xref: /titanic_51/usr/src/uts/sfmmu/vm/hat_sfmmu.c (revision e2c5185af3c50d9510e5df68aa37abdc6c0d3aac)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 /*
26  * VM - Hardware Address Translation management for Spitfire MMU.
27  *
28  * This file implements the machine specific hardware translation
29  * needed by the VM system.  The machine independent interface is
30  * described in <vm/hat.h> while the machine dependent interface
31  * and data structures are described in <vm/hat_sfmmu.h>.
32  *
33  * The hat layer manages the address translation hardware as a cache
34  * driven by calls from the higher levels in the VM system.
35  */
36 
37 #include <sys/types.h>
38 #include <sys/kstat.h>
39 #include <vm/hat.h>
40 #include <vm/hat_sfmmu.h>
41 #include <vm/page.h>
42 #include <sys/pte.h>
43 #include <sys/systm.h>
44 #include <sys/mman.h>
45 #include <sys/sysmacros.h>
46 #include <sys/machparam.h>
47 #include <sys/vtrace.h>
48 #include <sys/kmem.h>
49 #include <sys/mmu.h>
50 #include <sys/cmn_err.h>
51 #include <sys/cpu.h>
52 #include <sys/cpuvar.h>
53 #include <sys/debug.h>
54 #include <sys/lgrp.h>
55 #include <sys/archsystm.h>
56 #include <sys/machsystm.h>
57 #include <sys/vmsystm.h>
58 #include <vm/as.h>
59 #include <vm/seg.h>
60 #include <vm/seg_kp.h>
61 #include <vm/seg_kmem.h>
62 #include <vm/seg_kpm.h>
63 #include <vm/rm.h>
64 #include <sys/t_lock.h>
65 #include <sys/obpdefs.h>
66 #include <sys/vm_machparam.h>
67 #include <sys/var.h>
68 #include <sys/trap.h>
69 #include <sys/machtrap.h>
70 #include <sys/scb.h>
71 #include <sys/bitmap.h>
72 #include <sys/machlock.h>
73 #include <sys/membar.h>
74 #include <sys/atomic.h>
75 #include <sys/cpu_module.h>
76 #include <sys/prom_debug.h>
77 #include <sys/ksynch.h>
78 #include <sys/mem_config.h>
79 #include <sys/mem_cage.h>
80 #include <vm/vm_dep.h>
81 #include <vm/xhat_sfmmu.h>
82 #include <sys/fpu/fpusystm.h>
83 #include <vm/mach_kpm.h>
84 #include <sys/callb.h>
85 
86 #ifdef	DEBUG
87 #define	SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)			\
88 	if (SFMMU_IS_SHMERID_VALID(rid)) {				\
89 		caddr_t _eaddr = (saddr) + (len);			\
90 		sf_srd_t *_srdp;					\
91 		sf_region_t *_rgnp;					\
92 		ASSERT((rid) < SFMMU_MAX_HME_REGIONS);			\
93 		ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid));	\
94 		ASSERT((hat) != ksfmmup);				\
95 		_srdp = (hat)->sfmmu_srdp;				\
96 		ASSERT(_srdp != NULL);					\
97 		ASSERT(_srdp->srd_refcnt != 0);				\
98 		_rgnp = _srdp->srd_hmergnp[(rid)];			\
99 		ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid);		\
100 		ASSERT(_rgnp->rgn_refcnt != 0);				\
101 		ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE));	\
102 		ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) ==	\
103 		    SFMMU_REGION_HME);					\
104 		ASSERT((saddr) >= _rgnp->rgn_saddr);			\
105 		ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size);	\
106 		ASSERT(_eaddr > _rgnp->rgn_saddr);			\
107 		ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size);	\
108 	}
109 
110 #define	SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) 	 	 \
111 {						 			 \
112 		caddr_t _hsva;						 \
113 		caddr_t _heva;						 \
114 		caddr_t _rsva;					 	 \
115 		caddr_t _reva;					 	 \
116 		int	_ttesz = get_hblk_ttesz(hmeblkp);		 \
117 		int	_flagtte;					 \
118 		ASSERT((srdp)->srd_refcnt != 0);			 \
119 		ASSERT((rid) < SFMMU_MAX_HME_REGIONS);			 \
120 		ASSERT((rgnp)->rgn_id == rid);				 \
121 		ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE));	 \
122 		ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) ==	 \
123 		    SFMMU_REGION_HME);					 \
124 		ASSERT(_ttesz <= (rgnp)->rgn_pgszc);			 \
125 		_hsva = (caddr_t)get_hblk_base(hmeblkp);		 \
126 		_heva = get_hblk_endaddr(hmeblkp);			 \
127 		_rsva = (caddr_t)P2ALIGN(				 \
128 		    (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES);	 \
129 		_reva = (caddr_t)P2ROUNDUP(				 \
130 		    (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size),	 \
131 		    HBLK_MIN_BYTES);					 \
132 		ASSERT(_hsva >= _rsva);				 	 \
133 		ASSERT(_hsva < _reva);				 	 \
134 		ASSERT(_heva > _rsva);				 	 \
135 		ASSERT(_heva <= _reva);				 	 \
136 		_flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ :  \
137 			_ttesz;						 \
138 		ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte));		 \
139 }
140 
141 #else /* DEBUG */
142 #define	SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
143 #define	SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
144 #endif /* DEBUG */
145 
146 #if defined(SF_ERRATA_57)
147 extern caddr_t errata57_limit;
148 #endif
149 
150 #define	HME8BLK_SZ_RND		((roundup(HME8BLK_SZ, sizeof (int64_t))) /  \
151 				(sizeof (int64_t)))
152 #define	HBLK_RESERVE		((struct hme_blk *)hblk_reserve)
153 
154 #define	HBLK_RESERVE_CNT	128
155 #define	HBLK_RESERVE_MIN	20
156 
157 static struct hme_blk		*freehblkp;
158 static kmutex_t			freehblkp_lock;
159 static int			freehblkcnt;
160 
161 static int64_t			hblk_reserve[HME8BLK_SZ_RND];
162 static kmutex_t			hblk_reserve_lock;
163 static kthread_t		*hblk_reserve_thread;
164 
165 static nucleus_hblk8_info_t	nucleus_hblk8;
166 static nucleus_hblk1_info_t	nucleus_hblk1;
167 
168 /*
169  * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
170  * after the initial phase of removing an hmeblk from the hash chain, see
171  * the detailed comment in sfmmu_hblk_hash_rm() for further details.
172  */
173 static cpu_hme_pend_t		*cpu_hme_pend;
174 static uint_t			cpu_hme_pend_thresh;
175 /*
176  * SFMMU specific hat functions
177  */
178 void	hat_pagecachectl(struct page *, int);
179 
180 /* flags for hat_pagecachectl */
181 #define	HAT_CACHE	0x1
182 #define	HAT_UNCACHE	0x2
183 #define	HAT_TMPNC	0x4
184 
185 /*
186  * Flag to allow the creation of non-cacheable translations
187  * to system memory. It is off by default. At the moment this
188  * flag is used by the ecache error injector. The error injector
189  * will turn it on when creating such a translation then shut it
190  * off when it's finished.
191  */
192 
193 int	sfmmu_allow_nc_trans = 0;
194 
195 /*
196  * Flag to disable large page support.
197  * 	value of 1 => disable all large pages.
198  *	bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
199  *
200  * For example, use the value 0x4 to disable 512K pages.
201  *
202  */
203 #define	LARGE_PAGES_OFF		0x1
204 
205 /*
206  * The disable_large_pages and disable_ism_large_pages variables control
207  * hat_memload_array and the page sizes to be used by ISM and the kernel.
208  *
209  * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
210  * are only used to control which OOB pages to use at upper VM segment creation
211  * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
212  * Their values may come from platform or CPU specific code to disable page
213  * sizes that should not be used.
214  *
215  * WARNING: 512K pages are currently not supported for ISM/DISM.
216  */
217 uint_t	disable_large_pages = 0;
218 uint_t	disable_ism_large_pages = (1 << TTE512K);
219 uint_t	disable_auto_data_large_pages = 0;
220 uint_t	disable_auto_text_large_pages = 0;
221 
222 /*
223  * Private sfmmu data structures for hat management
224  */
225 static struct kmem_cache *sfmmuid_cache;
226 static struct kmem_cache *mmuctxdom_cache;
227 
228 /*
229  * Private sfmmu data structures for tsb management
230  */
231 static struct kmem_cache *sfmmu_tsbinfo_cache;
232 static struct kmem_cache *sfmmu_tsb8k_cache;
233 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
234 static vmem_t *kmem_bigtsb_arena;
235 static vmem_t *kmem_tsb_arena;
236 
237 /*
238  * sfmmu static variables for hmeblk resource management.
239  */
240 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
241 static struct kmem_cache *sfmmu8_cache;
242 static struct kmem_cache *sfmmu1_cache;
243 static struct kmem_cache *pa_hment_cache;
244 
245 static kmutex_t 	ism_mlist_lock;	/* mutex for ism mapping list */
246 /*
247  * private data for ism
248  */
249 static struct kmem_cache *ism_blk_cache;
250 static struct kmem_cache *ism_ment_cache;
251 #define	ISMID_STARTADDR	NULL
252 
253 /*
254  * Region management data structures and function declarations.
255  */
256 
257 static void	sfmmu_leave_srd(sfmmu_t *);
258 static int	sfmmu_srdcache_constructor(void *, void *, int);
259 static void	sfmmu_srdcache_destructor(void *, void *);
260 static int	sfmmu_rgncache_constructor(void *, void *, int);
261 static void	sfmmu_rgncache_destructor(void *, void *);
262 static int	sfrgnmap_isnull(sf_region_map_t *);
263 static int	sfhmergnmap_isnull(sf_hmeregion_map_t *);
264 static int	sfmmu_scdcache_constructor(void *, void *, int);
265 static void	sfmmu_scdcache_destructor(void *, void *);
266 static void	sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
267     size_t, void *, u_offset_t);
268 
269 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
270 static sf_srd_bucket_t *srd_buckets;
271 static struct kmem_cache *srd_cache;
272 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
273 static struct kmem_cache *region_cache;
274 static struct kmem_cache *scd_cache;
275 
276 #ifdef sun4v
277 int use_bigtsb_arena = 1;
278 #else
279 int use_bigtsb_arena = 0;
280 #endif
281 
282 /* External /etc/system tunable, for turning on&off the shctx support */
283 int disable_shctx = 0;
284 /* Internal variable, set by MD if the HW supports shctx feature */
285 int shctx_on = 0;
286 
287 #ifdef DEBUG
288 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
289 #endif
290 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
291 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
292 
293 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
294 static void sfmmu_find_scd(sfmmu_t *);
295 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
296 static void sfmmu_finish_join_scd(sfmmu_t *);
297 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
298 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
299 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
300 static void sfmmu_free_scd_tsbs(sfmmu_t *);
301 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
302 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
303 static void sfmmu_ism_hatflags(sfmmu_t *, int);
304 static int sfmmu_srd_lock_held(sf_srd_t *);
305 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
306 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
307 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
308 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
309 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
310 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
311 
312 /*
313  * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
314  * HAT flags, synchronizing TLB/TSB coherency, and context management.
315  * The lock is hashed on the sfmmup since the case where we need to lock
316  * all processes is rare but does occur (e.g. we need to unload a shared
317  * mapping from all processes using the mapping).  We have a lot of buckets,
318  * and each slab of sfmmu_t's can use about a quarter of them, giving us
319  * a fairly good distribution without wasting too much space and overhead
320  * when we have to grab them all.
321  */
322 #define	SFMMU_NUM_LOCK	128		/* must be power of two */
323 hatlock_t	hat_lock[SFMMU_NUM_LOCK];
324 
325 /*
326  * Hash algorithm optimized for a small number of slabs.
327  *  7 is (highbit((sizeof sfmmu_t)) - 1)
328  * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
329  * kmem_cache, and thus they will be sequential within that cache.  In
330  * addition, each new slab will have a different "color" up to cache_maxcolor
331  * which will skew the hashing for each successive slab which is allocated.
332  * If the size of sfmmu_t changed to a larger size, this algorithm may need
333  * to be revisited.
334  */
335 #define	TSB_HASH_SHIFT_BITS (7)
336 #define	PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
337 
338 #ifdef DEBUG
339 int tsb_hash_debug = 0;
340 #define	TSB_HASH(sfmmup)	\
341 	(tsb_hash_debug ? &hat_lock[0] : \
342 	&hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
343 #else	/* DEBUG */
344 #define	TSB_HASH(sfmmup)	&hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
345 #endif	/* DEBUG */
346 
347 
348 /* sfmmu_replace_tsb() return codes. */
349 typedef enum tsb_replace_rc {
350 	TSB_SUCCESS,
351 	TSB_ALLOCFAIL,
352 	TSB_LOSTRACE,
353 	TSB_ALREADY_SWAPPED,
354 	TSB_CANTGROW
355 } tsb_replace_rc_t;
356 
357 /*
358  * Flags for TSB allocation routines.
359  */
360 #define	TSB_ALLOC	0x01
361 #define	TSB_FORCEALLOC	0x02
362 #define	TSB_GROW	0x04
363 #define	TSB_SHRINK	0x08
364 #define	TSB_SWAPIN	0x10
365 
366 /*
367  * Support for HAT callbacks.
368  */
369 #define	SFMMU_MAX_RELOC_CALLBACKS	10
370 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
371 static id_t sfmmu_cb_nextid = 0;
372 static id_t sfmmu_tsb_cb_id;
373 struct sfmmu_callback *sfmmu_cb_table;
374 
375 /*
376  * Kernel page relocation is enabled by default for non-caged
377  * kernel pages.  This has little effect unless segkmem_reloc is
378  * set, since by default kernel memory comes from inside the
379  * kernel cage.
380  */
381 int hat_kpr_enabled = 1;
382 
383 kmutex_t	kpr_mutex;
384 kmutex_t	kpr_suspendlock;
385 kthread_t	*kreloc_thread;
386 
387 /*
388  * Enable VA->PA translation sanity checking on DEBUG kernels.
389  * Disabled by default.  This is incompatible with some
390  * drivers (error injector, RSM) so if it breaks you get
391  * to keep both pieces.
392  */
393 int hat_check_vtop = 0;
394 
395 /*
396  * Private sfmmu routines (prototypes)
397  */
398 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
399 static struct 	hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
400 			struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
401 			uint_t);
402 static caddr_t	sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
403 			caddr_t, demap_range_t *, uint_t);
404 static caddr_t	sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
405 			caddr_t, int);
406 static void	sfmmu_hblk_free(struct hme_blk **);
407 static void	sfmmu_hblks_list_purge(struct hme_blk **, int);
408 static uint_t	sfmmu_get_free_hblk(struct hme_blk **, uint_t);
409 static uint_t	sfmmu_put_free_hblk(struct hme_blk *, uint_t);
410 static struct hme_blk *sfmmu_hblk_steal(int);
411 static int	sfmmu_steal_this_hblk(struct hmehash_bucket *,
412 			struct hme_blk *, uint64_t, struct hme_blk *);
413 static caddr_t	sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
414 
415 static void	hat_do_memload_array(struct hat *, caddr_t, size_t,
416 		    struct page **, uint_t, uint_t, uint_t);
417 static void	hat_do_memload(struct hat *, caddr_t, struct page *,
418 		    uint_t, uint_t, uint_t);
419 static void	sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
420 		    uint_t, uint_t, pgcnt_t, uint_t);
421 void		sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
422 			uint_t);
423 static int	sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
424 			uint_t, uint_t);
425 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
426 					caddr_t, int, uint_t);
427 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
428 			struct hmehash_bucket *, caddr_t, uint_t, uint_t,
429 			uint_t);
430 static int	sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
431 			caddr_t, page_t **, uint_t, uint_t);
432 static void	sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
433 
434 static int	sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
435 static pfn_t	sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
436 void		sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
437 #ifdef VAC
438 static void	sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
439 static int	sfmmu_vacconflict_array(caddr_t, page_t *, int *);
440 int	tst_tnc(page_t *pp, pgcnt_t);
441 void	conv_tnc(page_t *pp, int);
442 #endif
443 
444 static void	sfmmu_get_ctx(sfmmu_t *);
445 static void	sfmmu_free_sfmmu(sfmmu_t *);
446 
447 static void	sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
448 static void	sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
449 
450 cpuset_t	sfmmu_pageunload(page_t *, struct sf_hment *, int);
451 static void	hat_pagereload(struct page *, struct page *);
452 static cpuset_t	sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
453 #ifdef VAC
454 void	sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
455 static void	sfmmu_page_cache(page_t *, int, int, int);
456 #endif
457 
458 cpuset_t	sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
459     struct hme_blk *, int);
460 static void	sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
461 			pfn_t, int, int, int, int);
462 static void	sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
463 			pfn_t, int);
464 static void	sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
465 static void	sfmmu_tlb_range_demap(demap_range_t *);
466 static void	sfmmu_invalidate_ctx(sfmmu_t *);
467 static void	sfmmu_sync_mmustate(sfmmu_t *);
468 
469 static void 	sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
470 static int	sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
471 			sfmmu_t *);
472 static void	sfmmu_tsb_free(struct tsb_info *);
473 static void	sfmmu_tsbinfo_free(struct tsb_info *);
474 static int	sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
475 			sfmmu_t *);
476 static void	sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
477 static void	sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
478 static int	sfmmu_select_tsb_szc(pgcnt_t);
479 static void	sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
480 #define		sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
481 	sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
482 #define		sfmmu_unload_tsb(sfmmup, vaddr, szc)    \
483 	sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
484 static void	sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
485 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
486     hatlock_t *, uint_t);
487 static void	sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
488 
489 #ifdef VAC
490 void	sfmmu_cache_flush(pfn_t, int);
491 void	sfmmu_cache_flushcolor(int, pfn_t);
492 #endif
493 static caddr_t	sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
494 			caddr_t, demap_range_t *, uint_t, int);
495 
496 static uint64_t	sfmmu_vtop_attr(uint_t, int mode, tte_t *);
497 static uint_t	sfmmu_ptov_attr(tte_t *);
498 static caddr_t	sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
499 			caddr_t, demap_range_t *, uint_t);
500 static uint_t	sfmmu_vtop_prot(uint_t, uint_t *);
501 static int	sfmmu_idcache_constructor(void *, void *, int);
502 static void	sfmmu_idcache_destructor(void *, void *);
503 static int	sfmmu_hblkcache_constructor(void *, void *, int);
504 static void	sfmmu_hblkcache_destructor(void *, void *);
505 static void	sfmmu_hblkcache_reclaim(void *);
506 static void	sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
507 			struct hmehash_bucket *);
508 static void	sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
509 			struct hme_blk *, struct hme_blk **, int);
510 static void	sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
511 			uint64_t);
512 static struct hme_blk *sfmmu_check_pending_hblks(int);
513 static void	sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
514 static void	sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
515 static void	sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
516 			int, caddr_t *);
517 static void	sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
518 
519 static void	sfmmu_rm_large_mappings(page_t *, int);
520 
521 static void	hat_lock_init(void);
522 static void	hat_kstat_init(void);
523 static int	sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
524 static void	sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
525 static	int	sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
526 static void	sfmmu_check_page_sizes(sfmmu_t *, int);
527 int	fnd_mapping_sz(page_t *);
528 static void	iment_add(struct ism_ment *,  struct hat *);
529 static void	iment_sub(struct ism_ment *, struct hat *);
530 static pgcnt_t	ism_tsb_entries(sfmmu_t *, int szc);
531 extern void	sfmmu_setup_tsbinfo(sfmmu_t *);
532 extern void	sfmmu_clear_utsbinfo(void);
533 
534 static void		sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
535 
536 extern int vpm_enable;
537 
538 /* kpm globals */
539 #ifdef	DEBUG
540 /*
541  * Enable trap level tsbmiss handling
542  */
543 int	kpm_tsbmtl = 1;
544 
545 /*
546  * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
547  * required TLB shootdowns in this case, so handle w/ care. Off by default.
548  */
549 int	kpm_tlb_flush;
550 #endif	/* DEBUG */
551 
552 static void	*sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
553 
554 #ifdef DEBUG
555 static void	sfmmu_check_hblk_flist();
556 #endif
557 
558 /*
559  * Semi-private sfmmu data structures.  Some of them are initialize in
560  * startup or in hat_init. Some of them are private but accessed by
561  * assembly code or mach_sfmmu.c
562  */
563 struct hmehash_bucket *uhme_hash;	/* user hmeblk hash table */
564 struct hmehash_bucket *khme_hash;	/* kernel hmeblk hash table */
565 uint64_t	uhme_hash_pa;		/* PA of uhme_hash */
566 uint64_t	khme_hash_pa;		/* PA of khme_hash */
567 int 		uhmehash_num;		/* # of buckets in user hash table */
568 int 		khmehash_num;		/* # of buckets in kernel hash table */
569 
570 uint_t		max_mmu_ctxdoms = 0;	/* max context domains in the system */
571 mmu_ctx_t	**mmu_ctxs_tbl;		/* global array of context domains */
572 uint64_t	mmu_saved_gnum = 0;	/* to init incoming MMUs' gnums */
573 
574 #define	DEFAULT_NUM_CTXS_PER_MMU 8192
575 static uint_t	nctxs = DEFAULT_NUM_CTXS_PER_MMU;
576 
577 int		cache;			/* describes system cache */
578 
579 caddr_t		ktsb_base;		/* kernel 8k-indexed tsb base address */
580 uint64_t	ktsb_pbase;		/* kernel 8k-indexed tsb phys address */
581 int		ktsb_szcode;		/* kernel 8k-indexed tsb size code */
582 int		ktsb_sz;		/* kernel 8k-indexed tsb size */
583 
584 caddr_t		ktsb4m_base;		/* kernel 4m-indexed tsb base address */
585 uint64_t	ktsb4m_pbase;		/* kernel 4m-indexed tsb phys address */
586 int		ktsb4m_szcode;		/* kernel 4m-indexed tsb size code */
587 int		ktsb4m_sz;		/* kernel 4m-indexed tsb size */
588 
589 uint64_t	kpm_tsbbase;		/* kernel seg_kpm 4M TSB base address */
590 int		kpm_tsbsz;		/* kernel seg_kpm 4M TSB size code */
591 uint64_t	kpmsm_tsbbase;		/* kernel seg_kpm 8K TSB base address */
592 int		kpmsm_tsbsz;		/* kernel seg_kpm 8K TSB size code */
593 
594 #ifndef sun4v
595 int		utsb_dtlb_ttenum = -1;	/* index in TLB for utsb locked TTE */
596 int		utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
597 int		dtlb_resv_ttenum;	/* index in TLB of first reserved TTE */
598 caddr_t		utsb_vabase;		/* reserved kernel virtual memory */
599 caddr_t		utsb4m_vabase;		/* for trap handler TSB accesses */
600 #endif /* sun4v */
601 uint64_t	tsb_alloc_bytes = 0;	/* bytes allocated to TSBs */
602 vmem_t		*kmem_tsb_default_arena[NLGRPS_MAX];	/* For dynamic TSBs */
603 vmem_t		*kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
604 
605 /*
606  * Size to use for TSB slabs.  Future platforms that support page sizes
607  * larger than 4M may wish to change these values, and provide their own
608  * assembly macros for building and decoding the TSB base register contents.
609  * Note disable_large_pages will override the value set here.
610  */
611 static	uint_t tsb_slab_ttesz = TTE4M;
612 size_t	tsb_slab_size = MMU_PAGESIZE4M;
613 uint_t	tsb_slab_shift = MMU_PAGESHIFT4M;
614 /* PFN mask for TTE */
615 size_t	tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
616 
617 /*
618  * Size to use for TSB slabs.  These are used only when 256M tsb arenas
619  * exist.
620  */
621 static uint_t	bigtsb_slab_ttesz = TTE256M;
622 static size_t	bigtsb_slab_size = MMU_PAGESIZE256M;
623 static uint_t	bigtsb_slab_shift = MMU_PAGESHIFT256M;
624 /* 256M page alignment for 8K pfn */
625 static size_t	bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
626 
627 /* largest TSB size to grow to, will be smaller on smaller memory systems */
628 static int	tsb_max_growsize = 0;
629 
630 /*
631  * Tunable parameters dealing with TSB policies.
632  */
633 
634 /*
635  * This undocumented tunable forces all 8K TSBs to be allocated from
636  * the kernel heap rather than from the kmem_tsb_default_arena arenas.
637  */
638 #ifdef	DEBUG
639 int	tsb_forceheap = 0;
640 #endif	/* DEBUG */
641 
642 /*
643  * Decide whether to use per-lgroup arenas, or one global set of
644  * TSB arenas.  The default is not to break up per-lgroup, since
645  * most platforms don't recognize any tangible benefit from it.
646  */
647 int	tsb_lgrp_affinity = 0;
648 
649 /*
650  * Used for growing the TSB based on the process RSS.
651  * tsb_rss_factor is based on the smallest TSB, and is
652  * shifted by the TSB size to determine if we need to grow.
653  * The default will grow the TSB if the number of TTEs for
654  * this page size exceeds 75% of the number of TSB entries,
655  * which should _almost_ eliminate all conflict misses
656  * (at the expense of using up lots and lots of memory).
657  */
658 #define	TSB_RSS_FACTOR		(TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
659 #define	SFMMU_RSS_TSBSIZE(tsbszc)	(tsb_rss_factor << tsbszc)
660 #define	SELECT_TSB_SIZECODE(pgcnt) ( \
661 	(enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
662 	default_tsb_size)
663 #define	TSB_OK_SHRINK()	\
664 	(tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
665 #define	TSB_OK_GROW()	\
666 	(tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
667 
668 int	enable_tsb_rss_sizing = 1;
669 int	tsb_rss_factor	= (int)TSB_RSS_FACTOR;
670 
671 /* which TSB size code to use for new address spaces or if rss sizing off */
672 int default_tsb_size = TSB_8K_SZCODE;
673 
674 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
675 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
676 #define	TSB_ALLOC_HIWATER_FACTOR_DEFAULT	32
677 
678 #ifdef DEBUG
679 static int tsb_random_size = 0;	/* set to 1 to test random tsb sizes on alloc */
680 static int tsb_grow_stress = 0;	/* if set to 1, keep replacing TSB w/ random */
681 static int tsb_alloc_mtbf = 0;	/* fail allocation every n attempts */
682 static int tsb_alloc_fail_mtbf = 0;
683 static int tsb_alloc_count = 0;
684 #endif /* DEBUG */
685 
686 /* if set to 1, will remap valid TTEs when growing TSB. */
687 int tsb_remap_ttes = 1;
688 
689 /*
690  * If we have more than this many mappings, allocate a second TSB.
691  * This default is chosen because the I/D fully associative TLBs are
692  * assumed to have at least 8 available entries. Platforms with a
693  * larger fully-associative TLB could probably override the default.
694  */
695 
696 #ifdef sun4v
697 int tsb_sectsb_threshold = 0;
698 #else
699 int tsb_sectsb_threshold = 8;
700 #endif
701 
702 /*
703  * kstat data
704  */
705 struct sfmmu_global_stat sfmmu_global_stat;
706 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
707 
708 /*
709  * Global data
710  */
711 sfmmu_t 	*ksfmmup;		/* kernel's hat id */
712 
713 #ifdef DEBUG
714 static void	chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
715 #endif
716 
717 /* sfmmu locking operations */
718 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
719 static int	sfmmu_mlspl_held(struct page *, int);
720 
721 kmutex_t *sfmmu_page_enter(page_t *);
722 void	sfmmu_page_exit(kmutex_t *);
723 int	sfmmu_page_spl_held(struct page *);
724 
725 /* sfmmu internal locking operations - accessed directly */
726 static void	sfmmu_mlist_reloc_enter(page_t *, page_t *,
727 				kmutex_t **, kmutex_t **);
728 static void	sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
729 static hatlock_t *
730 		sfmmu_hat_enter(sfmmu_t *);
731 static hatlock_t *
732 		sfmmu_hat_tryenter(sfmmu_t *);
733 static void	sfmmu_hat_exit(hatlock_t *);
734 static void	sfmmu_hat_lock_all(void);
735 static void	sfmmu_hat_unlock_all(void);
736 static void	sfmmu_ismhat_enter(sfmmu_t *, int);
737 static void	sfmmu_ismhat_exit(sfmmu_t *, int);
738 
739 kpm_hlk_t	*kpmp_table;
740 uint_t		kpmp_table_sz;	/* must be a power of 2 */
741 uchar_t		kpmp_shift;
742 
743 kpm_shlk_t	*kpmp_stable;
744 uint_t		kpmp_stable_sz;	/* must be a power of 2 */
745 
746 /*
747  * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
748  * SPL_SHIFT is log2(SPL_TABLE_SIZE).
749  */
750 #if ((2*NCPU_P2) > 128)
751 #define	SPL_SHIFT	((unsigned)(NCPU_LOG2 + 1))
752 #else
753 #define	SPL_SHIFT	7U
754 #endif
755 #define	SPL_TABLE_SIZE	(1U << SPL_SHIFT)
756 #define	SPL_MASK	(SPL_TABLE_SIZE - 1)
757 
758 /*
759  * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
760  * and by multiples of SPL_SHIFT to get as many varied bits as we can.
761  */
762 #define	SPL_INDEX(pp) \
763 	((((uintptr_t)(pp) >> PP_SHIFT) ^ \
764 	((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
765 	((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
766 	((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
767 	SPL_MASK)
768 
769 #define	SPL_HASH(pp)    \
770 	(&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
771 
772 static	pad_mutex_t	sfmmu_page_lock[SPL_TABLE_SIZE];
773 
774 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
775 
776 #define	MML_TABLE_SIZE	SPL_TABLE_SIZE
777 #define	MLIST_HASH(pp)	(&mml_table[SPL_INDEX(pp)].pad_mutex)
778 
779 static pad_mutex_t	mml_table[MML_TABLE_SIZE];
780 
781 /*
782  * hat_unload_callback() will group together callbacks in order
783  * to avoid xt_sync() calls.  This is the maximum size of the group.
784  */
785 #define	MAX_CB_ADDR	32
786 
787 tte_t	hw_tte;
788 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
789 
790 static char	*mmu_ctx_kstat_names[] = {
791 	"mmu_ctx_tsb_exceptions",
792 	"mmu_ctx_tsb_raise_exception",
793 	"mmu_ctx_wrap_around",
794 };
795 
796 /*
797  * Wrapper for vmem_xalloc since vmem_create only allows limited
798  * parameters for vm_source_alloc functions.  This function allows us
799  * to specify alignment consistent with the size of the object being
800  * allocated.
801  */
802 static void *
803 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
804 {
805 	return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
806 }
807 
808 /* Common code for setting tsb_alloc_hiwater. */
809 #define	SFMMU_SET_TSB_ALLOC_HIWATER(pages)	tsb_alloc_hiwater = \
810 		ptob(pages) / tsb_alloc_hiwater_factor
811 
812 /*
813  * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
814  * a single TSB.  physmem is the number of physical pages so we need physmem 8K
815  * TTEs to represent all those physical pages.  We round this up by using
816  * 1<<highbit().  To figure out which size code to use, remember that the size
817  * code is just an amount to shift the smallest TSB size to get the size of
818  * this TSB.  So we subtract that size, TSB_START_SIZE, from highbit() (or
819  * highbit() - 1) to get the size code for the smallest TSB that can represent
820  * all of physical memory, while erring on the side of too much.
821  *
822  * Restrict tsb_max_growsize to make sure that:
823  *	1) TSBs can't grow larger than the TSB slab size
824  *	2) TSBs can't grow larger than UTSB_MAX_SZCODE.
825  */
826 #define	SFMMU_SET_TSB_MAX_GROWSIZE(pages) {				\
827 	int	_i, _szc, _slabszc, _tsbszc;				\
828 									\
829 	_i = highbit(pages);						\
830 	if ((1 << (_i - 1)) == (pages))					\
831 		_i--;		/* 2^n case, round down */              \
832 	_szc = _i - TSB_START_SIZE;					\
833 	_slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
834 	_tsbszc = MIN(_szc, _slabszc);                                  \
835 	tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE);               \
836 }
837 
838 /*
839  * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
840  * tsb_info which handles that TTE size.
841  */
842 #define	SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) {			\
843 	(tsbinfop) = (sfmmup)->sfmmu_tsb;				\
844 	ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) ||		\
845 	    sfmmu_hat_lock_held(sfmmup));				\
846 	if ((tte_szc) >= TTE4M)	{					\
847 		ASSERT((tsbinfop) != NULL);				\
848 		(tsbinfop) = (tsbinfop)->tsb_next;			\
849 	}								\
850 }
851 
852 /*
853  * Macro to use to unload entries from the TSB.
854  * It has knowledge of which page sizes get replicated in the TSB
855  * and will call the appropriate unload routine for the appropriate size.
856  */
857 #define	SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat)		\
858 {									\
859 	int ttesz = get_hblk_ttesz(hmeblkp);				\
860 	if (ttesz == TTE8K || ttesz == TTE4M) {				\
861 		sfmmu_unload_tsb(sfmmup, addr, ttesz);			\
862 	} else {							\
863 		caddr_t sva = ismhat ? addr : 				\
864 		    (caddr_t)get_hblk_base(hmeblkp);			\
865 		caddr_t eva = sva + get_hblk_span(hmeblkp);		\
866 		ASSERT(addr >= sva && addr < eva);			\
867 		sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz);	\
868 	}								\
869 }
870 
871 
872 /* Update tsb_alloc_hiwater after memory is configured. */
873 /*ARGSUSED*/
874 static void
875 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
876 {
877 	/* Assumes physmem has already been updated. */
878 	SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
879 	SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
880 }
881 
882 /*
883  * Update tsb_alloc_hiwater before memory is deleted.  We'll do nothing here
884  * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
885  * deleted.
886  */
887 /*ARGSUSED*/
888 static int
889 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
890 {
891 	return (0);
892 }
893 
894 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
895 /*ARGSUSED*/
896 static void
897 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
898 {
899 	/*
900 	 * Whether the delete was cancelled or not, just go ahead and update
901 	 * tsb_alloc_hiwater and tsb_max_growsize.
902 	 */
903 	SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
904 	SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
905 }
906 
907 static kphysm_setup_vector_t sfmmu_update_vec = {
908 	KPHYSM_SETUP_VECTOR_VERSION,	/* version */
909 	sfmmu_update_post_add,		/* post_add */
910 	sfmmu_update_pre_del,		/* pre_del */
911 	sfmmu_update_post_del		/* post_del */
912 };
913 
914 
915 /*
916  * HME_BLK HASH PRIMITIVES
917  */
918 
919 /*
920  * Enter a hme on the mapping list for page pp.
921  * When large pages are more prevalent in the system we might want to
922  * keep the mapping list in ascending order by the hment size. For now,
923  * small pages are more frequent, so don't slow it down.
924  */
925 #define	HME_ADD(hme, pp)					\
926 {								\
927 	ASSERT(sfmmu_mlist_held(pp));				\
928 								\
929 	hme->hme_prev = NULL;					\
930 	hme->hme_next = pp->p_mapping;				\
931 	hme->hme_page = pp;					\
932 	if (pp->p_mapping) {					\
933 		((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
934 		ASSERT(pp->p_share > 0);			\
935 	} else  {						\
936 		/* EMPTY */					\
937 		ASSERT(pp->p_share == 0);			\
938 	}							\
939 	pp->p_mapping = hme;					\
940 	pp->p_share++;						\
941 }
942 
943 /*
944  * Enter a hme on the mapping list for page pp.
945  * If we are unmapping a large translation, we need to make sure that the
946  * change is reflect in the corresponding bit of the p_index field.
947  */
948 #define	HME_SUB(hme, pp)					\
949 {								\
950 	ASSERT(sfmmu_mlist_held(pp));				\
951 	ASSERT(hme->hme_page == pp || IS_PAHME(hme));		\
952 								\
953 	if (pp->p_mapping == NULL) {				\
954 		panic("hme_remove - no mappings");		\
955 	}							\
956 								\
957 	membar_stst();	/* ensure previous stores finish */	\
958 								\
959 	ASSERT(pp->p_share > 0);				\
960 	pp->p_share--;						\
961 								\
962 	if (hme->hme_prev) {					\
963 		ASSERT(pp->p_mapping != hme);			\
964 		ASSERT(hme->hme_prev->hme_page == pp ||		\
965 			IS_PAHME(hme->hme_prev));		\
966 		hme->hme_prev->hme_next = hme->hme_next;	\
967 	} else {						\
968 		ASSERT(pp->p_mapping == hme);			\
969 		pp->p_mapping = hme->hme_next;			\
970 		ASSERT((pp->p_mapping == NULL) ?		\
971 			(pp->p_share == 0) : 1);		\
972 	}							\
973 								\
974 	if (hme->hme_next) {					\
975 		ASSERT(hme->hme_next->hme_page == pp ||		\
976 			IS_PAHME(hme->hme_next));		\
977 		hme->hme_next->hme_prev = hme->hme_prev;	\
978 	}							\
979 								\
980 	/* zero out the entry */				\
981 	hme->hme_next = NULL;					\
982 	hme->hme_prev = NULL;					\
983 	hme->hme_page = NULL;					\
984 								\
985 	if (hme_size(hme) > TTE8K) {				\
986 		/* remove mappings for remainder of large pg */	\
987 		sfmmu_rm_large_mappings(pp, hme_size(hme));	\
988 	}							\
989 }
990 
991 /*
992  * This function returns the hment given the hme_blk and a vaddr.
993  * It assumes addr has already been checked to belong to hme_blk's
994  * range.
995  */
996 #define	HBLKTOHME(hment, hmeblkp, addr)					\
997 {									\
998 	int index;							\
999 	HBLKTOHME_IDX(hment, hmeblkp, addr, index)			\
1000 }
1001 
1002 /*
1003  * Version of HBLKTOHME that also returns the index in hmeblkp
1004  * of the hment.
1005  */
1006 #define	HBLKTOHME_IDX(hment, hmeblkp, addr, idx)			\
1007 {									\
1008 	ASSERT(in_hblk_range((hmeblkp), (addr)));			\
1009 									\
1010 	if (get_hblk_ttesz(hmeblkp) == TTE8K) {				\
1011 		idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1012 	} else								\
1013 		idx = 0;						\
1014 									\
1015 	(hment) = &(hmeblkp)->hblk_hme[idx];				\
1016 }
1017 
1018 /*
1019  * Disable any page sizes not supported by the CPU
1020  */
1021 void
1022 hat_init_pagesizes()
1023 {
1024 	int 		i;
1025 
1026 	mmu_exported_page_sizes = 0;
1027 	for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1028 
1029 		szc_2_userszc[i] = (uint_t)-1;
1030 		userszc_2_szc[i] = (uint_t)-1;
1031 
1032 		if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1033 			disable_large_pages |= (1 << i);
1034 		} else {
1035 			szc_2_userszc[i] = mmu_exported_page_sizes;
1036 			userszc_2_szc[mmu_exported_page_sizes] = i;
1037 			mmu_exported_page_sizes++;
1038 		}
1039 	}
1040 
1041 	disable_ism_large_pages |= disable_large_pages;
1042 	disable_auto_data_large_pages = disable_large_pages;
1043 	disable_auto_text_large_pages = disable_large_pages;
1044 
1045 	/*
1046 	 * Initialize mmu-specific large page sizes.
1047 	 */
1048 	if (&mmu_large_pages_disabled) {
1049 		disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1050 		disable_ism_large_pages |=
1051 		    mmu_large_pages_disabled(HAT_LOAD_SHARE);
1052 		disable_auto_data_large_pages |=
1053 		    mmu_large_pages_disabled(HAT_AUTO_DATA);
1054 		disable_auto_text_large_pages |=
1055 		    mmu_large_pages_disabled(HAT_AUTO_TEXT);
1056 	}
1057 }
1058 
1059 /*
1060  * Initialize the hardware address translation structures.
1061  */
1062 void
1063 hat_init(void)
1064 {
1065 	int 		i;
1066 	uint_t		sz;
1067 	size_t		size;
1068 
1069 	hat_lock_init();
1070 	hat_kstat_init();
1071 
1072 	/*
1073 	 * Hardware-only bits in a TTE
1074 	 */
1075 	MAKE_TTE_MASK(&hw_tte);
1076 
1077 	hat_init_pagesizes();
1078 
1079 	/* Initialize the hash locks */
1080 	for (i = 0; i < khmehash_num; i++) {
1081 		mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1082 		    MUTEX_DEFAULT, NULL);
1083 		khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1084 	}
1085 	for (i = 0; i < uhmehash_num; i++) {
1086 		mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1087 		    MUTEX_DEFAULT, NULL);
1088 		uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1089 	}
1090 	khmehash_num--;		/* make sure counter starts from 0 */
1091 	uhmehash_num--;		/* make sure counter starts from 0 */
1092 
1093 	/*
1094 	 * Allocate context domain structures.
1095 	 *
1096 	 * A platform may choose to modify max_mmu_ctxdoms in
1097 	 * set_platform_defaults(). If a platform does not define
1098 	 * a set_platform_defaults() or does not choose to modify
1099 	 * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1100 	 *
1101 	 * For all platforms that have CPUs sharing MMUs, this
1102 	 * value must be defined.
1103 	 */
1104 	if (max_mmu_ctxdoms == 0)
1105 		max_mmu_ctxdoms = max_ncpus;
1106 
1107 	size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1108 	mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1109 
1110 	/* mmu_ctx_t is 64 bytes aligned */
1111 	mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1112 	    sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1113 	/*
1114 	 * MMU context domain initialization for the Boot CPU.
1115 	 * This needs the context domains array allocated above.
1116 	 */
1117 	mutex_enter(&cpu_lock);
1118 	sfmmu_cpu_init(CPU);
1119 	mutex_exit(&cpu_lock);
1120 
1121 	/*
1122 	 * Intialize ism mapping list lock.
1123 	 */
1124 
1125 	mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1126 
1127 	/*
1128 	 * Each sfmmu structure carries an array of MMU context info
1129 	 * structures, one per context domain. The size of this array depends
1130 	 * on the maximum number of context domains. So, the size of the
1131 	 * sfmmu structure varies per platform.
1132 	 *
1133 	 * sfmmu is allocated from static arena, because trap
1134 	 * handler at TL > 0 is not allowed to touch kernel relocatable
1135 	 * memory. sfmmu's alignment is changed to 64 bytes from
1136 	 * default 8 bytes, as the lower 6 bits will be used to pass
1137 	 * pgcnt to vtag_flush_pgcnt_tl1.
1138 	 */
1139 	size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1140 
1141 	sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1142 	    64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1143 	    NULL, NULL, static_arena, 0);
1144 
1145 	sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1146 	    sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1147 
1148 	/*
1149 	 * Since we only use the tsb8k cache to "borrow" pages for TSBs
1150 	 * from the heap when low on memory or when TSB_FORCEALLOC is
1151 	 * specified, don't use magazines to cache them--we want to return
1152 	 * them to the system as quickly as possible.
1153 	 */
1154 	sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1155 	    MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1156 	    static_arena, KMC_NOMAGAZINE);
1157 
1158 	/*
1159 	 * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1160 	 * memory, which corresponds to the old static reserve for TSBs.
1161 	 * tsb_alloc_hiwater_factor defaults to 32.  This caps the amount of
1162 	 * memory we'll allocate for TSB slabs; beyond this point TSB
1163 	 * allocations will be taken from the kernel heap (via
1164 	 * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1165 	 * consumer.
1166 	 */
1167 	if (tsb_alloc_hiwater_factor == 0) {
1168 		tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1169 	}
1170 	SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1171 
1172 	for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1173 		if (!(disable_large_pages & (1 << sz)))
1174 			break;
1175 	}
1176 
1177 	if (sz < tsb_slab_ttesz) {
1178 		tsb_slab_ttesz = sz;
1179 		tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1180 		tsb_slab_size = 1 << tsb_slab_shift;
1181 		tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1182 		use_bigtsb_arena = 0;
1183 	} else if (use_bigtsb_arena &&
1184 	    (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1185 		use_bigtsb_arena = 0;
1186 	}
1187 
1188 	if (!use_bigtsb_arena) {
1189 		bigtsb_slab_shift = tsb_slab_shift;
1190 	}
1191 	SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1192 
1193 	/*
1194 	 * On smaller memory systems, allocate TSB memory in smaller chunks
1195 	 * than the default 4M slab size. We also honor disable_large_pages
1196 	 * here.
1197 	 *
1198 	 * The trap handlers need to be patched with the final slab shift,
1199 	 * since they need to be able to construct the TSB pointer at runtime.
1200 	 */
1201 	if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1202 	    !(disable_large_pages & (1 << TTE512K))) {
1203 		tsb_slab_ttesz = TTE512K;
1204 		tsb_slab_shift = MMU_PAGESHIFT512K;
1205 		tsb_slab_size = MMU_PAGESIZE512K;
1206 		tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1207 		use_bigtsb_arena = 0;
1208 	}
1209 
1210 	if (!use_bigtsb_arena) {
1211 		bigtsb_slab_ttesz = tsb_slab_ttesz;
1212 		bigtsb_slab_shift = tsb_slab_shift;
1213 		bigtsb_slab_size = tsb_slab_size;
1214 		bigtsb_slab_mask = tsb_slab_mask;
1215 	}
1216 
1217 
1218 	/*
1219 	 * Set up memory callback to update tsb_alloc_hiwater and
1220 	 * tsb_max_growsize.
1221 	 */
1222 	i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1223 	ASSERT(i == 0);
1224 
1225 	/*
1226 	 * kmem_tsb_arena is the source from which large TSB slabs are
1227 	 * drawn.  The quantum of this arena corresponds to the largest
1228 	 * TSB size we can dynamically allocate for user processes.
1229 	 * Currently it must also be a supported page size since we
1230 	 * use exactly one translation entry to map each slab page.
1231 	 *
1232 	 * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1233 	 * which most TSBs are allocated.  Since most TSB allocations are
1234 	 * typically 8K we have a kmem cache we stack on top of each
1235 	 * kmem_tsb_default_arena to speed up those allocations.
1236 	 *
1237 	 * Note the two-level scheme of arenas is required only
1238 	 * because vmem_create doesn't allow us to specify alignment
1239 	 * requirements.  If this ever changes the code could be
1240 	 * simplified to use only one level of arenas.
1241 	 *
1242 	 * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1243 	 * will be provided in addition to the 4M kmem_tsb_arena.
1244 	 */
1245 	if (use_bigtsb_arena) {
1246 		kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1247 		    bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1248 		    vmem_xfree, heap_arena, 0, VM_SLEEP);
1249 	}
1250 
1251 	kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1252 	    sfmmu_vmem_xalloc_aligned_wrapper,
1253 	    vmem_xfree, heap_arena, 0, VM_SLEEP);
1254 
1255 	if (tsb_lgrp_affinity) {
1256 		char s[50];
1257 		for (i = 0; i < NLGRPS_MAX; i++) {
1258 			if (use_bigtsb_arena) {
1259 				(void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1260 				kmem_bigtsb_default_arena[i] = vmem_create(s,
1261 				    NULL, 0, 2 * tsb_slab_size,
1262 				    sfmmu_tsb_segkmem_alloc,
1263 				    sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1264 				    0, VM_SLEEP | VM_BESTFIT);
1265 			}
1266 
1267 			(void) sprintf(s, "kmem_tsb_lgrp%d", i);
1268 			kmem_tsb_default_arena[i] = vmem_create(s,
1269 			    NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1270 			    sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1271 			    VM_SLEEP | VM_BESTFIT);
1272 
1273 			(void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1274 			sfmmu_tsb_cache[i] = kmem_cache_create(s,
1275 			    PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1276 			    kmem_tsb_default_arena[i], 0);
1277 		}
1278 	} else {
1279 		if (use_bigtsb_arena) {
1280 			kmem_bigtsb_default_arena[0] =
1281 			    vmem_create("kmem_bigtsb_default", NULL, 0,
1282 			    2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1283 			    sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1284 			    VM_SLEEP | VM_BESTFIT);
1285 		}
1286 
1287 		kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1288 		    NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1289 		    sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1290 		    VM_SLEEP | VM_BESTFIT);
1291 		sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1292 		    PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1293 		    kmem_tsb_default_arena[0], 0);
1294 	}
1295 
1296 	sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1297 	    HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1298 	    sfmmu_hblkcache_destructor,
1299 	    sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1300 	    hat_memload_arena, KMC_NOHASH);
1301 
1302 	hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1303 	    segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1304 	    VMC_DUMPSAFE | VM_SLEEP);
1305 
1306 	sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1307 	    HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1308 	    sfmmu_hblkcache_destructor,
1309 	    NULL, (void *)HME1BLK_SZ,
1310 	    hat_memload1_arena, KMC_NOHASH);
1311 
1312 	pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1313 	    0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1314 
1315 	ism_blk_cache = kmem_cache_create("ism_blk_cache",
1316 	    sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1317 	    NULL, NULL, static_arena, KMC_NOHASH);
1318 
1319 	ism_ment_cache = kmem_cache_create("ism_ment_cache",
1320 	    sizeof (ism_ment_t), 0, NULL, NULL,
1321 	    NULL, NULL, NULL, 0);
1322 
1323 	/*
1324 	 * We grab the first hat for the kernel,
1325 	 */
1326 	AS_LOCK_ENTER(&kas, &kas.a_lock, RW_WRITER);
1327 	kas.a_hat = hat_alloc(&kas);
1328 	AS_LOCK_EXIT(&kas, &kas.a_lock);
1329 
1330 	/*
1331 	 * Initialize hblk_reserve.
1332 	 */
1333 	((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1334 	    va_to_pa((caddr_t)hblk_reserve);
1335 
1336 #ifndef UTSB_PHYS
1337 	/*
1338 	 * Reserve some kernel virtual address space for the locked TTEs
1339 	 * that allow us to probe the TSB from TL>0.
1340 	 */
1341 	utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1342 	    0, 0, NULL, NULL, VM_SLEEP);
1343 	utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1344 	    0, 0, NULL, NULL, VM_SLEEP);
1345 #endif
1346 
1347 #ifdef VAC
1348 	/*
1349 	 * The big page VAC handling code assumes VAC
1350 	 * will not be bigger than the smallest big
1351 	 * page- which is 64K.
1352 	 */
1353 	if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1354 		cmn_err(CE_PANIC, "VAC too big!");
1355 	}
1356 #endif
1357 
1358 	(void) xhat_init();
1359 
1360 	uhme_hash_pa = va_to_pa(uhme_hash);
1361 	khme_hash_pa = va_to_pa(khme_hash);
1362 
1363 	/*
1364 	 * Initialize relocation locks. kpr_suspendlock is held
1365 	 * at PIL_MAX to prevent interrupts from pinning the holder
1366 	 * of a suspended TTE which may access it leading to a
1367 	 * deadlock condition.
1368 	 */
1369 	mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1370 	mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1371 
1372 	/*
1373 	 * If Shared context support is disabled via /etc/system
1374 	 * set shctx_on to 0 here if it was set to 1 earlier in boot
1375 	 * sequence by cpu module initialization code.
1376 	 */
1377 	if (shctx_on && disable_shctx) {
1378 		shctx_on = 0;
1379 	}
1380 
1381 	if (shctx_on) {
1382 		srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1383 		    sizeof (srd_buckets[0]), KM_SLEEP);
1384 		for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1385 			mutex_init(&srd_buckets[i].srdb_lock, NULL,
1386 			    MUTEX_DEFAULT, NULL);
1387 		}
1388 
1389 		srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1390 		    0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1391 		    NULL, NULL, NULL, 0);
1392 		region_cache = kmem_cache_create("region_cache",
1393 		    sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1394 		    sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1395 		scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1396 		    0, sfmmu_scdcache_constructor,  sfmmu_scdcache_destructor,
1397 		    NULL, NULL, NULL, 0);
1398 	}
1399 
1400 	/*
1401 	 * Pre-allocate hrm_hashtab before enabling the collection of
1402 	 * refmod statistics.  Allocating on the fly would mean us
1403 	 * running the risk of suffering recursive mutex enters or
1404 	 * deadlocks.
1405 	 */
1406 	hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1407 	    KM_SLEEP);
1408 
1409 	/* Allocate per-cpu pending freelist of hmeblks */
1410 	cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1411 	    KM_SLEEP);
1412 	cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1413 	    (uintptr_t)cpu_hme_pend, 64);
1414 
1415 	for (i = 0; i < NCPU; i++) {
1416 		mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1417 		    NULL);
1418 	}
1419 
1420 	if (cpu_hme_pend_thresh == 0) {
1421 		cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1422 	}
1423 }
1424 
1425 /*
1426  * Initialize locking for the hat layer, called early during boot.
1427  */
1428 static void
1429 hat_lock_init()
1430 {
1431 	int i;
1432 
1433 	/*
1434 	 * initialize the array of mutexes protecting a page's mapping
1435 	 * list and p_nrm field.
1436 	 */
1437 	for (i = 0; i < MML_TABLE_SIZE; i++)
1438 		mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1439 
1440 	if (kpm_enable) {
1441 		for (i = 0; i < kpmp_table_sz; i++) {
1442 			mutex_init(&kpmp_table[i].khl_mutex, NULL,
1443 			    MUTEX_DEFAULT, NULL);
1444 		}
1445 	}
1446 
1447 	/*
1448 	 * Initialize array of mutex locks that protects sfmmu fields and
1449 	 * TSB lists.
1450 	 */
1451 	for (i = 0; i < SFMMU_NUM_LOCK; i++)
1452 		mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1453 		    NULL);
1454 }
1455 
1456 #define	SFMMU_KERNEL_MAXVA \
1457 	(kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1458 
1459 /*
1460  * Allocate a hat structure.
1461  * Called when an address space first uses a hat.
1462  */
1463 struct hat *
1464 hat_alloc(struct as *as)
1465 {
1466 	sfmmu_t *sfmmup;
1467 	int i;
1468 	uint64_t cnum;
1469 	extern uint_t get_color_start(struct as *);
1470 
1471 	ASSERT(AS_WRITE_HELD(as, &as->a_lock));
1472 	sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1473 	sfmmup->sfmmu_as = as;
1474 	sfmmup->sfmmu_flags = 0;
1475 	sfmmup->sfmmu_tteflags = 0;
1476 	sfmmup->sfmmu_rtteflags = 0;
1477 	LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1478 
1479 	if (as == &kas) {
1480 		ksfmmup = sfmmup;
1481 		sfmmup->sfmmu_cext = 0;
1482 		cnum = KCONTEXT;
1483 
1484 		sfmmup->sfmmu_clrstart = 0;
1485 		sfmmup->sfmmu_tsb = NULL;
1486 		/*
1487 		 * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1488 		 * to setup tsb_info for ksfmmup.
1489 		 */
1490 	} else {
1491 
1492 		/*
1493 		 * Just set to invalid ctx. When it faults, it will
1494 		 * get a valid ctx. This would avoid the situation
1495 		 * where we get a ctx, but it gets stolen and then
1496 		 * we fault when we try to run and so have to get
1497 		 * another ctx.
1498 		 */
1499 		sfmmup->sfmmu_cext = 0;
1500 		cnum = INVALID_CONTEXT;
1501 
1502 		/* initialize original physical page coloring bin */
1503 		sfmmup->sfmmu_clrstart = get_color_start(as);
1504 #ifdef DEBUG
1505 		if (tsb_random_size) {
1506 			uint32_t randval = (uint32_t)gettick() >> 4;
1507 			int size = randval % (tsb_max_growsize + 1);
1508 
1509 			/* chose a random tsb size for stress testing */
1510 			(void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1511 			    TSB8K|TSB64K|TSB512K, 0, sfmmup);
1512 		} else
1513 #endif /* DEBUG */
1514 			(void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1515 			    default_tsb_size,
1516 			    TSB8K|TSB64K|TSB512K, 0, sfmmup);
1517 		sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1518 		ASSERT(sfmmup->sfmmu_tsb != NULL);
1519 	}
1520 
1521 	ASSERT(max_mmu_ctxdoms > 0);
1522 	for (i = 0; i < max_mmu_ctxdoms; i++) {
1523 		sfmmup->sfmmu_ctxs[i].cnum = cnum;
1524 		sfmmup->sfmmu_ctxs[i].gnum = 0;
1525 	}
1526 
1527 	for (i = 0; i < max_mmu_page_sizes; i++) {
1528 		sfmmup->sfmmu_ttecnt[i] = 0;
1529 		sfmmup->sfmmu_scdrttecnt[i] = 0;
1530 		sfmmup->sfmmu_ismttecnt[i] = 0;
1531 		sfmmup->sfmmu_scdismttecnt[i] = 0;
1532 		sfmmup->sfmmu_pgsz[i] = TTE8K;
1533 	}
1534 	sfmmup->sfmmu_tsb0_4minflcnt = 0;
1535 	sfmmup->sfmmu_iblk = NULL;
1536 	sfmmup->sfmmu_ismhat = 0;
1537 	sfmmup->sfmmu_scdhat = 0;
1538 	sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1539 	if (sfmmup == ksfmmup) {
1540 		CPUSET_ALL(sfmmup->sfmmu_cpusran);
1541 	} else {
1542 		CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1543 	}
1544 	sfmmup->sfmmu_free = 0;
1545 	sfmmup->sfmmu_rmstat = 0;
1546 	sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1547 	sfmmup->sfmmu_xhat_provider = NULL;
1548 	cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1549 	sfmmup->sfmmu_srdp = NULL;
1550 	SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1551 	bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1552 	sfmmup->sfmmu_scdp = NULL;
1553 	sfmmup->sfmmu_scd_link.next = NULL;
1554 	sfmmup->sfmmu_scd_link.prev = NULL;
1555 	return (sfmmup);
1556 }
1557 
1558 /*
1559  * Create per-MMU context domain kstats for a given MMU ctx.
1560  */
1561 static void
1562 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1563 {
1564 	mmu_ctx_stat_t	stat;
1565 	kstat_t		*mmu_kstat;
1566 
1567 	ASSERT(MUTEX_HELD(&cpu_lock));
1568 	ASSERT(mmu_ctxp->mmu_kstat == NULL);
1569 
1570 	mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1571 	    "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1572 
1573 	if (mmu_kstat == NULL) {
1574 		cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1575 		    mmu_ctxp->mmu_idx);
1576 	} else {
1577 		mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1578 		for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1579 			kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1580 			    mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1581 		mmu_ctxp->mmu_kstat = mmu_kstat;
1582 		kstat_install(mmu_kstat);
1583 	}
1584 }
1585 
1586 /*
1587  * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1588  * context domain information for a given CPU. If a platform does not
1589  * specify that interface, then the function below is used instead to return
1590  * default information. The defaults are as follows:
1591  *
1592  *	- The number of MMU context IDs supported on any CPU in the
1593  *	  system is 8K.
1594  *	- There is one MMU context domain per CPU.
1595  */
1596 /*ARGSUSED*/
1597 static void
1598 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1599 {
1600 	infop->mmu_nctxs = nctxs;
1601 	infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1602 }
1603 
1604 /*
1605  * Called during CPU initialization to set the MMU context-related information
1606  * for a CPU.
1607  *
1608  * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1609  */
1610 void
1611 sfmmu_cpu_init(cpu_t *cp)
1612 {
1613 	mmu_ctx_info_t	info;
1614 	mmu_ctx_t	*mmu_ctxp;
1615 
1616 	ASSERT(MUTEX_HELD(&cpu_lock));
1617 
1618 	if (&plat_cpuid_to_mmu_ctx_info == NULL)
1619 		sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1620 	else
1621 		plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1622 
1623 	ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1624 
1625 	if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1626 		/* Each mmu_ctx is cacheline aligned. */
1627 		mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1628 		bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1629 
1630 		mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1631 		    (void *)ipltospl(DISP_LEVEL));
1632 		mmu_ctxp->mmu_idx = info.mmu_idx;
1633 		mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1634 		/*
1635 		 * Globally for lifetime of a system,
1636 		 * gnum must always increase.
1637 		 * mmu_saved_gnum is protected by the cpu_lock.
1638 		 */
1639 		mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1640 		mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1641 
1642 		sfmmu_mmu_kstat_create(mmu_ctxp);
1643 
1644 		mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1645 	} else {
1646 		ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1647 		ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1648 	}
1649 
1650 	/*
1651 	 * The mmu_lock is acquired here to prevent races with
1652 	 * the wrap-around code.
1653 	 */
1654 	mutex_enter(&mmu_ctxp->mmu_lock);
1655 
1656 
1657 	mmu_ctxp->mmu_ncpus++;
1658 	CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1659 	CPU_MMU_IDX(cp) = info.mmu_idx;
1660 	CPU_MMU_CTXP(cp) = mmu_ctxp;
1661 
1662 	mutex_exit(&mmu_ctxp->mmu_lock);
1663 }
1664 
1665 static void
1666 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1667 {
1668 	ASSERT(MUTEX_HELD(&cpu_lock));
1669 	ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1670 
1671 	mutex_destroy(&mmu_ctxp->mmu_lock);
1672 
1673 	if (mmu_ctxp->mmu_kstat)
1674 		kstat_delete(mmu_ctxp->mmu_kstat);
1675 
1676 	/* mmu_saved_gnum is protected by the cpu_lock. */
1677 	if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1678 		mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1679 
1680 	kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1681 }
1682 
1683 /*
1684  * Called to perform MMU context-related cleanup for a CPU.
1685  */
1686 void
1687 sfmmu_cpu_cleanup(cpu_t *cp)
1688 {
1689 	mmu_ctx_t	*mmu_ctxp;
1690 
1691 	ASSERT(MUTEX_HELD(&cpu_lock));
1692 
1693 	mmu_ctxp = CPU_MMU_CTXP(cp);
1694 	ASSERT(mmu_ctxp != NULL);
1695 
1696 	/*
1697 	 * The mmu_lock is acquired here to prevent races with
1698 	 * the wrap-around code.
1699 	 */
1700 	mutex_enter(&mmu_ctxp->mmu_lock);
1701 
1702 	CPU_MMU_CTXP(cp) = NULL;
1703 
1704 	CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1705 	if (--mmu_ctxp->mmu_ncpus == 0) {
1706 		mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1707 		mutex_exit(&mmu_ctxp->mmu_lock);
1708 		sfmmu_ctxdom_free(mmu_ctxp);
1709 		return;
1710 	}
1711 
1712 	mutex_exit(&mmu_ctxp->mmu_lock);
1713 }
1714 
1715 uint_t
1716 sfmmu_ctxdom_nctxs(int idx)
1717 {
1718 	return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1719 }
1720 
1721 #ifdef sun4v
1722 /*
1723  * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1724  * consistant after suspend/resume on system that can resume on a different
1725  * hardware than it was suspended.
1726  *
1727  * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1728  * from being allocated.  It acquires all hat_locks, which blocks most access to
1729  * context data, except for a few cases that are handled separately or are
1730  * harmless.  It wraps each domain to increment gnum and invalidate on-CPU
1731  * contexts, and forces cnum to its max.  As a result of this call all user
1732  * threads that are running on CPUs trap and try to perform wrap around but
1733  * can't because hat_locks are taken.  Threads that were not on CPUs but started
1734  * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1735  * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1736  * on hat_lock trying to wrap.  sfmmu_ctxdom_lock() must be called before CPUs
1737  * are paused, else it could deadlock acquiring locks held by paused CPUs.
1738  *
1739  * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1740  * the CPUs that had them.  It must be called after CPUs have been paused. This
1741  * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1742  * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1743  * runs with interrupts disabled.  When CPUs are later resumed, they may enter
1744  * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1745  * return failure.  Or, they will be blocked trying to acquire hat_lock. Thus
1746  * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1747  * accessing the old context domains.
1748  *
1749  * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1750  * allocates new context domains based on hardware layout.  It initializes
1751  * every CPU that had context domain before migration to have one again.
1752  * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1753  * could deadlock acquiring locks held by paused CPUs.
1754  *
1755  * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1756  * acquire new context ids and continue execution.
1757  *
1758  * Therefore functions should be called in the following order:
1759  *       suspend_routine()
1760  *		sfmmu_ctxdom_lock()
1761  *		pause_cpus()
1762  *		suspend()
1763  *			if (suspend failed)
1764  *				sfmmu_ctxdom_unlock()
1765  *		...
1766  *		sfmmu_ctxdom_remove()
1767  *		resume_cpus()
1768  *		sfmmu_ctxdom_update()
1769  *		sfmmu_ctxdom_unlock()
1770  */
1771 static cpuset_t sfmmu_ctxdoms_pset;
1772 
1773 void
1774 sfmmu_ctxdoms_remove()
1775 {
1776 	processorid_t	id;
1777 	cpu_t		*cp;
1778 
1779 	/*
1780 	 * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1781 	 * be restored post-migration. A CPU may be powered off and not have a
1782 	 * domain, for example.
1783 	 */
1784 	CPUSET_ZERO(sfmmu_ctxdoms_pset);
1785 
1786 	for (id = 0; id < NCPU; id++) {
1787 		if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1788 			CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1789 			CPU_MMU_CTXP(cp) = NULL;
1790 		}
1791 	}
1792 }
1793 
1794 void
1795 sfmmu_ctxdoms_lock(void)
1796 {
1797 	int		idx;
1798 	mmu_ctx_t	*mmu_ctxp;
1799 
1800 	sfmmu_hat_lock_all();
1801 
1802 	/*
1803 	 * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1804 	 * hat_lock is always taken before calling it.
1805 	 *
1806 	 * For each domain, set mmu_cnum to max so no more contexts can be
1807 	 * allocated, and wrap to flush on-CPU contexts and force threads to
1808 	 * acquire a new context when we later drop hat_lock after migration.
1809 	 * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1810 	 * but the latter uses CAS and will miscompare and not overwrite it.
1811 	 */
1812 	kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1813 	for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1814 		if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1815 			mutex_enter(&mmu_ctxp->mmu_lock);
1816 			mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1817 			/* make sure updated cnum visible */
1818 			membar_enter();
1819 			mutex_exit(&mmu_ctxp->mmu_lock);
1820 			sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1821 		}
1822 	}
1823 	kpreempt_enable();
1824 }
1825 
1826 void
1827 sfmmu_ctxdoms_unlock(void)
1828 {
1829 	sfmmu_hat_unlock_all();
1830 }
1831 
1832 void
1833 sfmmu_ctxdoms_update(void)
1834 {
1835 	processorid_t	id;
1836 	cpu_t		*cp;
1837 	uint_t		idx;
1838 	mmu_ctx_t	*mmu_ctxp;
1839 
1840 	/*
1841 	 * Free all context domains.  As side effect, this increases
1842 	 * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1843 	 * init gnum in the new domains, which therefore will be larger than the
1844 	 * sfmmu gnum for any process, guaranteeing that every process will see
1845 	 * a new generation and allocate a new context regardless of what new
1846 	 * domain it runs in.
1847 	 */
1848 	mutex_enter(&cpu_lock);
1849 
1850 	for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1851 		if (mmu_ctxs_tbl[idx] != NULL) {
1852 			mmu_ctxp = mmu_ctxs_tbl[idx];
1853 			mmu_ctxs_tbl[idx] = NULL;
1854 			sfmmu_ctxdom_free(mmu_ctxp);
1855 		}
1856 	}
1857 
1858 	for (id = 0; id < NCPU; id++) {
1859 		if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1860 		    (cp = cpu[id]) != NULL)
1861 			sfmmu_cpu_init(cp);
1862 	}
1863 	mutex_exit(&cpu_lock);
1864 }
1865 #endif
1866 
1867 /*
1868  * Hat_setup, makes an address space context the current active one.
1869  * In sfmmu this translates to setting the secondary context with the
1870  * corresponding context.
1871  */
1872 void
1873 hat_setup(struct hat *sfmmup, int allocflag)
1874 {
1875 	hatlock_t *hatlockp;
1876 
1877 	/* Init needs some special treatment. */
1878 	if (allocflag == HAT_INIT) {
1879 		/*
1880 		 * Make sure that we have
1881 		 * 1. a TSB
1882 		 * 2. a valid ctx that doesn't get stolen after this point.
1883 		 */
1884 		hatlockp = sfmmu_hat_enter(sfmmup);
1885 
1886 		/*
1887 		 * Swap in the TSB.  hat_init() allocates tsbinfos without
1888 		 * TSBs, but we need one for init, since the kernel does some
1889 		 * special things to set up its stack and needs the TSB to
1890 		 * resolve page faults.
1891 		 */
1892 		sfmmu_tsb_swapin(sfmmup, hatlockp);
1893 
1894 		sfmmu_get_ctx(sfmmup);
1895 
1896 		sfmmu_hat_exit(hatlockp);
1897 	} else {
1898 		ASSERT(allocflag == HAT_ALLOC);
1899 
1900 		hatlockp = sfmmu_hat_enter(sfmmup);
1901 		kpreempt_disable();
1902 
1903 		CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1904 		/*
1905 		 * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1906 		 * pagesize bits don't matter in this case since we are passing
1907 		 * INVALID_CONTEXT to it.
1908 		 * Compatibility Note: hw takes care of MMU_SCONTEXT1
1909 		 */
1910 		sfmmu_setctx_sec(INVALID_CONTEXT);
1911 		sfmmu_clear_utsbinfo();
1912 
1913 		kpreempt_enable();
1914 		sfmmu_hat_exit(hatlockp);
1915 	}
1916 }
1917 
1918 /*
1919  * Free all the translation resources for the specified address space.
1920  * Called from as_free when an address space is being destroyed.
1921  */
1922 void
1923 hat_free_start(struct hat *sfmmup)
1924 {
1925 	ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
1926 	ASSERT(sfmmup != ksfmmup);
1927 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
1928 
1929 	sfmmup->sfmmu_free = 1;
1930 	if (sfmmup->sfmmu_scdp != NULL) {
1931 		sfmmu_leave_scd(sfmmup, 0);
1932 	}
1933 
1934 	ASSERT(sfmmup->sfmmu_scdp == NULL);
1935 }
1936 
1937 void
1938 hat_free_end(struct hat *sfmmup)
1939 {
1940 	int i;
1941 
1942 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
1943 	ASSERT(sfmmup->sfmmu_free == 1);
1944 	ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1945 	ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1946 	ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1947 	ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1948 	ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1949 	ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1950 
1951 	if (sfmmup->sfmmu_rmstat) {
1952 		hat_freestat(sfmmup->sfmmu_as, NULL);
1953 	}
1954 
1955 	while (sfmmup->sfmmu_tsb != NULL) {
1956 		struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1957 		sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1958 		sfmmup->sfmmu_tsb = next;
1959 	}
1960 
1961 	if (sfmmup->sfmmu_srdp != NULL) {
1962 		sfmmu_leave_srd(sfmmup);
1963 		ASSERT(sfmmup->sfmmu_srdp == NULL);
1964 		for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1965 			if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1966 				kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1967 				    SFMMU_L2_HMERLINKS_SIZE);
1968 				sfmmup->sfmmu_hmeregion_links[i] = NULL;
1969 			}
1970 		}
1971 	}
1972 	sfmmu_free_sfmmu(sfmmup);
1973 
1974 #ifdef DEBUG
1975 	for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1976 		ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1977 	}
1978 #endif
1979 
1980 	kmem_cache_free(sfmmuid_cache, sfmmup);
1981 }
1982 
1983 /*
1984  * Set up any translation structures, for the specified address space,
1985  * that are needed or preferred when the process is being swapped in.
1986  */
1987 /* ARGSUSED */
1988 void
1989 hat_swapin(struct hat *hat)
1990 {
1991 	ASSERT(hat->sfmmu_xhat_provider == NULL);
1992 }
1993 
1994 /*
1995  * Free all of the translation resources, for the specified address space,
1996  * that can be freed while the process is swapped out. Called from as_swapout.
1997  * Also, free up the ctx that this process was using.
1998  */
1999 void
2000 hat_swapout(struct hat *sfmmup)
2001 {
2002 	struct hmehash_bucket *hmebp;
2003 	struct hme_blk *hmeblkp;
2004 	struct hme_blk *pr_hblk = NULL;
2005 	struct hme_blk *nx_hblk;
2006 	int i;
2007 	struct hme_blk *list = NULL;
2008 	hatlock_t *hatlockp;
2009 	struct tsb_info *tsbinfop;
2010 	struct free_tsb {
2011 		struct free_tsb *next;
2012 		struct tsb_info *tsbinfop;
2013 	};			/* free list of TSBs */
2014 	struct free_tsb *freelist, *last, *next;
2015 
2016 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
2017 	SFMMU_STAT(sf_swapout);
2018 
2019 	/*
2020 	 * There is no way to go from an as to all its translations in sfmmu.
2021 	 * Here is one of the times when we take the big hit and traverse
2022 	 * the hash looking for hme_blks to free up.  Not only do we free up
2023 	 * this as hme_blks but all those that are free.  We are obviously
2024 	 * swapping because we need memory so let's free up as much
2025 	 * as we can.
2026 	 *
2027 	 * Note that we don't flush TLB/TSB here -- it's not necessary
2028 	 * because:
2029 	 *  1) we free the ctx we're using and throw away the TSB(s);
2030 	 *  2) processes aren't runnable while being swapped out.
2031 	 */
2032 	ASSERT(sfmmup != KHATID);
2033 	for (i = 0; i <= UHMEHASH_SZ; i++) {
2034 		hmebp = &uhme_hash[i];
2035 		SFMMU_HASH_LOCK(hmebp);
2036 		hmeblkp = hmebp->hmeblkp;
2037 		pr_hblk = NULL;
2038 		while (hmeblkp) {
2039 
2040 			ASSERT(!hmeblkp->hblk_xhat_bit);
2041 
2042 			if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2043 			    !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2044 				ASSERT(!hmeblkp->hblk_shared);
2045 				(void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2046 				    (caddr_t)get_hblk_base(hmeblkp),
2047 				    get_hblk_endaddr(hmeblkp),
2048 				    NULL, HAT_UNLOAD);
2049 			}
2050 			nx_hblk = hmeblkp->hblk_next;
2051 			if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2052 				ASSERT(!hmeblkp->hblk_lckcnt);
2053 				sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2054 				    &list, 0);
2055 			} else {
2056 				pr_hblk = hmeblkp;
2057 			}
2058 			hmeblkp = nx_hblk;
2059 		}
2060 		SFMMU_HASH_UNLOCK(hmebp);
2061 	}
2062 
2063 	sfmmu_hblks_list_purge(&list, 0);
2064 
2065 	/*
2066 	 * Now free up the ctx so that others can reuse it.
2067 	 */
2068 	hatlockp = sfmmu_hat_enter(sfmmup);
2069 
2070 	sfmmu_invalidate_ctx(sfmmup);
2071 
2072 	/*
2073 	 * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2074 	 * If TSBs were never swapped in, just return.
2075 	 * This implies that we don't support partial swapping
2076 	 * of TSBs -- either all are swapped out, or none are.
2077 	 *
2078 	 * We must hold the HAT lock here to prevent racing with another
2079 	 * thread trying to unmap TTEs from the TSB or running the post-
2080 	 * relocator after relocating the TSB's memory.  Unfortunately, we
2081 	 * can't free memory while holding the HAT lock or we could
2082 	 * deadlock, so we build a list of TSBs to be freed after marking
2083 	 * the tsbinfos as swapped out and free them after dropping the
2084 	 * lock.
2085 	 */
2086 	if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2087 		sfmmu_hat_exit(hatlockp);
2088 		return;
2089 	}
2090 
2091 	SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2092 	last = freelist = NULL;
2093 	for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2094 	    tsbinfop = tsbinfop->tsb_next) {
2095 		ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2096 
2097 		/*
2098 		 * Cast the TSB into a struct free_tsb and put it on the free
2099 		 * list.
2100 		 */
2101 		if (freelist == NULL) {
2102 			last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2103 		} else {
2104 			last->next = (struct free_tsb *)tsbinfop->tsb_va;
2105 			last = last->next;
2106 		}
2107 		last->next = NULL;
2108 		last->tsbinfop = tsbinfop;
2109 		tsbinfop->tsb_flags |= TSB_SWAPPED;
2110 		/*
2111 		 * Zero out the TTE to clear the valid bit.
2112 		 * Note we can't use a value like 0xbad because we want to
2113 		 * ensure diagnostic bits are NEVER set on TTEs that might
2114 		 * be loaded.  The intent is to catch any invalid access
2115 		 * to the swapped TSB, such as a thread running with a valid
2116 		 * context without first calling sfmmu_tsb_swapin() to
2117 		 * allocate TSB memory.
2118 		 */
2119 		tsbinfop->tsb_tte.ll = 0;
2120 	}
2121 
2122 	/* Now we can drop the lock and free the TSB memory. */
2123 	sfmmu_hat_exit(hatlockp);
2124 	for (; freelist != NULL; freelist = next) {
2125 		next = freelist->next;
2126 		sfmmu_tsb_free(freelist->tsbinfop);
2127 	}
2128 }
2129 
2130 /*
2131  * Duplicate the translations of an as into another newas
2132  */
2133 /* ARGSUSED */
2134 int
2135 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2136 	uint_t flag)
2137 {
2138 	sf_srd_t *srdp;
2139 	sf_scd_t *scdp;
2140 	int i;
2141 	extern uint_t get_color_start(struct as *);
2142 
2143 	ASSERT(hat->sfmmu_xhat_provider == NULL);
2144 	ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2145 	    (flag == HAT_DUP_SRD));
2146 	ASSERT(hat != ksfmmup);
2147 	ASSERT(newhat != ksfmmup);
2148 	ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2149 
2150 	if (flag == HAT_DUP_COW) {
2151 		panic("hat_dup: HAT_DUP_COW not supported");
2152 	}
2153 
2154 	if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2155 		ASSERT(srdp->srd_evp != NULL);
2156 		VN_HOLD(srdp->srd_evp);
2157 		ASSERT(srdp->srd_refcnt > 0);
2158 		newhat->sfmmu_srdp = srdp;
2159 		atomic_add_32((volatile uint_t *)&srdp->srd_refcnt, 1);
2160 	}
2161 
2162 	/*
2163 	 * HAT_DUP_ALL flag is used after as duplication is done.
2164 	 */
2165 	if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2166 		ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2167 		newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2168 		if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2169 			newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2170 		}
2171 
2172 		/* check if need to join scd */
2173 		if ((scdp = hat->sfmmu_scdp) != NULL &&
2174 		    newhat->sfmmu_scdp != scdp) {
2175 			int ret;
2176 			SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2177 			    &scdp->scd_region_map, ret);
2178 			ASSERT(ret);
2179 			sfmmu_join_scd(scdp, newhat);
2180 			ASSERT(newhat->sfmmu_scdp == scdp &&
2181 			    scdp->scd_refcnt >= 2);
2182 			for (i = 0; i < max_mmu_page_sizes; i++) {
2183 				newhat->sfmmu_ismttecnt[i] =
2184 				    hat->sfmmu_ismttecnt[i];
2185 				newhat->sfmmu_scdismttecnt[i] =
2186 				    hat->sfmmu_scdismttecnt[i];
2187 			}
2188 		}
2189 
2190 		sfmmu_check_page_sizes(newhat, 1);
2191 	}
2192 
2193 	if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2194 	    update_proc_pgcolorbase_after_fork != 0) {
2195 		hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2196 	}
2197 	return (0);
2198 }
2199 
2200 void
2201 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2202 	uint_t attr, uint_t flags)
2203 {
2204 	hat_do_memload(hat, addr, pp, attr, flags,
2205 	    SFMMU_INVALID_SHMERID);
2206 }
2207 
2208 void
2209 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2210 	uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2211 {
2212 	uint_t rid;
2213 	if (rcookie == HAT_INVALID_REGION_COOKIE ||
2214 	    hat->sfmmu_xhat_provider != NULL) {
2215 		hat_do_memload(hat, addr, pp, attr, flags,
2216 		    SFMMU_INVALID_SHMERID);
2217 		return;
2218 	}
2219 	rid = (uint_t)((uint64_t)rcookie);
2220 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2221 	hat_do_memload(hat, addr, pp, attr, flags, rid);
2222 }
2223 
2224 /*
2225  * Set up addr to map to page pp with protection prot.
2226  * As an optimization we also load the TSB with the
2227  * corresponding tte but it is no big deal if  the tte gets kicked out.
2228  */
2229 static void
2230 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2231 	uint_t attr, uint_t flags, uint_t rid)
2232 {
2233 	tte_t tte;
2234 
2235 
2236 	ASSERT(hat != NULL);
2237 	ASSERT(PAGE_LOCKED(pp));
2238 	ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2239 	ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2240 	ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2241 	SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2242 
2243 	if (PP_ISFREE(pp)) {
2244 		panic("hat_memload: loading a mapping to free page %p",
2245 		    (void *)pp);
2246 	}
2247 
2248 	if (hat->sfmmu_xhat_provider) {
2249 		/* no regions for xhats */
2250 		ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
2251 		XHAT_MEMLOAD(hat, addr, pp, attr, flags);
2252 		return;
2253 	}
2254 
2255 	ASSERT((hat == ksfmmup) ||
2256 	    AS_LOCK_HELD(hat->sfmmu_as, &hat->sfmmu_as->a_lock));
2257 
2258 	if (flags & ~SFMMU_LOAD_ALLFLAG)
2259 		cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2260 		    flags & ~SFMMU_LOAD_ALLFLAG);
2261 
2262 	if (hat->sfmmu_rmstat)
2263 		hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2264 
2265 #if defined(SF_ERRATA_57)
2266 	if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2267 	    (addr < errata57_limit) && (attr & PROT_EXEC) &&
2268 	    !(flags & HAT_LOAD_SHARE)) {
2269 		cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2270 		    " page executable");
2271 		attr &= ~PROT_EXEC;
2272 	}
2273 #endif
2274 
2275 	sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2276 	(void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2277 
2278 	/*
2279 	 * Check TSB and TLB page sizes.
2280 	 */
2281 	if ((flags & HAT_LOAD_SHARE) == 0) {
2282 		sfmmu_check_page_sizes(hat, 1);
2283 	}
2284 }
2285 
2286 /*
2287  * hat_devload can be called to map real memory (e.g.
2288  * /dev/kmem) and even though hat_devload will determine pf is
2289  * for memory, it will be unable to get a shared lock on the
2290  * page (because someone else has it exclusively) and will
2291  * pass dp = NULL.  If tteload doesn't get a non-NULL
2292  * page pointer it can't cache memory.
2293  */
2294 void
2295 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2296 	uint_t attr, int flags)
2297 {
2298 	tte_t tte;
2299 	struct page *pp = NULL;
2300 	int use_lgpg = 0;
2301 
2302 	ASSERT(hat != NULL);
2303 
2304 	if (hat->sfmmu_xhat_provider) {
2305 		XHAT_DEVLOAD(hat, addr, len, pfn, attr, flags);
2306 		return;
2307 	}
2308 
2309 	ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2310 	ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2311 	ASSERT((hat == ksfmmup) ||
2312 	    AS_LOCK_HELD(hat->sfmmu_as, &hat->sfmmu_as->a_lock));
2313 	if (len == 0)
2314 		panic("hat_devload: zero len");
2315 	if (flags & ~SFMMU_LOAD_ALLFLAG)
2316 		cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2317 		    flags & ~SFMMU_LOAD_ALLFLAG);
2318 
2319 #if defined(SF_ERRATA_57)
2320 	if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2321 	    (addr < errata57_limit) && (attr & PROT_EXEC) &&
2322 	    !(flags & HAT_LOAD_SHARE)) {
2323 		cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2324 		    " page executable");
2325 		attr &= ~PROT_EXEC;
2326 	}
2327 #endif
2328 
2329 	/*
2330 	 * If it's a memory page find its pp
2331 	 */
2332 	if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2333 		pp = page_numtopp_nolock(pfn);
2334 		if (pp == NULL) {
2335 			flags |= HAT_LOAD_NOCONSIST;
2336 		} else {
2337 			if (PP_ISFREE(pp)) {
2338 				panic("hat_memload: loading "
2339 				    "a mapping to free page %p",
2340 				    (void *)pp);
2341 			}
2342 			if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2343 				panic("hat_memload: loading a mapping "
2344 				    "to unlocked relocatable page %p",
2345 				    (void *)pp);
2346 			}
2347 			ASSERT(len == MMU_PAGESIZE);
2348 		}
2349 	}
2350 
2351 	if (hat->sfmmu_rmstat)
2352 		hat_resvstat(len, hat->sfmmu_as, addr);
2353 
2354 	if (flags & HAT_LOAD_NOCONSIST) {
2355 		attr |= SFMMU_UNCACHEVTTE;
2356 		use_lgpg = 1;
2357 	}
2358 	if (!pf_is_memory(pfn)) {
2359 		attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2360 		use_lgpg = 1;
2361 		switch (attr & HAT_ORDER_MASK) {
2362 			case HAT_STRICTORDER:
2363 			case HAT_UNORDERED_OK:
2364 				/*
2365 				 * we set the side effect bit for all non
2366 				 * memory mappings unless merging is ok
2367 				 */
2368 				attr |= SFMMU_SIDEFFECT;
2369 				break;
2370 			case HAT_MERGING_OK:
2371 			case HAT_LOADCACHING_OK:
2372 			case HAT_STORECACHING_OK:
2373 				break;
2374 			default:
2375 				panic("hat_devload: bad attr");
2376 				break;
2377 		}
2378 	}
2379 	while (len) {
2380 		if (!use_lgpg) {
2381 			sfmmu_memtte(&tte, pfn, attr, TTE8K);
2382 			(void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2383 			    flags, SFMMU_INVALID_SHMERID);
2384 			len -= MMU_PAGESIZE;
2385 			addr += MMU_PAGESIZE;
2386 			pfn++;
2387 			continue;
2388 		}
2389 		/*
2390 		 *  try to use large pages, check va/pa alignments
2391 		 *  Note that 32M/256M page sizes are not (yet) supported.
2392 		 */
2393 		if ((len >= MMU_PAGESIZE4M) &&
2394 		    !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2395 		    !(disable_large_pages & (1 << TTE4M)) &&
2396 		    !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2397 			sfmmu_memtte(&tte, pfn, attr, TTE4M);
2398 			(void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2399 			    flags, SFMMU_INVALID_SHMERID);
2400 			len -= MMU_PAGESIZE4M;
2401 			addr += MMU_PAGESIZE4M;
2402 			pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2403 		} else if ((len >= MMU_PAGESIZE512K) &&
2404 		    !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2405 		    !(disable_large_pages & (1 << TTE512K)) &&
2406 		    !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2407 			sfmmu_memtte(&tte, pfn, attr, TTE512K);
2408 			(void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2409 			    flags, SFMMU_INVALID_SHMERID);
2410 			len -= MMU_PAGESIZE512K;
2411 			addr += MMU_PAGESIZE512K;
2412 			pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2413 		} else if ((len >= MMU_PAGESIZE64K) &&
2414 		    !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2415 		    !(disable_large_pages & (1 << TTE64K)) &&
2416 		    !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2417 			sfmmu_memtte(&tte, pfn, attr, TTE64K);
2418 			(void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2419 			    flags, SFMMU_INVALID_SHMERID);
2420 			len -= MMU_PAGESIZE64K;
2421 			addr += MMU_PAGESIZE64K;
2422 			pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2423 		} else {
2424 			sfmmu_memtte(&tte, pfn, attr, TTE8K);
2425 			(void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2426 			    flags, SFMMU_INVALID_SHMERID);
2427 			len -= MMU_PAGESIZE;
2428 			addr += MMU_PAGESIZE;
2429 			pfn++;
2430 		}
2431 	}
2432 
2433 	/*
2434 	 * Check TSB and TLB page sizes.
2435 	 */
2436 	if ((flags & HAT_LOAD_SHARE) == 0) {
2437 		sfmmu_check_page_sizes(hat, 1);
2438 	}
2439 }
2440 
2441 void
2442 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2443 	struct page **pps, uint_t attr, uint_t flags)
2444 {
2445 	hat_do_memload_array(hat, addr, len, pps, attr, flags,
2446 	    SFMMU_INVALID_SHMERID);
2447 }
2448 
2449 void
2450 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2451 	struct page **pps, uint_t attr, uint_t flags,
2452 	hat_region_cookie_t rcookie)
2453 {
2454 	uint_t rid;
2455 	if (rcookie == HAT_INVALID_REGION_COOKIE ||
2456 	    hat->sfmmu_xhat_provider != NULL) {
2457 		hat_do_memload_array(hat, addr, len, pps, attr, flags,
2458 		    SFMMU_INVALID_SHMERID);
2459 		return;
2460 	}
2461 	rid = (uint_t)((uint64_t)rcookie);
2462 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2463 	hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2464 }
2465 
2466 /*
2467  * Map the largest extend possible out of the page array. The array may NOT
2468  * be in order.  The largest possible mapping a page can have
2469  * is specified in the p_szc field.  The p_szc field
2470  * cannot change as long as there any mappings (large or small)
2471  * to any of the pages that make up the large page. (ie. any
2472  * promotion/demotion of page size is not up to the hat but up to
2473  * the page free list manager).  The array
2474  * should consist of properly aligned contigous pages that are
2475  * part of a big page for a large mapping to be created.
2476  */
2477 static void
2478 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2479 	struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2480 {
2481 	int  ttesz;
2482 	size_t mapsz;
2483 	pgcnt_t	numpg, npgs;
2484 	tte_t tte;
2485 	page_t *pp;
2486 	uint_t large_pages_disable;
2487 
2488 	ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2489 	SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2490 
2491 	if (hat->sfmmu_xhat_provider) {
2492 		ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
2493 		XHAT_MEMLOAD_ARRAY(hat, addr, len, pps, attr, flags);
2494 		return;
2495 	}
2496 
2497 	if (hat->sfmmu_rmstat)
2498 		hat_resvstat(len, hat->sfmmu_as, addr);
2499 
2500 #if defined(SF_ERRATA_57)
2501 	if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2502 	    (addr < errata57_limit) && (attr & PROT_EXEC) &&
2503 	    !(flags & HAT_LOAD_SHARE)) {
2504 		cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2505 		    "user page executable");
2506 		attr &= ~PROT_EXEC;
2507 	}
2508 #endif
2509 
2510 	/* Get number of pages */
2511 	npgs = len >> MMU_PAGESHIFT;
2512 
2513 	if (flags & HAT_LOAD_SHARE) {
2514 		large_pages_disable = disable_ism_large_pages;
2515 	} else {
2516 		large_pages_disable = disable_large_pages;
2517 	}
2518 
2519 	if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2520 		sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2521 		    rid);
2522 		return;
2523 	}
2524 
2525 	while (npgs >= NHMENTS) {
2526 		pp = *pps;
2527 		for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2528 			/*
2529 			 * Check if this page size is disabled.
2530 			 */
2531 			if (large_pages_disable & (1 << ttesz))
2532 				continue;
2533 
2534 			numpg = TTEPAGES(ttesz);
2535 			mapsz = numpg << MMU_PAGESHIFT;
2536 			if ((npgs >= numpg) &&
2537 			    IS_P2ALIGNED(addr, mapsz) &&
2538 			    IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2539 				/*
2540 				 * At this point we have enough pages and
2541 				 * we know the virtual address and the pfn
2542 				 * are properly aligned.  We still need
2543 				 * to check for physical contiguity but since
2544 				 * it is very likely that this is the case
2545 				 * we will assume they are so and undo
2546 				 * the request if necessary.  It would
2547 				 * be great if we could get a hint flag
2548 				 * like HAT_CONTIG which would tell us
2549 				 * the pages are contigous for sure.
2550 				 */
2551 				sfmmu_memtte(&tte, (*pps)->p_pagenum,
2552 				    attr, ttesz);
2553 				if (!sfmmu_tteload_array(hat, &tte, addr,
2554 				    pps, flags, rid)) {
2555 					break;
2556 				}
2557 			}
2558 		}
2559 		if (ttesz == TTE8K) {
2560 			/*
2561 			 * We were not able to map array using a large page
2562 			 * batch a hmeblk or fraction at a time.
2563 			 */
2564 			numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2565 			    & (NHMENTS-1);
2566 			numpg = NHMENTS - numpg;
2567 			ASSERT(numpg <= npgs);
2568 			mapsz = numpg * MMU_PAGESIZE;
2569 			sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2570 			    numpg, rid);
2571 		}
2572 		addr += mapsz;
2573 		npgs -= numpg;
2574 		pps += numpg;
2575 	}
2576 
2577 	if (npgs) {
2578 		sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2579 		    rid);
2580 	}
2581 
2582 	/*
2583 	 * Check TSB and TLB page sizes.
2584 	 */
2585 	if ((flags & HAT_LOAD_SHARE) == 0) {
2586 		sfmmu_check_page_sizes(hat, 1);
2587 	}
2588 }
2589 
2590 /*
2591  * Function tries to batch 8K pages into the same hme blk.
2592  */
2593 static void
2594 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2595 		    uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2596 {
2597 	tte_t	tte;
2598 	page_t *pp;
2599 	struct hmehash_bucket *hmebp;
2600 	struct hme_blk *hmeblkp;
2601 	int	index;
2602 
2603 	while (npgs) {
2604 		/*
2605 		 * Acquire the hash bucket.
2606 		 */
2607 		hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2608 		    rid);
2609 		ASSERT(hmebp);
2610 
2611 		/*
2612 		 * Find the hment block.
2613 		 */
2614 		hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2615 		    TTE8K, flags, rid);
2616 		ASSERT(hmeblkp);
2617 
2618 		do {
2619 			/*
2620 			 * Make the tte.
2621 			 */
2622 			pp = *pps;
2623 			sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2624 
2625 			/*
2626 			 * Add the translation.
2627 			 */
2628 			(void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2629 			    vaddr, pps, flags, rid);
2630 
2631 			/*
2632 			 * Goto next page.
2633 			 */
2634 			pps++;
2635 			npgs--;
2636 
2637 			/*
2638 			 * Goto next address.
2639 			 */
2640 			vaddr += MMU_PAGESIZE;
2641 
2642 			/*
2643 			 * Don't crossover into a different hmentblk.
2644 			 */
2645 			index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2646 			    (NHMENTS-1));
2647 
2648 		} while (index != 0 && npgs != 0);
2649 
2650 		/*
2651 		 * Release the hash bucket.
2652 		 */
2653 
2654 		sfmmu_tteload_release_hashbucket(hmebp);
2655 	}
2656 }
2657 
2658 /*
2659  * Construct a tte for a page:
2660  *
2661  * tte_valid = 1
2662  * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2663  * tte_size = size
2664  * tte_nfo = attr & HAT_NOFAULT
2665  * tte_ie = attr & HAT_STRUCTURE_LE
2666  * tte_hmenum = hmenum
2667  * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2668  * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2669  * tte_ref = 1 (optimization)
2670  * tte_wr_perm = attr & PROT_WRITE;
2671  * tte_no_sync = attr & HAT_NOSYNC
2672  * tte_lock = attr & SFMMU_LOCKTTE
2673  * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2674  * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2675  * tte_e = attr & SFMMU_SIDEFFECT
2676  * tte_priv = !(attr & PROT_USER)
2677  * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2678  * tte_glb = 0
2679  */
2680 void
2681 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2682 {
2683 	ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2684 
2685 	ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2686 	ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2687 
2688 	if (TTE_IS_NOSYNC(ttep)) {
2689 		TTE_SET_REF(ttep);
2690 		if (TTE_IS_WRITABLE(ttep)) {
2691 			TTE_SET_MOD(ttep);
2692 		}
2693 	}
2694 	if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2695 		panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2696 	}
2697 }
2698 
2699 /*
2700  * This function will add a translation to the hme_blk and allocate the
2701  * hme_blk if one does not exist.
2702  * If a page structure is specified then it will add the
2703  * corresponding hment to the mapping list.
2704  * It will also update the hmenum field for the tte.
2705  *
2706  * Currently this function is only used for kernel mappings.
2707  * So pass invalid region to sfmmu_tteload_array().
2708  */
2709 void
2710 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2711 	uint_t flags)
2712 {
2713 	ASSERT(sfmmup == ksfmmup);
2714 	(void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2715 	    SFMMU_INVALID_SHMERID);
2716 }
2717 
2718 /*
2719  * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2720  * Assumes that a particular page size may only be resident in one TSB.
2721  */
2722 static void
2723 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2724 {
2725 	struct tsb_info *tsbinfop = NULL;
2726 	uint64_t tag;
2727 	struct tsbe *tsbe_addr;
2728 	uint64_t tsb_base;
2729 	uint_t tsb_size;
2730 	int vpshift = MMU_PAGESHIFT;
2731 	int phys = 0;
2732 
2733 	if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2734 		phys = ktsb_phys;
2735 		if (ttesz >= TTE4M) {
2736 #ifndef sun4v
2737 			ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2738 #endif
2739 			tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2740 			tsb_size = ktsb4m_szcode;
2741 		} else {
2742 			tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2743 			tsb_size = ktsb_szcode;
2744 		}
2745 	} else {
2746 		SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2747 
2748 		/*
2749 		 * If there isn't a TSB for this page size, or the TSB is
2750 		 * swapped out, there is nothing to do.  Note that the latter
2751 		 * case seems impossible but can occur if hat_pageunload()
2752 		 * is called on an ISM mapping while the process is swapped
2753 		 * out.
2754 		 */
2755 		if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2756 			return;
2757 
2758 		/*
2759 		 * If another thread is in the middle of relocating a TSB
2760 		 * we can't unload the entry so set a flag so that the
2761 		 * TSB will be flushed before it can be accessed by the
2762 		 * process.
2763 		 */
2764 		if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2765 			if (ttep == NULL)
2766 				tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2767 			return;
2768 		}
2769 #if defined(UTSB_PHYS)
2770 		phys = 1;
2771 		tsb_base = (uint64_t)tsbinfop->tsb_pa;
2772 #else
2773 		tsb_base = (uint64_t)tsbinfop->tsb_va;
2774 #endif
2775 		tsb_size = tsbinfop->tsb_szc;
2776 	}
2777 	if (ttesz >= TTE4M)
2778 		vpshift = MMU_PAGESHIFT4M;
2779 
2780 	tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2781 	tag = sfmmu_make_tsbtag(vaddr);
2782 
2783 	if (ttep == NULL) {
2784 		sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2785 	} else {
2786 		if (ttesz >= TTE4M) {
2787 			SFMMU_STAT(sf_tsb_load4m);
2788 		} else {
2789 			SFMMU_STAT(sf_tsb_load8k);
2790 		}
2791 
2792 		sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2793 	}
2794 }
2795 
2796 /*
2797  * Unmap all entries from [start, end) matching the given page size.
2798  *
2799  * This function is used primarily to unmap replicated 64K or 512K entries
2800  * from the TSB that are inserted using the base page size TSB pointer, but
2801  * it may also be called to unmap a range of addresses from the TSB.
2802  */
2803 void
2804 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2805 {
2806 	struct tsb_info *tsbinfop;
2807 	uint64_t tag;
2808 	struct tsbe *tsbe_addr;
2809 	caddr_t vaddr;
2810 	uint64_t tsb_base;
2811 	int vpshift, vpgsz;
2812 	uint_t tsb_size;
2813 	int phys = 0;
2814 
2815 	/*
2816 	 * Assumptions:
2817 	 *  If ttesz == 8K, 64K or 512K, we walk through the range 8K
2818 	 *  at a time shooting down any valid entries we encounter.
2819 	 *
2820 	 *  If ttesz >= 4M we walk the range 4M at a time shooting
2821 	 *  down any valid mappings we find.
2822 	 */
2823 	if (sfmmup == ksfmmup) {
2824 		phys = ktsb_phys;
2825 		if (ttesz >= TTE4M) {
2826 #ifndef sun4v
2827 			ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2828 #endif
2829 			tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2830 			tsb_size = ktsb4m_szcode;
2831 		} else {
2832 			tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2833 			tsb_size = ktsb_szcode;
2834 		}
2835 	} else {
2836 		SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2837 
2838 		/*
2839 		 * If there isn't a TSB for this page size, or the TSB is
2840 		 * swapped out, there is nothing to do.  Note that the latter
2841 		 * case seems impossible but can occur if hat_pageunload()
2842 		 * is called on an ISM mapping while the process is swapped
2843 		 * out.
2844 		 */
2845 		if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2846 			return;
2847 
2848 		/*
2849 		 * If another thread is in the middle of relocating a TSB
2850 		 * we can't unload the entry so set a flag so that the
2851 		 * TSB will be flushed before it can be accessed by the
2852 		 * process.
2853 		 */
2854 		if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2855 			tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2856 			return;
2857 		}
2858 #if defined(UTSB_PHYS)
2859 		phys = 1;
2860 		tsb_base = (uint64_t)tsbinfop->tsb_pa;
2861 #else
2862 		tsb_base = (uint64_t)tsbinfop->tsb_va;
2863 #endif
2864 		tsb_size = tsbinfop->tsb_szc;
2865 	}
2866 	if (ttesz >= TTE4M) {
2867 		vpshift = MMU_PAGESHIFT4M;
2868 		vpgsz = MMU_PAGESIZE4M;
2869 	} else {
2870 		vpshift = MMU_PAGESHIFT;
2871 		vpgsz = MMU_PAGESIZE;
2872 	}
2873 
2874 	for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2875 		tag = sfmmu_make_tsbtag(vaddr);
2876 		tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2877 		sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2878 	}
2879 }
2880 
2881 /*
2882  * Select the optimum TSB size given the number of mappings
2883  * that need to be cached.
2884  */
2885 static int
2886 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2887 {
2888 	int szc = 0;
2889 
2890 #ifdef DEBUG
2891 	if (tsb_grow_stress) {
2892 		uint32_t randval = (uint32_t)gettick() >> 4;
2893 		return (randval % (tsb_max_growsize + 1));
2894 	}
2895 #endif	/* DEBUG */
2896 
2897 	while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2898 		szc++;
2899 	return (szc);
2900 }
2901 
2902 /*
2903  * This function will add a translation to the hme_blk and allocate the
2904  * hme_blk if one does not exist.
2905  * If a page structure is specified then it will add the
2906  * corresponding hment to the mapping list.
2907  * It will also update the hmenum field for the tte.
2908  * Furthermore, it attempts to create a large page translation
2909  * for <addr,hat> at page array pps.  It assumes addr and first
2910  * pp is correctly aligned.  It returns 0 if successful and 1 otherwise.
2911  */
2912 static int
2913 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2914 	page_t **pps, uint_t flags, uint_t rid)
2915 {
2916 	struct hmehash_bucket *hmebp;
2917 	struct hme_blk *hmeblkp;
2918 	int 	ret;
2919 	uint_t	size;
2920 
2921 	/*
2922 	 * Get mapping size.
2923 	 */
2924 	size = TTE_CSZ(ttep);
2925 	ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2926 
2927 	/*
2928 	 * Acquire the hash bucket.
2929 	 */
2930 	hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2931 	ASSERT(hmebp);
2932 
2933 	/*
2934 	 * Find the hment block.
2935 	 */
2936 	hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2937 	    rid);
2938 	ASSERT(hmeblkp);
2939 
2940 	/*
2941 	 * Add the translation.
2942 	 */
2943 	ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2944 	    rid);
2945 
2946 	/*
2947 	 * Release the hash bucket.
2948 	 */
2949 	sfmmu_tteload_release_hashbucket(hmebp);
2950 
2951 	return (ret);
2952 }
2953 
2954 /*
2955  * Function locks and returns a pointer to the hash bucket for vaddr and size.
2956  */
2957 static struct hmehash_bucket *
2958 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2959     uint_t rid)
2960 {
2961 	struct hmehash_bucket *hmebp;
2962 	int hmeshift;
2963 	void *htagid = sfmmutohtagid(sfmmup, rid);
2964 
2965 	ASSERT(htagid != NULL);
2966 
2967 	hmeshift = HME_HASH_SHIFT(size);
2968 
2969 	hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2970 
2971 	SFMMU_HASH_LOCK(hmebp);
2972 
2973 	return (hmebp);
2974 }
2975 
2976 /*
2977  * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2978  * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2979  * allocated.
2980  */
2981 static struct hme_blk *
2982 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2983 	caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2984 {
2985 	hmeblk_tag hblktag;
2986 	int hmeshift;
2987 	struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2988 
2989 	SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2990 
2991 	hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2992 	ASSERT(hblktag.htag_id != NULL);
2993 	hmeshift = HME_HASH_SHIFT(size);
2994 	hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2995 	hblktag.htag_rehash = HME_HASH_REHASH(size);
2996 	hblktag.htag_rid = rid;
2997 
2998 ttearray_realloc:
2999 
3000 	HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3001 
3002 	/*
3003 	 * We block until hblk_reserve_lock is released; it's held by
3004 	 * the thread, temporarily using hblk_reserve, until hblk_reserve is
3005 	 * replaced by a hblk from sfmmu8_cache.
3006 	 */
3007 	if (hmeblkp == (struct hme_blk *)hblk_reserve &&
3008 	    hblk_reserve_thread != curthread) {
3009 		SFMMU_HASH_UNLOCK(hmebp);
3010 		mutex_enter(&hblk_reserve_lock);
3011 		mutex_exit(&hblk_reserve_lock);
3012 		SFMMU_STAT(sf_hblk_reserve_hit);
3013 		SFMMU_HASH_LOCK(hmebp);
3014 		goto ttearray_realloc;
3015 	}
3016 
3017 	if (hmeblkp == NULL) {
3018 		hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3019 		    hblktag, flags, rid);
3020 		ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3021 		ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3022 	} else {
3023 		/*
3024 		 * It is possible for 8k and 64k hblks to collide since they
3025 		 * have the same rehash value. This is because we
3026 		 * lazily free hblks and 8K/64K blks could be lingering.
3027 		 * If we find size mismatch we free the block and & try again.
3028 		 */
3029 		if (get_hblk_ttesz(hmeblkp) != size) {
3030 			ASSERT(!hmeblkp->hblk_vcnt);
3031 			ASSERT(!hmeblkp->hblk_hmecnt);
3032 			sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3033 			    &list, 0);
3034 			goto ttearray_realloc;
3035 		}
3036 		if (hmeblkp->hblk_shw_bit) {
3037 			/*
3038 			 * if the hblk was previously used as a shadow hblk then
3039 			 * we will change it to a normal hblk
3040 			 */
3041 			ASSERT(!hmeblkp->hblk_shared);
3042 			if (hmeblkp->hblk_shw_mask) {
3043 				sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3044 				ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3045 				goto ttearray_realloc;
3046 			} else {
3047 				hmeblkp->hblk_shw_bit = 0;
3048 			}
3049 		}
3050 		SFMMU_STAT(sf_hblk_hit);
3051 	}
3052 
3053 	/*
3054 	 * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3055 	 * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3056 	 * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3057 	 * just add these hmeblks to the per-cpu pending queue.
3058 	 */
3059 	sfmmu_hblks_list_purge(&list, 1);
3060 
3061 	ASSERT(get_hblk_ttesz(hmeblkp) == size);
3062 	ASSERT(!hmeblkp->hblk_shw_bit);
3063 	ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3064 	ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3065 	ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3066 
3067 	return (hmeblkp);
3068 }
3069 
3070 /*
3071  * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3072  * otherwise.
3073  */
3074 static int
3075 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3076 	caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3077 {
3078 	page_t *pp = *pps;
3079 	int hmenum, size, remap;
3080 	tte_t tteold, flush_tte;
3081 #ifdef DEBUG
3082 	tte_t orig_old;
3083 #endif /* DEBUG */
3084 	struct sf_hment *sfhme;
3085 	kmutex_t *pml, *pmtx;
3086 	hatlock_t *hatlockp;
3087 	int myflt;
3088 
3089 	/*
3090 	 * remove this panic when we decide to let user virtual address
3091 	 * space be >= USERLIMIT.
3092 	 */
3093 	if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3094 		panic("user addr %p in kernel space", (void *)vaddr);
3095 #if defined(TTE_IS_GLOBAL)
3096 	if (TTE_IS_GLOBAL(ttep))
3097 		panic("sfmmu_tteload: creating global tte");
3098 #endif
3099 
3100 #ifdef DEBUG
3101 	if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3102 	    !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3103 		panic("sfmmu_tteload: non cacheable memory tte");
3104 #endif /* DEBUG */
3105 
3106 	/* don't simulate dirty bit for writeable ISM/DISM mappings */
3107 	if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3108 		TTE_SET_REF(ttep);
3109 		TTE_SET_MOD(ttep);
3110 	}
3111 
3112 	if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3113 	    !TTE_IS_MOD(ttep)) {
3114 		/*
3115 		 * Don't load TSB for dummy as in ISM.  Also don't preload
3116 		 * the TSB if the TTE isn't writable since we're likely to
3117 		 * fault on it again -- preloading can be fairly expensive.
3118 		 */
3119 		flags |= SFMMU_NO_TSBLOAD;
3120 	}
3121 
3122 	size = TTE_CSZ(ttep);
3123 	switch (size) {
3124 	case TTE8K:
3125 		SFMMU_STAT(sf_tteload8k);
3126 		break;
3127 	case TTE64K:
3128 		SFMMU_STAT(sf_tteload64k);
3129 		break;
3130 	case TTE512K:
3131 		SFMMU_STAT(sf_tteload512k);
3132 		break;
3133 	case TTE4M:
3134 		SFMMU_STAT(sf_tteload4m);
3135 		break;
3136 	case (TTE32M):
3137 		SFMMU_STAT(sf_tteload32m);
3138 		ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3139 		break;
3140 	case (TTE256M):
3141 		SFMMU_STAT(sf_tteload256m);
3142 		ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3143 		break;
3144 	}
3145 
3146 	ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3147 	SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3148 	ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3149 	ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3150 
3151 	HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3152 
3153 	/*
3154 	 * Need to grab mlist lock here so that pageunload
3155 	 * will not change tte behind us.
3156 	 */
3157 	if (pp) {
3158 		pml = sfmmu_mlist_enter(pp);
3159 	}
3160 
3161 	sfmmu_copytte(&sfhme->hme_tte, &tteold);
3162 	/*
3163 	 * Look for corresponding hment and if valid verify
3164 	 * pfns are equal.
3165 	 */
3166 	remap = TTE_IS_VALID(&tteold);
3167 	if (remap) {
3168 		pfn_t	new_pfn, old_pfn;
3169 
3170 		old_pfn = TTE_TO_PFN(vaddr, &tteold);
3171 		new_pfn = TTE_TO_PFN(vaddr, ttep);
3172 
3173 		if (flags & HAT_LOAD_REMAP) {
3174 			/* make sure we are remapping same type of pages */
3175 			if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3176 				panic("sfmmu_tteload - tte remap io<->memory");
3177 			}
3178 			if (old_pfn != new_pfn &&
3179 			    (pp != NULL || sfhme->hme_page != NULL)) {
3180 				panic("sfmmu_tteload - tte remap pp != NULL");
3181 			}
3182 		} else if (old_pfn != new_pfn) {
3183 			panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3184 			    (void *)hmeblkp);
3185 		}
3186 		ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3187 	}
3188 
3189 	if (pp) {
3190 		if (size == TTE8K) {
3191 #ifdef VAC
3192 			/*
3193 			 * Handle VAC consistency
3194 			 */
3195 			if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3196 				sfmmu_vac_conflict(sfmmup, vaddr, pp);
3197 			}
3198 #endif
3199 
3200 			if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3201 				pmtx = sfmmu_page_enter(pp);
3202 				PP_CLRRO(pp);
3203 				sfmmu_page_exit(pmtx);
3204 			} else if (!PP_ISMAPPED(pp) &&
3205 			    (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3206 				pmtx = sfmmu_page_enter(pp);
3207 				if (!(PP_ISMOD(pp))) {
3208 					PP_SETRO(pp);
3209 				}
3210 				sfmmu_page_exit(pmtx);
3211 			}
3212 
3213 		} else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3214 			/*
3215 			 * sfmmu_pagearray_setup failed so return
3216 			 */
3217 			sfmmu_mlist_exit(pml);
3218 			return (1);
3219 		}
3220 	}
3221 
3222 	/*
3223 	 * Make sure hment is not on a mapping list.
3224 	 */
3225 	ASSERT(remap || (sfhme->hme_page == NULL));
3226 
3227 	/* if it is not a remap then hme->next better be NULL */
3228 	ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3229 
3230 	if (flags & HAT_LOAD_LOCK) {
3231 		if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3232 			panic("too high lckcnt-hmeblk %p",
3233 			    (void *)hmeblkp);
3234 		}
3235 		atomic_add_32(&hmeblkp->hblk_lckcnt, 1);
3236 
3237 		HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3238 	}
3239 
3240 #ifdef VAC
3241 	if (pp && PP_ISNC(pp)) {
3242 		/*
3243 		 * If the physical page is marked to be uncacheable, like
3244 		 * by a vac conflict, make sure the new mapping is also
3245 		 * uncacheable.
3246 		 */
3247 		TTE_CLR_VCACHEABLE(ttep);
3248 		ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3249 	}
3250 #endif
3251 	ttep->tte_hmenum = hmenum;
3252 
3253 #ifdef DEBUG
3254 	orig_old = tteold;
3255 #endif /* DEBUG */
3256 
3257 	while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3258 		if ((sfmmup == KHATID) &&
3259 		    (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3260 			sfmmu_copytte(&sfhme->hme_tte, &tteold);
3261 		}
3262 #ifdef DEBUG
3263 		chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3264 #endif /* DEBUG */
3265 	}
3266 	ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3267 
3268 	if (!TTE_IS_VALID(&tteold)) {
3269 
3270 		atomic_add_16(&hmeblkp->hblk_vcnt, 1);
3271 		if (rid == SFMMU_INVALID_SHMERID) {
3272 			atomic_add_long(&sfmmup->sfmmu_ttecnt[size], 1);
3273 		} else {
3274 			sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3275 			sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3276 			/*
3277 			 * We already accounted for region ttecnt's in sfmmu
3278 			 * during hat_join_region() processing. Here we
3279 			 * only update ttecnt's in region struture.
3280 			 */
3281 			atomic_add_long(&rgnp->rgn_ttecnt[size], 1);
3282 		}
3283 	}
3284 
3285 	myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3286 	if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3287 	    sfmmup != ksfmmup) {
3288 		uchar_t tteflag = 1 << size;
3289 		if (rid == SFMMU_INVALID_SHMERID) {
3290 			if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3291 				hatlockp = sfmmu_hat_enter(sfmmup);
3292 				sfmmup->sfmmu_tteflags |= tteflag;
3293 				sfmmu_hat_exit(hatlockp);
3294 			}
3295 		} else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3296 			hatlockp = sfmmu_hat_enter(sfmmup);
3297 			sfmmup->sfmmu_rtteflags |= tteflag;
3298 			sfmmu_hat_exit(hatlockp);
3299 		}
3300 		/*
3301 		 * Update the current CPU tsbmiss area, so the current thread
3302 		 * won't need to take the tsbmiss for the new pagesize.
3303 		 * The other threads in the process will update their tsb
3304 		 * miss area lazily in sfmmu_tsbmiss_exception() when they
3305 		 * fail to find the translation for a newly added pagesize.
3306 		 */
3307 		if (size > TTE64K && myflt) {
3308 			struct tsbmiss *tsbmp;
3309 			kpreempt_disable();
3310 			tsbmp = &tsbmiss_area[CPU->cpu_id];
3311 			if (rid == SFMMU_INVALID_SHMERID) {
3312 				if (!(tsbmp->uhat_tteflags & tteflag)) {
3313 					tsbmp->uhat_tteflags |= tteflag;
3314 				}
3315 			} else {
3316 				if (!(tsbmp->uhat_rtteflags & tteflag)) {
3317 					tsbmp->uhat_rtteflags |= tteflag;
3318 				}
3319 			}
3320 			kpreempt_enable();
3321 		}
3322 	}
3323 
3324 	if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3325 	    !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3326 		hatlockp = sfmmu_hat_enter(sfmmup);
3327 		SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3328 		sfmmu_hat_exit(hatlockp);
3329 	}
3330 
3331 	flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3332 	    hw_tte.tte_intlo;
3333 	flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3334 	    hw_tte.tte_inthi;
3335 
3336 	if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3337 		/*
3338 		 * If remap and new tte differs from old tte we need
3339 		 * to sync the mod bit and flush TLB/TSB.  We don't
3340 		 * need to sync ref bit because we currently always set
3341 		 * ref bit in tteload.
3342 		 */
3343 		ASSERT(TTE_IS_REF(ttep));
3344 		if (TTE_IS_MOD(&tteold)) {
3345 			sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3346 		}
3347 		/*
3348 		 * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3349 		 * hmes are only used for read only text. Adding this code for
3350 		 * completeness and future use of shared hmeblks with writable
3351 		 * mappings of VMODSORT vnodes.
3352 		 */
3353 		if (hmeblkp->hblk_shared) {
3354 			cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3355 			    sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3356 			xt_sync(cpuset);
3357 			SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3358 		} else {
3359 			sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3360 			xt_sync(sfmmup->sfmmu_cpusran);
3361 		}
3362 	}
3363 
3364 	if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3365 		/*
3366 		 * We only preload 8K and 4M mappings into the TSB, since
3367 		 * 64K and 512K mappings are replicated and hence don't
3368 		 * have a single, unique TSB entry. Ditto for 32M/256M.
3369 		 */
3370 		if (size == TTE8K || size == TTE4M) {
3371 			sf_scd_t *scdp;
3372 			hatlockp = sfmmu_hat_enter(sfmmup);
3373 			/*
3374 			 * Don't preload private TSB if the mapping is used
3375 			 * by the shctx in the SCD.
3376 			 */
3377 			scdp = sfmmup->sfmmu_scdp;
3378 			if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3379 			    !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3380 				sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3381 				    size);
3382 			}
3383 			sfmmu_hat_exit(hatlockp);
3384 		}
3385 	}
3386 	if (pp) {
3387 		if (!remap) {
3388 			HME_ADD(sfhme, pp);
3389 			atomic_add_16(&hmeblkp->hblk_hmecnt, 1);
3390 			ASSERT(hmeblkp->hblk_hmecnt > 0);
3391 
3392 			/*
3393 			 * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3394 			 * see pageunload() for comment.
3395 			 */
3396 		}
3397 		sfmmu_mlist_exit(pml);
3398 	}
3399 
3400 	return (0);
3401 }
3402 /*
3403  * Function unlocks hash bucket.
3404  */
3405 static void
3406 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3407 {
3408 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3409 	SFMMU_HASH_UNLOCK(hmebp);
3410 }
3411 
3412 /*
3413  * function which checks and sets up page array for a large
3414  * translation.  Will set p_vcolor, p_index, p_ro fields.
3415  * Assumes addr and pfnum of first page are properly aligned.
3416  * Will check for physical contiguity. If check fails it return
3417  * non null.
3418  */
3419 static int
3420 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3421 {
3422 	int 	i, index, ttesz;
3423 	pfn_t	pfnum;
3424 	pgcnt_t	npgs;
3425 	page_t *pp, *pp1;
3426 	kmutex_t *pmtx;
3427 #ifdef VAC
3428 	int osz;
3429 	int cflags = 0;
3430 	int vac_err = 0;
3431 #endif
3432 	int newidx = 0;
3433 
3434 	ttesz = TTE_CSZ(ttep);
3435 
3436 	ASSERT(ttesz > TTE8K);
3437 
3438 	npgs = TTEPAGES(ttesz);
3439 	index = PAGESZ_TO_INDEX(ttesz);
3440 
3441 	pfnum = (*pps)->p_pagenum;
3442 	ASSERT(IS_P2ALIGNED(pfnum, npgs));
3443 
3444 	/*
3445 	 * Save the first pp so we can do HAT_TMPNC at the end.
3446 	 */
3447 	pp1 = *pps;
3448 #ifdef VAC
3449 	osz = fnd_mapping_sz(pp1);
3450 #endif
3451 
3452 	for (i = 0; i < npgs; i++, pps++) {
3453 		pp = *pps;
3454 		ASSERT(PAGE_LOCKED(pp));
3455 		ASSERT(pp->p_szc >= ttesz);
3456 		ASSERT(pp->p_szc == pp1->p_szc);
3457 		ASSERT(sfmmu_mlist_held(pp));
3458 
3459 		/*
3460 		 * XXX is it possible to maintain P_RO on the root only?
3461 		 */
3462 		if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3463 			pmtx = sfmmu_page_enter(pp);
3464 			PP_CLRRO(pp);
3465 			sfmmu_page_exit(pmtx);
3466 		} else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3467 		    !PP_ISMOD(pp)) {
3468 			pmtx = sfmmu_page_enter(pp);
3469 			if (!(PP_ISMOD(pp))) {
3470 				PP_SETRO(pp);
3471 			}
3472 			sfmmu_page_exit(pmtx);
3473 		}
3474 
3475 		/*
3476 		 * If this is a remap we skip vac & contiguity checks.
3477 		 */
3478 		if (remap)
3479 			continue;
3480 
3481 		/*
3482 		 * set p_vcolor and detect any vac conflicts.
3483 		 */
3484 #ifdef VAC
3485 		if (vac_err == 0) {
3486 			vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3487 
3488 		}
3489 #endif
3490 
3491 		/*
3492 		 * Save current index in case we need to undo it.
3493 		 * Note: "PAGESZ_TO_INDEX(sz)	(1 << (sz))"
3494 		 *	"SFMMU_INDEX_SHIFT	6"
3495 		 *	 "SFMMU_INDEX_MASK	((1 << SFMMU_INDEX_SHIFT) - 1)"
3496 		 *	 "PP_MAPINDEX(p_index)	(p_index & SFMMU_INDEX_MASK)"
3497 		 *
3498 		 * So:	index = PAGESZ_TO_INDEX(ttesz);
3499 		 *	if ttesz == 1 then index = 0x2
3500 		 *		    2 then index = 0x4
3501 		 *		    3 then index = 0x8
3502 		 *		    4 then index = 0x10
3503 		 *		    5 then index = 0x20
3504 		 * The code below checks if it's a new pagesize (ie, newidx)
3505 		 * in case we need to take it back out of p_index,
3506 		 * and then or's the new index into the existing index.
3507 		 */
3508 		if ((PP_MAPINDEX(pp) & index) == 0)
3509 			newidx = 1;
3510 		pp->p_index = (PP_MAPINDEX(pp) | index);
3511 
3512 		/*
3513 		 * contiguity check
3514 		 */
3515 		if (pp->p_pagenum != pfnum) {
3516 			/*
3517 			 * If we fail the contiguity test then
3518 			 * the only thing we need to fix is the p_index field.
3519 			 * We might get a few extra flushes but since this
3520 			 * path is rare that is ok.  The p_ro field will
3521 			 * get automatically fixed on the next tteload to
3522 			 * the page.  NO TNC bit is set yet.
3523 			 */
3524 			while (i >= 0) {
3525 				pp = *pps;
3526 				if (newidx)
3527 					pp->p_index = (PP_MAPINDEX(pp) &
3528 					    ~index);
3529 				pps--;
3530 				i--;
3531 			}
3532 			return (1);
3533 		}
3534 		pfnum++;
3535 		addr += MMU_PAGESIZE;
3536 	}
3537 
3538 #ifdef VAC
3539 	if (vac_err) {
3540 		if (ttesz > osz) {
3541 			/*
3542 			 * There are some smaller mappings that causes vac
3543 			 * conflicts. Convert all existing small mappings to
3544 			 * TNC.
3545 			 */
3546 			SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3547 			sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3548 			    npgs);
3549 		} else {
3550 			/* EMPTY */
3551 			/*
3552 			 * If there exists an big page mapping,
3553 			 * that means the whole existing big page
3554 			 * has TNC setting already. No need to covert to
3555 			 * TNC again.
3556 			 */
3557 			ASSERT(PP_ISTNC(pp1));
3558 		}
3559 	}
3560 #endif	/* VAC */
3561 
3562 	return (0);
3563 }
3564 
3565 #ifdef VAC
3566 /*
3567  * Routine that detects vac consistency for a large page. It also
3568  * sets virtual color for all pp's for this big mapping.
3569  */
3570 static int
3571 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3572 {
3573 	int vcolor, ocolor;
3574 
3575 	ASSERT(sfmmu_mlist_held(pp));
3576 
3577 	if (PP_ISNC(pp)) {
3578 		return (HAT_TMPNC);
3579 	}
3580 
3581 	vcolor = addr_to_vcolor(addr);
3582 	if (PP_NEWPAGE(pp)) {
3583 		PP_SET_VCOLOR(pp, vcolor);
3584 		return (0);
3585 	}
3586 
3587 	ocolor = PP_GET_VCOLOR(pp);
3588 	if (ocolor == vcolor) {
3589 		return (0);
3590 	}
3591 
3592 	if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3593 		/*
3594 		 * Previous user of page had a differnet color
3595 		 * but since there are no current users
3596 		 * we just flush the cache and change the color.
3597 		 * As an optimization for large pages we flush the
3598 		 * entire cache of that color and set a flag.
3599 		 */
3600 		SFMMU_STAT(sf_pgcolor_conflict);
3601 		if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3602 			CacheColor_SetFlushed(*cflags, ocolor);
3603 			sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3604 		}
3605 		PP_SET_VCOLOR(pp, vcolor);
3606 		return (0);
3607 	}
3608 
3609 	/*
3610 	 * We got a real conflict with a current mapping.
3611 	 * set flags to start unencaching all mappings
3612 	 * and return failure so we restart looping
3613 	 * the pp array from the beginning.
3614 	 */
3615 	return (HAT_TMPNC);
3616 }
3617 #endif	/* VAC */
3618 
3619 /*
3620  * creates a large page shadow hmeblk for a tte.
3621  * The purpose of this routine is to allow us to do quick unloads because
3622  * the vm layer can easily pass a very large but sparsely populated range.
3623  */
3624 static struct hme_blk *
3625 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3626 {
3627 	struct hmehash_bucket *hmebp;
3628 	hmeblk_tag hblktag;
3629 	int hmeshift, size, vshift;
3630 	uint_t shw_mask, newshw_mask;
3631 	struct hme_blk *hmeblkp;
3632 
3633 	ASSERT(sfmmup != KHATID);
3634 	if (mmu_page_sizes == max_mmu_page_sizes) {
3635 		ASSERT(ttesz < TTE256M);
3636 	} else {
3637 		ASSERT(ttesz < TTE4M);
3638 		ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3639 		ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3640 	}
3641 
3642 	if (ttesz == TTE8K) {
3643 		size = TTE512K;
3644 	} else {
3645 		size = ++ttesz;
3646 	}
3647 
3648 	hblktag.htag_id = sfmmup;
3649 	hmeshift = HME_HASH_SHIFT(size);
3650 	hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3651 	hblktag.htag_rehash = HME_HASH_REHASH(size);
3652 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3653 	hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3654 
3655 	SFMMU_HASH_LOCK(hmebp);
3656 
3657 	HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3658 	ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3659 	if (hmeblkp == NULL) {
3660 		hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3661 		    hblktag, flags, SFMMU_INVALID_SHMERID);
3662 	}
3663 	ASSERT(hmeblkp);
3664 	if (!hmeblkp->hblk_shw_mask) {
3665 		/*
3666 		 * if this is a unused hblk it was just allocated or could
3667 		 * potentially be a previous large page hblk so we need to
3668 		 * set the shadow bit.
3669 		 */
3670 		ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3671 		hmeblkp->hblk_shw_bit = 1;
3672 	} else if (hmeblkp->hblk_shw_bit == 0) {
3673 		panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3674 		    (void *)hmeblkp);
3675 	}
3676 	ASSERT(hmeblkp->hblk_shw_bit == 1);
3677 	ASSERT(!hmeblkp->hblk_shared);
3678 	vshift = vaddr_to_vshift(hblktag, vaddr, size);
3679 	ASSERT(vshift < 8);
3680 	/*
3681 	 * Atomically set shw mask bit
3682 	 */
3683 	do {
3684 		shw_mask = hmeblkp->hblk_shw_mask;
3685 		newshw_mask = shw_mask | (1 << vshift);
3686 		newshw_mask = cas32(&hmeblkp->hblk_shw_mask, shw_mask,
3687 		    newshw_mask);
3688 	} while (newshw_mask != shw_mask);
3689 
3690 	SFMMU_HASH_UNLOCK(hmebp);
3691 
3692 	return (hmeblkp);
3693 }
3694 
3695 /*
3696  * This routine cleanup a previous shadow hmeblk and changes it to
3697  * a regular hblk.  This happens rarely but it is possible
3698  * when a process wants to use large pages and there are hblks still
3699  * lying around from the previous as that used these hmeblks.
3700  * The alternative was to cleanup the shadow hblks at unload time
3701  * but since so few user processes actually use large pages, it is
3702  * better to be lazy and cleanup at this time.
3703  */
3704 static void
3705 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3706 	struct hmehash_bucket *hmebp)
3707 {
3708 	caddr_t addr, endaddr;
3709 	int hashno, size;
3710 
3711 	ASSERT(hmeblkp->hblk_shw_bit);
3712 	ASSERT(!hmeblkp->hblk_shared);
3713 
3714 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3715 
3716 	if (!hmeblkp->hblk_shw_mask) {
3717 		hmeblkp->hblk_shw_bit = 0;
3718 		return;
3719 	}
3720 	addr = (caddr_t)get_hblk_base(hmeblkp);
3721 	endaddr = get_hblk_endaddr(hmeblkp);
3722 	size = get_hblk_ttesz(hmeblkp);
3723 	hashno = size - 1;
3724 	ASSERT(hashno > 0);
3725 	SFMMU_HASH_UNLOCK(hmebp);
3726 
3727 	sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3728 
3729 	SFMMU_HASH_LOCK(hmebp);
3730 }
3731 
3732 static void
3733 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3734 	int hashno)
3735 {
3736 	int hmeshift, shadow = 0;
3737 	hmeblk_tag hblktag;
3738 	struct hmehash_bucket *hmebp;
3739 	struct hme_blk *hmeblkp;
3740 	struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3741 
3742 	ASSERT(hashno > 0);
3743 	hblktag.htag_id = sfmmup;
3744 	hblktag.htag_rehash = hashno;
3745 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3746 
3747 	hmeshift = HME_HASH_SHIFT(hashno);
3748 
3749 	while (addr < endaddr) {
3750 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3751 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3752 		SFMMU_HASH_LOCK(hmebp);
3753 		/* inline HME_HASH_SEARCH */
3754 		hmeblkp = hmebp->hmeblkp;
3755 		pr_hblk = NULL;
3756 		while (hmeblkp) {
3757 			if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3758 				/* found hme_blk */
3759 				ASSERT(!hmeblkp->hblk_shared);
3760 				if (hmeblkp->hblk_shw_bit) {
3761 					if (hmeblkp->hblk_shw_mask) {
3762 						shadow = 1;
3763 						sfmmu_shadow_hcleanup(sfmmup,
3764 						    hmeblkp, hmebp);
3765 						break;
3766 					} else {
3767 						hmeblkp->hblk_shw_bit = 0;
3768 					}
3769 				}
3770 
3771 				/*
3772 				 * Hblk_hmecnt and hblk_vcnt could be non zero
3773 				 * since hblk_unload() does not gurantee that.
3774 				 *
3775 				 * XXX - this could cause tteload() to spin
3776 				 * where sfmmu_shadow_hcleanup() is called.
3777 				 */
3778 			}
3779 
3780 			nx_hblk = hmeblkp->hblk_next;
3781 			if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3782 				sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3783 				    &list, 0);
3784 			} else {
3785 				pr_hblk = hmeblkp;
3786 			}
3787 			hmeblkp = nx_hblk;
3788 		}
3789 
3790 		SFMMU_HASH_UNLOCK(hmebp);
3791 
3792 		if (shadow) {
3793 			/*
3794 			 * We found another shadow hblk so cleaned its
3795 			 * children.  We need to go back and cleanup
3796 			 * the original hblk so we don't change the
3797 			 * addr.
3798 			 */
3799 			shadow = 0;
3800 		} else {
3801 			addr = (caddr_t)roundup((uintptr_t)addr + 1,
3802 			    (1 << hmeshift));
3803 		}
3804 	}
3805 	sfmmu_hblks_list_purge(&list, 0);
3806 }
3807 
3808 /*
3809  * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3810  * may still linger on after pageunload.
3811  */
3812 static void
3813 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3814 {
3815 	int hmeshift;
3816 	hmeblk_tag hblktag;
3817 	struct hmehash_bucket *hmebp;
3818 	struct hme_blk *hmeblkp;
3819 	struct hme_blk *pr_hblk;
3820 	struct hme_blk *list = NULL;
3821 
3822 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3823 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3824 
3825 	hmeshift = HME_HASH_SHIFT(ttesz);
3826 	hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3827 	hblktag.htag_rehash = ttesz;
3828 	hblktag.htag_rid = rid;
3829 	hblktag.htag_id = srdp;
3830 	hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3831 
3832 	SFMMU_HASH_LOCK(hmebp);
3833 	HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3834 	if (hmeblkp != NULL) {
3835 		ASSERT(hmeblkp->hblk_shared);
3836 		ASSERT(!hmeblkp->hblk_shw_bit);
3837 		if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3838 			panic("sfmmu_cleanup_rhblk: valid hmeblk");
3839 		}
3840 		ASSERT(!hmeblkp->hblk_lckcnt);
3841 		sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3842 		    &list, 0);
3843 	}
3844 	SFMMU_HASH_UNLOCK(hmebp);
3845 	sfmmu_hblks_list_purge(&list, 0);
3846 }
3847 
3848 /* ARGSUSED */
3849 static void
3850 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3851     size_t r_size, void *r_obj, u_offset_t r_objoff)
3852 {
3853 }
3854 
3855 /*
3856  * Searches for an hmeblk which maps addr, then unloads this mapping
3857  * and updates *eaddrp, if the hmeblk is found.
3858  */
3859 static void
3860 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3861     caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3862 {
3863 	int hmeshift;
3864 	hmeblk_tag hblktag;
3865 	struct hmehash_bucket *hmebp;
3866 	struct hme_blk *hmeblkp;
3867 	struct hme_blk *pr_hblk;
3868 	struct hme_blk *list = NULL;
3869 
3870 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3871 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3872 	ASSERT(ttesz >= HBLK_MIN_TTESZ);
3873 
3874 	hmeshift = HME_HASH_SHIFT(ttesz);
3875 	hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3876 	hblktag.htag_rehash = ttesz;
3877 	hblktag.htag_rid = rid;
3878 	hblktag.htag_id = srdp;
3879 	hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3880 
3881 	SFMMU_HASH_LOCK(hmebp);
3882 	HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3883 	if (hmeblkp != NULL) {
3884 		ASSERT(hmeblkp->hblk_shared);
3885 		ASSERT(!hmeblkp->hblk_lckcnt);
3886 		if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3887 			*eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3888 			    eaddr, NULL, HAT_UNLOAD);
3889 			ASSERT(*eaddrp > addr);
3890 		}
3891 		ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3892 		sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3893 		    &list, 0);
3894 	}
3895 	SFMMU_HASH_UNLOCK(hmebp);
3896 	sfmmu_hblks_list_purge(&list, 0);
3897 }
3898 
3899 static void
3900 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3901 {
3902 	int ttesz = rgnp->rgn_pgszc;
3903 	size_t rsz = rgnp->rgn_size;
3904 	caddr_t rsaddr = rgnp->rgn_saddr;
3905 	caddr_t readdr = rsaddr + rsz;
3906 	caddr_t rhsaddr;
3907 	caddr_t va;
3908 	uint_t rid = rgnp->rgn_id;
3909 	caddr_t cbsaddr;
3910 	caddr_t cbeaddr;
3911 	hat_rgn_cb_func_t rcbfunc;
3912 	ulong_t cnt;
3913 
3914 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3915 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3916 
3917 	ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3918 	ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3919 	if (ttesz < HBLK_MIN_TTESZ) {
3920 		ttesz = HBLK_MIN_TTESZ;
3921 		rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3922 	} else {
3923 		rhsaddr = rsaddr;
3924 	}
3925 
3926 	if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3927 		rcbfunc = sfmmu_rgn_cb_noop;
3928 	}
3929 
3930 	while (ttesz >= HBLK_MIN_TTESZ) {
3931 		cbsaddr = rsaddr;
3932 		cbeaddr = rsaddr;
3933 		if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3934 			ttesz--;
3935 			continue;
3936 		}
3937 		cnt = 0;
3938 		va = rsaddr;
3939 		while (va < readdr) {
3940 			ASSERT(va >= rhsaddr);
3941 			if (va != cbeaddr) {
3942 				if (cbeaddr != cbsaddr) {
3943 					ASSERT(cbeaddr > cbsaddr);
3944 					(*rcbfunc)(cbsaddr, cbeaddr,
3945 					    rsaddr, rsz, rgnp->rgn_obj,
3946 					    rgnp->rgn_objoff);
3947 				}
3948 				cbsaddr = va;
3949 				cbeaddr = va;
3950 			}
3951 			sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3952 			    ttesz, &cbeaddr);
3953 			cnt++;
3954 			va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3955 		}
3956 		if (cbeaddr != cbsaddr) {
3957 			ASSERT(cbeaddr > cbsaddr);
3958 			(*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3959 			    rsz, rgnp->rgn_obj,
3960 			    rgnp->rgn_objoff);
3961 		}
3962 		ttesz--;
3963 	}
3964 }
3965 
3966 /*
3967  * Release one hardware address translation lock on the given address range.
3968  */
3969 void
3970 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3971 {
3972 	struct hmehash_bucket *hmebp;
3973 	hmeblk_tag hblktag;
3974 	int hmeshift, hashno = 1;
3975 	struct hme_blk *hmeblkp, *list = NULL;
3976 	caddr_t endaddr;
3977 
3978 	ASSERT(sfmmup != NULL);
3979 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
3980 
3981 	ASSERT((sfmmup == ksfmmup) ||
3982 	    AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
3983 	ASSERT((len & MMU_PAGEOFFSET) == 0);
3984 	endaddr = addr + len;
3985 	hblktag.htag_id = sfmmup;
3986 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3987 
3988 	/*
3989 	 * Spitfire supports 4 page sizes.
3990 	 * Most pages are expected to be of the smallest page size (8K) and
3991 	 * these will not need to be rehashed. 64K pages also don't need to be
3992 	 * rehashed because an hmeblk spans 64K of address space. 512K pages
3993 	 * might need 1 rehash and and 4M pages might need 2 rehashes.
3994 	 */
3995 	while (addr < endaddr) {
3996 		hmeshift = HME_HASH_SHIFT(hashno);
3997 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3998 		hblktag.htag_rehash = hashno;
3999 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4000 
4001 		SFMMU_HASH_LOCK(hmebp);
4002 
4003 		HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4004 		if (hmeblkp != NULL) {
4005 			ASSERT(!hmeblkp->hblk_shared);
4006 			/*
4007 			 * If we encounter a shadow hmeblk then
4008 			 * we know there are no valid hmeblks mapping
4009 			 * this address at this size or larger.
4010 			 * Just increment address by the smallest
4011 			 * page size.
4012 			 */
4013 			if (hmeblkp->hblk_shw_bit) {
4014 				addr += MMU_PAGESIZE;
4015 			} else {
4016 				addr = sfmmu_hblk_unlock(hmeblkp, addr,
4017 				    endaddr);
4018 			}
4019 			SFMMU_HASH_UNLOCK(hmebp);
4020 			hashno = 1;
4021 			continue;
4022 		}
4023 		SFMMU_HASH_UNLOCK(hmebp);
4024 
4025 		if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4026 			/*
4027 			 * We have traversed the whole list and rehashed
4028 			 * if necessary without finding the address to unlock
4029 			 * which should never happen.
4030 			 */
4031 			panic("sfmmu_unlock: addr not found. "
4032 			    "addr %p hat %p", (void *)addr, (void *)sfmmup);
4033 		} else {
4034 			hashno++;
4035 		}
4036 	}
4037 
4038 	sfmmu_hblks_list_purge(&list, 0);
4039 }
4040 
4041 void
4042 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4043     hat_region_cookie_t rcookie)
4044 {
4045 	sf_srd_t *srdp;
4046 	sf_region_t *rgnp;
4047 	int ttesz;
4048 	uint_t rid;
4049 	caddr_t eaddr;
4050 	caddr_t va;
4051 	int hmeshift;
4052 	hmeblk_tag hblktag;
4053 	struct hmehash_bucket *hmebp;
4054 	struct hme_blk *hmeblkp;
4055 	struct hme_blk *pr_hblk;
4056 	struct hme_blk *list;
4057 
4058 	if (rcookie == HAT_INVALID_REGION_COOKIE) {
4059 		hat_unlock(sfmmup, addr, len);
4060 		return;
4061 	}
4062 
4063 	ASSERT(sfmmup != NULL);
4064 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4065 	ASSERT(sfmmup != ksfmmup);
4066 
4067 	srdp = sfmmup->sfmmu_srdp;
4068 	rid = (uint_t)((uint64_t)rcookie);
4069 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
4070 	eaddr = addr + len;
4071 	va = addr;
4072 	list = NULL;
4073 	rgnp = srdp->srd_hmergnp[rid];
4074 	SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4075 
4076 	ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4077 	ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4078 	if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4079 		ttesz = HBLK_MIN_TTESZ;
4080 	} else {
4081 		ttesz = rgnp->rgn_pgszc;
4082 	}
4083 	while (va < eaddr) {
4084 		while (ttesz < rgnp->rgn_pgszc &&
4085 		    IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4086 			ttesz++;
4087 		}
4088 		while (ttesz >= HBLK_MIN_TTESZ) {
4089 			if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4090 				ttesz--;
4091 				continue;
4092 			}
4093 			hmeshift = HME_HASH_SHIFT(ttesz);
4094 			hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4095 			hblktag.htag_rehash = ttesz;
4096 			hblktag.htag_rid = rid;
4097 			hblktag.htag_id = srdp;
4098 			hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4099 			SFMMU_HASH_LOCK(hmebp);
4100 			HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4101 			    &list);
4102 			if (hmeblkp == NULL) {
4103 				SFMMU_HASH_UNLOCK(hmebp);
4104 				ttesz--;
4105 				continue;
4106 			}
4107 			ASSERT(hmeblkp->hblk_shared);
4108 			va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4109 			ASSERT(va >= eaddr ||
4110 			    IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4111 			SFMMU_HASH_UNLOCK(hmebp);
4112 			break;
4113 		}
4114 		if (ttesz < HBLK_MIN_TTESZ) {
4115 			panic("hat_unlock_region: addr not found "
4116 			    "addr %p hat %p", (void *)va, (void *)sfmmup);
4117 		}
4118 	}
4119 	sfmmu_hblks_list_purge(&list, 0);
4120 }
4121 
4122 /*
4123  * Function to unlock a range of addresses in an hmeblk.  It returns the
4124  * next address that needs to be unlocked.
4125  * Should be called with the hash lock held.
4126  */
4127 static caddr_t
4128 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4129 {
4130 	struct sf_hment *sfhme;
4131 	tte_t tteold, ttemod;
4132 	int ttesz, ret;
4133 
4134 	ASSERT(in_hblk_range(hmeblkp, addr));
4135 	ASSERT(hmeblkp->hblk_shw_bit == 0);
4136 
4137 	endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4138 	ttesz = get_hblk_ttesz(hmeblkp);
4139 
4140 	HBLKTOHME(sfhme, hmeblkp, addr);
4141 	while (addr < endaddr) {
4142 readtte:
4143 		sfmmu_copytte(&sfhme->hme_tte, &tteold);
4144 		if (TTE_IS_VALID(&tteold)) {
4145 
4146 			ttemod = tteold;
4147 
4148 			ret = sfmmu_modifytte_try(&tteold, &ttemod,
4149 			    &sfhme->hme_tte);
4150 
4151 			if (ret < 0)
4152 				goto readtte;
4153 
4154 			if (hmeblkp->hblk_lckcnt == 0)
4155 				panic("zero hblk lckcnt");
4156 
4157 			if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4158 			    (uintptr_t)endaddr)
4159 				panic("can't unlock large tte");
4160 
4161 			ASSERT(hmeblkp->hblk_lckcnt > 0);
4162 			atomic_add_32(&hmeblkp->hblk_lckcnt, -1);
4163 			HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4164 		} else {
4165 			panic("sfmmu_hblk_unlock: invalid tte");
4166 		}
4167 		addr += TTEBYTES(ttesz);
4168 		sfhme++;
4169 	}
4170 	return (addr);
4171 }
4172 
4173 /*
4174  * Physical Address Mapping Framework
4175  *
4176  * General rules:
4177  *
4178  * (1) Applies only to seg_kmem memory pages. To make things easier,
4179  *     seg_kpm addresses are also accepted by the routines, but nothing
4180  *     is done with them since by definition their PA mappings are static.
4181  * (2) hat_add_callback() may only be called while holding the page lock
4182  *     SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4183  *     or passing HAC_PAGELOCK flag.
4184  * (3) prehandler() and posthandler() may not call hat_add_callback() or
4185  *     hat_delete_callback(), nor should they allocate memory. Post quiesce
4186  *     callbacks may not sleep or acquire adaptive mutex locks.
4187  * (4) Either prehandler() or posthandler() (but not both) may be specified
4188  *     as being NULL.  Specifying an errhandler() is optional.
4189  *
4190  * Details of using the framework:
4191  *
4192  * registering a callback (hat_register_callback())
4193  *
4194  *	Pass prehandler, posthandler, errhandler addresses
4195  *	as described below. If capture_cpus argument is nonzero,
4196  *	suspend callback to the prehandler will occur with CPUs
4197  *	captured and executing xc_loop() and CPUs will remain
4198  *	captured until after the posthandler suspend callback
4199  *	occurs.
4200  *
4201  * adding a callback (hat_add_callback())
4202  *
4203  *      as_pagelock();
4204  *	hat_add_callback();
4205  *      save returned pfn in private data structures or program registers;
4206  *      as_pageunlock();
4207  *
4208  * prehandler()
4209  *
4210  *	Stop all accesses by physical address to this memory page.
4211  *	Called twice: the first, PRESUSPEND, is a context safe to acquire
4212  *	adaptive locks. The second, SUSPEND, is called at high PIL with
4213  *	CPUs captured so adaptive locks may NOT be acquired (and all spin
4214  *	locks must be XCALL_PIL or higher locks).
4215  *
4216  *	May return the following errors:
4217  *		EIO:	A fatal error has occurred. This will result in panic.
4218  *		EAGAIN:	The page cannot be suspended. This will fail the
4219  *			relocation.
4220  *		0:	Success.
4221  *
4222  * posthandler()
4223  *
4224  *      Save new pfn in private data structures or program registers;
4225  *	not allowed to fail (non-zero return values will result in panic).
4226  *
4227  * errhandler()
4228  *
4229  *	called when an error occurs related to the callback.  Currently
4230  *	the only such error is HAT_CB_ERR_LEAKED which indicates that
4231  *	a page is being freed, but there are still outstanding callback(s)
4232  *	registered on the page.
4233  *
4234  * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4235  *
4236  *	stop using physical address
4237  *	hat_delete_callback();
4238  *
4239  */
4240 
4241 /*
4242  * Register a callback class.  Each subsystem should do this once and
4243  * cache the id_t returned for use in setting up and tearing down callbacks.
4244  *
4245  * There is no facility for removing callback IDs once they are created;
4246  * the "key" should be unique for each module, so in case a module is unloaded
4247  * and subsequently re-loaded, we can recycle the module's previous entry.
4248  */
4249 id_t
4250 hat_register_callback(int key,
4251 	int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4252 	int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4253 	int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4254 	int capture_cpus)
4255 {
4256 	id_t id;
4257 
4258 	/*
4259 	 * Search the table for a pre-existing callback associated with
4260 	 * the identifier "key".  If one exists, we re-use that entry in
4261 	 * the table for this instance, otherwise we assign the next
4262 	 * available table slot.
4263 	 */
4264 	for (id = 0; id < sfmmu_max_cb_id; id++) {
4265 		if (sfmmu_cb_table[id].key == key)
4266 			break;
4267 	}
4268 
4269 	if (id == sfmmu_max_cb_id) {
4270 		id = sfmmu_cb_nextid++;
4271 		if (id >= sfmmu_max_cb_id)
4272 			panic("hat_register_callback: out of callback IDs");
4273 	}
4274 
4275 	ASSERT(prehandler != NULL || posthandler != NULL);
4276 
4277 	sfmmu_cb_table[id].key = key;
4278 	sfmmu_cb_table[id].prehandler = prehandler;
4279 	sfmmu_cb_table[id].posthandler = posthandler;
4280 	sfmmu_cb_table[id].errhandler = errhandler;
4281 	sfmmu_cb_table[id].capture_cpus = capture_cpus;
4282 
4283 	return (id);
4284 }
4285 
4286 #define	HAC_COOKIE_NONE	(void *)-1
4287 
4288 /*
4289  * Add relocation callbacks to the specified addr/len which will be called
4290  * when relocating the associated page. See the description of pre and
4291  * posthandler above for more details.
4292  *
4293  * If HAC_PAGELOCK is included in flags, the underlying memory page is
4294  * locked internally so the caller must be able to deal with the callback
4295  * running even before this function has returned.  If HAC_PAGELOCK is not
4296  * set, it is assumed that the underlying memory pages are locked.
4297  *
4298  * Since the caller must track the individual page boundaries anyway,
4299  * we only allow a callback to be added to a single page (large
4300  * or small).  Thus [addr, addr + len) MUST be contained within a single
4301  * page.
4302  *
4303  * Registering multiple callbacks on the same [addr, addr+len) is supported,
4304  * _provided_that_ a unique parameter is specified for each callback.
4305  * If multiple callbacks are registered on the same range the callback will
4306  * be invoked with each unique parameter. Registering the same callback with
4307  * the same argument more than once will result in corrupted kernel state.
4308  *
4309  * Returns the pfn of the underlying kernel page in *rpfn
4310  * on success, or PFN_INVALID on failure.
4311  *
4312  * cookiep (if passed) provides storage space for an opaque cookie
4313  * to return later to hat_delete_callback(). This cookie makes the callback
4314  * deletion significantly quicker by avoiding a potentially lengthy hash
4315  * search.
4316  *
4317  * Returns values:
4318  *    0:      success
4319  *    ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4320  *    EINVAL: callback ID is not valid
4321  *    ENXIO:  ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4322  *            space
4323  *    ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4324  */
4325 int
4326 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4327 	void *pvt, pfn_t *rpfn, void **cookiep)
4328 {
4329 	struct 		hmehash_bucket *hmebp;
4330 	hmeblk_tag 	hblktag;
4331 	struct hme_blk	*hmeblkp;
4332 	int 		hmeshift, hashno;
4333 	caddr_t 	saddr, eaddr, baseaddr;
4334 	struct pa_hment *pahmep;
4335 	struct sf_hment *sfhmep, *osfhmep;
4336 	kmutex_t	*pml;
4337 	tte_t   	tte;
4338 	page_t		*pp;
4339 	vnode_t		*vp;
4340 	u_offset_t	off;
4341 	pfn_t		pfn;
4342 	int		kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4343 	int		locked = 0;
4344 
4345 	/*
4346 	 * For KPM mappings, just return the physical address since we
4347 	 * don't need to register any callbacks.
4348 	 */
4349 	if (IS_KPM_ADDR(vaddr)) {
4350 		uint64_t paddr;
4351 		SFMMU_KPM_VTOP(vaddr, paddr);
4352 		*rpfn = btop(paddr);
4353 		if (cookiep != NULL)
4354 			*cookiep = HAC_COOKIE_NONE;
4355 		return (0);
4356 	}
4357 
4358 	if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4359 		*rpfn = PFN_INVALID;
4360 		return (EINVAL);
4361 	}
4362 
4363 	if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4364 		*rpfn = PFN_INVALID;
4365 		return (ENOMEM);
4366 	}
4367 
4368 	sfhmep = &pahmep->sfment;
4369 
4370 	saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4371 	eaddr = saddr + len;
4372 
4373 rehash:
4374 	/* Find the mapping(s) for this page */
4375 	for (hashno = TTE64K, hmeblkp = NULL;
4376 	    hmeblkp == NULL && hashno <= mmu_hashcnt;
4377 	    hashno++) {
4378 		hmeshift = HME_HASH_SHIFT(hashno);
4379 		hblktag.htag_id = ksfmmup;
4380 		hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4381 		hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4382 		hblktag.htag_rehash = hashno;
4383 		hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4384 
4385 		SFMMU_HASH_LOCK(hmebp);
4386 
4387 		HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4388 
4389 		if (hmeblkp == NULL)
4390 			SFMMU_HASH_UNLOCK(hmebp);
4391 	}
4392 
4393 	if (hmeblkp == NULL) {
4394 		kmem_cache_free(pa_hment_cache, pahmep);
4395 		*rpfn = PFN_INVALID;
4396 		return (ENXIO);
4397 	}
4398 
4399 	ASSERT(!hmeblkp->hblk_shared);
4400 
4401 	HBLKTOHME(osfhmep, hmeblkp, saddr);
4402 	sfmmu_copytte(&osfhmep->hme_tte, &tte);
4403 
4404 	if (!TTE_IS_VALID(&tte)) {
4405 		SFMMU_HASH_UNLOCK(hmebp);
4406 		kmem_cache_free(pa_hment_cache, pahmep);
4407 		*rpfn = PFN_INVALID;
4408 		return (ENXIO);
4409 	}
4410 
4411 	/*
4412 	 * Make sure the boundaries for the callback fall within this
4413 	 * single mapping.
4414 	 */
4415 	baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4416 	ASSERT(saddr >= baseaddr);
4417 	if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4418 		SFMMU_HASH_UNLOCK(hmebp);
4419 		kmem_cache_free(pa_hment_cache, pahmep);
4420 		*rpfn = PFN_INVALID;
4421 		return (ERANGE);
4422 	}
4423 
4424 	pfn = sfmmu_ttetopfn(&tte, vaddr);
4425 
4426 	/*
4427 	 * The pfn may not have a page_t underneath in which case we
4428 	 * just return it. This can happen if we are doing I/O to a
4429 	 * static portion of the kernel's address space, for instance.
4430 	 */
4431 	pp = osfhmep->hme_page;
4432 	if (pp == NULL) {
4433 		SFMMU_HASH_UNLOCK(hmebp);
4434 		kmem_cache_free(pa_hment_cache, pahmep);
4435 		*rpfn = pfn;
4436 		if (cookiep)
4437 			*cookiep = HAC_COOKIE_NONE;
4438 		return (0);
4439 	}
4440 	ASSERT(pp == PP_PAGEROOT(pp));
4441 
4442 	vp = pp->p_vnode;
4443 	off = pp->p_offset;
4444 
4445 	pml = sfmmu_mlist_enter(pp);
4446 
4447 	if (flags & HAC_PAGELOCK) {
4448 		if (!page_trylock(pp, SE_SHARED)) {
4449 			/*
4450 			 * Somebody is holding SE_EXCL lock. Might
4451 			 * even be hat_page_relocate(). Drop all
4452 			 * our locks, lookup the page in &kvp, and
4453 			 * retry. If it doesn't exist in &kvp and &zvp,
4454 			 * then we must be dealing with a kernel mapped
4455 			 * page which doesn't actually belong to
4456 			 * segkmem so we punt.
4457 			 */
4458 			sfmmu_mlist_exit(pml);
4459 			SFMMU_HASH_UNLOCK(hmebp);
4460 			pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4461 
4462 			/* check zvp before giving up */
4463 			if (pp == NULL)
4464 				pp = page_lookup(&zvp, (u_offset_t)saddr,
4465 				    SE_SHARED);
4466 
4467 			/* Okay, we didn't find it, give up */
4468 			if (pp == NULL) {
4469 				kmem_cache_free(pa_hment_cache, pahmep);
4470 				*rpfn = pfn;
4471 				if (cookiep)
4472 					*cookiep = HAC_COOKIE_NONE;
4473 				return (0);
4474 			}
4475 			page_unlock(pp);
4476 			goto rehash;
4477 		}
4478 		locked = 1;
4479 	}
4480 
4481 	if (!PAGE_LOCKED(pp) && !panicstr)
4482 		panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4483 
4484 	if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4485 	    pp->p_offset != off) {
4486 		/*
4487 		 * The page moved before we got our hands on it.  Drop
4488 		 * all the locks and try again.
4489 		 */
4490 		ASSERT((flags & HAC_PAGELOCK) != 0);
4491 		sfmmu_mlist_exit(pml);
4492 		SFMMU_HASH_UNLOCK(hmebp);
4493 		page_unlock(pp);
4494 		locked = 0;
4495 		goto rehash;
4496 	}
4497 
4498 	if (!VN_ISKAS(vp)) {
4499 		/*
4500 		 * This is not a segkmem page but another page which
4501 		 * has been kernel mapped. It had better have at least
4502 		 * a share lock on it. Return the pfn.
4503 		 */
4504 		sfmmu_mlist_exit(pml);
4505 		SFMMU_HASH_UNLOCK(hmebp);
4506 		if (locked)
4507 			page_unlock(pp);
4508 		kmem_cache_free(pa_hment_cache, pahmep);
4509 		ASSERT(PAGE_LOCKED(pp));
4510 		*rpfn = pfn;
4511 		if (cookiep)
4512 			*cookiep = HAC_COOKIE_NONE;
4513 		return (0);
4514 	}
4515 
4516 	/*
4517 	 * Setup this pa_hment and link its embedded dummy sf_hment into
4518 	 * the mapping list.
4519 	 */
4520 	pp->p_share++;
4521 	pahmep->cb_id = callback_id;
4522 	pahmep->addr = vaddr;
4523 	pahmep->len = len;
4524 	pahmep->refcnt = 1;
4525 	pahmep->flags = 0;
4526 	pahmep->pvt = pvt;
4527 
4528 	sfhmep->hme_tte.ll = 0;
4529 	sfhmep->hme_data = pahmep;
4530 	sfhmep->hme_prev = osfhmep;
4531 	sfhmep->hme_next = osfhmep->hme_next;
4532 
4533 	if (osfhmep->hme_next)
4534 		osfhmep->hme_next->hme_prev = sfhmep;
4535 
4536 	osfhmep->hme_next = sfhmep;
4537 
4538 	sfmmu_mlist_exit(pml);
4539 	SFMMU_HASH_UNLOCK(hmebp);
4540 
4541 	if (locked)
4542 		page_unlock(pp);
4543 
4544 	*rpfn = pfn;
4545 	if (cookiep)
4546 		*cookiep = (void *)pahmep;
4547 
4548 	return (0);
4549 }
4550 
4551 /*
4552  * Remove the relocation callbacks from the specified addr/len.
4553  */
4554 void
4555 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4556 	void *cookie)
4557 {
4558 	struct		hmehash_bucket *hmebp;
4559 	hmeblk_tag	hblktag;
4560 	struct hme_blk	*hmeblkp;
4561 	int		hmeshift, hashno;
4562 	caddr_t		saddr;
4563 	struct pa_hment	*pahmep;
4564 	struct sf_hment	*sfhmep, *osfhmep;
4565 	kmutex_t	*pml;
4566 	tte_t		tte;
4567 	page_t		*pp;
4568 	vnode_t		*vp;
4569 	u_offset_t	off;
4570 	int		locked = 0;
4571 
4572 	/*
4573 	 * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4574 	 * remove so just return.
4575 	 */
4576 	if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4577 		return;
4578 
4579 	saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4580 
4581 rehash:
4582 	/* Find the mapping(s) for this page */
4583 	for (hashno = TTE64K, hmeblkp = NULL;
4584 	    hmeblkp == NULL && hashno <= mmu_hashcnt;
4585 	    hashno++) {
4586 		hmeshift = HME_HASH_SHIFT(hashno);
4587 		hblktag.htag_id = ksfmmup;
4588 		hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4589 		hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4590 		hblktag.htag_rehash = hashno;
4591 		hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4592 
4593 		SFMMU_HASH_LOCK(hmebp);
4594 
4595 		HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4596 
4597 		if (hmeblkp == NULL)
4598 			SFMMU_HASH_UNLOCK(hmebp);
4599 	}
4600 
4601 	if (hmeblkp == NULL)
4602 		return;
4603 
4604 	ASSERT(!hmeblkp->hblk_shared);
4605 
4606 	HBLKTOHME(osfhmep, hmeblkp, saddr);
4607 
4608 	sfmmu_copytte(&osfhmep->hme_tte, &tte);
4609 	if (!TTE_IS_VALID(&tte)) {
4610 		SFMMU_HASH_UNLOCK(hmebp);
4611 		return;
4612 	}
4613 
4614 	pp = osfhmep->hme_page;
4615 	if (pp == NULL) {
4616 		SFMMU_HASH_UNLOCK(hmebp);
4617 		ASSERT(cookie == NULL);
4618 		return;
4619 	}
4620 
4621 	vp = pp->p_vnode;
4622 	off = pp->p_offset;
4623 
4624 	pml = sfmmu_mlist_enter(pp);
4625 
4626 	if (flags & HAC_PAGELOCK) {
4627 		if (!page_trylock(pp, SE_SHARED)) {
4628 			/*
4629 			 * Somebody is holding SE_EXCL lock. Might
4630 			 * even be hat_page_relocate(). Drop all
4631 			 * our locks, lookup the page in &kvp, and
4632 			 * retry. If it doesn't exist in &kvp and &zvp,
4633 			 * then we must be dealing with a kernel mapped
4634 			 * page which doesn't actually belong to
4635 			 * segkmem so we punt.
4636 			 */
4637 			sfmmu_mlist_exit(pml);
4638 			SFMMU_HASH_UNLOCK(hmebp);
4639 			pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4640 			/* check zvp before giving up */
4641 			if (pp == NULL)
4642 				pp = page_lookup(&zvp, (u_offset_t)saddr,
4643 				    SE_SHARED);
4644 
4645 			if (pp == NULL) {
4646 				ASSERT(cookie == NULL);
4647 				return;
4648 			}
4649 			page_unlock(pp);
4650 			goto rehash;
4651 		}
4652 		locked = 1;
4653 	}
4654 
4655 	ASSERT(PAGE_LOCKED(pp));
4656 
4657 	if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4658 	    pp->p_offset != off) {
4659 		/*
4660 		 * The page moved before we got our hands on it.  Drop
4661 		 * all the locks and try again.
4662 		 */
4663 		ASSERT((flags & HAC_PAGELOCK) != 0);
4664 		sfmmu_mlist_exit(pml);
4665 		SFMMU_HASH_UNLOCK(hmebp);
4666 		page_unlock(pp);
4667 		locked = 0;
4668 		goto rehash;
4669 	}
4670 
4671 	if (!VN_ISKAS(vp)) {
4672 		/*
4673 		 * This is not a segkmem page but another page which
4674 		 * has been kernel mapped.
4675 		 */
4676 		sfmmu_mlist_exit(pml);
4677 		SFMMU_HASH_UNLOCK(hmebp);
4678 		if (locked)
4679 			page_unlock(pp);
4680 		ASSERT(cookie == NULL);
4681 		return;
4682 	}
4683 
4684 	if (cookie != NULL) {
4685 		pahmep = (struct pa_hment *)cookie;
4686 		sfhmep = &pahmep->sfment;
4687 	} else {
4688 		for (sfhmep = pp->p_mapping; sfhmep != NULL;
4689 		    sfhmep = sfhmep->hme_next) {
4690 
4691 			/*
4692 			 * skip va<->pa mappings
4693 			 */
4694 			if (!IS_PAHME(sfhmep))
4695 				continue;
4696 
4697 			pahmep = sfhmep->hme_data;
4698 			ASSERT(pahmep != NULL);
4699 
4700 			/*
4701 			 * if pa_hment matches, remove it
4702 			 */
4703 			if ((pahmep->pvt == pvt) &&
4704 			    (pahmep->addr == vaddr) &&
4705 			    (pahmep->len == len)) {
4706 				break;
4707 			}
4708 		}
4709 	}
4710 
4711 	if (sfhmep == NULL) {
4712 		if (!panicstr) {
4713 			panic("hat_delete_callback: pa_hment not found, pp %p",
4714 			    (void *)pp);
4715 		}
4716 		return;
4717 	}
4718 
4719 	/*
4720 	 * Note: at this point a valid kernel mapping must still be
4721 	 * present on this page.
4722 	 */
4723 	pp->p_share--;
4724 	if (pp->p_share <= 0)
4725 		panic("hat_delete_callback: zero p_share");
4726 
4727 	if (--pahmep->refcnt == 0) {
4728 		if (pahmep->flags != 0)
4729 			panic("hat_delete_callback: pa_hment is busy");
4730 
4731 		/*
4732 		 * Remove sfhmep from the mapping list for the page.
4733 		 */
4734 		if (sfhmep->hme_prev) {
4735 			sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4736 		} else {
4737 			pp->p_mapping = sfhmep->hme_next;
4738 		}
4739 
4740 		if (sfhmep->hme_next)
4741 			sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4742 
4743 		sfmmu_mlist_exit(pml);
4744 		SFMMU_HASH_UNLOCK(hmebp);
4745 
4746 		if (locked)
4747 			page_unlock(pp);
4748 
4749 		kmem_cache_free(pa_hment_cache, pahmep);
4750 		return;
4751 	}
4752 
4753 	sfmmu_mlist_exit(pml);
4754 	SFMMU_HASH_UNLOCK(hmebp);
4755 	if (locked)
4756 		page_unlock(pp);
4757 }
4758 
4759 /*
4760  * hat_probe returns 1 if the translation for the address 'addr' is
4761  * loaded, zero otherwise.
4762  *
4763  * hat_probe should be used only for advisorary purposes because it may
4764  * occasionally return the wrong value. The implementation must guarantee that
4765  * returning the wrong value is a very rare event. hat_probe is used
4766  * to implement optimizations in the segment drivers.
4767  *
4768  */
4769 int
4770 hat_probe(struct hat *sfmmup, caddr_t addr)
4771 {
4772 	pfn_t pfn;
4773 	tte_t tte;
4774 
4775 	ASSERT(sfmmup != NULL);
4776 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4777 
4778 	ASSERT((sfmmup == ksfmmup) ||
4779 	    AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
4780 
4781 	if (sfmmup == ksfmmup) {
4782 		while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4783 		    == PFN_SUSPENDED) {
4784 			sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4785 		}
4786 	} else {
4787 		pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4788 	}
4789 
4790 	if (pfn != PFN_INVALID)
4791 		return (1);
4792 	else
4793 		return (0);
4794 }
4795 
4796 ssize_t
4797 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4798 {
4799 	tte_t tte;
4800 
4801 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4802 
4803 	if (sfmmup == ksfmmup) {
4804 		if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4805 			return (-1);
4806 		}
4807 	} else {
4808 		if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4809 			return (-1);
4810 		}
4811 	}
4812 
4813 	ASSERT(TTE_IS_VALID(&tte));
4814 	return (TTEBYTES(TTE_CSZ(&tte)));
4815 }
4816 
4817 uint_t
4818 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4819 {
4820 	tte_t tte;
4821 
4822 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
4823 
4824 	if (sfmmup == ksfmmup) {
4825 		if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4826 			tte.ll = 0;
4827 		}
4828 	} else {
4829 		if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4830 			tte.ll = 0;
4831 		}
4832 	}
4833 	if (TTE_IS_VALID(&tte)) {
4834 		*attr = sfmmu_ptov_attr(&tte);
4835 		return (0);
4836 	}
4837 	*attr = 0;
4838 	return ((uint_t)0xffffffff);
4839 }
4840 
4841 /*
4842  * Enables more attributes on specified address range (ie. logical OR)
4843  */
4844 void
4845 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4846 {
4847 	if (hat->sfmmu_xhat_provider) {
4848 		XHAT_SETATTR(hat, addr, len, attr);
4849 		return;
4850 	} else {
4851 		/*
4852 		 * This must be a CPU HAT. If the address space has
4853 		 * XHATs attached, change attributes for all of them,
4854 		 * just in case
4855 		 */
4856 		ASSERT(hat->sfmmu_as != NULL);
4857 		if (hat->sfmmu_as->a_xhat != NULL)
4858 			xhat_setattr_all(hat->sfmmu_as, addr, len, attr);
4859 	}
4860 
4861 	sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4862 }
4863 
4864 /*
4865  * Assigns attributes to the specified address range.  All the attributes
4866  * are specified.
4867  */
4868 void
4869 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4870 {
4871 	if (hat->sfmmu_xhat_provider) {
4872 		XHAT_CHGATTR(hat, addr, len, attr);
4873 		return;
4874 	} else {
4875 		/*
4876 		 * This must be a CPU HAT. If the address space has
4877 		 * XHATs attached, change attributes for all of them,
4878 		 * just in case
4879 		 */
4880 		ASSERT(hat->sfmmu_as != NULL);
4881 		if (hat->sfmmu_as->a_xhat != NULL)
4882 			xhat_chgattr_all(hat->sfmmu_as, addr, len, attr);
4883 	}
4884 
4885 	sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4886 }
4887 
4888 /*
4889  * Remove attributes on the specified address range (ie. loginal NAND)
4890  */
4891 void
4892 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4893 {
4894 	if (hat->sfmmu_xhat_provider) {
4895 		XHAT_CLRATTR(hat, addr, len, attr);
4896 		return;
4897 	} else {
4898 		/*
4899 		 * This must be a CPU HAT. If the address space has
4900 		 * XHATs attached, change attributes for all of them,
4901 		 * just in case
4902 		 */
4903 		ASSERT(hat->sfmmu_as != NULL);
4904 		if (hat->sfmmu_as->a_xhat != NULL)
4905 			xhat_clrattr_all(hat->sfmmu_as, addr, len, attr);
4906 	}
4907 
4908 	sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4909 }
4910 
4911 /*
4912  * Change attributes on an address range to that specified by attr and mode.
4913  */
4914 static void
4915 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4916 	int mode)
4917 {
4918 	struct hmehash_bucket *hmebp;
4919 	hmeblk_tag hblktag;
4920 	int hmeshift, hashno = 1;
4921 	struct hme_blk *hmeblkp, *list = NULL;
4922 	caddr_t endaddr;
4923 	cpuset_t cpuset;
4924 	demap_range_t dmr;
4925 
4926 	CPUSET_ZERO(cpuset);
4927 
4928 	ASSERT((sfmmup == ksfmmup) ||
4929 	    AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
4930 	ASSERT((len & MMU_PAGEOFFSET) == 0);
4931 	ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4932 
4933 	if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4934 	    ((addr + len) > (caddr_t)USERLIMIT)) {
4935 		panic("user addr %p in kernel space",
4936 		    (void *)addr);
4937 	}
4938 
4939 	endaddr = addr + len;
4940 	hblktag.htag_id = sfmmup;
4941 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4942 	DEMAP_RANGE_INIT(sfmmup, &dmr);
4943 
4944 	while (addr < endaddr) {
4945 		hmeshift = HME_HASH_SHIFT(hashno);
4946 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4947 		hblktag.htag_rehash = hashno;
4948 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4949 
4950 		SFMMU_HASH_LOCK(hmebp);
4951 
4952 		HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4953 		if (hmeblkp != NULL) {
4954 			ASSERT(!hmeblkp->hblk_shared);
4955 			/*
4956 			 * We've encountered a shadow hmeblk so skip the range
4957 			 * of the next smaller mapping size.
4958 			 */
4959 			if (hmeblkp->hblk_shw_bit) {
4960 				ASSERT(sfmmup != ksfmmup);
4961 				ASSERT(hashno > 1);
4962 				addr = (caddr_t)P2END((uintptr_t)addr,
4963 				    TTEBYTES(hashno - 1));
4964 			} else {
4965 				addr = sfmmu_hblk_chgattr(sfmmup,
4966 				    hmeblkp, addr, endaddr, &dmr, attr, mode);
4967 			}
4968 			SFMMU_HASH_UNLOCK(hmebp);
4969 			hashno = 1;
4970 			continue;
4971 		}
4972 		SFMMU_HASH_UNLOCK(hmebp);
4973 
4974 		if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4975 			/*
4976 			 * We have traversed the whole list and rehashed
4977 			 * if necessary without finding the address to chgattr.
4978 			 * This is ok, so we increment the address by the
4979 			 * smallest hmeblk range for kernel mappings or for
4980 			 * user mappings with no large pages, and the largest
4981 			 * hmeblk range, to account for shadow hmeblks, for
4982 			 * user mappings with large pages and continue.
4983 			 */
4984 			if (sfmmup == ksfmmup)
4985 				addr = (caddr_t)P2END((uintptr_t)addr,
4986 				    TTEBYTES(1));
4987 			else
4988 				addr = (caddr_t)P2END((uintptr_t)addr,
4989 				    TTEBYTES(hashno));
4990 			hashno = 1;
4991 		} else {
4992 			hashno++;
4993 		}
4994 	}
4995 
4996 	sfmmu_hblks_list_purge(&list, 0);
4997 	DEMAP_RANGE_FLUSH(&dmr);
4998 	cpuset = sfmmup->sfmmu_cpusran;
4999 	xt_sync(cpuset);
5000 }
5001 
5002 /*
5003  * This function chgattr on a range of addresses in an hmeblk.  It returns the
5004  * next addres that needs to be chgattr.
5005  * It should be called with the hash lock held.
5006  * XXX It should be possible to optimize chgattr by not flushing every time but
5007  * on the other hand:
5008  * 1. do one flush crosscall.
5009  * 2. only flush if we are increasing permissions (make sure this will work)
5010  */
5011 static caddr_t
5012 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5013 	caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
5014 {
5015 	tte_t tte, tteattr, tteflags, ttemod;
5016 	struct sf_hment *sfhmep;
5017 	int ttesz;
5018 	struct page *pp = NULL;
5019 	kmutex_t *pml, *pmtx;
5020 	int ret;
5021 	int use_demap_range;
5022 #if defined(SF_ERRATA_57)
5023 	int check_exec;
5024 #endif
5025 
5026 	ASSERT(in_hblk_range(hmeblkp, addr));
5027 	ASSERT(hmeblkp->hblk_shw_bit == 0);
5028 	ASSERT(!hmeblkp->hblk_shared);
5029 
5030 	endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5031 	ttesz = get_hblk_ttesz(hmeblkp);
5032 
5033 	/*
5034 	 * Flush the current demap region if addresses have been
5035 	 * skipped or the page size doesn't match.
5036 	 */
5037 	use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
5038 	if (use_demap_range) {
5039 		DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5040 	} else {
5041 		DEMAP_RANGE_FLUSH(dmrp);
5042 	}
5043 
5044 	tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
5045 #if defined(SF_ERRATA_57)
5046 	check_exec = (sfmmup != ksfmmup) &&
5047 	    AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5048 	    TTE_IS_EXECUTABLE(&tteattr);
5049 #endif
5050 	HBLKTOHME(sfhmep, hmeblkp, addr);
5051 	while (addr < endaddr) {
5052 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
5053 		if (TTE_IS_VALID(&tte)) {
5054 			if ((tte.ll & tteflags.ll) == tteattr.ll) {
5055 				/*
5056 				 * if the new attr is the same as old
5057 				 * continue
5058 				 */
5059 				goto next_addr;
5060 			}
5061 			if (!TTE_IS_WRITABLE(&tteattr)) {
5062 				/*
5063 				 * make sure we clear hw modify bit if we
5064 				 * removing write protections
5065 				 */
5066 				tteflags.tte_intlo |= TTE_HWWR_INT;
5067 			}
5068 
5069 			pml = NULL;
5070 			pp = sfhmep->hme_page;
5071 			if (pp) {
5072 				pml = sfmmu_mlist_enter(pp);
5073 			}
5074 
5075 			if (pp != sfhmep->hme_page) {
5076 				/*
5077 				 * tte must have been unloaded.
5078 				 */
5079 				ASSERT(pml);
5080 				sfmmu_mlist_exit(pml);
5081 				continue;
5082 			}
5083 
5084 			ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5085 
5086 			ttemod = tte;
5087 			ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5088 			ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5089 
5090 #if defined(SF_ERRATA_57)
5091 			if (check_exec && addr < errata57_limit)
5092 				ttemod.tte_exec_perm = 0;
5093 #endif
5094 			ret = sfmmu_modifytte_try(&tte, &ttemod,
5095 			    &sfhmep->hme_tte);
5096 
5097 			if (ret < 0) {
5098 				/* tte changed underneath us */
5099 				if (pml) {
5100 					sfmmu_mlist_exit(pml);
5101 				}
5102 				continue;
5103 			}
5104 
5105 			if (tteflags.tte_intlo & TTE_HWWR_INT) {
5106 				/*
5107 				 * need to sync if we are clearing modify bit.
5108 				 */
5109 				sfmmu_ttesync(sfmmup, addr, &tte, pp);
5110 			}
5111 
5112 			if (pp && PP_ISRO(pp)) {
5113 				if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5114 					pmtx = sfmmu_page_enter(pp);
5115 					PP_CLRRO(pp);
5116 					sfmmu_page_exit(pmtx);
5117 				}
5118 			}
5119 
5120 			if (ret > 0 && use_demap_range) {
5121 				DEMAP_RANGE_MARKPG(dmrp, addr);
5122 			} else if (ret > 0) {
5123 				sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5124 			}
5125 
5126 			if (pml) {
5127 				sfmmu_mlist_exit(pml);
5128 			}
5129 		}
5130 next_addr:
5131 		addr += TTEBYTES(ttesz);
5132 		sfhmep++;
5133 		DEMAP_RANGE_NEXTPG(dmrp);
5134 	}
5135 	return (addr);
5136 }
5137 
5138 /*
5139  * This routine converts virtual attributes to physical ones.  It will
5140  * update the tteflags field with the tte mask corresponding to the attributes
5141  * affected and it returns the new attributes.  It will also clear the modify
5142  * bit if we are taking away write permission.  This is necessary since the
5143  * modify bit is the hardware permission bit and we need to clear it in order
5144  * to detect write faults.
5145  */
5146 static uint64_t
5147 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5148 {
5149 	tte_t ttevalue;
5150 
5151 	ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5152 
5153 	switch (mode) {
5154 	case SFMMU_CHGATTR:
5155 		/* all attributes specified */
5156 		ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5157 		ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5158 		ttemaskp->tte_inthi = TTEINTHI_ATTR;
5159 		ttemaskp->tte_intlo = TTEINTLO_ATTR;
5160 		break;
5161 	case SFMMU_SETATTR:
5162 		ASSERT(!(attr & ~HAT_PROT_MASK));
5163 		ttemaskp->ll = 0;
5164 		ttevalue.ll = 0;
5165 		/*
5166 		 * a valid tte implies exec and read for sfmmu
5167 		 * so no need to do anything about them.
5168 		 * since priviledged access implies user access
5169 		 * PROT_USER doesn't make sense either.
5170 		 */
5171 		if (attr & PROT_WRITE) {
5172 			ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5173 			ttevalue.tte_intlo |= TTE_WRPRM_INT;
5174 		}
5175 		break;
5176 	case SFMMU_CLRATTR:
5177 		/* attributes will be nand with current ones */
5178 		if (attr & ~(PROT_WRITE | PROT_USER)) {
5179 			panic("sfmmu: attr %x not supported", attr);
5180 		}
5181 		ttemaskp->ll = 0;
5182 		ttevalue.ll = 0;
5183 		if (attr & PROT_WRITE) {
5184 			/* clear both writable and modify bit */
5185 			ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5186 		}
5187 		if (attr & PROT_USER) {
5188 			ttemaskp->tte_intlo |= TTE_PRIV_INT;
5189 			ttevalue.tte_intlo |= TTE_PRIV_INT;
5190 		}
5191 		break;
5192 	default:
5193 		panic("sfmmu_vtop_attr: bad mode %x", mode);
5194 	}
5195 	ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5196 	return (ttevalue.ll);
5197 }
5198 
5199 static uint_t
5200 sfmmu_ptov_attr(tte_t *ttep)
5201 {
5202 	uint_t attr;
5203 
5204 	ASSERT(TTE_IS_VALID(ttep));
5205 
5206 	attr = PROT_READ;
5207 
5208 	if (TTE_IS_WRITABLE(ttep)) {
5209 		attr |= PROT_WRITE;
5210 	}
5211 	if (TTE_IS_EXECUTABLE(ttep)) {
5212 		attr |= PROT_EXEC;
5213 	}
5214 	if (!TTE_IS_PRIVILEGED(ttep)) {
5215 		attr |= PROT_USER;
5216 	}
5217 	if (TTE_IS_NFO(ttep)) {
5218 		attr |= HAT_NOFAULT;
5219 	}
5220 	if (TTE_IS_NOSYNC(ttep)) {
5221 		attr |= HAT_NOSYNC;
5222 	}
5223 	if (TTE_IS_SIDEFFECT(ttep)) {
5224 		attr |= SFMMU_SIDEFFECT;
5225 	}
5226 	if (!TTE_IS_VCACHEABLE(ttep)) {
5227 		attr |= SFMMU_UNCACHEVTTE;
5228 	}
5229 	if (!TTE_IS_PCACHEABLE(ttep)) {
5230 		attr |= SFMMU_UNCACHEPTTE;
5231 	}
5232 	return (attr);
5233 }
5234 
5235 /*
5236  * hat_chgprot is a deprecated hat call.  New segment drivers
5237  * should store all attributes and use hat_*attr calls.
5238  *
5239  * Change the protections in the virtual address range
5240  * given to the specified virtual protection.  If vprot is ~PROT_WRITE,
5241  * then remove write permission, leaving the other
5242  * permissions unchanged.  If vprot is ~PROT_USER, remove user permissions.
5243  *
5244  */
5245 void
5246 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5247 {
5248 	struct hmehash_bucket *hmebp;
5249 	hmeblk_tag hblktag;
5250 	int hmeshift, hashno = 1;
5251 	struct hme_blk *hmeblkp, *list = NULL;
5252 	caddr_t endaddr;
5253 	cpuset_t cpuset;
5254 	demap_range_t dmr;
5255 
5256 	ASSERT((len & MMU_PAGEOFFSET) == 0);
5257 	ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5258 
5259 	if (sfmmup->sfmmu_xhat_provider) {
5260 		XHAT_CHGPROT(sfmmup, addr, len, vprot);
5261 		return;
5262 	} else {
5263 		/*
5264 		 * This must be a CPU HAT. If the address space has
5265 		 * XHATs attached, change attributes for all of them,
5266 		 * just in case
5267 		 */
5268 		ASSERT(sfmmup->sfmmu_as != NULL);
5269 		if (sfmmup->sfmmu_as->a_xhat != NULL)
5270 			xhat_chgprot_all(sfmmup->sfmmu_as, addr, len, vprot);
5271 	}
5272 
5273 	CPUSET_ZERO(cpuset);
5274 
5275 	if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5276 	    ((addr + len) > (caddr_t)USERLIMIT)) {
5277 		panic("user addr %p vprot %x in kernel space",
5278 		    (void *)addr, vprot);
5279 	}
5280 	endaddr = addr + len;
5281 	hblktag.htag_id = sfmmup;
5282 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5283 	DEMAP_RANGE_INIT(sfmmup, &dmr);
5284 
5285 	while (addr < endaddr) {
5286 		hmeshift = HME_HASH_SHIFT(hashno);
5287 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5288 		hblktag.htag_rehash = hashno;
5289 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5290 
5291 		SFMMU_HASH_LOCK(hmebp);
5292 
5293 		HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5294 		if (hmeblkp != NULL) {
5295 			ASSERT(!hmeblkp->hblk_shared);
5296 			/*
5297 			 * We've encountered a shadow hmeblk so skip the range
5298 			 * of the next smaller mapping size.
5299 			 */
5300 			if (hmeblkp->hblk_shw_bit) {
5301 				ASSERT(sfmmup != ksfmmup);
5302 				ASSERT(hashno > 1);
5303 				addr = (caddr_t)P2END((uintptr_t)addr,
5304 				    TTEBYTES(hashno - 1));
5305 			} else {
5306 				addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5307 				    addr, endaddr, &dmr, vprot);
5308 			}
5309 			SFMMU_HASH_UNLOCK(hmebp);
5310 			hashno = 1;
5311 			continue;
5312 		}
5313 		SFMMU_HASH_UNLOCK(hmebp);
5314 
5315 		if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5316 			/*
5317 			 * We have traversed the whole list and rehashed
5318 			 * if necessary without finding the address to chgprot.
5319 			 * This is ok so we increment the address by the
5320 			 * smallest hmeblk range for kernel mappings and the
5321 			 * largest hmeblk range, to account for shadow hmeblks,
5322 			 * for user mappings and continue.
5323 			 */
5324 			if (sfmmup == ksfmmup)
5325 				addr = (caddr_t)P2END((uintptr_t)addr,
5326 				    TTEBYTES(1));
5327 			else
5328 				addr = (caddr_t)P2END((uintptr_t)addr,
5329 				    TTEBYTES(hashno));
5330 			hashno = 1;
5331 		} else {
5332 			hashno++;
5333 		}
5334 	}
5335 
5336 	sfmmu_hblks_list_purge(&list, 0);
5337 	DEMAP_RANGE_FLUSH(&dmr);
5338 	cpuset = sfmmup->sfmmu_cpusran;
5339 	xt_sync(cpuset);
5340 }
5341 
5342 /*
5343  * This function chgprots a range of addresses in an hmeblk.  It returns the
5344  * next addres that needs to be chgprot.
5345  * It should be called with the hash lock held.
5346  * XXX It shold be possible to optimize chgprot by not flushing every time but
5347  * on the other hand:
5348  * 1. do one flush crosscall.
5349  * 2. only flush if we are increasing permissions (make sure this will work)
5350  */
5351 static caddr_t
5352 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5353 	caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5354 {
5355 	uint_t pprot;
5356 	tte_t tte, ttemod;
5357 	struct sf_hment *sfhmep;
5358 	uint_t tteflags;
5359 	int ttesz;
5360 	struct page *pp = NULL;
5361 	kmutex_t *pml, *pmtx;
5362 	int ret;
5363 	int use_demap_range;
5364 #if defined(SF_ERRATA_57)
5365 	int check_exec;
5366 #endif
5367 
5368 	ASSERT(in_hblk_range(hmeblkp, addr));
5369 	ASSERT(hmeblkp->hblk_shw_bit == 0);
5370 	ASSERT(!hmeblkp->hblk_shared);
5371 
5372 #ifdef DEBUG
5373 	if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5374 	    (endaddr < get_hblk_endaddr(hmeblkp))) {
5375 		panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5376 	}
5377 #endif /* DEBUG */
5378 
5379 	endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5380 	ttesz = get_hblk_ttesz(hmeblkp);
5381 
5382 	pprot = sfmmu_vtop_prot(vprot, &tteflags);
5383 #if defined(SF_ERRATA_57)
5384 	check_exec = (sfmmup != ksfmmup) &&
5385 	    AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5386 	    ((vprot & PROT_EXEC) == PROT_EXEC);
5387 #endif
5388 	HBLKTOHME(sfhmep, hmeblkp, addr);
5389 
5390 	/*
5391 	 * Flush the current demap region if addresses have been
5392 	 * skipped or the page size doesn't match.
5393 	 */
5394 	use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5395 	if (use_demap_range) {
5396 		DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5397 	} else {
5398 		DEMAP_RANGE_FLUSH(dmrp);
5399 	}
5400 
5401 	while (addr < endaddr) {
5402 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
5403 		if (TTE_IS_VALID(&tte)) {
5404 			if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5405 				/*
5406 				 * if the new protection is the same as old
5407 				 * continue
5408 				 */
5409 				goto next_addr;
5410 			}
5411 			pml = NULL;
5412 			pp = sfhmep->hme_page;
5413 			if (pp) {
5414 				pml = sfmmu_mlist_enter(pp);
5415 			}
5416 			if (pp != sfhmep->hme_page) {
5417 				/*
5418 				 * tte most have been unloaded
5419 				 * underneath us.  Recheck
5420 				 */
5421 				ASSERT(pml);
5422 				sfmmu_mlist_exit(pml);
5423 				continue;
5424 			}
5425 
5426 			ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5427 
5428 			ttemod = tte;
5429 			TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5430 #if defined(SF_ERRATA_57)
5431 			if (check_exec && addr < errata57_limit)
5432 				ttemod.tte_exec_perm = 0;
5433 #endif
5434 			ret = sfmmu_modifytte_try(&tte, &ttemod,
5435 			    &sfhmep->hme_tte);
5436 
5437 			if (ret < 0) {
5438 				/* tte changed underneath us */
5439 				if (pml) {
5440 					sfmmu_mlist_exit(pml);
5441 				}
5442 				continue;
5443 			}
5444 
5445 			if (tteflags & TTE_HWWR_INT) {
5446 				/*
5447 				 * need to sync if we are clearing modify bit.
5448 				 */
5449 				sfmmu_ttesync(sfmmup, addr, &tte, pp);
5450 			}
5451 
5452 			if (pp && PP_ISRO(pp)) {
5453 				if (pprot & TTE_WRPRM_INT) {
5454 					pmtx = sfmmu_page_enter(pp);
5455 					PP_CLRRO(pp);
5456 					sfmmu_page_exit(pmtx);
5457 				}
5458 			}
5459 
5460 			if (ret > 0 && use_demap_range) {
5461 				DEMAP_RANGE_MARKPG(dmrp, addr);
5462 			} else if (ret > 0) {
5463 				sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5464 			}
5465 
5466 			if (pml) {
5467 				sfmmu_mlist_exit(pml);
5468 			}
5469 		}
5470 next_addr:
5471 		addr += TTEBYTES(ttesz);
5472 		sfhmep++;
5473 		DEMAP_RANGE_NEXTPG(dmrp);
5474 	}
5475 	return (addr);
5476 }
5477 
5478 /*
5479  * This routine is deprecated and should only be used by hat_chgprot.
5480  * The correct routine is sfmmu_vtop_attr.
5481  * This routine converts virtual page protections to physical ones.  It will
5482  * update the tteflags field with the tte mask corresponding to the protections
5483  * affected and it returns the new protections.  It will also clear the modify
5484  * bit if we are taking away write permission.  This is necessary since the
5485  * modify bit is the hardware permission bit and we need to clear it in order
5486  * to detect write faults.
5487  * It accepts the following special protections:
5488  * ~PROT_WRITE = remove write permissions.
5489  * ~PROT_USER = remove user permissions.
5490  */
5491 static uint_t
5492 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5493 {
5494 	if (vprot == (uint_t)~PROT_WRITE) {
5495 		*tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5496 		return (0);		/* will cause wrprm to be cleared */
5497 	}
5498 	if (vprot == (uint_t)~PROT_USER) {
5499 		*tteflagsp = TTE_PRIV_INT;
5500 		return (0);		/* will cause privprm to be cleared */
5501 	}
5502 	if ((vprot == 0) || (vprot == PROT_USER) ||
5503 	    ((vprot & PROT_ALL) != vprot)) {
5504 		panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5505 	}
5506 
5507 	switch (vprot) {
5508 	case (PROT_READ):
5509 	case (PROT_EXEC):
5510 	case (PROT_EXEC | PROT_READ):
5511 		*tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5512 		return (TTE_PRIV_INT); 		/* set prv and clr wrt */
5513 	case (PROT_WRITE):
5514 	case (PROT_WRITE | PROT_READ):
5515 	case (PROT_EXEC | PROT_WRITE):
5516 	case (PROT_EXEC | PROT_WRITE | PROT_READ):
5517 		*tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5518 		return (TTE_PRIV_INT | TTE_WRPRM_INT); 	/* set prv and wrt */
5519 	case (PROT_USER | PROT_READ):
5520 	case (PROT_USER | PROT_EXEC):
5521 	case (PROT_USER | PROT_EXEC | PROT_READ):
5522 		*tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5523 		return (0); 			/* clr prv and wrt */
5524 	case (PROT_USER | PROT_WRITE):
5525 	case (PROT_USER | PROT_WRITE | PROT_READ):
5526 	case (PROT_USER | PROT_EXEC | PROT_WRITE):
5527 	case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5528 		*tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5529 		return (TTE_WRPRM_INT); 	/* clr prv and set wrt */
5530 	default:
5531 		panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5532 	}
5533 	return (0);
5534 }
5535 
5536 /*
5537  * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5538  * the normal algorithm would take too long for a very large VA range with
5539  * few real mappings. This routine just walks thru all HMEs in the global
5540  * hash table to find and remove mappings.
5541  */
5542 static void
5543 hat_unload_large_virtual(
5544 	struct hat		*sfmmup,
5545 	caddr_t			startaddr,
5546 	size_t			len,
5547 	uint_t			flags,
5548 	hat_callback_t		*callback)
5549 {
5550 	struct hmehash_bucket *hmebp;
5551 	struct hme_blk *hmeblkp;
5552 	struct hme_blk *pr_hblk = NULL;
5553 	struct hme_blk *nx_hblk;
5554 	struct hme_blk *list = NULL;
5555 	int i;
5556 	demap_range_t dmr, *dmrp;
5557 	cpuset_t cpuset;
5558 	caddr_t	endaddr = startaddr + len;
5559 	caddr_t	sa;
5560 	caddr_t	ea;
5561 	caddr_t	cb_sa[MAX_CB_ADDR];
5562 	caddr_t	cb_ea[MAX_CB_ADDR];
5563 	int	addr_cnt = 0;
5564 	int	a = 0;
5565 
5566 	if (sfmmup->sfmmu_free) {
5567 		dmrp = NULL;
5568 	} else {
5569 		dmrp = &dmr;
5570 		DEMAP_RANGE_INIT(sfmmup, dmrp);
5571 	}
5572 
5573 	/*
5574 	 * Loop through all the hash buckets of HME blocks looking for matches.
5575 	 */
5576 	for (i = 0; i <= UHMEHASH_SZ; i++) {
5577 		hmebp = &uhme_hash[i];
5578 		SFMMU_HASH_LOCK(hmebp);
5579 		hmeblkp = hmebp->hmeblkp;
5580 		pr_hblk = NULL;
5581 		while (hmeblkp) {
5582 			nx_hblk = hmeblkp->hblk_next;
5583 
5584 			/*
5585 			 * skip if not this context, if a shadow block or
5586 			 * if the mapping is not in the requested range
5587 			 */
5588 			if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5589 			    hmeblkp->hblk_shw_bit ||
5590 			    (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5591 			    (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5592 				pr_hblk = hmeblkp;
5593 				goto next_block;
5594 			}
5595 
5596 			ASSERT(!hmeblkp->hblk_shared);
5597 			/*
5598 			 * unload if there are any current valid mappings
5599 			 */
5600 			if (hmeblkp->hblk_vcnt != 0 ||
5601 			    hmeblkp->hblk_hmecnt != 0)
5602 				(void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5603 				    sa, ea, dmrp, flags);
5604 
5605 			/*
5606 			 * on unmap we also release the HME block itself, once
5607 			 * all mappings are gone.
5608 			 */
5609 			if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5610 			    !hmeblkp->hblk_vcnt &&
5611 			    !hmeblkp->hblk_hmecnt) {
5612 				ASSERT(!hmeblkp->hblk_lckcnt);
5613 				sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5614 				    &list, 0);
5615 			} else {
5616 				pr_hblk = hmeblkp;
5617 			}
5618 
5619 			if (callback == NULL)
5620 				goto next_block;
5621 
5622 			/*
5623 			 * HME blocks may span more than one page, but we may be
5624 			 * unmapping only one page, so check for a smaller range
5625 			 * for the callback
5626 			 */
5627 			if (sa < startaddr)
5628 				sa = startaddr;
5629 			if (--ea > endaddr)
5630 				ea = endaddr - 1;
5631 
5632 			cb_sa[addr_cnt] = sa;
5633 			cb_ea[addr_cnt] = ea;
5634 			if (++addr_cnt == MAX_CB_ADDR) {
5635 				if (dmrp != NULL) {
5636 					DEMAP_RANGE_FLUSH(dmrp);
5637 					cpuset = sfmmup->sfmmu_cpusran;
5638 					xt_sync(cpuset);
5639 				}
5640 
5641 				for (a = 0; a < MAX_CB_ADDR; ++a) {
5642 					callback->hcb_start_addr = cb_sa[a];
5643 					callback->hcb_end_addr = cb_ea[a];
5644 					callback->hcb_function(callback);
5645 				}
5646 				addr_cnt = 0;
5647 			}
5648 
5649 next_block:
5650 			hmeblkp = nx_hblk;
5651 		}
5652 		SFMMU_HASH_UNLOCK(hmebp);
5653 	}
5654 
5655 	sfmmu_hblks_list_purge(&list, 0);
5656 	if (dmrp != NULL) {
5657 		DEMAP_RANGE_FLUSH(dmrp);
5658 		cpuset = sfmmup->sfmmu_cpusran;
5659 		xt_sync(cpuset);
5660 	}
5661 
5662 	for (a = 0; a < addr_cnt; ++a) {
5663 		callback->hcb_start_addr = cb_sa[a];
5664 		callback->hcb_end_addr = cb_ea[a];
5665 		callback->hcb_function(callback);
5666 	}
5667 
5668 	/*
5669 	 * Check TSB and TLB page sizes if the process isn't exiting.
5670 	 */
5671 	if (!sfmmup->sfmmu_free)
5672 		sfmmu_check_page_sizes(sfmmup, 0);
5673 }
5674 
5675 /*
5676  * Unload all the mappings in the range [addr..addr+len). addr and len must
5677  * be MMU_PAGESIZE aligned.
5678  */
5679 
5680 extern struct seg *segkmap;
5681 #define	ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5682 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5683 
5684 
5685 void
5686 hat_unload_callback(
5687 	struct hat *sfmmup,
5688 	caddr_t addr,
5689 	size_t len,
5690 	uint_t flags,
5691 	hat_callback_t *callback)
5692 {
5693 	struct hmehash_bucket *hmebp;
5694 	hmeblk_tag hblktag;
5695 	int hmeshift, hashno, iskernel;
5696 	struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5697 	caddr_t endaddr;
5698 	cpuset_t cpuset;
5699 	int addr_count = 0;
5700 	int a;
5701 	caddr_t cb_start_addr[MAX_CB_ADDR];
5702 	caddr_t cb_end_addr[MAX_CB_ADDR];
5703 	int issegkmap = ISSEGKMAP(sfmmup, addr);
5704 	demap_range_t dmr, *dmrp;
5705 
5706 	if (sfmmup->sfmmu_xhat_provider) {
5707 		XHAT_UNLOAD_CALLBACK(sfmmup, addr, len, flags, callback);
5708 		return;
5709 	} else {
5710 		/*
5711 		 * This must be a CPU HAT. If the address space has
5712 		 * XHATs attached, unload the mappings for all of them,
5713 		 * just in case
5714 		 */
5715 		ASSERT(sfmmup->sfmmu_as != NULL);
5716 		if (sfmmup->sfmmu_as->a_xhat != NULL)
5717 			xhat_unload_callback_all(sfmmup->sfmmu_as, addr,
5718 			    len, flags, callback);
5719 	}
5720 
5721 	ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5722 	    AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
5723 
5724 	ASSERT(sfmmup != NULL);
5725 	ASSERT((len & MMU_PAGEOFFSET) == 0);
5726 	ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5727 
5728 	/*
5729 	 * Probing through a large VA range (say 63 bits) will be slow, even
5730 	 * at 4 Meg steps between the probes. So, when the virtual address range
5731 	 * is very large, search the HME entries for what to unload.
5732 	 *
5733 	 *	len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5734 	 *
5735 	 *	UHMEHASH_SZ is number of hash buckets to examine
5736 	 *
5737 	 */
5738 	if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5739 		hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5740 		return;
5741 	}
5742 
5743 	CPUSET_ZERO(cpuset);
5744 
5745 	/*
5746 	 * If the process is exiting, we can save a lot of fuss since
5747 	 * we'll flush the TLB when we free the ctx anyway.
5748 	 */
5749 	if (sfmmup->sfmmu_free)
5750 		dmrp = NULL;
5751 	else
5752 		dmrp = &dmr;
5753 
5754 	DEMAP_RANGE_INIT(sfmmup, dmrp);
5755 	endaddr = addr + len;
5756 	hblktag.htag_id = sfmmup;
5757 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5758 
5759 	/*
5760 	 * It is likely for the vm to call unload over a wide range of
5761 	 * addresses that are actually very sparsely populated by
5762 	 * translations.  In order to speed this up the sfmmu hat supports
5763 	 * the concept of shadow hmeblks. Dummy large page hmeblks that
5764 	 * correspond to actual small translations are allocated at tteload
5765 	 * time and are referred to as shadow hmeblks.  Now, during unload
5766 	 * time, we first check if we have a shadow hmeblk for that
5767 	 * translation.  The absence of one means the corresponding address
5768 	 * range is empty and can be skipped.
5769 	 *
5770 	 * The kernel is an exception to above statement and that is why
5771 	 * we don't use shadow hmeblks and hash starting from the smallest
5772 	 * page size.
5773 	 */
5774 	if (sfmmup == KHATID) {
5775 		iskernel = 1;
5776 		hashno = TTE64K;
5777 	} else {
5778 		iskernel = 0;
5779 		if (mmu_page_sizes == max_mmu_page_sizes) {
5780 			hashno = TTE256M;
5781 		} else {
5782 			hashno = TTE4M;
5783 		}
5784 	}
5785 	while (addr < endaddr) {
5786 		hmeshift = HME_HASH_SHIFT(hashno);
5787 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5788 		hblktag.htag_rehash = hashno;
5789 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5790 
5791 		SFMMU_HASH_LOCK(hmebp);
5792 
5793 		HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5794 		if (hmeblkp == NULL) {
5795 			/*
5796 			 * didn't find an hmeblk. skip the appropiate
5797 			 * address range.
5798 			 */
5799 			SFMMU_HASH_UNLOCK(hmebp);
5800 			if (iskernel) {
5801 				if (hashno < mmu_hashcnt) {
5802 					hashno++;
5803 					continue;
5804 				} else {
5805 					hashno = TTE64K;
5806 					addr = (caddr_t)roundup((uintptr_t)addr
5807 					    + 1, MMU_PAGESIZE64K);
5808 					continue;
5809 				}
5810 			}
5811 			addr = (caddr_t)roundup((uintptr_t)addr + 1,
5812 			    (1 << hmeshift));
5813 			if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5814 				ASSERT(hashno == TTE64K);
5815 				continue;
5816 			}
5817 			if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5818 				hashno = TTE512K;
5819 				continue;
5820 			}
5821 			if (mmu_page_sizes == max_mmu_page_sizes) {
5822 				if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5823 					hashno = TTE4M;
5824 					continue;
5825 				}
5826 				if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5827 					hashno = TTE32M;
5828 					continue;
5829 				}
5830 				hashno = TTE256M;
5831 				continue;
5832 			} else {
5833 				hashno = TTE4M;
5834 				continue;
5835 			}
5836 		}
5837 		ASSERT(hmeblkp);
5838 		ASSERT(!hmeblkp->hblk_shared);
5839 		if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5840 			/*
5841 			 * If the valid count is zero we can skip the range
5842 			 * mapped by this hmeblk.
5843 			 * We free hblks in the case of HAT_UNMAP.  HAT_UNMAP
5844 			 * is used by segment drivers as a hint
5845 			 * that the mapping resource won't be used any longer.
5846 			 * The best example of this is during exit().
5847 			 */
5848 			addr = (caddr_t)roundup((uintptr_t)addr + 1,
5849 			    get_hblk_span(hmeblkp));
5850 			if ((flags & HAT_UNLOAD_UNMAP) ||
5851 			    (iskernel && !issegkmap)) {
5852 				sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5853 				    &list, 0);
5854 			}
5855 			SFMMU_HASH_UNLOCK(hmebp);
5856 
5857 			if (iskernel) {
5858 				hashno = TTE64K;
5859 				continue;
5860 			}
5861 			if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5862 				ASSERT(hashno == TTE64K);
5863 				continue;
5864 			}
5865 			if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5866 				hashno = TTE512K;
5867 				continue;
5868 			}
5869 			if (mmu_page_sizes == max_mmu_page_sizes) {
5870 				if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5871 					hashno = TTE4M;
5872 					continue;
5873 				}
5874 				if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5875 					hashno = TTE32M;
5876 					continue;
5877 				}
5878 				hashno = TTE256M;
5879 				continue;
5880 			} else {
5881 				hashno = TTE4M;
5882 				continue;
5883 			}
5884 		}
5885 		if (hmeblkp->hblk_shw_bit) {
5886 			/*
5887 			 * If we encounter a shadow hmeblk we know there is
5888 			 * smaller sized hmeblks mapping the same address space.
5889 			 * Decrement the hash size and rehash.
5890 			 */
5891 			ASSERT(sfmmup != KHATID);
5892 			hashno--;
5893 			SFMMU_HASH_UNLOCK(hmebp);
5894 			continue;
5895 		}
5896 
5897 		/*
5898 		 * track callback address ranges.
5899 		 * only start a new range when it's not contiguous
5900 		 */
5901 		if (callback != NULL) {
5902 			if (addr_count > 0 &&
5903 			    addr == cb_end_addr[addr_count - 1])
5904 				--addr_count;
5905 			else
5906 				cb_start_addr[addr_count] = addr;
5907 		}
5908 
5909 		addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5910 		    dmrp, flags);
5911 
5912 		if (callback != NULL)
5913 			cb_end_addr[addr_count++] = addr;
5914 
5915 		if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5916 		    !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5917 			sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5918 		}
5919 		SFMMU_HASH_UNLOCK(hmebp);
5920 
5921 		/*
5922 		 * Notify our caller as to exactly which pages
5923 		 * have been unloaded. We do these in clumps,
5924 		 * to minimize the number of xt_sync()s that need to occur.
5925 		 */
5926 		if (callback != NULL && addr_count == MAX_CB_ADDR) {
5927 			DEMAP_RANGE_FLUSH(dmrp);
5928 			if (dmrp != NULL) {
5929 				cpuset = sfmmup->sfmmu_cpusran;
5930 				xt_sync(cpuset);
5931 			}
5932 
5933 			for (a = 0; a < MAX_CB_ADDR; ++a) {
5934 				callback->hcb_start_addr = cb_start_addr[a];
5935 				callback->hcb_end_addr = cb_end_addr[a];
5936 				callback->hcb_function(callback);
5937 			}
5938 			addr_count = 0;
5939 		}
5940 		if (iskernel) {
5941 			hashno = TTE64K;
5942 			continue;
5943 		}
5944 		if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5945 			ASSERT(hashno == TTE64K);
5946 			continue;
5947 		}
5948 		if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5949 			hashno = TTE512K;
5950 			continue;
5951 		}
5952 		if (mmu_page_sizes == max_mmu_page_sizes) {
5953 			if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5954 				hashno = TTE4M;
5955 				continue;
5956 			}
5957 			if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5958 				hashno = TTE32M;
5959 				continue;
5960 			}
5961 			hashno = TTE256M;
5962 		} else {
5963 			hashno = TTE4M;
5964 		}
5965 	}
5966 
5967 	sfmmu_hblks_list_purge(&list, 0);
5968 	DEMAP_RANGE_FLUSH(dmrp);
5969 	if (dmrp != NULL) {
5970 		cpuset = sfmmup->sfmmu_cpusran;
5971 		xt_sync(cpuset);
5972 	}
5973 	if (callback && addr_count != 0) {
5974 		for (a = 0; a < addr_count; ++a) {
5975 			callback->hcb_start_addr = cb_start_addr[a];
5976 			callback->hcb_end_addr = cb_end_addr[a];
5977 			callback->hcb_function(callback);
5978 		}
5979 	}
5980 
5981 	/*
5982 	 * Check TSB and TLB page sizes if the process isn't exiting.
5983 	 */
5984 	if (!sfmmup->sfmmu_free)
5985 		sfmmu_check_page_sizes(sfmmup, 0);
5986 }
5987 
5988 /*
5989  * Unload all the mappings in the range [addr..addr+len). addr and len must
5990  * be MMU_PAGESIZE aligned.
5991  */
5992 void
5993 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5994 {
5995 	if (sfmmup->sfmmu_xhat_provider) {
5996 		XHAT_UNLOAD(sfmmup, addr, len, flags);
5997 		return;
5998 	}
5999 	hat_unload_callback(sfmmup, addr, len, flags, NULL);
6000 }
6001 
6002 
6003 /*
6004  * Find the largest mapping size for this page.
6005  */
6006 int
6007 fnd_mapping_sz(page_t *pp)
6008 {
6009 	int sz;
6010 	int p_index;
6011 
6012 	p_index = PP_MAPINDEX(pp);
6013 
6014 	sz = 0;
6015 	p_index >>= 1;	/* don't care about 8K bit */
6016 	for (; p_index; p_index >>= 1) {
6017 		sz++;
6018 	}
6019 
6020 	return (sz);
6021 }
6022 
6023 /*
6024  * This function unloads a range of addresses for an hmeblk.
6025  * It returns the next address to be unloaded.
6026  * It should be called with the hash lock held.
6027  */
6028 static caddr_t
6029 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6030 	caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
6031 {
6032 	tte_t	tte, ttemod;
6033 	struct	sf_hment *sfhmep;
6034 	int	ttesz;
6035 	long	ttecnt;
6036 	page_t *pp;
6037 	kmutex_t *pml;
6038 	int ret;
6039 	int use_demap_range;
6040 
6041 	ASSERT(in_hblk_range(hmeblkp, addr));
6042 	ASSERT(!hmeblkp->hblk_shw_bit);
6043 	ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
6044 	ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
6045 	ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
6046 
6047 #ifdef DEBUG
6048 	if (get_hblk_ttesz(hmeblkp) != TTE8K &&
6049 	    (endaddr < get_hblk_endaddr(hmeblkp))) {
6050 		panic("sfmmu_hblk_unload: partial unload of large page");
6051 	}
6052 #endif /* DEBUG */
6053 
6054 	endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6055 	ttesz = get_hblk_ttesz(hmeblkp);
6056 
6057 	use_demap_range = ((dmrp == NULL) ||
6058 	    (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
6059 
6060 	if (use_demap_range) {
6061 		DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
6062 	} else {
6063 		DEMAP_RANGE_FLUSH(dmrp);
6064 	}
6065 	ttecnt = 0;
6066 	HBLKTOHME(sfhmep, hmeblkp, addr);
6067 
6068 	while (addr < endaddr) {
6069 		pml = NULL;
6070 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
6071 		if (TTE_IS_VALID(&tte)) {
6072 			pp = sfhmep->hme_page;
6073 			if (pp != NULL) {
6074 				pml = sfmmu_mlist_enter(pp);
6075 			}
6076 
6077 			/*
6078 			 * Verify if hme still points to 'pp' now that
6079 			 * we have p_mapping lock.
6080 			 */
6081 			if (sfhmep->hme_page != pp) {
6082 				if (pp != NULL && sfhmep->hme_page != NULL) {
6083 					ASSERT(pml != NULL);
6084 					sfmmu_mlist_exit(pml);
6085 					/* Re-start this iteration. */
6086 					continue;
6087 				}
6088 				ASSERT((pp != NULL) &&
6089 				    (sfhmep->hme_page == NULL));
6090 				goto tte_unloaded;
6091 			}
6092 
6093 			/*
6094 			 * This point on we have both HASH and p_mapping
6095 			 * lock.
6096 			 */
6097 			ASSERT(pp == sfhmep->hme_page);
6098 			ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6099 
6100 			/*
6101 			 * We need to loop on modify tte because it is
6102 			 * possible for pagesync to come along and
6103 			 * change the software bits beneath us.
6104 			 *
6105 			 * Page_unload can also invalidate the tte after
6106 			 * we read tte outside of p_mapping lock.
6107 			 */
6108 again:
6109 			ttemod = tte;
6110 
6111 			TTE_SET_INVALID(&ttemod);
6112 			ret = sfmmu_modifytte_try(&tte, &ttemod,
6113 			    &sfhmep->hme_tte);
6114 
6115 			if (ret <= 0) {
6116 				if (TTE_IS_VALID(&tte)) {
6117 					ASSERT(ret < 0);
6118 					goto again;
6119 				}
6120 				if (pp != NULL) {
6121 					panic("sfmmu_hblk_unload: pp = 0x%p "
6122 					    "tte became invalid under mlist"
6123 					    " lock = 0x%p", (void *)pp,
6124 					    (void *)pml);
6125 				}
6126 				continue;
6127 			}
6128 
6129 			if (!(flags & HAT_UNLOAD_NOSYNC)) {
6130 				sfmmu_ttesync(sfmmup, addr, &tte, pp);
6131 			}
6132 
6133 			/*
6134 			 * Ok- we invalidated the tte. Do the rest of the job.
6135 			 */
6136 			ttecnt++;
6137 
6138 			if (flags & HAT_UNLOAD_UNLOCK) {
6139 				ASSERT(hmeblkp->hblk_lckcnt > 0);
6140 				atomic_add_32(&hmeblkp->hblk_lckcnt, -1);
6141 				HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6142 			}
6143 
6144 			/*
6145 			 * Normally we would need to flush the page
6146 			 * from the virtual cache at this point in
6147 			 * order to prevent a potential cache alias
6148 			 * inconsistency.
6149 			 * The particular scenario we need to worry
6150 			 * about is:
6151 			 * Given:  va1 and va2 are two virtual address
6152 			 * that alias and map the same physical
6153 			 * address.
6154 			 * 1.   mapping exists from va1 to pa and data
6155 			 * has been read into the cache.
6156 			 * 2.   unload va1.
6157 			 * 3.   load va2 and modify data using va2.
6158 			 * 4    unload va2.
6159 			 * 5.   load va1 and reference data.  Unless we
6160 			 * flush the data cache when we unload we will
6161 			 * get stale data.
6162 			 * Fortunately, page coloring eliminates the
6163 			 * above scenario by remembering the color a
6164 			 * physical page was last or is currently
6165 			 * mapped to.  Now, we delay the flush until
6166 			 * the loading of translations.  Only when the
6167 			 * new translation is of a different color
6168 			 * are we forced to flush.
6169 			 */
6170 			if (use_demap_range) {
6171 				/*
6172 				 * Mark this page as needing a demap.
6173 				 */
6174 				DEMAP_RANGE_MARKPG(dmrp, addr);
6175 			} else {
6176 				ASSERT(sfmmup != NULL);
6177 				ASSERT(!hmeblkp->hblk_shared);
6178 				sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6179 				    sfmmup->sfmmu_free, 0);
6180 			}
6181 
6182 			if (pp) {
6183 				/*
6184 				 * Remove the hment from the mapping list
6185 				 */
6186 				ASSERT(hmeblkp->hblk_hmecnt > 0);
6187 
6188 				/*
6189 				 * Again, we cannot
6190 				 * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6191 				 */
6192 				HME_SUB(sfhmep, pp);
6193 				membar_stst();
6194 				atomic_add_16(&hmeblkp->hblk_hmecnt, -1);
6195 			}
6196 
6197 			ASSERT(hmeblkp->hblk_vcnt > 0);
6198 			atomic_add_16(&hmeblkp->hblk_vcnt, -1);
6199 
6200 			ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6201 			    !hmeblkp->hblk_lckcnt);
6202 
6203 #ifdef VAC
6204 			if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6205 				if (PP_ISTNC(pp)) {
6206 					/*
6207 					 * If page was temporary
6208 					 * uncached, try to recache
6209 					 * it. Note that HME_SUB() was
6210 					 * called above so p_index and
6211 					 * mlist had been updated.
6212 					 */
6213 					conv_tnc(pp, ttesz);
6214 				} else if (pp->p_mapping == NULL) {
6215 					ASSERT(kpm_enable);
6216 					/*
6217 					 * Page is marked to be in VAC conflict
6218 					 * to an existing kpm mapping and/or is
6219 					 * kpm mapped using only the regular
6220 					 * pagesize.
6221 					 */
6222 					sfmmu_kpm_hme_unload(pp);
6223 				}
6224 			}
6225 #endif	/* VAC */
6226 		} else if ((pp = sfhmep->hme_page) != NULL) {
6227 				/*
6228 				 * TTE is invalid but the hme
6229 				 * still exists. let pageunload
6230 				 * complete its job.
6231 				 */
6232 				ASSERT(pml == NULL);
6233 				pml = sfmmu_mlist_enter(pp);
6234 				if (sfhmep->hme_page != NULL) {
6235 					sfmmu_mlist_exit(pml);
6236 					continue;
6237 				}
6238 				ASSERT(sfhmep->hme_page == NULL);
6239 		} else if (hmeblkp->hblk_hmecnt != 0) {
6240 			/*
6241 			 * pageunload may have not finished decrementing
6242 			 * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6243 			 * wait for pageunload to finish. Rely on pageunload
6244 			 * to decrement hblk_hmecnt after hblk_vcnt.
6245 			 */
6246 			pfn_t pfn = TTE_TO_TTEPFN(&tte);
6247 			ASSERT(pml == NULL);
6248 			if (pf_is_memory(pfn)) {
6249 				pp = page_numtopp_nolock(pfn);
6250 				if (pp != NULL) {
6251 					pml = sfmmu_mlist_enter(pp);
6252 					sfmmu_mlist_exit(pml);
6253 					pml = NULL;
6254 				}
6255 			}
6256 		}
6257 
6258 tte_unloaded:
6259 		/*
6260 		 * At this point, the tte we are looking at
6261 		 * should be unloaded, and hme has been unlinked
6262 		 * from page too. This is important because in
6263 		 * pageunload, it does ttesync() then HME_SUB.
6264 		 * We need to make sure HME_SUB has been completed
6265 		 * so we know ttesync() has been completed. Otherwise,
6266 		 * at exit time, after return from hat layer, VM will
6267 		 * release as structure which hat_setstat() (called
6268 		 * by ttesync()) needs.
6269 		 */
6270 #ifdef DEBUG
6271 		{
6272 			tte_t	dtte;
6273 
6274 			ASSERT(sfhmep->hme_page == NULL);
6275 
6276 			sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6277 			ASSERT(!TTE_IS_VALID(&dtte));
6278 		}
6279 #endif
6280 
6281 		if (pml) {
6282 			sfmmu_mlist_exit(pml);
6283 		}
6284 
6285 		addr += TTEBYTES(ttesz);
6286 		sfhmep++;
6287 		DEMAP_RANGE_NEXTPG(dmrp);
6288 	}
6289 	/*
6290 	 * For shared hmeblks this routine is only called when region is freed
6291 	 * and no longer referenced.  So no need to decrement ttecnt
6292 	 * in the region structure here.
6293 	 */
6294 	if (ttecnt > 0 && sfmmup != NULL) {
6295 		atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6296 	}
6297 	return (addr);
6298 }
6299 
6300 /*
6301  * Invalidate a virtual address range for the local CPU.
6302  * For best performance ensure that the va range is completely
6303  * mapped, otherwise the entire TLB will be flushed.
6304  */
6305 void
6306 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6307 {
6308 	ssize_t sz;
6309 	caddr_t endva = va + size;
6310 
6311 	while (va < endva) {
6312 		sz = hat_getpagesize(sfmmup, va);
6313 		if (sz < 0) {
6314 			vtag_flushall();
6315 			break;
6316 		}
6317 		vtag_flushpage(va, (uint64_t)sfmmup);
6318 		va += sz;
6319 	}
6320 }
6321 
6322 /*
6323  * Synchronize all the mappings in the range [addr..addr+len).
6324  * Can be called with clearflag having two states:
6325  * HAT_SYNC_DONTZERO means just return the rm stats
6326  * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6327  */
6328 void
6329 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6330 {
6331 	struct hmehash_bucket *hmebp;
6332 	hmeblk_tag hblktag;
6333 	int hmeshift, hashno = 1;
6334 	struct hme_blk *hmeblkp, *list = NULL;
6335 	caddr_t endaddr;
6336 	cpuset_t cpuset;
6337 
6338 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
6339 	ASSERT((sfmmup == ksfmmup) ||
6340 	    AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
6341 	ASSERT((len & MMU_PAGEOFFSET) == 0);
6342 	ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6343 	    (clearflag == HAT_SYNC_ZERORM));
6344 
6345 	CPUSET_ZERO(cpuset);
6346 
6347 	endaddr = addr + len;
6348 	hblktag.htag_id = sfmmup;
6349 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6350 
6351 	/*
6352 	 * Spitfire supports 4 page sizes.
6353 	 * Most pages are expected to be of the smallest page
6354 	 * size (8K) and these will not need to be rehashed. 64K
6355 	 * pages also don't need to be rehashed because the an hmeblk
6356 	 * spans 64K of address space. 512K pages might need 1 rehash and
6357 	 * and 4M pages 2 rehashes.
6358 	 */
6359 	while (addr < endaddr) {
6360 		hmeshift = HME_HASH_SHIFT(hashno);
6361 		hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6362 		hblktag.htag_rehash = hashno;
6363 		hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6364 
6365 		SFMMU_HASH_LOCK(hmebp);
6366 
6367 		HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6368 		if (hmeblkp != NULL) {
6369 			ASSERT(!hmeblkp->hblk_shared);
6370 			/*
6371 			 * We've encountered a shadow hmeblk so skip the range
6372 			 * of the next smaller mapping size.
6373 			 */
6374 			if (hmeblkp->hblk_shw_bit) {
6375 				ASSERT(sfmmup != ksfmmup);
6376 				ASSERT(hashno > 1);
6377 				addr = (caddr_t)P2END((uintptr_t)addr,
6378 				    TTEBYTES(hashno - 1));
6379 			} else {
6380 				addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6381 				    addr, endaddr, clearflag);
6382 			}
6383 			SFMMU_HASH_UNLOCK(hmebp);
6384 			hashno = 1;
6385 			continue;
6386 		}
6387 		SFMMU_HASH_UNLOCK(hmebp);
6388 
6389 		if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6390 			/*
6391 			 * We have traversed the whole list and rehashed
6392 			 * if necessary without finding the address to sync.
6393 			 * This is ok so we increment the address by the
6394 			 * smallest hmeblk range for kernel mappings and the
6395 			 * largest hmeblk range, to account for shadow hmeblks,
6396 			 * for user mappings and continue.
6397 			 */
6398 			if (sfmmup == ksfmmup)
6399 				addr = (caddr_t)P2END((uintptr_t)addr,
6400 				    TTEBYTES(1));
6401 			else
6402 				addr = (caddr_t)P2END((uintptr_t)addr,
6403 				    TTEBYTES(hashno));
6404 			hashno = 1;
6405 		} else {
6406 			hashno++;
6407 		}
6408 	}
6409 	sfmmu_hblks_list_purge(&list, 0);
6410 	cpuset = sfmmup->sfmmu_cpusran;
6411 	xt_sync(cpuset);
6412 }
6413 
6414 static caddr_t
6415 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6416 	caddr_t endaddr, int clearflag)
6417 {
6418 	tte_t	tte, ttemod;
6419 	struct sf_hment *sfhmep;
6420 	int ttesz;
6421 	struct page *pp;
6422 	kmutex_t *pml;
6423 	int ret;
6424 
6425 	ASSERT(hmeblkp->hblk_shw_bit == 0);
6426 	ASSERT(!hmeblkp->hblk_shared);
6427 
6428 	endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6429 
6430 	ttesz = get_hblk_ttesz(hmeblkp);
6431 	HBLKTOHME(sfhmep, hmeblkp, addr);
6432 
6433 	while (addr < endaddr) {
6434 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
6435 		if (TTE_IS_VALID(&tte)) {
6436 			pml = NULL;
6437 			pp = sfhmep->hme_page;
6438 			if (pp) {
6439 				pml = sfmmu_mlist_enter(pp);
6440 			}
6441 			if (pp != sfhmep->hme_page) {
6442 				/*
6443 				 * tte most have been unloaded
6444 				 * underneath us.  Recheck
6445 				 */
6446 				ASSERT(pml);
6447 				sfmmu_mlist_exit(pml);
6448 				continue;
6449 			}
6450 
6451 			ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6452 
6453 			if (clearflag == HAT_SYNC_ZERORM) {
6454 				ttemod = tte;
6455 				TTE_CLR_RM(&ttemod);
6456 				ret = sfmmu_modifytte_try(&tte, &ttemod,
6457 				    &sfhmep->hme_tte);
6458 				if (ret < 0) {
6459 					if (pml) {
6460 						sfmmu_mlist_exit(pml);
6461 					}
6462 					continue;
6463 				}
6464 
6465 				if (ret > 0) {
6466 					sfmmu_tlb_demap(addr, sfmmup,
6467 					    hmeblkp, 0, 0);
6468 				}
6469 			}
6470 			sfmmu_ttesync(sfmmup, addr, &tte, pp);
6471 			if (pml) {
6472 				sfmmu_mlist_exit(pml);
6473 			}
6474 		}
6475 		addr += TTEBYTES(ttesz);
6476 		sfhmep++;
6477 	}
6478 	return (addr);
6479 }
6480 
6481 /*
6482  * This function will sync a tte to the page struct and it will
6483  * update the hat stats. Currently it allows us to pass a NULL pp
6484  * and we will simply update the stats.  We may want to change this
6485  * so we only keep stats for pages backed by pp's.
6486  */
6487 static void
6488 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6489 {
6490 	uint_t rm = 0;
6491 	int   	sz;
6492 	pgcnt_t	npgs;
6493 
6494 	ASSERT(TTE_IS_VALID(ttep));
6495 
6496 	if (TTE_IS_NOSYNC(ttep)) {
6497 		return;
6498 	}
6499 
6500 	if (TTE_IS_REF(ttep))  {
6501 		rm = P_REF;
6502 	}
6503 	if (TTE_IS_MOD(ttep))  {
6504 		rm |= P_MOD;
6505 	}
6506 
6507 	if (rm == 0) {
6508 		return;
6509 	}
6510 
6511 	sz = TTE_CSZ(ttep);
6512 	if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6513 		int i;
6514 		caddr_t	vaddr = addr;
6515 
6516 		for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6517 			hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6518 		}
6519 
6520 	}
6521 
6522 	/*
6523 	 * XXX I want to use cas to update nrm bits but they
6524 	 * currently belong in common/vm and not in hat where
6525 	 * they should be.
6526 	 * The nrm bits are protected by the same mutex as
6527 	 * the one that protects the page's mapping list.
6528 	 */
6529 	if (!pp)
6530 		return;
6531 	ASSERT(sfmmu_mlist_held(pp));
6532 	/*
6533 	 * If the tte is for a large page, we need to sync all the
6534 	 * pages covered by the tte.
6535 	 */
6536 	if (sz != TTE8K) {
6537 		ASSERT(pp->p_szc != 0);
6538 		pp = PP_GROUPLEADER(pp, sz);
6539 		ASSERT(sfmmu_mlist_held(pp));
6540 	}
6541 
6542 	/* Get number of pages from tte size. */
6543 	npgs = TTEPAGES(sz);
6544 
6545 	do {
6546 		ASSERT(pp);
6547 		ASSERT(sfmmu_mlist_held(pp));
6548 		if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6549 		    ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6550 			hat_page_setattr(pp, rm);
6551 
6552 		/*
6553 		 * Are we done? If not, we must have a large mapping.
6554 		 * For large mappings we need to sync the rest of the pages
6555 		 * covered by this tte; goto the next page.
6556 		 */
6557 	} while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6558 }
6559 
6560 /*
6561  * Execute pre-callback handler of each pa_hment linked to pp
6562  *
6563  * Inputs:
6564  *   flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6565  *   capture_cpus: pointer to return value (below)
6566  *
6567  * Returns:
6568  *   Propagates the subsystem callback return values back to the caller;
6569  *   returns 0 on success.  If capture_cpus is non-NULL, the value returned
6570  *   is zero if all of the pa_hments are of a type that do not require
6571  *   capturing CPUs prior to suspending the mapping, else it is 1.
6572  */
6573 static int
6574 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6575 {
6576 	struct sf_hment	*sfhmep;
6577 	struct pa_hment *pahmep;
6578 	int (*f)(caddr_t, uint_t, uint_t, void *);
6579 	int		ret;
6580 	id_t		id;
6581 	int		locked = 0;
6582 	kmutex_t	*pml;
6583 
6584 	ASSERT(PAGE_EXCL(pp));
6585 	if (!sfmmu_mlist_held(pp)) {
6586 		pml = sfmmu_mlist_enter(pp);
6587 		locked = 1;
6588 	}
6589 
6590 	if (capture_cpus)
6591 		*capture_cpus = 0;
6592 
6593 top:
6594 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6595 		/*
6596 		 * skip sf_hments corresponding to VA<->PA mappings;
6597 		 * for pa_hment's, hme_tte.ll is zero
6598 		 */
6599 		if (!IS_PAHME(sfhmep))
6600 			continue;
6601 
6602 		pahmep = sfhmep->hme_data;
6603 		ASSERT(pahmep != NULL);
6604 
6605 		/*
6606 		 * skip if pre-handler has been called earlier in this loop
6607 		 */
6608 		if (pahmep->flags & flag)
6609 			continue;
6610 
6611 		id = pahmep->cb_id;
6612 		ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6613 		if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6614 			*capture_cpus = 1;
6615 		if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6616 			pahmep->flags |= flag;
6617 			continue;
6618 		}
6619 
6620 		/*
6621 		 * Drop the mapping list lock to avoid locking order issues.
6622 		 */
6623 		if (locked)
6624 			sfmmu_mlist_exit(pml);
6625 
6626 		ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6627 		if (ret != 0)
6628 			return (ret);	/* caller must do the cleanup */
6629 
6630 		if (locked) {
6631 			pml = sfmmu_mlist_enter(pp);
6632 			pahmep->flags |= flag;
6633 			goto top;
6634 		}
6635 
6636 		pahmep->flags |= flag;
6637 	}
6638 
6639 	if (locked)
6640 		sfmmu_mlist_exit(pml);
6641 
6642 	return (0);
6643 }
6644 
6645 /*
6646  * Execute post-callback handler of each pa_hment linked to pp
6647  *
6648  * Same overall assumptions and restrictions apply as for
6649  * hat_pageprocess_precallbacks().
6650  */
6651 static void
6652 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6653 {
6654 	pfn_t pgpfn = pp->p_pagenum;
6655 	pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6656 	pfn_t newpfn;
6657 	struct sf_hment *sfhmep;
6658 	struct pa_hment *pahmep;
6659 	int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6660 	id_t	id;
6661 	int	locked = 0;
6662 	kmutex_t *pml;
6663 
6664 	ASSERT(PAGE_EXCL(pp));
6665 	if (!sfmmu_mlist_held(pp)) {
6666 		pml = sfmmu_mlist_enter(pp);
6667 		locked = 1;
6668 	}
6669 
6670 top:
6671 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6672 		/*
6673 		 * skip sf_hments corresponding to VA<->PA mappings;
6674 		 * for pa_hment's, hme_tte.ll is zero
6675 		 */
6676 		if (!IS_PAHME(sfhmep))
6677 			continue;
6678 
6679 		pahmep = sfhmep->hme_data;
6680 		ASSERT(pahmep != NULL);
6681 
6682 		if ((pahmep->flags & flag) == 0)
6683 			continue;
6684 
6685 		pahmep->flags &= ~flag;
6686 
6687 		id = pahmep->cb_id;
6688 		ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6689 		if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6690 			continue;
6691 
6692 		/*
6693 		 * Convert the base page PFN into the constituent PFN
6694 		 * which is needed by the callback handler.
6695 		 */
6696 		newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6697 
6698 		/*
6699 		 * Drop the mapping list lock to avoid locking order issues.
6700 		 */
6701 		if (locked)
6702 			sfmmu_mlist_exit(pml);
6703 
6704 		if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6705 		    != 0)
6706 			panic("sfmmu: posthandler failed");
6707 
6708 		if (locked) {
6709 			pml = sfmmu_mlist_enter(pp);
6710 			goto top;
6711 		}
6712 	}
6713 
6714 	if (locked)
6715 		sfmmu_mlist_exit(pml);
6716 }
6717 
6718 /*
6719  * Suspend locked kernel mapping
6720  */
6721 void
6722 hat_pagesuspend(struct page *pp)
6723 {
6724 	struct sf_hment *sfhmep;
6725 	sfmmu_t *sfmmup;
6726 	tte_t tte, ttemod;
6727 	struct hme_blk *hmeblkp;
6728 	caddr_t addr;
6729 	int index, cons;
6730 	cpuset_t cpuset;
6731 
6732 	ASSERT(PAGE_EXCL(pp));
6733 	ASSERT(sfmmu_mlist_held(pp));
6734 
6735 	mutex_enter(&kpr_suspendlock);
6736 
6737 	/*
6738 	 * We're about to suspend a kernel mapping so mark this thread as
6739 	 * non-traceable by DTrace. This prevents us from running into issues
6740 	 * with probe context trying to touch a suspended page
6741 	 * in the relocation codepath itself.
6742 	 */
6743 	curthread->t_flag |= T_DONTDTRACE;
6744 
6745 	index = PP_MAPINDEX(pp);
6746 	cons = TTE8K;
6747 
6748 retry:
6749 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6750 
6751 		if (IS_PAHME(sfhmep))
6752 			continue;
6753 
6754 		if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6755 			continue;
6756 
6757 		/*
6758 		 * Loop until we successfully set the suspend bit in
6759 		 * the TTE.
6760 		 */
6761 again:
6762 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
6763 		ASSERT(TTE_IS_VALID(&tte));
6764 
6765 		ttemod = tte;
6766 		TTE_SET_SUSPEND(&ttemod);
6767 		if (sfmmu_modifytte_try(&tte, &ttemod,
6768 		    &sfhmep->hme_tte) < 0)
6769 			goto again;
6770 
6771 		/*
6772 		 * Invalidate TSB entry
6773 		 */
6774 		hmeblkp = sfmmu_hmetohblk(sfhmep);
6775 
6776 		sfmmup = hblktosfmmu(hmeblkp);
6777 		ASSERT(sfmmup == ksfmmup);
6778 		ASSERT(!hmeblkp->hblk_shared);
6779 
6780 		addr = tte_to_vaddr(hmeblkp, tte);
6781 
6782 		/*
6783 		 * No need to make sure that the TSB for this sfmmu is
6784 		 * not being relocated since it is ksfmmup and thus it
6785 		 * will never be relocated.
6786 		 */
6787 		SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6788 
6789 		/*
6790 		 * Update xcall stats
6791 		 */
6792 		cpuset = cpu_ready_set;
6793 		CPUSET_DEL(cpuset, CPU->cpu_id);
6794 
6795 		/* LINTED: constant in conditional context */
6796 		SFMMU_XCALL_STATS(ksfmmup);
6797 
6798 		/*
6799 		 * Flush TLB entry on remote CPU's
6800 		 */
6801 		xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6802 		    (uint64_t)ksfmmup);
6803 		xt_sync(cpuset);
6804 
6805 		/*
6806 		 * Flush TLB entry on local CPU
6807 		 */
6808 		vtag_flushpage(addr, (uint64_t)ksfmmup);
6809 	}
6810 
6811 	while (index != 0) {
6812 		index = index >> 1;
6813 		if (index != 0)
6814 			cons++;
6815 		if (index & 0x1) {
6816 			pp = PP_GROUPLEADER(pp, cons);
6817 			goto retry;
6818 		}
6819 	}
6820 }
6821 
6822 #ifdef	DEBUG
6823 
6824 #define	N_PRLE	1024
6825 struct prle {
6826 	page_t *targ;
6827 	page_t *repl;
6828 	int status;
6829 	int pausecpus;
6830 	hrtime_t whence;
6831 };
6832 
6833 static struct prle page_relocate_log[N_PRLE];
6834 static int prl_entry;
6835 static kmutex_t prl_mutex;
6836 
6837 #define	PAGE_RELOCATE_LOG(t, r, s, p)					\
6838 	mutex_enter(&prl_mutex);					\
6839 	page_relocate_log[prl_entry].targ = *(t);			\
6840 	page_relocate_log[prl_entry].repl = *(r);			\
6841 	page_relocate_log[prl_entry].status = (s);			\
6842 	page_relocate_log[prl_entry].pausecpus = (p);			\
6843 	page_relocate_log[prl_entry].whence = gethrtime();		\
6844 	prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1;	\
6845 	mutex_exit(&prl_mutex);
6846 
6847 #else	/* !DEBUG */
6848 #define	PAGE_RELOCATE_LOG(t, r, s, p)
6849 #endif
6850 
6851 /*
6852  * Core Kernel Page Relocation Algorithm
6853  *
6854  * Input:
6855  *
6856  * target : 	constituent pages are SE_EXCL locked.
6857  * replacement:	constituent pages are SE_EXCL locked.
6858  *
6859  * Output:
6860  *
6861  * nrelocp:	number of pages relocated
6862  */
6863 int
6864 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6865 {
6866 	page_t		*targ, *repl;
6867 	page_t		*tpp, *rpp;
6868 	kmutex_t	*low, *high;
6869 	spgcnt_t	npages, i;
6870 	page_t		*pl = NULL;
6871 	int		old_pil;
6872 	cpuset_t	cpuset;
6873 	int		cap_cpus;
6874 	int		ret;
6875 #ifdef VAC
6876 	int		cflags = 0;
6877 #endif
6878 
6879 	if (hat_kpr_enabled == 0 || !kcage_on || PP_ISNORELOC(*target)) {
6880 		PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6881 		return (EAGAIN);
6882 	}
6883 
6884 	mutex_enter(&kpr_mutex);
6885 	kreloc_thread = curthread;
6886 
6887 	targ = *target;
6888 	repl = *replacement;
6889 	ASSERT(repl != NULL);
6890 	ASSERT(targ->p_szc == repl->p_szc);
6891 
6892 	npages = page_get_pagecnt(targ->p_szc);
6893 
6894 	/*
6895 	 * unload VA<->PA mappings that are not locked
6896 	 */
6897 	tpp = targ;
6898 	for (i = 0; i < npages; i++) {
6899 		(void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6900 		tpp++;
6901 	}
6902 
6903 	/*
6904 	 * Do "presuspend" callbacks, in a context from which we can still
6905 	 * block as needed. Note that we don't hold the mapping list lock
6906 	 * of "targ" at this point due to potential locking order issues;
6907 	 * we assume that between the hat_pageunload() above and holding
6908 	 * the SE_EXCL lock that the mapping list *cannot* change at this
6909 	 * point.
6910 	 */
6911 	ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6912 	if (ret != 0) {
6913 		/*
6914 		 * EIO translates to fatal error, for all others cleanup
6915 		 * and return EAGAIN.
6916 		 */
6917 		ASSERT(ret != EIO);
6918 		hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6919 		PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6920 		kreloc_thread = NULL;
6921 		mutex_exit(&kpr_mutex);
6922 		return (EAGAIN);
6923 	}
6924 
6925 	/*
6926 	 * acquire p_mapping list lock for both the target and replacement
6927 	 * root pages.
6928 	 *
6929 	 * low and high refer to the need to grab the mlist locks in a
6930 	 * specific order in order to prevent race conditions.  Thus the
6931 	 * lower lock must be grabbed before the higher lock.
6932 	 *
6933 	 * This will block hat_unload's accessing p_mapping list.  Since
6934 	 * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6935 	 * blocked.  Thus, no one else will be accessing the p_mapping list
6936 	 * while we suspend and reload the locked mapping below.
6937 	 */
6938 	tpp = targ;
6939 	rpp = repl;
6940 	sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6941 
6942 	kpreempt_disable();
6943 
6944 	/*
6945 	 * We raise our PIL to 13 so that we don't get captured by
6946 	 * another CPU or pinned by an interrupt thread.  We can't go to
6947 	 * PIL 14 since the nexus driver(s) may need to interrupt at
6948 	 * that level in the case of IOMMU pseudo mappings.
6949 	 */
6950 	cpuset = cpu_ready_set;
6951 	CPUSET_DEL(cpuset, CPU->cpu_id);
6952 	if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6953 		old_pil = splr(XCALL_PIL);
6954 	} else {
6955 		old_pil = -1;
6956 		xc_attention(cpuset);
6957 	}
6958 	ASSERT(getpil() == XCALL_PIL);
6959 
6960 	/*
6961 	 * Now do suspend callbacks. In the case of an IOMMU mapping
6962 	 * this will suspend all DMA activity to the page while it is
6963 	 * being relocated. Since we are well above LOCK_LEVEL and CPUs
6964 	 * may be captured at this point we should have acquired any needed
6965 	 * locks in the presuspend callback.
6966 	 */
6967 	ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6968 	if (ret != 0) {
6969 		repl = targ;
6970 		goto suspend_fail;
6971 	}
6972 
6973 	/*
6974 	 * Raise the PIL yet again, this time to block all high-level
6975 	 * interrupts on this CPU. This is necessary to prevent an
6976 	 * interrupt routine from pinning the thread which holds the
6977 	 * mapping suspended and then touching the suspended page.
6978 	 *
6979 	 * Once the page is suspended we also need to be careful to
6980 	 * avoid calling any functions which touch any seg_kmem memory
6981 	 * since that memory may be backed by the very page we are
6982 	 * relocating in here!
6983 	 */
6984 	hat_pagesuspend(targ);
6985 
6986 	/*
6987 	 * Now that we are confident everybody has stopped using this page,
6988 	 * copy the page contents.  Note we use a physical copy to prevent
6989 	 * locking issues and to avoid fpRAS because we can't handle it in
6990 	 * this context.
6991 	 */
6992 	for (i = 0; i < npages; i++, tpp++, rpp++) {
6993 #ifdef VAC
6994 		/*
6995 		 * If the replacement has a different vcolor than
6996 		 * the one being replacd, we need to handle VAC
6997 		 * consistency for it just as we were setting up
6998 		 * a new mapping to it.
6999 		 */
7000 		if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
7001 		    (tpp->p_vcolor != rpp->p_vcolor) &&
7002 		    !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
7003 			CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
7004 			sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
7005 			    rpp->p_pagenum);
7006 		}
7007 #endif
7008 		/*
7009 		 * Copy the contents of the page.
7010 		 */
7011 		ppcopy_kernel(tpp, rpp);
7012 	}
7013 
7014 	tpp = targ;
7015 	rpp = repl;
7016 	for (i = 0; i < npages; i++, tpp++, rpp++) {
7017 		/*
7018 		 * Copy attributes.  VAC consistency was handled above,
7019 		 * if required.
7020 		 */
7021 		rpp->p_nrm = tpp->p_nrm;
7022 		tpp->p_nrm = 0;
7023 		rpp->p_index = tpp->p_index;
7024 		tpp->p_index = 0;
7025 #ifdef VAC
7026 		rpp->p_vcolor = tpp->p_vcolor;
7027 #endif
7028 	}
7029 
7030 	/*
7031 	 * First, unsuspend the page, if we set the suspend bit, and transfer
7032 	 * the mapping list from the target page to the replacement page.
7033 	 * Next process postcallbacks; since pa_hment's are linked only to the
7034 	 * p_mapping list of root page, we don't iterate over the constituent
7035 	 * pages.
7036 	 */
7037 	hat_pagereload(targ, repl);
7038 
7039 suspend_fail:
7040 	hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
7041 
7042 	/*
7043 	 * Now lower our PIL and release any captured CPUs since we
7044 	 * are out of the "danger zone".  After this it will again be
7045 	 * safe to acquire adaptive mutex locks, or to drop them...
7046 	 */
7047 	if (old_pil != -1) {
7048 		splx(old_pil);
7049 	} else {
7050 		xc_dismissed(cpuset);
7051 	}
7052 
7053 	kpreempt_enable();
7054 
7055 	sfmmu_mlist_reloc_exit(low, high);
7056 
7057 	/*
7058 	 * Postsuspend callbacks should drop any locks held across
7059 	 * the suspend callbacks.  As before, we don't hold the mapping
7060 	 * list lock at this point.. our assumption is that the mapping
7061 	 * list still can't change due to our holding SE_EXCL lock and
7062 	 * there being no unlocked mappings left. Hence the restriction
7063 	 * on calling context to hat_delete_callback()
7064 	 */
7065 	hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
7066 	if (ret != 0) {
7067 		/*
7068 		 * The second presuspend call failed: we got here through
7069 		 * the suspend_fail label above.
7070 		 */
7071 		ASSERT(ret != EIO);
7072 		PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
7073 		kreloc_thread = NULL;
7074 		mutex_exit(&kpr_mutex);
7075 		return (EAGAIN);
7076 	}
7077 
7078 	/*
7079 	 * Now that we're out of the performance critical section we can
7080 	 * take care of updating the hash table, since we still
7081 	 * hold all the pages locked SE_EXCL at this point we
7082 	 * needn't worry about things changing out from under us.
7083 	 */
7084 	tpp = targ;
7085 	rpp = repl;
7086 	for (i = 0; i < npages; i++, tpp++, rpp++) {
7087 
7088 		/*
7089 		 * replace targ with replacement in page_hash table
7090 		 */
7091 		targ = tpp;
7092 		page_relocate_hash(rpp, targ);
7093 
7094 		/*
7095 		 * concatenate target; caller of platform_page_relocate()
7096 		 * expects target to be concatenated after returning.
7097 		 */
7098 		ASSERT(targ->p_next == targ);
7099 		ASSERT(targ->p_prev == targ);
7100 		page_list_concat(&pl, &targ);
7101 	}
7102 
7103 	ASSERT(*target == pl);
7104 	*nrelocp = npages;
7105 	PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
7106 	kreloc_thread = NULL;
7107 	mutex_exit(&kpr_mutex);
7108 	return (0);
7109 }
7110 
7111 /*
7112  * Called when stray pa_hments are found attached to a page which is
7113  * being freed.  Notify the subsystem which attached the pa_hment of
7114  * the error if it registered a suitable handler, else panic.
7115  */
7116 static void
7117 sfmmu_pahment_leaked(struct pa_hment *pahmep)
7118 {
7119 	id_t cb_id = pahmep->cb_id;
7120 
7121 	ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
7122 	if (sfmmu_cb_table[cb_id].errhandler != NULL) {
7123 		if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7124 		    HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7125 			return;		/* non-fatal */
7126 	}
7127 	panic("pa_hment leaked: 0x%p", (void *)pahmep);
7128 }
7129 
7130 /*
7131  * Remove all mappings to page 'pp'.
7132  */
7133 int
7134 hat_pageunload(struct page *pp, uint_t forceflag)
7135 {
7136 	struct page *origpp = pp;
7137 	struct sf_hment *sfhme, *tmphme;
7138 	struct hme_blk *hmeblkp;
7139 	kmutex_t *pml;
7140 #ifdef VAC
7141 	kmutex_t *pmtx;
7142 #endif
7143 	cpuset_t cpuset, tset;
7144 	int index, cons;
7145 	int xhme_blks;
7146 	int pa_hments;
7147 
7148 	ASSERT(PAGE_EXCL(pp));
7149 
7150 retry_xhat:
7151 	tmphme = NULL;
7152 	xhme_blks = 0;
7153 	pa_hments = 0;
7154 	CPUSET_ZERO(cpuset);
7155 
7156 	pml = sfmmu_mlist_enter(pp);
7157 
7158 #ifdef VAC
7159 	if (pp->p_kpmref)
7160 		sfmmu_kpm_pageunload(pp);
7161 	ASSERT(!PP_ISMAPPED_KPM(pp));
7162 #endif
7163 	/*
7164 	 * Clear vpm reference. Since the page is exclusively locked
7165 	 * vpm cannot be referencing it.
7166 	 */
7167 	if (vpm_enable) {
7168 		pp->p_vpmref = 0;
7169 	}
7170 
7171 	index = PP_MAPINDEX(pp);
7172 	cons = TTE8K;
7173 retry:
7174 	for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7175 		tmphme = sfhme->hme_next;
7176 
7177 		if (IS_PAHME(sfhme)) {
7178 			ASSERT(sfhme->hme_data != NULL);
7179 			pa_hments++;
7180 			continue;
7181 		}
7182 
7183 		hmeblkp = sfmmu_hmetohblk(sfhme);
7184 		if (hmeblkp->hblk_xhat_bit) {
7185 			struct xhat_hme_blk *xblk =
7186 			    (struct xhat_hme_blk *)hmeblkp;
7187 
7188 			(void) XHAT_PAGEUNLOAD(xblk->xhat_hme_blk_hat,
7189 			    pp, forceflag, XBLK2PROVBLK(xblk));
7190 
7191 			xhme_blks = 1;
7192 			continue;
7193 		}
7194 
7195 		/*
7196 		 * If there are kernel mappings don't unload them, they will
7197 		 * be suspended.
7198 		 */
7199 		if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7200 		    hmeblkp->hblk_tag.htag_id == ksfmmup)
7201 			continue;
7202 
7203 		tset = sfmmu_pageunload(pp, sfhme, cons);
7204 		CPUSET_OR(cpuset, tset);
7205 	}
7206 
7207 	while (index != 0) {
7208 		index = index >> 1;
7209 		if (index != 0)
7210 			cons++;
7211 		if (index & 0x1) {
7212 			/* Go to leading page */
7213 			pp = PP_GROUPLEADER(pp, cons);
7214 			ASSERT(sfmmu_mlist_held(pp));
7215 			goto retry;
7216 		}
7217 	}
7218 
7219 	/*
7220 	 * cpuset may be empty if the page was only mapped by segkpm,
7221 	 * in which case we won't actually cross-trap.
7222 	 */
7223 	xt_sync(cpuset);
7224 
7225 	/*
7226 	 * The page should have no mappings at this point, unless
7227 	 * we were called from hat_page_relocate() in which case we
7228 	 * leave the locked mappings which will be suspended later.
7229 	 */
7230 	ASSERT(!PP_ISMAPPED(origpp) || xhme_blks || pa_hments ||
7231 	    (forceflag == SFMMU_KERNEL_RELOC));
7232 
7233 #ifdef VAC
7234 	if (PP_ISTNC(pp)) {
7235 		if (cons == TTE8K) {
7236 			pmtx = sfmmu_page_enter(pp);
7237 			PP_CLRTNC(pp);
7238 			sfmmu_page_exit(pmtx);
7239 		} else {
7240 			conv_tnc(pp, cons);
7241 		}
7242 	}
7243 #endif	/* VAC */
7244 
7245 	if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7246 		/*
7247 		 * Unlink any pa_hments and free them, calling back
7248 		 * the responsible subsystem to notify it of the error.
7249 		 * This can occur in situations such as drivers leaking
7250 		 * DMA handles: naughty, but common enough that we'd like
7251 		 * to keep the system running rather than bringing it
7252 		 * down with an obscure error like "pa_hment leaked"
7253 		 * which doesn't aid the user in debugging their driver.
7254 		 */
7255 		for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7256 			tmphme = sfhme->hme_next;
7257 			if (IS_PAHME(sfhme)) {
7258 				struct pa_hment *pahmep = sfhme->hme_data;
7259 				sfmmu_pahment_leaked(pahmep);
7260 				HME_SUB(sfhme, pp);
7261 				kmem_cache_free(pa_hment_cache, pahmep);
7262 			}
7263 		}
7264 
7265 		ASSERT(!PP_ISMAPPED(origpp) || xhme_blks);
7266 	}
7267 
7268 	sfmmu_mlist_exit(pml);
7269 
7270 	/*
7271 	 * XHAT may not have finished unloading pages
7272 	 * because some other thread was waiting for
7273 	 * mlist lock and XHAT_PAGEUNLOAD let it do
7274 	 * the job.
7275 	 */
7276 	if (xhme_blks) {
7277 		pp = origpp;
7278 		goto retry_xhat;
7279 	}
7280 
7281 	return (0);
7282 }
7283 
7284 cpuset_t
7285 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7286 {
7287 	struct hme_blk *hmeblkp;
7288 	sfmmu_t *sfmmup;
7289 	tte_t tte, ttemod;
7290 #ifdef DEBUG
7291 	tte_t orig_old;
7292 #endif /* DEBUG */
7293 	caddr_t addr;
7294 	int ttesz;
7295 	int ret;
7296 	cpuset_t cpuset;
7297 
7298 	ASSERT(pp != NULL);
7299 	ASSERT(sfmmu_mlist_held(pp));
7300 	ASSERT(!PP_ISKAS(pp));
7301 
7302 	CPUSET_ZERO(cpuset);
7303 
7304 	hmeblkp = sfmmu_hmetohblk(sfhme);
7305 
7306 readtte:
7307 	sfmmu_copytte(&sfhme->hme_tte, &tte);
7308 	if (TTE_IS_VALID(&tte)) {
7309 		sfmmup = hblktosfmmu(hmeblkp);
7310 		ttesz = get_hblk_ttesz(hmeblkp);
7311 		/*
7312 		 * Only unload mappings of 'cons' size.
7313 		 */
7314 		if (ttesz != cons)
7315 			return (cpuset);
7316 
7317 		/*
7318 		 * Note that we have p_mapping lock, but no hash lock here.
7319 		 * hblk_unload() has to have both hash lock AND p_mapping
7320 		 * lock before it tries to modify tte. So, the tte could
7321 		 * not become invalid in the sfmmu_modifytte_try() below.
7322 		 */
7323 		ttemod = tte;
7324 #ifdef DEBUG
7325 		orig_old = tte;
7326 #endif /* DEBUG */
7327 
7328 		TTE_SET_INVALID(&ttemod);
7329 		ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7330 		if (ret < 0) {
7331 #ifdef DEBUG
7332 			/* only R/M bits can change. */
7333 			chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7334 #endif /* DEBUG */
7335 			goto readtte;
7336 		}
7337 
7338 		if (ret == 0) {
7339 			panic("pageunload: cas failed?");
7340 		}
7341 
7342 		addr = tte_to_vaddr(hmeblkp, tte);
7343 
7344 		if (hmeblkp->hblk_shared) {
7345 			sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7346 			uint_t rid = hmeblkp->hblk_tag.htag_rid;
7347 			sf_region_t *rgnp;
7348 			ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7349 			ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7350 			ASSERT(srdp != NULL);
7351 			rgnp = srdp->srd_hmergnp[rid];
7352 			SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7353 			cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7354 			sfmmu_ttesync(NULL, addr, &tte, pp);
7355 			ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7356 			atomic_add_long(&rgnp->rgn_ttecnt[ttesz], -1);
7357 		} else {
7358 			sfmmu_ttesync(sfmmup, addr, &tte, pp);
7359 			atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -1);
7360 
7361 			/*
7362 			 * We need to flush the page from the virtual cache
7363 			 * in order to prevent a virtual cache alias
7364 			 * inconsistency. The particular scenario we need
7365 			 * to worry about is:
7366 			 * Given:  va1 and va2 are two virtual address that
7367 			 * alias and will map the same physical address.
7368 			 * 1.   mapping exists from va1 to pa and data has
7369 			 *	been read into the cache.
7370 			 * 2.   unload va1.
7371 			 * 3.   load va2 and modify data using va2.
7372 			 * 4    unload va2.
7373 			 * 5.   load va1 and reference data.  Unless we flush
7374 			 *	the data cache when we unload we will get
7375 			 *	stale data.
7376 			 * This scenario is taken care of by using virtual
7377 			 * page coloring.
7378 			 */
7379 			if (sfmmup->sfmmu_ismhat) {
7380 				/*
7381 				 * Flush TSBs, TLBs and caches
7382 				 * of every process
7383 				 * sharing this ism segment.
7384 				 */
7385 				sfmmu_hat_lock_all();
7386 				mutex_enter(&ism_mlist_lock);
7387 				kpreempt_disable();
7388 				sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7389 				    pp->p_pagenum, CACHE_NO_FLUSH);
7390 				kpreempt_enable();
7391 				mutex_exit(&ism_mlist_lock);
7392 				sfmmu_hat_unlock_all();
7393 				cpuset = cpu_ready_set;
7394 			} else {
7395 				sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7396 				cpuset = sfmmup->sfmmu_cpusran;
7397 			}
7398 		}
7399 
7400 		/*
7401 		 * Hme_sub has to run after ttesync() and a_rss update.
7402 		 * See hblk_unload().
7403 		 */
7404 		HME_SUB(sfhme, pp);
7405 		membar_stst();
7406 
7407 		/*
7408 		 * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7409 		 * since pteload may have done a HME_ADD() right after
7410 		 * we did the HME_SUB() above. Hmecnt is now maintained
7411 		 * by cas only. no lock guranteed its value. The only
7412 		 * gurantee we have is the hmecnt should not be less than
7413 		 * what it should be so the hblk will not be taken away.
7414 		 * It's also important that we decremented the hmecnt after
7415 		 * we are done with hmeblkp so that this hmeblk won't be
7416 		 * stolen.
7417 		 */
7418 		ASSERT(hmeblkp->hblk_hmecnt > 0);
7419 		ASSERT(hmeblkp->hblk_vcnt > 0);
7420 		atomic_add_16(&hmeblkp->hblk_vcnt, -1);
7421 		atomic_add_16(&hmeblkp->hblk_hmecnt, -1);
7422 		/*
7423 		 * This is bug 4063182.
7424 		 * XXX: fixme
7425 		 * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7426 		 *	!hmeblkp->hblk_lckcnt);
7427 		 */
7428 	} else {
7429 		panic("invalid tte? pp %p &tte %p",
7430 		    (void *)pp, (void *)&tte);
7431 	}
7432 
7433 	return (cpuset);
7434 }
7435 
7436 /*
7437  * While relocating a kernel page, this function will move the mappings
7438  * from tpp to dpp and modify any associated data with these mappings.
7439  * It also unsuspends the suspended kernel mapping.
7440  */
7441 static void
7442 hat_pagereload(struct page *tpp, struct page *dpp)
7443 {
7444 	struct sf_hment *sfhme;
7445 	tte_t tte, ttemod;
7446 	int index, cons;
7447 
7448 	ASSERT(getpil() == PIL_MAX);
7449 	ASSERT(sfmmu_mlist_held(tpp));
7450 	ASSERT(sfmmu_mlist_held(dpp));
7451 
7452 	index = PP_MAPINDEX(tpp);
7453 	cons = TTE8K;
7454 
7455 	/* Update real mappings to the page */
7456 retry:
7457 	for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7458 		if (IS_PAHME(sfhme))
7459 			continue;
7460 		sfmmu_copytte(&sfhme->hme_tte, &tte);
7461 		ttemod = tte;
7462 
7463 		/*
7464 		 * replace old pfn with new pfn in TTE
7465 		 */
7466 		PFN_TO_TTE(ttemod, dpp->p_pagenum);
7467 
7468 		/*
7469 		 * clear suspend bit
7470 		 */
7471 		ASSERT(TTE_IS_SUSPEND(&ttemod));
7472 		TTE_CLR_SUSPEND(&ttemod);
7473 
7474 		if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7475 			panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7476 
7477 		/*
7478 		 * set hme_page point to new page
7479 		 */
7480 		sfhme->hme_page = dpp;
7481 	}
7482 
7483 	/*
7484 	 * move p_mapping list from old page to new page
7485 	 */
7486 	dpp->p_mapping = tpp->p_mapping;
7487 	tpp->p_mapping = NULL;
7488 	dpp->p_share = tpp->p_share;
7489 	tpp->p_share = 0;
7490 
7491 	while (index != 0) {
7492 		index = index >> 1;
7493 		if (index != 0)
7494 			cons++;
7495 		if (index & 0x1) {
7496 			tpp = PP_GROUPLEADER(tpp, cons);
7497 			dpp = PP_GROUPLEADER(dpp, cons);
7498 			goto retry;
7499 		}
7500 	}
7501 
7502 	curthread->t_flag &= ~T_DONTDTRACE;
7503 	mutex_exit(&kpr_suspendlock);
7504 }
7505 
7506 uint_t
7507 hat_pagesync(struct page *pp, uint_t clearflag)
7508 {
7509 	struct sf_hment *sfhme, *tmphme = NULL;
7510 	struct hme_blk *hmeblkp;
7511 	kmutex_t *pml;
7512 	cpuset_t cpuset, tset;
7513 	int	index, cons;
7514 	extern	ulong_t po_share;
7515 	page_t	*save_pp = pp;
7516 	int	stop_on_sh = 0;
7517 	uint_t	shcnt;
7518 
7519 	CPUSET_ZERO(cpuset);
7520 
7521 	if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7522 		return (PP_GENERIC_ATTR(pp));
7523 	}
7524 
7525 	if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7526 		if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7527 			return (PP_GENERIC_ATTR(pp));
7528 		}
7529 		if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7530 			return (PP_GENERIC_ATTR(pp));
7531 		}
7532 		if (clearflag & HAT_SYNC_STOPON_SHARED) {
7533 			if (pp->p_share > po_share) {
7534 				hat_page_setattr(pp, P_REF);
7535 				return (PP_GENERIC_ATTR(pp));
7536 			}
7537 			stop_on_sh = 1;
7538 			shcnt = 0;
7539 		}
7540 	}
7541 
7542 	clearflag &= ~HAT_SYNC_STOPON_SHARED;
7543 	pml = sfmmu_mlist_enter(pp);
7544 	index = PP_MAPINDEX(pp);
7545 	cons = TTE8K;
7546 retry:
7547 	for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7548 		/*
7549 		 * We need to save the next hment on the list since
7550 		 * it is possible for pagesync to remove an invalid hment
7551 		 * from the list.
7552 		 */
7553 		tmphme = sfhme->hme_next;
7554 		if (IS_PAHME(sfhme))
7555 			continue;
7556 		/*
7557 		 * If we are looking for large mappings and this hme doesn't
7558 		 * reach the range we are seeking, just ignore it.
7559 		 */
7560 		hmeblkp = sfmmu_hmetohblk(sfhme);
7561 		if (hmeblkp->hblk_xhat_bit)
7562 			continue;
7563 
7564 		if (hme_size(sfhme) < cons)
7565 			continue;
7566 
7567 		if (stop_on_sh) {
7568 			if (hmeblkp->hblk_shared) {
7569 				sf_srd_t *srdp = hblktosrd(hmeblkp);
7570 				uint_t rid = hmeblkp->hblk_tag.htag_rid;
7571 				sf_region_t *rgnp;
7572 				ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7573 				ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7574 				ASSERT(srdp != NULL);
7575 				rgnp = srdp->srd_hmergnp[rid];
7576 				SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7577 				    rgnp, rid);
7578 				shcnt += rgnp->rgn_refcnt;
7579 			} else {
7580 				shcnt++;
7581 			}
7582 			if (shcnt > po_share) {
7583 				/*
7584 				 * tell the pager to spare the page this time
7585 				 * around.
7586 				 */
7587 				hat_page_setattr(save_pp, P_REF);
7588 				index = 0;
7589 				break;
7590 			}
7591 		}
7592 		tset = sfmmu_pagesync(pp, sfhme,
7593 		    clearflag & ~HAT_SYNC_STOPON_RM);
7594 		CPUSET_OR(cpuset, tset);
7595 
7596 		/*
7597 		 * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7598 		 * as the "ref" or "mod" is set or share cnt exceeds po_share.
7599 		 */
7600 		if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7601 		    (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7602 		    ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7603 			index = 0;
7604 			break;
7605 		}
7606 	}
7607 
7608 	while (index) {
7609 		index = index >> 1;
7610 		cons++;
7611 		if (index & 0x1) {
7612 			/* Go to leading page */
7613 			pp = PP_GROUPLEADER(pp, cons);
7614 			goto retry;
7615 		}
7616 	}
7617 
7618 	xt_sync(cpuset);
7619 	sfmmu_mlist_exit(pml);
7620 	return (PP_GENERIC_ATTR(save_pp));
7621 }
7622 
7623 /*
7624  * Get all the hardware dependent attributes for a page struct
7625  */
7626 static cpuset_t
7627 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7628 	uint_t clearflag)
7629 {
7630 	caddr_t addr;
7631 	tte_t tte, ttemod;
7632 	struct hme_blk *hmeblkp;
7633 	int ret;
7634 	sfmmu_t *sfmmup;
7635 	cpuset_t cpuset;
7636 
7637 	ASSERT(pp != NULL);
7638 	ASSERT(sfmmu_mlist_held(pp));
7639 	ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7640 	    (clearflag == HAT_SYNC_ZERORM));
7641 
7642 	SFMMU_STAT(sf_pagesync);
7643 
7644 	CPUSET_ZERO(cpuset);
7645 
7646 sfmmu_pagesync_retry:
7647 
7648 	sfmmu_copytte(&sfhme->hme_tte, &tte);
7649 	if (TTE_IS_VALID(&tte)) {
7650 		hmeblkp = sfmmu_hmetohblk(sfhme);
7651 		sfmmup = hblktosfmmu(hmeblkp);
7652 		addr = tte_to_vaddr(hmeblkp, tte);
7653 		if (clearflag == HAT_SYNC_ZERORM) {
7654 			ttemod = tte;
7655 			TTE_CLR_RM(&ttemod);
7656 			ret = sfmmu_modifytte_try(&tte, &ttemod,
7657 			    &sfhme->hme_tte);
7658 			if (ret < 0) {
7659 				/*
7660 				 * cas failed and the new value is not what
7661 				 * we want.
7662 				 */
7663 				goto sfmmu_pagesync_retry;
7664 			}
7665 
7666 			if (ret > 0) {
7667 				/* we win the cas */
7668 				if (hmeblkp->hblk_shared) {
7669 					sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7670 					uint_t rid =
7671 					    hmeblkp->hblk_tag.htag_rid;
7672 					sf_region_t *rgnp;
7673 					ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7674 					ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7675 					ASSERT(srdp != NULL);
7676 					rgnp = srdp->srd_hmergnp[rid];
7677 					SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7678 					    srdp, rgnp, rid);
7679 					cpuset = sfmmu_rgntlb_demap(addr,
7680 					    rgnp, hmeblkp, 1);
7681 				} else {
7682 					sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7683 					    0, 0);
7684 					cpuset = sfmmup->sfmmu_cpusran;
7685 				}
7686 			}
7687 		}
7688 		sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7689 		    &tte, pp);
7690 	}
7691 	return (cpuset);
7692 }
7693 
7694 /*
7695  * Remove write permission from a mappings to a page, so that
7696  * we can detect the next modification of it. This requires modifying
7697  * the TTE then invalidating (demap) any TLB entry using that TTE.
7698  * This code is similar to sfmmu_pagesync().
7699  */
7700 static cpuset_t
7701 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7702 {
7703 	caddr_t addr;
7704 	tte_t tte;
7705 	tte_t ttemod;
7706 	struct hme_blk *hmeblkp;
7707 	int ret;
7708 	sfmmu_t *sfmmup;
7709 	cpuset_t cpuset;
7710 
7711 	ASSERT(pp != NULL);
7712 	ASSERT(sfmmu_mlist_held(pp));
7713 
7714 	CPUSET_ZERO(cpuset);
7715 	SFMMU_STAT(sf_clrwrt);
7716 
7717 retry:
7718 
7719 	sfmmu_copytte(&sfhme->hme_tte, &tte);
7720 	if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7721 		hmeblkp = sfmmu_hmetohblk(sfhme);
7722 
7723 		/*
7724 		 * xhat mappings should never be to a VMODSORT page.
7725 		 */
7726 		ASSERT(hmeblkp->hblk_xhat_bit == 0);
7727 
7728 		sfmmup = hblktosfmmu(hmeblkp);
7729 		addr = tte_to_vaddr(hmeblkp, tte);
7730 
7731 		ttemod = tte;
7732 		TTE_CLR_WRT(&ttemod);
7733 		TTE_CLR_MOD(&ttemod);
7734 		ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7735 
7736 		/*
7737 		 * if cas failed and the new value is not what
7738 		 * we want retry
7739 		 */
7740 		if (ret < 0)
7741 			goto retry;
7742 
7743 		/* we win the cas */
7744 		if (ret > 0) {
7745 			if (hmeblkp->hblk_shared) {
7746 				sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7747 				uint_t rid = hmeblkp->hblk_tag.htag_rid;
7748 				sf_region_t *rgnp;
7749 				ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7750 				ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7751 				ASSERT(srdp != NULL);
7752 				rgnp = srdp->srd_hmergnp[rid];
7753 				SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7754 				    srdp, rgnp, rid);
7755 				cpuset = sfmmu_rgntlb_demap(addr,
7756 				    rgnp, hmeblkp, 1);
7757 			} else {
7758 				sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7759 				cpuset = sfmmup->sfmmu_cpusran;
7760 			}
7761 		}
7762 	}
7763 
7764 	return (cpuset);
7765 }
7766 
7767 /*
7768  * Walk all mappings of a page, removing write permission and clearing the
7769  * ref/mod bits. This code is similar to hat_pagesync()
7770  */
7771 static void
7772 hat_page_clrwrt(page_t *pp)
7773 {
7774 	struct sf_hment *sfhme;
7775 	struct sf_hment *tmphme = NULL;
7776 	kmutex_t *pml;
7777 	cpuset_t cpuset;
7778 	cpuset_t tset;
7779 	int	index;
7780 	int	 cons;
7781 
7782 	CPUSET_ZERO(cpuset);
7783 
7784 	pml = sfmmu_mlist_enter(pp);
7785 	index = PP_MAPINDEX(pp);
7786 	cons = TTE8K;
7787 retry:
7788 	for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7789 		tmphme = sfhme->hme_next;
7790 
7791 		/*
7792 		 * If we are looking for large mappings and this hme doesn't
7793 		 * reach the range we are seeking, just ignore its.
7794 		 */
7795 
7796 		if (hme_size(sfhme) < cons)
7797 			continue;
7798 
7799 		tset = sfmmu_pageclrwrt(pp, sfhme);
7800 		CPUSET_OR(cpuset, tset);
7801 	}
7802 
7803 	while (index) {
7804 		index = index >> 1;
7805 		cons++;
7806 		if (index & 0x1) {
7807 			/* Go to leading page */
7808 			pp = PP_GROUPLEADER(pp, cons);
7809 			goto retry;
7810 		}
7811 	}
7812 
7813 	xt_sync(cpuset);
7814 	sfmmu_mlist_exit(pml);
7815 }
7816 
7817 /*
7818  * Set the given REF/MOD/RO bits for the given page.
7819  * For a vnode with a sorted v_pages list, we need to change
7820  * the attributes and the v_pages list together under page_vnode_mutex.
7821  */
7822 void
7823 hat_page_setattr(page_t *pp, uint_t flag)
7824 {
7825 	vnode_t		*vp = pp->p_vnode;
7826 	page_t		**listp;
7827 	kmutex_t	*pmtx;
7828 	kmutex_t	*vphm = NULL;
7829 	int		noshuffle;
7830 
7831 	noshuffle = flag & P_NSH;
7832 	flag &= ~P_NSH;
7833 
7834 	ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7835 
7836 	/*
7837 	 * nothing to do if attribute already set
7838 	 */
7839 	if ((pp->p_nrm & flag) == flag)
7840 		return;
7841 
7842 	if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7843 	    !noshuffle) {
7844 		vphm = page_vnode_mutex(vp);
7845 		mutex_enter(vphm);
7846 	}
7847 
7848 	pmtx = sfmmu_page_enter(pp);
7849 	pp->p_nrm |= flag;
7850 	sfmmu_page_exit(pmtx);
7851 
7852 	if (vphm != NULL) {
7853 		/*
7854 		 * Some File Systems examine v_pages for NULL w/o
7855 		 * grabbing the vphm mutex. Must not let it become NULL when
7856 		 * pp is the only page on the list.
7857 		 */
7858 		if (pp->p_vpnext != pp) {
7859 			page_vpsub(&vp->v_pages, pp);
7860 			if (vp->v_pages != NULL)
7861 				listp = &vp->v_pages->p_vpprev->p_vpnext;
7862 			else
7863 				listp = &vp->v_pages;
7864 			page_vpadd(listp, pp);
7865 		}
7866 		mutex_exit(vphm);
7867 	}
7868 }
7869 
7870 void
7871 hat_page_clrattr(page_t *pp, uint_t flag)
7872 {
7873 	vnode_t		*vp = pp->p_vnode;
7874 	kmutex_t	*pmtx;
7875 
7876 	ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7877 
7878 	pmtx = sfmmu_page_enter(pp);
7879 
7880 	/*
7881 	 * Caller is expected to hold page's io lock for VMODSORT to work
7882 	 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7883 	 * bit is cleared.
7884 	 * We don't have assert to avoid tripping some existing third party
7885 	 * code. The dirty page is moved back to top of the v_page list
7886 	 * after IO is done in pvn_write_done().
7887 	 */
7888 	pp->p_nrm &= ~flag;
7889 	sfmmu_page_exit(pmtx);
7890 
7891 	if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7892 
7893 		/*
7894 		 * VMODSORT works by removing write permissions and getting
7895 		 * a fault when a page is made dirty. At this point
7896 		 * we need to remove write permission from all mappings
7897 		 * to this page.
7898 		 */
7899 		hat_page_clrwrt(pp);
7900 	}
7901 }
7902 
7903 uint_t
7904 hat_page_getattr(page_t *pp, uint_t flag)
7905 {
7906 	ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7907 	return ((uint_t)(pp->p_nrm & flag));
7908 }
7909 
7910 /*
7911  * DEBUG kernels: verify that a kernel va<->pa translation
7912  * is safe by checking the underlying page_t is in a page
7913  * relocation-safe state.
7914  */
7915 #ifdef	DEBUG
7916 void
7917 sfmmu_check_kpfn(pfn_t pfn)
7918 {
7919 	page_t *pp;
7920 	int index, cons;
7921 
7922 	if (hat_check_vtop == 0)
7923 		return;
7924 
7925 	if (hat_kpr_enabled == 0 || kvseg.s_base == NULL || panicstr)
7926 		return;
7927 
7928 	pp = page_numtopp_nolock(pfn);
7929 	if (!pp)
7930 		return;
7931 
7932 	if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7933 		return;
7934 
7935 	/*
7936 	 * Handed a large kernel page, we dig up the root page since we
7937 	 * know the root page might have the lock also.
7938 	 */
7939 	if (pp->p_szc != 0) {
7940 		index = PP_MAPINDEX(pp);
7941 		cons = TTE8K;
7942 again:
7943 		while (index != 0) {
7944 			index >>= 1;
7945 			if (index != 0)
7946 				cons++;
7947 			if (index & 0x1) {
7948 				pp = PP_GROUPLEADER(pp, cons);
7949 				goto again;
7950 			}
7951 		}
7952 	}
7953 
7954 	if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7955 		return;
7956 
7957 	/*
7958 	 * Pages need to be locked or allocated "permanent" (either from
7959 	 * static_arena arena or explicitly setting PG_NORELOC when calling
7960 	 * page_create_va()) for VA->PA translations to be valid.
7961 	 */
7962 	if (!PP_ISNORELOC(pp))
7963 		panic("Illegal VA->PA translation, pp 0x%p not permanent",
7964 		    (void *)pp);
7965 	else
7966 		panic("Illegal VA->PA translation, pp 0x%p not locked",
7967 		    (void *)pp);
7968 }
7969 #endif	/* DEBUG */
7970 
7971 /*
7972  * Returns a page frame number for a given virtual address.
7973  * Returns PFN_INVALID to indicate an invalid mapping
7974  */
7975 pfn_t
7976 hat_getpfnum(struct hat *hat, caddr_t addr)
7977 {
7978 	pfn_t pfn;
7979 	tte_t tte;
7980 
7981 	/*
7982 	 * We would like to
7983 	 * ASSERT(AS_LOCK_HELD(as, &as->a_lock));
7984 	 * but we can't because the iommu driver will call this
7985 	 * routine at interrupt time and it can't grab the as lock
7986 	 * or it will deadlock: A thread could have the as lock
7987 	 * and be waiting for io.  The io can't complete
7988 	 * because the interrupt thread is blocked trying to grab
7989 	 * the as lock.
7990 	 */
7991 
7992 	ASSERT(hat->sfmmu_xhat_provider == NULL);
7993 
7994 	if (hat == ksfmmup) {
7995 		if (IS_KMEM_VA_LARGEPAGE(addr)) {
7996 			ASSERT(segkmem_lpszc > 0);
7997 			pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7998 			if (pfn != PFN_INVALID) {
7999 				sfmmu_check_kpfn(pfn);
8000 				return (pfn);
8001 			}
8002 		} else if (segkpm && IS_KPM_ADDR(addr)) {
8003 			return (sfmmu_kpm_vatopfn(addr));
8004 		}
8005 		while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
8006 		    == PFN_SUSPENDED) {
8007 			sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
8008 		}
8009 		sfmmu_check_kpfn(pfn);
8010 		return (pfn);
8011 	} else {
8012 		return (sfmmu_uvatopfn(addr, hat, NULL));
8013 	}
8014 }
8015 
8016 /*
8017  * hat_getkpfnum() is an obsolete DDI routine, and its use is discouraged.
8018  * Use hat_getpfnum(kas.a_hat, ...) instead.
8019  *
8020  * We'd like to return PFN_INVALID if the mappings have underlying page_t's
8021  * but can't right now due to the fact that some software has grown to use
8022  * this interface incorrectly. So for now when the interface is misused,
8023  * return a warning to the user that in the future it won't work in the
8024  * way they're abusing it, and carry on (after disabling page relocation).
8025  */
8026 pfn_t
8027 hat_getkpfnum(caddr_t addr)
8028 {
8029 	pfn_t pfn;
8030 	tte_t tte;
8031 	int badcaller = 0;
8032 	extern int segkmem_reloc;
8033 
8034 	if (segkpm && IS_KPM_ADDR(addr)) {
8035 		badcaller = 1;
8036 		pfn = sfmmu_kpm_vatopfn(addr);
8037 	} else {
8038 		while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
8039 		    == PFN_SUSPENDED) {
8040 			sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
8041 		}
8042 		badcaller = pf_is_memory(pfn);
8043 	}
8044 
8045 	if (badcaller) {
8046 		/*
8047 		 * We can't return PFN_INVALID or the caller may panic
8048 		 * or corrupt the system.  The only alternative is to
8049 		 * disable page relocation at this point for all kernel
8050 		 * memory.  This will impact any callers of page_relocate()
8051 		 * such as FMA or DR.
8052 		 *
8053 		 * RFE: Add junk here to spit out an ereport so the sysadmin
8054 		 * can be advised that he should upgrade his device driver
8055 		 * so that this doesn't happen.
8056 		 */
8057 		hat_getkpfnum_badcall(caller());
8058 		if (hat_kpr_enabled && segkmem_reloc) {
8059 			hat_kpr_enabled = 0;
8060 			segkmem_reloc = 0;
8061 			cmn_err(CE_WARN, "Kernel Page Relocation is DISABLED");
8062 		}
8063 	}
8064 	return (pfn);
8065 }
8066 
8067 /*
8068  * This routine will return both pfn and tte for the vaddr.
8069  */
8070 static pfn_t
8071 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
8072 {
8073 	struct hmehash_bucket *hmebp;
8074 	hmeblk_tag hblktag;
8075 	int hmeshift, hashno = 1;
8076 	struct hme_blk *hmeblkp = NULL;
8077 	tte_t tte;
8078 
8079 	struct sf_hment *sfhmep;
8080 	pfn_t pfn;
8081 
8082 	/* support for ISM */
8083 	ism_map_t	*ism_map;
8084 	ism_blk_t	*ism_blkp;
8085 	int		i;
8086 	sfmmu_t *ism_hatid = NULL;
8087 	sfmmu_t *locked_hatid = NULL;
8088 	sfmmu_t	*sv_sfmmup = sfmmup;
8089 	caddr_t	sv_vaddr = vaddr;
8090 	sf_srd_t *srdp;
8091 
8092 	if (ttep == NULL) {
8093 		ttep = &tte;
8094 	} else {
8095 		ttep->ll = 0;
8096 	}
8097 
8098 	ASSERT(sfmmup != ksfmmup);
8099 	SFMMU_STAT(sf_user_vtop);
8100 	/*
8101 	 * Set ism_hatid if vaddr falls in a ISM segment.
8102 	 */
8103 	ism_blkp = sfmmup->sfmmu_iblk;
8104 	if (ism_blkp != NULL) {
8105 		sfmmu_ismhat_enter(sfmmup, 0);
8106 		locked_hatid = sfmmup;
8107 	}
8108 	while (ism_blkp != NULL && ism_hatid == NULL) {
8109 		ism_map = ism_blkp->iblk_maps;
8110 		for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
8111 			if (vaddr >= ism_start(ism_map[i]) &&
8112 			    vaddr < ism_end(ism_map[i])) {
8113 				sfmmup = ism_hatid = ism_map[i].imap_ismhat;
8114 				vaddr = (caddr_t)(vaddr -
8115 				    ism_start(ism_map[i]));
8116 				break;
8117 			}
8118 		}
8119 		ism_blkp = ism_blkp->iblk_next;
8120 	}
8121 	if (locked_hatid) {
8122 		sfmmu_ismhat_exit(locked_hatid, 0);
8123 	}
8124 
8125 	hblktag.htag_id = sfmmup;
8126 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
8127 	do {
8128 		hmeshift = HME_HASH_SHIFT(hashno);
8129 		hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
8130 		hblktag.htag_rehash = hashno;
8131 		hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
8132 
8133 		SFMMU_HASH_LOCK(hmebp);
8134 
8135 		HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
8136 		if (hmeblkp != NULL) {
8137 			ASSERT(!hmeblkp->hblk_shared);
8138 			HBLKTOHME(sfhmep, hmeblkp, vaddr);
8139 			sfmmu_copytte(&sfhmep->hme_tte, ttep);
8140 			SFMMU_HASH_UNLOCK(hmebp);
8141 			if (TTE_IS_VALID(ttep)) {
8142 				pfn = TTE_TO_PFN(vaddr, ttep);
8143 				return (pfn);
8144 			}
8145 			break;
8146 		}
8147 		SFMMU_HASH_UNLOCK(hmebp);
8148 		hashno++;
8149 	} while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
8150 
8151 	if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
8152 		return (PFN_INVALID);
8153 	}
8154 	srdp = sv_sfmmup->sfmmu_srdp;
8155 	ASSERT(srdp != NULL);
8156 	ASSERT(srdp->srd_refcnt != 0);
8157 	hblktag.htag_id = srdp;
8158 	hashno = 1;
8159 	do {
8160 		hmeshift = HME_HASH_SHIFT(hashno);
8161 		hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
8162 		hblktag.htag_rehash = hashno;
8163 		hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
8164 
8165 		SFMMU_HASH_LOCK(hmebp);
8166 		for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
8167 		    hmeblkp = hmeblkp->hblk_next) {
8168 			uint_t rid;
8169 			sf_region_t *rgnp;
8170 			caddr_t rsaddr;
8171 			caddr_t readdr;
8172 
8173 			if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
8174 			    sv_sfmmup->sfmmu_hmeregion_map)) {
8175 				continue;
8176 			}
8177 			ASSERT(hmeblkp->hblk_shared);
8178 			rid = hmeblkp->hblk_tag.htag_rid;
8179 			ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8180 			ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8181 			rgnp = srdp->srd_hmergnp[rid];
8182 			SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
8183 			HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
8184 			sfmmu_copytte(&sfhmep->hme_tte, ttep);
8185 			rsaddr = rgnp->rgn_saddr;
8186 			readdr = rsaddr + rgnp->rgn_size;
8187 #ifdef DEBUG
8188 			if (TTE_IS_VALID(ttep) ||
8189 			    get_hblk_ttesz(hmeblkp) > TTE8K) {
8190 				caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
8191 				ASSERT(eva > sv_vaddr);
8192 				ASSERT(sv_vaddr >= rsaddr);
8193 				ASSERT(sv_vaddr < readdr);
8194 				ASSERT(eva <= readdr);
8195 			}
8196 #endif /* DEBUG */
8197 			/*
8198 			 * Continue the search if we
8199 			 * found an invalid 8K tte outside of the area
8200 			 * covered by this hmeblk's region.
8201 			 */
8202 			if (TTE_IS_VALID(ttep)) {
8203 				SFMMU_HASH_UNLOCK(hmebp);
8204 				pfn = TTE_TO_PFN(sv_vaddr, ttep);
8205 				return (pfn);
8206 			} else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
8207 			    (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
8208 				SFMMU_HASH_UNLOCK(hmebp);
8209 				pfn = PFN_INVALID;
8210 				return (pfn);
8211 			}
8212 		}
8213 		SFMMU_HASH_UNLOCK(hmebp);
8214 		hashno++;
8215 	} while (hashno <= mmu_hashcnt);
8216 	return (PFN_INVALID);
8217 }
8218 
8219 
8220 /*
8221  * For compatability with AT&T and later optimizations
8222  */
8223 /* ARGSUSED */
8224 void
8225 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8226 {
8227 	ASSERT(hat != NULL);
8228 	ASSERT(hat->sfmmu_xhat_provider == NULL);
8229 }
8230 
8231 /*
8232  * Return the number of mappings to a particular page.  This number is an
8233  * approximation of the number of people sharing the page.
8234  *
8235  * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8236  * hat_page_checkshare() can be used to compare threshold to share
8237  * count that reflects the number of region sharers albeit at higher cost.
8238  */
8239 ulong_t
8240 hat_page_getshare(page_t *pp)
8241 {
8242 	page_t *spp = pp;	/* start page */
8243 	kmutex_t *pml;
8244 	ulong_t	cnt;
8245 	int index, sz = TTE64K;
8246 
8247 	/*
8248 	 * We need to grab the mlist lock to make sure any outstanding
8249 	 * load/unloads complete.  Otherwise we could return zero
8250 	 * even though the unload(s) hasn't finished yet.
8251 	 */
8252 	pml = sfmmu_mlist_enter(spp);
8253 	cnt = spp->p_share;
8254 
8255 #ifdef VAC
8256 	if (kpm_enable)
8257 		cnt += spp->p_kpmref;
8258 #endif
8259 	if (vpm_enable && pp->p_vpmref) {
8260 		cnt += 1;
8261 	}
8262 
8263 	/*
8264 	 * If we have any large mappings, we count the number of
8265 	 * mappings that this large page is part of.
8266 	 */
8267 	index = PP_MAPINDEX(spp);
8268 	index >>= 1;
8269 	while (index) {
8270 		pp = PP_GROUPLEADER(spp, sz);
8271 		if ((index & 0x1) && pp != spp) {
8272 			cnt += pp->p_share;
8273 			spp = pp;
8274 		}
8275 		index >>= 1;
8276 		sz++;
8277 	}
8278 	sfmmu_mlist_exit(pml);
8279 	return (cnt);
8280 }
8281 
8282 /*
8283  * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8284  * otherwise. Count shared hmeblks by region's refcnt.
8285  */
8286 int
8287 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8288 {
8289 	kmutex_t *pml;
8290 	ulong_t	cnt = 0;
8291 	int index, sz = TTE8K;
8292 	struct sf_hment *sfhme, *tmphme = NULL;
8293 	struct hme_blk *hmeblkp;
8294 
8295 	pml = sfmmu_mlist_enter(pp);
8296 
8297 #ifdef VAC
8298 	if (kpm_enable)
8299 		cnt = pp->p_kpmref;
8300 #endif
8301 
8302 	if (vpm_enable && pp->p_vpmref) {
8303 		cnt += 1;
8304 	}
8305 
8306 	if (pp->p_share + cnt > sh_thresh) {
8307 		sfmmu_mlist_exit(pml);
8308 		return (1);
8309 	}
8310 
8311 	index = PP_MAPINDEX(pp);
8312 
8313 again:
8314 	for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8315 		tmphme = sfhme->hme_next;
8316 		if (IS_PAHME(sfhme)) {
8317 			continue;
8318 		}
8319 
8320 		hmeblkp = sfmmu_hmetohblk(sfhme);
8321 		if (hmeblkp->hblk_xhat_bit) {
8322 			cnt++;
8323 			if (cnt > sh_thresh) {
8324 				sfmmu_mlist_exit(pml);
8325 				return (1);
8326 			}
8327 			continue;
8328 		}
8329 		if (hme_size(sfhme) != sz) {
8330 			continue;
8331 		}
8332 
8333 		if (hmeblkp->hblk_shared) {
8334 			sf_srd_t *srdp = hblktosrd(hmeblkp);
8335 			uint_t rid = hmeblkp->hblk_tag.htag_rid;
8336 			sf_region_t *rgnp;
8337 			ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8338 			ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8339 			ASSERT(srdp != NULL);
8340 			rgnp = srdp->srd_hmergnp[rid];
8341 			SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8342 			    rgnp, rid);
8343 			cnt += rgnp->rgn_refcnt;
8344 		} else {
8345 			cnt++;
8346 		}
8347 		if (cnt > sh_thresh) {
8348 			sfmmu_mlist_exit(pml);
8349 			return (1);
8350 		}
8351 	}
8352 
8353 	index >>= 1;
8354 	sz++;
8355 	while (index) {
8356 		pp = PP_GROUPLEADER(pp, sz);
8357 		ASSERT(sfmmu_mlist_held(pp));
8358 		if (index & 0x1) {
8359 			goto again;
8360 		}
8361 		index >>= 1;
8362 		sz++;
8363 	}
8364 	sfmmu_mlist_exit(pml);
8365 	return (0);
8366 }
8367 
8368 /*
8369  * Unload all large mappings to the pp and reset the p_szc field of every
8370  * constituent page according to the remaining mappings.
8371  *
8372  * pp must be locked SE_EXCL. Even though no other constituent pages are
8373  * locked it's legal to unload the large mappings to the pp because all
8374  * constituent pages of large locked mappings have to be locked SE_SHARED.
8375  * This means if we have SE_EXCL lock on one of constituent pages none of the
8376  * large mappings to pp are locked.
8377  *
8378  * Decrease p_szc field starting from the last constituent page and ending
8379  * with the root page. This method is used because other threads rely on the
8380  * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8381  * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8382  * ensures that p_szc changes of the constituent pages appears atomic for all
8383  * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8384  *
8385  * This mechanism is only used for file system pages where it's not always
8386  * possible to get SE_EXCL locks on all constituent pages to demote the size
8387  * code (as is done for anonymous or kernel large pages).
8388  *
8389  * See more comments in front of sfmmu_mlspl_enter().
8390  */
8391 void
8392 hat_page_demote(page_t *pp)
8393 {
8394 	int index;
8395 	int sz;
8396 	cpuset_t cpuset;
8397 	int sync = 0;
8398 	page_t *rootpp;
8399 	struct sf_hment *sfhme;
8400 	struct sf_hment *tmphme = NULL;
8401 	struct hme_blk *hmeblkp;
8402 	uint_t pszc;
8403 	page_t *lastpp;
8404 	cpuset_t tset;
8405 	pgcnt_t npgs;
8406 	kmutex_t *pml;
8407 	kmutex_t *pmtx = NULL;
8408 
8409 	ASSERT(PAGE_EXCL(pp));
8410 	ASSERT(!PP_ISFREE(pp));
8411 	ASSERT(!PP_ISKAS(pp));
8412 	ASSERT(page_szc_lock_assert(pp));
8413 	pml = sfmmu_mlist_enter(pp);
8414 
8415 	pszc = pp->p_szc;
8416 	if (pszc == 0) {
8417 		goto out;
8418 	}
8419 
8420 	index = PP_MAPINDEX(pp) >> 1;
8421 
8422 	if (index) {
8423 		CPUSET_ZERO(cpuset);
8424 		sz = TTE64K;
8425 		sync = 1;
8426 	}
8427 
8428 	while (index) {
8429 		if (!(index & 0x1)) {
8430 			index >>= 1;
8431 			sz++;
8432 			continue;
8433 		}
8434 		ASSERT(sz <= pszc);
8435 		rootpp = PP_GROUPLEADER(pp, sz);
8436 		for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8437 			tmphme = sfhme->hme_next;
8438 			ASSERT(!IS_PAHME(sfhme));
8439 			hmeblkp = sfmmu_hmetohblk(sfhme);
8440 			if (hme_size(sfhme) != sz) {
8441 				continue;
8442 			}
8443 			if (hmeblkp->hblk_xhat_bit) {
8444 				cmn_err(CE_PANIC,
8445 				    "hat_page_demote: xhat hmeblk");
8446 			}
8447 			tset = sfmmu_pageunload(rootpp, sfhme, sz);
8448 			CPUSET_OR(cpuset, tset);
8449 		}
8450 		if (index >>= 1) {
8451 			sz++;
8452 		}
8453 	}
8454 
8455 	ASSERT(!PP_ISMAPPED_LARGE(pp));
8456 
8457 	if (sync) {
8458 		xt_sync(cpuset);
8459 #ifdef VAC
8460 		if (PP_ISTNC(pp)) {
8461 			conv_tnc(rootpp, sz);
8462 		}
8463 #endif	/* VAC */
8464 	}
8465 
8466 	pmtx = sfmmu_page_enter(pp);
8467 
8468 	ASSERT(pp->p_szc == pszc);
8469 	rootpp = PP_PAGEROOT(pp);
8470 	ASSERT(rootpp->p_szc == pszc);
8471 	lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8472 
8473 	while (lastpp != rootpp) {
8474 		sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8475 		ASSERT(sz < pszc);
8476 		npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8477 		ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8478 		while (--npgs > 0) {
8479 			lastpp->p_szc = (uchar_t)sz;
8480 			lastpp = PP_PAGEPREV(lastpp);
8481 		}
8482 		if (sz) {
8483 			/*
8484 			 * make sure before current root's pszc
8485 			 * is updated all updates to constituent pages pszc
8486 			 * fields are globally visible.
8487 			 */
8488 			membar_producer();
8489 		}
8490 		lastpp->p_szc = sz;
8491 		ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8492 		if (lastpp != rootpp) {
8493 			lastpp = PP_PAGEPREV(lastpp);
8494 		}
8495 	}
8496 	if (sz == 0) {
8497 		/* the loop above doesn't cover this case */
8498 		rootpp->p_szc = 0;
8499 	}
8500 out:
8501 	ASSERT(pp->p_szc == 0);
8502 	if (pmtx != NULL) {
8503 		sfmmu_page_exit(pmtx);
8504 	}
8505 	sfmmu_mlist_exit(pml);
8506 }
8507 
8508 /*
8509  * Refresh the HAT ismttecnt[] element for size szc.
8510  * Caller must have set ISM busy flag to prevent mapping
8511  * lists from changing while we're traversing them.
8512  */
8513 pgcnt_t
8514 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8515 {
8516 	ism_blk_t	*ism_blkp = sfmmup->sfmmu_iblk;
8517 	ism_map_t	*ism_map;
8518 	pgcnt_t		npgs = 0;
8519 	pgcnt_t		npgs_scd = 0;
8520 	int		j;
8521 	sf_scd_t	*scdp;
8522 	uchar_t		rid;
8523 
8524 	ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8525 	scdp = sfmmup->sfmmu_scdp;
8526 
8527 	for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8528 		ism_map = ism_blkp->iblk_maps;
8529 		for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8530 			rid = ism_map[j].imap_rid;
8531 			ASSERT(rid == SFMMU_INVALID_ISMRID ||
8532 			    rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8533 
8534 			if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8535 			    SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8536 				/* ISM is in sfmmup's SCD */
8537 				npgs_scd +=
8538 				    ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8539 			} else {
8540 				/* ISMs is not in SCD */
8541 				npgs +=
8542 				    ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8543 			}
8544 		}
8545 	}
8546 	sfmmup->sfmmu_ismttecnt[szc] = npgs;
8547 	sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8548 	return (npgs);
8549 }
8550 
8551 /*
8552  * Yield the memory claim requirement for an address space.
8553  *
8554  * This is currently implemented as the number of bytes that have active
8555  * hardware translations that have page structures.  Therefore, it can
8556  * underestimate the traditional resident set size, eg, if the
8557  * physical page is present and the hardware translation is missing;
8558  * and it can overestimate the rss, eg, if there are active
8559  * translations to a frame buffer with page structs.
8560  * Also, it does not take sharing into account.
8561  *
8562  * Note that we don't acquire locks here since this function is most often
8563  * called from the clock thread.
8564  */
8565 size_t
8566 hat_get_mapped_size(struct hat *hat)
8567 {
8568 	size_t		assize = 0;
8569 	int 		i;
8570 
8571 	if (hat == NULL)
8572 		return (0);
8573 
8574 	ASSERT(hat->sfmmu_xhat_provider == NULL);
8575 
8576 	for (i = 0; i < mmu_page_sizes; i++)
8577 		assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8578 		    (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8579 
8580 	if (hat->sfmmu_iblk == NULL)
8581 		return (assize);
8582 
8583 	for (i = 0; i < mmu_page_sizes; i++)
8584 		assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8585 		    (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8586 
8587 	return (assize);
8588 }
8589 
8590 int
8591 hat_stats_enable(struct hat *hat)
8592 {
8593 	hatlock_t	*hatlockp;
8594 
8595 	ASSERT(hat->sfmmu_xhat_provider == NULL);
8596 
8597 	hatlockp = sfmmu_hat_enter(hat);
8598 	hat->sfmmu_rmstat++;
8599 	sfmmu_hat_exit(hatlockp);
8600 	return (1);
8601 }
8602 
8603 void
8604 hat_stats_disable(struct hat *hat)
8605 {
8606 	hatlock_t	*hatlockp;
8607 
8608 	ASSERT(hat->sfmmu_xhat_provider == NULL);
8609 
8610 	hatlockp = sfmmu_hat_enter(hat);
8611 	hat->sfmmu_rmstat--;
8612 	sfmmu_hat_exit(hatlockp);
8613 }
8614 
8615 /*
8616  * Routines for entering or removing  ourselves from the
8617  * ism_hat's mapping list. This is used for both private and
8618  * SCD hats.
8619  */
8620 static void
8621 iment_add(struct ism_ment *iment,  struct hat *ism_hat)
8622 {
8623 	ASSERT(MUTEX_HELD(&ism_mlist_lock));
8624 
8625 	iment->iment_prev = NULL;
8626 	iment->iment_next = ism_hat->sfmmu_iment;
8627 	if (ism_hat->sfmmu_iment) {
8628 		ism_hat->sfmmu_iment->iment_prev = iment;
8629 	}
8630 	ism_hat->sfmmu_iment = iment;
8631 }
8632 
8633 static void
8634 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8635 {
8636 	ASSERT(MUTEX_HELD(&ism_mlist_lock));
8637 
8638 	if (ism_hat->sfmmu_iment == NULL) {
8639 		panic("ism map entry remove - no entries");
8640 	}
8641 
8642 	if (iment->iment_prev) {
8643 		ASSERT(ism_hat->sfmmu_iment != iment);
8644 		iment->iment_prev->iment_next = iment->iment_next;
8645 	} else {
8646 		ASSERT(ism_hat->sfmmu_iment == iment);
8647 		ism_hat->sfmmu_iment = iment->iment_next;
8648 	}
8649 
8650 	if (iment->iment_next) {
8651 		iment->iment_next->iment_prev = iment->iment_prev;
8652 	}
8653 
8654 	/*
8655 	 * zero out the entry
8656 	 */
8657 	iment->iment_next = NULL;
8658 	iment->iment_prev = NULL;
8659 	iment->iment_hat =  NULL;
8660 	iment->iment_base_va = 0;
8661 }
8662 
8663 /*
8664  * Hat_share()/unshare() return an (non-zero) error
8665  * when saddr and daddr are not properly aligned.
8666  *
8667  * The top level mapping element determines the alignment
8668  * requirement for saddr and daddr, depending on different
8669  * architectures.
8670  *
8671  * When hat_share()/unshare() are not supported,
8672  * HATOP_SHARE()/UNSHARE() return 0
8673  */
8674 int
8675 hat_share(struct hat *sfmmup, caddr_t addr,
8676 	struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8677 {
8678 	ism_blk_t	*ism_blkp;
8679 	ism_blk_t	*new_iblk;
8680 	ism_map_t 	*ism_map;
8681 	ism_ment_t	*ism_ment;
8682 	int		i, added;
8683 	hatlock_t	*hatlockp;
8684 	int		reload_mmu = 0;
8685 	uint_t		ismshift = page_get_shift(ismszc);
8686 	size_t		ismpgsz = page_get_pagesize(ismszc);
8687 	uint_t		ismmask = (uint_t)ismpgsz - 1;
8688 	size_t		sh_size = ISM_SHIFT(ismshift, len);
8689 	ushort_t	ismhatflag;
8690 	hat_region_cookie_t rcookie;
8691 	sf_scd_t	*old_scdp;
8692 
8693 #ifdef DEBUG
8694 	caddr_t		eaddr = addr + len;
8695 #endif /* DEBUG */
8696 
8697 	ASSERT(ism_hatid != NULL && sfmmup != NULL);
8698 	ASSERT(sptaddr == ISMID_STARTADDR);
8699 	/*
8700 	 * Check the alignment.
8701 	 */
8702 	if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8703 		return (EINVAL);
8704 
8705 	/*
8706 	 * Check size alignment.
8707 	 */
8708 	if (!ISM_ALIGNED(ismshift, len))
8709 		return (EINVAL);
8710 
8711 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
8712 
8713 	/*
8714 	 * Allocate ism_ment for the ism_hat's mapping list, and an
8715 	 * ism map blk in case we need one.  We must do our
8716 	 * allocations before acquiring locks to prevent a deadlock
8717 	 * in the kmem allocator on the mapping list lock.
8718 	 */
8719 	new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8720 	ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8721 
8722 	/*
8723 	 * Serialize ISM mappings with the ISM busy flag, and also the
8724 	 * trap handlers.
8725 	 */
8726 	sfmmu_ismhat_enter(sfmmup, 0);
8727 
8728 	/*
8729 	 * Allocate an ism map blk if necessary.
8730 	 */
8731 	if (sfmmup->sfmmu_iblk == NULL) {
8732 		sfmmup->sfmmu_iblk = new_iblk;
8733 		bzero(new_iblk, sizeof (*new_iblk));
8734 		new_iblk->iblk_nextpa = (uint64_t)-1;
8735 		membar_stst();	/* make sure next ptr visible to all CPUs */
8736 		sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8737 		reload_mmu = 1;
8738 		new_iblk = NULL;
8739 	}
8740 
8741 #ifdef DEBUG
8742 	/*
8743 	 * Make sure mapping does not already exist.
8744 	 */
8745 	ism_blkp = sfmmup->sfmmu_iblk;
8746 	while (ism_blkp != NULL) {
8747 		ism_map = ism_blkp->iblk_maps;
8748 		for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8749 			if ((addr >= ism_start(ism_map[i]) &&
8750 			    addr < ism_end(ism_map[i])) ||
8751 			    eaddr > ism_start(ism_map[i]) &&
8752 			    eaddr <= ism_end(ism_map[i])) {
8753 				panic("sfmmu_share: Already mapped!");
8754 			}
8755 		}
8756 		ism_blkp = ism_blkp->iblk_next;
8757 	}
8758 #endif /* DEBUG */
8759 
8760 	ASSERT(ismszc >= TTE4M);
8761 	if (ismszc == TTE4M) {
8762 		ismhatflag = HAT_4M_FLAG;
8763 	} else if (ismszc == TTE32M) {
8764 		ismhatflag = HAT_32M_FLAG;
8765 	} else if (ismszc == TTE256M) {
8766 		ismhatflag = HAT_256M_FLAG;
8767 	}
8768 	/*
8769 	 * Add mapping to first available mapping slot.
8770 	 */
8771 	ism_blkp = sfmmup->sfmmu_iblk;
8772 	added = 0;
8773 	while (!added) {
8774 		ism_map = ism_blkp->iblk_maps;
8775 		for (i = 0; i < ISM_MAP_SLOTS; i++)  {
8776 			if (ism_map[i].imap_ismhat == NULL) {
8777 
8778 				ism_map[i].imap_ismhat = ism_hatid;
8779 				ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8780 				ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8781 				ism_map[i].imap_hatflags = ismhatflag;
8782 				ism_map[i].imap_sz_mask = ismmask;
8783 				/*
8784 				 * imap_seg is checked in ISM_CHECK to see if
8785 				 * non-NULL, then other info assumed valid.
8786 				 */
8787 				membar_stst();
8788 				ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8789 				ism_map[i].imap_ment = ism_ment;
8790 
8791 				/*
8792 				 * Now add ourselves to the ism_hat's
8793 				 * mapping list.
8794 				 */
8795 				ism_ment->iment_hat = sfmmup;
8796 				ism_ment->iment_base_va = addr;
8797 				ism_hatid->sfmmu_ismhat = 1;
8798 				mutex_enter(&ism_mlist_lock);
8799 				iment_add(ism_ment, ism_hatid);
8800 				mutex_exit(&ism_mlist_lock);
8801 				added = 1;
8802 				break;
8803 			}
8804 		}
8805 		if (!added && ism_blkp->iblk_next == NULL) {
8806 			ism_blkp->iblk_next = new_iblk;
8807 			new_iblk = NULL;
8808 			bzero(ism_blkp->iblk_next,
8809 			    sizeof (*ism_blkp->iblk_next));
8810 			ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8811 			membar_stst();
8812 			ism_blkp->iblk_nextpa =
8813 			    va_to_pa((caddr_t)ism_blkp->iblk_next);
8814 		}
8815 		ism_blkp = ism_blkp->iblk_next;
8816 	}
8817 
8818 	/*
8819 	 * After calling hat_join_region, sfmmup may join a new SCD or
8820 	 * move from the old scd to a new scd, in which case, we want to
8821 	 * shrink the sfmmup's private tsb size, i.e., pass shrink to
8822 	 * sfmmu_check_page_sizes at the end of this routine.
8823 	 */
8824 	old_scdp = sfmmup->sfmmu_scdp;
8825 
8826 	rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8827 	    PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8828 	if (rcookie != HAT_INVALID_REGION_COOKIE) {
8829 		ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8830 	}
8831 	/*
8832 	 * Update our counters for this sfmmup's ism mappings.
8833 	 */
8834 	for (i = 0; i <= ismszc; i++) {
8835 		if (!(disable_ism_large_pages & (1 << i)))
8836 			(void) ism_tsb_entries(sfmmup, i);
8837 	}
8838 
8839 	/*
8840 	 * For ISM and DISM we do not support 512K pages, so we only only
8841 	 * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8842 	 * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8843 	 *
8844 	 * Need to set 32M/256M ISM flags to make sure
8845 	 * sfmmu_check_page_sizes() enables them on Panther.
8846 	 */
8847 	ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8848 
8849 	switch (ismszc) {
8850 	case TTE256M:
8851 		if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8852 			hatlockp = sfmmu_hat_enter(sfmmup);
8853 			SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8854 			sfmmu_hat_exit(hatlockp);
8855 		}
8856 		break;
8857 	case TTE32M:
8858 		if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8859 			hatlockp = sfmmu_hat_enter(sfmmup);
8860 			SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8861 			sfmmu_hat_exit(hatlockp);
8862 		}
8863 		break;
8864 	default:
8865 		break;
8866 	}
8867 
8868 	/*
8869 	 * If we updated the ismblkpa for this HAT we must make
8870 	 * sure all CPUs running this process reload their tsbmiss area.
8871 	 * Otherwise they will fail to load the mappings in the tsbmiss
8872 	 * handler and will loop calling pagefault().
8873 	 */
8874 	if (reload_mmu) {
8875 		hatlockp = sfmmu_hat_enter(sfmmup);
8876 		sfmmu_sync_mmustate(sfmmup);
8877 		sfmmu_hat_exit(hatlockp);
8878 	}
8879 
8880 	sfmmu_ismhat_exit(sfmmup, 0);
8881 
8882 	/*
8883 	 * Free up ismblk if we didn't use it.
8884 	 */
8885 	if (new_iblk != NULL)
8886 		kmem_cache_free(ism_blk_cache, new_iblk);
8887 
8888 	/*
8889 	 * Check TSB and TLB page sizes.
8890 	 */
8891 	if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8892 		sfmmu_check_page_sizes(sfmmup, 0);
8893 	} else {
8894 		sfmmu_check_page_sizes(sfmmup, 1);
8895 	}
8896 	return (0);
8897 }
8898 
8899 /*
8900  * hat_unshare removes exactly one ism_map from
8901  * this process's as.  It expects multiple calls
8902  * to hat_unshare for multiple shm segments.
8903  */
8904 void
8905 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8906 {
8907 	ism_map_t 	*ism_map;
8908 	ism_ment_t	*free_ment = NULL;
8909 	ism_blk_t	*ism_blkp;
8910 	struct hat	*ism_hatid;
8911 	int 		found, i;
8912 	hatlock_t	*hatlockp;
8913 	struct tsb_info	*tsbinfo;
8914 	uint_t		ismshift = page_get_shift(ismszc);
8915 	size_t		sh_size = ISM_SHIFT(ismshift, len);
8916 	uchar_t		ism_rid;
8917 	sf_scd_t	*old_scdp;
8918 
8919 	ASSERT(ISM_ALIGNED(ismshift, addr));
8920 	ASSERT(ISM_ALIGNED(ismshift, len));
8921 	ASSERT(sfmmup != NULL);
8922 	ASSERT(sfmmup != ksfmmup);
8923 
8924 	if (sfmmup->sfmmu_xhat_provider) {
8925 		XHAT_UNSHARE(sfmmup, addr, len);
8926 		return;
8927 	} else {
8928 		/*
8929 		 * This must be a CPU HAT. If the address space has
8930 		 * XHATs attached, inform all XHATs that ISM segment
8931 		 * is going away
8932 		 */
8933 		ASSERT(sfmmup->sfmmu_as != NULL);
8934 		if (sfmmup->sfmmu_as->a_xhat != NULL)
8935 			xhat_unshare_all(sfmmup->sfmmu_as, addr, len);
8936 	}
8937 
8938 	/*
8939 	 * Make sure that during the entire time ISM mappings are removed,
8940 	 * the trap handlers serialize behind us, and that no one else
8941 	 * can be mucking with ISM mappings.  This also lets us get away
8942 	 * with not doing expensive cross calls to flush the TLB -- we
8943 	 * just discard the context, flush the entire TSB, and call it
8944 	 * a day.
8945 	 */
8946 	sfmmu_ismhat_enter(sfmmup, 0);
8947 
8948 	/*
8949 	 * Remove the mapping.
8950 	 *
8951 	 * We can't have any holes in the ism map.
8952 	 * The tsb miss code while searching the ism map will
8953 	 * stop on an empty map slot.  So we must move
8954 	 * everyone past the hole up 1 if any.
8955 	 *
8956 	 * Also empty ism map blks are not freed until the
8957 	 * process exits. This is to prevent a MT race condition
8958 	 * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8959 	 */
8960 	found = 0;
8961 	ism_blkp = sfmmup->sfmmu_iblk;
8962 	while (!found && ism_blkp != NULL) {
8963 		ism_map = ism_blkp->iblk_maps;
8964 		for (i = 0; i < ISM_MAP_SLOTS; i++) {
8965 			if (addr == ism_start(ism_map[i]) &&
8966 			    sh_size == (size_t)(ism_size(ism_map[i]))) {
8967 				found = 1;
8968 				break;
8969 			}
8970 		}
8971 		if (!found)
8972 			ism_blkp = ism_blkp->iblk_next;
8973 	}
8974 
8975 	if (found) {
8976 		ism_hatid = ism_map[i].imap_ismhat;
8977 		ism_rid = ism_map[i].imap_rid;
8978 		ASSERT(ism_hatid != NULL);
8979 		ASSERT(ism_hatid->sfmmu_ismhat == 1);
8980 
8981 		/*
8982 		 * After hat_leave_region, the sfmmup may leave SCD,
8983 		 * in which case, we want to grow the private tsb size when
8984 		 * calling sfmmu_check_page_sizes at the end of the routine.
8985 		 */
8986 		old_scdp = sfmmup->sfmmu_scdp;
8987 		/*
8988 		 * Then remove ourselves from the region.
8989 		 */
8990 		if (ism_rid != SFMMU_INVALID_ISMRID) {
8991 			hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8992 			    HAT_REGION_ISM);
8993 		}
8994 
8995 		/*
8996 		 * And now guarantee that any other cpu
8997 		 * that tries to process an ISM miss
8998 		 * will go to tl=0.
8999 		 */
9000 		hatlockp = sfmmu_hat_enter(sfmmup);
9001 		sfmmu_invalidate_ctx(sfmmup);
9002 		sfmmu_hat_exit(hatlockp);
9003 
9004 		/*
9005 		 * Remove ourselves from the ism mapping list.
9006 		 */
9007 		mutex_enter(&ism_mlist_lock);
9008 		iment_sub(ism_map[i].imap_ment, ism_hatid);
9009 		mutex_exit(&ism_mlist_lock);
9010 		free_ment = ism_map[i].imap_ment;
9011 
9012 		/*
9013 		 * We delete the ism map by copying
9014 		 * the next map over the current one.
9015 		 * We will take the next one in the maps
9016 		 * array or from the next ism_blk.
9017 		 */
9018 		while (ism_blkp != NULL) {
9019 			ism_map = ism_blkp->iblk_maps;
9020 			while (i < (ISM_MAP_SLOTS - 1)) {
9021 				ism_map[i] = ism_map[i + 1];
9022 				i++;
9023 			}
9024 			/* i == (ISM_MAP_SLOTS - 1) */
9025 			ism_blkp = ism_blkp->iblk_next;
9026 			if (ism_blkp != NULL) {
9027 				ism_map[i] = ism_blkp->iblk_maps[0];
9028 				i = 0;
9029 			} else {
9030 				ism_map[i].imap_seg = 0;
9031 				ism_map[i].imap_vb_shift = 0;
9032 				ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
9033 				ism_map[i].imap_hatflags = 0;
9034 				ism_map[i].imap_sz_mask = 0;
9035 				ism_map[i].imap_ismhat = NULL;
9036 				ism_map[i].imap_ment = NULL;
9037 			}
9038 		}
9039 
9040 		/*
9041 		 * Now flush entire TSB for the process, since
9042 		 * demapping page by page can be too expensive.
9043 		 * We don't have to flush the TLB here anymore
9044 		 * since we switch to a new TLB ctx instead.
9045 		 * Also, there is no need to flush if the process
9046 		 * is exiting since the TSB will be freed later.
9047 		 */
9048 		if (!sfmmup->sfmmu_free) {
9049 			hatlockp = sfmmu_hat_enter(sfmmup);
9050 			for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
9051 			    tsbinfo = tsbinfo->tsb_next) {
9052 				if (tsbinfo->tsb_flags & TSB_SWAPPED)
9053 					continue;
9054 				if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
9055 					tsbinfo->tsb_flags |=
9056 					    TSB_FLUSH_NEEDED;
9057 					continue;
9058 				}
9059 
9060 				sfmmu_inv_tsb(tsbinfo->tsb_va,
9061 				    TSB_BYTES(tsbinfo->tsb_szc));
9062 			}
9063 			sfmmu_hat_exit(hatlockp);
9064 		}
9065 	}
9066 
9067 	/*
9068 	 * Update our counters for this sfmmup's ism mappings.
9069 	 */
9070 	for (i = 0; i <= ismszc; i++) {
9071 		if (!(disable_ism_large_pages & (1 << i)))
9072 			(void) ism_tsb_entries(sfmmup, i);
9073 	}
9074 
9075 	sfmmu_ismhat_exit(sfmmup, 0);
9076 
9077 	/*
9078 	 * We must do our freeing here after dropping locks
9079 	 * to prevent a deadlock in the kmem allocator on the
9080 	 * mapping list lock.
9081 	 */
9082 	if (free_ment != NULL)
9083 		kmem_cache_free(ism_ment_cache, free_ment);
9084 
9085 	/*
9086 	 * Check TSB and TLB page sizes if the process isn't exiting.
9087 	 */
9088 	if (!sfmmup->sfmmu_free) {
9089 		if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
9090 			sfmmu_check_page_sizes(sfmmup, 1);
9091 		} else {
9092 			sfmmu_check_page_sizes(sfmmup, 0);
9093 		}
9094 	}
9095 }
9096 
9097 /* ARGSUSED */
9098 static int
9099 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
9100 {
9101 	/* void *buf is sfmmu_t pointer */
9102 	bzero(buf, sizeof (sfmmu_t));
9103 
9104 	return (0);
9105 }
9106 
9107 /* ARGSUSED */
9108 static void
9109 sfmmu_idcache_destructor(void *buf, void *cdrarg)
9110 {
9111 	/* void *buf is sfmmu_t pointer */
9112 }
9113 
9114 /*
9115  * setup kmem hmeblks by bzeroing all members and initializing the nextpa
9116  * field to be the pa of this hmeblk
9117  */
9118 /* ARGSUSED */
9119 static int
9120 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
9121 {
9122 	struct hme_blk *hmeblkp;
9123 
9124 	bzero(buf, (size_t)cdrarg);
9125 	hmeblkp = (struct hme_blk *)buf;
9126 	hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
9127 
9128 #ifdef	HBLK_TRACE
9129 	mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
9130 #endif	/* HBLK_TRACE */
9131 
9132 	return (0);
9133 }
9134 
9135 /* ARGSUSED */
9136 static void
9137 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
9138 {
9139 
9140 #ifdef	HBLK_TRACE
9141 
9142 	struct hme_blk *hmeblkp;
9143 
9144 	hmeblkp = (struct hme_blk *)buf;
9145 	mutex_destroy(&hmeblkp->hblk_audit_lock);
9146 
9147 #endif	/* HBLK_TRACE */
9148 }
9149 
9150 #define	SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
9151 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
9152 /*
9153  * The kmem allocator will callback into our reclaim routine when the system
9154  * is running low in memory.  We traverse the hash and free up all unused but
9155  * still cached hme_blks.  We also traverse the free list and free them up
9156  * as well.
9157  */
9158 /*ARGSUSED*/
9159 static void
9160 sfmmu_hblkcache_reclaim(void *cdrarg)
9161 {
9162 	int i;
9163 	struct hmehash_bucket *hmebp;
9164 	struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
9165 	static struct hmehash_bucket *uhmehash_reclaim_hand;
9166 	static struct hmehash_bucket *khmehash_reclaim_hand;
9167 	struct hme_blk *list = NULL, *last_hmeblkp;
9168 	cpuset_t cpuset = cpu_ready_set;
9169 	cpu_hme_pend_t *cpuhp;
9170 
9171 	/* Free up hmeblks on the cpu pending lists */
9172 	for (i = 0; i < NCPU; i++) {
9173 		cpuhp = &cpu_hme_pend[i];
9174 		if (cpuhp->chp_listp != NULL)  {
9175 			mutex_enter(&cpuhp->chp_mutex);
9176 			if (cpuhp->chp_listp == NULL) {
9177 				mutex_exit(&cpuhp->chp_mutex);
9178 				continue;
9179 			}
9180 			for (last_hmeblkp = cpuhp->chp_listp;
9181 			    last_hmeblkp->hblk_next != NULL;
9182 			    last_hmeblkp = last_hmeblkp->hblk_next)
9183 				;
9184 			last_hmeblkp->hblk_next = list;
9185 			list = cpuhp->chp_listp;
9186 			cpuhp->chp_listp = NULL;
9187 			cpuhp->chp_count = 0;
9188 			mutex_exit(&cpuhp->chp_mutex);
9189 		}
9190 
9191 	}
9192 
9193 	if (list != NULL) {
9194 		kpreempt_disable();
9195 		CPUSET_DEL(cpuset, CPU->cpu_id);
9196 		xt_sync(cpuset);
9197 		xt_sync(cpuset);
9198 		kpreempt_enable();
9199 		sfmmu_hblk_free(&list);
9200 		list = NULL;
9201 	}
9202 
9203 	hmebp = uhmehash_reclaim_hand;
9204 	if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
9205 		uhmehash_reclaim_hand = hmebp = uhme_hash;
9206 	uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9207 
9208 	for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9209 		if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9210 			hmeblkp = hmebp->hmeblkp;
9211 			pr_hblk = NULL;
9212 			while (hmeblkp) {
9213 				nx_hblk = hmeblkp->hblk_next;
9214 				if (!hmeblkp->hblk_vcnt &&
9215 				    !hmeblkp->hblk_hmecnt) {
9216 					sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9217 					    pr_hblk, &list, 0);
9218 				} else {
9219 					pr_hblk = hmeblkp;
9220 				}
9221 				hmeblkp = nx_hblk;
9222 			}
9223 			SFMMU_HASH_UNLOCK(hmebp);
9224 		}
9225 		if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
9226 			hmebp = uhme_hash;
9227 	}
9228 
9229 	hmebp = khmehash_reclaim_hand;
9230 	if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
9231 		khmehash_reclaim_hand = hmebp = khme_hash;
9232 	khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9233 
9234 	for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9235 		if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9236 			hmeblkp = hmebp->hmeblkp;
9237 			pr_hblk = NULL;
9238 			while (hmeblkp) {
9239 				nx_hblk = hmeblkp->hblk_next;
9240 				if (!hmeblkp->hblk_vcnt &&
9241 				    !hmeblkp->hblk_hmecnt) {
9242 					sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9243 					    pr_hblk, &list, 0);
9244 				} else {
9245 					pr_hblk = hmeblkp;
9246 				}
9247 				hmeblkp = nx_hblk;
9248 			}
9249 			SFMMU_HASH_UNLOCK(hmebp);
9250 		}
9251 		if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9252 			hmebp = khme_hash;
9253 	}
9254 	sfmmu_hblks_list_purge(&list, 0);
9255 }
9256 
9257 /*
9258  * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9259  * same goes for sfmmu_get_addrvcolor().
9260  *
9261  * This function will return the virtual color for the specified page. The
9262  * virtual color corresponds to this page current mapping or its last mapping.
9263  * It is used by memory allocators to choose addresses with the correct
9264  * alignment so vac consistency is automatically maintained.  If the page
9265  * has no color it returns -1.
9266  */
9267 /*ARGSUSED*/
9268 int
9269 sfmmu_get_ppvcolor(struct page *pp)
9270 {
9271 #ifdef VAC
9272 	int color;
9273 
9274 	if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9275 		return (-1);
9276 	}
9277 	color = PP_GET_VCOLOR(pp);
9278 	ASSERT(color < mmu_btop(shm_alignment));
9279 	return (color);
9280 #else
9281 	return (-1);
9282 #endif	/* VAC */
9283 }
9284 
9285 /*
9286  * This function will return the desired alignment for vac consistency
9287  * (vac color) given a virtual address.  If no vac is present it returns -1.
9288  */
9289 /*ARGSUSED*/
9290 int
9291 sfmmu_get_addrvcolor(caddr_t vaddr)
9292 {
9293 #ifdef VAC
9294 	if (cache & CACHE_VAC) {
9295 		return (addr_to_vcolor(vaddr));
9296 	} else {
9297 		return (-1);
9298 	}
9299 #else
9300 	return (-1);
9301 #endif	/* VAC */
9302 }
9303 
9304 #ifdef VAC
9305 /*
9306  * Check for conflicts.
9307  * A conflict exists if the new and existent mappings do not match in
9308  * their "shm_alignment fields. If conflicts exist, the existant mappings
9309  * are flushed unless one of them is locked. If one of them is locked, then
9310  * the mappings are flushed and converted to non-cacheable mappings.
9311  */
9312 static void
9313 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9314 {
9315 	struct hat *tmphat;
9316 	struct sf_hment *sfhmep, *tmphme = NULL;
9317 	struct hme_blk *hmeblkp;
9318 	int vcolor;
9319 	tte_t tte;
9320 
9321 	ASSERT(sfmmu_mlist_held(pp));
9322 	ASSERT(!PP_ISNC(pp));		/* page better be cacheable */
9323 
9324 	vcolor = addr_to_vcolor(addr);
9325 	if (PP_NEWPAGE(pp)) {
9326 		PP_SET_VCOLOR(pp, vcolor);
9327 		return;
9328 	}
9329 
9330 	if (PP_GET_VCOLOR(pp) == vcolor) {
9331 		return;
9332 	}
9333 
9334 	if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9335 		/*
9336 		 * Previous user of page had a different color
9337 		 * but since there are no current users
9338 		 * we just flush the cache and change the color.
9339 		 */
9340 		SFMMU_STAT(sf_pgcolor_conflict);
9341 		sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9342 		PP_SET_VCOLOR(pp, vcolor);
9343 		return;
9344 	}
9345 
9346 	/*
9347 	 * If we get here we have a vac conflict with a current
9348 	 * mapping.  VAC conflict policy is as follows.
9349 	 * - The default is to unload the other mappings unless:
9350 	 * - If we have a large mapping we uncache the page.
9351 	 * We need to uncache the rest of the large page too.
9352 	 * - If any of the mappings are locked we uncache the page.
9353 	 * - If the requested mapping is inconsistent
9354 	 * with another mapping and that mapping
9355 	 * is in the same address space we have to
9356 	 * make it non-cached.  The default thing
9357 	 * to do is unload the inconsistent mapping
9358 	 * but if they are in the same address space
9359 	 * we run the risk of unmapping the pc or the
9360 	 * stack which we will use as we return to the user,
9361 	 * in which case we can then fault on the thing
9362 	 * we just unloaded and get into an infinite loop.
9363 	 */
9364 	if (PP_ISMAPPED_LARGE(pp)) {
9365 		int sz;
9366 
9367 		/*
9368 		 * Existing mapping is for big pages. We don't unload
9369 		 * existing big mappings to satisfy new mappings.
9370 		 * Always convert all mappings to TNC.
9371 		 */
9372 		sz = fnd_mapping_sz(pp);
9373 		pp = PP_GROUPLEADER(pp, sz);
9374 		SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9375 		sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9376 		    TTEPAGES(sz));
9377 
9378 		return;
9379 	}
9380 
9381 	/*
9382 	 * check if any mapping is in same as or if it is locked
9383 	 * since in that case we need to uncache.
9384 	 */
9385 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9386 		tmphme = sfhmep->hme_next;
9387 		if (IS_PAHME(sfhmep))
9388 			continue;
9389 		hmeblkp = sfmmu_hmetohblk(sfhmep);
9390 		if (hmeblkp->hblk_xhat_bit)
9391 			continue;
9392 		tmphat = hblktosfmmu(hmeblkp);
9393 		sfmmu_copytte(&sfhmep->hme_tte, &tte);
9394 		ASSERT(TTE_IS_VALID(&tte));
9395 		if (hmeblkp->hblk_shared || tmphat == hat ||
9396 		    hmeblkp->hblk_lckcnt) {
9397 			/*
9398 			 * We have an uncache conflict
9399 			 */
9400 			SFMMU_STAT(sf_uncache_conflict);
9401 			sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9402 			return;
9403 		}
9404 	}
9405 
9406 	/*
9407 	 * We have an unload conflict
9408 	 * We have already checked for LARGE mappings, therefore
9409 	 * the remaining mapping(s) must be TTE8K.
9410 	 */
9411 	SFMMU_STAT(sf_unload_conflict);
9412 
9413 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9414 		tmphme = sfhmep->hme_next;
9415 		if (IS_PAHME(sfhmep))
9416 			continue;
9417 		hmeblkp = sfmmu_hmetohblk(sfhmep);
9418 		if (hmeblkp->hblk_xhat_bit)
9419 			continue;
9420 		ASSERT(!hmeblkp->hblk_shared);
9421 		(void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9422 	}
9423 
9424 	if (PP_ISMAPPED_KPM(pp))
9425 		sfmmu_kpm_vac_unload(pp, addr);
9426 
9427 	/*
9428 	 * Unloads only do TLB flushes so we need to flush the
9429 	 * cache here.
9430 	 */
9431 	sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9432 	PP_SET_VCOLOR(pp, vcolor);
9433 }
9434 
9435 /*
9436  * Whenever a mapping is unloaded and the page is in TNC state,
9437  * we see if the page can be made cacheable again. 'pp' is
9438  * the page that we just unloaded a mapping from, the size
9439  * of mapping that was unloaded is 'ottesz'.
9440  * Remark:
9441  * The recache policy for mpss pages can leave a performance problem
9442  * under the following circumstances:
9443  * . A large page in uncached mode has just been unmapped.
9444  * . All constituent pages are TNC due to a conflicting small mapping.
9445  * . There are many other, non conflicting, small mappings around for
9446  *   a lot of the constituent pages.
9447  * . We're called w/ the "old" groupleader page and the old ottesz,
9448  *   but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9449  *   we end up w/ TTE8K or npages == 1.
9450  * . We call tst_tnc w/ the old groupleader only, and if there is no
9451  *   conflict, we re-cache only this page.
9452  * . All other small mappings are not checked and will be left in TNC mode.
9453  * The problem is not very serious because:
9454  * . mpss is actually only defined for heap and stack, so the probability
9455  *   is not very high that a large page mapping exists in parallel to a small
9456  *   one (this is possible, but seems to be bad programming style in the
9457  *   appl).
9458  * . The problem gets a little bit more serious, when those TNC pages
9459  *   have to be mapped into kernel space, e.g. for networking.
9460  * . When VAC alias conflicts occur in applications, this is regarded
9461  *   as an application bug. So if kstat's show them, the appl should
9462  *   be changed anyway.
9463  */
9464 void
9465 conv_tnc(page_t *pp, int ottesz)
9466 {
9467 	int cursz, dosz;
9468 	pgcnt_t curnpgs, dopgs;
9469 	pgcnt_t pg64k;
9470 	page_t *pp2;
9471 
9472 	/*
9473 	 * Determine how big a range we check for TNC and find
9474 	 * leader page. cursz is the size of the biggest
9475 	 * mapping that still exist on 'pp'.
9476 	 */
9477 	if (PP_ISMAPPED_LARGE(pp)) {
9478 		cursz = fnd_mapping_sz(pp);
9479 	} else {
9480 		cursz = TTE8K;
9481 	}
9482 
9483 	if (ottesz >= cursz) {
9484 		dosz = ottesz;
9485 		pp2 = pp;
9486 	} else {
9487 		dosz = cursz;
9488 		pp2 = PP_GROUPLEADER(pp, dosz);
9489 	}
9490 
9491 	pg64k = TTEPAGES(TTE64K);
9492 	dopgs = TTEPAGES(dosz);
9493 
9494 	ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9495 
9496 	while (dopgs != 0) {
9497 		curnpgs = TTEPAGES(cursz);
9498 		if (tst_tnc(pp2, curnpgs)) {
9499 			SFMMU_STAT_ADD(sf_recache, curnpgs);
9500 			sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9501 			    curnpgs);
9502 		}
9503 
9504 		ASSERT(dopgs >= curnpgs);
9505 		dopgs -= curnpgs;
9506 
9507 		if (dopgs == 0) {
9508 			break;
9509 		}
9510 
9511 		pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9512 		if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9513 			cursz = fnd_mapping_sz(pp2);
9514 		} else {
9515 			cursz = TTE8K;
9516 		}
9517 	}
9518 }
9519 
9520 /*
9521  * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9522  * returns 0 otherwise. Note that oaddr argument is valid for only
9523  * 8k pages.
9524  */
9525 int
9526 tst_tnc(page_t *pp, pgcnt_t npages)
9527 {
9528 	struct	sf_hment *sfhme;
9529 	struct	hme_blk *hmeblkp;
9530 	tte_t	tte;
9531 	caddr_t	vaddr;
9532 	int	clr_valid = 0;
9533 	int 	color, color1, bcolor;
9534 	int	i, ncolors;
9535 
9536 	ASSERT(pp != NULL);
9537 	ASSERT(!(cache & CACHE_WRITEBACK));
9538 
9539 	if (npages > 1) {
9540 		ncolors = CACHE_NUM_COLOR;
9541 	}
9542 
9543 	for (i = 0; i < npages; i++) {
9544 		ASSERT(sfmmu_mlist_held(pp));
9545 		ASSERT(PP_ISTNC(pp));
9546 		ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9547 
9548 		if (PP_ISPNC(pp)) {
9549 			return (0);
9550 		}
9551 
9552 		clr_valid = 0;
9553 		if (PP_ISMAPPED_KPM(pp)) {
9554 			caddr_t kpmvaddr;
9555 
9556 			ASSERT(kpm_enable);
9557 			kpmvaddr = hat_kpm_page2va(pp, 1);
9558 			ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9559 			color1 = addr_to_vcolor(kpmvaddr);
9560 			clr_valid = 1;
9561 		}
9562 
9563 		for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9564 			if (IS_PAHME(sfhme))
9565 				continue;
9566 			hmeblkp = sfmmu_hmetohblk(sfhme);
9567 			if (hmeblkp->hblk_xhat_bit)
9568 				continue;
9569 
9570 			sfmmu_copytte(&sfhme->hme_tte, &tte);
9571 			ASSERT(TTE_IS_VALID(&tte));
9572 
9573 			vaddr = tte_to_vaddr(hmeblkp, tte);
9574 			color = addr_to_vcolor(vaddr);
9575 
9576 			if (npages > 1) {
9577 				/*
9578 				 * If there is a big mapping, make sure
9579 				 * 8K mapping is consistent with the big
9580 				 * mapping.
9581 				 */
9582 				bcolor = i % ncolors;
9583 				if (color != bcolor) {
9584 					return (0);
9585 				}
9586 			}
9587 			if (!clr_valid) {
9588 				clr_valid = 1;
9589 				color1 = color;
9590 			}
9591 
9592 			if (color1 != color) {
9593 				return (0);
9594 			}
9595 		}
9596 
9597 		pp = PP_PAGENEXT(pp);
9598 	}
9599 
9600 	return (1);
9601 }
9602 
9603 void
9604 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9605 	pgcnt_t npages)
9606 {
9607 	kmutex_t *pmtx;
9608 	int i, ncolors, bcolor;
9609 	kpm_hlk_t *kpmp;
9610 	cpuset_t cpuset;
9611 
9612 	ASSERT(pp != NULL);
9613 	ASSERT(!(cache & CACHE_WRITEBACK));
9614 
9615 	kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9616 	pmtx = sfmmu_page_enter(pp);
9617 
9618 	/*
9619 	 * Fast path caching single unmapped page
9620 	 */
9621 	if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9622 	    flags == HAT_CACHE) {
9623 		PP_CLRTNC(pp);
9624 		PP_CLRPNC(pp);
9625 		sfmmu_page_exit(pmtx);
9626 		sfmmu_kpm_kpmp_exit(kpmp);
9627 		return;
9628 	}
9629 
9630 	/*
9631 	 * We need to capture all cpus in order to change cacheability
9632 	 * because we can't allow one cpu to access the same physical
9633 	 * page using a cacheable and a non-cachebale mapping at the same
9634 	 * time. Since we may end up walking the ism mapping list
9635 	 * have to grab it's lock now since we can't after all the
9636 	 * cpus have been captured.
9637 	 */
9638 	sfmmu_hat_lock_all();
9639 	mutex_enter(&ism_mlist_lock);
9640 	kpreempt_disable();
9641 	cpuset = cpu_ready_set;
9642 	xc_attention(cpuset);
9643 
9644 	if (npages > 1) {
9645 		/*
9646 		 * Make sure all colors are flushed since the
9647 		 * sfmmu_page_cache() only flushes one color-
9648 		 * it does not know big pages.
9649 		 */
9650 		ncolors = CACHE_NUM_COLOR;
9651 		if (flags & HAT_TMPNC) {
9652 			for (i = 0; i < ncolors; i++) {
9653 				sfmmu_cache_flushcolor(i, pp->p_pagenum);
9654 			}
9655 			cache_flush_flag = CACHE_NO_FLUSH;
9656 		}
9657 	}
9658 
9659 	for (i = 0; i < npages; i++) {
9660 
9661 		ASSERT(sfmmu_mlist_held(pp));
9662 
9663 		if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9664 
9665 			if (npages > 1) {
9666 				bcolor = i % ncolors;
9667 			} else {
9668 				bcolor = NO_VCOLOR;
9669 			}
9670 
9671 			sfmmu_page_cache(pp, flags, cache_flush_flag,
9672 			    bcolor);
9673 		}
9674 
9675 		pp = PP_PAGENEXT(pp);
9676 	}
9677 
9678 	xt_sync(cpuset);
9679 	xc_dismissed(cpuset);
9680 	mutex_exit(&ism_mlist_lock);
9681 	sfmmu_hat_unlock_all();
9682 	sfmmu_page_exit(pmtx);
9683 	sfmmu_kpm_kpmp_exit(kpmp);
9684 	kpreempt_enable();
9685 }
9686 
9687 /*
9688  * This function changes the virtual cacheability of all mappings to a
9689  * particular page.  When changing from uncache to cacheable the mappings will
9690  * only be changed if all of them have the same virtual color.
9691  * We need to flush the cache in all cpus.  It is possible that
9692  * a process referenced a page as cacheable but has sinced exited
9693  * and cleared the mapping list.  We still to flush it but have no
9694  * state so all cpus is the only alternative.
9695  */
9696 static void
9697 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9698 {
9699 	struct	sf_hment *sfhme;
9700 	struct	hme_blk *hmeblkp;
9701 	sfmmu_t *sfmmup;
9702 	tte_t	tte, ttemod;
9703 	caddr_t	vaddr;
9704 	int	ret, color;
9705 	pfn_t	pfn;
9706 
9707 	color = bcolor;
9708 	pfn = pp->p_pagenum;
9709 
9710 	for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9711 
9712 		if (IS_PAHME(sfhme))
9713 			continue;
9714 		hmeblkp = sfmmu_hmetohblk(sfhme);
9715 
9716 		if (hmeblkp->hblk_xhat_bit)
9717 			continue;
9718 
9719 		sfmmu_copytte(&sfhme->hme_tte, &tte);
9720 		ASSERT(TTE_IS_VALID(&tte));
9721 		vaddr = tte_to_vaddr(hmeblkp, tte);
9722 		color = addr_to_vcolor(vaddr);
9723 
9724 #ifdef DEBUG
9725 		if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9726 			ASSERT(color == bcolor);
9727 		}
9728 #endif
9729 
9730 		ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9731 
9732 		ttemod = tte;
9733 		if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9734 			TTE_CLR_VCACHEABLE(&ttemod);
9735 		} else {	/* flags & HAT_CACHE */
9736 			TTE_SET_VCACHEABLE(&ttemod);
9737 		}
9738 		ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9739 		if (ret < 0) {
9740 			/*
9741 			 * Since all cpus are captured modifytte should not
9742 			 * fail.
9743 			 */
9744 			panic("sfmmu_page_cache: write to tte failed");
9745 		}
9746 
9747 		sfmmup = hblktosfmmu(hmeblkp);
9748 		if (cache_flush_flag == CACHE_FLUSH) {
9749 			/*
9750 			 * Flush TSBs, TLBs and caches
9751 			 */
9752 			if (hmeblkp->hblk_shared) {
9753 				sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9754 				uint_t rid = hmeblkp->hblk_tag.htag_rid;
9755 				sf_region_t *rgnp;
9756 				ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9757 				ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9758 				ASSERT(srdp != NULL);
9759 				rgnp = srdp->srd_hmergnp[rid];
9760 				SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9761 				    srdp, rgnp, rid);
9762 				(void) sfmmu_rgntlb_demap(vaddr, rgnp,
9763 				    hmeblkp, 0);
9764 				sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9765 			} else if (sfmmup->sfmmu_ismhat) {
9766 				if (flags & HAT_CACHE) {
9767 					SFMMU_STAT(sf_ism_recache);
9768 				} else {
9769 					SFMMU_STAT(sf_ism_uncache);
9770 				}
9771 				sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9772 				    pfn, CACHE_FLUSH);
9773 			} else {
9774 				sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9775 				    pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9776 			}
9777 
9778 			/*
9779 			 * all cache entries belonging to this pfn are
9780 			 * now flushed.
9781 			 */
9782 			cache_flush_flag = CACHE_NO_FLUSH;
9783 		} else {
9784 			/*
9785 			 * Flush only TSBs and TLBs.
9786 			 */
9787 			if (hmeblkp->hblk_shared) {
9788 				sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9789 				uint_t rid = hmeblkp->hblk_tag.htag_rid;
9790 				sf_region_t *rgnp;
9791 				ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9792 				ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9793 				ASSERT(srdp != NULL);
9794 				rgnp = srdp->srd_hmergnp[rid];
9795 				SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9796 				    srdp, rgnp, rid);
9797 				(void) sfmmu_rgntlb_demap(vaddr, rgnp,
9798 				    hmeblkp, 0);
9799 			} else if (sfmmup->sfmmu_ismhat) {
9800 				if (flags & HAT_CACHE) {
9801 					SFMMU_STAT(sf_ism_recache);
9802 				} else {
9803 					SFMMU_STAT(sf_ism_uncache);
9804 				}
9805 				sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9806 				    pfn, CACHE_NO_FLUSH);
9807 			} else {
9808 				sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9809 			}
9810 		}
9811 	}
9812 
9813 	if (PP_ISMAPPED_KPM(pp))
9814 		sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9815 
9816 	switch (flags) {
9817 
9818 		default:
9819 			panic("sfmmu_pagecache: unknown flags");
9820 			break;
9821 
9822 		case HAT_CACHE:
9823 			PP_CLRTNC(pp);
9824 			PP_CLRPNC(pp);
9825 			PP_SET_VCOLOR(pp, color);
9826 			break;
9827 
9828 		case HAT_TMPNC:
9829 			PP_SETTNC(pp);
9830 			PP_SET_VCOLOR(pp, NO_VCOLOR);
9831 			break;
9832 
9833 		case HAT_UNCACHE:
9834 			PP_SETPNC(pp);
9835 			PP_CLRTNC(pp);
9836 			PP_SET_VCOLOR(pp, NO_VCOLOR);
9837 			break;
9838 	}
9839 }
9840 #endif	/* VAC */
9841 
9842 
9843 /*
9844  * Wrapper routine used to return a context.
9845  *
9846  * It's the responsibility of the caller to guarantee that the
9847  * process serializes on calls here by taking the HAT lock for
9848  * the hat.
9849  *
9850  */
9851 static void
9852 sfmmu_get_ctx(sfmmu_t *sfmmup)
9853 {
9854 	mmu_ctx_t *mmu_ctxp;
9855 	uint_t pstate_save;
9856 	int ret;
9857 
9858 	ASSERT(sfmmu_hat_lock_held(sfmmup));
9859 	ASSERT(sfmmup != ksfmmup);
9860 
9861 	if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9862 		sfmmu_setup_tsbinfo(sfmmup);
9863 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9864 	}
9865 
9866 	kpreempt_disable();
9867 
9868 	mmu_ctxp = CPU_MMU_CTXP(CPU);
9869 	ASSERT(mmu_ctxp);
9870 	ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9871 	ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9872 
9873 	/*
9874 	 * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9875 	 */
9876 	if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9877 		sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9878 
9879 	/*
9880 	 * Let the MMU set up the page sizes to use for
9881 	 * this context in the TLB. Don't program 2nd dtlb for ism hat.
9882 	 */
9883 	if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9884 		mmu_set_ctx_page_sizes(sfmmup);
9885 	}
9886 
9887 	/*
9888 	 * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9889 	 * interrupts disabled to prevent race condition with wrap-around
9890 	 * ctx invalidatation. In sun4v, ctx invalidation also involves
9891 	 * a HV call to set the number of TSBs to 0. If interrupts are not
9892 	 * disabled until after sfmmu_load_mmustate is complete TSBs may
9893 	 * become assigned to INVALID_CONTEXT. This is not allowed.
9894 	 */
9895 	pstate_save = sfmmu_disable_intrs();
9896 
9897 	if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9898 	    sfmmup->sfmmu_scdp != NULL) {
9899 		sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9900 		sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9901 		ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9902 		/* debug purpose only */
9903 		ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9904 		    != INVALID_CONTEXT);
9905 	}
9906 	sfmmu_load_mmustate(sfmmup);
9907 
9908 	sfmmu_enable_intrs(pstate_save);
9909 
9910 	kpreempt_enable();
9911 }
9912 
9913 /*
9914  * When all cnums are used up in a MMU, cnum will wrap around to the
9915  * next generation and start from 2.
9916  */
9917 static void
9918 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9919 {
9920 
9921 	/* caller must have disabled the preemption */
9922 	ASSERT(curthread->t_preempt >= 1);
9923 	ASSERT(mmu_ctxp != NULL);
9924 
9925 	/* acquire Per-MMU (PM) spin lock */
9926 	mutex_enter(&mmu_ctxp->mmu_lock);
9927 
9928 	/* re-check to see if wrap-around is needed */
9929 	if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9930 		goto done;
9931 
9932 	SFMMU_MMU_STAT(mmu_wrap_around);
9933 
9934 	/* update gnum */
9935 	ASSERT(mmu_ctxp->mmu_gnum != 0);
9936 	mmu_ctxp->mmu_gnum++;
9937 	if (mmu_ctxp->mmu_gnum == 0 ||
9938 	    mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9939 		cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9940 		    (void *)mmu_ctxp);
9941 	}
9942 
9943 	if (mmu_ctxp->mmu_ncpus > 1) {
9944 		cpuset_t cpuset;
9945 
9946 		membar_enter(); /* make sure updated gnum visible */
9947 
9948 		SFMMU_XCALL_STATS(NULL);
9949 
9950 		/* xcall to others on the same MMU to invalidate ctx */
9951 		cpuset = mmu_ctxp->mmu_cpuset;
9952 		ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9953 		CPUSET_DEL(cpuset, CPU->cpu_id);
9954 		CPUSET_AND(cpuset, cpu_ready_set);
9955 
9956 		/*
9957 		 * Pass in INVALID_CONTEXT as the first parameter to
9958 		 * sfmmu_raise_tsb_exception, which invalidates the context
9959 		 * of any process running on the CPUs in the MMU.
9960 		 */
9961 		xt_some(cpuset, sfmmu_raise_tsb_exception,
9962 		    INVALID_CONTEXT, INVALID_CONTEXT);
9963 		xt_sync(cpuset);
9964 
9965 		SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9966 	}
9967 
9968 	if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9969 		sfmmu_setctx_sec(INVALID_CONTEXT);
9970 		sfmmu_clear_utsbinfo();
9971 	}
9972 
9973 	/*
9974 	 * No xcall is needed here. For sun4u systems all CPUs in context
9975 	 * domain share a single physical MMU therefore it's enough to flush
9976 	 * TLB on local CPU. On sun4v systems we use 1 global context
9977 	 * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9978 	 * handler. Note that vtag_flushall_uctxs() is called
9979 	 * for Ultra II machine, where the equivalent flushall functionality
9980 	 * is implemented in SW, and only user ctx TLB entries are flushed.
9981 	 */
9982 	if (&vtag_flushall_uctxs != NULL) {
9983 		vtag_flushall_uctxs();
9984 	} else {
9985 		vtag_flushall();
9986 	}
9987 
9988 	/* reset mmu cnum, skips cnum 0 and 1 */
9989 	if (reset_cnum == B_TRUE)
9990 		mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9991 
9992 done:
9993 	mutex_exit(&mmu_ctxp->mmu_lock);
9994 }
9995 
9996 
9997 /*
9998  * For multi-threaded process, set the process context to INVALID_CONTEXT
9999  * so that it faults and reloads the MMU state from TL=0. For single-threaded
10000  * process, we can just load the MMU state directly without having to
10001  * set context invalid. Caller must hold the hat lock since we don't
10002  * acquire it here.
10003  */
10004 static void
10005 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
10006 {
10007 	uint_t cnum;
10008 	uint_t pstate_save;
10009 
10010 	ASSERT(sfmmup != ksfmmup);
10011 	ASSERT(sfmmu_hat_lock_held(sfmmup));
10012 
10013 	kpreempt_disable();
10014 
10015 	/*
10016 	 * We check whether the pass'ed-in sfmmup is the same as the
10017 	 * current running proc. This is to makes sure the current proc
10018 	 * stays single-threaded if it already is.
10019 	 */
10020 	if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
10021 	    (curthread->t_procp->p_lwpcnt == 1)) {
10022 		/* single-thread */
10023 		cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
10024 		if (cnum != INVALID_CONTEXT) {
10025 			uint_t curcnum;
10026 			/*
10027 			 * Disable interrupts to prevent race condition
10028 			 * with sfmmu_ctx_wrap_around ctx invalidation.
10029 			 * In sun4v, ctx invalidation involves setting
10030 			 * TSB to NULL, hence, interrupts should be disabled
10031 			 * untill after sfmmu_load_mmustate is completed.
10032 			 */
10033 			pstate_save = sfmmu_disable_intrs();
10034 			curcnum = sfmmu_getctx_sec();
10035 			if (curcnum == cnum)
10036 				sfmmu_load_mmustate(sfmmup);
10037 			sfmmu_enable_intrs(pstate_save);
10038 			ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
10039 		}
10040 	} else {
10041 		/*
10042 		 * multi-thread
10043 		 * or when sfmmup is not the same as the curproc.
10044 		 */
10045 		sfmmu_invalidate_ctx(sfmmup);
10046 	}
10047 
10048 	kpreempt_enable();
10049 }
10050 
10051 
10052 /*
10053  * Replace the specified TSB with a new TSB.  This function gets called when
10054  * we grow, shrink or swapin a TSB.  When swapping in a TSB (TSB_SWAPIN), the
10055  * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
10056  * (8K).
10057  *
10058  * Caller must hold the HAT lock, but should assume any tsb_info
10059  * pointers it has are no longer valid after calling this function.
10060  *
10061  * Return values:
10062  *	TSB_ALLOCFAIL	Failed to allocate a TSB, due to memory constraints
10063  *	TSB_LOSTRACE	HAT is busy, i.e. another thread is already doing
10064  *			something to this tsbinfo/TSB
10065  *	TSB_SUCCESS	Operation succeeded
10066  */
10067 static tsb_replace_rc_t
10068 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
10069     hatlock_t *hatlockp, uint_t flags)
10070 {
10071 	struct tsb_info *new_tsbinfo = NULL;
10072 	struct tsb_info *curtsb, *prevtsb;
10073 	uint_t tte_sz_mask;
10074 	int i;
10075 
10076 	ASSERT(sfmmup != ksfmmup);
10077 	ASSERT(sfmmup->sfmmu_ismhat == 0);
10078 	ASSERT(sfmmu_hat_lock_held(sfmmup));
10079 	ASSERT(szc <= tsb_max_growsize);
10080 
10081 	if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
10082 		return (TSB_LOSTRACE);
10083 
10084 	/*
10085 	 * Find the tsb_info ahead of this one in the list, and
10086 	 * also make sure that the tsb_info passed in really
10087 	 * exists!
10088 	 */
10089 	for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
10090 	    curtsb != old_tsbinfo && curtsb != NULL;
10091 	    prevtsb = curtsb, curtsb = curtsb->tsb_next)
10092 		;
10093 	ASSERT(curtsb != NULL);
10094 
10095 	if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
10096 		/*
10097 		 * The process is swapped out, so just set the new size
10098 		 * code.  When it swaps back in, we'll allocate a new one
10099 		 * of the new chosen size.
10100 		 */
10101 		curtsb->tsb_szc = szc;
10102 		return (TSB_SUCCESS);
10103 	}
10104 	SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
10105 
10106 	tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
10107 
10108 	/*
10109 	 * All initialization is done inside of sfmmu_tsbinfo_alloc().
10110 	 * If we fail to allocate a TSB, exit.
10111 	 *
10112 	 * If tsb grows with new tsb size > 4M and old tsb size < 4M,
10113 	 * then try 4M slab after the initial alloc fails.
10114 	 *
10115 	 * If tsb swapin with tsb size > 4M, then try 4M after the
10116 	 * initial alloc fails.
10117 	 */
10118 	sfmmu_hat_exit(hatlockp);
10119 	if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
10120 	    tte_sz_mask, flags, sfmmup) &&
10121 	    (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
10122 	    (!(flags & TSB_SWAPIN) &&
10123 	    (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
10124 	    sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
10125 	    tte_sz_mask, flags, sfmmup))) {
10126 		(void) sfmmu_hat_enter(sfmmup);
10127 		if (!(flags & TSB_SWAPIN))
10128 			SFMMU_STAT(sf_tsb_resize_failures);
10129 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10130 		return (TSB_ALLOCFAIL);
10131 	}
10132 	(void) sfmmu_hat_enter(sfmmup);
10133 
10134 	/*
10135 	 * Re-check to make sure somebody else didn't muck with us while we
10136 	 * didn't hold the HAT lock.  If the process swapped out, fine, just
10137 	 * exit; this can happen if we try to shrink the TSB from the context
10138 	 * of another process (such as on an ISM unmap), though it is rare.
10139 	 */
10140 	if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
10141 		SFMMU_STAT(sf_tsb_resize_failures);
10142 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10143 		sfmmu_hat_exit(hatlockp);
10144 		sfmmu_tsbinfo_free(new_tsbinfo);
10145 		(void) sfmmu_hat_enter(sfmmup);
10146 		return (TSB_LOSTRACE);
10147 	}
10148 
10149 #ifdef	DEBUG
10150 	/* Reverify that the tsb_info still exists.. for debugging only */
10151 	for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
10152 	    curtsb != old_tsbinfo && curtsb != NULL;
10153 	    prevtsb = curtsb, curtsb = curtsb->tsb_next)
10154 		;
10155 	ASSERT(curtsb != NULL);
10156 #endif	/* DEBUG */
10157 
10158 	/*
10159 	 * Quiesce any CPUs running this process on their next TLB miss
10160 	 * so they atomically see the new tsb_info.  We temporarily set the
10161 	 * context to invalid context so new threads that come on processor
10162 	 * after we do the xcall to cpusran will also serialize behind the
10163 	 * HAT lock on TLB miss and will see the new TSB.  Since this short
10164 	 * race with a new thread coming on processor is relatively rare,
10165 	 * this synchronization mechanism should be cheaper than always
10166 	 * pausing all CPUs for the duration of the setup, which is what
10167 	 * the old implementation did.  This is particuarly true if we are
10168 	 * copying a huge chunk of memory around during that window.
10169 	 *
10170 	 * The memory barriers are to make sure things stay consistent
10171 	 * with resume() since it does not hold the HAT lock while
10172 	 * walking the list of tsb_info structures.
10173 	 */
10174 	if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
10175 		/* The TSB is either growing or shrinking. */
10176 		sfmmu_invalidate_ctx(sfmmup);
10177 	} else {
10178 		/*
10179 		 * It is illegal to swap in TSBs from a process other
10180 		 * than a process being swapped in.  This in turn
10181 		 * implies we do not have a valid MMU context here
10182 		 * since a process needs one to resolve translation
10183 		 * misses.
10184 		 */
10185 		ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
10186 	}
10187 
10188 #ifdef DEBUG
10189 	ASSERT(max_mmu_ctxdoms > 0);
10190 
10191 	/*
10192 	 * Process should have INVALID_CONTEXT on all MMUs
10193 	 */
10194 	for (i = 0; i < max_mmu_ctxdoms; i++) {
10195 
10196 		ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
10197 	}
10198 #endif
10199 
10200 	new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
10201 	membar_stst();	/* strict ordering required */
10202 	if (prevtsb)
10203 		prevtsb->tsb_next = new_tsbinfo;
10204 	else
10205 		sfmmup->sfmmu_tsb = new_tsbinfo;
10206 	membar_enter();	/* make sure new TSB globally visible */
10207 
10208 	/*
10209 	 * We need to migrate TSB entries from the old TSB to the new TSB
10210 	 * if tsb_remap_ttes is set and the TSB is growing.
10211 	 */
10212 	if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
10213 		sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
10214 
10215 	SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
10216 
10217 	/*
10218 	 * Drop the HAT lock to free our old tsb_info.
10219 	 */
10220 	sfmmu_hat_exit(hatlockp);
10221 
10222 	if ((flags & TSB_GROW) == TSB_GROW) {
10223 		SFMMU_STAT(sf_tsb_grow);
10224 	} else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
10225 		SFMMU_STAT(sf_tsb_shrink);
10226 	}
10227 
10228 	sfmmu_tsbinfo_free(old_tsbinfo);
10229 
10230 	(void) sfmmu_hat_enter(sfmmup);
10231 	return (TSB_SUCCESS);
10232 }
10233 
10234 /*
10235  * This function will re-program hat pgsz array, and invalidate the
10236  * process' context, forcing the process to switch to another
10237  * context on the next TLB miss, and therefore start using the
10238  * TLB that is reprogrammed for the new page sizes.
10239  */
10240 void
10241 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
10242 {
10243 	int i;
10244 	hatlock_t *hatlockp = NULL;
10245 
10246 	hatlockp = sfmmu_hat_enter(sfmmup);
10247 	/* USIII+-IV+ optimization, requires hat lock */
10248 	if (tmp_pgsz) {
10249 		for (i = 0; i < mmu_page_sizes; i++)
10250 			sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
10251 	}
10252 	SFMMU_STAT(sf_tlb_reprog_pgsz);
10253 
10254 	sfmmu_invalidate_ctx(sfmmup);
10255 
10256 	sfmmu_hat_exit(hatlockp);
10257 }
10258 
10259 /*
10260  * The scd_rttecnt field in the SCD must be updated to take account of the
10261  * regions which it contains.
10262  */
10263 static void
10264 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10265 {
10266 	uint_t rid;
10267 	uint_t i, j;
10268 	ulong_t w;
10269 	sf_region_t *rgnp;
10270 
10271 	ASSERT(srdp != NULL);
10272 
10273 	for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10274 		if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10275 			continue;
10276 		}
10277 
10278 		j = 0;
10279 		while (w) {
10280 			if (!(w & 0x1)) {
10281 				j++;
10282 				w >>= 1;
10283 				continue;
10284 			}
10285 			rid = (i << BT_ULSHIFT) | j;
10286 			j++;
10287 			w >>= 1;
10288 
10289 			ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10290 			ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10291 			rgnp = srdp->srd_hmergnp[rid];
10292 			ASSERT(rgnp->rgn_refcnt > 0);
10293 			ASSERT(rgnp->rgn_id == rid);
10294 
10295 			scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10296 			    rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10297 
10298 			/*
10299 			 * Maintain the tsb0 inflation cnt for the regions
10300 			 * in the SCD.
10301 			 */
10302 			if (rgnp->rgn_pgszc >= TTE4M) {
10303 				scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10304 				    rgnp->rgn_size >>
10305 				    (TTE_PAGE_SHIFT(TTE8K) + 2);
10306 			}
10307 		}
10308 	}
10309 }
10310 
10311 /*
10312  * This function assumes that there are either four or six supported page
10313  * sizes and at most two programmable TLBs, so we need to decide which
10314  * page sizes are most important and then tell the MMU layer so it
10315  * can adjust the TLB page sizes accordingly (if supported).
10316  *
10317  * If these assumptions change, this function will need to be
10318  * updated to support whatever the new limits are.
10319  *
10320  * The growing flag is nonzero if we are growing the address space,
10321  * and zero if it is shrinking.  This allows us to decide whether
10322  * to grow or shrink our TSB, depending upon available memory
10323  * conditions.
10324  */
10325 static void
10326 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10327 {
10328 	uint64_t ttecnt[MMU_PAGE_SIZES];
10329 	uint64_t tte8k_cnt, tte4m_cnt;
10330 	uint8_t i;
10331 	int sectsb_thresh;
10332 
10333 	/*
10334 	 * Kernel threads, processes with small address spaces not using
10335 	 * large pages, and dummy ISM HATs need not apply.
10336 	 */
10337 	if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10338 		return;
10339 
10340 	if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10341 	    sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10342 		return;
10343 
10344 	for (i = 0; i < mmu_page_sizes; i++) {
10345 		ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10346 		    sfmmup->sfmmu_ismttecnt[i];
10347 	}
10348 
10349 	/* Check pagesizes in use, and possibly reprogram DTLB. */
10350 	if (&mmu_check_page_sizes)
10351 		mmu_check_page_sizes(sfmmup, ttecnt);
10352 
10353 	/*
10354 	 * Calculate the number of 8k ttes to represent the span of these
10355 	 * pages.
10356 	 */
10357 	tte8k_cnt = ttecnt[TTE8K] +
10358 	    (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10359 	    (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10360 	if (mmu_page_sizes == max_mmu_page_sizes) {
10361 		tte4m_cnt = ttecnt[TTE4M] +
10362 		    (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10363 		    (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10364 	} else {
10365 		tte4m_cnt = ttecnt[TTE4M];
10366 	}
10367 
10368 	/*
10369 	 * Inflate tte8k_cnt to allow for region large page allocation failure.
10370 	 */
10371 	tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10372 
10373 	/*
10374 	 * Inflate TSB sizes by a factor of 2 if this process
10375 	 * uses 4M text pages to minimize extra conflict misses
10376 	 * in the first TSB since without counting text pages
10377 	 * 8K TSB may become too small.
10378 	 *
10379 	 * Also double the size of the second TSB to minimize
10380 	 * extra conflict misses due to competition between 4M text pages
10381 	 * and data pages.
10382 	 *
10383 	 * We need to adjust the second TSB allocation threshold by the
10384 	 * inflation factor, since there is no point in creating a second
10385 	 * TSB when we know all the mappings can fit in the I/D TLBs.
10386 	 */
10387 	sectsb_thresh = tsb_sectsb_threshold;
10388 	if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10389 		tte8k_cnt <<= 1;
10390 		tte4m_cnt <<= 1;
10391 		sectsb_thresh <<= 1;
10392 	}
10393 
10394 	/*
10395 	 * Check to see if our TSB is the right size; we may need to
10396 	 * grow or shrink it.  If the process is small, our work is
10397 	 * finished at this point.
10398 	 */
10399 	if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10400 		return;
10401 	}
10402 	sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10403 }
10404 
10405 static void
10406 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10407 	uint64_t tte4m_cnt, int sectsb_thresh)
10408 {
10409 	int tsb_bits;
10410 	uint_t tsb_szc;
10411 	struct tsb_info *tsbinfop;
10412 	hatlock_t *hatlockp = NULL;
10413 
10414 	hatlockp = sfmmu_hat_enter(sfmmup);
10415 	ASSERT(hatlockp != NULL);
10416 	tsbinfop = sfmmup->sfmmu_tsb;
10417 	ASSERT(tsbinfop != NULL);
10418 
10419 	/*
10420 	 * If we're growing, select the size based on RSS.  If we're
10421 	 * shrinking, leave some room so we don't have to turn around and
10422 	 * grow again immediately.
10423 	 */
10424 	if (growing)
10425 		tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10426 	else
10427 		tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10428 
10429 	if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10430 	    (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10431 		(void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10432 		    hatlockp, TSB_SHRINK);
10433 	} else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10434 		(void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10435 		    hatlockp, TSB_GROW);
10436 	}
10437 	tsbinfop = sfmmup->sfmmu_tsb;
10438 
10439 	/*
10440 	 * With the TLB and first TSB out of the way, we need to see if
10441 	 * we need a second TSB for 4M pages.  If we managed to reprogram
10442 	 * the TLB page sizes above, the process will start using this new
10443 	 * TSB right away; otherwise, it will start using it on the next
10444 	 * context switch.  Either way, it's no big deal so there's no
10445 	 * synchronization with the trap handlers here unless we grow the
10446 	 * TSB (in which case it's required to prevent using the old one
10447 	 * after it's freed). Note: second tsb is required for 32M/256M
10448 	 * page sizes.
10449 	 */
10450 	if (tte4m_cnt > sectsb_thresh) {
10451 		/*
10452 		 * If we're growing, select the size based on RSS.  If we're
10453 		 * shrinking, leave some room so we don't have to turn
10454 		 * around and grow again immediately.
10455 		 */
10456 		if (growing)
10457 			tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10458 		else
10459 			tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10460 		if (tsbinfop->tsb_next == NULL) {
10461 			struct tsb_info *newtsb;
10462 			int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10463 			    0 : TSB_ALLOC;
10464 
10465 			sfmmu_hat_exit(hatlockp);
10466 
10467 			/*
10468 			 * Try to allocate a TSB for 4[32|256]M pages.  If we
10469 			 * can't get the size we want, retry w/a minimum sized
10470 			 * TSB.  If that still didn't work, give up; we can
10471 			 * still run without one.
10472 			 */
10473 			tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10474 			    TSB4M|TSB32M|TSB256M:TSB4M;
10475 			if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10476 			    allocflags, sfmmup)) &&
10477 			    (tsb_szc <= TSB_4M_SZCODE ||
10478 			    sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10479 			    tsb_bits, allocflags, sfmmup)) &&
10480 			    sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10481 			    tsb_bits, allocflags, sfmmup)) {
10482 				return;
10483 			}
10484 
10485 			hatlockp = sfmmu_hat_enter(sfmmup);
10486 
10487 			sfmmu_invalidate_ctx(sfmmup);
10488 
10489 			if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10490 				sfmmup->sfmmu_tsb->tsb_next = newtsb;
10491 				SFMMU_STAT(sf_tsb_sectsb_create);
10492 				sfmmu_hat_exit(hatlockp);
10493 				return;
10494 			} else {
10495 				/*
10496 				 * It's annoying, but possible for us
10497 				 * to get here.. we dropped the HAT lock
10498 				 * because of locking order in the kmem
10499 				 * allocator, and while we were off getting
10500 				 * our memory, some other thread decided to
10501 				 * do us a favor and won the race to get a
10502 				 * second TSB for this process.  Sigh.
10503 				 */
10504 				sfmmu_hat_exit(hatlockp);
10505 				sfmmu_tsbinfo_free(newtsb);
10506 				return;
10507 			}
10508 		}
10509 
10510 		/*
10511 		 * We have a second TSB, see if it's big enough.
10512 		 */
10513 		tsbinfop = tsbinfop->tsb_next;
10514 
10515 		/*
10516 		 * Check to see if our second TSB is the right size;
10517 		 * we may need to grow or shrink it.
10518 		 * To prevent thrashing (e.g. growing the TSB on a
10519 		 * subsequent map operation), only try to shrink if
10520 		 * the TSB reach exceeds twice the virtual address
10521 		 * space size.
10522 		 */
10523 		if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10524 		    (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10525 			(void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10526 			    tsb_szc, hatlockp, TSB_SHRINK);
10527 		} else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10528 		    TSB_OK_GROW()) {
10529 			(void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10530 			    tsb_szc, hatlockp, TSB_GROW);
10531 		}
10532 	}
10533 
10534 	sfmmu_hat_exit(hatlockp);
10535 }
10536 
10537 /*
10538  * Free up a sfmmu
10539  * Since the sfmmu is currently embedded in the hat struct we simply zero
10540  * out our fields and free up the ism map blk list if any.
10541  */
10542 static void
10543 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10544 {
10545 	ism_blk_t	*blkp, *nx_blkp;
10546 #ifdef	DEBUG
10547 	ism_map_t	*map;
10548 	int 		i;
10549 #endif
10550 
10551 	ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10552 	ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10553 	ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10554 	ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10555 	ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10556 	ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10557 	ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10558 
10559 	sfmmup->sfmmu_free = 0;
10560 	sfmmup->sfmmu_ismhat = 0;
10561 
10562 	blkp = sfmmup->sfmmu_iblk;
10563 	sfmmup->sfmmu_iblk = NULL;
10564 
10565 	while (blkp) {
10566 #ifdef	DEBUG
10567 		map = blkp->iblk_maps;
10568 		for (i = 0; i < ISM_MAP_SLOTS; i++) {
10569 			ASSERT(map[i].imap_seg == 0);
10570 			ASSERT(map[i].imap_ismhat == NULL);
10571 			ASSERT(map[i].imap_ment == NULL);
10572 		}
10573 #endif
10574 		nx_blkp = blkp->iblk_next;
10575 		blkp->iblk_next = NULL;
10576 		blkp->iblk_nextpa = (uint64_t)-1;
10577 		kmem_cache_free(ism_blk_cache, blkp);
10578 		blkp = nx_blkp;
10579 	}
10580 }
10581 
10582 /*
10583  * Locking primitves accessed by HATLOCK macros
10584  */
10585 
10586 #define	SFMMU_SPL_MTX	(0x0)
10587 #define	SFMMU_ML_MTX	(0x1)
10588 
10589 #define	SFMMU_MLSPL_MTX(type, pg)	(((type) == SFMMU_SPL_MTX) ? \
10590 					    SPL_HASH(pg) : MLIST_HASH(pg))
10591 
10592 kmutex_t *
10593 sfmmu_page_enter(struct page *pp)
10594 {
10595 	return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10596 }
10597 
10598 void
10599 sfmmu_page_exit(kmutex_t *spl)
10600 {
10601 	mutex_exit(spl);
10602 }
10603 
10604 int
10605 sfmmu_page_spl_held(struct page *pp)
10606 {
10607 	return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10608 }
10609 
10610 kmutex_t *
10611 sfmmu_mlist_enter(struct page *pp)
10612 {
10613 	return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10614 }
10615 
10616 void
10617 sfmmu_mlist_exit(kmutex_t *mml)
10618 {
10619 	mutex_exit(mml);
10620 }
10621 
10622 int
10623 sfmmu_mlist_held(struct page *pp)
10624 {
10625 
10626 	return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10627 }
10628 
10629 /*
10630  * Common code for sfmmu_mlist_enter() and sfmmu_page_enter().  For
10631  * sfmmu_mlist_enter() case mml_table lock array is used and for
10632  * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10633  *
10634  * The lock is taken on a root page so that it protects an operation on all
10635  * constituent pages of a large page pp belongs to.
10636  *
10637  * The routine takes a lock from the appropriate array. The lock is determined
10638  * by hashing the root page. After taking the lock this routine checks if the
10639  * root page has the same size code that was used to determine the root (i.e
10640  * that root hasn't changed).  If root page has the expected p_szc field we
10641  * have the right lock and it's returned to the caller. If root's p_szc
10642  * decreased we release the lock and retry from the beginning.  This case can
10643  * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10644  * value and taking the lock. The number of retries due to p_szc decrease is
10645  * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10646  * determined by hashing pp itself.
10647  *
10648  * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10649  * possible that p_szc can increase. To increase p_szc a thread has to lock
10650  * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10651  * callers that don't hold a page locked recheck if hmeblk through which pp
10652  * was found still maps this pp.  If it doesn't map it anymore returned lock
10653  * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10654  * p_szc increase after taking the lock it returns this lock without further
10655  * retries because in this case the caller doesn't care about which lock was
10656  * taken. The caller will drop it right away.
10657  *
10658  * After the routine returns it's guaranteed that hat_page_demote() can't
10659  * change p_szc field of any of constituent pages of a large page pp belongs
10660  * to as long as pp was either locked at least SHARED prior to this call or
10661  * the caller finds that hment that pointed to this pp still references this
10662  * pp (this also assumes that the caller holds hme hash bucket lock so that
10663  * the same pp can't be remapped into the same hmeblk after it was unmapped by
10664  * hat_pageunload()).
10665  */
10666 static kmutex_t *
10667 sfmmu_mlspl_enter(struct page *pp, int type)
10668 {
10669 	kmutex_t	*mtx;
10670 	uint_t		prev_rszc = UINT_MAX;
10671 	page_t		*rootpp;
10672 	uint_t		szc;
10673 	uint_t		rszc;
10674 	uint_t		pszc = pp->p_szc;
10675 
10676 	ASSERT(pp != NULL);
10677 
10678 again:
10679 	if (pszc == 0) {
10680 		mtx = SFMMU_MLSPL_MTX(type, pp);
10681 		mutex_enter(mtx);
10682 		return (mtx);
10683 	}
10684 
10685 	/* The lock lives in the root page */
10686 	rootpp = PP_GROUPLEADER(pp, pszc);
10687 	mtx = SFMMU_MLSPL_MTX(type, rootpp);
10688 	mutex_enter(mtx);
10689 
10690 	/*
10691 	 * Return mml in the following 3 cases:
10692 	 *
10693 	 * 1) If pp itself is root since if its p_szc decreased before we took
10694 	 * the lock pp is still the root of smaller szc page. And if its p_szc
10695 	 * increased it doesn't matter what lock we return (see comment in
10696 	 * front of this routine).
10697 	 *
10698 	 * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10699 	 * large page we have the right lock since any previous potential
10700 	 * hat_page_demote() is done demoting from greater than current root's
10701 	 * p_szc because hat_page_demote() changes root's p_szc last. No
10702 	 * further hat_page_demote() can start or be in progress since it
10703 	 * would need the same lock we currently hold.
10704 	 *
10705 	 * 3) If rootpp's p_szc increased since previous iteration it doesn't
10706 	 * matter what lock we return (see comment in front of this routine).
10707 	 */
10708 	if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10709 	    rszc >= prev_rszc) {
10710 		return (mtx);
10711 	}
10712 
10713 	/*
10714 	 * hat_page_demote() could have decreased root's p_szc.
10715 	 * In this case pp's p_szc must also be smaller than pszc.
10716 	 * Retry.
10717 	 */
10718 	if (rszc < pszc) {
10719 		szc = pp->p_szc;
10720 		if (szc < pszc) {
10721 			mutex_exit(mtx);
10722 			pszc = szc;
10723 			goto again;
10724 		}
10725 		/*
10726 		 * pp's p_szc increased after it was decreased.
10727 		 * page cannot be mapped. Return current lock. The caller
10728 		 * will drop it right away.
10729 		 */
10730 		return (mtx);
10731 	}
10732 
10733 	/*
10734 	 * root's p_szc is greater than pp's p_szc.
10735 	 * hat_page_demote() is not done with all pages
10736 	 * yet. Wait for it to complete.
10737 	 */
10738 	mutex_exit(mtx);
10739 	rootpp = PP_GROUPLEADER(rootpp, rszc);
10740 	mtx = SFMMU_MLSPL_MTX(type, rootpp);
10741 	mutex_enter(mtx);
10742 	mutex_exit(mtx);
10743 	prev_rszc = rszc;
10744 	goto again;
10745 }
10746 
10747 static int
10748 sfmmu_mlspl_held(struct page *pp, int type)
10749 {
10750 	kmutex_t	*mtx;
10751 
10752 	ASSERT(pp != NULL);
10753 	/* The lock lives in the root page */
10754 	pp = PP_PAGEROOT(pp);
10755 	ASSERT(pp != NULL);
10756 
10757 	mtx = SFMMU_MLSPL_MTX(type, pp);
10758 	return (MUTEX_HELD(mtx));
10759 }
10760 
10761 static uint_t
10762 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10763 {
10764 	struct  hme_blk *hblkp;
10765 
10766 
10767 	if (freehblkp != NULL) {
10768 		mutex_enter(&freehblkp_lock);
10769 		if (freehblkp != NULL) {
10770 			/*
10771 			 * If the current thread is owning hblk_reserve OR
10772 			 * critical request from sfmmu_hblk_steal()
10773 			 * let it succeed even if freehblkcnt is really low.
10774 			 */
10775 			if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10776 				SFMMU_STAT(sf_get_free_throttle);
10777 				mutex_exit(&freehblkp_lock);
10778 				return (0);
10779 			}
10780 			freehblkcnt--;
10781 			*hmeblkpp = freehblkp;
10782 			hblkp = *hmeblkpp;
10783 			freehblkp = hblkp->hblk_next;
10784 			mutex_exit(&freehblkp_lock);
10785 			hblkp->hblk_next = NULL;
10786 			SFMMU_STAT(sf_get_free_success);
10787 
10788 			ASSERT(hblkp->hblk_hmecnt == 0);
10789 			ASSERT(hblkp->hblk_vcnt == 0);
10790 			ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10791 
10792 			return (1);
10793 		}
10794 		mutex_exit(&freehblkp_lock);
10795 	}
10796 
10797 	/* Check cpu hblk pending queues */
10798 	if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10799 		hblkp = *hmeblkpp;
10800 		hblkp->hblk_next = NULL;
10801 		hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10802 
10803 		ASSERT(hblkp->hblk_hmecnt == 0);
10804 		ASSERT(hblkp->hblk_vcnt == 0);
10805 
10806 		return (1);
10807 	}
10808 
10809 	SFMMU_STAT(sf_get_free_fail);
10810 	return (0);
10811 }
10812 
10813 static uint_t
10814 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10815 {
10816 	struct  hme_blk *hblkp;
10817 
10818 	ASSERT(hmeblkp->hblk_hmecnt == 0);
10819 	ASSERT(hmeblkp->hblk_vcnt == 0);
10820 	ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10821 
10822 	/*
10823 	 * If the current thread is mapping into kernel space,
10824 	 * let it succede even if freehblkcnt is max
10825 	 * so that it will avoid freeing it to kmem.
10826 	 * This will prevent stack overflow due to
10827 	 * possible recursion since kmem_cache_free()
10828 	 * might require creation of a slab which
10829 	 * in turn needs an hmeblk to map that slab;
10830 	 * let's break this vicious chain at the first
10831 	 * opportunity.
10832 	 */
10833 	if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10834 		mutex_enter(&freehblkp_lock);
10835 		if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10836 			SFMMU_STAT(sf_put_free_success);
10837 			freehblkcnt++;
10838 			hmeblkp->hblk_next = freehblkp;
10839 			freehblkp = hmeblkp;
10840 			mutex_exit(&freehblkp_lock);
10841 			return (1);
10842 		}
10843 		mutex_exit(&freehblkp_lock);
10844 	}
10845 
10846 	/*
10847 	 * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10848 	 * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10849 	 * we are not in the process of mapping into kernel space.
10850 	 */
10851 	ASSERT(!critical);
10852 	while (freehblkcnt > HBLK_RESERVE_CNT) {
10853 		mutex_enter(&freehblkp_lock);
10854 		if (freehblkcnt > HBLK_RESERVE_CNT) {
10855 			freehblkcnt--;
10856 			hblkp = freehblkp;
10857 			freehblkp = hblkp->hblk_next;
10858 			mutex_exit(&freehblkp_lock);
10859 			ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10860 			kmem_cache_free(sfmmu8_cache, hblkp);
10861 			continue;
10862 		}
10863 		mutex_exit(&freehblkp_lock);
10864 	}
10865 	SFMMU_STAT(sf_put_free_fail);
10866 	return (0);
10867 }
10868 
10869 static void
10870 sfmmu_hblk_swap(struct hme_blk *new)
10871 {
10872 	struct hme_blk *old, *hblkp, *prev;
10873 	uint64_t newpa;
10874 	caddr_t	base, vaddr, endaddr;
10875 	struct hmehash_bucket *hmebp;
10876 	struct sf_hment *osfhme, *nsfhme;
10877 	page_t *pp;
10878 	kmutex_t *pml;
10879 	tte_t tte;
10880 	struct hme_blk *list = NULL;
10881 
10882 #ifdef	DEBUG
10883 	hmeblk_tag		hblktag;
10884 	struct hme_blk		*found;
10885 #endif
10886 	old = HBLK_RESERVE;
10887 	ASSERT(!old->hblk_shared);
10888 
10889 	/*
10890 	 * save pa before bcopy clobbers it
10891 	 */
10892 	newpa = new->hblk_nextpa;
10893 
10894 	base = (caddr_t)get_hblk_base(old);
10895 	endaddr = base + get_hblk_span(old);
10896 
10897 	/*
10898 	 * acquire hash bucket lock.
10899 	 */
10900 	hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10901 	    SFMMU_INVALID_SHMERID);
10902 
10903 	/*
10904 	 * copy contents from old to new
10905 	 */
10906 	bcopy((void *)old, (void *)new, HME8BLK_SZ);
10907 
10908 	/*
10909 	 * add new to hash chain
10910 	 */
10911 	sfmmu_hblk_hash_add(hmebp, new, newpa);
10912 
10913 	/*
10914 	 * search hash chain for hblk_reserve; this needs to be performed
10915 	 * after adding new, otherwise prev won't correspond to the hblk which
10916 	 * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10917 	 * remove old later.
10918 	 */
10919 	for (prev = NULL,
10920 	    hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10921 	    prev = hblkp, hblkp = hblkp->hblk_next)
10922 		;
10923 
10924 	if (hblkp != old)
10925 		panic("sfmmu_hblk_swap: hblk_reserve not found");
10926 
10927 	/*
10928 	 * p_mapping list is still pointing to hments in hblk_reserve;
10929 	 * fix up p_mapping list so that they point to hments in new.
10930 	 *
10931 	 * Since all these mappings are created by hblk_reserve_thread
10932 	 * on the way and it's using at least one of the buffers from each of
10933 	 * the newly minted slabs, there is no danger of any of these
10934 	 * mappings getting unloaded by another thread.
10935 	 *
10936 	 * tsbmiss could only modify ref/mod bits of hments in old/new.
10937 	 * Since all of these hments hold mappings established by segkmem
10938 	 * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10939 	 * have no meaning for the mappings in hblk_reserve.  hments in
10940 	 * old and new are identical except for ref/mod bits.
10941 	 */
10942 	for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10943 
10944 		HBLKTOHME(osfhme, old, vaddr);
10945 		sfmmu_copytte(&osfhme->hme_tte, &tte);
10946 
10947 		if (TTE_IS_VALID(&tte)) {
10948 			if ((pp = osfhme->hme_page) == NULL)
10949 				panic("sfmmu_hblk_swap: page not mapped");
10950 
10951 			pml = sfmmu_mlist_enter(pp);
10952 
10953 			if (pp != osfhme->hme_page)
10954 				panic("sfmmu_hblk_swap: mapping changed");
10955 
10956 			HBLKTOHME(nsfhme, new, vaddr);
10957 
10958 			HME_ADD(nsfhme, pp);
10959 			HME_SUB(osfhme, pp);
10960 
10961 			sfmmu_mlist_exit(pml);
10962 		}
10963 	}
10964 
10965 	/*
10966 	 * remove old from hash chain
10967 	 */
10968 	sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10969 
10970 #ifdef	DEBUG
10971 
10972 	hblktag.htag_id = ksfmmup;
10973 	hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10974 	hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10975 	hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10976 	HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10977 
10978 	if (found != new)
10979 		panic("sfmmu_hblk_swap: new hblk not found");
10980 #endif
10981 
10982 	SFMMU_HASH_UNLOCK(hmebp);
10983 
10984 	/*
10985 	 * Reset hblk_reserve
10986 	 */
10987 	bzero((void *)old, HME8BLK_SZ);
10988 	old->hblk_nextpa = va_to_pa((caddr_t)old);
10989 }
10990 
10991 /*
10992  * Grab the mlist mutex for both pages passed in.
10993  *
10994  * low and high will be returned as pointers to the mutexes for these pages.
10995  * low refers to the mutex residing in the lower bin of the mlist hash, while
10996  * high refers to the mutex residing in the higher bin of the mlist hash.  This
10997  * is due to the locking order restrictions on the same thread grabbing
10998  * multiple mlist mutexes.  The low lock must be acquired before the high lock.
10999  *
11000  * If both pages hash to the same mutex, only grab that single mutex, and
11001  * high will be returned as NULL
11002  * If the pages hash to different bins in the hash, grab the lower addressed
11003  * lock first and then the higher addressed lock in order to follow the locking
11004  * rules involved with the same thread grabbing multiple mlist mutexes.
11005  * low and high will both have non-NULL values.
11006  */
11007 static void
11008 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
11009     kmutex_t **low, kmutex_t **high)
11010 {
11011 	kmutex_t	*mml_targ, *mml_repl;
11012 
11013 	/*
11014 	 * no need to do the dance around szc as in sfmmu_mlist_enter()
11015 	 * because this routine is only called by hat_page_relocate() and all
11016 	 * targ and repl pages are already locked EXCL so szc can't change.
11017 	 */
11018 
11019 	mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
11020 	mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
11021 
11022 	if (mml_targ == mml_repl) {
11023 		*low = mml_targ;
11024 		*high = NULL;
11025 	} else {
11026 		if (mml_targ < mml_repl) {
11027 			*low = mml_targ;
11028 			*high = mml_repl;
11029 		} else {
11030 			*low = mml_repl;
11031 			*high = mml_targ;
11032 		}
11033 	}
11034 
11035 	mutex_enter(*low);
11036 	if (*high)
11037 		mutex_enter(*high);
11038 }
11039 
11040 static void
11041 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
11042 {
11043 	if (high)
11044 		mutex_exit(high);
11045 	mutex_exit(low);
11046 }
11047 
11048 static hatlock_t *
11049 sfmmu_hat_enter(sfmmu_t *sfmmup)
11050 {
11051 	hatlock_t	*hatlockp;
11052 
11053 	if (sfmmup != ksfmmup) {
11054 		hatlockp = TSB_HASH(sfmmup);
11055 		mutex_enter(HATLOCK_MUTEXP(hatlockp));
11056 		return (hatlockp);
11057 	}
11058 	return (NULL);
11059 }
11060 
11061 static hatlock_t *
11062 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
11063 {
11064 	hatlock_t	*hatlockp;
11065 
11066 	if (sfmmup != ksfmmup) {
11067 		hatlockp = TSB_HASH(sfmmup);
11068 		if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
11069 			return (NULL);
11070 		return (hatlockp);
11071 	}
11072 	return (NULL);
11073 }
11074 
11075 static void
11076 sfmmu_hat_exit(hatlock_t *hatlockp)
11077 {
11078 	if (hatlockp != NULL)
11079 		mutex_exit(HATLOCK_MUTEXP(hatlockp));
11080 }
11081 
11082 static void
11083 sfmmu_hat_lock_all(void)
11084 {
11085 	int i;
11086 	for (i = 0; i < SFMMU_NUM_LOCK; i++)
11087 		mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
11088 }
11089 
11090 static void
11091 sfmmu_hat_unlock_all(void)
11092 {
11093 	int i;
11094 	for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
11095 		mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
11096 }
11097 
11098 int
11099 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
11100 {
11101 	ASSERT(sfmmup != ksfmmup);
11102 	return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
11103 }
11104 
11105 /*
11106  * Locking primitives to provide consistency between ISM unmap
11107  * and other operations.  Since ISM unmap can take a long time, we
11108  * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
11109  * contention on the hatlock buckets while ISM segments are being
11110  * unmapped.  The tradeoff is that the flags don't prevent priority
11111  * inversion from occurring, so we must request kernel priority in
11112  * case we have to sleep to keep from getting buried while holding
11113  * the HAT_ISMBUSY flag set, which in turn could block other kernel
11114  * threads from running (for example, in sfmmu_uvatopfn()).
11115  */
11116 static void
11117 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
11118 {
11119 	hatlock_t *hatlockp;
11120 
11121 	THREAD_KPRI_REQUEST();
11122 	if (!hatlock_held)
11123 		hatlockp = sfmmu_hat_enter(sfmmup);
11124 	while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
11125 		cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11126 	SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
11127 	if (!hatlock_held)
11128 		sfmmu_hat_exit(hatlockp);
11129 }
11130 
11131 static void
11132 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
11133 {
11134 	hatlock_t *hatlockp;
11135 
11136 	if (!hatlock_held)
11137 		hatlockp = sfmmu_hat_enter(sfmmup);
11138 	ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
11139 	SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
11140 	cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11141 	if (!hatlock_held)
11142 		sfmmu_hat_exit(hatlockp);
11143 	THREAD_KPRI_RELEASE();
11144 }
11145 
11146 /*
11147  *
11148  * Algorithm:
11149  *
11150  * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
11151  *	hblks.
11152  *
11153  * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
11154  *
11155  * 		(a) try to return an hblk from reserve pool of free hblks;
11156  *		(b) if the reserve pool is empty, acquire hblk_reserve_lock
11157  *		    and return hblk_reserve.
11158  *
11159  * (3) call kmem_cache_alloc() to allocate hblk;
11160  *
11161  *		(a) if hblk_reserve_lock is held by the current thread,
11162  *		    atomically replace hblk_reserve by the hblk that is
11163  *		    returned by kmem_cache_alloc; release hblk_reserve_lock
11164  *		    and call kmem_cache_alloc() again.
11165  *		(b) if reserve pool is not full, add the hblk that is
11166  *		    returned by kmem_cache_alloc to reserve pool and
11167  *		    call kmem_cache_alloc again.
11168  *
11169  */
11170 static struct hme_blk *
11171 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
11172 	struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
11173 	uint_t flags, uint_t rid)
11174 {
11175 	struct hme_blk *hmeblkp = NULL;
11176 	struct hme_blk *newhblkp;
11177 	struct hme_blk *shw_hblkp = NULL;
11178 	struct kmem_cache *sfmmu_cache = NULL;
11179 	uint64_t hblkpa;
11180 	ulong_t index;
11181 	uint_t owner;		/* set to 1 if using hblk_reserve */
11182 	uint_t forcefree;
11183 	int sleep;
11184 	sf_srd_t *srdp;
11185 	sf_region_t *rgnp;
11186 
11187 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11188 	ASSERT(hblktag.htag_rid == rid);
11189 	SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
11190 	ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11191 	    IS_P2ALIGNED(vaddr, TTEBYTES(size)));
11192 
11193 	/*
11194 	 * If segkmem is not created yet, allocate from static hmeblks
11195 	 * created at the end of startup_modules().  See the block comment
11196 	 * in startup_modules() describing how we estimate the number of
11197 	 * static hmeblks that will be needed during re-map.
11198 	 */
11199 	if (!hblk_alloc_dynamic) {
11200 
11201 		ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11202 
11203 		if (size == TTE8K) {
11204 			index = nucleus_hblk8.index;
11205 			if (index >= nucleus_hblk8.len) {
11206 				/*
11207 				 * If we panic here, see startup_modules() to
11208 				 * make sure that we are calculating the
11209 				 * number of hblk8's that we need correctly.
11210 				 */
11211 				prom_panic("no nucleus hblk8 to allocate");
11212 			}
11213 			hmeblkp =
11214 			    (struct hme_blk *)&nucleus_hblk8.list[index];
11215 			nucleus_hblk8.index++;
11216 			SFMMU_STAT(sf_hblk8_nalloc);
11217 		} else {
11218 			index = nucleus_hblk1.index;
11219 			if (nucleus_hblk1.index >= nucleus_hblk1.len) {
11220 				/*
11221 				 * If we panic here, see startup_modules().
11222 				 * Most likely you need to update the
11223 				 * calculation of the number of hblk1 elements
11224 				 * that the kernel needs to boot.
11225 				 */
11226 				prom_panic("no nucleus hblk1 to allocate");
11227 			}
11228 			hmeblkp =
11229 			    (struct hme_blk *)&nucleus_hblk1.list[index];
11230 			nucleus_hblk1.index++;
11231 			SFMMU_STAT(sf_hblk1_nalloc);
11232 		}
11233 
11234 		goto hblk_init;
11235 	}
11236 
11237 	SFMMU_HASH_UNLOCK(hmebp);
11238 
11239 	if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
11240 		if (mmu_page_sizes == max_mmu_page_sizes) {
11241 			if (size < TTE256M)
11242 				shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11243 				    size, flags);
11244 		} else {
11245 			if (size < TTE4M)
11246 				shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11247 				    size, flags);
11248 		}
11249 	} else if (SFMMU_IS_SHMERID_VALID(rid)) {
11250 		/*
11251 		 * Shared hmes use per region bitmaps in rgn_hmeflag
11252 		 * rather than shadow hmeblks to keep track of the
11253 		 * mapping sizes which have been allocated for the region.
11254 		 * Here we cleanup old invalid hmeblks with this rid,
11255 		 * which may be left around by pageunload().
11256 		 */
11257 		int ttesz;
11258 		caddr_t va;
11259 		caddr_t	eva = vaddr + TTEBYTES(size);
11260 
11261 		ASSERT(sfmmup != KHATID);
11262 
11263 		srdp = sfmmup->sfmmu_srdp;
11264 		ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11265 		rgnp = srdp->srd_hmergnp[rid];
11266 		ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11267 		ASSERT(rgnp->rgn_refcnt != 0);
11268 		ASSERT(size <= rgnp->rgn_pgszc);
11269 
11270 		ttesz = HBLK_MIN_TTESZ;
11271 		do {
11272 			if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11273 				continue;
11274 			}
11275 
11276 			if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11277 				sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11278 			} else if (ttesz < size) {
11279 				for (va = vaddr; va < eva;
11280 				    va += TTEBYTES(ttesz)) {
11281 					sfmmu_cleanup_rhblk(srdp, va, rid,
11282 					    ttesz);
11283 				}
11284 			}
11285 		} while (++ttesz <= rgnp->rgn_pgszc);
11286 	}
11287 
11288 fill_hblk:
11289 	owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11290 
11291 	if (owner && size == TTE8K) {
11292 
11293 		ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11294 		/*
11295 		 * We are really in a tight spot. We already own
11296 		 * hblk_reserve and we need another hblk.  In anticipation
11297 		 * of this kind of scenario, we specifically set aside
11298 		 * HBLK_RESERVE_MIN number of hblks to be used exclusively
11299 		 * by owner of hblk_reserve.
11300 		 */
11301 		SFMMU_STAT(sf_hblk_recurse_cnt);
11302 
11303 		if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11304 			panic("sfmmu_hblk_alloc: reserve list is empty");
11305 
11306 		goto hblk_verify;
11307 	}
11308 
11309 	ASSERT(!owner);
11310 
11311 	if ((flags & HAT_NO_KALLOC) == 0) {
11312 
11313 		sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11314 		sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11315 
11316 		if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11317 			hmeblkp = sfmmu_hblk_steal(size);
11318 		} else {
11319 			/*
11320 			 * if we are the owner of hblk_reserve,
11321 			 * swap hblk_reserve with hmeblkp and
11322 			 * start a fresh life.  Hope things go
11323 			 * better this time.
11324 			 */
11325 			if (hblk_reserve_thread == curthread) {
11326 				ASSERT(sfmmu_cache == sfmmu8_cache);
11327 				sfmmu_hblk_swap(hmeblkp);
11328 				hblk_reserve_thread = NULL;
11329 				mutex_exit(&hblk_reserve_lock);
11330 				goto fill_hblk;
11331 			}
11332 			/*
11333 			 * let's donate this hblk to our reserve list if
11334 			 * we are not mapping kernel range
11335 			 */
11336 			if (size == TTE8K && sfmmup != KHATID) {
11337 				if (sfmmu_put_free_hblk(hmeblkp, 0))
11338 					goto fill_hblk;
11339 			}
11340 		}
11341 	} else {
11342 		/*
11343 		 * We are here to map the slab in sfmmu8_cache; let's
11344 		 * check if we could tap our reserve list; if successful,
11345 		 * this will avoid the pain of going thru sfmmu_hblk_swap
11346 		 */
11347 		SFMMU_STAT(sf_hblk_slab_cnt);
11348 		if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11349 			/*
11350 			 * let's start hblk_reserve dance
11351 			 */
11352 			SFMMU_STAT(sf_hblk_reserve_cnt);
11353 			owner = 1;
11354 			mutex_enter(&hblk_reserve_lock);
11355 			hmeblkp = HBLK_RESERVE;
11356 			hblk_reserve_thread = curthread;
11357 		}
11358 	}
11359 
11360 hblk_verify:
11361 	ASSERT(hmeblkp != NULL);
11362 	set_hblk_sz(hmeblkp, size);
11363 	ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11364 	SFMMU_HASH_LOCK(hmebp);
11365 	HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11366 	if (newhblkp != NULL) {
11367 		SFMMU_HASH_UNLOCK(hmebp);
11368 		if (hmeblkp != HBLK_RESERVE) {
11369 			/*
11370 			 * This is really tricky!
11371 			 *
11372 			 * vmem_alloc(vmem_seg_arena)
11373 			 *  vmem_alloc(vmem_internal_arena)
11374 			 *   segkmem_alloc(heap_arena)
11375 			 *    vmem_alloc(heap_arena)
11376 			 *    page_create()
11377 			 *    hat_memload()
11378 			 *	kmem_cache_free()
11379 			 *	 kmem_cache_alloc()
11380 			 *	  kmem_slab_create()
11381 			 *	   vmem_alloc(kmem_internal_arena)
11382 			 *	    segkmem_alloc(heap_arena)
11383 			 *		vmem_alloc(heap_arena)
11384 			 *		page_create()
11385 			 *		hat_memload()
11386 			 *		  kmem_cache_free()
11387 			 *		...
11388 			 *
11389 			 * Thus, hat_memload() could call kmem_cache_free
11390 			 * for enough number of times that we could easily
11391 			 * hit the bottom of the stack or run out of reserve
11392 			 * list of vmem_seg structs.  So, we must donate
11393 			 * this hblk to reserve list if it's allocated
11394 			 * from sfmmu8_cache *and* mapping kernel range.
11395 			 * We don't need to worry about freeing hmeblk1's
11396 			 * to kmem since they don't map any kmem slabs.
11397 			 *
11398 			 * Note: When segkmem supports largepages, we must
11399 			 * free hmeblk1's to reserve list as well.
11400 			 */
11401 			forcefree = (sfmmup == KHATID) ? 1 : 0;
11402 			if (size == TTE8K &&
11403 			    sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11404 				goto re_verify;
11405 			}
11406 			ASSERT(sfmmup != KHATID);
11407 			kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11408 		} else {
11409 			/*
11410 			 * Hey! we don't need hblk_reserve any more.
11411 			 */
11412 			ASSERT(owner);
11413 			hblk_reserve_thread = NULL;
11414 			mutex_exit(&hblk_reserve_lock);
11415 			owner = 0;
11416 		}
11417 re_verify:
11418 		/*
11419 		 * let's check if the goodies are still present
11420 		 */
11421 		SFMMU_HASH_LOCK(hmebp);
11422 		HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11423 		if (newhblkp != NULL) {
11424 			/*
11425 			 * return newhblkp if it's not hblk_reserve;
11426 			 * if newhblkp is hblk_reserve, return it
11427 			 * _only if_ we are the owner of hblk_reserve.
11428 			 */
11429 			if (newhblkp != HBLK_RESERVE || owner) {
11430 				ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11431 				    newhblkp->hblk_shared);
11432 				ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11433 				    !newhblkp->hblk_shared);
11434 				return (newhblkp);
11435 			} else {
11436 				/*
11437 				 * we just hit hblk_reserve in the hash and
11438 				 * we are not the owner of that;
11439 				 *
11440 				 * block until hblk_reserve_thread completes
11441 				 * swapping hblk_reserve and try the dance
11442 				 * once again.
11443 				 */
11444 				SFMMU_HASH_UNLOCK(hmebp);
11445 				mutex_enter(&hblk_reserve_lock);
11446 				mutex_exit(&hblk_reserve_lock);
11447 				SFMMU_STAT(sf_hblk_reserve_hit);
11448 				goto fill_hblk;
11449 			}
11450 		} else {
11451 			/*
11452 			 * it's no more! try the dance once again.
11453 			 */
11454 			SFMMU_HASH_UNLOCK(hmebp);
11455 			goto fill_hblk;
11456 		}
11457 	}
11458 
11459 hblk_init:
11460 	if (SFMMU_IS_SHMERID_VALID(rid)) {
11461 		uint16_t tteflag = 0x1 <<
11462 		    ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11463 
11464 		if (!(rgnp->rgn_hmeflags & tteflag)) {
11465 			atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11466 		}
11467 		hmeblkp->hblk_shared = 1;
11468 	} else {
11469 		hmeblkp->hblk_shared = 0;
11470 	}
11471 	set_hblk_sz(hmeblkp, size);
11472 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11473 	hmeblkp->hblk_next = (struct hme_blk *)NULL;
11474 	hmeblkp->hblk_tag = hblktag;
11475 	hmeblkp->hblk_shadow = shw_hblkp;
11476 	hblkpa = hmeblkp->hblk_nextpa;
11477 	hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11478 
11479 	ASSERT(get_hblk_ttesz(hmeblkp) == size);
11480 	ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11481 	ASSERT(hmeblkp->hblk_hmecnt == 0);
11482 	ASSERT(hmeblkp->hblk_vcnt == 0);
11483 	ASSERT(hmeblkp->hblk_lckcnt == 0);
11484 	ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11485 	sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11486 	return (hmeblkp);
11487 }
11488 
11489 /*
11490  * This function cleans up the hme_blk and returns it to the free list.
11491  */
11492 /* ARGSUSED */
11493 static void
11494 sfmmu_hblk_free(struct hme_blk **listp)
11495 {
11496 	struct hme_blk *hmeblkp, *next_hmeblkp;
11497 	int		size;
11498 	uint_t		critical;
11499 	uint64_t	hblkpa;
11500 
11501 	ASSERT(*listp != NULL);
11502 
11503 	hmeblkp = *listp;
11504 	while (hmeblkp != NULL) {
11505 		next_hmeblkp = hmeblkp->hblk_next;
11506 		ASSERT(!hmeblkp->hblk_hmecnt);
11507 		ASSERT(!hmeblkp->hblk_vcnt);
11508 		ASSERT(!hmeblkp->hblk_lckcnt);
11509 		ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11510 		ASSERT(hmeblkp->hblk_shared == 0);
11511 		ASSERT(hmeblkp->hblk_shw_bit == 0);
11512 		ASSERT(hmeblkp->hblk_shadow == NULL);
11513 
11514 		hblkpa = va_to_pa((caddr_t)hmeblkp);
11515 		ASSERT(hblkpa != (uint64_t)-1);
11516 		critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11517 
11518 		size = get_hblk_ttesz(hmeblkp);
11519 		hmeblkp->hblk_next = NULL;
11520 		hmeblkp->hblk_nextpa = hblkpa;
11521 
11522 		if (hmeblkp->hblk_nuc_bit == 0) {
11523 
11524 			if (size != TTE8K ||
11525 			    !sfmmu_put_free_hblk(hmeblkp, critical))
11526 				kmem_cache_free(get_hblk_cache(hmeblkp),
11527 				    hmeblkp);
11528 		}
11529 		hmeblkp = next_hmeblkp;
11530 	}
11531 }
11532 
11533 #define	BUCKETS_TO_SEARCH_BEFORE_UNLOAD	30
11534 #define	SFMMU_HBLK_STEAL_THRESHOLD 5
11535 
11536 static uint_t sfmmu_hblk_steal_twice;
11537 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11538 
11539 /*
11540  * Steal a hmeblk from user or kernel hme hash lists.
11541  * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11542  * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11543  * tap into critical reserve of freehblkp.
11544  * Note: We remain looping in this routine until we find one.
11545  */
11546 static struct hme_blk *
11547 sfmmu_hblk_steal(int size)
11548 {
11549 	static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11550 	struct hmehash_bucket *hmebp;
11551 	struct hme_blk *hmeblkp = NULL, *pr_hblk;
11552 	uint64_t hblkpa;
11553 	int i;
11554 	uint_t loop_cnt = 0, critical;
11555 
11556 	for (;;) {
11557 		/* Check cpu hblk pending queues */
11558 		if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11559 			hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11560 			ASSERT(hmeblkp->hblk_hmecnt == 0);
11561 			ASSERT(hmeblkp->hblk_vcnt == 0);
11562 			return (hmeblkp);
11563 		}
11564 
11565 		if (size == TTE8K) {
11566 			critical =
11567 			    (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11568 			if (sfmmu_get_free_hblk(&hmeblkp, critical))
11569 				return (hmeblkp);
11570 		}
11571 
11572 		hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11573 		    uhmehash_steal_hand;
11574 		ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11575 
11576 		for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11577 		    BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11578 			SFMMU_HASH_LOCK(hmebp);
11579 			hmeblkp = hmebp->hmeblkp;
11580 			hblkpa = hmebp->hmeh_nextpa;
11581 			pr_hblk = NULL;
11582 			while (hmeblkp) {
11583 				/*
11584 				 * check if it is a hmeblk that is not locked
11585 				 * and not shared. skip shadow hmeblks with
11586 				 * shadow_mask set i.e valid count non zero.
11587 				 */
11588 				if ((get_hblk_ttesz(hmeblkp) == size) &&
11589 				    (hmeblkp->hblk_shw_bit == 0 ||
11590 				    hmeblkp->hblk_vcnt == 0) &&
11591 				    (hmeblkp->hblk_lckcnt == 0)) {
11592 					/*
11593 					 * there is a high probability that we
11594 					 * will find a free one. search some
11595 					 * buckets for a free hmeblk initially
11596 					 * before unloading a valid hmeblk.
11597 					 */
11598 					if ((hmeblkp->hblk_vcnt == 0 &&
11599 					    hmeblkp->hblk_hmecnt == 0) || (i >=
11600 					    BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11601 						if (sfmmu_steal_this_hblk(hmebp,
11602 						    hmeblkp, hblkpa, pr_hblk)) {
11603 							/*
11604 							 * Hblk is unloaded
11605 							 * successfully
11606 							 */
11607 							break;
11608 						}
11609 					}
11610 				}
11611 				pr_hblk = hmeblkp;
11612 				hblkpa = hmeblkp->hblk_nextpa;
11613 				hmeblkp = hmeblkp->hblk_next;
11614 			}
11615 
11616 			SFMMU_HASH_UNLOCK(hmebp);
11617 			if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11618 				hmebp = uhme_hash;
11619 		}
11620 		uhmehash_steal_hand = hmebp;
11621 
11622 		if (hmeblkp != NULL)
11623 			break;
11624 
11625 		/*
11626 		 * in the worst case, look for a free one in the kernel
11627 		 * hash table.
11628 		 */
11629 		for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11630 			SFMMU_HASH_LOCK(hmebp);
11631 			hmeblkp = hmebp->hmeblkp;
11632 			hblkpa = hmebp->hmeh_nextpa;
11633 			pr_hblk = NULL;
11634 			while (hmeblkp) {
11635 				/*
11636 				 * check if it is free hmeblk
11637 				 */
11638 				if ((get_hblk_ttesz(hmeblkp) == size) &&
11639 				    (hmeblkp->hblk_lckcnt == 0) &&
11640 				    (hmeblkp->hblk_vcnt == 0) &&
11641 				    (hmeblkp->hblk_hmecnt == 0)) {
11642 					if (sfmmu_steal_this_hblk(hmebp,
11643 					    hmeblkp, hblkpa, pr_hblk)) {
11644 						break;
11645 					} else {
11646 						/*
11647 						 * Cannot fail since we have
11648 						 * hash lock.
11649 						 */
11650 						panic("fail to steal?");
11651 					}
11652 				}
11653 
11654 				pr_hblk = hmeblkp;
11655 				hblkpa = hmeblkp->hblk_nextpa;
11656 				hmeblkp = hmeblkp->hblk_next;
11657 			}
11658 
11659 			SFMMU_HASH_UNLOCK(hmebp);
11660 			if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11661 				hmebp = khme_hash;
11662 		}
11663 
11664 		if (hmeblkp != NULL)
11665 			break;
11666 		sfmmu_hblk_steal_twice++;
11667 	}
11668 	return (hmeblkp);
11669 }
11670 
11671 /*
11672  * This routine does real work to prepare a hblk to be "stolen" by
11673  * unloading the mappings, updating shadow counts ....
11674  * It returns 1 if the block is ready to be reused (stolen), or 0
11675  * means the block cannot be stolen yet- pageunload is still working
11676  * on this hblk.
11677  */
11678 static int
11679 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11680 	uint64_t hblkpa, struct hme_blk *pr_hblk)
11681 {
11682 	int shw_size, vshift;
11683 	struct hme_blk *shw_hblkp;
11684 	caddr_t vaddr;
11685 	uint_t shw_mask, newshw_mask;
11686 	struct hme_blk *list = NULL;
11687 
11688 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11689 
11690 	/*
11691 	 * check if the hmeblk is free, unload if necessary
11692 	 */
11693 	if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11694 		sfmmu_t *sfmmup;
11695 		demap_range_t dmr;
11696 
11697 		sfmmup = hblktosfmmu(hmeblkp);
11698 		if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11699 			return (0);
11700 		}
11701 		DEMAP_RANGE_INIT(sfmmup, &dmr);
11702 		(void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11703 		    (caddr_t)get_hblk_base(hmeblkp),
11704 		    get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11705 		DEMAP_RANGE_FLUSH(&dmr);
11706 		if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11707 			/*
11708 			 * Pageunload is working on the same hblk.
11709 			 */
11710 			return (0);
11711 		}
11712 
11713 		sfmmu_hblk_steal_unload_count++;
11714 	}
11715 
11716 	ASSERT(hmeblkp->hblk_lckcnt == 0);
11717 	ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11718 
11719 	sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11720 	hmeblkp->hblk_nextpa = hblkpa;
11721 
11722 	shw_hblkp = hmeblkp->hblk_shadow;
11723 	if (shw_hblkp) {
11724 		ASSERT(!hmeblkp->hblk_shared);
11725 		shw_size = get_hblk_ttesz(shw_hblkp);
11726 		vaddr = (caddr_t)get_hblk_base(hmeblkp);
11727 		vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11728 		ASSERT(vshift < 8);
11729 		/*
11730 		 * Atomically clear shadow mask bit
11731 		 */
11732 		do {
11733 			shw_mask = shw_hblkp->hblk_shw_mask;
11734 			ASSERT(shw_mask & (1 << vshift));
11735 			newshw_mask = shw_mask & ~(1 << vshift);
11736 			newshw_mask = cas32(&shw_hblkp->hblk_shw_mask,
11737 			    shw_mask, newshw_mask);
11738 		} while (newshw_mask != shw_mask);
11739 		hmeblkp->hblk_shadow = NULL;
11740 	}
11741 
11742 	/*
11743 	 * remove shadow bit if we are stealing an unused shadow hmeblk.
11744 	 * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11745 	 * we are indeed allocating a shadow hmeblk.
11746 	 */
11747 	hmeblkp->hblk_shw_bit = 0;
11748 
11749 	if (hmeblkp->hblk_shared) {
11750 		sf_srd_t	*srdp;
11751 		sf_region_t	*rgnp;
11752 		uint_t		rid;
11753 
11754 		srdp = hblktosrd(hmeblkp);
11755 		ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11756 		rid = hmeblkp->hblk_tag.htag_rid;
11757 		ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11758 		ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11759 		rgnp = srdp->srd_hmergnp[rid];
11760 		ASSERT(rgnp != NULL);
11761 		SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11762 		hmeblkp->hblk_shared = 0;
11763 	}
11764 
11765 	sfmmu_hblk_steal_count++;
11766 	SFMMU_STAT(sf_steal_count);
11767 
11768 	return (1);
11769 }
11770 
11771 struct hme_blk *
11772 sfmmu_hmetohblk(struct sf_hment *sfhme)
11773 {
11774 	struct hme_blk *hmeblkp;
11775 	struct sf_hment *sfhme0;
11776 	struct hme_blk *hblk_dummy = 0;
11777 
11778 	/*
11779 	 * No dummy sf_hments, please.
11780 	 */
11781 	ASSERT(sfhme->hme_tte.ll != 0);
11782 
11783 	sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11784 	hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11785 	    (uintptr_t)&hblk_dummy->hblk_hme[0]);
11786 
11787 	return (hmeblkp);
11788 }
11789 
11790 /*
11791  * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11792  * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11793  * KM_SLEEP allocation.
11794  *
11795  * Return 0 on success, -1 otherwise.
11796  */
11797 static void
11798 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11799 {
11800 	struct tsb_info *tsbinfop, *next;
11801 	tsb_replace_rc_t rc;
11802 	boolean_t gotfirst = B_FALSE;
11803 
11804 	ASSERT(sfmmup != ksfmmup);
11805 	ASSERT(sfmmu_hat_lock_held(sfmmup));
11806 
11807 	while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11808 		cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11809 	}
11810 
11811 	if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11812 		SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11813 	} else {
11814 		return;
11815 	}
11816 
11817 	ASSERT(sfmmup->sfmmu_tsb != NULL);
11818 
11819 	/*
11820 	 * Loop over all tsbinfo's replacing them with ones that actually have
11821 	 * a TSB.  If any of the replacements ever fail, bail out of the loop.
11822 	 */
11823 	for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11824 		ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11825 		next = tsbinfop->tsb_next;
11826 		rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11827 		    hatlockp, TSB_SWAPIN);
11828 		if (rc != TSB_SUCCESS) {
11829 			break;
11830 		}
11831 		gotfirst = B_TRUE;
11832 	}
11833 
11834 	switch (rc) {
11835 	case TSB_SUCCESS:
11836 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11837 		cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11838 		return;
11839 	case TSB_LOSTRACE:
11840 		break;
11841 	case TSB_ALLOCFAIL:
11842 		break;
11843 	default:
11844 		panic("sfmmu_replace_tsb returned unrecognized failure code "
11845 		    "%d", rc);
11846 	}
11847 
11848 	/*
11849 	 * In this case, we failed to get one of our TSBs.  If we failed to
11850 	 * get the first TSB, get one of minimum size (8KB).  Walk the list
11851 	 * and throw away the tsbinfos, starting where the allocation failed;
11852 	 * we can get by with just one TSB as long as we don't leave the
11853 	 * SWAPPED tsbinfo structures lying around.
11854 	 */
11855 	tsbinfop = sfmmup->sfmmu_tsb;
11856 	next = tsbinfop->tsb_next;
11857 	tsbinfop->tsb_next = NULL;
11858 
11859 	sfmmu_hat_exit(hatlockp);
11860 	for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11861 		next = tsbinfop->tsb_next;
11862 		sfmmu_tsbinfo_free(tsbinfop);
11863 	}
11864 	hatlockp = sfmmu_hat_enter(sfmmup);
11865 
11866 	/*
11867 	 * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11868 	 * pages.
11869 	 */
11870 	if (!gotfirst) {
11871 		tsbinfop = sfmmup->sfmmu_tsb;
11872 		rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11873 		    hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11874 		ASSERT(rc == TSB_SUCCESS);
11875 	}
11876 
11877 	SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11878 	cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11879 }
11880 
11881 static int
11882 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11883 {
11884 	ulong_t bix = 0;
11885 	uint_t rid;
11886 	sf_region_t *rgnp;
11887 
11888 	ASSERT(srdp != NULL);
11889 	ASSERT(srdp->srd_refcnt != 0);
11890 
11891 	w <<= BT_ULSHIFT;
11892 	while (bmw) {
11893 		if (!(bmw & 0x1)) {
11894 			bix++;
11895 			bmw >>= 1;
11896 			continue;
11897 		}
11898 		rid = w | bix;
11899 		rgnp = srdp->srd_hmergnp[rid];
11900 		ASSERT(rgnp->rgn_refcnt > 0);
11901 		ASSERT(rgnp->rgn_id == rid);
11902 		if (addr < rgnp->rgn_saddr ||
11903 		    addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11904 			bix++;
11905 			bmw >>= 1;
11906 		} else {
11907 			return (1);
11908 		}
11909 	}
11910 	return (0);
11911 }
11912 
11913 /*
11914  * Handle exceptions for low level tsb_handler.
11915  *
11916  * There are many scenarios that could land us here:
11917  *
11918  * If the context is invalid we land here. The context can be invalid
11919  * for 3 reasons: 1) we couldn't allocate a new context and now need to
11920  * perform a wrap around operation in order to allocate a new context.
11921  * 2) Context was invalidated to change pagesize programming 3) ISMs or
11922  * TSBs configuration is changeing for this process and we are forced into
11923  * here to do a syncronization operation. If the context is valid we can
11924  * be here from window trap hanlder. In this case just call trap to handle
11925  * the fault.
11926  *
11927  * Note that the process will run in INVALID_CONTEXT before
11928  * faulting into here and subsequently loading the MMU registers
11929  * (including the TSB base register) associated with this process.
11930  * For this reason, the trap handlers must all test for
11931  * INVALID_CONTEXT before attempting to access any registers other
11932  * than the context registers.
11933  */
11934 void
11935 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11936 {
11937 	sfmmu_t *sfmmup, *shsfmmup;
11938 	uint_t ctxtype;
11939 	klwp_id_t lwp;
11940 	char lwp_save_state;
11941 	hatlock_t *hatlockp, *shatlockp;
11942 	struct tsb_info *tsbinfop;
11943 	struct tsbmiss *tsbmp;
11944 	sf_scd_t *scdp;
11945 
11946 	SFMMU_STAT(sf_tsb_exceptions);
11947 	SFMMU_MMU_STAT(mmu_tsb_exceptions);
11948 	sfmmup = astosfmmu(curthread->t_procp->p_as);
11949 	/*
11950 	 * note that in sun4u, tagacces register contains ctxnum
11951 	 * while sun4v passes ctxtype in the tagaccess register.
11952 	 */
11953 	ctxtype = tagaccess & TAGACC_CTX_MASK;
11954 
11955 	ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11956 	ASSERT(sfmmup->sfmmu_ismhat == 0);
11957 	ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11958 	    ctxtype == INVALID_CONTEXT);
11959 
11960 	if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11961 		/*
11962 		 * We may land here because shme bitmap and pagesize
11963 		 * flags are updated lazily in tsbmiss area on other cpus.
11964 		 * If we detect here that tsbmiss area is out of sync with
11965 		 * sfmmu update it and retry the trapped instruction.
11966 		 * Otherwise call trap().
11967 		 */
11968 		int ret = 0;
11969 		uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11970 		caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11971 
11972 		/*
11973 		 * Must set lwp state to LWP_SYS before
11974 		 * trying to acquire any adaptive lock
11975 		 */
11976 		lwp = ttolwp(curthread);
11977 		ASSERT(lwp);
11978 		lwp_save_state = lwp->lwp_state;
11979 		lwp->lwp_state = LWP_SYS;
11980 
11981 		hatlockp = sfmmu_hat_enter(sfmmup);
11982 		kpreempt_disable();
11983 		tsbmp = &tsbmiss_area[CPU->cpu_id];
11984 		ASSERT(sfmmup == tsbmp->usfmmup);
11985 		if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11986 		    ~tteflag_mask) ||
11987 		    ((tsbmp->uhat_rtteflags ^  sfmmup->sfmmu_rtteflags) &
11988 		    ~tteflag_mask)) {
11989 			tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11990 			tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11991 			ret = 1;
11992 		}
11993 		if (sfmmup->sfmmu_srdp != NULL) {
11994 			ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11995 			ulong_t *tm = tsbmp->shmermap;
11996 			ulong_t i;
11997 			for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11998 				ulong_t d = tm[i] ^ sm[i];
11999 				if (d) {
12000 					if (d & sm[i]) {
12001 						if (!ret && sfmmu_is_rgnva(
12002 						    sfmmup->sfmmu_srdp,
12003 						    addr, i, d & sm[i])) {
12004 							ret = 1;
12005 						}
12006 					}
12007 					tm[i] = sm[i];
12008 				}
12009 			}
12010 		}
12011 		kpreempt_enable();
12012 		sfmmu_hat_exit(hatlockp);
12013 		lwp->lwp_state = lwp_save_state;
12014 		if (ret) {
12015 			return;
12016 		}
12017 	} else if (ctxtype == INVALID_CONTEXT) {
12018 		/*
12019 		 * First, make sure we come out of here with a valid ctx,
12020 		 * since if we don't get one we'll simply loop on the
12021 		 * faulting instruction.
12022 		 *
12023 		 * If the ISM mappings are changing, the TSB is relocated,
12024 		 * the process is swapped, the process is joining SCD or
12025 		 * leaving SCD or shared regions we serialize behind the
12026 		 * controlling thread with hat lock, sfmmu_flags and
12027 		 * sfmmu_tsb_cv condition variable.
12028 		 */
12029 
12030 		/*
12031 		 * Must set lwp state to LWP_SYS before
12032 		 * trying to acquire any adaptive lock
12033 		 */
12034 		lwp = ttolwp(curthread);
12035 		ASSERT(lwp);
12036 		lwp_save_state = lwp->lwp_state;
12037 		lwp->lwp_state = LWP_SYS;
12038 
12039 		hatlockp = sfmmu_hat_enter(sfmmup);
12040 retry:
12041 		if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
12042 			shsfmmup = scdp->scd_sfmmup;
12043 			ASSERT(shsfmmup != NULL);
12044 
12045 			for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
12046 			    tsbinfop = tsbinfop->tsb_next) {
12047 				if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
12048 					/* drop the private hat lock */
12049 					sfmmu_hat_exit(hatlockp);
12050 					/* acquire the shared hat lock */
12051 					shatlockp = sfmmu_hat_enter(shsfmmup);
12052 					/*
12053 					 * recheck to see if anything changed
12054 					 * after we drop the private hat lock.
12055 					 */
12056 					if (sfmmup->sfmmu_scdp == scdp &&
12057 					    shsfmmup == scdp->scd_sfmmup) {
12058 						sfmmu_tsb_chk_reloc(shsfmmup,
12059 						    shatlockp);
12060 					}
12061 					sfmmu_hat_exit(shatlockp);
12062 					hatlockp = sfmmu_hat_enter(sfmmup);
12063 					goto retry;
12064 				}
12065 			}
12066 		}
12067 
12068 		for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
12069 		    tsbinfop = tsbinfop->tsb_next) {
12070 			if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
12071 				cv_wait(&sfmmup->sfmmu_tsb_cv,
12072 				    HATLOCK_MUTEXP(hatlockp));
12073 				goto retry;
12074 			}
12075 		}
12076 
12077 		/*
12078 		 * Wait for ISM maps to be updated.
12079 		 */
12080 		if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12081 			cv_wait(&sfmmup->sfmmu_tsb_cv,
12082 			    HATLOCK_MUTEXP(hatlockp));
12083 			goto retry;
12084 		}
12085 
12086 		/* Is this process joining an SCD? */
12087 		if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
12088 			/*
12089 			 * Flush private TSB and setup shared TSB.
12090 			 * sfmmu_finish_join_scd() does not drop the
12091 			 * hat lock.
12092 			 */
12093 			sfmmu_finish_join_scd(sfmmup);
12094 			SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
12095 		}
12096 
12097 		/*
12098 		 * If we're swapping in, get TSB(s).  Note that we must do
12099 		 * this before we get a ctx or load the MMU state.  Once
12100 		 * we swap in we have to recheck to make sure the TSB(s) and
12101 		 * ISM mappings didn't change while we slept.
12102 		 */
12103 		if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
12104 			sfmmu_tsb_swapin(sfmmup, hatlockp);
12105 			goto retry;
12106 		}
12107 
12108 		sfmmu_get_ctx(sfmmup);
12109 
12110 		sfmmu_hat_exit(hatlockp);
12111 		/*
12112 		 * Must restore lwp_state if not calling
12113 		 * trap() for further processing. Restore
12114 		 * it anyway.
12115 		 */
12116 		lwp->lwp_state = lwp_save_state;
12117 		return;
12118 	}
12119 	trap(rp, (caddr_t)tagaccess, traptype, 0);
12120 }
12121 
12122 static void
12123 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
12124 {
12125 	struct tsb_info *tp;
12126 
12127 	ASSERT(sfmmu_hat_lock_held(sfmmup));
12128 
12129 	for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
12130 		if (tp->tsb_flags & TSB_RELOC_FLAG) {
12131 			cv_wait(&sfmmup->sfmmu_tsb_cv,
12132 			    HATLOCK_MUTEXP(hatlockp));
12133 			break;
12134 		}
12135 	}
12136 }
12137 
12138 /*
12139  * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
12140  * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
12141  * rather than spinning to avoid send mondo timeouts with
12142  * interrupts enabled. When the lock is acquired it is immediately
12143  * released and we return back to sfmmu_vatopfn just after
12144  * the GET_TTE call.
12145  */
12146 void
12147 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
12148 {
12149 	struct page	**pp;
12150 
12151 	(void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
12152 	as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
12153 }
12154 
12155 /*
12156  * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
12157  * TTE_SUSPENDED bit set in tte. We do this so that we can handle
12158  * cross traps which cannot be handled while spinning in the
12159  * trap handlers. Simply enter and exit the kpr_suspendlock spin
12160  * mutex, which is held by the holder of the suspend bit, and then
12161  * retry the trapped instruction after unwinding.
12162  */
12163 /*ARGSUSED*/
12164 void
12165 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
12166 {
12167 	ASSERT(curthread != kreloc_thread);
12168 	mutex_enter(&kpr_suspendlock);
12169 	mutex_exit(&kpr_suspendlock);
12170 }
12171 
12172 /*
12173  * This routine could be optimized to reduce the number of xcalls by flushing
12174  * the entire TLBs if region reference count is above some threshold but the
12175  * tradeoff will depend on the size of the TLB. So for now flush the specific
12176  * page a context at a time.
12177  *
12178  * If uselocks is 0 then it's called after all cpus were captured and all the
12179  * hat locks were taken. In this case don't take the region lock by relying on
12180  * the order of list region update operations in hat_join_region(),
12181  * hat_leave_region() and hat_dup_region(). The ordering in those routines
12182  * guarantees that list is always forward walkable and reaches active sfmmus
12183  * regardless of where xc_attention() captures a cpu.
12184  */
12185 cpuset_t
12186 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
12187     struct hme_blk *hmeblkp, int uselocks)
12188 {
12189 	sfmmu_t	*sfmmup;
12190 	cpuset_t cpuset;
12191 	cpuset_t rcpuset;
12192 	hatlock_t *hatlockp;
12193 	uint_t rid = rgnp->rgn_id;
12194 	sf_rgn_link_t *rlink;
12195 	sf_scd_t *scdp;
12196 
12197 	ASSERT(hmeblkp->hblk_shared);
12198 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
12199 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
12200 
12201 	CPUSET_ZERO(rcpuset);
12202 	if (uselocks) {
12203 		mutex_enter(&rgnp->rgn_mutex);
12204 	}
12205 	sfmmup = rgnp->rgn_sfmmu_head;
12206 	while (sfmmup != NULL) {
12207 		if (uselocks) {
12208 			hatlockp = sfmmu_hat_enter(sfmmup);
12209 		}
12210 
12211 		/*
12212 		 * When an SCD is created the SCD hat is linked on the sfmmu
12213 		 * region lists for each hme region which is part of the
12214 		 * SCD. If we find an SCD hat, when walking these lists,
12215 		 * then we flush the shared TSBs, if we find a private hat,
12216 		 * which is part of an SCD, but where the region
12217 		 * is not part of the SCD then we flush the private TSBs.
12218 		 */
12219 		if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12220 		    !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
12221 			scdp = sfmmup->sfmmu_scdp;
12222 			if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
12223 				if (uselocks) {
12224 					sfmmu_hat_exit(hatlockp);
12225 				}
12226 				goto next;
12227 			}
12228 		}
12229 
12230 		SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12231 
12232 		kpreempt_disable();
12233 		cpuset = sfmmup->sfmmu_cpusran;
12234 		CPUSET_AND(cpuset, cpu_ready_set);
12235 		CPUSET_DEL(cpuset, CPU->cpu_id);
12236 		SFMMU_XCALL_STATS(sfmmup);
12237 		xt_some(cpuset, vtag_flushpage_tl1,
12238 		    (uint64_t)addr, (uint64_t)sfmmup);
12239 		vtag_flushpage(addr, (uint64_t)sfmmup);
12240 		if (uselocks) {
12241 			sfmmu_hat_exit(hatlockp);
12242 		}
12243 		kpreempt_enable();
12244 		CPUSET_OR(rcpuset, cpuset);
12245 
12246 next:
12247 		/* LINTED: constant in conditional context */
12248 		SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
12249 		ASSERT(rlink != NULL);
12250 		sfmmup = rlink->next;
12251 	}
12252 	if (uselocks) {
12253 		mutex_exit(&rgnp->rgn_mutex);
12254 	}
12255 	return (rcpuset);
12256 }
12257 
12258 /*
12259  * This routine takes an sfmmu pointer and the va for an adddress in an
12260  * ISM region as input and returns the corresponding region id in ism_rid.
12261  * The return value of 1 indicates that a region has been found and ism_rid
12262  * is valid, otherwise 0 is returned.
12263  */
12264 static int
12265 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12266 {
12267 	ism_blk_t	*ism_blkp;
12268 	int		i;
12269 	ism_map_t	*ism_map;
12270 #ifdef DEBUG
12271 	struct hat	*ism_hatid;
12272 #endif
12273 	ASSERT(sfmmu_hat_lock_held(sfmmup));
12274 
12275 	ism_blkp = sfmmup->sfmmu_iblk;
12276 	while (ism_blkp != NULL) {
12277 		ism_map = ism_blkp->iblk_maps;
12278 		for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12279 			if ((va >= ism_start(ism_map[i])) &&
12280 			    (va < ism_end(ism_map[i]))) {
12281 
12282 				*ism_rid = ism_map[i].imap_rid;
12283 #ifdef DEBUG
12284 				ism_hatid = ism_map[i].imap_ismhat;
12285 				ASSERT(ism_hatid == ism_sfmmup);
12286 				ASSERT(ism_hatid->sfmmu_ismhat);
12287 #endif
12288 				return (1);
12289 			}
12290 		}
12291 		ism_blkp = ism_blkp->iblk_next;
12292 	}
12293 	return (0);
12294 }
12295 
12296 /*
12297  * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12298  * This routine may be called with all cpu's captured. Therefore, the
12299  * caller is responsible for holding all locks and disabling kernel
12300  * preemption.
12301  */
12302 /* ARGSUSED */
12303 static void
12304 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12305 	struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12306 {
12307 	cpuset_t 	cpuset;
12308 	caddr_t 	va;
12309 	ism_ment_t	*ment;
12310 	sfmmu_t		*sfmmup;
12311 #ifdef VAC
12312 	int 		vcolor;
12313 #endif
12314 
12315 	sf_scd_t	*scdp;
12316 	uint_t		ism_rid;
12317 
12318 	ASSERT(!hmeblkp->hblk_shared);
12319 	/*
12320 	 * Walk the ism_hat's mapping list and flush the page
12321 	 * from every hat sharing this ism_hat. This routine
12322 	 * may be called while all cpu's have been captured.
12323 	 * Therefore we can't attempt to grab any locks. For now
12324 	 * this means we will protect the ism mapping list under
12325 	 * a single lock which will be grabbed by the caller.
12326 	 * If hat_share/unshare scalibility becomes a performance
12327 	 * problem then we may need to re-think ism mapping list locking.
12328 	 */
12329 	ASSERT(ism_sfmmup->sfmmu_ismhat);
12330 	ASSERT(MUTEX_HELD(&ism_mlist_lock));
12331 	addr = addr - ISMID_STARTADDR;
12332 
12333 	for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12334 
12335 		sfmmup = ment->iment_hat;
12336 
12337 		va = ment->iment_base_va;
12338 		va = (caddr_t)((uintptr_t)va  + (uintptr_t)addr);
12339 
12340 		/*
12341 		 * When an SCD is created the SCD hat is linked on the ism
12342 		 * mapping lists for each ISM segment which is part of the
12343 		 * SCD. If we find an SCD hat, when walking these lists,
12344 		 * then we flush the shared TSBs, if we find a private hat,
12345 		 * which is part of an SCD, but where the region
12346 		 * corresponding to this va is not part of the SCD then we
12347 		 * flush the private TSBs.
12348 		 */
12349 		if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12350 		    !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12351 		    !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12352 			if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12353 			    &ism_rid)) {
12354 				cmn_err(CE_PANIC,
12355 				    "can't find matching ISM rid!");
12356 			}
12357 
12358 			scdp = sfmmup->sfmmu_scdp;
12359 			if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12360 			    SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12361 			    ism_rid)) {
12362 				continue;
12363 			}
12364 		}
12365 		SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12366 
12367 		cpuset = sfmmup->sfmmu_cpusran;
12368 		CPUSET_AND(cpuset, cpu_ready_set);
12369 		CPUSET_DEL(cpuset, CPU->cpu_id);
12370 		SFMMU_XCALL_STATS(sfmmup);
12371 		xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12372 		    (uint64_t)sfmmup);
12373 		vtag_flushpage(va, (uint64_t)sfmmup);
12374 
12375 #ifdef VAC
12376 		/*
12377 		 * Flush D$
12378 		 * When flushing D$ we must flush all
12379 		 * cpu's. See sfmmu_cache_flush().
12380 		 */
12381 		if (cache_flush_flag == CACHE_FLUSH) {
12382 			cpuset = cpu_ready_set;
12383 			CPUSET_DEL(cpuset, CPU->cpu_id);
12384 
12385 			SFMMU_XCALL_STATS(sfmmup);
12386 			vcolor = addr_to_vcolor(va);
12387 			xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12388 			vac_flushpage(pfnum, vcolor);
12389 		}
12390 #endif	/* VAC */
12391 	}
12392 }
12393 
12394 /*
12395  * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12396  * a particular virtual address and ctx.  If noflush is set we do not
12397  * flush the TLB/TSB.  This function may or may not be called with the
12398  * HAT lock held.
12399  */
12400 static void
12401 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12402 	pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12403 	int hat_lock_held)
12404 {
12405 #ifdef VAC
12406 	int vcolor;
12407 #endif
12408 	cpuset_t cpuset;
12409 	hatlock_t *hatlockp;
12410 
12411 	ASSERT(!hmeblkp->hblk_shared);
12412 
12413 #if defined(lint) && !defined(VAC)
12414 	pfnum = pfnum;
12415 	cpu_flag = cpu_flag;
12416 	cache_flush_flag = cache_flush_flag;
12417 #endif
12418 
12419 	/*
12420 	 * There is no longer a need to protect against ctx being
12421 	 * stolen here since we don't store the ctx in the TSB anymore.
12422 	 */
12423 #ifdef VAC
12424 	vcolor = addr_to_vcolor(addr);
12425 #endif
12426 
12427 	/*
12428 	 * We must hold the hat lock during the flush of TLB,
12429 	 * to avoid a race with sfmmu_invalidate_ctx(), where
12430 	 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12431 	 * causing TLB demap routine to skip flush on that MMU.
12432 	 * If the context on a MMU has already been set to
12433 	 * INVALID_CONTEXT, we just get an extra flush on
12434 	 * that MMU.
12435 	 */
12436 	if (!hat_lock_held && !tlb_noflush)
12437 		hatlockp = sfmmu_hat_enter(sfmmup);
12438 
12439 	kpreempt_disable();
12440 	if (!tlb_noflush) {
12441 		/*
12442 		 * Flush the TSB and TLB.
12443 		 */
12444 		SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12445 
12446 		cpuset = sfmmup->sfmmu_cpusran;
12447 		CPUSET_AND(cpuset, cpu_ready_set);
12448 		CPUSET_DEL(cpuset, CPU->cpu_id);
12449 
12450 		SFMMU_XCALL_STATS(sfmmup);
12451 
12452 		xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12453 		    (uint64_t)sfmmup);
12454 
12455 		vtag_flushpage(addr, (uint64_t)sfmmup);
12456 	}
12457 
12458 	if (!hat_lock_held && !tlb_noflush)
12459 		sfmmu_hat_exit(hatlockp);
12460 
12461 #ifdef VAC
12462 	/*
12463 	 * Flush the D$
12464 	 *
12465 	 * Even if the ctx is stolen, we need to flush the
12466 	 * cache. Our ctx stealer only flushes the TLBs.
12467 	 */
12468 	if (cache_flush_flag == CACHE_FLUSH) {
12469 		if (cpu_flag & FLUSH_ALL_CPUS) {
12470 			cpuset = cpu_ready_set;
12471 		} else {
12472 			cpuset = sfmmup->sfmmu_cpusran;
12473 			CPUSET_AND(cpuset, cpu_ready_set);
12474 		}
12475 		CPUSET_DEL(cpuset, CPU->cpu_id);
12476 		SFMMU_XCALL_STATS(sfmmup);
12477 		xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12478 		vac_flushpage(pfnum, vcolor);
12479 	}
12480 #endif	/* VAC */
12481 	kpreempt_enable();
12482 }
12483 
12484 /*
12485  * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12486  * address and ctx.  If noflush is set we do not currently do anything.
12487  * This function may or may not be called with the HAT lock held.
12488  */
12489 static void
12490 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12491 	int tlb_noflush, int hat_lock_held)
12492 {
12493 	cpuset_t cpuset;
12494 	hatlock_t *hatlockp;
12495 
12496 	ASSERT(!hmeblkp->hblk_shared);
12497 
12498 	/*
12499 	 * If the process is exiting we have nothing to do.
12500 	 */
12501 	if (tlb_noflush)
12502 		return;
12503 
12504 	/*
12505 	 * Flush TSB.
12506 	 */
12507 	if (!hat_lock_held)
12508 		hatlockp = sfmmu_hat_enter(sfmmup);
12509 	SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12510 
12511 	kpreempt_disable();
12512 
12513 	cpuset = sfmmup->sfmmu_cpusran;
12514 	CPUSET_AND(cpuset, cpu_ready_set);
12515 	CPUSET_DEL(cpuset, CPU->cpu_id);
12516 
12517 	SFMMU_XCALL_STATS(sfmmup);
12518 	xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12519 
12520 	vtag_flushpage(addr, (uint64_t)sfmmup);
12521 
12522 	if (!hat_lock_held)
12523 		sfmmu_hat_exit(hatlockp);
12524 
12525 	kpreempt_enable();
12526 
12527 }
12528 
12529 /*
12530  * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12531  * call handler that can flush a range of pages to save on xcalls.
12532  */
12533 static int sfmmu_xcall_save;
12534 
12535 /*
12536  * this routine is never used for demaping addresses backed by SRD hmeblks.
12537  */
12538 static void
12539 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12540 {
12541 	sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12542 	hatlock_t *hatlockp;
12543 	cpuset_t cpuset;
12544 	uint64_t sfmmu_pgcnt;
12545 	pgcnt_t pgcnt = 0;
12546 	int pgunload = 0;
12547 	int dirtypg = 0;
12548 	caddr_t addr = dmrp->dmr_addr;
12549 	caddr_t eaddr;
12550 	uint64_t bitvec = dmrp->dmr_bitvec;
12551 
12552 	ASSERT(bitvec & 1);
12553 
12554 	/*
12555 	 * Flush TSB and calculate number of pages to flush.
12556 	 */
12557 	while (bitvec != 0) {
12558 		dirtypg = 0;
12559 		/*
12560 		 * Find the first page to flush and then count how many
12561 		 * pages there are after it that also need to be flushed.
12562 		 * This way the number of TSB flushes is minimized.
12563 		 */
12564 		while ((bitvec & 1) == 0) {
12565 			pgcnt++;
12566 			addr += MMU_PAGESIZE;
12567 			bitvec >>= 1;
12568 		}
12569 		while (bitvec & 1) {
12570 			dirtypg++;
12571 			bitvec >>= 1;
12572 		}
12573 		eaddr = addr + ptob(dirtypg);
12574 		hatlockp = sfmmu_hat_enter(sfmmup);
12575 		sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12576 		sfmmu_hat_exit(hatlockp);
12577 		pgunload += dirtypg;
12578 		addr = eaddr;
12579 		pgcnt += dirtypg;
12580 	}
12581 
12582 	ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12583 	if (sfmmup->sfmmu_free == 0) {
12584 		addr = dmrp->dmr_addr;
12585 		bitvec = dmrp->dmr_bitvec;
12586 
12587 		/*
12588 		 * make sure it has SFMMU_PGCNT_SHIFT bits only,
12589 		 * as it will be used to pack argument for xt_some
12590 		 */
12591 		ASSERT((pgcnt > 0) &&
12592 		    (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12593 
12594 		/*
12595 		 * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12596 		 * the low 6 bits of sfmmup. This is doable since pgcnt
12597 		 * always >= 1.
12598 		 */
12599 		ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12600 		sfmmu_pgcnt = (uint64_t)sfmmup |
12601 		    ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12602 
12603 		/*
12604 		 * We must hold the hat lock during the flush of TLB,
12605 		 * to avoid a race with sfmmu_invalidate_ctx(), where
12606 		 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12607 		 * causing TLB demap routine to skip flush on that MMU.
12608 		 * If the context on a MMU has already been set to
12609 		 * INVALID_CONTEXT, we just get an extra flush on
12610 		 * that MMU.
12611 		 */
12612 		hatlockp = sfmmu_hat_enter(sfmmup);
12613 		kpreempt_disable();
12614 
12615 		cpuset = sfmmup->sfmmu_cpusran;
12616 		CPUSET_AND(cpuset, cpu_ready_set);
12617 		CPUSET_DEL(cpuset, CPU->cpu_id);
12618 
12619 		SFMMU_XCALL_STATS(sfmmup);
12620 		xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12621 		    sfmmu_pgcnt);
12622 
12623 		for (; bitvec != 0; bitvec >>= 1) {
12624 			if (bitvec & 1)
12625 				vtag_flushpage(addr, (uint64_t)sfmmup);
12626 			addr += MMU_PAGESIZE;
12627 		}
12628 		kpreempt_enable();
12629 		sfmmu_hat_exit(hatlockp);
12630 
12631 		sfmmu_xcall_save += (pgunload-1);
12632 	}
12633 	dmrp->dmr_bitvec = 0;
12634 }
12635 
12636 /*
12637  * In cases where we need to synchronize with TLB/TSB miss trap
12638  * handlers, _and_ need to flush the TLB, it's a lot easier to
12639  * throw away the context from the process than to do a
12640  * special song and dance to keep things consistent for the
12641  * handlers.
12642  *
12643  * Since the process suddenly ends up without a context and our caller
12644  * holds the hat lock, threads that fault after this function is called
12645  * will pile up on the lock.  We can then do whatever we need to
12646  * atomically from the context of the caller.  The first blocked thread
12647  * to resume executing will get the process a new context, and the
12648  * process will resume executing.
12649  *
12650  * One added advantage of this approach is that on MMUs that
12651  * support a "flush all" operation, we will delay the flush until
12652  * cnum wrap-around, and then flush the TLB one time.  This
12653  * is rather rare, so it's a lot less expensive than making 8000
12654  * x-calls to flush the TLB 8000 times.
12655  *
12656  * A per-process (PP) lock is used to synchronize ctx allocations in
12657  * resume() and ctx invalidations here.
12658  */
12659 static void
12660 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12661 {
12662 	cpuset_t cpuset;
12663 	int cnum, currcnum;
12664 	mmu_ctx_t *mmu_ctxp;
12665 	int i;
12666 	uint_t pstate_save;
12667 
12668 	SFMMU_STAT(sf_ctx_inv);
12669 
12670 	ASSERT(sfmmu_hat_lock_held(sfmmup));
12671 	ASSERT(sfmmup != ksfmmup);
12672 
12673 	kpreempt_disable();
12674 
12675 	mmu_ctxp = CPU_MMU_CTXP(CPU);
12676 	ASSERT(mmu_ctxp);
12677 	ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12678 	ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12679 
12680 	currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12681 
12682 	pstate_save = sfmmu_disable_intrs();
12683 
12684 	lock_set(&sfmmup->sfmmu_ctx_lock);	/* acquire PP lock */
12685 	/* set HAT cnum invalid across all context domains. */
12686 	for (i = 0; i < max_mmu_ctxdoms; i++) {
12687 
12688 		cnum = 	sfmmup->sfmmu_ctxs[i].cnum;
12689 		if (cnum == INVALID_CONTEXT) {
12690 			continue;
12691 		}
12692 
12693 		sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12694 	}
12695 	membar_enter();	/* make sure globally visible to all CPUs */
12696 	lock_clear(&sfmmup->sfmmu_ctx_lock);	/* release PP lock */
12697 
12698 	sfmmu_enable_intrs(pstate_save);
12699 
12700 	cpuset = sfmmup->sfmmu_cpusran;
12701 	CPUSET_DEL(cpuset, CPU->cpu_id);
12702 	CPUSET_AND(cpuset, cpu_ready_set);
12703 	if (!CPUSET_ISNULL(cpuset)) {
12704 		SFMMU_XCALL_STATS(sfmmup);
12705 		xt_some(cpuset, sfmmu_raise_tsb_exception,
12706 		    (uint64_t)sfmmup, INVALID_CONTEXT);
12707 		xt_sync(cpuset);
12708 		SFMMU_STAT(sf_tsb_raise_exception);
12709 		SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12710 	}
12711 
12712 	/*
12713 	 * If the hat to-be-invalidated is the same as the current
12714 	 * process on local CPU we need to invalidate
12715 	 * this CPU context as well.
12716 	 */
12717 	if ((sfmmu_getctx_sec() == currcnum) &&
12718 	    (currcnum != INVALID_CONTEXT)) {
12719 		/* sets shared context to INVALID too */
12720 		sfmmu_setctx_sec(INVALID_CONTEXT);
12721 		sfmmu_clear_utsbinfo();
12722 	}
12723 
12724 	SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12725 
12726 	kpreempt_enable();
12727 
12728 	/*
12729 	 * we hold the hat lock, so nobody should allocate a context
12730 	 * for us yet
12731 	 */
12732 	ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12733 }
12734 
12735 #ifdef VAC
12736 /*
12737  * We need to flush the cache in all cpus.  It is possible that
12738  * a process referenced a page as cacheable but has sinced exited
12739  * and cleared the mapping list.  We still to flush it but have no
12740  * state so all cpus is the only alternative.
12741  */
12742 void
12743 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12744 {
12745 	cpuset_t cpuset;
12746 
12747 	kpreempt_disable();
12748 	cpuset = cpu_ready_set;
12749 	CPUSET_DEL(cpuset, CPU->cpu_id);
12750 	SFMMU_XCALL_STATS(NULL);	/* account to any ctx */
12751 	xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12752 	xt_sync(cpuset);
12753 	vac_flushpage(pfnum, vcolor);
12754 	kpreempt_enable();
12755 }
12756 
12757 void
12758 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12759 {
12760 	cpuset_t cpuset;
12761 
12762 	ASSERT(vcolor >= 0);
12763 
12764 	kpreempt_disable();
12765 	cpuset = cpu_ready_set;
12766 	CPUSET_DEL(cpuset, CPU->cpu_id);
12767 	SFMMU_XCALL_STATS(NULL);	/* account to any ctx */
12768 	xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12769 	xt_sync(cpuset);
12770 	vac_flushcolor(vcolor, pfnum);
12771 	kpreempt_enable();
12772 }
12773 #endif	/* VAC */
12774 
12775 /*
12776  * We need to prevent processes from accessing the TSB using a cached physical
12777  * address.  It's alright if they try to access the TSB via virtual address
12778  * since they will just fault on that virtual address once the mapping has
12779  * been suspended.
12780  */
12781 #pragma weak sendmondo_in_recover
12782 
12783 /* ARGSUSED */
12784 static int
12785 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12786 {
12787 	struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12788 	sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12789 	hatlock_t *hatlockp;
12790 	sf_scd_t *scdp;
12791 
12792 	if (flags != HAT_PRESUSPEND)
12793 		return (0);
12794 
12795 	/*
12796 	 * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12797 	 * be a shared hat, then set SCD's tsbinfo's flag.
12798 	 * If tsb is not shared, sfmmup is a private hat, then set
12799 	 * its private tsbinfo's flag.
12800 	 */
12801 	hatlockp = sfmmu_hat_enter(sfmmup);
12802 	tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12803 
12804 	if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12805 		sfmmu_tsb_inv_ctx(sfmmup);
12806 		sfmmu_hat_exit(hatlockp);
12807 	} else {
12808 		/* release lock on the shared hat */
12809 		sfmmu_hat_exit(hatlockp);
12810 		/* sfmmup is a shared hat */
12811 		ASSERT(sfmmup->sfmmu_scdhat);
12812 		scdp = sfmmup->sfmmu_scdp;
12813 		ASSERT(scdp != NULL);
12814 		/* get private hat from the scd list */
12815 		mutex_enter(&scdp->scd_mutex);
12816 		sfmmup = scdp->scd_sf_list;
12817 		while (sfmmup != NULL) {
12818 			hatlockp = sfmmu_hat_enter(sfmmup);
12819 			/*
12820 			 * We do not call sfmmu_tsb_inv_ctx here because
12821 			 * sendmondo_in_recover check is only needed for
12822 			 * sun4u.
12823 			 */
12824 			sfmmu_invalidate_ctx(sfmmup);
12825 			sfmmu_hat_exit(hatlockp);
12826 			sfmmup = sfmmup->sfmmu_scd_link.next;
12827 
12828 		}
12829 		mutex_exit(&scdp->scd_mutex);
12830 	}
12831 	return (0);
12832 }
12833 
12834 static void
12835 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12836 {
12837 	extern uint32_t sendmondo_in_recover;
12838 
12839 	ASSERT(sfmmu_hat_lock_held(sfmmup));
12840 
12841 	/*
12842 	 * For Cheetah+ Erratum 25:
12843 	 * Wait for any active recovery to finish.  We can't risk
12844 	 * relocating the TSB of the thread running mondo_recover_proc()
12845 	 * since, if we did that, we would deadlock.  The scenario we are
12846 	 * trying to avoid is as follows:
12847 	 *
12848 	 * THIS CPU			RECOVER CPU
12849 	 * --------			-----------
12850 	 *				Begins recovery, walking through TSB
12851 	 * hat_pagesuspend() TSB TTE
12852 	 *				TLB miss on TSB TTE, spins at TL1
12853 	 * xt_sync()
12854 	 *	send_mondo_timeout()
12855 	 *	mondo_recover_proc()
12856 	 *	((deadlocked))
12857 	 *
12858 	 * The second half of the workaround is that mondo_recover_proc()
12859 	 * checks to see if the tsb_info has the RELOC flag set, and if it
12860 	 * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12861 	 * and hence avoiding the TLB miss that could result in a deadlock.
12862 	 */
12863 	if (&sendmondo_in_recover) {
12864 		membar_enter();	/* make sure RELOC flag visible */
12865 		while (sendmondo_in_recover) {
12866 			drv_usecwait(1);
12867 			membar_consumer();
12868 		}
12869 	}
12870 
12871 	sfmmu_invalidate_ctx(sfmmup);
12872 }
12873 
12874 /* ARGSUSED */
12875 static int
12876 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12877 	void *tsbinfo, pfn_t newpfn)
12878 {
12879 	hatlock_t *hatlockp;
12880 	struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12881 	sfmmu_t	*sfmmup = tsbinfop->tsb_sfmmu;
12882 
12883 	if (flags != HAT_POSTUNSUSPEND)
12884 		return (0);
12885 
12886 	hatlockp = sfmmu_hat_enter(sfmmup);
12887 
12888 	SFMMU_STAT(sf_tsb_reloc);
12889 
12890 	/*
12891 	 * The process may have swapped out while we were relocating one
12892 	 * of its TSBs.  If so, don't bother doing the setup since the
12893 	 * process can't be using the memory anymore.
12894 	 */
12895 	if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12896 		ASSERT(va == tsbinfop->tsb_va);
12897 		sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12898 
12899 		if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12900 			sfmmu_inv_tsb(tsbinfop->tsb_va,
12901 			    TSB_BYTES(tsbinfop->tsb_szc));
12902 			tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12903 		}
12904 	}
12905 
12906 	membar_exit();
12907 	tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12908 	cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12909 
12910 	sfmmu_hat_exit(hatlockp);
12911 
12912 	return (0);
12913 }
12914 
12915 /*
12916  * Allocate and initialize a tsb_info structure.  Note that we may or may not
12917  * allocate a TSB here, depending on the flags passed in.
12918  */
12919 static int
12920 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12921 	uint_t flags, sfmmu_t *sfmmup)
12922 {
12923 	int err;
12924 
12925 	*tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12926 	    sfmmu_tsbinfo_cache, KM_SLEEP);
12927 
12928 	if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12929 	    tsb_szc, flags, sfmmup)) != 0) {
12930 		kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12931 		SFMMU_STAT(sf_tsb_allocfail);
12932 		*tsbinfopp = NULL;
12933 		return (err);
12934 	}
12935 	SFMMU_STAT(sf_tsb_alloc);
12936 
12937 	/*
12938 	 * Bump the TSB size counters for this TSB size.
12939 	 */
12940 	(*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12941 	return (0);
12942 }
12943 
12944 static void
12945 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12946 {
12947 	caddr_t tsbva = tsbinfo->tsb_va;
12948 	uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12949 	struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12950 	vmem_t	*vmp = tsbinfo->tsb_vmp;
12951 
12952 	/*
12953 	 * If we allocated this TSB from relocatable kernel memory, then we
12954 	 * need to uninstall the callback handler.
12955 	 */
12956 	if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12957 		uintptr_t slab_mask;
12958 		caddr_t slab_vaddr;
12959 		page_t **ppl;
12960 		int ret;
12961 
12962 		ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12963 		if (tsb_size > MMU_PAGESIZE4M)
12964 			slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12965 		else
12966 			slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12967 		slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12968 
12969 		ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12970 		ASSERT(ret == 0);
12971 		hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12972 		    0, NULL);
12973 		as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12974 	}
12975 
12976 	if (kmem_cachep != NULL) {
12977 		kmem_cache_free(kmem_cachep, tsbva);
12978 	} else {
12979 		vmem_xfree(vmp, (void *)tsbva, tsb_size);
12980 	}
12981 	tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12982 	atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12983 }
12984 
12985 static void
12986 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12987 {
12988 	if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12989 		sfmmu_tsb_free(tsbinfo);
12990 	}
12991 	kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12992 
12993 }
12994 
12995 /*
12996  * Setup all the references to physical memory for this tsbinfo.
12997  * The underlying page(s) must be locked.
12998  */
12999 static void
13000 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
13001 {
13002 	ASSERT(pfn != PFN_INVALID);
13003 	ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
13004 
13005 #ifndef sun4v
13006 	if (tsbinfo->tsb_szc == 0) {
13007 		sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
13008 		    PROT_WRITE|PROT_READ, TTE8K);
13009 	} else {
13010 		/*
13011 		 * Round down PA and use a large mapping; the handlers will
13012 		 * compute the TSB pointer at the correct offset into the
13013 		 * big virtual page.  NOTE: this assumes all TSBs larger
13014 		 * than 8K must come from physically contiguous slabs of
13015 		 * size tsb_slab_size.
13016 		 */
13017 		sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
13018 		    PROT_WRITE|PROT_READ, tsb_slab_ttesz);
13019 	}
13020 	tsbinfo->tsb_pa = ptob(pfn);
13021 
13022 	TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
13023 	TTE_SET_MOD(&tsbinfo->tsb_tte);    /* enable writes */
13024 
13025 	ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
13026 	ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
13027 #else /* sun4v */
13028 	tsbinfo->tsb_pa = ptob(pfn);
13029 #endif /* sun4v */
13030 }
13031 
13032 
13033 /*
13034  * Returns zero on success, ENOMEM if over the high water mark,
13035  * or EAGAIN if the caller needs to retry with a smaller TSB
13036  * size (or specify TSB_FORCEALLOC if the allocation can't fail).
13037  *
13038  * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
13039  * is specified and the TSB requested is PAGESIZE, though it
13040  * may sleep waiting for memory if sufficient memory is not
13041  * available.
13042  */
13043 static int
13044 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
13045     int tsbcode, uint_t flags, sfmmu_t *sfmmup)
13046 {
13047 	caddr_t vaddr = NULL;
13048 	caddr_t slab_vaddr;
13049 	uintptr_t slab_mask;
13050 	int tsbbytes = TSB_BYTES(tsbcode);
13051 	int lowmem = 0;
13052 	struct kmem_cache *kmem_cachep = NULL;
13053 	vmem_t *vmp = NULL;
13054 	lgrp_id_t lgrpid = LGRP_NONE;
13055 	pfn_t pfn;
13056 	uint_t cbflags = HAC_SLEEP;
13057 	page_t **pplist;
13058 	int ret;
13059 
13060 	ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
13061 	if (tsbbytes > MMU_PAGESIZE4M)
13062 		slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
13063 	else
13064 		slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
13065 
13066 	if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
13067 		flags |= TSB_ALLOC;
13068 
13069 	ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
13070 
13071 	tsbinfo->tsb_sfmmu = sfmmup;
13072 
13073 	/*
13074 	 * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
13075 	 * return.
13076 	 */
13077 	if ((flags & TSB_ALLOC) == 0) {
13078 		tsbinfo->tsb_szc = tsbcode;
13079 		tsbinfo->tsb_ttesz_mask = tteszmask;
13080 		tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
13081 		tsbinfo->tsb_pa = -1;
13082 		tsbinfo->tsb_tte.ll = 0;
13083 		tsbinfo->tsb_next = NULL;
13084 		tsbinfo->tsb_flags = TSB_SWAPPED;
13085 		tsbinfo->tsb_cache = NULL;
13086 		tsbinfo->tsb_vmp = NULL;
13087 		return (0);
13088 	}
13089 
13090 #ifdef DEBUG
13091 	/*
13092 	 * For debugging:
13093 	 * Randomly force allocation failures every tsb_alloc_mtbf
13094 	 * tries if TSB_FORCEALLOC is not specified.  This will
13095 	 * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
13096 	 * it is even, to allow testing of both failure paths...
13097 	 */
13098 	if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
13099 	    (tsb_alloc_count++ == tsb_alloc_mtbf)) {
13100 		tsb_alloc_count = 0;
13101 		tsb_alloc_fail_mtbf++;
13102 		return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
13103 	}
13104 #endif	/* DEBUG */
13105 
13106 	/*
13107 	 * Enforce high water mark if we are not doing a forced allocation
13108 	 * and are not shrinking a process' TSB.
13109 	 */
13110 	if ((flags & TSB_SHRINK) == 0 &&
13111 	    (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
13112 		if ((flags & TSB_FORCEALLOC) == 0)
13113 			return (ENOMEM);
13114 		lowmem = 1;
13115 	}
13116 
13117 	/*
13118 	 * Allocate from the correct location based upon the size of the TSB
13119 	 * compared to the base page size, and what memory conditions dictate.
13120 	 * Note we always do nonblocking allocations from the TSB arena since
13121 	 * we don't want memory fragmentation to cause processes to block
13122 	 * indefinitely waiting for memory; until the kernel algorithms that
13123 	 * coalesce large pages are improved this is our best option.
13124 	 *
13125 	 * Algorithm:
13126 	 *	If allocating a "large" TSB (>8K), allocate from the
13127 	 *		appropriate kmem_tsb_default_arena vmem arena
13128 	 *	else if low on memory or the TSB_FORCEALLOC flag is set or
13129 	 *	tsb_forceheap is set
13130 	 *		Allocate from kernel heap via sfmmu_tsb8k_cache with
13131 	 *		KM_SLEEP (never fails)
13132 	 *	else
13133 	 *		Allocate from appropriate sfmmu_tsb_cache with
13134 	 *		KM_NOSLEEP
13135 	 *	endif
13136 	 */
13137 	if (tsb_lgrp_affinity)
13138 		lgrpid = lgrp_home_id(curthread);
13139 	if (lgrpid == LGRP_NONE)
13140 		lgrpid = 0;	/* use lgrp of boot CPU */
13141 
13142 	if (tsbbytes > MMU_PAGESIZE) {
13143 		if (tsbbytes > MMU_PAGESIZE4M) {
13144 			vmp = kmem_bigtsb_default_arena[lgrpid];
13145 			vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
13146 			    0, 0, NULL, NULL, VM_NOSLEEP);
13147 		} else {
13148 			vmp = kmem_tsb_default_arena[lgrpid];
13149 			vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
13150 			    0, 0, NULL, NULL, VM_NOSLEEP);
13151 		}
13152 #ifdef	DEBUG
13153 	} else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
13154 #else	/* !DEBUG */
13155 	} else if (lowmem || (flags & TSB_FORCEALLOC)) {
13156 #endif	/* DEBUG */
13157 		kmem_cachep = sfmmu_tsb8k_cache;
13158 		vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
13159 		ASSERT(vaddr != NULL);
13160 	} else {
13161 		kmem_cachep = sfmmu_tsb_cache[lgrpid];
13162 		vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
13163 	}
13164 
13165 	tsbinfo->tsb_cache = kmem_cachep;
13166 	tsbinfo->tsb_vmp = vmp;
13167 
13168 	if (vaddr == NULL) {
13169 		return (EAGAIN);
13170 	}
13171 
13172 	atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
13173 	kmem_cachep = tsbinfo->tsb_cache;
13174 
13175 	/*
13176 	 * If we are allocating from outside the cage, then we need to
13177 	 * register a relocation callback handler.  Note that for now
13178 	 * since pseudo mappings always hang off of the slab's root page,
13179 	 * we need only lock the first 8K of the TSB slab.  This is a bit
13180 	 * hacky but it is good for performance.
13181 	 */
13182 	if (kmem_cachep != sfmmu_tsb8k_cache) {
13183 		slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
13184 		ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
13185 		ASSERT(ret == 0);
13186 		ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
13187 		    cbflags, (void *)tsbinfo, &pfn, NULL);
13188 
13189 		/*
13190 		 * Need to free up resources if we could not successfully
13191 		 * add the callback function and return an error condition.
13192 		 */
13193 		if (ret != 0) {
13194 			if (kmem_cachep) {
13195 				kmem_cache_free(kmem_cachep, vaddr);
13196 			} else {
13197 				vmem_xfree(vmp, (void *)vaddr, tsbbytes);
13198 			}
13199 			as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
13200 			    S_WRITE);
13201 			return (EAGAIN);
13202 		}
13203 	} else {
13204 		/*
13205 		 * Since allocation of 8K TSBs from heap is rare and occurs
13206 		 * during memory pressure we allocate them from permanent
13207 		 * memory rather than using callbacks to get the PFN.
13208 		 */
13209 		pfn = hat_getpfnum(kas.a_hat, vaddr);
13210 	}
13211 
13212 	tsbinfo->tsb_va = vaddr;
13213 	tsbinfo->tsb_szc = tsbcode;
13214 	tsbinfo->tsb_ttesz_mask = tteszmask;
13215 	tsbinfo->tsb_next = NULL;
13216 	tsbinfo->tsb_flags = 0;
13217 
13218 	sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
13219 
13220 	sfmmu_inv_tsb(vaddr, tsbbytes);
13221 
13222 	if (kmem_cachep != sfmmu_tsb8k_cache) {
13223 		as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
13224 	}
13225 
13226 	return (0);
13227 }
13228 
13229 /*
13230  * Initialize per cpu tsb and per cpu tsbmiss_area
13231  */
13232 void
13233 sfmmu_init_tsbs(void)
13234 {
13235 	int i;
13236 	struct tsbmiss	*tsbmissp;
13237 	struct kpmtsbm	*kpmtsbmp;
13238 #ifndef sun4v
13239 	extern int	dcache_line_mask;
13240 #endif /* sun4v */
13241 	extern uint_t	vac_colors;
13242 
13243 	/*
13244 	 * Init. tsb miss area.
13245 	 */
13246 	tsbmissp = tsbmiss_area;
13247 
13248 	for (i = 0; i < NCPU; tsbmissp++, i++) {
13249 		/*
13250 		 * initialize the tsbmiss area.
13251 		 * Do this for all possible CPUs as some may be added
13252 		 * while the system is running. There is no cost to this.
13253 		 */
13254 		tsbmissp->ksfmmup = ksfmmup;
13255 #ifndef sun4v
13256 		tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13257 #endif /* sun4v */
13258 		tsbmissp->khashstart =
13259 		    (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13260 		tsbmissp->uhashstart =
13261 		    (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13262 		tsbmissp->khashsz = khmehash_num;
13263 		tsbmissp->uhashsz = uhmehash_num;
13264 	}
13265 
13266 	sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13267 	    sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13268 
13269 	if (kpm_enable == 0)
13270 		return;
13271 
13272 	/* -- Begin KPM specific init -- */
13273 
13274 	if (kpm_smallpages) {
13275 		/*
13276 		 * If we're using base pagesize pages for seg_kpm
13277 		 * mappings, we use the kernel TSB since we can't afford
13278 		 * to allocate a second huge TSB for these mappings.
13279 		 */
13280 		kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13281 		kpm_tsbsz = ktsb_szcode;
13282 		kpmsm_tsbbase = kpm_tsbbase;
13283 		kpmsm_tsbsz = kpm_tsbsz;
13284 	} else {
13285 		/*
13286 		 * In VAC conflict case, just put the entries in the
13287 		 * kernel 8K indexed TSB for now so we can find them.
13288 		 * This could really be changed in the future if we feel
13289 		 * the need...
13290 		 */
13291 		kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13292 		kpmsm_tsbsz = ktsb_szcode;
13293 		kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13294 		kpm_tsbsz = ktsb4m_szcode;
13295 	}
13296 
13297 	kpmtsbmp = kpmtsbm_area;
13298 	for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13299 		/*
13300 		 * Initialize the kpmtsbm area.
13301 		 * Do this for all possible CPUs as some may be added
13302 		 * while the system is running. There is no cost to this.
13303 		 */
13304 		kpmtsbmp->vbase = kpm_vbase;
13305 		kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13306 		kpmtsbmp->sz_shift = kpm_size_shift;
13307 		kpmtsbmp->kpmp_shift = kpmp_shift;
13308 		kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13309 		if (kpm_smallpages == 0) {
13310 			kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13311 			kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13312 		} else {
13313 			kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13314 			kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13315 		}
13316 		kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13317 		kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13318 #ifdef	DEBUG
13319 		kpmtsbmp->flags |= (kpm_tsbmtl) ?  KPMTSBM_TLTSBM_FLAG : 0;
13320 #endif	/* DEBUG */
13321 		if (ktsb_phys)
13322 			kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13323 	}
13324 
13325 	/* -- End KPM specific init -- */
13326 }
13327 
13328 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13329 struct tsb_info ktsb_info[2];
13330 
13331 /*
13332  * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13333  */
13334 void
13335 sfmmu_init_ktsbinfo()
13336 {
13337 	ASSERT(ksfmmup != NULL);
13338 	ASSERT(ksfmmup->sfmmu_tsb == NULL);
13339 	/*
13340 	 * Allocate tsbinfos for kernel and copy in data
13341 	 * to make debug easier and sun4v setup easier.
13342 	 */
13343 	ktsb_info[0].tsb_sfmmu = ksfmmup;
13344 	ktsb_info[0].tsb_szc = ktsb_szcode;
13345 	ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13346 	ktsb_info[0].tsb_va = ktsb_base;
13347 	ktsb_info[0].tsb_pa = ktsb_pbase;
13348 	ktsb_info[0].tsb_flags = 0;
13349 	ktsb_info[0].tsb_tte.ll = 0;
13350 	ktsb_info[0].tsb_cache = NULL;
13351 
13352 	ktsb_info[1].tsb_sfmmu = ksfmmup;
13353 	ktsb_info[1].tsb_szc = ktsb4m_szcode;
13354 	ktsb_info[1].tsb_ttesz_mask = TSB4M;
13355 	ktsb_info[1].tsb_va = ktsb4m_base;
13356 	ktsb_info[1].tsb_pa = ktsb4m_pbase;
13357 	ktsb_info[1].tsb_flags = 0;
13358 	ktsb_info[1].tsb_tte.ll = 0;
13359 	ktsb_info[1].tsb_cache = NULL;
13360 
13361 	/* Link them into ksfmmup. */
13362 	ktsb_info[0].tsb_next = &ktsb_info[1];
13363 	ktsb_info[1].tsb_next = NULL;
13364 	ksfmmup->sfmmu_tsb = &ktsb_info[0];
13365 
13366 	sfmmu_setup_tsbinfo(ksfmmup);
13367 }
13368 
13369 /*
13370  * Cache the last value returned from va_to_pa().  If the VA specified
13371  * in the current call to cached_va_to_pa() maps to the same Page (as the
13372  * previous call to cached_va_to_pa()), then compute the PA using
13373  * cached info, else call va_to_pa().
13374  *
13375  * Note: this function is neither MT-safe nor consistent in the presence
13376  * of multiple, interleaved threads.  This function was created to enable
13377  * an optimization used during boot (at a point when there's only one thread
13378  * executing on the "boot CPU", and before startup_vm() has been called).
13379  */
13380 static uint64_t
13381 cached_va_to_pa(void *vaddr)
13382 {
13383 	static uint64_t prev_vaddr_base = 0;
13384 	static uint64_t prev_pfn = 0;
13385 
13386 	if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13387 		return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13388 	} else {
13389 		uint64_t pa = va_to_pa(vaddr);
13390 
13391 		if (pa != ((uint64_t)-1)) {
13392 			/*
13393 			 * Computed physical address is valid.  Cache its
13394 			 * related info for the next cached_va_to_pa() call.
13395 			 */
13396 			prev_pfn = pa & MMU_PAGEMASK;
13397 			prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13398 		}
13399 
13400 		return (pa);
13401 	}
13402 }
13403 
13404 /*
13405  * Carve up our nucleus hblk region.  We may allocate more hblks than
13406  * asked due to rounding errors but we are guaranteed to have at least
13407  * enough space to allocate the requested number of hblk8's and hblk1's.
13408  */
13409 void
13410 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13411 {
13412 	struct hme_blk *hmeblkp;
13413 	size_t hme8blk_sz, hme1blk_sz;
13414 	size_t i;
13415 	size_t hblk8_bound;
13416 	ulong_t j = 0, k = 0;
13417 
13418 	ASSERT(addr != NULL && size != 0);
13419 
13420 	/* Need to use proper structure alignment */
13421 	hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13422 	hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13423 
13424 	nucleus_hblk8.list = (void *)addr;
13425 	nucleus_hblk8.index = 0;
13426 
13427 	/*
13428 	 * Use as much memory as possible for hblk8's since we
13429 	 * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13430 	 * We need to hold back enough space for the hblk1's which
13431 	 * we'll allocate next.
13432 	 */
13433 	hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13434 	for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13435 		hmeblkp = (struct hme_blk *)addr;
13436 		addr += hme8blk_sz;
13437 		hmeblkp->hblk_nuc_bit = 1;
13438 		hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13439 	}
13440 	nucleus_hblk8.len = j;
13441 	ASSERT(j >= nhblk8);
13442 	SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13443 
13444 	nucleus_hblk1.list = (void *)addr;
13445 	nucleus_hblk1.index = 0;
13446 	for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13447 		hmeblkp = (struct hme_blk *)addr;
13448 		addr += hme1blk_sz;
13449 		hmeblkp->hblk_nuc_bit = 1;
13450 		hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13451 	}
13452 	ASSERT(k >= nhblk1);
13453 	nucleus_hblk1.len = k;
13454 	SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13455 }
13456 
13457 /*
13458  * This function is currently not supported on this platform. For what
13459  * it's supposed to do, see hat.c and hat_srmmu.c
13460  */
13461 /* ARGSUSED */
13462 faultcode_t
13463 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13464     uint_t flags)
13465 {
13466 	ASSERT(hat->sfmmu_xhat_provider == NULL);
13467 	return (FC_NOSUPPORT);
13468 }
13469 
13470 /*
13471  * Searchs the mapping list of the page for a mapping of the same size. If not
13472  * found the corresponding bit is cleared in the p_index field. When large
13473  * pages are more prevalent in the system, we can maintain the mapping list
13474  * in order and we don't have to traverse the list each time. Just check the
13475  * next and prev entries, and if both are of different size, we clear the bit.
13476  */
13477 static void
13478 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13479 {
13480 	struct sf_hment *sfhmep;
13481 	struct hme_blk *hmeblkp;
13482 	int	index;
13483 	pgcnt_t	npgs;
13484 
13485 	ASSERT(ttesz > TTE8K);
13486 
13487 	ASSERT(sfmmu_mlist_held(pp));
13488 
13489 	ASSERT(PP_ISMAPPED_LARGE(pp));
13490 
13491 	/*
13492 	 * Traverse mapping list looking for another mapping of same size.
13493 	 * since we only want to clear index field if all mappings of
13494 	 * that size are gone.
13495 	 */
13496 
13497 	for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13498 		if (IS_PAHME(sfhmep))
13499 			continue;
13500 		hmeblkp = sfmmu_hmetohblk(sfhmep);
13501 		if (hmeblkp->hblk_xhat_bit)
13502 			continue;
13503 		if (hme_size(sfhmep) == ttesz) {
13504 			/*
13505 			 * another mapping of the same size. don't clear index.
13506 			 */
13507 			return;
13508 		}
13509 	}
13510 
13511 	/*
13512 	 * Clear the p_index bit for large page.
13513 	 */
13514 	index = PAGESZ_TO_INDEX(ttesz);
13515 	npgs = TTEPAGES(ttesz);
13516 	while (npgs-- > 0) {
13517 		ASSERT(pp->p_index & index);
13518 		pp->p_index &= ~index;
13519 		pp = PP_PAGENEXT(pp);
13520 	}
13521 }
13522 
13523 /*
13524  * return supported features
13525  */
13526 /* ARGSUSED */
13527 int
13528 hat_supported(enum hat_features feature, void *arg)
13529 {
13530 	switch (feature) {
13531 	case    HAT_SHARED_PT:
13532 	case	HAT_DYNAMIC_ISM_UNMAP:
13533 	case	HAT_VMODSORT:
13534 		return (1);
13535 	case	HAT_SHARED_REGIONS:
13536 		if (shctx_on)
13537 			return (1);
13538 		else
13539 			return (0);
13540 	default:
13541 		return (0);
13542 	}
13543 }
13544 
13545 void
13546 hat_enter(struct hat *hat)
13547 {
13548 	hatlock_t	*hatlockp;
13549 
13550 	if (hat != ksfmmup) {
13551 		hatlockp = TSB_HASH(hat);
13552 		mutex_enter(HATLOCK_MUTEXP(hatlockp));
13553 	}
13554 }
13555 
13556 void
13557 hat_exit(struct hat *hat)
13558 {
13559 	hatlock_t	*hatlockp;
13560 
13561 	if (hat != ksfmmup) {
13562 		hatlockp = TSB_HASH(hat);
13563 		mutex_exit(HATLOCK_MUTEXP(hatlockp));
13564 	}
13565 }
13566 
13567 /*ARGSUSED*/
13568 void
13569 hat_reserve(struct as *as, caddr_t addr, size_t len)
13570 {
13571 }
13572 
13573 static void
13574 hat_kstat_init(void)
13575 {
13576 	kstat_t *ksp;
13577 
13578 	ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13579 	    KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13580 	    KSTAT_FLAG_VIRTUAL);
13581 	if (ksp) {
13582 		ksp->ks_data = (void *) &sfmmu_global_stat;
13583 		kstat_install(ksp);
13584 	}
13585 	ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13586 	    KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13587 	    KSTAT_FLAG_VIRTUAL);
13588 	if (ksp) {
13589 		ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13590 		kstat_install(ksp);
13591 	}
13592 	ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13593 	    KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13594 	    KSTAT_FLAG_WRITABLE);
13595 	if (ksp) {
13596 		ksp->ks_update = sfmmu_kstat_percpu_update;
13597 		kstat_install(ksp);
13598 	}
13599 }
13600 
13601 /* ARGSUSED */
13602 static int
13603 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13604 {
13605 	struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13606 	struct tsbmiss *tsbm = tsbmiss_area;
13607 	struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13608 	int i;
13609 
13610 	ASSERT(cpu_kstat);
13611 	if (rw == KSTAT_READ) {
13612 		for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13613 			cpu_kstat->sf_itlb_misses = 0;
13614 			cpu_kstat->sf_dtlb_misses = 0;
13615 			cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13616 			    tsbm->uprot_traps;
13617 			cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13618 			    kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13619 			cpu_kstat->sf_tsb_hits = 0;
13620 			cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13621 			cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13622 		}
13623 	} else {
13624 		/* KSTAT_WRITE is used to clear stats */
13625 		for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13626 			tsbm->utsb_misses = 0;
13627 			tsbm->ktsb_misses = 0;
13628 			tsbm->uprot_traps = 0;
13629 			tsbm->kprot_traps = 0;
13630 			kpmtsbm->kpm_dtlb_misses = 0;
13631 			kpmtsbm->kpm_tsb_misses = 0;
13632 		}
13633 	}
13634 	return (0);
13635 }
13636 
13637 #ifdef	DEBUG
13638 
13639 tte_t  *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13640 
13641 /*
13642  * A tte checker. *orig_old is the value we read before cas.
13643  *	*cur is the value returned by cas.
13644  *	*new is the desired value when we do the cas.
13645  *
13646  *	*hmeblkp is currently unused.
13647  */
13648 
13649 /* ARGSUSED */
13650 void
13651 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13652 {
13653 	pfn_t i, j, k;
13654 	int cpuid = CPU->cpu_id;
13655 
13656 	gorig[cpuid] = orig_old;
13657 	gcur[cpuid] = cur;
13658 	gnew[cpuid] = new;
13659 
13660 #ifdef lint
13661 	hmeblkp = hmeblkp;
13662 #endif
13663 
13664 	if (TTE_IS_VALID(orig_old)) {
13665 		if (TTE_IS_VALID(cur)) {
13666 			i = TTE_TO_TTEPFN(orig_old);
13667 			j = TTE_TO_TTEPFN(cur);
13668 			k = TTE_TO_TTEPFN(new);
13669 			if (i != j) {
13670 				/* remap error? */
13671 				panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13672 			}
13673 
13674 			if (i != k) {
13675 				/* remap error? */
13676 				panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13677 			}
13678 		} else {
13679 			if (TTE_IS_VALID(new)) {
13680 				panic("chk_tte: invalid cur? ");
13681 			}
13682 
13683 			i = TTE_TO_TTEPFN(orig_old);
13684 			k = TTE_TO_TTEPFN(new);
13685 			if (i != k) {
13686 				panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13687 			}
13688 		}
13689 	} else {
13690 		if (TTE_IS_VALID(cur)) {
13691 			j = TTE_TO_TTEPFN(cur);
13692 			if (TTE_IS_VALID(new)) {
13693 				k = TTE_TO_TTEPFN(new);
13694 				if (j != k) {
13695 					panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13696 					    j, k);
13697 				}
13698 			} else {
13699 				panic("chk_tte: why here?");
13700 			}
13701 		} else {
13702 			if (!TTE_IS_VALID(new)) {
13703 				panic("chk_tte: why here2 ?");
13704 			}
13705 		}
13706 	}
13707 }
13708 
13709 #endif /* DEBUG */
13710 
13711 extern void prefetch_tsbe_read(struct tsbe *);
13712 extern void prefetch_tsbe_write(struct tsbe *);
13713 
13714 
13715 /*
13716  * We want to prefetch 7 cache lines ahead for our read prefetch.  This gives
13717  * us optimal performance on Cheetah+.  You can only have 8 outstanding
13718  * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13719  * prefetch to make the most utilization of the prefetch capability.
13720  */
13721 #define	TSBE_PREFETCH_STRIDE (7)
13722 
13723 void
13724 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13725 {
13726 	int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13727 	int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13728 	int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13729 	int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13730 	struct tsbe *old;
13731 	struct tsbe *new;
13732 	struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13733 	uint64_t va;
13734 	int new_offset;
13735 	int i;
13736 	int vpshift;
13737 	int last_prefetch;
13738 
13739 	if (old_bytes == new_bytes) {
13740 		bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13741 	} else {
13742 
13743 		/*
13744 		 * A TSBE is 16 bytes which means there are four TSBE's per
13745 		 * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13746 		 */
13747 		old = (struct tsbe *)old_tsbinfo->tsb_va;
13748 		last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13749 		for (i = 0; i < old_entries; i++, old++) {
13750 			if (((i & (4-1)) == 0) && (i < last_prefetch))
13751 				prefetch_tsbe_read(old);
13752 			if (!old->tte_tag.tag_invalid) {
13753 				/*
13754 				 * We have a valid TTE to remap.  Check the
13755 				 * size.  We won't remap 64K or 512K TTEs
13756 				 * because they span more than one TSB entry
13757 				 * and are indexed using an 8K virt. page.
13758 				 * Ditto for 32M and 256M TTEs.
13759 				 */
13760 				if (TTE_CSZ(&old->tte_data) == TTE64K ||
13761 				    TTE_CSZ(&old->tte_data) == TTE512K)
13762 					continue;
13763 				if (mmu_page_sizes == max_mmu_page_sizes) {
13764 					if (TTE_CSZ(&old->tte_data) == TTE32M ||
13765 					    TTE_CSZ(&old->tte_data) == TTE256M)
13766 						continue;
13767 				}
13768 
13769 				/* clear the lower 22 bits of the va */
13770 				va = *(uint64_t *)old << 22;
13771 				/* turn va into a virtual pfn */
13772 				va >>= 22 - TSB_START_SIZE;
13773 				/*
13774 				 * or in bits from the offset in the tsb
13775 				 * to get the real virtual pfn. These
13776 				 * correspond to bits [21:13] in the va
13777 				 */
13778 				vpshift =
13779 				    TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13780 				    0x1ff;
13781 				va |= (i << vpshift);
13782 				va >>= vpshift;
13783 				new_offset = va & (new_entries - 1);
13784 				new = new_base + new_offset;
13785 				prefetch_tsbe_write(new);
13786 				*new = *old;
13787 			}
13788 		}
13789 	}
13790 }
13791 
13792 /*
13793  * unused in sfmmu
13794  */
13795 void
13796 hat_dump(void)
13797 {
13798 }
13799 
13800 /*
13801  * Called when a thread is exiting and we have switched to the kernel address
13802  * space.  Perform the same VM initialization resume() uses when switching
13803  * processes.
13804  *
13805  * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13806  * we call it anyway in case the semantics change in the future.
13807  */
13808 /*ARGSUSED*/
13809 void
13810 hat_thread_exit(kthread_t *thd)
13811 {
13812 	uint_t pgsz_cnum;
13813 	uint_t pstate_save;
13814 
13815 	ASSERT(thd->t_procp->p_as == &kas);
13816 
13817 	pgsz_cnum = KCONTEXT;
13818 #ifdef sun4u
13819 	pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13820 #endif
13821 
13822 	/*
13823 	 * Note that sfmmu_load_mmustate() is currently a no-op for
13824 	 * kernel threads. We need to disable interrupts here,
13825 	 * simply because otherwise sfmmu_load_mmustate() would panic
13826 	 * if the caller does not disable interrupts.
13827 	 */
13828 	pstate_save = sfmmu_disable_intrs();
13829 
13830 	/* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13831 	sfmmu_setctx_sec(pgsz_cnum);
13832 	sfmmu_load_mmustate(ksfmmup);
13833 	sfmmu_enable_intrs(pstate_save);
13834 }
13835 
13836 
13837 /*
13838  * SRD support
13839  */
13840 #define	SRD_HASH_FUNCTION(vp)	(((((uintptr_t)(vp)) >> 4) ^ \
13841 				    (((uintptr_t)(vp)) >> 11)) & \
13842 				    srd_hashmask)
13843 
13844 /*
13845  * Attach the process to the srd struct associated with the exec vnode
13846  * from which the process is started.
13847  */
13848 void
13849 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13850 {
13851 	uint_t hash = SRD_HASH_FUNCTION(evp);
13852 	sf_srd_t *srdp;
13853 	sf_srd_t *newsrdp;
13854 
13855 	ASSERT(sfmmup != ksfmmup);
13856 	ASSERT(sfmmup->sfmmu_srdp == NULL);
13857 
13858 	if (!shctx_on) {
13859 		return;
13860 	}
13861 
13862 	VN_HOLD(evp);
13863 
13864 	if (srd_buckets[hash].srdb_srdp != NULL) {
13865 		mutex_enter(&srd_buckets[hash].srdb_lock);
13866 		for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13867 		    srdp = srdp->srd_hash) {
13868 			if (srdp->srd_evp == evp) {
13869 				ASSERT(srdp->srd_refcnt >= 0);
13870 				sfmmup->sfmmu_srdp = srdp;
13871 				atomic_add_32(
13872 				    (volatile uint_t *)&srdp->srd_refcnt, 1);
13873 				mutex_exit(&srd_buckets[hash].srdb_lock);
13874 				return;
13875 			}
13876 		}
13877 		mutex_exit(&srd_buckets[hash].srdb_lock);
13878 	}
13879 	newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13880 	ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13881 
13882 	newsrdp->srd_evp = evp;
13883 	newsrdp->srd_refcnt = 1;
13884 	newsrdp->srd_hmergnfree = NULL;
13885 	newsrdp->srd_ismrgnfree = NULL;
13886 
13887 	mutex_enter(&srd_buckets[hash].srdb_lock);
13888 	for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13889 	    srdp = srdp->srd_hash) {
13890 		if (srdp->srd_evp == evp) {
13891 			ASSERT(srdp->srd_refcnt >= 0);
13892 			sfmmup->sfmmu_srdp = srdp;
13893 			atomic_add_32((volatile uint_t *)&srdp->srd_refcnt, 1);
13894 			mutex_exit(&srd_buckets[hash].srdb_lock);
13895 			kmem_cache_free(srd_cache, newsrdp);
13896 			return;
13897 		}
13898 	}
13899 	newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13900 	srd_buckets[hash].srdb_srdp = newsrdp;
13901 	sfmmup->sfmmu_srdp = newsrdp;
13902 
13903 	mutex_exit(&srd_buckets[hash].srdb_lock);
13904 
13905 }
13906 
13907 static void
13908 sfmmu_leave_srd(sfmmu_t *sfmmup)
13909 {
13910 	vnode_t *evp;
13911 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13912 	uint_t hash;
13913 	sf_srd_t **prev_srdpp;
13914 	sf_region_t *rgnp;
13915 	sf_region_t *nrgnp;
13916 #ifdef DEBUG
13917 	int rgns = 0;
13918 #endif
13919 	int i;
13920 
13921 	ASSERT(sfmmup != ksfmmup);
13922 	ASSERT(srdp != NULL);
13923 	ASSERT(srdp->srd_refcnt > 0);
13924 	ASSERT(sfmmup->sfmmu_scdp == NULL);
13925 	ASSERT(sfmmup->sfmmu_free == 1);
13926 
13927 	sfmmup->sfmmu_srdp = NULL;
13928 	evp = srdp->srd_evp;
13929 	ASSERT(evp != NULL);
13930 	if (atomic_add_32_nv(
13931 	    (volatile uint_t *)&srdp->srd_refcnt, -1)) {
13932 		VN_RELE(evp);
13933 		return;
13934 	}
13935 
13936 	hash = SRD_HASH_FUNCTION(evp);
13937 	mutex_enter(&srd_buckets[hash].srdb_lock);
13938 	for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13939 	    (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13940 		if (srdp->srd_evp == evp) {
13941 			break;
13942 		}
13943 	}
13944 	if (srdp == NULL || srdp->srd_refcnt) {
13945 		mutex_exit(&srd_buckets[hash].srdb_lock);
13946 		VN_RELE(evp);
13947 		return;
13948 	}
13949 	*prev_srdpp = srdp->srd_hash;
13950 	mutex_exit(&srd_buckets[hash].srdb_lock);
13951 
13952 	ASSERT(srdp->srd_refcnt == 0);
13953 	VN_RELE(evp);
13954 
13955 #ifdef DEBUG
13956 	for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13957 		ASSERT(srdp->srd_rgnhash[i] == NULL);
13958 	}
13959 #endif /* DEBUG */
13960 
13961 	/* free each hme regions in the srd */
13962 	for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13963 		nrgnp = rgnp->rgn_next;
13964 		ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13965 		ASSERT(rgnp->rgn_refcnt == 0);
13966 		ASSERT(rgnp->rgn_sfmmu_head == NULL);
13967 		ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13968 		ASSERT(rgnp->rgn_hmeflags == 0);
13969 		ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13970 #ifdef DEBUG
13971 		for (i = 0; i < MMU_PAGE_SIZES; i++) {
13972 			ASSERT(rgnp->rgn_ttecnt[i] == 0);
13973 		}
13974 		rgns++;
13975 #endif /* DEBUG */
13976 		kmem_cache_free(region_cache, rgnp);
13977 	}
13978 	ASSERT(rgns == srdp->srd_next_hmerid);
13979 
13980 #ifdef DEBUG
13981 	rgns = 0;
13982 #endif
13983 	/* free each ism rgns in the srd */
13984 	for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13985 		nrgnp = rgnp->rgn_next;
13986 		ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13987 		ASSERT(rgnp->rgn_refcnt == 0);
13988 		ASSERT(rgnp->rgn_sfmmu_head == NULL);
13989 		ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13990 		ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13991 #ifdef DEBUG
13992 		for (i = 0; i < MMU_PAGE_SIZES; i++) {
13993 			ASSERT(rgnp->rgn_ttecnt[i] == 0);
13994 		}
13995 		rgns++;
13996 #endif /* DEBUG */
13997 		kmem_cache_free(region_cache, rgnp);
13998 	}
13999 	ASSERT(rgns == srdp->srd_next_ismrid);
14000 	ASSERT(srdp->srd_ismbusyrgns == 0);
14001 	ASSERT(srdp->srd_hmebusyrgns == 0);
14002 
14003 	srdp->srd_next_ismrid = 0;
14004 	srdp->srd_next_hmerid = 0;
14005 
14006 	bzero((void *)srdp->srd_ismrgnp,
14007 	    sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
14008 	bzero((void *)srdp->srd_hmergnp,
14009 	    sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
14010 
14011 	ASSERT(srdp->srd_scdp == NULL);
14012 	kmem_cache_free(srd_cache, srdp);
14013 }
14014 
14015 /* ARGSUSED */
14016 static int
14017 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
14018 {
14019 	sf_srd_t *srdp = (sf_srd_t *)buf;
14020 	bzero(buf, sizeof (*srdp));
14021 
14022 	mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
14023 	mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
14024 	return (0);
14025 }
14026 
14027 /* ARGSUSED */
14028 static void
14029 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
14030 {
14031 	sf_srd_t *srdp = (sf_srd_t *)buf;
14032 
14033 	mutex_destroy(&srdp->srd_mutex);
14034 	mutex_destroy(&srdp->srd_scd_mutex);
14035 }
14036 
14037 /*
14038  * The caller makes sure hat_join_region()/hat_leave_region() can't be called
14039  * at the same time for the same process and address range. This is ensured by
14040  * the fact that address space is locked as writer when a process joins the
14041  * regions. Therefore there's no need to hold an srd lock during the entire
14042  * execution of hat_join_region()/hat_leave_region().
14043  */
14044 
14045 #define	RGN_HASH_FUNCTION(obj)	(((((uintptr_t)(obj)) >> 4) ^ \
14046 				    (((uintptr_t)(obj)) >> 11)) & \
14047 					srd_rgn_hashmask)
14048 /*
14049  * This routine implements the shared context functionality required when
14050  * attaching a segment to an address space. It must be called from
14051  * hat_share() for D(ISM) segments and from segvn_create() for segments
14052  * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
14053  * which is saved in the private segment data for hme segments and
14054  * the ism_map structure for ism segments.
14055  */
14056 hat_region_cookie_t
14057 hat_join_region(struct hat *sfmmup,
14058 	caddr_t r_saddr,
14059 	size_t r_size,
14060 	void *r_obj,
14061 	u_offset_t r_objoff,
14062 	uchar_t r_perm,
14063 	uchar_t r_pgszc,
14064 	hat_rgn_cb_func_t r_cb_function,
14065 	uint_t flags)
14066 {
14067 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14068 	uint_t rhash;
14069 	uint_t rid;
14070 	hatlock_t *hatlockp;
14071 	sf_region_t *rgnp;
14072 	sf_region_t *new_rgnp = NULL;
14073 	int i;
14074 	uint16_t *nextidp;
14075 	sf_region_t **freelistp;
14076 	int maxids;
14077 	sf_region_t **rarrp;
14078 	uint16_t *busyrgnsp;
14079 	ulong_t rttecnt;
14080 	uchar_t tteflag;
14081 	uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14082 	int text = (r_type == HAT_REGION_TEXT);
14083 
14084 	if (srdp == NULL || r_size == 0) {
14085 		return (HAT_INVALID_REGION_COOKIE);
14086 	}
14087 
14088 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
14089 	ASSERT(sfmmup != ksfmmup);
14090 	ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
14091 	ASSERT(srdp->srd_refcnt > 0);
14092 	ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14093 	ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14094 	ASSERT(r_pgszc < mmu_page_sizes);
14095 	if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
14096 	    !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
14097 		panic("hat_join_region: region addr or size is not aligned\n");
14098 	}
14099 
14100 
14101 	r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14102 	    SFMMU_REGION_HME;
14103 	/*
14104 	 * Currently only support shared hmes for the read only main text
14105 	 * region.
14106 	 */
14107 	if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
14108 	    (r_perm & PROT_WRITE))) {
14109 		return (HAT_INVALID_REGION_COOKIE);
14110 	}
14111 
14112 	rhash = RGN_HASH_FUNCTION(r_obj);
14113 
14114 	if (r_type == SFMMU_REGION_ISM) {
14115 		nextidp = &srdp->srd_next_ismrid;
14116 		freelistp = &srdp->srd_ismrgnfree;
14117 		maxids = SFMMU_MAX_ISM_REGIONS;
14118 		rarrp = srdp->srd_ismrgnp;
14119 		busyrgnsp = &srdp->srd_ismbusyrgns;
14120 	} else {
14121 		nextidp = &srdp->srd_next_hmerid;
14122 		freelistp = &srdp->srd_hmergnfree;
14123 		maxids = SFMMU_MAX_HME_REGIONS;
14124 		rarrp = srdp->srd_hmergnp;
14125 		busyrgnsp = &srdp->srd_hmebusyrgns;
14126 	}
14127 
14128 	mutex_enter(&srdp->srd_mutex);
14129 
14130 	for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14131 	    rgnp = rgnp->rgn_hash) {
14132 		if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
14133 		    rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
14134 		    rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
14135 			break;
14136 		}
14137 	}
14138 
14139 rfound:
14140 	if (rgnp != NULL) {
14141 		ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14142 		ASSERT(rgnp->rgn_cb_function == r_cb_function);
14143 		ASSERT(rgnp->rgn_refcnt >= 0);
14144 		rid = rgnp->rgn_id;
14145 		ASSERT(rid < maxids);
14146 		ASSERT(rarrp[rid] == rgnp);
14147 		ASSERT(rid < *nextidp);
14148 		atomic_add_32((volatile uint_t *)&rgnp->rgn_refcnt, 1);
14149 		mutex_exit(&srdp->srd_mutex);
14150 		if (new_rgnp != NULL) {
14151 			kmem_cache_free(region_cache, new_rgnp);
14152 		}
14153 		if (r_type == SFMMU_REGION_HME) {
14154 			int myjoin =
14155 			    (sfmmup == astosfmmu(curthread->t_procp->p_as));
14156 
14157 			sfmmu_link_to_hmeregion(sfmmup, rgnp);
14158 			/*
14159 			 * bitmap should be updated after linking sfmmu on
14160 			 * region list so that pageunload() doesn't skip
14161 			 * TSB/TLB flush. As soon as bitmap is updated another
14162 			 * thread in this process can already start accessing
14163 			 * this region.
14164 			 */
14165 			/*
14166 			 * Normally ttecnt accounting is done as part of
14167 			 * pagefault handling. But a process may not take any
14168 			 * pagefaults on shared hmeblks created by some other
14169 			 * process. To compensate for this assume that the
14170 			 * entire region will end up faulted in using
14171 			 * the region's pagesize.
14172 			 *
14173 			 */
14174 			if (r_pgszc > TTE8K) {
14175 				tteflag = 1 << r_pgszc;
14176 				if (disable_large_pages & tteflag) {
14177 					tteflag = 0;
14178 				}
14179 			} else {
14180 				tteflag = 0;
14181 			}
14182 			if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
14183 				hatlockp = sfmmu_hat_enter(sfmmup);
14184 				sfmmup->sfmmu_rtteflags |= tteflag;
14185 				sfmmu_hat_exit(hatlockp);
14186 			}
14187 			hatlockp = sfmmu_hat_enter(sfmmup);
14188 
14189 			/*
14190 			 * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
14191 			 * region to allow for large page allocation failure.
14192 			 */
14193 			if (r_pgszc >= TTE4M) {
14194 				sfmmup->sfmmu_tsb0_4minflcnt +=
14195 				    r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14196 			}
14197 
14198 			/* update sfmmu_ttecnt with the shme rgn ttecnt */
14199 			rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14200 			atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14201 			    rttecnt);
14202 
14203 			if (text && r_pgszc >= TTE4M &&
14204 			    (tteflag || ((disable_large_pages >> TTE4M) &
14205 			    ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
14206 			    !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
14207 				SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
14208 			}
14209 
14210 			sfmmu_hat_exit(hatlockp);
14211 			/*
14212 			 * On Panther we need to make sure TLB is programmed
14213 			 * to accept 32M/256M pages.  Call
14214 			 * sfmmu_check_page_sizes() now to make sure TLB is
14215 			 * setup before making hmeregions visible to other
14216 			 * threads.
14217 			 */
14218 			sfmmu_check_page_sizes(sfmmup, 1);
14219 			hatlockp = sfmmu_hat_enter(sfmmup);
14220 			SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14221 
14222 			/*
14223 			 * if context is invalid tsb miss exception code will
14224 			 * call sfmmu_check_page_sizes() and update tsbmiss
14225 			 * area later.
14226 			 */
14227 			kpreempt_disable();
14228 			if (myjoin &&
14229 			    (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
14230 			    != INVALID_CONTEXT)) {
14231 				struct tsbmiss *tsbmp;
14232 
14233 				tsbmp = &tsbmiss_area[CPU->cpu_id];
14234 				ASSERT(sfmmup == tsbmp->usfmmup);
14235 				BT_SET(tsbmp->shmermap, rid);
14236 				if (r_pgszc > TTE64K) {
14237 					tsbmp->uhat_rtteflags |= tteflag;
14238 				}
14239 
14240 			}
14241 			kpreempt_enable();
14242 
14243 			sfmmu_hat_exit(hatlockp);
14244 			ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
14245 			    HAT_INVALID_REGION_COOKIE);
14246 		} else {
14247 			hatlockp = sfmmu_hat_enter(sfmmup);
14248 			SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
14249 			sfmmu_hat_exit(hatlockp);
14250 		}
14251 		ASSERT(rid < maxids);
14252 
14253 		if (r_type == SFMMU_REGION_ISM) {
14254 			sfmmu_find_scd(sfmmup);
14255 		}
14256 		return ((hat_region_cookie_t)((uint64_t)rid));
14257 	}
14258 
14259 	ASSERT(new_rgnp == NULL);
14260 
14261 	if (*busyrgnsp >= maxids) {
14262 		mutex_exit(&srdp->srd_mutex);
14263 		return (HAT_INVALID_REGION_COOKIE);
14264 	}
14265 
14266 	ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14267 	if (*freelistp != NULL) {
14268 		rgnp = *freelistp;
14269 		*freelistp = rgnp->rgn_next;
14270 		ASSERT(rgnp->rgn_id < *nextidp);
14271 		ASSERT(rgnp->rgn_id < maxids);
14272 		ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14273 		ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14274 		    == r_type);
14275 		ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14276 		ASSERT(rgnp->rgn_hmeflags == 0);
14277 	} else {
14278 		/*
14279 		 * release local locks before memory allocation.
14280 		 */
14281 		mutex_exit(&srdp->srd_mutex);
14282 
14283 		new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14284 
14285 		mutex_enter(&srdp->srd_mutex);
14286 		for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14287 		    rgnp = rgnp->rgn_hash) {
14288 			if (rgnp->rgn_saddr == r_saddr &&
14289 			    rgnp->rgn_size == r_size &&
14290 			    rgnp->rgn_obj == r_obj &&
14291 			    rgnp->rgn_objoff == r_objoff &&
14292 			    rgnp->rgn_perm == r_perm &&
14293 			    rgnp->rgn_pgszc == r_pgszc) {
14294 				break;
14295 			}
14296 		}
14297 		if (rgnp != NULL) {
14298 			goto rfound;
14299 		}
14300 
14301 		if (*nextidp >= maxids) {
14302 			mutex_exit(&srdp->srd_mutex);
14303 			goto fail;
14304 		}
14305 		rgnp = new_rgnp;
14306 		new_rgnp = NULL;
14307 		rgnp->rgn_id = (*nextidp)++;
14308 		ASSERT(rgnp->rgn_id < maxids);
14309 		ASSERT(rarrp[rgnp->rgn_id] == NULL);
14310 		rarrp[rgnp->rgn_id] = rgnp;
14311 	}
14312 
14313 	ASSERT(rgnp->rgn_sfmmu_head == NULL);
14314 	ASSERT(rgnp->rgn_hmeflags == 0);
14315 #ifdef DEBUG
14316 	for (i = 0; i < MMU_PAGE_SIZES; i++) {
14317 		ASSERT(rgnp->rgn_ttecnt[i] == 0);
14318 	}
14319 #endif
14320 	rgnp->rgn_saddr = r_saddr;
14321 	rgnp->rgn_size = r_size;
14322 	rgnp->rgn_obj = r_obj;
14323 	rgnp->rgn_objoff = r_objoff;
14324 	rgnp->rgn_perm = r_perm;
14325 	rgnp->rgn_pgszc = r_pgszc;
14326 	rgnp->rgn_flags = r_type;
14327 	rgnp->rgn_refcnt = 0;
14328 	rgnp->rgn_cb_function = r_cb_function;
14329 	rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14330 	srdp->srd_rgnhash[rhash] = rgnp;
14331 	(*busyrgnsp)++;
14332 	ASSERT(*busyrgnsp <= maxids);
14333 	goto rfound;
14334 
14335 fail:
14336 	ASSERT(new_rgnp != NULL);
14337 	kmem_cache_free(region_cache, new_rgnp);
14338 	return (HAT_INVALID_REGION_COOKIE);
14339 }
14340 
14341 /*
14342  * This function implements the shared context functionality required
14343  * when detaching a segment from an address space. It must be called
14344  * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14345  * for segments with a valid region_cookie.
14346  * It will also be called from all seg_vn routines which change a
14347  * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14348  * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14349  * from segvn_fault().
14350  */
14351 void
14352 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14353 {
14354 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14355 	sf_scd_t *scdp;
14356 	uint_t rhash;
14357 	uint_t rid = (uint_t)((uint64_t)rcookie);
14358 	hatlock_t *hatlockp = NULL;
14359 	sf_region_t *rgnp;
14360 	sf_region_t **prev_rgnpp;
14361 	sf_region_t *cur_rgnp;
14362 	void *r_obj;
14363 	int i;
14364 	caddr_t	r_saddr;
14365 	caddr_t r_eaddr;
14366 	size_t	r_size;
14367 	uchar_t	r_pgszc;
14368 	uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14369 
14370 	ASSERT(sfmmup != ksfmmup);
14371 	ASSERT(srdp != NULL);
14372 	ASSERT(srdp->srd_refcnt > 0);
14373 	ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14374 	ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14375 	ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14376 
14377 	r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14378 	    SFMMU_REGION_HME;
14379 
14380 	if (r_type == SFMMU_REGION_ISM) {
14381 		ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14382 		ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14383 		rgnp = srdp->srd_ismrgnp[rid];
14384 	} else {
14385 		ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14386 		ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14387 		rgnp = srdp->srd_hmergnp[rid];
14388 	}
14389 	ASSERT(rgnp != NULL);
14390 	ASSERT(rgnp->rgn_id == rid);
14391 	ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14392 	ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14393 	ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
14394 
14395 	ASSERT(sfmmup->sfmmu_xhat_provider == NULL);
14396 	if (r_type == SFMMU_REGION_HME && sfmmup->sfmmu_as->a_xhat != NULL) {
14397 		xhat_unload_callback_all(sfmmup->sfmmu_as, rgnp->rgn_saddr,
14398 		    rgnp->rgn_size, 0, NULL);
14399 	}
14400 
14401 	if (sfmmup->sfmmu_free) {
14402 		ulong_t rttecnt;
14403 		r_pgszc = rgnp->rgn_pgszc;
14404 		r_size = rgnp->rgn_size;
14405 
14406 		ASSERT(sfmmup->sfmmu_scdp == NULL);
14407 		if (r_type == SFMMU_REGION_ISM) {
14408 			SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14409 		} else {
14410 			/* update shme rgns ttecnt in sfmmu_ttecnt */
14411 			rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14412 			ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14413 
14414 			atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14415 			    -rttecnt);
14416 
14417 			SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14418 		}
14419 	} else if (r_type == SFMMU_REGION_ISM) {
14420 		hatlockp = sfmmu_hat_enter(sfmmup);
14421 		ASSERT(rid < srdp->srd_next_ismrid);
14422 		SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14423 		scdp = sfmmup->sfmmu_scdp;
14424 		if (scdp != NULL &&
14425 		    SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14426 			sfmmu_leave_scd(sfmmup, r_type);
14427 			ASSERT(sfmmu_hat_lock_held(sfmmup));
14428 		}
14429 		sfmmu_hat_exit(hatlockp);
14430 	} else {
14431 		ulong_t rttecnt;
14432 		r_pgszc = rgnp->rgn_pgszc;
14433 		r_saddr = rgnp->rgn_saddr;
14434 		r_size = rgnp->rgn_size;
14435 		r_eaddr = r_saddr + r_size;
14436 
14437 		ASSERT(r_type == SFMMU_REGION_HME);
14438 		hatlockp = sfmmu_hat_enter(sfmmup);
14439 		ASSERT(rid < srdp->srd_next_hmerid);
14440 		SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14441 
14442 		/*
14443 		 * If region is part of an SCD call sfmmu_leave_scd().
14444 		 * Otherwise if process is not exiting and has valid context
14445 		 * just drop the context on the floor to lose stale TLB
14446 		 * entries and force the update of tsb miss area to reflect
14447 		 * the new region map. After that clean our TSB entries.
14448 		 */
14449 		scdp = sfmmup->sfmmu_scdp;
14450 		if (scdp != NULL &&
14451 		    SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14452 			sfmmu_leave_scd(sfmmup, r_type);
14453 			ASSERT(sfmmu_hat_lock_held(sfmmup));
14454 		}
14455 		sfmmu_invalidate_ctx(sfmmup);
14456 
14457 		i = TTE8K;
14458 		while (i < mmu_page_sizes) {
14459 			if (rgnp->rgn_ttecnt[i] != 0) {
14460 				sfmmu_unload_tsb_range(sfmmup, r_saddr,
14461 				    r_eaddr, i);
14462 				if (i < TTE4M) {
14463 					i = TTE4M;
14464 					continue;
14465 				} else {
14466 					break;
14467 				}
14468 			}
14469 			i++;
14470 		}
14471 		/* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14472 		if (r_pgszc >= TTE4M) {
14473 			rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14474 			ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14475 			    rttecnt);
14476 			sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14477 		}
14478 
14479 		/* update shme rgns ttecnt in sfmmu_ttecnt */
14480 		rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14481 		ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14482 		atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14483 
14484 		sfmmu_hat_exit(hatlockp);
14485 		if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14486 			/* sfmmup left the scd, grow private tsb */
14487 			sfmmu_check_page_sizes(sfmmup, 1);
14488 		} else {
14489 			sfmmu_check_page_sizes(sfmmup, 0);
14490 		}
14491 	}
14492 
14493 	if (r_type == SFMMU_REGION_HME) {
14494 		sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14495 	}
14496 
14497 	r_obj = rgnp->rgn_obj;
14498 	if (atomic_add_32_nv((volatile uint_t *)&rgnp->rgn_refcnt, -1)) {
14499 		return;
14500 	}
14501 
14502 	/*
14503 	 * looks like nobody uses this region anymore. Free it.
14504 	 */
14505 	rhash = RGN_HASH_FUNCTION(r_obj);
14506 	mutex_enter(&srdp->srd_mutex);
14507 	for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14508 	    (cur_rgnp = *prev_rgnpp) != NULL;
14509 	    prev_rgnpp = &cur_rgnp->rgn_hash) {
14510 		if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14511 			break;
14512 		}
14513 	}
14514 
14515 	if (cur_rgnp == NULL) {
14516 		mutex_exit(&srdp->srd_mutex);
14517 		return;
14518 	}
14519 
14520 	ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14521 	*prev_rgnpp = rgnp->rgn_hash;
14522 	if (r_type == SFMMU_REGION_ISM) {
14523 		rgnp->rgn_flags |= SFMMU_REGION_FREE;
14524 		ASSERT(rid < srdp->srd_next_ismrid);
14525 		rgnp->rgn_next = srdp->srd_ismrgnfree;
14526 		srdp->srd_ismrgnfree = rgnp;
14527 		ASSERT(srdp->srd_ismbusyrgns > 0);
14528 		srdp->srd_ismbusyrgns--;
14529 		mutex_exit(&srdp->srd_mutex);
14530 		return;
14531 	}
14532 	mutex_exit(&srdp->srd_mutex);
14533 
14534 	/*
14535 	 * Destroy region's hmeblks.
14536 	 */
14537 	sfmmu_unload_hmeregion(srdp, rgnp);
14538 
14539 	rgnp->rgn_hmeflags = 0;
14540 
14541 	ASSERT(rgnp->rgn_sfmmu_head == NULL);
14542 	ASSERT(rgnp->rgn_id == rid);
14543 	for (i = 0; i < MMU_PAGE_SIZES; i++) {
14544 		rgnp->rgn_ttecnt[i] = 0;
14545 	}
14546 	rgnp->rgn_flags |= SFMMU_REGION_FREE;
14547 	mutex_enter(&srdp->srd_mutex);
14548 	ASSERT(rid < srdp->srd_next_hmerid);
14549 	rgnp->rgn_next = srdp->srd_hmergnfree;
14550 	srdp->srd_hmergnfree = rgnp;
14551 	ASSERT(srdp->srd_hmebusyrgns > 0);
14552 	srdp->srd_hmebusyrgns--;
14553 	mutex_exit(&srdp->srd_mutex);
14554 }
14555 
14556 /*
14557  * For now only called for hmeblk regions and not for ISM regions.
14558  */
14559 void
14560 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14561 {
14562 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14563 	uint_t rid = (uint_t)((uint64_t)rcookie);
14564 	sf_region_t *rgnp;
14565 	sf_rgn_link_t *rlink;
14566 	sf_rgn_link_t *hrlink;
14567 	ulong_t	rttecnt;
14568 
14569 	ASSERT(sfmmup != ksfmmup);
14570 	ASSERT(srdp != NULL);
14571 	ASSERT(srdp->srd_refcnt > 0);
14572 
14573 	ASSERT(rid < srdp->srd_next_hmerid);
14574 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14575 	ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14576 
14577 	rgnp = srdp->srd_hmergnp[rid];
14578 	ASSERT(rgnp->rgn_refcnt > 0);
14579 	ASSERT(rgnp->rgn_id == rid);
14580 	ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14581 	ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14582 
14583 	atomic_add_32((volatile uint_t *)&rgnp->rgn_refcnt, 1);
14584 
14585 	/* LINTED: constant in conditional context */
14586 	SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14587 	ASSERT(rlink != NULL);
14588 	mutex_enter(&rgnp->rgn_mutex);
14589 	ASSERT(rgnp->rgn_sfmmu_head != NULL);
14590 	/* LINTED: constant in conditional context */
14591 	SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14592 	ASSERT(hrlink != NULL);
14593 	ASSERT(hrlink->prev == NULL);
14594 	rlink->next = rgnp->rgn_sfmmu_head;
14595 	rlink->prev = NULL;
14596 	hrlink->prev = sfmmup;
14597 	/*
14598 	 * make sure rlink's next field is correct
14599 	 * before making this link visible.
14600 	 */
14601 	membar_stst();
14602 	rgnp->rgn_sfmmu_head = sfmmup;
14603 	mutex_exit(&rgnp->rgn_mutex);
14604 
14605 	/* update sfmmu_ttecnt with the shme rgn ttecnt */
14606 	rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14607 	atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14608 	/* update tsb0 inflation count */
14609 	if (rgnp->rgn_pgszc >= TTE4M) {
14610 		sfmmup->sfmmu_tsb0_4minflcnt +=
14611 		    rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14612 	}
14613 	/*
14614 	 * Update regionid bitmask without hat lock since no other thread
14615 	 * can update this region bitmask right now.
14616 	 */
14617 	SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14618 }
14619 
14620 /* ARGSUSED */
14621 static int
14622 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14623 {
14624 	sf_region_t *rgnp = (sf_region_t *)buf;
14625 	bzero(buf, sizeof (*rgnp));
14626 
14627 	mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14628 
14629 	return (0);
14630 }
14631 
14632 /* ARGSUSED */
14633 static void
14634 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14635 {
14636 	sf_region_t *rgnp = (sf_region_t *)buf;
14637 	mutex_destroy(&rgnp->rgn_mutex);
14638 }
14639 
14640 static int
14641 sfrgnmap_isnull(sf_region_map_t *map)
14642 {
14643 	int i;
14644 
14645 	for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14646 		if (map->bitmap[i] != 0) {
14647 			return (0);
14648 		}
14649 	}
14650 	return (1);
14651 }
14652 
14653 static int
14654 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14655 {
14656 	int i;
14657 
14658 	for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14659 		if (map->bitmap[i] != 0) {
14660 			return (0);
14661 		}
14662 	}
14663 	return (1);
14664 }
14665 
14666 #ifdef DEBUG
14667 static void
14668 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14669 {
14670 	sfmmu_t *sp;
14671 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14672 
14673 	for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14674 		ASSERT(srdp == sp->sfmmu_srdp);
14675 		if (sp == sfmmup) {
14676 			if (onlist) {
14677 				return;
14678 			} else {
14679 				panic("shctx: sfmmu 0x%p found on scd"
14680 				    "list 0x%p", (void *)sfmmup,
14681 				    (void *)*headp);
14682 			}
14683 		}
14684 	}
14685 	if (onlist) {
14686 		panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14687 		    (void *)sfmmup, (void *)*headp);
14688 	} else {
14689 		return;
14690 	}
14691 }
14692 #else /* DEBUG */
14693 #define	check_scd_sfmmu_list(headp, sfmmup, onlist)
14694 #endif /* DEBUG */
14695 
14696 /*
14697  * Removes an sfmmu from the SCD sfmmu list.
14698  */
14699 static void
14700 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14701 {
14702 	ASSERT(sfmmup->sfmmu_srdp != NULL);
14703 	check_scd_sfmmu_list(headp, sfmmup, 1);
14704 	if (sfmmup->sfmmu_scd_link.prev != NULL) {
14705 		ASSERT(*headp != sfmmup);
14706 		sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14707 		    sfmmup->sfmmu_scd_link.next;
14708 	} else {
14709 		ASSERT(*headp == sfmmup);
14710 		*headp = sfmmup->sfmmu_scd_link.next;
14711 	}
14712 	if (sfmmup->sfmmu_scd_link.next != NULL) {
14713 		sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14714 		    sfmmup->sfmmu_scd_link.prev;
14715 	}
14716 }
14717 
14718 
14719 /*
14720  * Adds an sfmmu to the start of the queue.
14721  */
14722 static void
14723 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14724 {
14725 	check_scd_sfmmu_list(headp, sfmmup, 0);
14726 	sfmmup->sfmmu_scd_link.prev = NULL;
14727 	sfmmup->sfmmu_scd_link.next = *headp;
14728 	if (*headp != NULL)
14729 		(*headp)->sfmmu_scd_link.prev = sfmmup;
14730 	*headp = sfmmup;
14731 }
14732 
14733 /*
14734  * Remove an scd from the start of the queue.
14735  */
14736 static void
14737 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14738 {
14739 	if (scdp->scd_prev != NULL) {
14740 		ASSERT(*headp != scdp);
14741 		scdp->scd_prev->scd_next = scdp->scd_next;
14742 	} else {
14743 		ASSERT(*headp == scdp);
14744 		*headp = scdp->scd_next;
14745 	}
14746 
14747 	if (scdp->scd_next != NULL) {
14748 		scdp->scd_next->scd_prev = scdp->scd_prev;
14749 	}
14750 }
14751 
14752 /*
14753  * Add an scd to the start of the queue.
14754  */
14755 static void
14756 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14757 {
14758 	scdp->scd_prev = NULL;
14759 	scdp->scd_next = *headp;
14760 	if (*headp != NULL) {
14761 		(*headp)->scd_prev = scdp;
14762 	}
14763 	*headp = scdp;
14764 }
14765 
14766 static int
14767 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14768 {
14769 	uint_t rid;
14770 	uint_t i;
14771 	uint_t j;
14772 	ulong_t w;
14773 	sf_region_t *rgnp;
14774 	ulong_t tte8k_cnt = 0;
14775 	ulong_t tte4m_cnt = 0;
14776 	uint_t tsb_szc;
14777 	sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14778 	sfmmu_t	*ism_hatid;
14779 	struct tsb_info *newtsb;
14780 	int szc;
14781 
14782 	ASSERT(srdp != NULL);
14783 
14784 	for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14785 		if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14786 			continue;
14787 		}
14788 		j = 0;
14789 		while (w) {
14790 			if (!(w & 0x1)) {
14791 				j++;
14792 				w >>= 1;
14793 				continue;
14794 			}
14795 			rid = (i << BT_ULSHIFT) | j;
14796 			j++;
14797 			w >>= 1;
14798 
14799 			if (rid < SFMMU_MAX_HME_REGIONS) {
14800 				rgnp = srdp->srd_hmergnp[rid];
14801 				ASSERT(rgnp->rgn_id == rid);
14802 				ASSERT(rgnp->rgn_refcnt > 0);
14803 
14804 				if (rgnp->rgn_pgszc < TTE4M) {
14805 					tte8k_cnt += rgnp->rgn_size >>
14806 					    TTE_PAGE_SHIFT(TTE8K);
14807 				} else {
14808 					ASSERT(rgnp->rgn_pgszc >= TTE4M);
14809 					tte4m_cnt += rgnp->rgn_size >>
14810 					    TTE_PAGE_SHIFT(TTE4M);
14811 					/*
14812 					 * Inflate SCD tsb0 by preallocating
14813 					 * 1/4 8k ttecnt for 4M regions to
14814 					 * allow for lgpg alloc failure.
14815 					 */
14816 					tte8k_cnt += rgnp->rgn_size >>
14817 					    (TTE_PAGE_SHIFT(TTE8K) + 2);
14818 				}
14819 			} else {
14820 				rid -= SFMMU_MAX_HME_REGIONS;
14821 				rgnp = srdp->srd_ismrgnp[rid];
14822 				ASSERT(rgnp->rgn_id == rid);
14823 				ASSERT(rgnp->rgn_refcnt > 0);
14824 
14825 				ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14826 				ASSERT(ism_hatid->sfmmu_ismhat);
14827 
14828 				for (szc = 0; szc < TTE4M; szc++) {
14829 					tte8k_cnt +=
14830 					    ism_hatid->sfmmu_ttecnt[szc] <<
14831 					    TTE_BSZS_SHIFT(szc);
14832 				}
14833 
14834 				ASSERT(rgnp->rgn_pgszc >= TTE4M);
14835 				if (rgnp->rgn_pgszc >= TTE4M) {
14836 					tte4m_cnt += rgnp->rgn_size >>
14837 					    TTE_PAGE_SHIFT(TTE4M);
14838 				}
14839 			}
14840 		}
14841 	}
14842 
14843 	tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14844 
14845 	/* Allocate both the SCD TSBs here. */
14846 	if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14847 	    tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14848 	    (tsb_szc <= TSB_4M_SZCODE ||
14849 	    sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14850 	    TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14851 	    TSB_ALLOC, scsfmmup))) {
14852 
14853 		SFMMU_STAT(sf_scd_1sttsb_allocfail);
14854 		return (TSB_ALLOCFAIL);
14855 	} else {
14856 		scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14857 
14858 		if (tte4m_cnt) {
14859 			tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14860 			if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14861 			    TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14862 			    (tsb_szc <= TSB_4M_SZCODE ||
14863 			    sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14864 			    TSB4M|TSB32M|TSB256M,
14865 			    TSB_ALLOC, scsfmmup))) {
14866 				/*
14867 				 * If we fail to allocate the 2nd shared tsb,
14868 				 * just free the 1st tsb, return failure.
14869 				 */
14870 				sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14871 				SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14872 				return (TSB_ALLOCFAIL);
14873 			} else {
14874 				ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14875 				newtsb->tsb_flags |= TSB_SHAREDCTX;
14876 				scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14877 				SFMMU_STAT(sf_scd_2ndtsb_alloc);
14878 			}
14879 		}
14880 		SFMMU_STAT(sf_scd_1sttsb_alloc);
14881 	}
14882 	return (TSB_SUCCESS);
14883 }
14884 
14885 static void
14886 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14887 {
14888 	while (scd_sfmmu->sfmmu_tsb != NULL) {
14889 		struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14890 		sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14891 		scd_sfmmu->sfmmu_tsb = next;
14892 	}
14893 }
14894 
14895 /*
14896  * Link the sfmmu onto the hme region list.
14897  */
14898 void
14899 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14900 {
14901 	uint_t rid;
14902 	sf_rgn_link_t *rlink;
14903 	sfmmu_t *head;
14904 	sf_rgn_link_t *hrlink;
14905 
14906 	rid = rgnp->rgn_id;
14907 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14908 
14909 	/* LINTED: constant in conditional context */
14910 	SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14911 	ASSERT(rlink != NULL);
14912 	mutex_enter(&rgnp->rgn_mutex);
14913 	if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14914 		rlink->next = NULL;
14915 		rlink->prev = NULL;
14916 		/*
14917 		 * make sure rlink's next field is NULL
14918 		 * before making this link visible.
14919 		 */
14920 		membar_stst();
14921 		rgnp->rgn_sfmmu_head = sfmmup;
14922 	} else {
14923 		/* LINTED: constant in conditional context */
14924 		SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14925 		ASSERT(hrlink != NULL);
14926 		ASSERT(hrlink->prev == NULL);
14927 		rlink->next = head;
14928 		rlink->prev = NULL;
14929 		hrlink->prev = sfmmup;
14930 		/*
14931 		 * make sure rlink's next field is correct
14932 		 * before making this link visible.
14933 		 */
14934 		membar_stst();
14935 		rgnp->rgn_sfmmu_head = sfmmup;
14936 	}
14937 	mutex_exit(&rgnp->rgn_mutex);
14938 }
14939 
14940 /*
14941  * Unlink the sfmmu from the hme region list.
14942  */
14943 void
14944 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14945 {
14946 	uint_t rid;
14947 	sf_rgn_link_t *rlink;
14948 
14949 	rid = rgnp->rgn_id;
14950 	ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14951 
14952 	/* LINTED: constant in conditional context */
14953 	SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14954 	ASSERT(rlink != NULL);
14955 	mutex_enter(&rgnp->rgn_mutex);
14956 	if (rgnp->rgn_sfmmu_head == sfmmup) {
14957 		sfmmu_t *next = rlink->next;
14958 		rgnp->rgn_sfmmu_head = next;
14959 		/*
14960 		 * if we are stopped by xc_attention() after this
14961 		 * point the forward link walking in
14962 		 * sfmmu_rgntlb_demap() will work correctly since the
14963 		 * head correctly points to the next element.
14964 		 */
14965 		membar_stst();
14966 		rlink->next = NULL;
14967 		ASSERT(rlink->prev == NULL);
14968 		if (next != NULL) {
14969 			sf_rgn_link_t *nrlink;
14970 			/* LINTED: constant in conditional context */
14971 			SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14972 			ASSERT(nrlink != NULL);
14973 			ASSERT(nrlink->prev == sfmmup);
14974 			nrlink->prev = NULL;
14975 		}
14976 	} else {
14977 		sfmmu_t *next = rlink->next;
14978 		sfmmu_t *prev = rlink->prev;
14979 		sf_rgn_link_t *prlink;
14980 
14981 		ASSERT(prev != NULL);
14982 		/* LINTED: constant in conditional context */
14983 		SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14984 		ASSERT(prlink != NULL);
14985 		ASSERT(prlink->next == sfmmup);
14986 		prlink->next = next;
14987 		/*
14988 		 * if we are stopped by xc_attention()
14989 		 * after this point the forward link walking
14990 		 * will work correctly since the prev element
14991 		 * correctly points to the next element.
14992 		 */
14993 		membar_stst();
14994 		rlink->next = NULL;
14995 		rlink->prev = NULL;
14996 		if (next != NULL) {
14997 			sf_rgn_link_t *nrlink;
14998 			/* LINTED: constant in conditional context */
14999 			SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
15000 			ASSERT(nrlink != NULL);
15001 			ASSERT(nrlink->prev == sfmmup);
15002 			nrlink->prev = prev;
15003 		}
15004 	}
15005 	mutex_exit(&rgnp->rgn_mutex);
15006 }
15007 
15008 /*
15009  * Link scd sfmmu onto ism or hme region list for each region in the
15010  * scd region map.
15011  */
15012 void
15013 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
15014 {
15015 	uint_t rid;
15016 	uint_t i;
15017 	uint_t j;
15018 	ulong_t w;
15019 	sf_region_t *rgnp;
15020 	sfmmu_t *scsfmmup;
15021 
15022 	scsfmmup = scdp->scd_sfmmup;
15023 	ASSERT(scsfmmup->sfmmu_scdhat);
15024 	for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
15025 		if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
15026 			continue;
15027 		}
15028 		j = 0;
15029 		while (w) {
15030 			if (!(w & 0x1)) {
15031 				j++;
15032 				w >>= 1;
15033 				continue;
15034 			}
15035 			rid = (i << BT_ULSHIFT) | j;
15036 			j++;
15037 			w >>= 1;
15038 
15039 			if (rid < SFMMU_MAX_HME_REGIONS) {
15040 				rgnp = srdp->srd_hmergnp[rid];
15041 				ASSERT(rgnp->rgn_id == rid);
15042 				ASSERT(rgnp->rgn_refcnt > 0);
15043 				sfmmu_link_to_hmeregion(scsfmmup, rgnp);
15044 			} else {
15045 				sfmmu_t *ism_hatid = NULL;
15046 				ism_ment_t *ism_ment;
15047 				rid -= SFMMU_MAX_HME_REGIONS;
15048 				rgnp = srdp->srd_ismrgnp[rid];
15049 				ASSERT(rgnp->rgn_id == rid);
15050 				ASSERT(rgnp->rgn_refcnt > 0);
15051 
15052 				ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
15053 				ASSERT(ism_hatid->sfmmu_ismhat);
15054 				ism_ment = &scdp->scd_ism_links[rid];
15055 				ism_ment->iment_hat = scsfmmup;
15056 				ism_ment->iment_base_va = rgnp->rgn_saddr;
15057 				mutex_enter(&ism_mlist_lock);
15058 				iment_add(ism_ment, ism_hatid);
15059 				mutex_exit(&ism_mlist_lock);
15060 
15061 			}
15062 		}
15063 	}
15064 }
15065 /*
15066  * Unlink scd sfmmu from ism or hme region list for each region in the
15067  * scd region map.
15068  */
15069 void
15070 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
15071 {
15072 	uint_t rid;
15073 	uint_t i;
15074 	uint_t j;
15075 	ulong_t w;
15076 	sf_region_t *rgnp;
15077 	sfmmu_t *scsfmmup;
15078 
15079 	scsfmmup = scdp->scd_sfmmup;
15080 	for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
15081 		if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
15082 			continue;
15083 		}
15084 		j = 0;
15085 		while (w) {
15086 			if (!(w & 0x1)) {
15087 				j++;
15088 				w >>= 1;
15089 				continue;
15090 			}
15091 			rid = (i << BT_ULSHIFT) | j;
15092 			j++;
15093 			w >>= 1;
15094 
15095 			if (rid < SFMMU_MAX_HME_REGIONS) {
15096 				rgnp = srdp->srd_hmergnp[rid];
15097 				ASSERT(rgnp->rgn_id == rid);
15098 				ASSERT(rgnp->rgn_refcnt > 0);
15099 				sfmmu_unlink_from_hmeregion(scsfmmup,
15100 				    rgnp);
15101 
15102 			} else {
15103 				sfmmu_t *ism_hatid = NULL;
15104 				ism_ment_t *ism_ment;
15105 				rid -= SFMMU_MAX_HME_REGIONS;
15106 				rgnp = srdp->srd_ismrgnp[rid];
15107 				ASSERT(rgnp->rgn_id == rid);
15108 				ASSERT(rgnp->rgn_refcnt > 0);
15109 
15110 				ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
15111 				ASSERT(ism_hatid->sfmmu_ismhat);
15112 				ism_ment = &scdp->scd_ism_links[rid];
15113 				ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
15114 				ASSERT(ism_ment->iment_base_va ==
15115 				    rgnp->rgn_saddr);
15116 				mutex_enter(&ism_mlist_lock);
15117 				iment_sub(ism_ment, ism_hatid);
15118 				mutex_exit(&ism_mlist_lock);
15119 
15120 			}
15121 		}
15122 	}
15123 }
15124 /*
15125  * Allocates and initialises a new SCD structure, this is called with
15126  * the srd_scd_mutex held and returns with the reference count
15127  * initialised to 1.
15128  */
15129 static sf_scd_t *
15130 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
15131 {
15132 	sf_scd_t *new_scdp;
15133 	sfmmu_t *scsfmmup;
15134 	int i;
15135 
15136 	ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
15137 	new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
15138 
15139 	scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
15140 	new_scdp->scd_sfmmup = scsfmmup;
15141 	scsfmmup->sfmmu_srdp = srdp;
15142 	scsfmmup->sfmmu_scdp = new_scdp;
15143 	scsfmmup->sfmmu_tsb0_4minflcnt = 0;
15144 	scsfmmup->sfmmu_scdhat = 1;
15145 	CPUSET_ALL(scsfmmup->sfmmu_cpusran);
15146 	bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
15147 
15148 	ASSERT(max_mmu_ctxdoms > 0);
15149 	for (i = 0; i < max_mmu_ctxdoms; i++) {
15150 		scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
15151 		scsfmmup->sfmmu_ctxs[i].gnum = 0;
15152 	}
15153 
15154 	for (i = 0; i < MMU_PAGE_SIZES; i++) {
15155 		new_scdp->scd_rttecnt[i] = 0;
15156 	}
15157 
15158 	new_scdp->scd_region_map = *new_map;
15159 	new_scdp->scd_refcnt = 1;
15160 	if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
15161 		kmem_cache_free(scd_cache, new_scdp);
15162 		kmem_cache_free(sfmmuid_cache, scsfmmup);
15163 		return (NULL);
15164 	}
15165 	if (&mmu_init_scd) {
15166 		mmu_init_scd(new_scdp);
15167 	}
15168 	return (new_scdp);
15169 }
15170 
15171 /*
15172  * The first phase of a process joining an SCD. The hat structure is
15173  * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
15174  * and a cross-call with context invalidation is used to cause the
15175  * remaining work to be carried out in the sfmmu_tsbmiss_exception()
15176  * routine.
15177  */
15178 static void
15179 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
15180 {
15181 	hatlock_t *hatlockp;
15182 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15183 	int i;
15184 	sf_scd_t *old_scdp;
15185 
15186 	ASSERT(srdp != NULL);
15187 	ASSERT(scdp != NULL);
15188 	ASSERT(scdp->scd_refcnt > 0);
15189 	ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
15190 
15191 	if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
15192 		ASSERT(old_scdp != scdp);
15193 
15194 		mutex_enter(&old_scdp->scd_mutex);
15195 		sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
15196 		mutex_exit(&old_scdp->scd_mutex);
15197 		/*
15198 		 * sfmmup leaves the old scd. Update sfmmu_ttecnt to
15199 		 * include the shme rgn ttecnt for rgns that
15200 		 * were in the old SCD
15201 		 */
15202 		for (i = 0; i < mmu_page_sizes; i++) {
15203 			ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15204 			    old_scdp->scd_rttecnt[i]);
15205 			atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15206 			    sfmmup->sfmmu_scdrttecnt[i]);
15207 		}
15208 	}
15209 
15210 	/*
15211 	 * Move sfmmu to the scd lists.
15212 	 */
15213 	mutex_enter(&scdp->scd_mutex);
15214 	sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
15215 	mutex_exit(&scdp->scd_mutex);
15216 	SF_SCD_INCR_REF(scdp);
15217 
15218 	hatlockp = sfmmu_hat_enter(sfmmup);
15219 	/*
15220 	 * For a multi-thread process, we must stop
15221 	 * all the other threads before joining the scd.
15222 	 */
15223 
15224 	SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
15225 
15226 	sfmmu_invalidate_ctx(sfmmup);
15227 	sfmmup->sfmmu_scdp = scdp;
15228 
15229 	/*
15230 	 * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
15231 	 * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
15232 	 */
15233 	for (i = 0; i < mmu_page_sizes; i++) {
15234 		sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
15235 		ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
15236 		atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15237 		    -sfmmup->sfmmu_scdrttecnt[i]);
15238 	}
15239 	/* update tsb0 inflation count */
15240 	if (old_scdp != NULL) {
15241 		sfmmup->sfmmu_tsb0_4minflcnt +=
15242 		    old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15243 	}
15244 	ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
15245 	    scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
15246 	sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15247 
15248 	sfmmu_hat_exit(hatlockp);
15249 
15250 	if (old_scdp != NULL) {
15251 		SF_SCD_DECR_REF(srdp, old_scdp);
15252 	}
15253 
15254 }
15255 
15256 /*
15257  * This routine is called by a process to become part of an SCD. It is called
15258  * from sfmmu_tsbmiss_exception() once most of the initial work has been
15259  * done by sfmmu_join_scd(). This routine must not drop the hat lock.
15260  */
15261 static void
15262 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
15263 {
15264 	struct tsb_info	*tsbinfop;
15265 
15266 	ASSERT(sfmmu_hat_lock_held(sfmmup));
15267 	ASSERT(sfmmup->sfmmu_scdp != NULL);
15268 	ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
15269 	ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15270 	ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15271 
15272 	for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15273 	    tsbinfop = tsbinfop->tsb_next) {
15274 		if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15275 			continue;
15276 		}
15277 		ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15278 
15279 		sfmmu_inv_tsb(tsbinfop->tsb_va,
15280 		    TSB_BYTES(tsbinfop->tsb_szc));
15281 	}
15282 
15283 	/* Set HAT_CTX1_FLAG for all SCD ISMs */
15284 	sfmmu_ism_hatflags(sfmmup, 1);
15285 
15286 	SFMMU_STAT(sf_join_scd);
15287 }
15288 
15289 /*
15290  * This routine is called in order to check if there is an SCD which matches
15291  * the process's region map if not then a new SCD may be created.
15292  */
15293 static void
15294 sfmmu_find_scd(sfmmu_t *sfmmup)
15295 {
15296 	sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15297 	sf_scd_t *scdp, *new_scdp;
15298 	int ret;
15299 
15300 	ASSERT(srdp != NULL);
15301 	ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
15302 
15303 	mutex_enter(&srdp->srd_scd_mutex);
15304 	for (scdp = srdp->srd_scdp; scdp != NULL;
15305 	    scdp = scdp->scd_next) {
15306 		SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15307 		    &sfmmup->sfmmu_region_map, ret);
15308 		if (ret == 1) {
15309 			SF_SCD_INCR_REF(scdp);
15310 			mutex_exit(&srdp->srd_scd_mutex);
15311 			sfmmu_join_scd(scdp, sfmmup);
15312 			ASSERT(scdp->scd_refcnt >= 2);
15313 			atomic_add_32((volatile uint32_t *)
15314 			    &scdp->scd_refcnt, -1);
15315 			return;
15316 		} else {
15317 			/*
15318 			 * If the sfmmu region map is a subset of the scd
15319 			 * region map, then the assumption is that this process
15320 			 * will continue attaching to ISM segments until the
15321 			 * region maps are equal.
15322 			 */
15323 			SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15324 			    &sfmmup->sfmmu_region_map, ret);
15325 			if (ret == 1) {
15326 				mutex_exit(&srdp->srd_scd_mutex);
15327 				return;
15328 			}
15329 		}
15330 	}
15331 
15332 	ASSERT(scdp == NULL);
15333 	/*
15334 	 * No matching SCD has been found, create a new one.
15335 	 */
15336 	if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15337 	    NULL) {
15338 		mutex_exit(&srdp->srd_scd_mutex);
15339 		return;
15340 	}
15341 
15342 	/*
15343 	 * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15344 	 */
15345 
15346 	/* Set scd_rttecnt for shme rgns in SCD */
15347 	sfmmu_set_scd_rttecnt(srdp, new_scdp);
15348 
15349 	/*
15350 	 * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15351 	 */
15352 	sfmmu_link_scd_to_regions(srdp, new_scdp);
15353 	sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15354 	SFMMU_STAT_ADD(sf_create_scd, 1);
15355 
15356 	mutex_exit(&srdp->srd_scd_mutex);
15357 	sfmmu_join_scd(new_scdp, sfmmup);
15358 	ASSERT(new_scdp->scd_refcnt >= 2);
15359 	atomic_add_32((volatile uint32_t *)&new_scdp->scd_refcnt, -1);
15360 }
15361 
15362 /*
15363  * This routine is called by a process to remove itself from an SCD. It is
15364  * either called when the processes has detached from a segment or from
15365  * hat_free_start() as a result of calling exit.
15366  */
15367 static void
15368 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15369 {
15370 	sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15371 	sf_srd_t *srdp =  sfmmup->sfmmu_srdp;
15372 	hatlock_t *hatlockp = TSB_HASH(sfmmup);
15373 	int i;
15374 
15375 	ASSERT(scdp != NULL);
15376 	ASSERT(srdp != NULL);
15377 
15378 	if (sfmmup->sfmmu_free) {
15379 		/*
15380 		 * If the process is part of an SCD the sfmmu is unlinked
15381 		 * from scd_sf_list.
15382 		 */
15383 		mutex_enter(&scdp->scd_mutex);
15384 		sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15385 		mutex_exit(&scdp->scd_mutex);
15386 		/*
15387 		 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15388 		 * are about to leave the SCD
15389 		 */
15390 		for (i = 0; i < mmu_page_sizes; i++) {
15391 			ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15392 			    scdp->scd_rttecnt[i]);
15393 			atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15394 			    sfmmup->sfmmu_scdrttecnt[i]);
15395 			sfmmup->sfmmu_scdrttecnt[i] = 0;
15396 		}
15397 		sfmmup->sfmmu_scdp = NULL;
15398 
15399 		SF_SCD_DECR_REF(srdp, scdp);
15400 		return;
15401 	}
15402 
15403 	ASSERT(r_type != SFMMU_REGION_ISM ||
15404 	    SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15405 	ASSERT(scdp->scd_refcnt);
15406 	ASSERT(!sfmmup->sfmmu_free);
15407 	ASSERT(sfmmu_hat_lock_held(sfmmup));
15408 	ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as, &sfmmup->sfmmu_as->a_lock));
15409 
15410 	/*
15411 	 * Wait for ISM maps to be updated.
15412 	 */
15413 	if (r_type != SFMMU_REGION_ISM) {
15414 		while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15415 		    sfmmup->sfmmu_scdp != NULL) {
15416 			cv_wait(&sfmmup->sfmmu_tsb_cv,
15417 			    HATLOCK_MUTEXP(hatlockp));
15418 		}
15419 
15420 		if (sfmmup->sfmmu_scdp == NULL) {
15421 			sfmmu_hat_exit(hatlockp);
15422 			return;
15423 		}
15424 		SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15425 	}
15426 
15427 	if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15428 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15429 		/*
15430 		 * Since HAT_JOIN_SCD was set our context
15431 		 * is still invalid.
15432 		 */
15433 	} else {
15434 		/*
15435 		 * For a multi-thread process, we must stop
15436 		 * all the other threads before leaving the scd.
15437 		 */
15438 
15439 		sfmmu_invalidate_ctx(sfmmup);
15440 	}
15441 
15442 	/* Clear all the rid's for ISM, delete flags, etc */
15443 	ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15444 	sfmmu_ism_hatflags(sfmmup, 0);
15445 
15446 	/*
15447 	 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15448 	 * are in SCD before this sfmmup leaves the SCD.
15449 	 */
15450 	for (i = 0; i < mmu_page_sizes; i++) {
15451 		ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15452 		    scdp->scd_rttecnt[i]);
15453 		atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15454 		    sfmmup->sfmmu_scdrttecnt[i]);
15455 		sfmmup->sfmmu_scdrttecnt[i] = 0;
15456 		/* update ismttecnt to include SCD ism before hat leaves SCD */
15457 		sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15458 		sfmmup->sfmmu_scdismttecnt[i] = 0;
15459 	}
15460 	/* update tsb0 inflation count */
15461 	sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15462 
15463 	if (r_type != SFMMU_REGION_ISM) {
15464 		SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15465 	}
15466 	sfmmup->sfmmu_scdp = NULL;
15467 
15468 	sfmmu_hat_exit(hatlockp);
15469 
15470 	/*
15471 	 * Unlink sfmmu from scd_sf_list this can be done without holding
15472 	 * the hat lock as we hold the sfmmu_as lock which prevents
15473 	 * hat_join_region from adding this thread to the scd again. Other
15474 	 * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15475 	 * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15476 	 * while holding the hat lock.
15477 	 */
15478 	mutex_enter(&scdp->scd_mutex);
15479 	sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15480 	mutex_exit(&scdp->scd_mutex);
15481 	SFMMU_STAT(sf_leave_scd);
15482 
15483 	SF_SCD_DECR_REF(srdp, scdp);
15484 	hatlockp = sfmmu_hat_enter(sfmmup);
15485 
15486 }
15487 
15488 /*
15489  * Unlink and free up an SCD structure with a reference count of 0.
15490  */
15491 static void
15492 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15493 {
15494 	sfmmu_t *scsfmmup;
15495 	sf_scd_t *sp;
15496 	hatlock_t *shatlockp;
15497 	int i, ret;
15498 
15499 	mutex_enter(&srdp->srd_scd_mutex);
15500 	for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15501 		if (sp == scdp)
15502 			break;
15503 	}
15504 	if (sp == NULL || sp->scd_refcnt) {
15505 		mutex_exit(&srdp->srd_scd_mutex);
15506 		return;
15507 	}
15508 
15509 	/*
15510 	 * It is possible that the scd has been freed and reallocated with a
15511 	 * different region map while we've been waiting for the srd_scd_mutex.
15512 	 */
15513 	SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15514 	if (ret != 1) {
15515 		mutex_exit(&srdp->srd_scd_mutex);
15516 		return;
15517 	}
15518 
15519 	ASSERT(scdp->scd_sf_list == NULL);
15520 	/*
15521 	 * Unlink scd from srd_scdp list.
15522 	 */
15523 	sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15524 	mutex_exit(&srdp->srd_scd_mutex);
15525 
15526 	sfmmu_unlink_scd_from_regions(srdp, scdp);
15527 
15528 	/* Clear shared context tsb and release ctx */
15529 	scsfmmup = scdp->scd_sfmmup;
15530 
15531 	/*
15532 	 * create a barrier so that scd will not be destroyed
15533 	 * if other thread still holds the same shared hat lock.
15534 	 * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15535 	 * shared hat lock before checking the shared tsb reloc flag.
15536 	 */
15537 	shatlockp = sfmmu_hat_enter(scsfmmup);
15538 	sfmmu_hat_exit(shatlockp);
15539 
15540 	sfmmu_free_scd_tsbs(scsfmmup);
15541 
15542 	for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15543 		if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15544 			kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15545 			    SFMMU_L2_HMERLINKS_SIZE);
15546 			scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15547 		}
15548 	}
15549 	kmem_cache_free(sfmmuid_cache, scsfmmup);
15550 	kmem_cache_free(scd_cache, scdp);
15551 	SFMMU_STAT(sf_destroy_scd);
15552 }
15553 
15554 /*
15555  * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15556  * bits which are set in the ism_region_map parameter. This flag indicates to
15557  * the tsbmiss handler that mapping for these segments should be loaded using
15558  * the shared context.
15559  */
15560 static void
15561 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15562 {
15563 	sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15564 	ism_blk_t *ism_blkp;
15565 	ism_map_t *ism_map;
15566 	int i, rid;
15567 
15568 	ASSERT(sfmmup->sfmmu_iblk != NULL);
15569 	ASSERT(scdp != NULL);
15570 	/*
15571 	 * Note that the caller either set HAT_ISMBUSY flag or checked
15572 	 * under hat lock that HAT_ISMBUSY was not set by another thread.
15573 	 */
15574 	ASSERT(sfmmu_hat_lock_held(sfmmup));
15575 
15576 	ism_blkp = sfmmup->sfmmu_iblk;
15577 	while (ism_blkp != NULL) {
15578 		ism_map = ism_blkp->iblk_maps;
15579 		for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15580 			rid = ism_map[i].imap_rid;
15581 			if (rid == SFMMU_INVALID_ISMRID) {
15582 				continue;
15583 			}
15584 			ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15585 			if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15586 			    addflag) {
15587 				ism_map[i].imap_hatflags |=
15588 				    HAT_CTX1_FLAG;
15589 			} else {
15590 				ism_map[i].imap_hatflags &=
15591 				    ~HAT_CTX1_FLAG;
15592 			}
15593 		}
15594 		ism_blkp = ism_blkp->iblk_next;
15595 	}
15596 }
15597 
15598 static int
15599 sfmmu_srd_lock_held(sf_srd_t *srdp)
15600 {
15601 	return (MUTEX_HELD(&srdp->srd_mutex));
15602 }
15603 
15604 /* ARGSUSED */
15605 static int
15606 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15607 {
15608 	sf_scd_t *scdp = (sf_scd_t *)buf;
15609 
15610 	bzero(buf, sizeof (sf_scd_t));
15611 	mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15612 	return (0);
15613 }
15614 
15615 /* ARGSUSED */
15616 static void
15617 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15618 {
15619 	sf_scd_t *scdp = (sf_scd_t *)buf;
15620 
15621 	mutex_destroy(&scdp->scd_mutex);
15622 }
15623 
15624 /*
15625  * The listp parameter is a pointer to a list of hmeblks which are partially
15626  * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15627  * freeing process is to cross-call all cpus to ensure that there are no
15628  * remaining cached references.
15629  *
15630  * If the local generation number is less than the global then we can free
15631  * hmeblks which are already on the pending queue as another cpu has completed
15632  * the cross-call.
15633  *
15634  * We cross-call to make sure that there are no threads on other cpus accessing
15635  * these hmblks and then complete the process of freeing them under the
15636  * following conditions:
15637  * 	The total number of pending hmeblks is greater than the threshold
15638  *	The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15639  *	It is at least 1 second since the last time we cross-called
15640  *
15641  * Otherwise, we add the hmeblks to the per-cpu pending queue.
15642  */
15643 static void
15644 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15645 {
15646 	struct hme_blk *hblkp, *pr_hblkp = NULL;
15647 	int		count = 0;
15648 	cpuset_t	cpuset = cpu_ready_set;
15649 	cpu_hme_pend_t	*cpuhp;
15650 	timestruc_t	now;
15651 	int		one_second_expired = 0;
15652 
15653 	gethrestime_lasttick(&now);
15654 
15655 	for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15656 		ASSERT(hblkp->hblk_shw_bit == 0);
15657 		ASSERT(hblkp->hblk_shared == 0);
15658 		count++;
15659 		pr_hblkp = hblkp;
15660 	}
15661 
15662 	cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15663 	mutex_enter(&cpuhp->chp_mutex);
15664 
15665 	if ((cpuhp->chp_count + count) == 0) {
15666 		mutex_exit(&cpuhp->chp_mutex);
15667 		return;
15668 	}
15669 
15670 	if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15671 		one_second_expired  = 1;
15672 	}
15673 
15674 	if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15675 	    (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15676 	    one_second_expired)) {
15677 		/* Append global list to local */
15678 		if (pr_hblkp == NULL) {
15679 			*listp = cpuhp->chp_listp;
15680 		} else {
15681 			pr_hblkp->hblk_next = cpuhp->chp_listp;
15682 		}
15683 		cpuhp->chp_listp = NULL;
15684 		cpuhp->chp_count = 0;
15685 		cpuhp->chp_timestamp = now.tv_sec;
15686 		mutex_exit(&cpuhp->chp_mutex);
15687 
15688 		kpreempt_disable();
15689 		CPUSET_DEL(cpuset, CPU->cpu_id);
15690 		xt_sync(cpuset);
15691 		xt_sync(cpuset);
15692 		kpreempt_enable();
15693 
15694 		/*
15695 		 * At this stage we know that no trap handlers on other
15696 		 * cpus can have references to hmeblks on the list.
15697 		 */
15698 		sfmmu_hblk_free(listp);
15699 	} else if (*listp != NULL) {
15700 		pr_hblkp->hblk_next = cpuhp->chp_listp;
15701 		cpuhp->chp_listp = *listp;
15702 		cpuhp->chp_count += count;
15703 		*listp = NULL;
15704 		mutex_exit(&cpuhp->chp_mutex);
15705 	} else {
15706 		mutex_exit(&cpuhp->chp_mutex);
15707 	}
15708 }
15709 
15710 /*
15711  * Add an hmeblk to the the hash list.
15712  */
15713 void
15714 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15715 	uint64_t hblkpa)
15716 {
15717 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15718 #ifdef	DEBUG
15719 	if (hmebp->hmeblkp == NULL) {
15720 		ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15721 	}
15722 #endif /* DEBUG */
15723 
15724 	hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15725 	/*
15726 	 * Since the TSB miss handler now does not lock the hash chain before
15727 	 * walking it, make sure that the hmeblks nextpa is globally visible
15728 	 * before we make the hmeblk globally visible by updating the chain root
15729 	 * pointer in the hash bucket.
15730 	 */
15731 	membar_producer();
15732 	hmebp->hmeh_nextpa = hblkpa;
15733 	hmeblkp->hblk_next = hmebp->hmeblkp;
15734 	hmebp->hmeblkp = hmeblkp;
15735 
15736 }
15737 
15738 /*
15739  * This function is the first part of a 2 part process to remove an hmeblk
15740  * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15741  * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15742  * a per-cpu pending list using the virtual address pointer.
15743  *
15744  * TSB miss trap handlers that start after this phase will no longer see
15745  * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15746  * can still use it for further chain traversal because we haven't yet modifed
15747  * the next physical pointer or freed it.
15748  *
15749  * In the second phase of hmeblk removal we'll issue a barrier xcall before
15750  * we reuse or free this hmeblk. This will make sure all lingering references to
15751  * the hmeblk after first phase disappear before we finally reclaim it.
15752  * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15753  * during their traversal.
15754  *
15755  * The hmehash_mutex must be held when calling this function.
15756  *
15757  * Input:
15758  *	 hmebp - hme hash bucket pointer
15759  *	 hmeblkp - address of hmeblk to be removed
15760  *	 pr_hblk - virtual address of previous hmeblkp
15761  *	 listp - pointer to list of hmeblks linked by virtual address
15762  *	 free_now flag - indicates that a complete removal from the hash chains
15763  *			 is necessary.
15764  *
15765  * It is inefficient to use the free_now flag as a cross-call is required to
15766  * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15767  * in short supply.
15768  */
15769 void
15770 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15771     struct hme_blk *pr_hblk, struct hme_blk **listp,
15772     int free_now)
15773 {
15774 	int shw_size, vshift;
15775 	struct hme_blk *shw_hblkp;
15776 	uint_t		shw_mask, newshw_mask;
15777 	caddr_t		vaddr;
15778 	int		size;
15779 	cpuset_t cpuset = cpu_ready_set;
15780 
15781 	ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15782 
15783 	if (hmebp->hmeblkp == hmeblkp) {
15784 		hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15785 		hmebp->hmeblkp = hmeblkp->hblk_next;
15786 	} else {
15787 		pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15788 		pr_hblk->hblk_next = hmeblkp->hblk_next;
15789 	}
15790 
15791 	size = get_hblk_ttesz(hmeblkp);
15792 	shw_hblkp = hmeblkp->hblk_shadow;
15793 	if (shw_hblkp) {
15794 		ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15795 		ASSERT(!hmeblkp->hblk_shared);
15796 #ifdef	DEBUG
15797 		if (mmu_page_sizes == max_mmu_page_sizes) {
15798 			ASSERT(size < TTE256M);
15799 		} else {
15800 			ASSERT(size < TTE4M);
15801 		}
15802 #endif /* DEBUG */
15803 
15804 		shw_size = get_hblk_ttesz(shw_hblkp);
15805 		vaddr = (caddr_t)get_hblk_base(hmeblkp);
15806 		vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15807 		ASSERT(vshift < 8);
15808 		/*
15809 		 * Atomically clear shadow mask bit
15810 		 */
15811 		do {
15812 			shw_mask = shw_hblkp->hblk_shw_mask;
15813 			ASSERT(shw_mask & (1 << vshift));
15814 			newshw_mask = shw_mask & ~(1 << vshift);
15815 			newshw_mask = cas32(&shw_hblkp->hblk_shw_mask,
15816 			    shw_mask, newshw_mask);
15817 		} while (newshw_mask != shw_mask);
15818 		hmeblkp->hblk_shadow = NULL;
15819 	}
15820 	hmeblkp->hblk_shw_bit = 0;
15821 
15822 	if (hmeblkp->hblk_shared) {
15823 #ifdef	DEBUG
15824 		sf_srd_t	*srdp;
15825 		sf_region_t	*rgnp;
15826 		uint_t		rid;
15827 
15828 		srdp = hblktosrd(hmeblkp);
15829 		ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15830 		rid = hmeblkp->hblk_tag.htag_rid;
15831 		ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15832 		ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15833 		rgnp = srdp->srd_hmergnp[rid];
15834 		ASSERT(rgnp != NULL);
15835 		SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15836 #endif /* DEBUG */
15837 		hmeblkp->hblk_shared = 0;
15838 	}
15839 	if (free_now) {
15840 		kpreempt_disable();
15841 		CPUSET_DEL(cpuset, CPU->cpu_id);
15842 		xt_sync(cpuset);
15843 		xt_sync(cpuset);
15844 		kpreempt_enable();
15845 
15846 		hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15847 		hmeblkp->hblk_next = NULL;
15848 	} else {
15849 		/* Append hmeblkp to listp for processing later. */
15850 		hmeblkp->hblk_next = *listp;
15851 		*listp = hmeblkp;
15852 	}
15853 }
15854 
15855 /*
15856  * This routine is called when memory is in short supply and returns a free
15857  * hmeblk of the requested size from the cpu pending lists.
15858  */
15859 static struct hme_blk *
15860 sfmmu_check_pending_hblks(int size)
15861 {
15862 	int i;
15863 	struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15864 	int found_hmeblk;
15865 	cpuset_t cpuset = cpu_ready_set;
15866 	cpu_hme_pend_t *cpuhp;
15867 
15868 	/* Flush cpu hblk pending queues */
15869 	for (i = 0; i < NCPU; i++) {
15870 		cpuhp = &cpu_hme_pend[i];
15871 		if (cpuhp->chp_listp != NULL)  {
15872 			mutex_enter(&cpuhp->chp_mutex);
15873 			if (cpuhp->chp_listp == NULL)  {
15874 				mutex_exit(&cpuhp->chp_mutex);
15875 				continue;
15876 			}
15877 			found_hmeblk = 0;
15878 			last_hmeblkp = NULL;
15879 			for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15880 			    hmeblkp = hmeblkp->hblk_next) {
15881 				if (get_hblk_ttesz(hmeblkp) == size) {
15882 					if (last_hmeblkp == NULL) {
15883 						cpuhp->chp_listp =
15884 						    hmeblkp->hblk_next;
15885 					} else {
15886 						last_hmeblkp->hblk_next =
15887 						    hmeblkp->hblk_next;
15888 					}
15889 					ASSERT(cpuhp->chp_count > 0);
15890 					cpuhp->chp_count--;
15891 					found_hmeblk = 1;
15892 					break;
15893 				} else {
15894 					last_hmeblkp = hmeblkp;
15895 				}
15896 			}
15897 			mutex_exit(&cpuhp->chp_mutex);
15898 
15899 			if (found_hmeblk) {
15900 				kpreempt_disable();
15901 				CPUSET_DEL(cpuset, CPU->cpu_id);
15902 				xt_sync(cpuset);
15903 				xt_sync(cpuset);
15904 				kpreempt_enable();
15905 				return (hmeblkp);
15906 			}
15907 		}
15908 	}
15909 	return (NULL);
15910 }
15911