134         xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12135 
12136         vtag_flushpage(addr, (uint64_t)sfmmup);
12137 
12138         if (!hat_lock_held)
12139                 sfmmu_hat_exit(hatlockp);
12140 
12141         kpreempt_enable();
12142 
12143 }
12144 
12145 /*
12146  * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12147  * call handler that can flush a range of pages to save on xcalls.
12148  */
12149 static int sfmmu_xcall_save;
12150 
12151 /*
12152  * this routine is never used for demaping addresses backed by SRD hmeblks.
12153  */
12154 static void
12155 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12156 {
12157         sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12158         hatlock_t *hatlockp;
12159         cpuset_t cpuset;
12160         uint64_t sfmmu_pgcnt;
12161         pgcnt_t pgcnt = 0;
12162         int pgunload = 0;
12163         int dirtypg = 0;
12164         caddr_t addr = dmrp->dmr_addr;
12165         caddr_t eaddr;
12166         uint64_t bitvec = dmrp->dmr_bitvec;
12167 
12168         ASSERT(bitvec & 1);
12169 
12170         /*
12171          * Flush TSB and calculate number of pages to flush.
12172          */
12173         while (bitvec != 0) {
12174                 dirtypg = 0;
12175                 /*
12176                  * Find the first page to flush and then count how many
12177                  * pages there are after it that also need to be flushed.
12178                  * This way the number of TSB flushes is minimized.
12179                  */
12180                 while ((bitvec & 1) == 0) {
12181                         pgcnt++;
12182                         addr += MMU_PAGESIZE;
12183                         bitvec >>= 1;
12184                 }
12185                 while (bitvec & 1) {
12186                         dirtypg++;
12187                         bitvec >>= 1;
12188                 }
12189                 eaddr = addr + ptob(dirtypg);
12190                 hatlockp = sfmmu_hat_enter(sfmmup);
12191                 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12192                 sfmmu_hat_exit(hatlockp);
12193                 pgunload += dirtypg;
12194                 addr = eaddr;
12195                 pgcnt += dirtypg;
12196         }
12197 
12198         ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12199         if (sfmmup->sfmmu_free == 0) {
12200                 addr = dmrp->dmr_addr;
12201                 bitvec = dmrp->dmr_bitvec;
12202 
12203                 /*
12204                  * make sure it has SFMMU_PGCNT_SHIFT bits only,
12205                  * as it will be used to pack argument for xt_some
12206                  */
12207                 ASSERT((pgcnt > 0) &&
12208                     (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12209 
12210                 /*
12211                  * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12212                  * the low 6 bits of sfmmup. This is doable since pgcnt
12213                  * always >= 1.
12214                  */
12215                 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12216                 sfmmu_pgcnt = (uint64_t)sfmmup |
12217                     ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12218 
12219                 /*
12220                  * We must hold the hat lock during the flush of TLB,
12221                  * to avoid a race with sfmmu_invalidate_ctx(), where
12222                  * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12223                  * causing TLB demap routine to skip flush on that MMU.
12224                  * If the context on a MMU has already been set to
12225                  * INVALID_CONTEXT, we just get an extra flush on
12226                  * that MMU.
12227                  */
12228                 hatlockp = sfmmu_hat_enter(sfmmup);
12229                 kpreempt_disable();
12230 
12231                 cpuset = sfmmup->sfmmu_cpusran;
12232                 CPUSET_AND(cpuset, cpu_ready_set);
12233                 CPUSET_DEL(cpuset, CPU->cpu_id);
12234 
12235                 SFMMU_XCALL_STATS(sfmmup);
12236                 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12237                     sfmmu_pgcnt);
12238 
12239                 for (; bitvec != 0; bitvec >>= 1) {
12240                         if (bitvec & 1)
12241                                 vtag_flushpage(addr, (uint64_t)sfmmup);
12242                         addr += MMU_PAGESIZE;
12243                 }
12244                 kpreempt_enable();
12245                 sfmmu_hat_exit(hatlockp);
12246 
12247                 sfmmu_xcall_save += (pgunload-1);
12248         }
12249         dmrp->dmr_bitvec = 0;
12250 }
12251 
12252 /*
12253  * In cases where we need to synchronize with TLB/TSB miss trap
12254  * handlers, _and_ need to flush the TLB, it's a lot easier to
12255  * throw away the context from the process than to do a
12256  * special song and dance to keep things consistent for the
12257  * handlers.
12258  *
12259  * Since the process suddenly ends up without a context and our caller
12260  * holds the hat lock, threads that fault after this function is called
12261  * will pile up on the lock.  We can then do whatever we need to
12262  * atomically from the context of the caller.  The first blocked thread
12263  * to resume executing will get the process a new context, and the
12264  * process will resume executing.
12265  *
12266  * One added advantage of this approach is that on MMUs that
12267  * support a "flush all" operation, we will delay the flush until
12268  * cnum wrap-around, and then flush the TLB one time.  This
12269  * is rather rare, so it's a lot less expensive than making 8000
12270  * x-calls to flush the TLB 8000 times.
12271  *
12272  * A per-process (PP) lock is used to synchronize ctx allocations in
12273  * resume() and ctx invalidations here.
12274  */
12275 static void
12276 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12277 {
12278         cpuset_t cpuset;
12279         int cnum, currcnum;
12280         mmu_ctx_t *mmu_ctxp;
12281         int i;
12282         uint_t pstate_save;
12283 
12284         SFMMU_STAT(sf_ctx_inv);
12285 
12286         ASSERT(sfmmu_hat_lock_held(sfmmup));
12287         ASSERT(sfmmup != ksfmmup);
12288 
12289         kpreempt_disable();
12290 
12291         mmu_ctxp = CPU_MMU_CTXP(CPU);
12292         ASSERT(mmu_ctxp);
12293         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12294         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12295 
12296         currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12297 
12298         pstate_save = sfmmu_disable_intrs();
12299 
12300         lock_set(&sfmmup->sfmmu_ctx_lock);       /* acquire PP lock */
12301         /* set HAT cnum invalid across all context domains. */
12302         for (i = 0; i < max_mmu_ctxdoms; i++) {
12303 
12304                 cnum =  sfmmup->sfmmu_ctxs[i].cnum;
12305                 if (cnum == INVALID_CONTEXT) {
12306                         continue;
12307                 }
12308 
12309                 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12310         }
12311         membar_enter(); /* make sure globally visible to all CPUs */
12312         lock_clear(&sfmmup->sfmmu_ctx_lock);     /* release PP lock */
12313 
12314         sfmmu_enable_intrs(pstate_save);
12315 
12316         cpuset = sfmmup->sfmmu_cpusran;
12317         CPUSET_DEL(cpuset, CPU->cpu_id);
12318         CPUSET_AND(cpuset, cpu_ready_set);
12319         if (!CPUSET_ISNULL(cpuset)) {
12320                 SFMMU_XCALL_STATS(sfmmup);
12321                 xt_some(cpuset, sfmmu_raise_tsb_exception,
12322                     (uint64_t)sfmmup, INVALID_CONTEXT);
12323                 xt_sync(cpuset);
12324                 SFMMU_STAT(sf_tsb_raise_exception);
12325                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12326         }
12327 
12328         /*
12329          * If the hat to-be-invalidated is the same as the current
12330          * process on local CPU we need to invalidate
12331          * this CPU context as well.
12332          */
12333         if ((sfmmu_getctx_sec() == currcnum) &&
12334             (currcnum != INVALID_CONTEXT)) {
12335                 /* sets shared context to INVALID too */
12336                 sfmmu_setctx_sec(INVALID_CONTEXT);
12337                 sfmmu_clear_utsbinfo();
12338         }
12339 
12340         SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12341 
12342         kpreempt_enable();
12343 
12344         /*
12345          * we hold the hat lock, so nobody should allocate a context
12346          * for us yet
12347          */
12348         ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12349 }
12350 
12351 #ifdef VAC
12352 /*
12353  * We need to flush the cache in all cpus.  It is possible that
12354  * a process referenced a page as cacheable but has sinced exited
12355  * and cleared the mapping list.  We still to flush it but have no
12356  * state so all cpus is the only alternative.
12357  */
12358 void
12359 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12360 {
12361         cpuset_t cpuset;
12362 
12363         kpreempt_disable();
12364         cpuset = cpu_ready_set;
12365         CPUSET_DEL(cpuset, CPU->cpu_id);
12366         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12367         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12368         xt_sync(cpuset);
12369         vac_flushpage(pfnum, vcolor);
12370         kpreempt_enable();
12371 }
12372 
12373 void
12374 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12375 {
12376         cpuset_t cpuset;
12377 
12378         ASSERT(vcolor >= 0);
12379 
12380         kpreempt_disable();
12381         cpuset = cpu_ready_set;
12382         CPUSET_DEL(cpuset, CPU->cpu_id);
12383         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12384         xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12385         xt_sync(cpuset);
12386         vac_flushcolor(vcolor, pfnum);
12387         kpreempt_enable();
12388 }
12389 #endif  /* VAC */
12390 
12391 /*
12392  * We need to prevent processes from accessing the TSB using a cached physical
12393  * address.  It's alright if they try to access the TSB via virtual address
12394  * since they will just fault on that virtual address once the mapping has
12395  * been suspended.
12396  */
12397 #pragma weak sendmondo_in_recover
12398 
12399 /* ARGSUSED */
12400 static int
12401 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12402 {
12403         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12404         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12405         hatlock_t *hatlockp;
12406         sf_scd_t *scdp;
12407 
12408         if (flags != HAT_PRESUSPEND)
12409                 return (0);
12410 
12411         /*
12412          * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12413          * be a shared hat, then set SCD's tsbinfo's flag.
12414          * If tsb is not shared, sfmmup is a private hat, then set
12415          * its private tsbinfo's flag.
12416          */
12417         hatlockp = sfmmu_hat_enter(sfmmup);
12418         tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12419 
12420         if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12421                 sfmmu_tsb_inv_ctx(sfmmup);
12422                 sfmmu_hat_exit(hatlockp);
12423         } else {
12424                 /* release lock on the shared hat */
12425                 sfmmu_hat_exit(hatlockp);
12426                 /* sfmmup is a shared hat */
12427                 ASSERT(sfmmup->sfmmu_scdhat);
12428                 scdp = sfmmup->sfmmu_scdp;
12429                 ASSERT(scdp != NULL);
12430                 /* get private hat from the scd list */
12431                 mutex_enter(&scdp->scd_mutex);
12432                 sfmmup = scdp->scd_sf_list;
12433                 while (sfmmup != NULL) {
12434                         hatlockp = sfmmu_hat_enter(sfmmup);
12435                         /*
12436                          * We do not call sfmmu_tsb_inv_ctx here because
12437                          * sendmondo_in_recover check is only needed for
12438                          * sun4u.
12439                          */
12440                         sfmmu_invalidate_ctx(sfmmup);
12441                         sfmmu_hat_exit(hatlockp);
12442                         sfmmup = sfmmup->sfmmu_scd_link.next;
12443 
12444                 }
12445                 mutex_exit(&scdp->scd_mutex);
12446         }
12447         return (0);
12448 }
12449 
12450 static void
12451 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12452 {
12453         extern uint32_t sendmondo_in_recover;
12454 
12455         ASSERT(sfmmu_hat_lock_held(sfmmup));
12456 
12457         /*
12458          * For Cheetah+ Erratum 25:
12459          * Wait for any active recovery to finish.  We can't risk
12460          * relocating the TSB of the thread running mondo_recover_proc()
12461          * since, if we did that, we would deadlock.  The scenario we are
12462          * trying to avoid is as follows:
12463          *
12464          * THIS CPU                     RECOVER CPU
12465          * --------                     -----------
12466          *                              Begins recovery, walking through TSB
12467          * hat_pagesuspend() TSB TTE
12468          *                              TLB miss on TSB TTE, spins at TL1
12469          * xt_sync()
12470          *      send_mondo_timeout()
12471          *      mondo_recover_proc()
12472          *      ((deadlocked))
12473          *
12474          * The second half of the workaround is that mondo_recover_proc()
12475          * checks to see if the tsb_info has the RELOC flag set, and if it
12476          * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12477          * and hence avoiding the TLB miss that could result in a deadlock.
12478          */
12479         if (&sendmondo_in_recover) {
12480                 membar_enter(); /* make sure RELOC flag visible */
12481                 while (sendmondo_in_recover) {
12482                         drv_usecwait(1);
12483                         membar_consumer();
12484                 }
12485         }
12486 
12487         sfmmu_invalidate_ctx(sfmmup);
12488 }
12489 
12490 /* ARGSUSED */
12491 static int
12492 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12493         void *tsbinfo, pfn_t newpfn)
12494 {
12495         hatlock_t *hatlockp;
12496         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12497         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12498 
12499         if (flags != HAT_POSTUNSUSPEND)
12500                 return (0);
12501 
12502         hatlockp = sfmmu_hat_enter(sfmmup);
12503 
12504         SFMMU_STAT(sf_tsb_reloc);
12505 
12506         /*
12507          * The process may have swapped out while we were relocating one
12508          * of its TSBs.  If so, don't bother doing the setup since the
12509          * process can't be using the memory anymore.
12510          */
12511         if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12512                 ASSERT(va == tsbinfop->tsb_va);
12513                 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12514 
12515                 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12516                         sfmmu_inv_tsb(tsbinfop->tsb_va,
12517                             TSB_BYTES(tsbinfop->tsb_szc));
12518                         tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12519                 }
12520         }
12521 
12522         membar_exit();
12523         tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12524         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12525 
12526         sfmmu_hat_exit(hatlockp);
12527 
12528         return (0);
12529 }
12530 
12531 /*
12532  * Allocate and initialize a tsb_info structure.  Note that we may or may not
12533  * allocate a TSB here, depending on the flags passed in.
12534  */
12535 static int
12536 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12537         uint_t flags, sfmmu_t *sfmmup)
12538 {
12539         int err;
12540 
12541         *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12542             sfmmu_tsbinfo_cache, KM_SLEEP);
12543 
12544         if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12545             tsb_szc, flags, sfmmup)) != 0) {
12546                 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12547                 SFMMU_STAT(sf_tsb_allocfail);
12548                 *tsbinfopp = NULL;
12549                 return (err);
12550         }
12551         SFMMU_STAT(sf_tsb_alloc);
12552 
12553         /*
12554          * Bump the TSB size counters for this TSB size.
12555          */
12556         (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12557         return (0);
12558 }
12559 
12560 static void
12561 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12562 {
12563         caddr_t tsbva = tsbinfo->tsb_va;
12564         uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12565         struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12566         vmem_t  *vmp = tsbinfo->tsb_vmp;
12567 
12568         /*
12569          * If we allocated this TSB from relocatable kernel memory, then we
12570          * need to uninstall the callback handler.
12571          */
12572         if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12573                 uintptr_t slab_mask;
12574                 caddr_t slab_vaddr;
12575                 page_t **ppl;
12576                 int ret;
12577 
12578                 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12579                 if (tsb_size > MMU_PAGESIZE4M)
12580                         slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12581                 else
12582                         slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12583                 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12584 
12585                 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12586                 ASSERT(ret == 0);
12587                 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12588                     0, NULL);
12589                 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12590         }
12591 
12592         if (kmem_cachep != NULL) {
12593                 kmem_cache_free(kmem_cachep, tsbva);
12594         } else {
12595                 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12596         }
12597         tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12598         atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12599 }
12600 
12601 static void
12602 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12603 {
12604         if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12605                 sfmmu_tsb_free(tsbinfo);
12606         }
12607         kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12608 
12609 }
12610 
12611 /*
12612  * Setup all the references to physical memory for this tsbinfo.
12613  * The underlying page(s) must be locked.
12614  */
12615 static void
12616 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12617 {
12618         ASSERT(pfn != PFN_INVALID);
12619         ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12620 
12621 #ifndef sun4v
12622         if (tsbinfo->tsb_szc == 0) {
12623                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12624                     PROT_WRITE|PROT_READ, TTE8K);
12625         } else {
12626                 /*
12627                  * Round down PA and use a large mapping; the handlers will
12628                  * compute the TSB pointer at the correct offset into the
12629                  * big virtual page.  NOTE: this assumes all TSBs larger
12630                  * than 8K must come from physically contiguous slabs of
12631                  * size tsb_slab_size.
12632                  */
12633                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12634                     PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12635         }
12636         tsbinfo->tsb_pa = ptob(pfn);
12637 
12638         TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12639         TTE_SET_MOD(&tsbinfo->tsb_tte);    /* enable writes */
12640 
12641         ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12642         ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12643 #else /* sun4v */
12644         tsbinfo->tsb_pa = ptob(pfn);
12645 #endif /* sun4v */
12646 }
12647 
12648 
12649 /*
12650  * Returns zero on success, ENOMEM if over the high water mark,
12651  * or EAGAIN if the caller needs to retry with a smaller TSB
12652  * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12653  *
12654  * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12655  * is specified and the TSB requested is PAGESIZE, though it
12656  * may sleep waiting for memory if sufficient memory is not
12657  * available.
12658  */
12659 static int
12660 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12661     int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12662 {
12663         caddr_t vaddr = NULL;
12664         caddr_t slab_vaddr;
12665         uintptr_t slab_mask;
12666         int tsbbytes = TSB_BYTES(tsbcode);
12667         int lowmem = 0;
12668         struct kmem_cache *kmem_cachep = NULL;
12669         vmem_t *vmp = NULL;
12670         lgrp_id_t lgrpid = LGRP_NONE;
12671         pfn_t pfn;
12672         uint_t cbflags = HAC_SLEEP;
12673         page_t **pplist;
12674         int ret;
12675 
12676         ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
12677         if (tsbbytes > MMU_PAGESIZE4M)
12678                 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12679         else
12680                 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12681 
12682         if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
12683                 flags |= TSB_ALLOC;
12684 
12685         ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
12686 
12687         tsbinfo->tsb_sfmmu = sfmmup;
12688 
12689         /*
12690          * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
12691          * return.
12692          */
12693         if ((flags & TSB_ALLOC) == 0) {
12694                 tsbinfo->tsb_szc = tsbcode;
12695                 tsbinfo->tsb_ttesz_mask = tteszmask;
12696                 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
12697                 tsbinfo->tsb_pa = -1;
12698                 tsbinfo->tsb_tte.ll = 0;
12699                 tsbinfo->tsb_next = NULL;
12700                 tsbinfo->tsb_flags = TSB_SWAPPED;
12701                 tsbinfo->tsb_cache = NULL;
12702                 tsbinfo->tsb_vmp = NULL;
12703                 return (0);
12704         }
12705 
12706 #ifdef DEBUG
12707         /*
12708          * For debugging:
12709          * Randomly force allocation failures every tsb_alloc_mtbf
12710          * tries if TSB_FORCEALLOC is not specified.  This will
12711          * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
12712          * it is even, to allow testing of both failure paths...
12713          */
12714         if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
12715             (tsb_alloc_count++ == tsb_alloc_mtbf)) {
12716                 tsb_alloc_count = 0;
12717                 tsb_alloc_fail_mtbf++;
12718                 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
12719         }
12720 #endif  /* DEBUG */
12721 
12722         /*
12723          * Enforce high water mark if we are not doing a forced allocation
12724          * and are not shrinking a process' TSB.
12725          */
12726         if ((flags & TSB_SHRINK) == 0 &&
12727             (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
12728                 if ((flags & TSB_FORCEALLOC) == 0)
12729                         return (ENOMEM);
12730                 lowmem = 1;
12731         }
12732 
12733         /*
12734          * Allocate from the correct location based upon the size of the TSB
12735          * compared to the base page size, and what memory conditions dictate.
12736          * Note we always do nonblocking allocations from the TSB arena since
12737          * we don't want memory fragmentation to cause processes to block
12738          * indefinitely waiting for memory; until the kernel algorithms that
12739          * coalesce large pages are improved this is our best option.
12740          *
12741          * Algorithm:
12742          *      If allocating a "large" TSB (>8K), allocate from the
12743          *              appropriate kmem_tsb_default_arena vmem arena
12744          *      else if low on memory or the TSB_FORCEALLOC flag is set or
12745          *      tsb_forceheap is set
12746          *              Allocate from kernel heap via sfmmu_tsb8k_cache with
12747          *              KM_SLEEP (never fails)
12748          *      else
12749          *              Allocate from appropriate sfmmu_tsb_cache with
12750          *              KM_NOSLEEP
12751          *      endif
12752          */
12753         if (tsb_lgrp_affinity)
12754                 lgrpid = lgrp_home_id(curthread);
12755         if (lgrpid == LGRP_NONE)
12756                 lgrpid = 0;     /* use lgrp of boot CPU */
12757 
12758         if (tsbbytes > MMU_PAGESIZE) {
12759                 if (tsbbytes > MMU_PAGESIZE4M) {
12760                         vmp = kmem_bigtsb_default_arena[lgrpid];
12761                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12762                             0, 0, NULL, NULL, VM_NOSLEEP);
12763                 } else {
12764                         vmp = kmem_tsb_default_arena[lgrpid];
12765                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12766                             0, 0, NULL, NULL, VM_NOSLEEP);
12767                 }
12768 #ifdef  DEBUG
12769         } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
12770 #else   /* !DEBUG */
12771         } else if (lowmem || (flags & TSB_FORCEALLOC)) {
12772 #endif  /* DEBUG */
12773                 kmem_cachep = sfmmu_tsb8k_cache;
12774                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
12775                 ASSERT(vaddr != NULL);
12776         } else {
12777                 kmem_cachep = sfmmu_tsb_cache[lgrpid];
12778                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
12779         }
12780 
12781         tsbinfo->tsb_cache = kmem_cachep;
12782         tsbinfo->tsb_vmp = vmp;
12783 
12784         if (vaddr == NULL) {
12785                 return (EAGAIN);
12786         }
12787 
12788         atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
12789         kmem_cachep = tsbinfo->tsb_cache;
12790 
12791         /*
12792          * If we are allocating from outside the cage, then we need to
12793          * register a relocation callback handler.  Note that for now
12794          * since pseudo mappings always hang off of the slab's root page,
12795          * we need only lock the first 8K of the TSB slab.  This is a bit
12796          * hacky but it is good for performance.
12797          */
12798         if (kmem_cachep != sfmmu_tsb8k_cache) {
12799                 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
12800                 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
12801                 ASSERT(ret == 0);
12802                 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
12803                     cbflags, (void *)tsbinfo, &pfn, NULL);
12804 
12805                 /*
12806                  * Need to free up resources if we could not successfully
12807                  * add the callback function and return an error condition.
12808                  */
12809                 if (ret != 0) {
12810                         if (kmem_cachep) {
12811                                 kmem_cache_free(kmem_cachep, vaddr);
12812                         } else {
12813                                 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
12814                         }
12815                         as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
12816                             S_WRITE);
12817                         return (EAGAIN);
12818                 }
12819         } else {
12820                 /*
12821                  * Since allocation of 8K TSBs from heap is rare and occurs
12822                  * during memory pressure we allocate them from permanent
12823                  * memory rather than using callbacks to get the PFN.
12824                  */
12825                 pfn = hat_getpfnum(kas.a_hat, vaddr);
12826         }
12827 
12828         tsbinfo->tsb_va = vaddr;
12829         tsbinfo->tsb_szc = tsbcode;
12830         tsbinfo->tsb_ttesz_mask = tteszmask;
12831         tsbinfo->tsb_next = NULL;
12832         tsbinfo->tsb_flags = 0;
12833 
12834         sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
12835 
12836         sfmmu_inv_tsb(vaddr, tsbbytes);
12837 
12838         if (kmem_cachep != sfmmu_tsb8k_cache) {
12839                 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
12840         }
12841 
12842         return (0);
12843 }
12844 
12845 /*
12846  * Initialize per cpu tsb and per cpu tsbmiss_area
12847  */
12848 void
12849 sfmmu_init_tsbs(void)
12850 {
12851         int i;
12852         struct tsbmiss  *tsbmissp;
12853         struct kpmtsbm  *kpmtsbmp;
12854 #ifndef sun4v
12855         extern int      dcache_line_mask;
12856 #endif /* sun4v */
12857         extern uint_t   vac_colors;
12858 
12859         /*
12860          * Init. tsb miss area.
12861          */
12862         tsbmissp = tsbmiss_area;
12863 
12864         for (i = 0; i < NCPU; tsbmissp++, i++) {
12865                 /*
12866                  * initialize the tsbmiss area.
12867                  * Do this for all possible CPUs as some may be added
12868                  * while the system is running. There is no cost to this.
12869                  */
12870                 tsbmissp->ksfmmup = ksfmmup;
12871 #ifndef sun4v
12872                 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
12873 #endif /* sun4v */
12874                 tsbmissp->khashstart =
12875                     (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
12876                 tsbmissp->uhashstart =
12877                     (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
12878                 tsbmissp->khashsz = khmehash_num;
12879                 tsbmissp->uhashsz = uhmehash_num;
12880         }
12881 
12882         sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
12883             sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
12884 
12885         if (kpm_enable == 0)
12886                 return;
12887 
12888         /* -- Begin KPM specific init -- */
12889 
12890         if (kpm_smallpages) {
12891                 /*
12892                  * If we're using base pagesize pages for seg_kpm
12893                  * mappings, we use the kernel TSB since we can't afford
12894                  * to allocate a second huge TSB for these mappings.
12895                  */
12896                 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
12897                 kpm_tsbsz = ktsb_szcode;
12898                 kpmsm_tsbbase = kpm_tsbbase;
12899                 kpmsm_tsbsz = kpm_tsbsz;
12900         } else {
12901                 /*
12902                  * In VAC conflict case, just put the entries in the
12903                  * kernel 8K indexed TSB for now so we can find them.
12904                  * This could really be changed in the future if we feel
12905                  * the need...
12906                  */
12907                 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
12908                 kpmsm_tsbsz = ktsb_szcode;
12909                 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
12910                 kpm_tsbsz = ktsb4m_szcode;
12911         }
12912 
12913         kpmtsbmp = kpmtsbm_area;
12914         for (i = 0; i < NCPU; kpmtsbmp++, i++) {
12915                 /*
12916                  * Initialize the kpmtsbm area.
12917                  * Do this for all possible CPUs as some may be added
12918                  * while the system is running. There is no cost to this.
12919                  */
12920                 kpmtsbmp->vbase = kpm_vbase;
12921                 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
12922                 kpmtsbmp->sz_shift = kpm_size_shift;
12923                 kpmtsbmp->kpmp_shift = kpmp_shift;
12924                 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
12925                 if (kpm_smallpages == 0) {
12926                         kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
12927                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
12928                 } else {
12929                         kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
12930                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
12931                 }
12932                 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
12933                 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
12934 #ifdef  DEBUG
12935                 kpmtsbmp->flags |= (kpm_tsbmtl) ?  KPMTSBM_TLTSBM_FLAG : 0;
12936 #endif  /* DEBUG */
12937                 if (ktsb_phys)
12938                         kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
12939         }
12940 
12941         /* -- End KPM specific init -- */
12942 }
12943 
12944 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
12945 struct tsb_info ktsb_info[2];
12946 
12947 /*
12948  * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
12949  */
12950 void
12951 sfmmu_init_ktsbinfo()
12952 {
12953         ASSERT(ksfmmup != NULL);
12954         ASSERT(ksfmmup->sfmmu_tsb == NULL);
12955         /*
12956          * Allocate tsbinfos for kernel and copy in data
12957          * to make debug easier and sun4v setup easier.
12958          */
12959         ktsb_info[0].tsb_sfmmu = ksfmmup;
12960         ktsb_info[0].tsb_szc = ktsb_szcode;
12961         ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
12962         ktsb_info[0].tsb_va = ktsb_base;
12963         ktsb_info[0].tsb_pa = ktsb_pbase;
12964         ktsb_info[0].tsb_flags = 0;
12965         ktsb_info[0].tsb_tte.ll = 0;
12966         ktsb_info[0].tsb_cache = NULL;
12967 
12968         ktsb_info[1].tsb_sfmmu = ksfmmup;
12969         ktsb_info[1].tsb_szc = ktsb4m_szcode;
12970         ktsb_info[1].tsb_ttesz_mask = TSB4M;
12971         ktsb_info[1].tsb_va = ktsb4m_base;
12972         ktsb_info[1].tsb_pa = ktsb4m_pbase;
12973         ktsb_info[1].tsb_flags = 0;
12974         ktsb_info[1].tsb_tte.ll = 0;
12975         ktsb_info[1].tsb_cache = NULL;
12976 
12977         /* Link them into ksfmmup. */
12978         ktsb_info[0].tsb_next = &ktsb_info[1];
12979         ktsb_info[1].tsb_next = NULL;
12980         ksfmmup->sfmmu_tsb = &ktsb_info[0];
12981 
12982         sfmmu_setup_tsbinfo(ksfmmup);
12983 }
12984 
12985 /*
12986  * Cache the last value returned from va_to_pa().  If the VA specified
12987  * in the current call to cached_va_to_pa() maps to the same Page (as the
12988  * previous call to cached_va_to_pa()), then compute the PA using
12989  * cached info, else call va_to_pa().
12990  *
12991  * Note: this function is neither MT-safe nor consistent in the presence
12992  * of multiple, interleaved threads.  This function was created to enable
12993  * an optimization used during boot (at a point when there's only one thread
12994  * executing on the "boot CPU", and before startup_vm() has been called).
12995  */
12996 static uint64_t
12997 cached_va_to_pa(void *vaddr)
12998 {
12999         static uint64_t prev_vaddr_base = 0;
13000         static uint64_t prev_pfn = 0;
13001 
13002         if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13003                 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13004         } else {
13005                 uint64_t pa = va_to_pa(vaddr);
13006 
13007                 if (pa != ((uint64_t)-1)) {
13008                         /*
13009                          * Computed physical address is valid.  Cache its
13010                          * related info for the next cached_va_to_pa() call.
13011                          */
13012                         prev_pfn = pa & MMU_PAGEMASK;
13013                         prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13014                 }
13015 
13016                 return (pa);
13017         }
13018 }
13019 
13020 /*
13021  * Carve up our nucleus hblk region.  We may allocate more hblks than
13022  * asked due to rounding errors but we are guaranteed to have at least
13023  * enough space to allocate the requested number of hblk8's and hblk1's.
13024  */
13025 void
13026 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13027 {
13028         struct hme_blk *hmeblkp;
13029         size_t hme8blk_sz, hme1blk_sz;
13030         size_t i;
13031         size_t hblk8_bound;
13032         ulong_t j = 0, k = 0;
13033 
13034         ASSERT(addr != NULL && size != 0);
13035 
13036         /* Need to use proper structure alignment */
13037         hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13038         hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13039 
13040         nucleus_hblk8.list = (void *)addr;
13041         nucleus_hblk8.index = 0;
13042 
13043         /*
13044          * Use as much memory as possible for hblk8's since we
13045          * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13046          * We need to hold back enough space for the hblk1's which
13047          * we'll allocate next.
13048          */
13049         hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13050         for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13051                 hmeblkp = (struct hme_blk *)addr;
13052                 addr += hme8blk_sz;
13053                 hmeblkp->hblk_nuc_bit = 1;
13054                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13055         }
13056         nucleus_hblk8.len = j;
13057         ASSERT(j >= nhblk8);
13058         SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13059 
13060         nucleus_hblk1.list = (void *)addr;
13061         nucleus_hblk1.index = 0;
13062         for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13063                 hmeblkp = (struct hme_blk *)addr;
13064                 addr += hme1blk_sz;
13065                 hmeblkp->hblk_nuc_bit = 1;
13066                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13067         }
13068         ASSERT(k >= nhblk1);
13069         nucleus_hblk1.len = k;
13070         SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13071 }
13072 
13073 /*
13074  * This function is currently not supported on this platform. For what
13075  * it's supposed to do, see hat.c and hat_srmmu.c
13076  */
13077 /* ARGSUSED */
13078 faultcode_t
13079 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13080     uint_t flags)
13081 {
13082         return (FC_NOSUPPORT);
13083 }
13084 
13085 /*
13086  * Searchs the mapping list of the page for a mapping of the same size. If not
13087  * found the corresponding bit is cleared in the p_index field. When large
13088  * pages are more prevalent in the system, we can maintain the mapping list
13089  * in order and we don't have to traverse the list each time. Just check the
13090  * next and prev entries, and if both are of different size, we clear the bit.
13091  */
13092 static void
13093 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13094 {
13095         struct sf_hment *sfhmep;
13096         struct hme_blk *hmeblkp;
13097         int     index;
13098         pgcnt_t npgs;
13099 
13100         ASSERT(ttesz > TTE8K);
13101 
13102         ASSERT(sfmmu_mlist_held(pp));
13103 
13104         ASSERT(PP_ISMAPPED_LARGE(pp));
13105 
13106         /*
13107          * Traverse mapping list looking for another mapping of same size.
13108          * since we only want to clear index field if all mappings of
13109          * that size are gone.
13110          */
13111 
13112         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13113                 if (IS_PAHME(sfhmep))
13114                         continue;
13115                 hmeblkp = sfmmu_hmetohblk(sfhmep);
13116                 if (hme_size(sfhmep) == ttesz) {
13117                         /*
13118                          * another mapping of the same size. don't clear index.
13119                          */
13120                         return;
13121                 }
13122         }
13123 
13124         /*
13125          * Clear the p_index bit for large page.
13126          */
13127         index = PAGESZ_TO_INDEX(ttesz);
13128         npgs = TTEPAGES(ttesz);
13129         while (npgs-- > 0) {
13130                 ASSERT(pp->p_index & index);
13131                 pp->p_index &= ~index;
13132                 pp = PP_PAGENEXT(pp);
13133         }
13134 }
13135 
13136 /*
13137  * return supported features
13138  */
13139 /* ARGSUSED */
13140 int
13141 hat_supported(enum hat_features feature, void *arg)
13142 {
13143         switch (feature) {
13144         case    HAT_SHARED_PT:
13145         case    HAT_DYNAMIC_ISM_UNMAP:
13146         case    HAT_VMODSORT:
13147                 return (1);
13148         case    HAT_SHARED_REGIONS:
13149                 if (shctx_on)
13150                         return (1);
13151                 else
13152                         return (0);
13153         default:
13154                 return (0);
13155         }
13156 }
13157 
13158 void
13159 hat_enter(struct hat *hat)
13160 {
13161         hatlock_t       *hatlockp;
13162 
13163         if (hat != ksfmmup) {
13164                 hatlockp = TSB_HASH(hat);
13165                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13166         }
13167 }
13168 
13169 void
13170 hat_exit(struct hat *hat)
13171 {
13172         hatlock_t       *hatlockp;
13173 
13174         if (hat != ksfmmup) {
13175                 hatlockp = TSB_HASH(hat);
13176                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13177         }
13178 }
13179 
13180 /*ARGSUSED*/
13181 void
13182 hat_reserve(struct as *as, caddr_t addr, size_t len)
13183 {
13184 }
13185 
13186 static void
13187 hat_kstat_init(void)
13188 {
13189         kstat_t *ksp;
13190 
13191         ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13192             KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13193             KSTAT_FLAG_VIRTUAL);
13194         if (ksp) {
13195                 ksp->ks_data = (void *) &sfmmu_global_stat;
13196                 kstat_install(ksp);
13197         }
13198         ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13199             KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13200             KSTAT_FLAG_VIRTUAL);
13201         if (ksp) {
13202                 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13203                 kstat_install(ksp);
13204         }
13205         ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13206             KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13207             KSTAT_FLAG_WRITABLE);
13208         if (ksp) {
13209                 ksp->ks_update = sfmmu_kstat_percpu_update;
13210                 kstat_install(ksp);
13211         }
13212 }
13213 
13214 /* ARGSUSED */
13215 static int
13216 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13217 {
13218         struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13219         struct tsbmiss *tsbm = tsbmiss_area;
13220         struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13221         int i;
13222 
13223         ASSERT(cpu_kstat);
13224         if (rw == KSTAT_READ) {
13225                 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13226                         cpu_kstat->sf_itlb_misses = 0;
13227                         cpu_kstat->sf_dtlb_misses = 0;
13228                         cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13229                             tsbm->uprot_traps;
13230                         cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13231                             kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13232                         cpu_kstat->sf_tsb_hits = 0;
13233                         cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13234                         cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13235                 }
13236         } else {
13237                 /* KSTAT_WRITE is used to clear stats */
13238                 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13239                         tsbm->utsb_misses = 0;
13240                         tsbm->ktsb_misses = 0;
13241                         tsbm->uprot_traps = 0;
13242                         tsbm->kprot_traps = 0;
13243                         kpmtsbm->kpm_dtlb_misses = 0;
13244                         kpmtsbm->kpm_tsb_misses = 0;
13245                 }
13246         }
13247         return (0);
13248 }
13249 
13250 #ifdef  DEBUG
13251 
13252 tte_t  *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13253 
13254 /*
13255  * A tte checker. *orig_old is the value we read before cas.
13256  *      *cur is the value returned by cas.
13257  *      *new is the desired value when we do the cas.
13258  *
13259  *      *hmeblkp is currently unused.
13260  */
13261 
13262 /* ARGSUSED */
13263 void
13264 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13265 {
13266         pfn_t i, j, k;
13267         int cpuid = CPU->cpu_id;
13268 
13269         gorig[cpuid] = orig_old;
13270         gcur[cpuid] = cur;
13271         gnew[cpuid] = new;
13272 
13273 #ifdef lint
13274         hmeblkp = hmeblkp;
13275 #endif
13276 
13277         if (TTE_IS_VALID(orig_old)) {
13278                 if (TTE_IS_VALID(cur)) {
13279                         i = TTE_TO_TTEPFN(orig_old);
13280                         j = TTE_TO_TTEPFN(cur);
13281                         k = TTE_TO_TTEPFN(new);
13282                         if (i != j) {
13283                                 /* remap error? */
13284                                 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13285                         }
13286 
13287                         if (i != k) {
13288                                 /* remap error? */
13289                                 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13290                         }
13291                 } else {
13292                         if (TTE_IS_VALID(new)) {
13293                                 panic("chk_tte: invalid cur? ");
13294                         }
13295 
13296                         i = TTE_TO_TTEPFN(orig_old);
13297                         k = TTE_TO_TTEPFN(new);
13298                         if (i != k) {
13299                                 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13300                         }
13301                 }
13302         } else {
13303                 if (TTE_IS_VALID(cur)) {
13304                         j = TTE_TO_TTEPFN(cur);
13305                         if (TTE_IS_VALID(new)) {
13306                                 k = TTE_TO_TTEPFN(new);
13307                                 if (j != k) {
13308                                         panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13309                                             j, k);
13310                                 }
13311                         } else {
13312                                 panic("chk_tte: why here?");
13313                         }
13314                 } else {
13315                         if (!TTE_IS_VALID(new)) {
13316                                 panic("chk_tte: why here2 ?");
13317                         }
13318                 }
13319         }
13320 }
13321 
13322 #endif /* DEBUG */
13323 
13324 extern void prefetch_tsbe_read(struct tsbe *);
13325 extern void prefetch_tsbe_write(struct tsbe *);
13326 
13327 
13328 /*
13329  * We want to prefetch 7 cache lines ahead for our read prefetch.  This gives
13330  * us optimal performance on Cheetah+.  You can only have 8 outstanding
13331  * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13332  * prefetch to make the most utilization of the prefetch capability.
13333  */
13334 #define TSBE_PREFETCH_STRIDE (7)
13335 
13336 void
13337 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13338 {
13339         int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13340         int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13341         int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13342         int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13343         struct tsbe *old;
13344         struct tsbe *new;
13345         struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13346         uint64_t va;
13347         int new_offset;
13348         int i;
13349         int vpshift;
13350         int last_prefetch;
13351 
13352         if (old_bytes == new_bytes) {
13353                 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13354         } else {
13355 
13356                 /*
13357                  * A TSBE is 16 bytes which means there are four TSBE's per
13358                  * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13359                  */
13360                 old = (struct tsbe *)old_tsbinfo->tsb_va;
13361                 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13362                 for (i = 0; i < old_entries; i++, old++) {
13363                         if (((i & (4-1)) == 0) && (i < last_prefetch))
13364                                 prefetch_tsbe_read(old);
13365                         if (!old->tte_tag.tag_invalid) {
13366                                 /*
13367                                  * We have a valid TTE to remap.  Check the
13368                                  * size.  We won't remap 64K or 512K TTEs
13369                                  * because they span more than one TSB entry
13370                                  * and are indexed using an 8K virt. page.
13371                                  * Ditto for 32M and 256M TTEs.
13372                                  */
13373                                 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13374                                     TTE_CSZ(&old->tte_data) == TTE512K)
13375                                         continue;
13376                                 if (mmu_page_sizes == max_mmu_page_sizes) {
13377                                         if (TTE_CSZ(&old->tte_data) == TTE32M ||
13378                                             TTE_CSZ(&old->tte_data) == TTE256M)
13379                                                 continue;
13380                                 }
13381 
13382                                 /* clear the lower 22 bits of the va */
13383                                 va = *(uint64_t *)old << 22;
13384                                 /* turn va into a virtual pfn */
13385                                 va >>= 22 - TSB_START_SIZE;
13386                                 /*
13387                                  * or in bits from the offset in the tsb
13388                                  * to get the real virtual pfn. These
13389                                  * correspond to bits [21:13] in the va
13390                                  */
13391                                 vpshift =
13392                                     TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13393                                     0x1ff;
13394                                 va |= (i << vpshift);
13395                                 va >>= vpshift;
13396                                 new_offset = va & (new_entries - 1);
13397                                 new = new_base + new_offset;
13398                                 prefetch_tsbe_write(new);
13399                                 *new = *old;
13400                         }
13401                 }
13402         }
13403 }
13404 
13405 /*
13406  * unused in sfmmu
13407  */
13408 void
13409 hat_dump(void)
13410 {
13411 }
13412 
13413 /*
13414  * Called when a thread is exiting and we have switched to the kernel address
13415  * space.  Perform the same VM initialization resume() uses when switching
13416  * processes.
13417  *
13418  * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13419  * we call it anyway in case the semantics change in the future.
13420  */
13421 /*ARGSUSED*/
13422 void
13423 hat_thread_exit(kthread_t *thd)
13424 {
13425         uint_t pgsz_cnum;
13426         uint_t pstate_save;
13427 
13428         ASSERT(thd->t_procp->p_as == &kas);
13429 
13430         pgsz_cnum = KCONTEXT;
13431 #ifdef sun4u
13432         pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13433 #endif
13434 
13435         /*
13436          * Note that sfmmu_load_mmustate() is currently a no-op for
13437          * kernel threads. We need to disable interrupts here,
13438          * simply because otherwise sfmmu_load_mmustate() would panic
13439          * if the caller does not disable interrupts.
13440          */
13441         pstate_save = sfmmu_disable_intrs();
13442 
13443         /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13444         sfmmu_setctx_sec(pgsz_cnum);
13445         sfmmu_load_mmustate(ksfmmup);
13446         sfmmu_enable_intrs(pstate_save);
13447 }
13448 
13449 
13450 /*
13451  * SRD support
13452  */
13453 #define SRD_HASH_FUNCTION(vp)   (((((uintptr_t)(vp)) >> 4) ^ \
13454                                     (((uintptr_t)(vp)) >> 11)) & \
13455                                     srd_hashmask)
13456 
13457 /*
13458  * Attach the process to the srd struct associated with the exec vnode
13459  * from which the process is started.
13460  */
13461 void
13462 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13463 {
13464         uint_t hash = SRD_HASH_FUNCTION(evp);
13465         sf_srd_t *srdp;
13466         sf_srd_t *newsrdp;
13467 
13468         ASSERT(sfmmup != ksfmmup);
13469         ASSERT(sfmmup->sfmmu_srdp == NULL);
13470 
13471         if (!shctx_on) {
13472                 return;
13473         }
13474 
13475         VN_HOLD(evp);
13476 
13477         if (srd_buckets[hash].srdb_srdp != NULL) {
13478                 mutex_enter(&srd_buckets[hash].srdb_lock);
13479                 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13480                     srdp = srdp->srd_hash) {
13481                         if (srdp->srd_evp == evp) {
13482                                 ASSERT(srdp->srd_refcnt >= 0);
13483                                 sfmmup->sfmmu_srdp = srdp;
13484                                 atomic_inc_32(
13485                                     (volatile uint_t *)&srdp->srd_refcnt);
13486                                 mutex_exit(&srd_buckets[hash].srdb_lock);
13487                                 return;
13488                         }
13489                 }
13490                 mutex_exit(&srd_buckets[hash].srdb_lock);
13491         }
13492         newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13493         ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13494 
13495         newsrdp->srd_evp = evp;
13496         newsrdp->srd_refcnt = 1;
13497         newsrdp->srd_hmergnfree = NULL;
13498         newsrdp->srd_ismrgnfree = NULL;
13499 
13500         mutex_enter(&srd_buckets[hash].srdb_lock);
13501         for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13502             srdp = srdp->srd_hash) {
13503                 if (srdp->srd_evp == evp) {
13504                         ASSERT(srdp->srd_refcnt >= 0);
13505                         sfmmup->sfmmu_srdp = srdp;
13506                         atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13507                         mutex_exit(&srd_buckets[hash].srdb_lock);
13508                         kmem_cache_free(srd_cache, newsrdp);
13509                         return;
13510                 }
13511         }
13512         newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13513         srd_buckets[hash].srdb_srdp = newsrdp;
13514         sfmmup->sfmmu_srdp = newsrdp;
13515 
13516         mutex_exit(&srd_buckets[hash].srdb_lock);
13517 
13518 }
13519 
13520 static void
13521 sfmmu_leave_srd(sfmmu_t *sfmmup)
13522 {
13523         vnode_t *evp;
13524         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13525         uint_t hash;
13526         sf_srd_t **prev_srdpp;
13527         sf_region_t *rgnp;
13528         sf_region_t *nrgnp;
13529 #ifdef DEBUG
13530         int rgns = 0;
13531 #endif
13532         int i;
13533 
13534         ASSERT(sfmmup != ksfmmup);
13535         ASSERT(srdp != NULL);
13536         ASSERT(srdp->srd_refcnt > 0);
13537         ASSERT(sfmmup->sfmmu_scdp == NULL);
13538         ASSERT(sfmmup->sfmmu_free == 1);
13539 
13540         sfmmup->sfmmu_srdp = NULL;
13541         evp = srdp->srd_evp;
13542         ASSERT(evp != NULL);
13543         if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13544                 VN_RELE(evp);
13545                 return;
13546         }
13547 
13548         hash = SRD_HASH_FUNCTION(evp);
13549         mutex_enter(&srd_buckets[hash].srdb_lock);
13550         for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13551             (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13552                 if (srdp->srd_evp == evp) {
13553                         break;
13554                 }
13555         }
13556         if (srdp == NULL || srdp->srd_refcnt) {
13557                 mutex_exit(&srd_buckets[hash].srdb_lock);
13558                 VN_RELE(evp);
13559                 return;
13560         }
13561         *prev_srdpp = srdp->srd_hash;
13562         mutex_exit(&srd_buckets[hash].srdb_lock);
13563 
13564         ASSERT(srdp->srd_refcnt == 0);
13565         VN_RELE(evp);
13566 
13567 #ifdef DEBUG
13568         for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13569                 ASSERT(srdp->srd_rgnhash[i] == NULL);
13570         }
13571 #endif /* DEBUG */
13572 
13573         /* free each hme regions in the srd */
13574         for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13575                 nrgnp = rgnp->rgn_next;
13576                 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13577                 ASSERT(rgnp->rgn_refcnt == 0);
13578                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13579                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13580                 ASSERT(rgnp->rgn_hmeflags == 0);
13581                 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13582 #ifdef DEBUG
13583                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13584                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13585                 }
13586                 rgns++;
13587 #endif /* DEBUG */
13588                 kmem_cache_free(region_cache, rgnp);
13589         }
13590         ASSERT(rgns == srdp->srd_next_hmerid);
13591 
13592 #ifdef DEBUG
13593         rgns = 0;
13594 #endif
13595         /* free each ism rgns in the srd */
13596         for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13597                 nrgnp = rgnp->rgn_next;
13598                 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13599                 ASSERT(rgnp->rgn_refcnt == 0);
13600                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13601                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13602                 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13603 #ifdef DEBUG
13604                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13605                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13606                 }
13607                 rgns++;
13608 #endif /* DEBUG */
13609                 kmem_cache_free(region_cache, rgnp);
13610         }
13611         ASSERT(rgns == srdp->srd_next_ismrid);
13612         ASSERT(srdp->srd_ismbusyrgns == 0);
13613         ASSERT(srdp->srd_hmebusyrgns == 0);
13614 
13615         srdp->srd_next_ismrid = 0;
13616         srdp->srd_next_hmerid = 0;
13617 
13618         bzero((void *)srdp->srd_ismrgnp,
13619             sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13620         bzero((void *)srdp->srd_hmergnp,
13621             sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13622 
13623         ASSERT(srdp->srd_scdp == NULL);
13624         kmem_cache_free(srd_cache, srdp);
13625 }
13626 
13627 /* ARGSUSED */
13628 static int
13629 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13630 {
13631         sf_srd_t *srdp = (sf_srd_t *)buf;
13632         bzero(buf, sizeof (*srdp));
13633 
13634         mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13635         mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13636         return (0);
13637 }
13638 
13639 /* ARGSUSED */
13640 static void
13641 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13642 {
13643         sf_srd_t *srdp = (sf_srd_t *)buf;
13644 
13645         mutex_destroy(&srdp->srd_mutex);
13646         mutex_destroy(&srdp->srd_scd_mutex);
13647 }
13648 
13649 /*
13650  * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13651  * at the same time for the same process and address range. This is ensured by
13652  * the fact that address space is locked as writer when a process joins the
13653  * regions. Therefore there's no need to hold an srd lock during the entire
13654  * execution of hat_join_region()/hat_leave_region().
13655  */
13656 
13657 #define RGN_HASH_FUNCTION(obj)  (((((uintptr_t)(obj)) >> 4) ^ \
13658                                     (((uintptr_t)(obj)) >> 11)) & \
13659                                         srd_rgn_hashmask)
13660 /*
13661  * This routine implements the shared context functionality required when
13662  * attaching a segment to an address space. It must be called from
13663  * hat_share() for D(ISM) segments and from segvn_create() for segments
13664  * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13665  * which is saved in the private segment data for hme segments and
13666  * the ism_map structure for ism segments.
13667  */
13668 hat_region_cookie_t
13669 hat_join_region(struct hat *sfmmup,
13670         caddr_t r_saddr,
13671         size_t r_size,
13672         void *r_obj,
13673         u_offset_t r_objoff,
13674         uchar_t r_perm,
13675         uchar_t r_pgszc,
13676         hat_rgn_cb_func_t r_cb_function,
13677         uint_t flags)
13678 {
13679         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13680         uint_t rhash;
13681         uint_t rid;
13682         hatlock_t *hatlockp;
13683         sf_region_t *rgnp;
13684         sf_region_t *new_rgnp = NULL;
13685         int i;
13686         uint16_t *nextidp;
13687         sf_region_t **freelistp;
13688         int maxids;
13689         sf_region_t **rarrp;
13690         uint16_t *busyrgnsp;
13691         ulong_t rttecnt;
13692         uchar_t tteflag;
13693         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13694         int text = (r_type == HAT_REGION_TEXT);
13695 
13696         if (srdp == NULL || r_size == 0) {
13697                 return (HAT_INVALID_REGION_COOKIE);
13698         }
13699 
13700         ASSERT(sfmmup != ksfmmup);
13701         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
13702         ASSERT(srdp->srd_refcnt > 0);
13703         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13704         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13705         ASSERT(r_pgszc < mmu_page_sizes);
13706         if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
13707             !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
13708                 panic("hat_join_region: region addr or size is not aligned\n");
13709         }
13710 
13711 
13712         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13713             SFMMU_REGION_HME;
13714         /*
13715          * Currently only support shared hmes for the read only main text
13716          * region.
13717          */
13718         if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
13719             (r_perm & PROT_WRITE))) {
13720                 return (HAT_INVALID_REGION_COOKIE);
13721         }
13722 
13723         rhash = RGN_HASH_FUNCTION(r_obj);
13724 
13725         if (r_type == SFMMU_REGION_ISM) {
13726                 nextidp = &srdp->srd_next_ismrid;
13727                 freelistp = &srdp->srd_ismrgnfree;
13728                 maxids = SFMMU_MAX_ISM_REGIONS;
13729                 rarrp = srdp->srd_ismrgnp;
13730                 busyrgnsp = &srdp->srd_ismbusyrgns;
13731         } else {
13732                 nextidp = &srdp->srd_next_hmerid;
13733                 freelistp = &srdp->srd_hmergnfree;
13734                 maxids = SFMMU_MAX_HME_REGIONS;
13735                 rarrp = srdp->srd_hmergnp;
13736                 busyrgnsp = &srdp->srd_hmebusyrgns;
13737         }
13738 
13739         mutex_enter(&srdp->srd_mutex);
13740 
13741         for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13742             rgnp = rgnp->rgn_hash) {
13743                 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
13744                     rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
13745                     rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
13746                         break;
13747                 }
13748         }
13749 
13750 rfound:
13751         if (rgnp != NULL) {
13752                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
13753                 ASSERT(rgnp->rgn_cb_function == r_cb_function);
13754                 ASSERT(rgnp->rgn_refcnt >= 0);
13755                 rid = rgnp->rgn_id;
13756                 ASSERT(rid < maxids);
13757                 ASSERT(rarrp[rid] == rgnp);
13758                 ASSERT(rid < *nextidp);
13759                 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
13760                 mutex_exit(&srdp->srd_mutex);
13761                 if (new_rgnp != NULL) {
13762                         kmem_cache_free(region_cache, new_rgnp);
13763                 }
13764                 if (r_type == SFMMU_REGION_HME) {
13765                         int myjoin =
13766                             (sfmmup == astosfmmu(curthread->t_procp->p_as));
13767 
13768                         sfmmu_link_to_hmeregion(sfmmup, rgnp);
13769                         /*
13770                          * bitmap should be updated after linking sfmmu on
13771                          * region list so that pageunload() doesn't skip
13772                          * TSB/TLB flush. As soon as bitmap is updated another
13773                          * thread in this process can already start accessing
13774                          * this region.
13775                          */
13776                         /*
13777                          * Normally ttecnt accounting is done as part of
13778                          * pagefault handling. But a process may not take any
13779                          * pagefaults on shared hmeblks created by some other
13780                          * process. To compensate for this assume that the
13781                          * entire region will end up faulted in using
13782                          * the region's pagesize.
13783                          *
13784                          */
13785                         if (r_pgszc > TTE8K) {
13786                                 tteflag = 1 << r_pgszc;
13787                                 if (disable_large_pages & tteflag) {
13788                                         tteflag = 0;
13789                                 }
13790                         } else {
13791                                 tteflag = 0;
13792                         }
13793                         if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
13794                                 hatlockp = sfmmu_hat_enter(sfmmup);
13795                                 sfmmup->sfmmu_rtteflags |= tteflag;
13796                                 sfmmu_hat_exit(hatlockp);
13797                         }
13798                         hatlockp = sfmmu_hat_enter(sfmmup);
13799 
13800                         /*
13801                          * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
13802                          * region to allow for large page allocation failure.
13803                          */
13804                         if (r_pgszc >= TTE4M) {
13805                                 sfmmup->sfmmu_tsb0_4minflcnt +=
13806                                     r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
13807                         }
13808 
13809                         /* update sfmmu_ttecnt with the shme rgn ttecnt */
13810                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
13811                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
13812                             rttecnt);
13813 
13814                         if (text && r_pgszc >= TTE4M &&
13815                             (tteflag || ((disable_large_pages >> TTE4M) &
13816                             ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
13817                             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
13818                                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
13819                         }
13820 
13821                         sfmmu_hat_exit(hatlockp);
13822                         /*
13823                          * On Panther we need to make sure TLB is programmed
13824                          * to accept 32M/256M pages.  Call
13825                          * sfmmu_check_page_sizes() now to make sure TLB is
13826                          * setup before making hmeregions visible to other
13827                          * threads.
13828                          */
13829                         sfmmu_check_page_sizes(sfmmup, 1);
13830                         hatlockp = sfmmu_hat_enter(sfmmup);
13831                         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
13832 
13833                         /*
13834                          * if context is invalid tsb miss exception code will
13835                          * call sfmmu_check_page_sizes() and update tsbmiss
13836                          * area later.
13837                          */
13838                         kpreempt_disable();
13839                         if (myjoin &&
13840                             (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
13841                             != INVALID_CONTEXT)) {
13842                                 struct tsbmiss *tsbmp;
13843 
13844                                 tsbmp = &tsbmiss_area[CPU->cpu_id];
13845                                 ASSERT(sfmmup == tsbmp->usfmmup);
13846                                 BT_SET(tsbmp->shmermap, rid);
13847                                 if (r_pgszc > TTE64K) {
13848                                         tsbmp->uhat_rtteflags |= tteflag;
13849                                 }
13850 
13851                         }
13852                         kpreempt_enable();
13853 
13854                         sfmmu_hat_exit(hatlockp);
13855                         ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
13856                             HAT_INVALID_REGION_COOKIE);
13857                 } else {
13858                         hatlockp = sfmmu_hat_enter(sfmmup);
13859                         SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
13860                         sfmmu_hat_exit(hatlockp);
13861                 }
13862                 ASSERT(rid < maxids);
13863 
13864                 if (r_type == SFMMU_REGION_ISM) {
13865                         sfmmu_find_scd(sfmmup);
13866                 }
13867                 return ((hat_region_cookie_t)((uint64_t)rid));
13868         }
13869 
13870         ASSERT(new_rgnp == NULL);
13871 
13872         if (*busyrgnsp >= maxids) {
13873                 mutex_exit(&srdp->srd_mutex);
13874                 return (HAT_INVALID_REGION_COOKIE);
13875         }
13876 
13877         ASSERT(MUTEX_HELD(&srdp->srd_mutex));
13878         if (*freelistp != NULL) {
13879                 rgnp = *freelistp;
13880                 *freelistp = rgnp->rgn_next;
13881                 ASSERT(rgnp->rgn_id < *nextidp);
13882                 ASSERT(rgnp->rgn_id < maxids);
13883                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13884                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
13885                     == r_type);
13886                 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
13887                 ASSERT(rgnp->rgn_hmeflags == 0);
13888         } else {
13889                 /*
13890                  * release local locks before memory allocation.
13891                  */
13892                 mutex_exit(&srdp->srd_mutex);
13893 
13894                 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
13895 
13896                 mutex_enter(&srdp->srd_mutex);
13897                 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13898                     rgnp = rgnp->rgn_hash) {
13899                         if (rgnp->rgn_saddr == r_saddr &&
13900                             rgnp->rgn_size == r_size &&
13901                             rgnp->rgn_obj == r_obj &&
13902                             rgnp->rgn_objoff == r_objoff &&
13903                             rgnp->rgn_perm == r_perm &&
13904                             rgnp->rgn_pgszc == r_pgszc) {
13905                                 break;
13906                         }
13907                 }
13908                 if (rgnp != NULL) {
13909                         goto rfound;
13910                 }
13911 
13912                 if (*nextidp >= maxids) {
13913                         mutex_exit(&srdp->srd_mutex);
13914                         goto fail;
13915                 }
13916                 rgnp = new_rgnp;
13917                 new_rgnp = NULL;
13918                 rgnp->rgn_id = (*nextidp)++;
13919                 ASSERT(rgnp->rgn_id < maxids);
13920                 ASSERT(rarrp[rgnp->rgn_id] == NULL);
13921                 rarrp[rgnp->rgn_id] = rgnp;
13922         }
13923 
13924         ASSERT(rgnp->rgn_sfmmu_head == NULL);
13925         ASSERT(rgnp->rgn_hmeflags == 0);
13926 #ifdef DEBUG
13927         for (i = 0; i < MMU_PAGE_SIZES; i++) {
13928                 ASSERT(rgnp->rgn_ttecnt[i] == 0);
13929         }
13930 #endif
13931         rgnp->rgn_saddr = r_saddr;
13932         rgnp->rgn_size = r_size;
13933         rgnp->rgn_obj = r_obj;
13934         rgnp->rgn_objoff = r_objoff;
13935         rgnp->rgn_perm = r_perm;
13936         rgnp->rgn_pgszc = r_pgszc;
13937         rgnp->rgn_flags = r_type;
13938         rgnp->rgn_refcnt = 0;
13939         rgnp->rgn_cb_function = r_cb_function;
13940         rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
13941         srdp->srd_rgnhash[rhash] = rgnp;
13942         (*busyrgnsp)++;
13943         ASSERT(*busyrgnsp <= maxids);
13944         goto rfound;
13945 
13946 fail:
13947         ASSERT(new_rgnp != NULL);
13948         kmem_cache_free(region_cache, new_rgnp);
13949         return (HAT_INVALID_REGION_COOKIE);
13950 }
13951 
13952 /*
13953  * This function implements the shared context functionality required
13954  * when detaching a segment from an address space. It must be called
13955  * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
13956  * for segments with a valid region_cookie.
13957  * It will also be called from all seg_vn routines which change a
13958  * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
13959  * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
13960  * from segvn_fault().
13961  */
13962 void
13963 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
13964 {
13965         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13966         sf_scd_t *scdp;
13967         uint_t rhash;
13968         uint_t rid = (uint_t)((uint64_t)rcookie);
13969         hatlock_t *hatlockp = NULL;
13970         sf_region_t *rgnp;
13971         sf_region_t **prev_rgnpp;
13972         sf_region_t *cur_rgnp;
13973         void *r_obj;
13974         int i;
13975         caddr_t r_saddr;
13976         caddr_t r_eaddr;
13977         size_t  r_size;
13978         uchar_t r_pgszc;
13979         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13980 
13981         ASSERT(sfmmup != ksfmmup);
13982         ASSERT(srdp != NULL);
13983         ASSERT(srdp->srd_refcnt > 0);
13984         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13985         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13986         ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
13987 
13988         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13989             SFMMU_REGION_HME;
13990 
13991         if (r_type == SFMMU_REGION_ISM) {
13992                 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
13993                 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
13994                 rgnp = srdp->srd_ismrgnp[rid];
13995         } else {
13996                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
13997                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
13998                 rgnp = srdp->srd_hmergnp[rid];
13999         }
14000         ASSERT(rgnp != NULL);
14001         ASSERT(rgnp->rgn_id == rid);
14002         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14003         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14004         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14005 
14006         if (sfmmup->sfmmu_free) {
14007                 ulong_t rttecnt;
14008                 r_pgszc = rgnp->rgn_pgszc;
14009                 r_size = rgnp->rgn_size;
14010 
14011                 ASSERT(sfmmup->sfmmu_scdp == NULL);
14012                 if (r_type == SFMMU_REGION_ISM) {
14013                         SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14014                 } else {
14015                         /* update shme rgns ttecnt in sfmmu_ttecnt */
14016                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14017                         ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14018 
14019                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14020                             -rttecnt);
14021 
14022                         SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14023                 }
14024         } else if (r_type == SFMMU_REGION_ISM) {
14025                 hatlockp = sfmmu_hat_enter(sfmmup);
14026                 ASSERT(rid < srdp->srd_next_ismrid);
14027                 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14028                 scdp = sfmmup->sfmmu_scdp;
14029                 if (scdp != NULL &&
14030                     SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14031                         sfmmu_leave_scd(sfmmup, r_type);
14032                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14033                 }
14034                 sfmmu_hat_exit(hatlockp);
14035         } else {
14036                 ulong_t rttecnt;
14037                 r_pgszc = rgnp->rgn_pgszc;
14038                 r_saddr = rgnp->rgn_saddr;
14039                 r_size = rgnp->rgn_size;
14040                 r_eaddr = r_saddr + r_size;
14041 
14042                 ASSERT(r_type == SFMMU_REGION_HME);
14043                 hatlockp = sfmmu_hat_enter(sfmmup);
14044                 ASSERT(rid < srdp->srd_next_hmerid);
14045                 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14046 
14047                 /*
14048                  * If region is part of an SCD call sfmmu_leave_scd().
14049                  * Otherwise if process is not exiting and has valid context
14050                  * just drop the context on the floor to lose stale TLB
14051                  * entries and force the update of tsb miss area to reflect
14052                  * the new region map. After that clean our TSB entries.
14053                  */
14054                 scdp = sfmmup->sfmmu_scdp;
14055                 if (scdp != NULL &&
14056                     SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14057                         sfmmu_leave_scd(sfmmup, r_type);
14058                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14059                 }
14060                 sfmmu_invalidate_ctx(sfmmup);
14061 
14062                 i = TTE8K;
14063                 while (i < mmu_page_sizes) {
14064                         if (rgnp->rgn_ttecnt[i] != 0) {
14065                                 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14066                                     r_eaddr, i);
14067                                 if (i < TTE4M) {
14068                                         i = TTE4M;
14069                                         continue;
14070                                 } else {
14071                                         break;
14072                                 }
14073                         }
14074                         i++;
14075                 }
14076                 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14077                 if (r_pgszc >= TTE4M) {
14078                         rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14079                         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14080                             rttecnt);
14081                         sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14082                 }
14083 
14084                 /* update shme rgns ttecnt in sfmmu_ttecnt */
14085                 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14086                 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14087                 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14088 
14089                 sfmmu_hat_exit(hatlockp);
14090                 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14091                         /* sfmmup left the scd, grow private tsb */
14092                         sfmmu_check_page_sizes(sfmmup, 1);
14093                 } else {
14094                         sfmmu_check_page_sizes(sfmmup, 0);
14095                 }
14096         }
14097 
14098         if (r_type == SFMMU_REGION_HME) {
14099                 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14100         }
14101 
14102         r_obj = rgnp->rgn_obj;
14103         if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14104                 return;
14105         }
14106 
14107         /*
14108          * looks like nobody uses this region anymore. Free it.
14109          */
14110         rhash = RGN_HASH_FUNCTION(r_obj);
14111         mutex_enter(&srdp->srd_mutex);
14112         for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14113             (cur_rgnp = *prev_rgnpp) != NULL;
14114             prev_rgnpp = &cur_rgnp->rgn_hash) {
14115                 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14116                         break;
14117                 }
14118         }
14119 
14120         if (cur_rgnp == NULL) {
14121                 mutex_exit(&srdp->srd_mutex);
14122                 return;
14123         }
14124 
14125         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14126         *prev_rgnpp = rgnp->rgn_hash;
14127         if (r_type == SFMMU_REGION_ISM) {
14128                 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14129                 ASSERT(rid < srdp->srd_next_ismrid);
14130                 rgnp->rgn_next = srdp->srd_ismrgnfree;
14131                 srdp->srd_ismrgnfree = rgnp;
14132                 ASSERT(srdp->srd_ismbusyrgns > 0);
14133                 srdp->srd_ismbusyrgns--;
14134                 mutex_exit(&srdp->srd_mutex);
14135                 return;
14136         }
14137         mutex_exit(&srdp->srd_mutex);
14138 
14139         /*
14140          * Destroy region's hmeblks.
14141          */
14142         sfmmu_unload_hmeregion(srdp, rgnp);
14143 
14144         rgnp->rgn_hmeflags = 0;
14145 
14146         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14147         ASSERT(rgnp->rgn_id == rid);
14148         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14149                 rgnp->rgn_ttecnt[i] = 0;
14150         }
14151         rgnp->rgn_flags |= SFMMU_REGION_FREE;
14152         mutex_enter(&srdp->srd_mutex);
14153         ASSERT(rid < srdp->srd_next_hmerid);
14154         rgnp->rgn_next = srdp->srd_hmergnfree;
14155         srdp->srd_hmergnfree = rgnp;
14156         ASSERT(srdp->srd_hmebusyrgns > 0);
14157         srdp->srd_hmebusyrgns--;
14158         mutex_exit(&srdp->srd_mutex);
14159 }
14160 
14161 /*
14162  * For now only called for hmeblk regions and not for ISM regions.
14163  */
14164 void
14165 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14166 {
14167         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14168         uint_t rid = (uint_t)((uint64_t)rcookie);
14169         sf_region_t *rgnp;
14170         sf_rgn_link_t *rlink;
14171         sf_rgn_link_t *hrlink;
14172         ulong_t rttecnt;
14173 
14174         ASSERT(sfmmup != ksfmmup);
14175         ASSERT(srdp != NULL);
14176         ASSERT(srdp->srd_refcnt > 0);
14177 
14178         ASSERT(rid < srdp->srd_next_hmerid);
14179         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14180         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14181 
14182         rgnp = srdp->srd_hmergnp[rid];
14183         ASSERT(rgnp->rgn_refcnt > 0);
14184         ASSERT(rgnp->rgn_id == rid);
14185         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14186         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14187 
14188         atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14189 
14190         /* LINTED: constant in conditional context */
14191         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14192         ASSERT(rlink != NULL);
14193         mutex_enter(&rgnp->rgn_mutex);
14194         ASSERT(rgnp->rgn_sfmmu_head != NULL);
14195         /* LINTED: constant in conditional context */
14196         SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14197         ASSERT(hrlink != NULL);
14198         ASSERT(hrlink->prev == NULL);
14199         rlink->next = rgnp->rgn_sfmmu_head;
14200         rlink->prev = NULL;
14201         hrlink->prev = sfmmup;
14202         /*
14203          * make sure rlink's next field is correct
14204          * before making this link visible.
14205          */
14206         membar_stst();
14207         rgnp->rgn_sfmmu_head = sfmmup;
14208         mutex_exit(&rgnp->rgn_mutex);
14209 
14210         /* update sfmmu_ttecnt with the shme rgn ttecnt */
14211         rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14212         atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14213         /* update tsb0 inflation count */
14214         if (rgnp->rgn_pgszc >= TTE4M) {
14215                 sfmmup->sfmmu_tsb0_4minflcnt +=
14216                     rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14217         }
14218         /*
14219          * Update regionid bitmask without hat lock since no other thread
14220          * can update this region bitmask right now.
14221          */
14222         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14223 }
14224 
14225 /* ARGSUSED */
14226 static int
14227 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14228 {
14229         sf_region_t *rgnp = (sf_region_t *)buf;
14230         bzero(buf, sizeof (*rgnp));
14231 
14232         mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14233 
14234         return (0);
14235 }
14236 
14237 /* ARGSUSED */
14238 static void
14239 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14240 {
14241         sf_region_t *rgnp = (sf_region_t *)buf;
14242         mutex_destroy(&rgnp->rgn_mutex);
14243 }
14244 
14245 static int
14246 sfrgnmap_isnull(sf_region_map_t *map)
14247 {
14248         int i;
14249 
14250         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14251                 if (map->bitmap[i] != 0) {
14252                         return (0);
14253                 }
14254         }
14255         return (1);
14256 }
14257 
14258 static int
14259 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14260 {
14261         int i;
14262 
14263         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14264                 if (map->bitmap[i] != 0) {
14265                         return (0);
14266                 }
14267         }
14268         return (1);
14269 }
14270 
14271 #ifdef DEBUG
14272 static void
14273 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14274 {
14275         sfmmu_t *sp;
14276         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14277 
14278         for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14279                 ASSERT(srdp == sp->sfmmu_srdp);
14280                 if (sp == sfmmup) {
14281                         if (onlist) {
14282                                 return;
14283                         } else {
14284                                 panic("shctx: sfmmu 0x%p found on scd"
14285                                     "list 0x%p", (void *)sfmmup,
14286                                     (void *)*headp);
14287                         }
14288                 }
14289         }
14290         if (onlist) {
14291                 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14292                     (void *)sfmmup, (void *)*headp);
14293         } else {
14294                 return;
14295         }
14296 }
14297 #else /* DEBUG */
14298 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14299 #endif /* DEBUG */
14300 
14301 /*
14302  * Removes an sfmmu from the SCD sfmmu list.
14303  */
14304 static void
14305 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14306 {
14307         ASSERT(sfmmup->sfmmu_srdp != NULL);
14308         check_scd_sfmmu_list(headp, sfmmup, 1);
14309         if (sfmmup->sfmmu_scd_link.prev != NULL) {
14310                 ASSERT(*headp != sfmmup);
14311                 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14312                     sfmmup->sfmmu_scd_link.next;
14313         } else {
14314                 ASSERT(*headp == sfmmup);
14315                 *headp = sfmmup->sfmmu_scd_link.next;
14316         }
14317         if (sfmmup->sfmmu_scd_link.next != NULL) {
14318                 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14319                     sfmmup->sfmmu_scd_link.prev;
14320         }
14321 }
14322 
14323 
14324 /*
14325  * Adds an sfmmu to the start of the queue.
14326  */
14327 static void
14328 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14329 {
14330         check_scd_sfmmu_list(headp, sfmmup, 0);
14331         sfmmup->sfmmu_scd_link.prev = NULL;
14332         sfmmup->sfmmu_scd_link.next = *headp;
14333         if (*headp != NULL)
14334                 (*headp)->sfmmu_scd_link.prev = sfmmup;
14335         *headp = sfmmup;
14336 }
14337 
14338 /*
14339  * Remove an scd from the start of the queue.
14340  */
14341 static void
14342 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14343 {
14344         if (scdp->scd_prev != NULL) {
14345                 ASSERT(*headp != scdp);
14346                 scdp->scd_prev->scd_next = scdp->scd_next;
14347         } else {
14348                 ASSERT(*headp == scdp);
14349                 *headp = scdp->scd_next;
14350         }
14351 
14352         if (scdp->scd_next != NULL) {
14353                 scdp->scd_next->scd_prev = scdp->scd_prev;
14354         }
14355 }
14356 
14357 /*
14358  * Add an scd to the start of the queue.
14359  */
14360 static void
14361 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14362 {
14363         scdp->scd_prev = NULL;
14364         scdp->scd_next = *headp;
14365         if (*headp != NULL) {
14366                 (*headp)->scd_prev = scdp;
14367         }
14368         *headp = scdp;
14369 }
14370 
14371 static int
14372 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14373 {
14374         uint_t rid;
14375         uint_t i;
14376         uint_t j;
14377         ulong_t w;
14378         sf_region_t *rgnp;
14379         ulong_t tte8k_cnt = 0;
14380         ulong_t tte4m_cnt = 0;
14381         uint_t tsb_szc;
14382         sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14383         sfmmu_t *ism_hatid;
14384         struct tsb_info *newtsb;
14385         int szc;
14386 
14387         ASSERT(srdp != NULL);
14388 
14389         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14390                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14391                         continue;
14392                 }
14393                 j = 0;
14394                 while (w) {
14395                         if (!(w & 0x1)) {
14396                                 j++;
14397                                 w >>= 1;
14398                                 continue;
14399                         }
14400                         rid = (i << BT_ULSHIFT) | j;
14401                         j++;
14402                         w >>= 1;
14403 
14404                         if (rid < SFMMU_MAX_HME_REGIONS) {
14405                                 rgnp = srdp->srd_hmergnp[rid];
14406                                 ASSERT(rgnp->rgn_id == rid);
14407                                 ASSERT(rgnp->rgn_refcnt > 0);
14408 
14409                                 if (rgnp->rgn_pgszc < TTE4M) {
14410                                         tte8k_cnt += rgnp->rgn_size >>
14411                                             TTE_PAGE_SHIFT(TTE8K);
14412                                 } else {
14413                                         ASSERT(rgnp->rgn_pgszc >= TTE4M);
14414                                         tte4m_cnt += rgnp->rgn_size >>
14415                                             TTE_PAGE_SHIFT(TTE4M);
14416                                         /*
14417                                          * Inflate SCD tsb0 by preallocating
14418                                          * 1/4 8k ttecnt for 4M regions to
14419                                          * allow for lgpg alloc failure.
14420                                          */
14421                                         tte8k_cnt += rgnp->rgn_size >>
14422                                             (TTE_PAGE_SHIFT(TTE8K) + 2);
14423                                 }
14424                         } else {
14425                                 rid -= SFMMU_MAX_HME_REGIONS;
14426                                 rgnp = srdp->srd_ismrgnp[rid];
14427                                 ASSERT(rgnp->rgn_id == rid);
14428                                 ASSERT(rgnp->rgn_refcnt > 0);
14429 
14430                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14431                                 ASSERT(ism_hatid->sfmmu_ismhat);
14432 
14433                                 for (szc = 0; szc < TTE4M; szc++) {
14434                                         tte8k_cnt +=
14435                                             ism_hatid->sfmmu_ttecnt[szc] <<
14436                                             TTE_BSZS_SHIFT(szc);
14437                                 }
14438 
14439                                 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14440                                 if (rgnp->rgn_pgszc >= TTE4M) {
14441                                         tte4m_cnt += rgnp->rgn_size >>
14442                                             TTE_PAGE_SHIFT(TTE4M);
14443                                 }
14444                         }
14445                 }
14446         }
14447 
14448         tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14449 
14450         /* Allocate both the SCD TSBs here. */
14451         if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14452             tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14453             (tsb_szc <= TSB_4M_SZCODE ||
14454             sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14455             TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14456             TSB_ALLOC, scsfmmup))) {
14457 
14458                 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14459                 return (TSB_ALLOCFAIL);
14460         } else {
14461                 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14462 
14463                 if (tte4m_cnt) {
14464                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14465                         if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14466                             TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14467                             (tsb_szc <= TSB_4M_SZCODE ||
14468                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14469                             TSB4M|TSB32M|TSB256M,
14470                             TSB_ALLOC, scsfmmup))) {
14471                                 /*
14472                                  * If we fail to allocate the 2nd shared tsb,
14473                                  * just free the 1st tsb, return failure.
14474                                  */
14475                                 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14476                                 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14477                                 return (TSB_ALLOCFAIL);
14478                         } else {
14479                                 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14480                                 newtsb->tsb_flags |= TSB_SHAREDCTX;
14481                                 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14482                                 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14483                         }
14484                 }
14485                 SFMMU_STAT(sf_scd_1sttsb_alloc);
14486         }
14487         return (TSB_SUCCESS);
14488 }
14489 
14490 static void
14491 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14492 {
14493         while (scd_sfmmu->sfmmu_tsb != NULL) {
14494                 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14495                 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14496                 scd_sfmmu->sfmmu_tsb = next;
14497         }
14498 }
14499 
14500 /*
14501  * Link the sfmmu onto the hme region list.
14502  */
14503 void
14504 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14505 {
14506         uint_t rid;
14507         sf_rgn_link_t *rlink;
14508         sfmmu_t *head;
14509         sf_rgn_link_t *hrlink;
14510 
14511         rid = rgnp->rgn_id;
14512         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14513 
14514         /* LINTED: constant in conditional context */
14515         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14516         ASSERT(rlink != NULL);
14517         mutex_enter(&rgnp->rgn_mutex);
14518         if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14519                 rlink->next = NULL;
14520                 rlink->prev = NULL;
14521                 /*
14522                  * make sure rlink's next field is NULL
14523                  * before making this link visible.
14524                  */
14525                 membar_stst();
14526                 rgnp->rgn_sfmmu_head = sfmmup;
14527         } else {
14528                 /* LINTED: constant in conditional context */
14529                 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14530                 ASSERT(hrlink != NULL);
14531                 ASSERT(hrlink->prev == NULL);
14532                 rlink->next = head;
14533                 rlink->prev = NULL;
14534                 hrlink->prev = sfmmup;
14535                 /*
14536                  * make sure rlink's next field is correct
14537                  * before making this link visible.
14538                  */
14539                 membar_stst();
14540                 rgnp->rgn_sfmmu_head = sfmmup;
14541         }
14542         mutex_exit(&rgnp->rgn_mutex);
14543 }
14544 
14545 /*
14546  * Unlink the sfmmu from the hme region list.
14547  */
14548 void
14549 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14550 {
14551         uint_t rid;
14552         sf_rgn_link_t *rlink;
14553 
14554         rid = rgnp->rgn_id;
14555         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14556 
14557         /* LINTED: constant in conditional context */
14558         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14559         ASSERT(rlink != NULL);
14560         mutex_enter(&rgnp->rgn_mutex);
14561         if (rgnp->rgn_sfmmu_head == sfmmup) {
14562                 sfmmu_t *next = rlink->next;
14563                 rgnp->rgn_sfmmu_head = next;
14564                 /*
14565                  * if we are stopped by xc_attention() after this
14566                  * point the forward link walking in
14567                  * sfmmu_rgntlb_demap() will work correctly since the
14568                  * head correctly points to the next element.
14569                  */
14570                 membar_stst();
14571                 rlink->next = NULL;
14572                 ASSERT(rlink->prev == NULL);
14573                 if (next != NULL) {
14574                         sf_rgn_link_t *nrlink;
14575                         /* LINTED: constant in conditional context */
14576                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14577                         ASSERT(nrlink != NULL);
14578                         ASSERT(nrlink->prev == sfmmup);
14579                         nrlink->prev = NULL;
14580                 }
14581         } else {
14582                 sfmmu_t *next = rlink->next;
14583                 sfmmu_t *prev = rlink->prev;
14584                 sf_rgn_link_t *prlink;
14585 
14586                 ASSERT(prev != NULL);
14587                 /* LINTED: constant in conditional context */
14588                 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14589                 ASSERT(prlink != NULL);
14590                 ASSERT(prlink->next == sfmmup);
14591                 prlink->next = next;
14592                 /*
14593                  * if we are stopped by xc_attention()
14594                  * after this point the forward link walking
14595                  * will work correctly since the prev element
14596                  * correctly points to the next element.
14597                  */
14598                 membar_stst();
14599                 rlink->next = NULL;
14600                 rlink->prev = NULL;
14601                 if (next != NULL) {
14602                         sf_rgn_link_t *nrlink;
14603                         /* LINTED: constant in conditional context */
14604                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14605                         ASSERT(nrlink != NULL);
14606                         ASSERT(nrlink->prev == sfmmup);
14607                         nrlink->prev = prev;
14608                 }
14609         }
14610         mutex_exit(&rgnp->rgn_mutex);
14611 }
14612 
14613 /*
14614  * Link scd sfmmu onto ism or hme region list for each region in the
14615  * scd region map.
14616  */
14617 void
14618 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14619 {
14620         uint_t rid;
14621         uint_t i;
14622         uint_t j;
14623         ulong_t w;
14624         sf_region_t *rgnp;
14625         sfmmu_t *scsfmmup;
14626 
14627         scsfmmup = scdp->scd_sfmmup;
14628         ASSERT(scsfmmup->sfmmu_scdhat);
14629         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14630                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14631                         continue;
14632                 }
14633                 j = 0;
14634                 while (w) {
14635                         if (!(w & 0x1)) {
14636                                 j++;
14637                                 w >>= 1;
14638                                 continue;
14639                         }
14640                         rid = (i << BT_ULSHIFT) | j;
14641                         j++;
14642                         w >>= 1;
14643 
14644                         if (rid < SFMMU_MAX_HME_REGIONS) {
14645                                 rgnp = srdp->srd_hmergnp[rid];
14646                                 ASSERT(rgnp->rgn_id == rid);
14647                                 ASSERT(rgnp->rgn_refcnt > 0);
14648                                 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14649                         } else {
14650                                 sfmmu_t *ism_hatid = NULL;
14651                                 ism_ment_t *ism_ment;
14652                                 rid -= SFMMU_MAX_HME_REGIONS;
14653                                 rgnp = srdp->srd_ismrgnp[rid];
14654                                 ASSERT(rgnp->rgn_id == rid);
14655                                 ASSERT(rgnp->rgn_refcnt > 0);
14656 
14657                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14658                                 ASSERT(ism_hatid->sfmmu_ismhat);
14659                                 ism_ment = &scdp->scd_ism_links[rid];
14660                                 ism_ment->iment_hat = scsfmmup;
14661                                 ism_ment->iment_base_va = rgnp->rgn_saddr;
14662                                 mutex_enter(&ism_mlist_lock);
14663                                 iment_add(ism_ment, ism_hatid);
14664                                 mutex_exit(&ism_mlist_lock);
14665 
14666                         }
14667                 }
14668         }
14669 }
14670 /*
14671  * Unlink scd sfmmu from ism or hme region list for each region in the
14672  * scd region map.
14673  */
14674 void
14675 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14676 {
14677         uint_t rid;
14678         uint_t i;
14679         uint_t j;
14680         ulong_t w;
14681         sf_region_t *rgnp;
14682         sfmmu_t *scsfmmup;
14683 
14684         scsfmmup = scdp->scd_sfmmup;
14685         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14686                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14687                         continue;
14688                 }
14689                 j = 0;
14690                 while (w) {
14691                         if (!(w & 0x1)) {
14692                                 j++;
14693                                 w >>= 1;
14694                                 continue;
14695                         }
14696                         rid = (i << BT_ULSHIFT) | j;
14697                         j++;
14698                         w >>= 1;
14699 
14700                         if (rid < SFMMU_MAX_HME_REGIONS) {
14701                                 rgnp = srdp->srd_hmergnp[rid];
14702                                 ASSERT(rgnp->rgn_id == rid);
14703                                 ASSERT(rgnp->rgn_refcnt > 0);
14704                                 sfmmu_unlink_from_hmeregion(scsfmmup,
14705                                     rgnp);
14706 
14707                         } else {
14708                                 sfmmu_t *ism_hatid = NULL;
14709                                 ism_ment_t *ism_ment;
14710                                 rid -= SFMMU_MAX_HME_REGIONS;
14711                                 rgnp = srdp->srd_ismrgnp[rid];
14712                                 ASSERT(rgnp->rgn_id == rid);
14713                                 ASSERT(rgnp->rgn_refcnt > 0);
14714 
14715                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14716                                 ASSERT(ism_hatid->sfmmu_ismhat);
14717                                 ism_ment = &scdp->scd_ism_links[rid];
14718                                 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
14719                                 ASSERT(ism_ment->iment_base_va ==
14720                                     rgnp->rgn_saddr);
14721                                 mutex_enter(&ism_mlist_lock);
14722                                 iment_sub(ism_ment, ism_hatid);
14723                                 mutex_exit(&ism_mlist_lock);
14724 
14725                         }
14726                 }
14727         }
14728 }
14729 /*
14730  * Allocates and initialises a new SCD structure, this is called with
14731  * the srd_scd_mutex held and returns with the reference count
14732  * initialised to 1.
14733  */
14734 static sf_scd_t *
14735 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
14736 {
14737         sf_scd_t *new_scdp;
14738         sfmmu_t *scsfmmup;
14739         int i;
14740 
14741         ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
14742         new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
14743 
14744         scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
14745         new_scdp->scd_sfmmup = scsfmmup;
14746         scsfmmup->sfmmu_srdp = srdp;
14747         scsfmmup->sfmmu_scdp = new_scdp;
14748         scsfmmup->sfmmu_tsb0_4minflcnt = 0;
14749         scsfmmup->sfmmu_scdhat = 1;
14750         CPUSET_ALL(scsfmmup->sfmmu_cpusran);
14751         bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
14752 
14753         ASSERT(max_mmu_ctxdoms > 0);
14754         for (i = 0; i < max_mmu_ctxdoms; i++) {
14755                 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
14756                 scsfmmup->sfmmu_ctxs[i].gnum = 0;
14757         }
14758 
14759         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14760                 new_scdp->scd_rttecnt[i] = 0;
14761         }
14762 
14763         new_scdp->scd_region_map = *new_map;
14764         new_scdp->scd_refcnt = 1;
14765         if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
14766                 kmem_cache_free(scd_cache, new_scdp);
14767                 kmem_cache_free(sfmmuid_cache, scsfmmup);
14768                 return (NULL);
14769         }
14770         if (&mmu_init_scd) {
14771                 mmu_init_scd(new_scdp);
14772         }
14773         return (new_scdp);
14774 }
14775 
14776 /*
14777  * The first phase of a process joining an SCD. The hat structure is
14778  * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
14779  * and a cross-call with context invalidation is used to cause the
14780  * remaining work to be carried out in the sfmmu_tsbmiss_exception()
14781  * routine.
14782  */
14783 static void
14784 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
14785 {
14786         hatlock_t *hatlockp;
14787         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14788         int i;
14789         sf_scd_t *old_scdp;
14790 
14791         ASSERT(srdp != NULL);
14792         ASSERT(scdp != NULL);
14793         ASSERT(scdp->scd_refcnt > 0);
14794         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14795 
14796         if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
14797                 ASSERT(old_scdp != scdp);
14798 
14799                 mutex_enter(&old_scdp->scd_mutex);
14800                 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
14801                 mutex_exit(&old_scdp->scd_mutex);
14802                 /*
14803                  * sfmmup leaves the old scd. Update sfmmu_ttecnt to
14804                  * include the shme rgn ttecnt for rgns that
14805                  * were in the old SCD
14806                  */
14807                 for (i = 0; i < mmu_page_sizes; i++) {
14808                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14809                             old_scdp->scd_rttecnt[i]);
14810                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14811                             sfmmup->sfmmu_scdrttecnt[i]);
14812                 }
14813         }
14814 
14815         /*
14816          * Move sfmmu to the scd lists.
14817          */
14818         mutex_enter(&scdp->scd_mutex);
14819         sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
14820         mutex_exit(&scdp->scd_mutex);
14821         SF_SCD_INCR_REF(scdp);
14822 
14823         hatlockp = sfmmu_hat_enter(sfmmup);
14824         /*
14825          * For a multi-thread process, we must stop
14826          * all the other threads before joining the scd.
14827          */
14828 
14829         SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
14830 
14831         sfmmu_invalidate_ctx(sfmmup);
14832         sfmmup->sfmmu_scdp = scdp;
14833 
14834         /*
14835          * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
14836          * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
14837          */
14838         for (i = 0; i < mmu_page_sizes; i++) {
14839                 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
14840                 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
14841                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14842                     -sfmmup->sfmmu_scdrttecnt[i]);
14843         }
14844         /* update tsb0 inflation count */
14845         if (old_scdp != NULL) {
14846                 sfmmup->sfmmu_tsb0_4minflcnt +=
14847                     old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14848         }
14849         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14850             scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
14851         sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14852 
14853         sfmmu_hat_exit(hatlockp);
14854 
14855         if (old_scdp != NULL) {
14856                 SF_SCD_DECR_REF(srdp, old_scdp);
14857         }
14858 
14859 }
14860 
14861 /*
14862  * This routine is called by a process to become part of an SCD. It is called
14863  * from sfmmu_tsbmiss_exception() once most of the initial work has been
14864  * done by sfmmu_join_scd(). This routine must not drop the hat lock.
14865  */
14866 static void
14867 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
14868 {
14869         struct tsb_info *tsbinfop;
14870 
14871         ASSERT(sfmmu_hat_lock_held(sfmmup));
14872         ASSERT(sfmmup->sfmmu_scdp != NULL);
14873         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
14874         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
14875         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
14876 
14877         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
14878             tsbinfop = tsbinfop->tsb_next) {
14879                 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
14880                         continue;
14881                 }
14882                 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
14883 
14884                 sfmmu_inv_tsb(tsbinfop->tsb_va,
14885                     TSB_BYTES(tsbinfop->tsb_szc));
14886         }
14887 
14888         /* Set HAT_CTX1_FLAG for all SCD ISMs */
14889         sfmmu_ism_hatflags(sfmmup, 1);
14890 
14891         SFMMU_STAT(sf_join_scd);
14892 }
14893 
14894 /*
14895  * This routine is called in order to check if there is an SCD which matches
14896  * the process's region map if not then a new SCD may be created.
14897  */
14898 static void
14899 sfmmu_find_scd(sfmmu_t *sfmmup)
14900 {
14901         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14902         sf_scd_t *scdp, *new_scdp;
14903         int ret;
14904 
14905         ASSERT(srdp != NULL);
14906         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14907 
14908         mutex_enter(&srdp->srd_scd_mutex);
14909         for (scdp = srdp->srd_scdp; scdp != NULL;
14910             scdp = scdp->scd_next) {
14911                 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
14912                     &sfmmup->sfmmu_region_map, ret);
14913                 if (ret == 1) {
14914                         SF_SCD_INCR_REF(scdp);
14915                         mutex_exit(&srdp->srd_scd_mutex);
14916                         sfmmu_join_scd(scdp, sfmmup);
14917                         ASSERT(scdp->scd_refcnt >= 2);
14918                         atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
14919                         return;
14920                 } else {
14921                         /*
14922                          * If the sfmmu region map is a subset of the scd
14923                          * region map, then the assumption is that this process
14924                          * will continue attaching to ISM segments until the
14925                          * region maps are equal.
14926                          */
14927                         SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
14928                             &sfmmup->sfmmu_region_map, ret);
14929                         if (ret == 1) {
14930                                 mutex_exit(&srdp->srd_scd_mutex);
14931                                 return;
14932                         }
14933                 }
14934         }
14935 
14936         ASSERT(scdp == NULL);
14937         /*
14938          * No matching SCD has been found, create a new one.
14939          */
14940         if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
14941             NULL) {
14942                 mutex_exit(&srdp->srd_scd_mutex);
14943                 return;
14944         }
14945 
14946         /*
14947          * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
14948          */
14949 
14950         /* Set scd_rttecnt for shme rgns in SCD */
14951         sfmmu_set_scd_rttecnt(srdp, new_scdp);
14952 
14953         /*
14954          * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
14955          */
14956         sfmmu_link_scd_to_regions(srdp, new_scdp);
14957         sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
14958         SFMMU_STAT_ADD(sf_create_scd, 1);
14959 
14960         mutex_exit(&srdp->srd_scd_mutex);
14961         sfmmu_join_scd(new_scdp, sfmmup);
14962         ASSERT(new_scdp->scd_refcnt >= 2);
14963         atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
14964 }
14965 
14966 /*
14967  * This routine is called by a process to remove itself from an SCD. It is
14968  * either called when the processes has detached from a segment or from
14969  * hat_free_start() as a result of calling exit.
14970  */
14971 static void
14972 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
14973 {
14974         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
14975         sf_srd_t *srdp =  sfmmup->sfmmu_srdp;
14976         hatlock_t *hatlockp = TSB_HASH(sfmmup);
14977         int i;
14978 
14979         ASSERT(scdp != NULL);
14980         ASSERT(srdp != NULL);
14981 
14982         if (sfmmup->sfmmu_free) {
14983                 /*
14984                  * If the process is part of an SCD the sfmmu is unlinked
14985                  * from scd_sf_list.
14986                  */
14987                 mutex_enter(&scdp->scd_mutex);
14988                 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
14989                 mutex_exit(&scdp->scd_mutex);
14990                 /*
14991                  * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
14992                  * are about to leave the SCD
14993                  */
14994                 for (i = 0; i < mmu_page_sizes; i++) {
14995                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14996                             scdp->scd_rttecnt[i]);
14997                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14998                             sfmmup->sfmmu_scdrttecnt[i]);
14999                         sfmmup->sfmmu_scdrttecnt[i] = 0;
15000                 }
15001                 sfmmup->sfmmu_scdp = NULL;
15002 
15003                 SF_SCD_DECR_REF(srdp, scdp);
15004                 return;
15005         }
15006 
15007         ASSERT(r_type != SFMMU_REGION_ISM ||
15008             SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15009         ASSERT(scdp->scd_refcnt);
15010         ASSERT(!sfmmup->sfmmu_free);
15011         ASSERT(sfmmu_hat_lock_held(sfmmup));
15012         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15013 
15014         /*
15015          * Wait for ISM maps to be updated.
15016          */
15017         if (r_type != SFMMU_REGION_ISM) {
15018                 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15019                     sfmmup->sfmmu_scdp != NULL) {
15020                         cv_wait(&sfmmup->sfmmu_tsb_cv,
15021                             HATLOCK_MUTEXP(hatlockp));
15022                 }
15023 
15024                 if (sfmmup->sfmmu_scdp == NULL) {
15025                         sfmmu_hat_exit(hatlockp);
15026                         return;
15027                 }
15028                 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15029         }
15030 
15031         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15032                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15033                 /*
15034                  * Since HAT_JOIN_SCD was set our context
15035                  * is still invalid.
15036                  */
15037         } else {
15038                 /*
15039                  * For a multi-thread process, we must stop
15040                  * all the other threads before leaving the scd.
15041                  */
15042 
15043                 sfmmu_invalidate_ctx(sfmmup);
15044         }
15045 
15046         /* Clear all the rid's for ISM, delete flags, etc */
15047         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15048         sfmmu_ism_hatflags(sfmmup, 0);
15049 
15050         /*
15051          * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15052          * are in SCD before this sfmmup leaves the SCD.
15053          */
15054         for (i = 0; i < mmu_page_sizes; i++) {
15055                 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15056                     scdp->scd_rttecnt[i]);
15057                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15058                     sfmmup->sfmmu_scdrttecnt[i]);
15059                 sfmmup->sfmmu_scdrttecnt[i] = 0;
15060                 /* update ismttecnt to include SCD ism before hat leaves SCD */
15061                 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15062                 sfmmup->sfmmu_scdismttecnt[i] = 0;
15063         }
15064         /* update tsb0 inflation count */
15065         sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15066 
15067         if (r_type != SFMMU_REGION_ISM) {
15068                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15069         }
15070         sfmmup->sfmmu_scdp = NULL;
15071 
15072         sfmmu_hat_exit(hatlockp);
15073 
15074         /*
15075          * Unlink sfmmu from scd_sf_list this can be done without holding
15076          * the hat lock as we hold the sfmmu_as lock which prevents
15077          * hat_join_region from adding this thread to the scd again. Other
15078          * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15079          * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15080          * while holding the hat lock.
15081          */
15082         mutex_enter(&scdp->scd_mutex);
15083         sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15084         mutex_exit(&scdp->scd_mutex);
15085         SFMMU_STAT(sf_leave_scd);
15086 
15087         SF_SCD_DECR_REF(srdp, scdp);
15088         hatlockp = sfmmu_hat_enter(sfmmup);
15089 
15090 }
15091 
15092 /*
15093  * Unlink and free up an SCD structure with a reference count of 0.
15094  */
15095 static void
15096 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15097 {
15098         sfmmu_t *scsfmmup;
15099         sf_scd_t *sp;
15100         hatlock_t *shatlockp;
15101         int i, ret;
15102 
15103         mutex_enter(&srdp->srd_scd_mutex);
15104         for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15105                 if (sp == scdp)
15106                         break;
15107         }
15108         if (sp == NULL || sp->scd_refcnt) {
15109                 mutex_exit(&srdp->srd_scd_mutex);
15110                 return;
15111         }
15112 
15113         /*
15114          * It is possible that the scd has been freed and reallocated with a
15115          * different region map while we've been waiting for the srd_scd_mutex.
15116          */
15117         SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15118         if (ret != 1) {
15119                 mutex_exit(&srdp->srd_scd_mutex);
15120                 return;
15121         }
15122 
15123         ASSERT(scdp->scd_sf_list == NULL);
15124         /*
15125          * Unlink scd from srd_scdp list.
15126          */
15127         sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15128         mutex_exit(&srdp->srd_scd_mutex);
15129 
15130         sfmmu_unlink_scd_from_regions(srdp, scdp);
15131 
15132         /* Clear shared context tsb and release ctx */
15133         scsfmmup = scdp->scd_sfmmup;
15134 
15135         /*
15136          * create a barrier so that scd will not be destroyed
15137          * if other thread still holds the same shared hat lock.
15138          * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15139          * shared hat lock before checking the shared tsb reloc flag.
15140          */
15141         shatlockp = sfmmu_hat_enter(scsfmmup);
15142         sfmmu_hat_exit(shatlockp);
15143 
15144         sfmmu_free_scd_tsbs(scsfmmup);
15145 
15146         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15147                 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15148                         kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15149                             SFMMU_L2_HMERLINKS_SIZE);
15150                         scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15151                 }
15152         }
15153         kmem_cache_free(sfmmuid_cache, scsfmmup);
15154         kmem_cache_free(scd_cache, scdp);
15155         SFMMU_STAT(sf_destroy_scd);
15156 }
15157 
15158 /*
15159  * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15160  * bits which are set in the ism_region_map parameter. This flag indicates to
15161  * the tsbmiss handler that mapping for these segments should be loaded using
15162  * the shared context.
15163  */
15164 static void
15165 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15166 {
15167         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15168         ism_blk_t *ism_blkp;
15169         ism_map_t *ism_map;
15170         int i, rid;
15171 
15172         ASSERT(sfmmup->sfmmu_iblk != NULL);
15173         ASSERT(scdp != NULL);
15174         /*
15175          * Note that the caller either set HAT_ISMBUSY flag or checked
15176          * under hat lock that HAT_ISMBUSY was not set by another thread.
15177          */
15178         ASSERT(sfmmu_hat_lock_held(sfmmup));
15179 
15180         ism_blkp = sfmmup->sfmmu_iblk;
15181         while (ism_blkp != NULL) {
15182                 ism_map = ism_blkp->iblk_maps;
15183                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15184                         rid = ism_map[i].imap_rid;
15185                         if (rid == SFMMU_INVALID_ISMRID) {
15186                                 continue;
15187                         }
15188                         ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15189                         if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15190                             addflag) {
15191                                 ism_map[i].imap_hatflags |=
15192                                     HAT_CTX1_FLAG;
15193                         } else {
15194                                 ism_map[i].imap_hatflags &=
15195                                     ~HAT_CTX1_FLAG;
15196                         }
15197                 }
15198                 ism_blkp = ism_blkp->iblk_next;
15199         }
15200 }
15201 
15202 static int
15203 sfmmu_srd_lock_held(sf_srd_t *srdp)
15204 {
15205         return (MUTEX_HELD(&srdp->srd_mutex));
15206 }
15207 
15208 /* ARGSUSED */
15209 static int
15210 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15211 {
15212         sf_scd_t *scdp = (sf_scd_t *)buf;
15213 
15214         bzero(buf, sizeof (sf_scd_t));
15215         mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15216         return (0);
15217 }
15218 
15219 /* ARGSUSED */
15220 static void
15221 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15222 {
15223         sf_scd_t *scdp = (sf_scd_t *)buf;
15224 
15225         mutex_destroy(&scdp->scd_mutex);
15226 }
15227 
15228 /*
15229  * The listp parameter is a pointer to a list of hmeblks which are partially
15230  * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15231  * freeing process is to cross-call all cpus to ensure that there are no
15232  * remaining cached references.
15233  *
15234  * If the local generation number is less than the global then we can free
15235  * hmeblks which are already on the pending queue as another cpu has completed
15236  * the cross-call.
15237  *
15238  * We cross-call to make sure that there are no threads on other cpus accessing
15239  * these hmblks and then complete the process of freeing them under the
15240  * following conditions:
15241  *      The total number of pending hmeblks is greater than the threshold
15242  *      The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15243  *      It is at least 1 second since the last time we cross-called
15244  *
15245  * Otherwise, we add the hmeblks to the per-cpu pending queue.
15246  */
15247 static void
15248 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15249 {
15250         struct hme_blk *hblkp, *pr_hblkp = NULL;
15251         int             count = 0;
15252         cpuset_t        cpuset = cpu_ready_set;
15253         cpu_hme_pend_t  *cpuhp;
15254         timestruc_t     now;
15255         int             one_second_expired = 0;
15256 
15257         gethrestime_lasttick(&now);
15258 
15259         for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15260                 ASSERT(hblkp->hblk_shw_bit == 0);
15261                 ASSERT(hblkp->hblk_shared == 0);
15262                 count++;
15263                 pr_hblkp = hblkp;
15264         }
15265 
15266         cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15267         mutex_enter(&cpuhp->chp_mutex);
15268 
15269         if ((cpuhp->chp_count + count) == 0) {
15270                 mutex_exit(&cpuhp->chp_mutex);
15271                 return;
15272         }
15273 
15274         if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15275                 one_second_expired  = 1;
15276         }
15277 
15278         if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15279             (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15280             one_second_expired)) {
15281                 /* Append global list to local */
15282                 if (pr_hblkp == NULL) {
15283                         *listp = cpuhp->chp_listp;
15284                 } else {
15285                         pr_hblkp->hblk_next = cpuhp->chp_listp;
15286                 }
15287                 cpuhp->chp_listp = NULL;
15288                 cpuhp->chp_count = 0;
15289                 cpuhp->chp_timestamp = now.tv_sec;
15290                 mutex_exit(&cpuhp->chp_mutex);
15291 
15292                 kpreempt_disable();
15293                 CPUSET_DEL(cpuset, CPU->cpu_id);
15294                 xt_sync(cpuset);
15295                 xt_sync(cpuset);
15296                 kpreempt_enable();
15297 
15298                 /*
15299                  * At this stage we know that no trap handlers on other
15300                  * cpus can have references to hmeblks on the list.
15301                  */
15302                 sfmmu_hblk_free(listp);
15303         } else if (*listp != NULL) {
15304                 pr_hblkp->hblk_next = cpuhp->chp_listp;
15305                 cpuhp->chp_listp = *listp;
15306                 cpuhp->chp_count += count;
15307                 *listp = NULL;
15308                 mutex_exit(&cpuhp->chp_mutex);
15309         } else {
15310                 mutex_exit(&cpuhp->chp_mutex);
15311         }
15312 }
15313 
15314 /*
15315  * Add an hmeblk to the the hash list.
15316  */
15317 void
15318 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15319         uint64_t hblkpa)
15320 {
15321         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15322 #ifdef  DEBUG
15323         if (hmebp->hmeblkp == NULL) {
15324                 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15325         }
15326 #endif /* DEBUG */
15327 
15328         hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15329         /*
15330          * Since the TSB miss handler now does not lock the hash chain before
15331          * walking it, make sure that the hmeblks nextpa is globally visible
15332          * before we make the hmeblk globally visible by updating the chain root
15333          * pointer in the hash bucket.
15334          */
15335         membar_producer();
15336         hmebp->hmeh_nextpa = hblkpa;
15337         hmeblkp->hblk_next = hmebp->hmeblkp;
15338         hmebp->hmeblkp = hmeblkp;
15339 
15340 }
15341 
15342 /*
15343  * This function is the first part of a 2 part process to remove an hmeblk
15344  * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15345  * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15346  * a per-cpu pending list using the virtual address pointer.
15347  *
15348  * TSB miss trap handlers that start after this phase will no longer see
15349  * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15350  * can still use it for further chain traversal because we haven't yet modifed
15351  * the next physical pointer or freed it.
15352  *
15353  * In the second phase of hmeblk removal we'll issue a barrier xcall before
15354  * we reuse or free this hmeblk. This will make sure all lingering references to
15355  * the hmeblk after first phase disappear before we finally reclaim it.
15356  * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15357  * during their traversal.
15358  *
15359  * The hmehash_mutex must be held when calling this function.
15360  *
15361  * Input:
15362  *       hmebp - hme hash bucket pointer
15363  *       hmeblkp - address of hmeblk to be removed
15364  *       pr_hblk - virtual address of previous hmeblkp
15365  *       listp - pointer to list of hmeblks linked by virtual address
15366  *       free_now flag - indicates that a complete removal from the hash chains
15367  *                       is necessary.
15368  *
15369  * It is inefficient to use the free_now flag as a cross-call is required to
15370  * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15371  * in short supply.
15372  */
15373 void
15374 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15375     struct hme_blk *pr_hblk, struct hme_blk **listp,
15376     int free_now)
15377 {
15378         int shw_size, vshift;
15379         struct hme_blk *shw_hblkp;
15380         uint_t          shw_mask, newshw_mask;
15381         caddr_t         vaddr;
15382         int             size;
15383         cpuset_t cpuset = cpu_ready_set;
15384 
15385         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15386 
15387         if (hmebp->hmeblkp == hmeblkp) {
15388                 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15389                 hmebp->hmeblkp = hmeblkp->hblk_next;
15390         } else {
15391                 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15392                 pr_hblk->hblk_next = hmeblkp->hblk_next;
15393         }
15394 
15395         size = get_hblk_ttesz(hmeblkp);
15396         shw_hblkp = hmeblkp->hblk_shadow;
15397         if (shw_hblkp) {
15398                 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15399                 ASSERT(!hmeblkp->hblk_shared);
15400 #ifdef  DEBUG
15401                 if (mmu_page_sizes == max_mmu_page_sizes) {
15402                         ASSERT(size < TTE256M);
15403                 } else {
15404                         ASSERT(size < TTE4M);
15405                 }
15406 #endif /* DEBUG */
15407 
15408                 shw_size = get_hblk_ttesz(shw_hblkp);
15409                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15410                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15411                 ASSERT(vshift < 8);
15412                 /*
15413                  * Atomically clear shadow mask bit
15414                  */
15415                 do {
15416                         shw_mask = shw_hblkp->hblk_shw_mask;
15417                         ASSERT(shw_mask & (1 << vshift));
15418                         newshw_mask = shw_mask & ~(1 << vshift);
15419                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15420                             shw_mask, newshw_mask);
15421                 } while (newshw_mask != shw_mask);
15422                 hmeblkp->hblk_shadow = NULL;
15423         }
15424         hmeblkp->hblk_shw_bit = 0;
15425 
15426         if (hmeblkp->hblk_shared) {
15427 #ifdef  DEBUG
15428                 sf_srd_t        *srdp;
15429                 sf_region_t     *rgnp;
15430                 uint_t          rid;
15431 
15432                 srdp = hblktosrd(hmeblkp);
15433                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15434                 rid = hmeblkp->hblk_tag.htag_rid;
15435                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15436                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15437                 rgnp = srdp->srd_hmergnp[rid];
15438                 ASSERT(rgnp != NULL);
15439                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15440 #endif /* DEBUG */
15441                 hmeblkp->hblk_shared = 0;
15442         }
15443         if (free_now) {
15444                 kpreempt_disable();
15445                 CPUSET_DEL(cpuset, CPU->cpu_id);
15446                 xt_sync(cpuset);
15447                 xt_sync(cpuset);
15448                 kpreempt_enable();
15449 
15450                 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15451                 hmeblkp->hblk_next = NULL;
15452         } else {
15453                 /* Append hmeblkp to listp for processing later. */
15454                 hmeblkp->hblk_next = *listp;
15455                 *listp = hmeblkp;
15456         }
15457 }
15458 
15459 /*
15460  * This routine is called when memory is in short supply and returns a free
15461  * hmeblk of the requested size from the cpu pending lists.
15462  */
15463 static struct hme_blk *
15464 sfmmu_check_pending_hblks(int size)
15465 {
15466         int i;
15467         struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15468         int found_hmeblk;
15469         cpuset_t cpuset = cpu_ready_set;
15470         cpu_hme_pend_t *cpuhp;
15471 
15472         /* Flush cpu hblk pending queues */
15473         for (i = 0; i < NCPU; i++) {
15474                 cpuhp = &cpu_hme_pend[i];
15475                 if (cpuhp->chp_listp != NULL)  {
15476                         mutex_enter(&cpuhp->chp_mutex);
15477                         if (cpuhp->chp_listp == NULL)  {
15478                                 mutex_exit(&cpuhp->chp_mutex);
15479                                 continue;
15480                         }
15481                         found_hmeblk = 0;
15482                         last_hmeblkp = NULL;
15483                         for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15484                             hmeblkp = hmeblkp->hblk_next) {
15485                                 if (get_hblk_ttesz(hmeblkp) == size) {
15486                                         if (last_hmeblkp == NULL) {
15487                                                 cpuhp->chp_listp =
15488                                                     hmeblkp->hblk_next;
15489                                         } else {
15490                                                 last_hmeblkp->hblk_next =
15491                                                     hmeblkp->hblk_next;
15492                                         }
15493                                         ASSERT(cpuhp->chp_count > 0);
15494                                         cpuhp->chp_count--;
15495                                         found_hmeblk = 1;
15496                                         break;
15497                                 } else {
15498                                         last_hmeblkp = hmeblkp;
15499                                 }
15500                         }
15501                         mutex_exit(&cpuhp->chp_mutex);
15502 
15503                         if (found_hmeblk) {
15504                                 kpreempt_disable();
15505                                 CPUSET_DEL(cpuset, CPU->cpu_id);
15506                                 xt_sync(cpuset);
15507                                 xt_sync(cpuset);
15508                                 kpreempt_enable();
15509                                 return (hmeblkp);
15510                         }
15511                 }
15512         }
15513         return (NULL);
15514 }