xref: /illumos-gate/usr/src/uts/i86pc/vm/hat_i86.c (revision 95c0a3c85cc8a224af0bc2bc1f7400be641f43fc)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * VM - Hardware Address Translation management for i386 and amd64
30  *
31  * Implementation of the interfaces described in <common/vm/hat.h>
32  *
33  * Nearly all the details of how the hardware is managed should not be
34  * visible outside this layer except for misc. machine specific functions
35  * that work in conjunction with this code.
36  *
37  * Routines used only inside of i86pc/vm start with hati_ for HAT Internal.
38  */
39 
40 #include <sys/machparam.h>
41 #include <sys/machsystm.h>
42 #include <sys/mman.h>
43 #include <sys/types.h>
44 #include <sys/systm.h>
45 #include <sys/cpuvar.h>
46 #include <sys/thread.h>
47 #include <sys/proc.h>
48 #include <sys/cpu.h>
49 #include <sys/kmem.h>
50 #include <sys/disp.h>
51 #include <sys/shm.h>
52 #include <sys/sysmacros.h>
53 #include <sys/machparam.h>
54 #include <sys/vmem.h>
55 #include <sys/vmsystm.h>
56 #include <sys/promif.h>
57 #include <sys/var.h>
58 #include <sys/x86_archext.h>
59 #include <sys/atomic.h>
60 #include <sys/bitmap.h>
61 #include <sys/controlregs.h>
62 #include <sys/bootconf.h>
63 #include <sys/bootsvcs.h>
64 #include <sys/bootinfo.h>
65 #include <sys/archsystm.h>
66 
67 #include <vm/seg_kmem.h>
68 #include <vm/hat_i86.h>
69 #include <vm/as.h>
70 #include <vm/seg.h>
71 #include <vm/page.h>
72 #include <vm/seg_kp.h>
73 #include <vm/seg_kpm.h>
74 #include <vm/vm_dep.h>
75 #include <vm/kboot_mmu.h>
76 
77 #include <sys/cmn_err.h>
78 
79 /*
80  * Basic parameters for hat operation.
81  */
82 struct hat_mmu_info mmu;
83 
84 /*
85  * The page that is the kernel's top level pagetable.
86  *
87  * For 32 bit VLP support, the kernel hat will use the 1st 4 entries
88  * on this 4K page for its top level page table. The remaining groups of
89  * 4 entries are used for per processor copies of user VLP pagetables for
90  * running threads.  See hat_switch() and reload_pae32() for details.
91  *
92  * vlp_page[0] - 0th level==2 PTE for kernel HAT (will be zero)
93  * vlp_page[1] - 1st level==2 PTE for kernel HAT (will be zero)
94  * vlp_page[2] - 2nd level==2 PTE for kernel HAT (zero for small memory)
95  * vlp_page[3] - 3rd level==2 PTE for kernel
96  *
97  * vlp_page[4] - 0th level==2 PTE for user thread on cpu 0
98  * vlp_page[5] - 1st level==2 PTE for user thread on cpu 0
99  * vlp_page[6] - 2nd level==2 PTE for user thread on cpu 0
100  * vlp_page[7] - probably copy of kernel PTE
101  *
102  * vlp_page[8]  - 0th level==2 PTE for user thread on cpu 1
103  * vlp_page[9]  - 1st level==2 PTE for user thread on cpu 1
104  * vlp_page[10] - 2nd level==2 PTE for user thread on cpu 1
105  * vlp_page[11] - probably copy of kernel PTE
106  * ...
107  *
108  * when / where the kernel PTE's are (entry 2 or 3 or none) depends
109  * on kernelbase.
110  */
111 static x86pte_t *vlp_page;
112 
113 /*
114  * forward declaration of internal utility routines
115  */
116 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected,
117 	x86pte_t new);
118 
119 /*
120  * The kernel address space exists in all HATs. To implement this the
121  * kernel reserves a fixed number of entries in every topmost level page
122  * table. The values are setup in hat_init() and then copied to every hat
123  * created by hat_alloc(). This means that kernelbase must be:
124  *
125  *	  4Meg aligned for 32 bit kernels
126  *	512Gig aligned for x86_64 64 bit kernel
127  *
128  * The PAE 32 bit hat is handled as a special case. Otherwise requiring 1Gig
129  * alignment would use too much VA for the kernel.
130  *
131  */
132 static uint_t	khat_start;	/* index of 1st entry in kernel's top ptable */
133 static uint_t	khat_entries;	/* number of entries in kernel's top ptable */
134 
135 #if defined(__i386)
136 
137 static htable_t	*khat_pae32_htable = NULL;
138 static uint_t	khat_pae32_start;
139 static uint_t	khat_pae32_entries;
140 
141 #endif
142 
143 uint_t use_boot_reserve = 1;	/* cleared after early boot process */
144 uint_t can_steal_post_boot = 0;	/* set late in boot to enable stealing */
145 
146 /*
147  * A cpuset for all cpus. This is used for kernel address cross calls, since
148  * the kernel addresses apply to all cpus.
149  */
150 cpuset_t khat_cpuset;
151 
152 /*
153  * management stuff for hat structures
154  */
155 kmutex_t	hat_list_lock;
156 kcondvar_t	hat_list_cv;
157 kmem_cache_t	*hat_cache;
158 kmem_cache_t	*hat_hash_cache;
159 kmem_cache_t	*vlp_hash_cache;
160 
161 /*
162  * Simple statistics
163  */
164 struct hatstats hatstat;
165 
166 /*
167  * useful stuff for atomic access/clearing/setting REF/MOD/RO bits in page_t's.
168  */
169 extern void atomic_orb(uchar_t *addr, uchar_t val);
170 extern void atomic_andb(uchar_t *addr, uchar_t val);
171 
172 #define	PP_GETRM(pp, rmmask)    (pp->p_nrm & rmmask)
173 #define	PP_ISMOD(pp)		PP_GETRM(pp, P_MOD)
174 #define	PP_ISREF(pp)		PP_GETRM(pp, P_REF)
175 #define	PP_ISRO(pp)		PP_GETRM(pp, P_RO)
176 
177 #define	PP_SETRM(pp, rm)	atomic_orb(&(pp->p_nrm), rm)
178 #define	PP_SETMOD(pp)		PP_SETRM(pp, P_MOD)
179 #define	PP_SETREF(pp)		PP_SETRM(pp, P_REF)
180 #define	PP_SETRO(pp)		PP_SETRM(pp, P_RO)
181 
182 #define	PP_CLRRM(pp, rm)	atomic_andb(&(pp->p_nrm), ~(rm))
183 #define	PP_CLRMOD(pp)   	PP_CLRRM(pp, P_MOD)
184 #define	PP_CLRREF(pp)   	PP_CLRRM(pp, P_REF)
185 #define	PP_CLRRO(pp)    	PP_CLRRM(pp, P_RO)
186 #define	PP_CLRALL(pp)		PP_CLRRM(pp, P_MOD | P_REF | P_RO)
187 
188 /*
189  * kmem cache constructor for struct hat
190  */
191 /*ARGSUSED*/
192 static int
193 hati_constructor(void *buf, void *handle, int kmflags)
194 {
195 	hat_t	*hat = buf;
196 
197 	mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
198 	bzero(hat->hat_pages_mapped,
199 	    sizeof (pgcnt_t) * (mmu.max_page_level + 1));
200 	hat->hat_stats = 0;
201 	hat->hat_flags = 0;
202 	CPUSET_ZERO(hat->hat_cpus);
203 	hat->hat_htable = NULL;
204 	hat->hat_ht_hash = NULL;
205 	return (0);
206 }
207 
208 /*
209  * Allocate a hat structure for as. We also create the top level
210  * htable and initialize it to contain the kernel hat entries.
211  */
212 hat_t *
213 hat_alloc(struct as *as)
214 {
215 	hat_t		*hat;
216 	htable_t	*ht;	/* top level htable */
217 	uint_t		use_vlp;
218 
219 	/*
220 	 * Once we start creating user process HATs we can enable
221 	 * the htable_steal() code.
222 	 */
223 	if (can_steal_post_boot == 0)
224 		can_steal_post_boot = 1;
225 
226 	ASSERT(AS_WRITE_HELD(as, &as->a_lock));
227 	hat = kmem_cache_alloc(hat_cache, KM_SLEEP);
228 	hat->hat_as = as;
229 	mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
230 	ASSERT(hat->hat_flags == 0);
231 
232 	/*
233 	 * a 32 bit process uses a VLP style hat when using PAE
234 	 */
235 #if defined(__amd64)
236 	use_vlp = (ttoproc(curthread)->p_model == DATAMODEL_ILP32);
237 #elif defined(__i386)
238 	use_vlp = mmu.pae_hat;
239 #endif
240 	if (use_vlp) {
241 		hat->hat_flags = HAT_VLP;
242 		bzero(hat->hat_vlp_ptes, VLP_SIZE);
243 	}
244 
245 	/*
246 	 * Allocate the htable hash
247 	 */
248 	if ((hat->hat_flags & HAT_VLP)) {
249 		hat->hat_num_hash = mmu.vlp_hash_cnt;
250 		hat->hat_ht_hash = kmem_cache_alloc(vlp_hash_cache, KM_SLEEP);
251 	} else {
252 		hat->hat_num_hash = mmu.hash_cnt;
253 		hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP);
254 	}
255 	bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *));
256 
257 	/*
258 	 * Initialize Kernel HAT entries at the top of the top level page
259 	 * table for the new hat.
260 	 *
261 	 * Note that we don't call htable_release() for the top level, that
262 	 * happens when the hat is destroyed in hat_free_end()
263 	 */
264 	hat->hat_htable = NULL;
265 	hat->hat_ht_cached = NULL;
266 	ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL);
267 
268 	if (!(hat->hat_flags & HAT_VLP))
269 		x86pte_copy(kas.a_hat->hat_htable, ht, khat_start,
270 		    khat_entries);
271 #if defined(__i386)
272 	else if (khat_entries > 0)
273 		bcopy(vlp_page + khat_start, hat->hat_vlp_ptes + khat_start,
274 		    khat_entries * sizeof (x86pte_t));
275 #endif
276 	hat->hat_htable = ht;
277 
278 #if defined(__i386)
279 	/*
280 	 * PAE32 HAT alignment is less restrictive than the others to keep
281 	 * the kernel from using too much VA. Because of this we may need
282 	 * one layer further down when kernelbase isn't 1Gig aligned.
283 	 * See hat_free_end() for the htable_release() that goes with this
284 	 * htable_create()
285 	 */
286 	if (khat_pae32_htable != NULL) {
287 		ht = htable_create(hat, kernelbase,
288 		    khat_pae32_htable->ht_level, NULL);
289 		x86pte_copy(khat_pae32_htable, ht, khat_pae32_start,
290 		    khat_pae32_entries);
291 		ht->ht_valid_cnt = khat_pae32_entries;
292 	}
293 #endif
294 
295 	/*
296 	 * Put it at the start of the global list of all hats (used by stealing)
297 	 *
298 	 * kas.a_hat is not in the list but is instead used to find the
299 	 * first and last items in the list.
300 	 *
301 	 * - kas.a_hat->hat_next points to the start of the user hats.
302 	 *   The list ends where hat->hat_next == NULL
303 	 *
304 	 * - kas.a_hat->hat_prev points to the last of the user hats.
305 	 *   The list begins where hat->hat_prev == NULL
306 	 */
307 	mutex_enter(&hat_list_lock);
308 	hat->hat_prev = NULL;
309 	hat->hat_next = kas.a_hat->hat_next;
310 	if (hat->hat_next)
311 		hat->hat_next->hat_prev = hat;
312 	else
313 		kas.a_hat->hat_prev = hat;
314 	kas.a_hat->hat_next = hat;
315 	mutex_exit(&hat_list_lock);
316 
317 	return (hat);
318 }
319 
320 /*
321  * process has finished executing but as has not been cleaned up yet.
322  */
323 /*ARGSUSED*/
324 void
325 hat_free_start(hat_t *hat)
326 {
327 	ASSERT(AS_WRITE_HELD(hat->hat_as, &hat->hat_as->a_lock));
328 
329 	/*
330 	 * If the hat is currently a stealing victim, wait for the stealing
331 	 * to finish.  Once we mark it as HAT_FREEING, htable_steal()
332 	 * won't look at its pagetables anymore.
333 	 */
334 	mutex_enter(&hat_list_lock);
335 	while (hat->hat_flags & HAT_VICTIM)
336 		cv_wait(&hat_list_cv, &hat_list_lock);
337 	hat->hat_flags |= HAT_FREEING;
338 	mutex_exit(&hat_list_lock);
339 }
340 
341 /*
342  * An address space is being destroyed, so we destroy the associated hat.
343  */
344 void
345 hat_free_end(hat_t *hat)
346 {
347 	int i;
348 	kmem_cache_t *cache;
349 
350 #ifdef DEBUG
351 	for (i = 0; i <= mmu.max_page_level; i++)
352 		ASSERT(hat->hat_pages_mapped[i] == 0);
353 #endif
354 	ASSERT(hat->hat_flags & HAT_FREEING);
355 
356 	/*
357 	 * must not be running on the given hat
358 	 */
359 	ASSERT(CPU->cpu_current_hat != hat);
360 
361 	/*
362 	 * Remove it from the list of HATs
363 	 */
364 	mutex_enter(&hat_list_lock);
365 	if (hat->hat_prev)
366 		hat->hat_prev->hat_next = hat->hat_next;
367 	else
368 		kas.a_hat->hat_next = hat->hat_next;
369 	if (hat->hat_next)
370 		hat->hat_next->hat_prev = hat->hat_prev;
371 	else
372 		kas.a_hat->hat_prev = hat->hat_prev;
373 	mutex_exit(&hat_list_lock);
374 	hat->hat_next = hat->hat_prev = NULL;
375 
376 	/*
377 	 * Make a pass through the htables freeing them all up.
378 	 */
379 	htable_purge_hat(hat);
380 
381 	/*
382 	 * Decide which kmem cache the hash table came from, then free it.
383 	 */
384 	if (hat->hat_flags & HAT_VLP)
385 		cache = vlp_hash_cache;
386 	else
387 		cache = hat_hash_cache;
388 	kmem_cache_free(cache, hat->hat_ht_hash);
389 	hat->hat_ht_hash = NULL;
390 
391 	hat->hat_flags = 0;
392 	kmem_cache_free(hat_cache, hat);
393 }
394 
395 /*
396  * round kernelbase down to a supported value to use for _userlimit
397  *
398  * userlimit must be aligned down to an entry in the top level htable.
399  * The one exception is for 32 bit HAT's running PAE.
400  */
401 uintptr_t
402 hat_kernelbase(uintptr_t va)
403 {
404 #if defined(__i386)
405 	va &= LEVEL_MASK(1);
406 #endif
407 	if (IN_VA_HOLE(va))
408 		panic("_userlimit %p will fall in VA hole\n", (void *)va);
409 	return (va);
410 }
411 
412 /*
413  * Initialize hat data structures based on processor MMU information.
414  */
415 void
416 mmu_init(void)
417 {
418 	uint_t max_htables;
419 	uint_t pa_bits;
420 	uint_t va_bits;
421 	int i;
422 
423 	/*
424 	 * If CPU enabled the page table global bit, use it for the kernel
425 	 * This is bit 7 in CR4 (PGE - Page Global Enable).
426 	 */
427 	if ((x86_feature & X86_PGE) != 0 && (getcr4() & CR4_PGE) != 0)
428 		mmu.pt_global = PT_GLOBAL;
429 
430 	/*
431 	 * Detect NX and PAE usage.
432 	 */
433 	mmu.pae_hat = kbm_pae_support;
434 	if (kbm_nx_support)
435 		mmu.pt_nx = PT_NX;
436 	else
437 		mmu.pt_nx = 0;
438 
439 	/*
440 	 * Intel CPUs allow speculative caching (in TLB-like h/w) of
441 	 * entries in upper page tables even though there may not be
442 	 * any valid entries in lower tables. This implies we have to
443 	 * re-INVLPG at every upper page table entry invalidation.
444 	 */
445 	if (cpuid_getvendor(CPU) == X86_VENDOR_Intel)
446 		mmu.inval_nonleaf = 1;
447 	else
448 		mmu.inval_nonleaf = 0;
449 	/*
450 	 * Use CPU info to set various MMU parameters
451 	 */
452 	cpuid_get_addrsize(CPU, &pa_bits, &va_bits);
453 
454 	if (va_bits < sizeof (void *) * NBBY) {
455 		mmu.hole_start = (1ul << (va_bits - 1));
456 		mmu.hole_end = 0ul - mmu.hole_start - 1;
457 	} else {
458 		mmu.hole_end = 0;
459 		mmu.hole_start = mmu.hole_end - 1;
460 	}
461 #if defined(OPTERON_ERRATUM_121)
462 	/*
463 	 * If erratum 121 has already been detected at this time, hole_start
464 	 * contains the value to be subtracted from mmu.hole_start.
465 	 */
466 	ASSERT(hole_start == 0 || opteron_erratum_121 != 0);
467 	hole_start = mmu.hole_start - hole_start;
468 #else
469 	hole_start = mmu.hole_start;
470 #endif
471 	hole_end = mmu.hole_end;
472 
473 	mmu.highest_pfn = mmu_btop((1ull << pa_bits) - 1);
474 	if (mmu.pae_hat == 0 && pa_bits > 32)
475 		mmu.highest_pfn = PFN_4G - 1;
476 
477 	if (mmu.pae_hat) {
478 		mmu.pte_size = 8;	/* 8 byte PTEs */
479 		mmu.pte_size_shift = 3;
480 	} else {
481 		mmu.pte_size = 4;	/* 4 byte PTEs */
482 		mmu.pte_size_shift = 2;
483 	}
484 
485 	if (mmu.pae_hat && (x86_feature & X86_PAE) == 0)
486 		panic("Processor does not support PAE");
487 
488 	if ((x86_feature & X86_CX8) == 0)
489 		panic("Processor does not support cmpxchg8b instruction");
490 
491 	/*
492 	 * Initialize parameters based on the 64 or 32 bit kernels and
493 	 * for the 32 bit kernel decide if we should use PAE.
494 	 */
495 	if (kbm_largepage_support)
496 		mmu.max_page_level = 1;
497 	else
498 		mmu.max_page_level = 0;
499 	mmu_page_sizes = mmu.max_page_level + 1;
500 	mmu_exported_page_sizes = mmu_page_sizes;
501 
502 #if defined(__amd64)
503 
504 	mmu.num_level = 4;
505 	mmu.max_level = 3;
506 	mmu.ptes_per_table = 512;
507 	mmu.top_level_count = 512;
508 
509 	mmu.level_shift[0] = 12;
510 	mmu.level_shift[1] = 21;
511 	mmu.level_shift[2] = 30;
512 	mmu.level_shift[3] = 39;
513 
514 #elif defined(__i386)
515 
516 	if (mmu.pae_hat) {
517 		mmu.num_level = 3;
518 		mmu.max_level = 2;
519 		mmu.ptes_per_table = 512;
520 		mmu.top_level_count = 4;
521 
522 		mmu.level_shift[0] = 12;
523 		mmu.level_shift[1] = 21;
524 		mmu.level_shift[2] = 30;
525 
526 	} else {
527 		mmu.num_level = 2;
528 		mmu.max_level = 1;
529 		mmu.ptes_per_table = 1024;
530 		mmu.top_level_count = 1024;
531 
532 		mmu.level_shift[0] = 12;
533 		mmu.level_shift[1] = 22;
534 	}
535 
536 #endif	/* __i386 */
537 
538 	for (i = 0; i < mmu.num_level; ++i) {
539 		mmu.level_size[i] = 1UL << mmu.level_shift[i];
540 		mmu.level_offset[i] = mmu.level_size[i] - 1;
541 		mmu.level_mask[i] = ~mmu.level_offset[i];
542 	}
543 
544 	for (i = 0; i <= mmu.max_page_level; ++i) {
545 		mmu.pte_bits[i] = PT_VALID;
546 		if (i > 0)
547 			mmu.pte_bits[i] |= PT_PAGESIZE;
548 	}
549 
550 	/*
551 	 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level.
552 	 */
553 	for (i = 1; i < mmu.num_level; ++i)
554 		mmu.ptp_bits[i] = PT_PTPBITS;
555 
556 #if defined(__i386)
557 	mmu.ptp_bits[2] = PT_VALID;
558 #endif
559 
560 	/*
561 	 * Compute how many hash table entries to have per process for htables.
562 	 * We start with 1 page's worth of entries.
563 	 *
564 	 * If physical memory is small, reduce the amount need to cover it.
565 	 */
566 	max_htables = physmax / mmu.ptes_per_table;
567 	mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *);
568 	while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables)
569 		mmu.hash_cnt >>= 1;
570 	mmu.vlp_hash_cnt = mmu.hash_cnt;
571 
572 #if defined(__amd64)
573 	/*
574 	 * If running in 64 bits and physical memory is large,
575 	 * increase the size of the cache to cover all of memory for
576 	 * a 64 bit process.
577 	 */
578 #define	HASH_MAX_LENGTH 4
579 	while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables)
580 		mmu.hash_cnt <<= 1;
581 #endif
582 }
583 
584 
585 /*
586  * initialize hat data structures
587  */
588 void
589 hat_init()
590 {
591 #if defined(__i386)
592 	/*
593 	 * _userlimit must be aligned correctly
594 	 */
595 	if ((_userlimit & LEVEL_MASK(1)) != _userlimit) {
596 		prom_printf("hat_init(): _userlimit=%p, not aligned at %p\n",
597 		    (void *)_userlimit, (void *)LEVEL_SIZE(1));
598 		halt("hat_init(): Unable to continue");
599 	}
600 #endif
601 
602 	cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL);
603 
604 	/*
605 	 * initialize kmem caches
606 	 */
607 	htable_init();
608 	hment_init();
609 
610 	hat_cache = kmem_cache_create("hat_t",
611 	    sizeof (hat_t), 0, hati_constructor, NULL, NULL,
612 	    NULL, 0, 0);
613 
614 	hat_hash_cache = kmem_cache_create("HatHash",
615 	    mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL,
616 	    NULL, 0, 0);
617 
618 	/*
619 	 * VLP hats can use a smaller hash table size on large memroy machines
620 	 */
621 	if (mmu.hash_cnt == mmu.vlp_hash_cnt) {
622 		vlp_hash_cache = hat_hash_cache;
623 	} else {
624 		vlp_hash_cache = kmem_cache_create("HatVlpHash",
625 		    mmu.vlp_hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL,
626 		    NULL, 0, 0);
627 	}
628 
629 	/*
630 	 * Set up the kernel's hat
631 	 */
632 	AS_LOCK_ENTER(&kas, &kas.a_lock, RW_WRITER);
633 	kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP);
634 	mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
635 	kas.a_hat->hat_as = &kas;
636 	kas.a_hat->hat_flags = 0;
637 	AS_LOCK_EXIT(&kas, &kas.a_lock);
638 
639 	CPUSET_ZERO(khat_cpuset);
640 	CPUSET_ADD(khat_cpuset, CPU->cpu_id);
641 
642 	/*
643 	 * The kernel hat's next pointer serves as the head of the hat list .
644 	 * The kernel hat's prev pointer tracks the last hat on the list for
645 	 * htable_steal() to use.
646 	 */
647 	kas.a_hat->hat_next = NULL;
648 	kas.a_hat->hat_prev = NULL;
649 
650 	/*
651 	 * Allocate an htable hash bucket for the kernel
652 	 * XX64 - tune for 64 bit procs
653 	 */
654 	kas.a_hat->hat_num_hash = mmu.hash_cnt;
655 	kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP);
656 	bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *));
657 
658 	/*
659 	 * zero out the top level and cached htable pointers
660 	 */
661 	kas.a_hat->hat_ht_cached = NULL;
662 	kas.a_hat->hat_htable = NULL;
663 
664 	/*
665 	 * Pre-allocate hrm_hashtab before enabling the collection of
666 	 * refmod statistics.  Allocating on the fly would mean us
667 	 * running the risk of suffering recursive mutex enters or
668 	 * deadlocks.
669 	 */
670 	hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
671 	    KM_SLEEP);
672 }
673 
674 /*
675  * Prepare CPU specific pagetables for VLP processes on 64 bit kernels.
676  *
677  * Each CPU has a set of 2 pagetables that are reused for any 32 bit
678  * process it runs. They are the top level pagetable, hci_vlp_l3ptes, and
679  * the next to top level table for the bottom 512 Gig, hci_vlp_l2ptes.
680  */
681 /*ARGSUSED*/
682 static void
683 hat_vlp_setup(struct cpu *cpu)
684 {
685 #if defined(__amd64)
686 	struct hat_cpu_info *hci = cpu->cpu_hat_info;
687 	pfn_t pfn;
688 
689 	/*
690 	 * allocate the level==2 page table for the bottom most
691 	 * 512Gig of address space (this is where 32 bit apps live)
692 	 */
693 	ASSERT(hci != NULL);
694 	hci->hci_vlp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
695 
696 	/*
697 	 * Allocate a top level pagetable and copy the kernel's
698 	 * entries into it. Then link in hci_vlp_l2ptes in the 1st entry.
699 	 */
700 	hci->hci_vlp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
701 	hci->hci_vlp_pfn =
702 	    hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l3ptes);
703 	ASSERT(hci->hci_vlp_pfn != PFN_INVALID);
704 	bcopy(vlp_page + khat_start, hci->hci_vlp_l3ptes + khat_start,
705 	    khat_entries * sizeof (x86pte_t));
706 
707 	pfn = hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l2ptes);
708 	ASSERT(pfn != PFN_INVALID);
709 	hci->hci_vlp_l3ptes[0] = MAKEPTP(pfn, 2);
710 #endif /* __amd64 */
711 }
712 
713 /*ARGSUSED*/
714 static void
715 hat_vlp_teardown(cpu_t *cpu)
716 {
717 #if defined(__amd64)
718 	struct hat_cpu_info *hci;
719 
720 	if ((hci = cpu->cpu_hat_info) == NULL)
721 		return;
722 	if (hci->hci_vlp_l2ptes)
723 		kmem_free(hci->hci_vlp_l2ptes, MMU_PAGESIZE);
724 	if (hci->hci_vlp_l3ptes)
725 		kmem_free(hci->hci_vlp_l3ptes, MMU_PAGESIZE);
726 #endif	/* __amd64 */
727 }
728 
729 /*
730  * Finish filling in the kernel hat.
731  * Pre fill in all top level kernel page table entries for the kernel's
732  * part of the address range.  From this point on we can't use any new
733  * kernel large pages if they need PTE's at max_level
734  *
735  * create the kmap mappings.
736  */
737 void
738 hat_init_finish(void)
739 {
740 	htable_t	*top = kas.a_hat->hat_htable;
741 	htable_t	*ht;
742 	uint_t		e;
743 	x86pte_t	pte;
744 	uintptr_t	va = kernelbase;
745 	size_t		size;
746 
747 
748 #if defined(__i386)
749 	ASSERT((va & LEVEL_MASK(1)) == va);
750 
751 	/*
752 	 * Deal with kernelbase not 1Gig aligned for 32 bit PAE hats.
753 	 */
754 	if (!mmu.pae_hat || (va & LEVEL_OFFSET(mmu.max_level)) == 0) {
755 		khat_pae32_htable = NULL;
756 	} else {
757 		ASSERT(mmu.max_level == 2);
758 		ASSERT((va & LEVEL_OFFSET(mmu.max_level - 1)) == 0);
759 		khat_pae32_htable =
760 		    htable_create(kas.a_hat, va, mmu.max_level - 1, NULL);
761 		khat_pae32_start = htable_va2entry(va, khat_pae32_htable);
762 		khat_pae32_entries = mmu.ptes_per_table - khat_pae32_start;
763 		for (e = khat_pae32_start; e < mmu.ptes_per_table;
764 		    ++e, va += LEVEL_SIZE(mmu.max_level - 1)) {
765 			pte = x86pte_get(khat_pae32_htable, e);
766 			if (PTE_ISVALID(pte))
767 				continue;
768 			ht = htable_create(kas.a_hat, va, mmu.max_level - 2,
769 			    NULL);
770 			ASSERT(ht != NULL);
771 		}
772 	}
773 #endif
774 
775 	/*
776 	 * The kernel hat will need fixed values in the highest level
777 	 * ptable for copying to all other hat's. This implies
778 	 * alignment restrictions on _userlimit.
779 	 *
780 	 * Note we don't htable_release() these htables. This keeps them
781 	 * from ever being stolen or free'd.
782 	 *
783 	 * top_level_count is used instead of ptes_per_table, since
784 	 * on 32-bit PAE we only have 4 usable entries at the top level ptable.
785 	 */
786 	if (va == 0)
787 		khat_start = mmu.top_level_count;
788 	else
789 		khat_start = htable_va2entry(va, kas.a_hat->hat_htable);
790 	khat_entries = mmu.top_level_count - khat_start;
791 	for (e = khat_start; e < mmu.top_level_count;
792 	    ++e, va += LEVEL_SIZE(mmu.max_level)) {
793 		if (IN_HYPERVISOR_VA(va))
794 			continue;
795 		pte = x86pte_get(top, e);
796 		if (PTE_ISVALID(pte))
797 			continue;
798 		ht = htable_create(kas.a_hat, va, mmu.max_level - 1, NULL);
799 		ASSERT(ht != NULL);
800 	}
801 
802 	/*
803 	 * We are now effectively running on the kernel hat.
804 	 * Clearing use_boot_reserve shuts off using the pre-allocated boot
805 	 * reserve for all HAT allocations.  From here on, the reserves are
806 	 * only used when mapping in memory for the hat's own allocations.
807 	 */
808 	use_boot_reserve = 0;
809 	htable_adjust_reserve();
810 
811 	/*
812 	 * 32 bit kernels use only 4 of the 512 entries in its top level
813 	 * pagetable. We'll use the remainder for the "per CPU" page tables
814 	 * for VLP processes.
815 	 *
816 	 * We also map the top level kernel pagetable into the kernel to make
817 	 * it easy to use bcopy to initialize new address spaces.
818 	 */
819 	if (mmu.pae_hat) {
820 		vlp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP);
821 		hat_devload(kas.a_hat, (caddr_t)vlp_page, MMU_PAGESIZE,
822 		    kas.a_hat->hat_htable->ht_pfn,
823 		    PROT_WRITE |
824 		    PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK,
825 		    HAT_LOAD | HAT_LOAD_NOCONSIST);
826 	}
827 	hat_vlp_setup(CPU);
828 
829 	/*
830 	 * Create kmap (cached mappings of kernel PTEs)
831 	 * for 32 bit we map from segmap_start .. ekernelheap
832 	 * for 64 bit we map from segmap_start .. segmap_start + segmapsize;
833 	 */
834 #if defined(__i386)
835 	size = (uintptr_t)ekernelheap - segmap_start;
836 #elif defined(__amd64)
837 	size = segmapsize;
838 #endif
839 	hat_kmap_init((uintptr_t)segmap_start, size);
840 }
841 
842 /*
843  * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references
844  * are 32 bit, so for safety we must use cas64() to install these.
845  */
846 #ifdef __i386
847 static void
848 reload_pae32(hat_t *hat, cpu_t *cpu)
849 {
850 	x86pte_t *src;
851 	x86pte_t *dest;
852 	x86pte_t pte;
853 	int i;
854 
855 	/*
856 	 * Load the 4 entries of the level 2 page table into this
857 	 * cpu's range of the vlp_page and point cr3 at them.
858 	 */
859 	ASSERT(mmu.pae_hat);
860 	src = hat->hat_vlp_ptes;
861 	dest = vlp_page + (cpu->cpu_id + 1) * VLP_NUM_PTES;
862 	for (i = 0; i < VLP_NUM_PTES; ++i) {
863 		for (;;) {
864 			pte = dest[i];
865 			if (pte == src[i])
866 				break;
867 			if (cas64(dest + i, pte, src[i]) != src[i])
868 				break;
869 		}
870 	}
871 }
872 #endif
873 
874 /*
875  * Switch to a new active hat, maintaining bit masks to track active CPUs.
876  */
877 void
878 hat_switch(hat_t *hat)
879 {
880 	uintptr_t	newcr3;
881 	cpu_t		*cpu = CPU;
882 	hat_t		*old = cpu->cpu_current_hat;
883 
884 	/*
885 	 * set up this information first, so we don't miss any cross calls
886 	 */
887 	if (old != NULL) {
888 		if (old == hat)
889 			return;
890 		if (old != kas.a_hat)
891 			CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id);
892 	}
893 
894 	/*
895 	 * Add this CPU to the active set for this HAT.
896 	 */
897 	if (hat != kas.a_hat) {
898 		CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id);
899 	}
900 	cpu->cpu_current_hat = hat;
901 
902 	/*
903 	 * now go ahead and load cr3
904 	 */
905 	if (hat->hat_flags & HAT_VLP) {
906 #if defined(__amd64)
907 		x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes;
908 
909 		VLP_COPY(hat->hat_vlp_ptes, vlpptep);
910 		newcr3 = MAKECR3(cpu->cpu_hat_info->hci_vlp_pfn);
911 #elif defined(__i386)
912 		reload_pae32(hat, cpu);
913 		newcr3 = MAKECR3(kas.a_hat->hat_htable->ht_pfn) +
914 		    (cpu->cpu_id + 1) * VLP_SIZE;
915 #endif
916 	} else {
917 		newcr3 = MAKECR3(hat->hat_htable->ht_pfn);
918 	}
919 	setcr3(newcr3);
920 	ASSERT(cpu == CPU);
921 }
922 
923 /*
924  * Utility to return a valid x86pte_t from protections, pfn, and level number
925  */
926 static x86pte_t
927 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags)
928 {
929 	x86pte_t	pte;
930 	uint_t		cache_attr = attr & HAT_ORDER_MASK;
931 
932 	pte = MAKEPTE(pfn, level);
933 
934 	if (attr & PROT_WRITE)
935 		PTE_SET(pte, PT_WRITABLE);
936 
937 	if (attr & PROT_USER)
938 		PTE_SET(pte, PT_USER);
939 
940 	if (!(attr & PROT_EXEC))
941 		PTE_SET(pte, mmu.pt_nx);
942 
943 	/*
944 	 * Set the software bits used track ref/mod sync's and hments.
945 	 * If not using REF/MOD, set them to avoid h/w rewriting PTEs.
946 	 */
947 	if (flags & HAT_LOAD_NOCONSIST)
948 		PTE_SET(pte, PT_NOCONSIST | PT_REF | PT_MOD);
949 	else if (attr & HAT_NOSYNC)
950 		PTE_SET(pte, PT_NOSYNC | PT_REF | PT_MOD);
951 
952 	/*
953 	 * Set the caching attributes in the PTE. The combination
954 	 * of attributes are poorly defined, so we pay attention
955 	 * to them in the given order.
956 	 *
957 	 * The test for HAT_STRICTORDER is different because it's defined
958 	 * as "0" - which was a stupid thing to do, but is too late to change!
959 	 */
960 	if (cache_attr == HAT_STRICTORDER) {
961 		PTE_SET(pte, PT_NOCACHE);
962 	/*LINTED [Lint hates empty ifs, but it's the obvious way to do this] */
963 	} else if (cache_attr & (HAT_UNORDERED_OK | HAT_STORECACHING_OK)) {
964 		/* nothing to set */;
965 	} else if (cache_attr & (HAT_MERGING_OK | HAT_LOADCACHING_OK)) {
966 		PTE_SET(pte, PT_NOCACHE);
967 		if (x86_feature & X86_PAT)
968 			PTE_SET(pte, (level == 0) ? PT_PAT_4K : PT_PAT_LARGE);
969 		else
970 			PTE_SET(pte, PT_WRITETHRU);
971 	} else {
972 		panic("hati_mkpte(): bad caching attributes: %x\n", cache_attr);
973 	}
974 
975 	return (pte);
976 }
977 
978 /*
979  * Duplicate address translations of the parent to the child.
980  * This function really isn't used anymore.
981  */
982 /*ARGSUSED*/
983 int
984 hat_dup(hat_t *old, hat_t *new, caddr_t addr, size_t len, uint_t flag)
985 {
986 	ASSERT((uintptr_t)addr < kernelbase);
987 	ASSERT(new != kas.a_hat);
988 	ASSERT(old != kas.a_hat);
989 	return (0);
990 }
991 
992 /*
993  * Allocate any hat resources required for a process being swapped in.
994  */
995 /*ARGSUSED*/
996 void
997 hat_swapin(hat_t *hat)
998 {
999 	/* do nothing - we let everything fault back in */
1000 }
1001 
1002 /*
1003  * Unload all translations associated with an address space of a process
1004  * that is being swapped out.
1005  */
1006 void
1007 hat_swapout(hat_t *hat)
1008 {
1009 	uintptr_t	vaddr = (uintptr_t)0;
1010 	uintptr_t	eaddr = _userlimit;
1011 	htable_t	*ht = NULL;
1012 	level_t		l;
1013 
1014 	/*
1015 	 * We can't just call hat_unload(hat, 0, _userlimit...)  here, because
1016 	 * seg_spt and shared pagetables can't be swapped out.
1017 	 * Take a look at segspt_shmswapout() - it's a big no-op.
1018 	 *
1019 	 * Instead we'll walk through all the address space and unload
1020 	 * any mappings which we are sure are not shared, not locked.
1021 	 */
1022 	ASSERT(IS_PAGEALIGNED(vaddr));
1023 	ASSERT(IS_PAGEALIGNED(eaddr));
1024 	ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1025 	if ((uintptr_t)hat->hat_as->a_userlimit < eaddr)
1026 		eaddr = (uintptr_t)hat->hat_as->a_userlimit;
1027 
1028 	while (vaddr < eaddr) {
1029 		(void) htable_walk(hat, &ht, &vaddr, eaddr);
1030 		if (ht == NULL)
1031 			break;
1032 
1033 		ASSERT(!IN_VA_HOLE(vaddr));
1034 
1035 		/*
1036 		 * If the page table is shared skip its entire range.
1037 		 * This code knows that only level 0 page tables are shared
1038 		 */
1039 		l = ht->ht_level;
1040 		if (ht->ht_flags & HTABLE_SHARED_PFN) {
1041 			ASSERT(l == 0);
1042 			vaddr = ht->ht_vaddr + LEVEL_SIZE(1);
1043 			htable_release(ht);
1044 			ht = NULL;
1045 			continue;
1046 		}
1047 
1048 		/*
1049 		 * If the page table has no locked entries, unload this one.
1050 		 */
1051 		if (ht->ht_lock_cnt == 0)
1052 			hat_unload(hat, (caddr_t)vaddr, LEVEL_SIZE(l),
1053 			    HAT_UNLOAD_UNMAP);
1054 
1055 		/*
1056 		 * If we have a level 0 page table with locked entries,
1057 		 * skip the entire page table, otherwise skip just one entry.
1058 		 */
1059 		if (ht->ht_lock_cnt > 0 && l == 0)
1060 			vaddr = ht->ht_vaddr + LEVEL_SIZE(1);
1061 		else
1062 			vaddr += LEVEL_SIZE(l);
1063 	}
1064 	if (ht)
1065 		htable_release(ht);
1066 
1067 	/*
1068 	 * We're in swapout because the system is low on memory, so
1069 	 * go back and flush all the htables off the cached list.
1070 	 */
1071 	htable_purge_hat(hat);
1072 }
1073 
1074 /*
1075  * returns number of bytes that have valid mappings in hat.
1076  */
1077 size_t
1078 hat_get_mapped_size(hat_t *hat)
1079 {
1080 	size_t total = 0;
1081 	int l;
1082 
1083 	for (l = 0; l <= mmu.max_page_level; l++)
1084 		total += (hat->hat_pages_mapped[l] << LEVEL_SHIFT(l));
1085 
1086 	return (total);
1087 }
1088 
1089 /*
1090  * enable/disable collection of stats for hat.
1091  */
1092 int
1093 hat_stats_enable(hat_t *hat)
1094 {
1095 	atomic_add_32(&hat->hat_stats, 1);
1096 	return (1);
1097 }
1098 
1099 void
1100 hat_stats_disable(hat_t *hat)
1101 {
1102 	atomic_add_32(&hat->hat_stats, -1);
1103 }
1104 
1105 /*
1106  * Utility to sync the ref/mod bits from a page table entry to the page_t
1107  * We must be holding the mapping list lock when this is called.
1108  */
1109 static void
1110 hati_sync_pte_to_page(page_t *pp, x86pte_t pte, level_t level)
1111 {
1112 	uint_t	rm = 0;
1113 	pgcnt_t	pgcnt;
1114 
1115 	if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC)
1116 		return;
1117 
1118 	if (PTE_GET(pte, PT_REF))
1119 		rm |= P_REF;
1120 
1121 	if (PTE_GET(pte, PT_MOD))
1122 		rm |= P_MOD;
1123 
1124 	if (rm == 0)
1125 		return;
1126 
1127 	/*
1128 	 * sync to all constituent pages of a large page
1129 	 */
1130 	ASSERT(x86_hm_held(pp));
1131 	pgcnt = page_get_pagecnt(level);
1132 	ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt));
1133 	for (; pgcnt > 0; --pgcnt) {
1134 		/*
1135 		 * hat_page_demote() can't decrease
1136 		 * pszc below this mapping size
1137 		 * since this large mapping existed after we
1138 		 * took mlist lock.
1139 		 */
1140 		ASSERT(pp->p_szc >= level);
1141 		hat_page_setattr(pp, rm);
1142 		++pp;
1143 	}
1144 }
1145 
1146 /*
1147  * This the set of PTE bits for PFN, permissions and caching
1148  * that require a TLB flush (hat_tlb_inval) if changed on a HAT_LOAD_REMAP
1149  */
1150 #define	PT_REMAP_BITS							\
1151 	(PT_PADDR | PT_NX | PT_WRITABLE | PT_WRITETHRU |		\
1152 	PT_NOCACHE | PT_PAT_4K | PT_PAT_LARGE)
1153 
1154 #define	REMAPASSERT(EX)	if (!(EX)) panic("hati_pte_map: " #EX)
1155 /*
1156  * Do the low-level work to get a mapping entered into a HAT's pagetables
1157  * and in the mapping list of the associated page_t.
1158  */
1159 static int
1160 hati_pte_map(
1161 	htable_t	*ht,
1162 	uint_t		entry,
1163 	page_t		*pp,
1164 	x86pte_t	pte,
1165 	int		flags,
1166 	void		*pte_ptr)
1167 {
1168 	hat_t		*hat = ht->ht_hat;
1169 	x86pte_t	old_pte;
1170 	level_t		l = ht->ht_level;
1171 	hment_t		*hm;
1172 	uint_t		is_consist;
1173 	int		rv = 0;
1174 
1175 	/*
1176 	 * Is this a consistant (ie. need mapping list lock) mapping?
1177 	 */
1178 	is_consist = (pp != NULL && (flags & HAT_LOAD_NOCONSIST) == 0);
1179 
1180 	/*
1181 	 * Track locked mapping count in the htable.  Do this first,
1182 	 * as we track locking even if there already is a mapping present.
1183 	 */
1184 	if ((flags & HAT_LOAD_LOCK) != 0 && hat != kas.a_hat)
1185 		HTABLE_LOCK_INC(ht);
1186 
1187 	/*
1188 	 * Acquire the page's mapping list lock and get an hment to use.
1189 	 * Note that hment_prepare() might return NULL.
1190 	 */
1191 	if (is_consist) {
1192 		x86_hm_enter(pp);
1193 		hm = hment_prepare(ht, entry, pp);
1194 	}
1195 
1196 	/*
1197 	 * Set the new pte, retrieving the old one at the same time.
1198 	 */
1199 	old_pte = x86pte_set(ht, entry, pte, pte_ptr);
1200 
1201 	/*
1202 	 * did we get a large page / page table collision?
1203 	 */
1204 	if (old_pte == LPAGE_ERROR) {
1205 		rv = -1;
1206 		goto done;
1207 	}
1208 
1209 	/*
1210 	 * If the mapping didn't change there is nothing more to do.
1211 	 */
1212 	if (PTE_EQUIV(pte, old_pte))
1213 		goto done;
1214 
1215 	/*
1216 	 * Install a new mapping in the page's mapping list
1217 	 */
1218 	if (!PTE_ISVALID(old_pte)) {
1219 		if (is_consist) {
1220 			hment_assign(ht, entry, pp, hm);
1221 			x86_hm_exit(pp);
1222 		} else {
1223 			ASSERT(flags & HAT_LOAD_NOCONSIST);
1224 		}
1225 		HTABLE_INC(ht->ht_valid_cnt);
1226 		PGCNT_INC(hat, l);
1227 		return (rv);
1228 	}
1229 
1230 	/*
1231 	 * Remap's are more complicated:
1232 	 *  - HAT_LOAD_REMAP must be specified if changing the pfn.
1233 	 *    We also require that NOCONSIST be specified.
1234 	 *  - Otherwise only permission or caching bits may change.
1235 	 */
1236 	if (!PTE_ISPAGE(old_pte, l))
1237 		panic("non-null/page mapping pte=" FMT_PTE, old_pte);
1238 
1239 	if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) {
1240 		REMAPASSERT(flags & HAT_LOAD_REMAP);
1241 		REMAPASSERT(flags & HAT_LOAD_NOCONSIST);
1242 		REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST);
1243 		REMAPASSERT(pf_is_memory(PTE2PFN(old_pte, l)) ==
1244 		    pf_is_memory(PTE2PFN(pte, l)));
1245 		REMAPASSERT(!is_consist);
1246 	}
1247 
1248 	/*
1249 	 * We only let remaps change the bits for PFNs, permissions
1250 	 * or caching type.
1251 	 */
1252 	ASSERT(PTE_GET(old_pte, ~(PT_REMAP_BITS | PT_REF | PT_MOD)) ==
1253 	    PTE_GET(pte, ~PT_REMAP_BITS));
1254 
1255 	/*
1256 	 * We don't create any mapping list entries on a remap, so release
1257 	 * any allocated hment after we drop the mapping list lock.
1258 	 */
1259 done:
1260 	if (is_consist) {
1261 		x86_hm_exit(pp);
1262 		if (hm != NULL)
1263 			hment_free(hm);
1264 	}
1265 	return (rv);
1266 }
1267 
1268 /*
1269  * Internal routine to load a single page table entry. This only fails if
1270  * we attempt to overwrite a page table link with a large page.
1271  */
1272 static int
1273 hati_load_common(
1274 	hat_t		*hat,
1275 	uintptr_t	va,
1276 	page_t		*pp,
1277 	uint_t		attr,
1278 	uint_t		flags,
1279 	level_t		level,
1280 	pfn_t		pfn)
1281 {
1282 	htable_t	*ht;
1283 	uint_t		entry;
1284 	x86pte_t	pte;
1285 	int		rv = 0;
1286 
1287 	/*
1288 	 * The number 16 is arbitrary and here to catch a recursion problem
1289 	 * early before we blow out the kernel stack.
1290 	 */
1291 	++curthread->t_hatdepth;
1292 	ASSERT(curthread->t_hatdepth < 16);
1293 
1294 	ASSERT(hat == kas.a_hat ||
1295 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1296 
1297 	if (flags & HAT_LOAD_SHARE)
1298 		hat->hat_flags |= HAT_SHARED;
1299 
1300 	/*
1301 	 * Find the page table that maps this page if it already exists.
1302 	 */
1303 	ht = htable_lookup(hat, va, level);
1304 
1305 	/*
1306 	 * We must have HAT_LOAD_NOCONSIST if page_t is NULL.
1307 	 */
1308 	if (pp == NULL)
1309 		flags |= HAT_LOAD_NOCONSIST;
1310 
1311 	if (ht == NULL) {
1312 		ht = htable_create(hat, va, level, NULL);
1313 		ASSERT(ht != NULL);
1314 	}
1315 	entry = htable_va2entry(va, ht);
1316 
1317 	/*
1318 	 * a bunch of paranoid error checking
1319 	 */
1320 	ASSERT(ht->ht_busy > 0);
1321 	if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht))
1322 		panic("hati_load_common: bad htable %p, va %p", ht, (void *)va);
1323 	ASSERT(ht->ht_level == level);
1324 
1325 	/*
1326 	 * construct the new PTE
1327 	 */
1328 	if (hat == kas.a_hat)
1329 		attr &= ~PROT_USER;
1330 	pte = hati_mkpte(pfn, attr, level, flags);
1331 	if (hat == kas.a_hat && va >= kernelbase)
1332 		PTE_SET(pte, mmu.pt_global);
1333 
1334 	/*
1335 	 * establish the mapping
1336 	 */
1337 	rv = hati_pte_map(ht, entry, pp, pte, flags, NULL);
1338 
1339 	/*
1340 	 * release the htable and any reserves
1341 	 */
1342 	htable_release(ht);
1343 	--curthread->t_hatdepth;
1344 	return (rv);
1345 }
1346 
1347 /*
1348  * special case of hat_memload to deal with some kernel addrs for performance
1349  */
1350 static void
1351 hat_kmap_load(
1352 	caddr_t		addr,
1353 	page_t		*pp,
1354 	uint_t		attr,
1355 	uint_t		flags)
1356 {
1357 	uintptr_t	va = (uintptr_t)addr;
1358 	x86pte_t	pte;
1359 	pfn_t		pfn = page_pptonum(pp);
1360 	pgcnt_t		pg_off = mmu_btop(va - mmu.kmap_addr);
1361 	htable_t	*ht;
1362 	uint_t		entry;
1363 	void		*pte_ptr;
1364 
1365 	/*
1366 	 * construct the requested PTE
1367 	 */
1368 	attr &= ~PROT_USER;
1369 	attr |= HAT_STORECACHING_OK;
1370 	pte = hati_mkpte(pfn, attr, 0, flags);
1371 	PTE_SET(pte, mmu.pt_global);
1372 
1373 	/*
1374 	 * Figure out the pte_ptr and htable and use common code to finish up
1375 	 */
1376 	if (mmu.pae_hat)
1377 		pte_ptr = mmu.kmap_ptes + pg_off;
1378 	else
1379 		pte_ptr = (x86pte32_t *)mmu.kmap_ptes + pg_off;
1380 	ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) >>
1381 	    LEVEL_SHIFT(1)];
1382 	entry = htable_va2entry(va, ht);
1383 	++curthread->t_hatdepth;
1384 	ASSERT(curthread->t_hatdepth < 16);
1385 	(void) hati_pte_map(ht, entry, pp, pte, flags, pte_ptr);
1386 	--curthread->t_hatdepth;
1387 }
1388 
1389 /*
1390  * hat_memload() - load a translation to the given page struct
1391  *
1392  * Flags for hat_memload/hat_devload/hat_*attr.
1393  *
1394  * 	HAT_LOAD	Default flags to load a translation to the page.
1395  *
1396  * 	HAT_LOAD_LOCK	Lock down mapping resources; hat_map(), hat_memload(),
1397  *			and hat_devload().
1398  *
1399  *	HAT_LOAD_NOCONSIST Do not add mapping to page_t mapping list.
1400  *			sets PT_NOCONSIST
1401  *
1402  *	HAT_LOAD_SHARE	A flag to hat_memload() to indicate h/w page tables
1403  *			that map some user pages (not kas) is shared by more
1404  *			than one process (eg. ISM).
1405  *
1406  *	HAT_LOAD_REMAP	Reload a valid pte with a different page frame.
1407  *
1408  *	HAT_NO_KALLOC	Do not kmem_alloc while creating the mapping; at this
1409  *			point, it's setting up mapping to allocate internal
1410  *			hat layer data structures.  This flag forces hat layer
1411  *			to tap its reserves in order to prevent infinite
1412  *			recursion.
1413  *
1414  * The following is a protection attribute (like PROT_READ, etc.)
1415  *
1416  *	HAT_NOSYNC	set PT_NOSYNC - this mapping's ref/mod bits
1417  *			are never cleared.
1418  *
1419  * Installing new valid PTE's and creation of the mapping list
1420  * entry are controlled under the same lock. It's derived from the
1421  * page_t being mapped.
1422  */
1423 static uint_t supported_memload_flags =
1424 	HAT_LOAD | HAT_LOAD_LOCK | HAT_LOAD_ADV | HAT_LOAD_NOCONSIST |
1425 	HAT_LOAD_SHARE | HAT_NO_KALLOC | HAT_LOAD_REMAP | HAT_LOAD_TEXT;
1426 
1427 void
1428 hat_memload(
1429 	hat_t		*hat,
1430 	caddr_t		addr,
1431 	page_t		*pp,
1432 	uint_t		attr,
1433 	uint_t		flags)
1434 {
1435 	uintptr_t	va = (uintptr_t)addr;
1436 	level_t		level = 0;
1437 	pfn_t		pfn = page_pptonum(pp);
1438 
1439 	ASSERT(IS_PAGEALIGNED(va));
1440 	ASSERT(hat == kas.a_hat || va < _userlimit);
1441 	ASSERT(hat == kas.a_hat ||
1442 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1443 	ASSERT((flags & supported_memload_flags) == flags);
1444 
1445 	ASSERT(!IN_VA_HOLE(va));
1446 	ASSERT(!PP_ISFREE(pp));
1447 
1448 	/*
1449 	 * kernel address special case for performance.
1450 	 */
1451 	if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) {
1452 		ASSERT(hat == kas.a_hat);
1453 		hat_kmap_load(addr, pp, attr, flags);
1454 		return;
1455 	}
1456 
1457 	/*
1458 	 * This is used for memory with normal caching enabled, so
1459 	 * always set HAT_STORECACHING_OK.
1460 	 */
1461 	attr |= HAT_STORECACHING_OK;
1462 	if (hati_load_common(hat, va, pp, attr, flags, level, pfn) != 0)
1463 		panic("unexpected hati_load_common() failure");
1464 }
1465 
1466 /*
1467  * Load the given array of page structs using large pages when possible
1468  */
1469 void
1470 hat_memload_array(
1471 	hat_t		*hat,
1472 	caddr_t		addr,
1473 	size_t		len,
1474 	page_t		**pages,
1475 	uint_t		attr,
1476 	uint_t		flags)
1477 {
1478 	uintptr_t	va = (uintptr_t)addr;
1479 	uintptr_t	eaddr = va + len;
1480 	level_t		level;
1481 	size_t		pgsize;
1482 	pgcnt_t		pgindx = 0;
1483 	pfn_t		pfn;
1484 	pgcnt_t		i;
1485 
1486 	ASSERT(IS_PAGEALIGNED(va));
1487 	ASSERT(hat == kas.a_hat || va + len <= _userlimit);
1488 	ASSERT(hat == kas.a_hat ||
1489 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1490 	ASSERT((flags & supported_memload_flags) == flags);
1491 
1492 	/*
1493 	 * memload is used for memory with full caching enabled, so
1494 	 * set HAT_STORECACHING_OK.
1495 	 */
1496 	attr |= HAT_STORECACHING_OK;
1497 
1498 	/*
1499 	 * handle all pages using largest possible pagesize
1500 	 */
1501 	while (va < eaddr) {
1502 		/*
1503 		 * decide what level mapping to use (ie. pagesize)
1504 		 */
1505 		pfn = page_pptonum(pages[pgindx]);
1506 		for (level = mmu.max_page_level; ; --level) {
1507 			pgsize = LEVEL_SIZE(level);
1508 			if (level == 0)
1509 				break;
1510 
1511 			if (!IS_P2ALIGNED(va, pgsize) ||
1512 			    (eaddr - va) < pgsize ||
1513 			    !IS_P2ALIGNED(pfn_to_pa(pfn), pgsize))
1514 				continue;
1515 
1516 			/*
1517 			 * To use a large mapping of this size, all the
1518 			 * pages we are passed must be sequential subpages
1519 			 * of the large page.
1520 			 * hat_page_demote() can't change p_szc because
1521 			 * all pages are locked.
1522 			 */
1523 			if (pages[pgindx]->p_szc >= level) {
1524 				for (i = 0; i < mmu_btop(pgsize); ++i) {
1525 					if (pfn + i !=
1526 					    page_pptonum(pages[pgindx + i]))
1527 						break;
1528 					ASSERT(pages[pgindx + i]->p_szc >=
1529 					    level);
1530 					ASSERT(pages[pgindx] + i ==
1531 					    pages[pgindx + i]);
1532 				}
1533 				if (i == mmu_btop(pgsize))
1534 					break;
1535 			}
1536 		}
1537 
1538 		/*
1539 		 * Load this page mapping. If the load fails, try a smaller
1540 		 * pagesize.
1541 		 */
1542 		ASSERT(!IN_VA_HOLE(va));
1543 		while (hati_load_common(hat, va, pages[pgindx], attr,
1544 			    flags, level, pfn) != 0) {
1545 			if (level == 0)
1546 				panic("unexpected hati_load_common() failure");
1547 			--level;
1548 			pgsize = LEVEL_SIZE(level);
1549 		}
1550 
1551 		/*
1552 		 * move to next page
1553 		 */
1554 		va += pgsize;
1555 		pgindx += mmu_btop(pgsize);
1556 	}
1557 }
1558 
1559 /*
1560  * void hat_devload(hat, addr, len, pf, attr, flags)
1561  *	load/lock the given page frame number
1562  *
1563  * Advisory ordering attributes. Apply only to device mappings.
1564  *
1565  * HAT_STRICTORDER: the CPU must issue the references in order, as the
1566  *	programmer specified.  This is the default.
1567  * HAT_UNORDERED_OK: the CPU may reorder the references (this is all kinds
1568  *	of reordering; store or load with store or load).
1569  * HAT_MERGING_OK: merging and batching: the CPU may merge individual stores
1570  *	to consecutive locations (for example, turn two consecutive byte
1571  *	stores into one halfword store), and it may batch individual loads
1572  *	(for example, turn two consecutive byte loads into one halfword load).
1573  *	This also implies re-ordering.
1574  * HAT_LOADCACHING_OK: the CPU may cache the data it fetches and reuse it
1575  *	until another store occurs.  The default is to fetch new data
1576  *	on every load.  This also implies merging.
1577  * HAT_STORECACHING_OK: the CPU may keep the data in the cache and push it to
1578  *	the device (perhaps with other data) at a later time.  The default is
1579  *	to push the data right away.  This also implies load caching.
1580  *
1581  * Equivalent of hat_memload(), but can be used for device memory where
1582  * there are no page_t's and we support additional flags (write merging, etc).
1583  * Note that we can have large page mappings with this interface.
1584  */
1585 int supported_devload_flags = HAT_LOAD | HAT_LOAD_LOCK |
1586 	HAT_LOAD_NOCONSIST | HAT_STRICTORDER | HAT_UNORDERED_OK |
1587 	HAT_MERGING_OK | HAT_LOADCACHING_OK | HAT_STORECACHING_OK;
1588 
1589 void
1590 hat_devload(
1591 	hat_t		*hat,
1592 	caddr_t		addr,
1593 	size_t		len,
1594 	pfn_t		pfn,
1595 	uint_t		attr,
1596 	int		flags)
1597 {
1598 	uintptr_t	va = ALIGN2PAGE(addr);
1599 	uintptr_t	eva = va + len;
1600 	level_t		level;
1601 	size_t		pgsize;
1602 	page_t		*pp;
1603 	int		f;	/* per PTE copy of flags  - maybe modified */
1604 	uint_t		a;	/* per PTE copy of attr */
1605 
1606 	ASSERT(IS_PAGEALIGNED(va));
1607 	ASSERT(hat == kas.a_hat || eva <= _userlimit);
1608 	ASSERT(hat == kas.a_hat ||
1609 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1610 	ASSERT((flags & supported_devload_flags) == flags);
1611 
1612 	/*
1613 	 * handle all pages
1614 	 */
1615 	while (va < eva) {
1616 
1617 		/*
1618 		 * decide what level mapping to use (ie. pagesize)
1619 		 */
1620 		for (level = mmu.max_page_level; ; --level) {
1621 			pgsize = LEVEL_SIZE(level);
1622 			if (level == 0)
1623 				break;
1624 			if (IS_P2ALIGNED(va, pgsize) &&
1625 			    (eva - va) >= pgsize &&
1626 			    IS_P2ALIGNED(pfn, mmu_btop(pgsize)))
1627 				break;
1628 		}
1629 
1630 		/*
1631 		 * If this is just memory then allow caching (this happens
1632 		 * for the nucleus pages) - though HAT_PLAT_NOCACHE can be used
1633 		 * to override that. If we don't have a page_t then make sure
1634 		 * NOCONSIST is set.
1635 		 */
1636 		a = attr;
1637 		f = flags;
1638 		if (pf_is_memory(pfn)) {
1639 			if (!(a & HAT_PLAT_NOCACHE))
1640 				a |= HAT_STORECACHING_OK;
1641 
1642 			if (f & HAT_LOAD_NOCONSIST)
1643 				pp = NULL;
1644 			else
1645 				pp = page_numtopp_nolock(pfn);
1646 		} else {
1647 			pp = NULL;
1648 			f |= HAT_LOAD_NOCONSIST;
1649 		}
1650 
1651 		/*
1652 		 * load this page mapping
1653 		 */
1654 		ASSERT(!IN_VA_HOLE(va));
1655 		while (hati_load_common(hat, va, pp, a, f, level, pfn) != 0) {
1656 			if (level == 0)
1657 				panic("unexpected hati_load_common() failure");
1658 			--level;
1659 			pgsize = LEVEL_SIZE(level);
1660 		}
1661 
1662 		/*
1663 		 * move to next page
1664 		 */
1665 		va += pgsize;
1666 		pfn += mmu_btop(pgsize);
1667 	}
1668 }
1669 
1670 /*
1671  * void hat_unlock(hat, addr, len)
1672  *	unlock the mappings to a given range of addresses
1673  *
1674  * Locks are tracked by ht_lock_cnt in the htable.
1675  */
1676 void
1677 hat_unlock(hat_t *hat, caddr_t addr, size_t len)
1678 {
1679 	uintptr_t	vaddr = (uintptr_t)addr;
1680 	uintptr_t	eaddr = vaddr + len;
1681 	htable_t	*ht = NULL;
1682 
1683 	/*
1684 	 * kernel entries are always locked, we don't track lock counts
1685 	 */
1686 	ASSERT(hat == kas.a_hat || eaddr <= _userlimit);
1687 	ASSERT(IS_PAGEALIGNED(vaddr));
1688 	ASSERT(IS_PAGEALIGNED(eaddr));
1689 	if (hat == kas.a_hat)
1690 		return;
1691 	if (eaddr > _userlimit)
1692 		panic("hat_unlock() address out of range - above _userlimit");
1693 
1694 	ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
1695 	while (vaddr < eaddr) {
1696 		(void) htable_walk(hat, &ht, &vaddr, eaddr);
1697 		if (ht == NULL)
1698 			break;
1699 
1700 		ASSERT(!IN_VA_HOLE(vaddr));
1701 
1702 		if (ht->ht_lock_cnt < 1)
1703 			panic("hat_unlock(): lock_cnt < 1, "
1704 			    "htable=%p, vaddr=%p\n", ht, (caddr_t)vaddr);
1705 		HTABLE_LOCK_DEC(ht);
1706 
1707 		vaddr += LEVEL_SIZE(ht->ht_level);
1708 	}
1709 	if (ht)
1710 		htable_release(ht);
1711 }
1712 
1713 /*
1714  * Cross call service routine to demap a virtual page on
1715  * the current CPU or flush all mappings in TLB.
1716  */
1717 /*ARGSUSED*/
1718 static int
1719 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3)
1720 {
1721 	hat_t	*hat = (hat_t *)a1;
1722 	caddr_t	addr = (caddr_t)a2;
1723 
1724 	/*
1725 	 * If the target hat isn't the kernel and this CPU isn't operating
1726 	 * in the target hat, we can ignore the cross call.
1727 	 */
1728 	if (hat != kas.a_hat && hat != CPU->cpu_current_hat)
1729 		return (0);
1730 
1731 	/*
1732 	 * For a normal address, we just flush one page mapping
1733 	 */
1734 	if ((uintptr_t)addr != DEMAP_ALL_ADDR) {
1735 		mmu_tlbflush_entry(addr);
1736 		return (0);
1737 	}
1738 
1739 	/*
1740 	 * Otherwise we reload cr3 to effect a complete TLB flush.
1741 	 *
1742 	 * A reload of cr3 on a VLP process also means we must also recopy in
1743 	 * the pte values from the struct hat
1744 	 */
1745 	if (hat->hat_flags & HAT_VLP) {
1746 #if defined(__amd64)
1747 		x86pte_t *vlpptep = CPU->cpu_hat_info->hci_vlp_l2ptes;
1748 
1749 		VLP_COPY(hat->hat_vlp_ptes, vlpptep);
1750 #elif defined(__i386)
1751 		reload_pae32(hat, CPU);
1752 #endif
1753 	}
1754 	reload_cr3();
1755 	return (0);
1756 }
1757 
1758 /*
1759  * Flush all TLB entries, including global (ie. kernel) ones.
1760  */
1761 static void
1762 flush_all_tlb_entries(void)
1763 {
1764 	ulong_t cr4 = getcr4();
1765 
1766 	if (cr4 & CR4_PGE) {
1767 		setcr4(cr4 & ~(ulong_t)CR4_PGE);
1768 		setcr4(cr4);
1769 
1770 		/*
1771 		 * 32 bit PAE also needs to always reload_cr3()
1772 		 */
1773 		if (mmu.max_level == 2)
1774 			reload_cr3();
1775 	} else {
1776 		reload_cr3();
1777 	}
1778 }
1779 
1780 #define	TLB_CPU_HALTED	(01ul)
1781 #define	TLB_INVAL_ALL	(02ul)
1782 #define	CAS_TLB_INFO(cpu, old, new)	\
1783 	caslong((ulong_t *)&(cpu)->cpu_m.mcpu_tlb_info, (old), (new))
1784 
1785 /*
1786  * Record that a CPU is going idle
1787  */
1788 void
1789 tlb_going_idle(void)
1790 {
1791 	atomic_or_long((ulong_t *)&CPU->cpu_m.mcpu_tlb_info, TLB_CPU_HALTED);
1792 }
1793 
1794 /*
1795  * Service a delayed TLB flush if coming out of being idle.
1796  */
1797 void
1798 tlb_service(void)
1799 {
1800 	ulong_t flags = getflags();
1801 	ulong_t tlb_info;
1802 	ulong_t found;
1803 
1804 	/*
1805 	 * Be sure interrupts are off while doing this so that
1806 	 * higher level interrupts correctly wait for flushes to finish.
1807 	 */
1808 	if (flags & PS_IE)
1809 		flags = intr_clear();
1810 
1811 	/*
1812 	 * We only have to do something if coming out of being idle.
1813 	 */
1814 	tlb_info = CPU->cpu_m.mcpu_tlb_info;
1815 	if (tlb_info & TLB_CPU_HALTED) {
1816 		ASSERT(CPU->cpu_current_hat == kas.a_hat);
1817 
1818 		/*
1819 		 * Atomic clear and fetch of old state.
1820 		 */
1821 		while ((found = CAS_TLB_INFO(CPU, tlb_info, 0)) != tlb_info) {
1822 			ASSERT(found & TLB_CPU_HALTED);
1823 			tlb_info = found;
1824 			SMT_PAUSE();
1825 		}
1826 		if (tlb_info & TLB_INVAL_ALL)
1827 			flush_all_tlb_entries();
1828 	}
1829 
1830 	/*
1831 	 * Restore interrupt enable control bit.
1832 	 */
1833 	if (flags & PS_IE)
1834 		sti();
1835 }
1836 
1837 /*
1838  * Internal routine to do cross calls to invalidate a range of pages on
1839  * all CPUs using a given hat.
1840  */
1841 void
1842 hat_tlb_inval(hat_t *hat, uintptr_t va)
1843 {
1844 	extern int	flushes_require_xcalls;	/* from mp_startup.c */
1845 	cpuset_t	justme;
1846 	cpuset_t	check_cpus;
1847 	cpuset_t	cpus_to_shootdown;
1848 	cpu_t		*cpup;
1849 	int		c;
1850 
1851 	/*
1852 	 * If the hat is being destroyed, there are no more users, so
1853 	 * demap need not do anything.
1854 	 */
1855 	if (hat->hat_flags & HAT_FREEING)
1856 		return;
1857 
1858 	/*
1859 	 * If demapping from a shared pagetable, we best demap the
1860 	 * entire set of user TLBs, since we don't know what addresses
1861 	 * these were shared at.
1862 	 */
1863 	if (hat->hat_flags & HAT_SHARED) {
1864 		hat = kas.a_hat;
1865 		va = DEMAP_ALL_ADDR;
1866 	}
1867 
1868 	/*
1869 	 * if not running with multiple CPUs, don't use cross calls
1870 	 */
1871 	if (panicstr || !flushes_require_xcalls) {
1872 		(void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL);
1873 		return;
1874 	}
1875 
1876 
1877 	/*
1878 	 * Determine CPUs to shootdown. Kernel changes always do all CPUs.
1879 	 * Otherwise it's just CPUs currently executing in this hat.
1880 	 */
1881 	kpreempt_disable();
1882 	CPUSET_ONLY(justme, CPU->cpu_id);
1883 	if (hat == kas.a_hat)
1884 		cpus_to_shootdown = khat_cpuset;
1885 	else
1886 		cpus_to_shootdown = hat->hat_cpus;
1887 
1888 	/*
1889 	 * If any CPUs in the set are idle, just request a delayed flush
1890 	 * and avoid waking them up.
1891 	 */
1892 	check_cpus = cpus_to_shootdown;
1893 	for (c = 0; c < NCPU && !CPUSET_ISNULL(check_cpus); ++c) {
1894 		ulong_t tlb_info;
1895 
1896 		if (!CPU_IN_SET(check_cpus, c))
1897 			continue;
1898 		CPUSET_DEL(check_cpus, c);
1899 		cpup = cpu[c];
1900 		if (cpup == NULL)
1901 			continue;
1902 
1903 		tlb_info = cpup->cpu_m.mcpu_tlb_info;
1904 		while (tlb_info == TLB_CPU_HALTED) {
1905 			(void) CAS_TLB_INFO(cpup, TLB_CPU_HALTED,
1906 				TLB_CPU_HALTED | TLB_INVAL_ALL);
1907 			SMT_PAUSE();
1908 			tlb_info = cpup->cpu_m.mcpu_tlb_info;
1909 		}
1910 		if (tlb_info == (TLB_CPU_HALTED | TLB_INVAL_ALL)) {
1911 			HATSTAT_INC(hs_tlb_inval_delayed);
1912 			CPUSET_DEL(cpus_to_shootdown, c);
1913 		}
1914 	}
1915 
1916 	if (CPUSET_ISNULL(cpus_to_shootdown) ||
1917 	    CPUSET_ISEQUAL(cpus_to_shootdown, justme)) {
1918 
1919 		(void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL);
1920 
1921 	} else {
1922 
1923 		CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id);
1924 		xc_call((xc_arg_t)hat, (xc_arg_t)va, NULL, X_CALL_HIPRI,
1925 		    cpus_to_shootdown, hati_demap_func);
1926 
1927 	}
1928 	kpreempt_enable();
1929 }
1930 
1931 /*
1932  * Interior routine for HAT_UNLOADs from hat_unload_callback(),
1933  * hat_kmap_unload() OR from hat_steal() code.  This routine doesn't
1934  * handle releasing of the htables.
1935  */
1936 void
1937 hat_pte_unmap(
1938 	htable_t	*ht,
1939 	uint_t		entry,
1940 	uint_t		flags,
1941 	x86pte_t	old_pte,
1942 	void		*pte_ptr)
1943 {
1944 	hat_t		*hat = ht->ht_hat;
1945 	hment_t		*hm = NULL;
1946 	page_t		*pp = NULL;
1947 	level_t		l = ht->ht_level;
1948 	pfn_t		pfn;
1949 
1950 	/*
1951 	 * We always track the locking counts, even if nothing is unmapped
1952 	 */
1953 	if ((flags & HAT_UNLOAD_UNLOCK) != 0 && hat != kas.a_hat) {
1954 		ASSERT(ht->ht_lock_cnt > 0);
1955 		HTABLE_LOCK_DEC(ht);
1956 	}
1957 
1958 	/*
1959 	 * Figure out which page's mapping list lock to acquire using the PFN
1960 	 * passed in "old" PTE. We then attempt to invalidate the PTE.
1961 	 * If another thread, probably a hat_pageunload, has asynchronously
1962 	 * unmapped/remapped this address we'll loop here.
1963 	 */
1964 	ASSERT(ht->ht_busy > 0);
1965 	while (PTE_ISVALID(old_pte)) {
1966 		pfn = PTE2PFN(old_pte, l);
1967 		if (PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST) {
1968 			pp = NULL;
1969 		} else {
1970 			pp = page_numtopp_nolock(pfn);
1971 			if (pp == NULL) {
1972 				panic("no page_t, not NOCONSIST: old_pte="
1973 				    FMT_PTE " ht=%lx entry=0x%x pte_ptr=%lx",
1974 				    old_pte, (uintptr_t)ht, entry,
1975 				    (uintptr_t)pte_ptr);
1976 			}
1977 			x86_hm_enter(pp);
1978 		}
1979 
1980 		/*
1981 		 * If freeing the address space, check that the PTE
1982 		 * hasn't changed, as the mappings are no longer in use by
1983 		 * any thread, invalidation is unnecessary.
1984 		 * If not freeing, do a full invalidate.
1985 		 */
1986 		if (hat->hat_flags & HAT_FREEING)
1987 			old_pte = x86pte_get(ht, entry);
1988 		else
1989 			old_pte = x86pte_inval(ht, entry, old_pte, pte_ptr);
1990 
1991 		/*
1992 		 * If the page hadn't changed we've unmapped it and can proceed
1993 		 */
1994 		if (PTE_ISVALID(old_pte) && PTE2PFN(old_pte, l) == pfn)
1995 			break;
1996 
1997 		/*
1998 		 * Otherwise, we'll have to retry with the current old_pte.
1999 		 * Drop the hment lock, since the pfn may have changed.
2000 		 */
2001 		if (pp != NULL) {
2002 			x86_hm_exit(pp);
2003 			pp = NULL;
2004 		} else {
2005 			ASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST);
2006 		}
2007 	}
2008 
2009 	/*
2010 	 * If the old mapping wasn't valid, there's nothing more to do
2011 	 */
2012 	if (!PTE_ISVALID(old_pte)) {
2013 		if (pp != NULL)
2014 			x86_hm_exit(pp);
2015 		return;
2016 	}
2017 
2018 	/*
2019 	 * Take care of syncing any MOD/REF bits and removing the hment.
2020 	 */
2021 	if (pp != NULL) {
2022 		if (!(flags & HAT_UNLOAD_NOSYNC))
2023 			hati_sync_pte_to_page(pp, old_pte, l);
2024 		hm = hment_remove(pp, ht, entry);
2025 		x86_hm_exit(pp);
2026 		if (hm != NULL)
2027 			hment_free(hm);
2028 	}
2029 
2030 	/*
2031 	 * Handle book keeping in the htable and hat
2032 	 */
2033 	ASSERT(ht->ht_valid_cnt > 0);
2034 	HTABLE_DEC(ht->ht_valid_cnt);
2035 	PGCNT_DEC(hat, l);
2036 }
2037 
2038 /*
2039  * very cheap unload implementation to special case some kernel addresses
2040  */
2041 static void
2042 hat_kmap_unload(caddr_t addr, size_t len, uint_t flags)
2043 {
2044 	uintptr_t	va = (uintptr_t)addr;
2045 	uintptr_t	eva = va + len;
2046 	pgcnt_t		pg_index;
2047 	htable_t	*ht;
2048 	uint_t		entry;
2049 	x86pte_t	*pte_ptr;
2050 	x86pte_t	old_pte;
2051 
2052 	for (; va < eva; va += MMU_PAGESIZE) {
2053 		/*
2054 		 * Get the PTE
2055 		 */
2056 		pg_index = mmu_btop(va - mmu.kmap_addr);
2057 		pte_ptr = PT_INDEX_PTR(mmu.kmap_ptes, pg_index);
2058 		old_pte = GET_PTE(pte_ptr);
2059 
2060 		/*
2061 		 * get the htable / entry
2062 		 */
2063 		ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr)
2064 		    >> LEVEL_SHIFT(1)];
2065 		entry = htable_va2entry(va, ht);
2066 
2067 		/*
2068 		 * use mostly common code to unmap it.
2069 		 */
2070 		hat_pte_unmap(ht, entry, flags, old_pte, pte_ptr);
2071 	}
2072 }
2073 
2074 
2075 /*
2076  * unload a range of virtual address space (no callback)
2077  */
2078 void
2079 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2080 {
2081 	uintptr_t va = (uintptr_t)addr;
2082 
2083 	ASSERT(hat == kas.a_hat || va + len <= _userlimit);
2084 
2085 	/*
2086 	 * special case for performance.
2087 	 */
2088 	if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) {
2089 		ASSERT(hat == kas.a_hat);
2090 		hat_kmap_unload(addr, len, flags);
2091 	} else {
2092 		hat_unload_callback(hat, addr, len, flags, NULL);
2093 	}
2094 }
2095 
2096 /*
2097  * Do the callbacks for ranges being unloaded.
2098  */
2099 typedef struct range_info {
2100 	uintptr_t	rng_va;
2101 	ulong_t		rng_cnt;
2102 	level_t		rng_level;
2103 } range_info_t;
2104 
2105 static void
2106 handle_ranges(hat_callback_t *cb, uint_t cnt, range_info_t *range)
2107 {
2108 	/*
2109 	 * do callbacks to upper level VM system
2110 	 */
2111 	while (cb != NULL && cnt > 0) {
2112 		--cnt;
2113 		cb->hcb_start_addr = (caddr_t)range[cnt].rng_va;
2114 		cb->hcb_end_addr = cb->hcb_start_addr;
2115 		cb->hcb_end_addr +=
2116 		    range[cnt].rng_cnt << LEVEL_SIZE(range[cnt].rng_level);
2117 		cb->hcb_function(cb);
2118 	}
2119 }
2120 
2121 /*
2122  * Unload a given range of addresses (has optional callback)
2123  *
2124  * Flags:
2125  * define	HAT_UNLOAD		0x00
2126  * define	HAT_UNLOAD_NOSYNC	0x02
2127  * define	HAT_UNLOAD_UNLOCK	0x04
2128  * define	HAT_UNLOAD_OTHER	0x08 - not used
2129  * define	HAT_UNLOAD_UNMAP	0x10 - same as HAT_UNLOAD
2130  */
2131 #define	MAX_UNLOAD_CNT (8)
2132 void
2133 hat_unload_callback(
2134 	hat_t		*hat,
2135 	caddr_t		addr,
2136 	size_t		len,
2137 	uint_t		flags,
2138 	hat_callback_t	*cb)
2139 {
2140 	uintptr_t	vaddr = (uintptr_t)addr;
2141 	uintptr_t	eaddr = vaddr + len;
2142 	htable_t	*ht = NULL;
2143 	uint_t		entry;
2144 	uintptr_t	contig_va = (uintptr_t)-1L;
2145 	range_info_t	r[MAX_UNLOAD_CNT];
2146 	uint_t		r_cnt = 0;
2147 	x86pte_t	old_pte;
2148 
2149 	ASSERT(hat == kas.a_hat || eaddr <= _userlimit);
2150 	ASSERT(IS_PAGEALIGNED(vaddr));
2151 	ASSERT(IS_PAGEALIGNED(eaddr));
2152 
2153 	/*
2154 	 * Special case a single page being unloaded for speed. This happens
2155 	 * quite frequently, COW faults after a fork() for example.
2156 	 */
2157 	if (cb == NULL && len == MMU_PAGESIZE) {
2158 		ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0);
2159 		if (ht != NULL) {
2160 			if (PTE_ISVALID(old_pte))
2161 				hat_pte_unmap(ht, entry, flags, old_pte, NULL);
2162 			htable_release(ht);
2163 		}
2164 		return;
2165 	}
2166 
2167 	while (vaddr < eaddr) {
2168 		old_pte = htable_walk(hat, &ht, &vaddr, eaddr);
2169 		if (ht == NULL)
2170 			break;
2171 
2172 		ASSERT(!IN_VA_HOLE(vaddr));
2173 
2174 		if (vaddr < (uintptr_t)addr)
2175 			panic("hat_unload_callback(): unmap inside large page");
2176 
2177 		/*
2178 		 * We'll do the call backs for contiguous ranges
2179 		 */
2180 		if (vaddr != contig_va ||
2181 		    (r_cnt > 0 && r[r_cnt - 1].rng_level != ht->ht_level)) {
2182 			if (r_cnt == MAX_UNLOAD_CNT) {
2183 				handle_ranges(cb, r_cnt, r);
2184 				r_cnt = 0;
2185 			}
2186 			r[r_cnt].rng_va = vaddr;
2187 			r[r_cnt].rng_cnt = 0;
2188 			r[r_cnt].rng_level = ht->ht_level;
2189 			++r_cnt;
2190 		}
2191 
2192 		/*
2193 		 * Unload one mapping from the page tables.
2194 		 */
2195 		entry = htable_va2entry(vaddr, ht);
2196 		hat_pte_unmap(ht, entry, flags, old_pte, NULL);
2197 		ASSERT(ht->ht_level <= mmu.max_page_level);
2198 		vaddr += LEVEL_SIZE(ht->ht_level);
2199 		contig_va = vaddr;
2200 		++r[r_cnt - 1].rng_cnt;
2201 	}
2202 	if (ht)
2203 		htable_release(ht);
2204 
2205 	/*
2206 	 * handle last range for callbacks
2207 	 */
2208 	if (r_cnt > 0)
2209 		handle_ranges(cb, r_cnt, r);
2210 }
2211 
2212 /*
2213  * synchronize mapping with software data structures
2214  *
2215  * This interface is currently only used by the working set monitor
2216  * driver.
2217  */
2218 /*ARGSUSED*/
2219 void
2220 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2221 {
2222 	uintptr_t	vaddr = (uintptr_t)addr;
2223 	uintptr_t	eaddr = vaddr + len;
2224 	htable_t	*ht = NULL;
2225 	uint_t		entry;
2226 	x86pte_t	pte;
2227 	x86pte_t	save_pte;
2228 	x86pte_t	new;
2229 	page_t		*pp;
2230 
2231 	ASSERT(!IN_VA_HOLE(vaddr));
2232 	ASSERT(IS_PAGEALIGNED(vaddr));
2233 	ASSERT(IS_PAGEALIGNED(eaddr));
2234 	ASSERT(hat == kas.a_hat || eaddr <= _userlimit);
2235 
2236 	for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) {
2237 try_again:
2238 		pte = htable_walk(hat, &ht, &vaddr, eaddr);
2239 		if (ht == NULL)
2240 			break;
2241 		entry = htable_va2entry(vaddr, ht);
2242 
2243 		if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC ||
2244 		    PTE_GET(pte, PT_REF | PT_MOD) == 0)
2245 			continue;
2246 
2247 		/*
2248 		 * We need to acquire the mapping list lock to protect
2249 		 * against hat_pageunload(), hat_unload(), etc.
2250 		 */
2251 		pp = page_numtopp_nolock(PTE2PFN(pte, ht->ht_level));
2252 		if (pp == NULL)
2253 			break;
2254 		x86_hm_enter(pp);
2255 		save_pte = pte;
2256 		pte = x86pte_get(ht, entry);
2257 		if (pte != save_pte) {
2258 			x86_hm_exit(pp);
2259 			goto try_again;
2260 		}
2261 		if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC ||
2262 		    PTE_GET(pte, PT_REF | PT_MOD) == 0) {
2263 			x86_hm_exit(pp);
2264 			continue;
2265 		}
2266 
2267 		/*
2268 		 * Need to clear ref or mod bits. We may compete with
2269 		 * hardware updating the R/M bits and have to try again.
2270 		 */
2271 		if (flags == HAT_SYNC_ZERORM) {
2272 			new = pte;
2273 			PTE_CLR(new, PT_REF | PT_MOD);
2274 			pte = hati_update_pte(ht, entry, pte, new);
2275 			if (pte != 0) {
2276 				x86_hm_exit(pp);
2277 				goto try_again;
2278 			}
2279 		} else {
2280 			/*
2281 			 * sync the PTE to the page_t
2282 			 */
2283 			hati_sync_pte_to_page(pp, save_pte, ht->ht_level);
2284 		}
2285 		x86_hm_exit(pp);
2286 	}
2287 	if (ht)
2288 		htable_release(ht);
2289 }
2290 
2291 /*
2292  * void	hat_map(hat, addr, len, flags)
2293  */
2294 /*ARGSUSED*/
2295 void
2296 hat_map(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2297 {
2298 	/* does nothing */
2299 }
2300 
2301 /*
2302  * uint_t hat_getattr(hat, addr, *attr)
2303  *	returns attr for <hat,addr> in *attr.  returns 0 if there was a
2304  *	mapping and *attr is valid, nonzero if there was no mapping and
2305  *	*attr is not valid.
2306  */
2307 uint_t
2308 hat_getattr(hat_t *hat, caddr_t addr, uint_t *attr)
2309 {
2310 	uintptr_t	vaddr = ALIGN2PAGE(addr);
2311 	htable_t	*ht = NULL;
2312 	x86pte_t	pte;
2313 
2314 	ASSERT(hat == kas.a_hat || vaddr <= _userlimit);
2315 
2316 	if (IN_VA_HOLE(vaddr))
2317 		return ((uint_t)-1);
2318 
2319 	ht = htable_getpte(hat, vaddr, NULL, &pte, mmu.max_page_level);
2320 	if (ht == NULL)
2321 		return ((uint_t)-1);
2322 
2323 	if (!PTE_ISVALID(pte) || !PTE_ISPAGE(pte, ht->ht_level)) {
2324 		htable_release(ht);
2325 		return ((uint_t)-1);
2326 	}
2327 
2328 	*attr = PROT_READ;
2329 	if (PTE_GET(pte, PT_WRITABLE))
2330 		*attr |= PROT_WRITE;
2331 	if (PTE_GET(pte, PT_USER))
2332 		*attr |= PROT_USER;
2333 	if (!PTE_GET(pte, mmu.pt_nx))
2334 		*attr |= PROT_EXEC;
2335 	if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC)
2336 		*attr |= HAT_NOSYNC;
2337 	htable_release(ht);
2338 	return (0);
2339 }
2340 
2341 /*
2342  * hat_updateattr() applies the given attribute change to an existing mapping
2343  */
2344 #define	HAT_LOAD_ATTR		1
2345 #define	HAT_SET_ATTR		2
2346 #define	HAT_CLR_ATTR		3
2347 
2348 static void
2349 hat_updateattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr, int what)
2350 {
2351 	uintptr_t	vaddr = (uintptr_t)addr;
2352 	uintptr_t	eaddr = (uintptr_t)addr + len;
2353 	htable_t	*ht = NULL;
2354 	uint_t		entry;
2355 	x86pte_t	oldpte, newpte;
2356 	page_t		*pp;
2357 
2358 	ASSERT(IS_PAGEALIGNED(vaddr));
2359 	ASSERT(IS_PAGEALIGNED(eaddr));
2360 	ASSERT(hat == kas.a_hat ||
2361 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
2362 	for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) {
2363 try_again:
2364 		oldpte = htable_walk(hat, &ht, &vaddr, eaddr);
2365 		if (ht == NULL)
2366 			break;
2367 		if (PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOCONSIST)
2368 			continue;
2369 
2370 		pp = page_numtopp_nolock(PTE2PFN(oldpte, ht->ht_level));
2371 		if (pp == NULL)
2372 			continue;
2373 		x86_hm_enter(pp);
2374 
2375 		newpte = oldpte;
2376 		/*
2377 		 * We found a page table entry in the desired range,
2378 		 * figure out the new attributes.
2379 		 */
2380 		if (what == HAT_SET_ATTR || what == HAT_LOAD_ATTR) {
2381 			if ((attr & PROT_WRITE) &&
2382 			    !PTE_GET(oldpte, PT_WRITABLE))
2383 				newpte |= PT_WRITABLE;
2384 
2385 			if ((attr & HAT_NOSYNC) &&
2386 			    PTE_GET(oldpte, PT_SOFTWARE) < PT_NOSYNC)
2387 				newpte |= PT_NOSYNC;
2388 
2389 			if ((attr & PROT_EXEC) && PTE_GET(oldpte, mmu.pt_nx))
2390 				newpte &= ~mmu.pt_nx;
2391 		}
2392 
2393 		if (what == HAT_LOAD_ATTR) {
2394 			if (!(attr & PROT_WRITE) &&
2395 			    PTE_GET(oldpte, PT_WRITABLE))
2396 				newpte &= ~PT_WRITABLE;
2397 
2398 			if (!(attr & HAT_NOSYNC) &&
2399 			    PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC)
2400 				newpte &= ~PT_SOFTWARE;
2401 
2402 			if (!(attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx))
2403 				newpte |= mmu.pt_nx;
2404 		}
2405 
2406 		if (what == HAT_CLR_ATTR) {
2407 			if ((attr & PROT_WRITE) && PTE_GET(oldpte, PT_WRITABLE))
2408 				newpte &= ~PT_WRITABLE;
2409 
2410 			if ((attr & HAT_NOSYNC) &&
2411 			    PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC)
2412 				newpte &= ~PT_SOFTWARE;
2413 
2414 			if ((attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx))
2415 				newpte |= mmu.pt_nx;
2416 		}
2417 
2418 		/*
2419 		 * Ensure NOSYNC/NOCONSIST mappings have REF and MOD set.
2420 		 * x86pte_set() depends on this.
2421 		 */
2422 		if (PTE_GET(newpte, PT_SOFTWARE) >= PT_NOSYNC)
2423 			newpte |= PT_REF | PT_MOD;
2424 
2425 		/*
2426 		 * what about PROT_READ or others? this code only handles:
2427 		 * EXEC, WRITE, NOSYNC
2428 		 */
2429 
2430 		/*
2431 		 * If new PTE really changed, update the table.
2432 		 */
2433 		if (newpte != oldpte) {
2434 			entry = htable_va2entry(vaddr, ht);
2435 			oldpte = hati_update_pte(ht, entry, oldpte, newpte);
2436 			if (oldpte != 0) {
2437 				x86_hm_exit(pp);
2438 				goto try_again;
2439 			}
2440 		}
2441 		x86_hm_exit(pp);
2442 	}
2443 	if (ht)
2444 		htable_release(ht);
2445 }
2446 
2447 /*
2448  * Various wrappers for hat_updateattr()
2449  */
2450 void
2451 hat_setattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr)
2452 {
2453 	ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit);
2454 	hat_updateattr(hat, addr, len, attr, HAT_SET_ATTR);
2455 }
2456 
2457 void
2458 hat_clrattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr)
2459 {
2460 	ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit);
2461 	hat_updateattr(hat, addr, len, attr, HAT_CLR_ATTR);
2462 }
2463 
2464 void
2465 hat_chgattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr)
2466 {
2467 	ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit);
2468 	hat_updateattr(hat, addr, len, attr, HAT_LOAD_ATTR);
2469 }
2470 
2471 void
2472 hat_chgprot(hat_t *hat, caddr_t addr, size_t len, uint_t vprot)
2473 {
2474 	ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit);
2475 	hat_updateattr(hat, addr, len, vprot & HAT_PROT_MASK, HAT_LOAD_ATTR);
2476 }
2477 
2478 /*
2479  * size_t hat_getpagesize(hat, addr)
2480  *	returns pagesize in bytes for <hat, addr>. returns -1 of there is
2481  *	no mapping. This is an advisory call.
2482  */
2483 ssize_t
2484 hat_getpagesize(hat_t *hat, caddr_t addr)
2485 {
2486 	uintptr_t	vaddr = ALIGN2PAGE(addr);
2487 	htable_t	*ht;
2488 	size_t		pagesize;
2489 
2490 	ASSERT(hat == kas.a_hat || vaddr <= _userlimit);
2491 	if (IN_VA_HOLE(vaddr))
2492 		return (-1);
2493 	ht = htable_getpage(hat, vaddr, NULL);
2494 	if (ht == NULL)
2495 		return (-1);
2496 	pagesize = LEVEL_SIZE(ht->ht_level);
2497 	htable_release(ht);
2498 	return (pagesize);
2499 }
2500 
2501 
2502 
2503 /*
2504  * pfn_t hat_getpfnum(hat, addr)
2505  *	returns pfn for <hat, addr> or PFN_INVALID if mapping is invalid.
2506  */
2507 pfn_t
2508 hat_getpfnum(hat_t *hat, caddr_t addr)
2509 {
2510 	uintptr_t	vaddr = ALIGN2PAGE(addr);
2511 	htable_t	*ht;
2512 	uint_t		entry;
2513 	pfn_t		pfn = PFN_INVALID;
2514 
2515 	ASSERT(hat == kas.a_hat || vaddr <= _userlimit);
2516 	if (khat_running == 0)
2517 		return (PFN_INVALID);
2518 
2519 	if (IN_VA_HOLE(vaddr))
2520 		return (PFN_INVALID);
2521 
2522 	/*
2523 	 * A very common use of hat_getpfnum() is from the DDI for kernel pages.
2524 	 * Use the kmap_ptes (which also covers the 32 bit heap) to speed
2525 	 * this up.
2526 	 */
2527 	if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) {
2528 		x86pte_t pte;
2529 		pgcnt_t pg_index;
2530 
2531 		pg_index = mmu_btop(vaddr - mmu.kmap_addr);
2532 		pte = GET_PTE(PT_INDEX_PTR(mmu.kmap_ptes, pg_index));
2533 		if (!PTE_ISVALID(pte))
2534 			return (PFN_INVALID);
2535 		/*LINTED [use of constant 0 causes a silly lint warning] */
2536 		return (PTE2PFN(pte, 0));
2537 	}
2538 
2539 	ht = htable_getpage(hat, vaddr, &entry);
2540 	if (ht == NULL)
2541 		return (PFN_INVALID);
2542 	ASSERT(vaddr >= ht->ht_vaddr);
2543 	ASSERT(vaddr <= HTABLE_LAST_PAGE(ht));
2544 	pfn = PTE2PFN(x86pte_get(ht, entry), ht->ht_level);
2545 	if (ht->ht_level > 0)
2546 		pfn += mmu_btop(vaddr & LEVEL_OFFSET(ht->ht_level));
2547 	htable_release(ht);
2548 	return (pfn);
2549 }
2550 
2551 /*
2552  * hat_getkpfnum() is an obsolete DDI routine, and its use is discouraged.
2553  * Use hat_getpfnum(kas.a_hat, ...) instead.
2554  *
2555  * We'd like to return PFN_INVALID if the mappings have underlying page_t's
2556  * but can't right now due to the fact that some software has grown to use
2557  * this interface incorrectly. So for now when the interface is misused,
2558  * return a warning to the user that in the future it won't work in the
2559  * way they're abusing it, and carry on.
2560  *
2561  * Note that hat_getkpfnum() is never supported on amd64.
2562  */
2563 #if !defined(__amd64)
2564 pfn_t
2565 hat_getkpfnum(caddr_t addr)
2566 {
2567 	pfn_t	pfn;
2568 	int badcaller = 0;
2569 
2570 	if (khat_running == 0)
2571 		panic("hat_getkpfnum(): called too early\n");
2572 	if ((uintptr_t)addr < kernelbase)
2573 		return (PFN_INVALID);
2574 
2575 
2576 	if (segkpm && IS_KPM_ADDR(addr)) {
2577 		badcaller = 1;
2578 		pfn = hat_kpm_va2pfn(addr);
2579 	} else {
2580 		pfn = hat_getpfnum(kas.a_hat, addr);
2581 		badcaller = pf_is_memory(pfn);
2582 	}
2583 
2584 	if (badcaller)
2585 		hat_getkpfnum_badcall(caller());
2586 	return (pfn);
2587 }
2588 #endif /* __amd64 */
2589 
2590 /*
2591  * int hat_probe(hat, addr)
2592  *	return 0 if no valid mapping is present.  Faster version
2593  *	of hat_getattr in certain architectures.
2594  */
2595 int
2596 hat_probe(hat_t *hat, caddr_t addr)
2597 {
2598 	uintptr_t	vaddr = ALIGN2PAGE(addr);
2599 	uint_t		entry;
2600 	htable_t	*ht;
2601 	pgcnt_t		pg_off;
2602 
2603 	ASSERT(hat == kas.a_hat || vaddr <= _userlimit);
2604 	ASSERT(hat == kas.a_hat ||
2605 	    AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock));
2606 	if (IN_VA_HOLE(vaddr))
2607 		return (0);
2608 
2609 	/*
2610 	 * Most common use of hat_probe is from segmap. We special case it
2611 	 * for performance.
2612 	 */
2613 	if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) {
2614 		pg_off = mmu_btop(vaddr - mmu.kmap_addr);
2615 		if (mmu.pae_hat)
2616 			return (PTE_ISVALID(mmu.kmap_ptes[pg_off]));
2617 		else
2618 			return (PTE_ISVALID(
2619 			    ((x86pte32_t *)mmu.kmap_ptes)[pg_off]));
2620 	}
2621 
2622 	ht = htable_getpage(hat, vaddr, &entry);
2623 	if (ht == NULL)
2624 		return (0);
2625 	htable_release(ht);
2626 	return (1);
2627 }
2628 
2629 /*
2630  * Simple implementation of ISM. hat_share() is just like hat_memload_array(),
2631  * except that we use the ism_hat's existing mappings to determine the pages
2632  * and protections to use for this hat. In case we find a properly aligned
2633  * and sized pagetable of 4K mappings, we will attempt to share the pagetable
2634  * itself.
2635  */
2636 /*ARGSUSED*/
2637 int
2638 hat_share(
2639 	hat_t		*hat,
2640 	caddr_t		addr,
2641 	hat_t		*ism_hat,
2642 	caddr_t		src_addr,
2643 	size_t		len,	/* almost useless value, see below.. */
2644 	uint_t		ismszc)
2645 {
2646 	uintptr_t	vaddr_start = (uintptr_t)addr;
2647 	uintptr_t	vaddr;
2648 	uintptr_t	pt_vaddr;
2649 	uintptr_t	eaddr = vaddr_start + len;
2650 	uintptr_t	ism_addr_start = (uintptr_t)src_addr;
2651 	uintptr_t	ism_addr = ism_addr_start;
2652 	uintptr_t	e_ism_addr = ism_addr + len;
2653 	htable_t	*ism_ht = NULL;
2654 	htable_t	*ht;
2655 	x86pte_t	pte;
2656 	page_t		*pp;
2657 	pfn_t		pfn;
2658 	level_t		l;
2659 	pgcnt_t		pgcnt;
2660 	uint_t		prot;
2661 	uint_t		valid_cnt;
2662 
2663 	/*
2664 	 * We might be asked to share an empty DISM hat by as_dup()
2665 	 */
2666 	ASSERT(hat != kas.a_hat);
2667 	ASSERT(eaddr <= _userlimit);
2668 	if (!(ism_hat->hat_flags & HAT_SHARED)) {
2669 		ASSERT(hat_get_mapped_size(ism_hat) == 0);
2670 		return (0);
2671 	}
2672 
2673 	/*
2674 	 * The SPT segment driver often passes us a size larger than there are
2675 	 * valid mappings. That's because it rounds the segment size up to a
2676 	 * large pagesize, even if the actual memory mapped by ism_hat is less.
2677 	 */
2678 	ASSERT(IS_PAGEALIGNED(vaddr_start));
2679 	ASSERT(IS_PAGEALIGNED(ism_addr_start));
2680 	ASSERT(ism_hat->hat_flags & HAT_SHARED);
2681 	while (ism_addr < e_ism_addr) {
2682 		/*
2683 		 * use htable_walk to get the next valid ISM mapping
2684 		 */
2685 		pte = htable_walk(ism_hat, &ism_ht, &ism_addr, e_ism_addr);
2686 		if (ism_ht == NULL)
2687 			break;
2688 
2689 		/*
2690 		 * Find the largest page size we can use, based on the
2691 		 * ISM mapping size, our address alignment and the remaining
2692 		 * map length.
2693 		 */
2694 		vaddr = vaddr_start + (ism_addr - ism_addr_start);
2695 		for (l = ism_ht->ht_level; l > 0; --l) {
2696 			if (LEVEL_SIZE(l) <= eaddr - vaddr &&
2697 			    (vaddr & LEVEL_OFFSET(l)) == 0)
2698 				break;
2699 		}
2700 
2701 		/*
2702 		 * attempt to share the pagetable
2703 		 *
2704 		 * - only 4K pagetables are shared (ie. level == 0)
2705 		 * - the hat_share() length must cover the whole pagetable
2706 		 * - the shared address must align at level 1
2707 		 * - a shared PTE for this address already exists OR
2708 		 * - no page table for this address exists yet
2709 		 */
2710 		pt_vaddr =
2711 		    vaddr_start + (ism_ht->ht_vaddr - ism_addr_start);
2712 		if (ism_ht->ht_level == 0 &&
2713 		    ism_ht->ht_vaddr + LEVEL_SIZE(1) <= e_ism_addr &&
2714 		    (pt_vaddr & LEVEL_OFFSET(1)) == 0) {
2715 
2716 			ht = htable_lookup(hat, pt_vaddr, 0);
2717 			if (ht == NULL)
2718 				ht = htable_create(hat, pt_vaddr, 0, ism_ht);
2719 
2720 			if (ht->ht_level > 0 ||
2721 			    !(ht->ht_flags & HTABLE_SHARED_PFN)) {
2722 
2723 				htable_release(ht);
2724 
2725 			} else {
2726 
2727 				/*
2728 				 * share the page table
2729 				 */
2730 				ASSERT(ht->ht_level == 0);
2731 				ASSERT(ht->ht_shares == ism_ht);
2732 				valid_cnt = ism_ht->ht_valid_cnt;
2733 				atomic_add_long(&hat->hat_pages_mapped[0],
2734 				    valid_cnt - ht->ht_valid_cnt);
2735 				ht->ht_valid_cnt = valid_cnt;
2736 				htable_release(ht);
2737 				ism_addr = ism_ht->ht_vaddr + LEVEL_SIZE(1);
2738 				htable_release(ism_ht);
2739 				ism_ht = NULL;
2740 				continue;
2741 			}
2742 		}
2743 
2744 		/*
2745 		 * Unable to share the page table. Instead we will
2746 		 * create new mappings from the values in the ISM mappings.
2747 		 *
2748 		 * The ISM mapping might be larger than the share area,
2749 		 * be careful to trunctate it if needed.
2750 		 */
2751 		if (eaddr - vaddr >= LEVEL_SIZE(ism_ht->ht_level)) {
2752 			pgcnt = mmu_btop(LEVEL_SIZE(ism_ht->ht_level));
2753 		} else {
2754 			pgcnt = mmu_btop(eaddr - vaddr);
2755 			l = 0;
2756 		}
2757 
2758 		pfn = PTE2PFN(pte, ism_ht->ht_level);
2759 		ASSERT(pfn != PFN_INVALID);
2760 		while (pgcnt > 0) {
2761 			/*
2762 			 * Make a new pte for the PFN for this level.
2763 			 * Copy protections for the pte from the ISM pte.
2764 			 */
2765 			pp = page_numtopp_nolock(pfn);
2766 			ASSERT(pp != NULL);
2767 
2768 			prot = PROT_USER | PROT_READ | HAT_UNORDERED_OK;
2769 			if (PTE_GET(pte, PT_WRITABLE))
2770 				prot |= PROT_WRITE;
2771 			if (!PTE_GET(pte, PT_NX))
2772 				prot |= PROT_EXEC;
2773 
2774 			/*
2775 			 * XX64 -- can shm ever be written to swap?
2776 			 * if not we could use HAT_NOSYNC here.
2777 			 */
2778 			while (hati_load_common(hat, vaddr, pp, prot, HAT_LOAD,
2779 			    l, pfn) != 0) {
2780 				if (l == 0)
2781 					panic("hati_load_common() failure");
2782 				--l;
2783 			}
2784 
2785 			vaddr += LEVEL_SIZE(l);
2786 			ism_addr += LEVEL_SIZE(l);
2787 			pfn += mmu_btop(LEVEL_SIZE(l));
2788 			pgcnt -= mmu_btop(LEVEL_SIZE(l));
2789 		}
2790 	}
2791 	if (ism_ht != NULL)
2792 		htable_release(ism_ht);
2793 	return (0);
2794 }
2795 
2796 
2797 /*
2798  * hat_unshare() is similar to hat_unload_callback(), but
2799  * we have to look for empty shared pagetables. Note that
2800  * hat_unshare() is always invoked against an entire segment.
2801  */
2802 /*ARGSUSED*/
2803 void
2804 hat_unshare(hat_t *hat, caddr_t addr, size_t len, uint_t ismszc)
2805 {
2806 	uintptr_t	vaddr = (uintptr_t)addr;
2807 	uintptr_t	eaddr = vaddr + len;
2808 	htable_t	*ht = NULL;
2809 	uint_t		need_demaps = 0;
2810 
2811 	ASSERT(hat != kas.a_hat);
2812 	ASSERT(eaddr <= _userlimit);
2813 	ASSERT(IS_PAGEALIGNED(vaddr));
2814 	ASSERT(IS_PAGEALIGNED(eaddr));
2815 
2816 	/*
2817 	 * First go through and remove any shared pagetables.
2818 	 *
2819 	 * Note that it's ok to delay the TLB shootdown till the entire range is
2820 	 * finished, because if hat_pageunload() were to unload a shared
2821 	 * pagetable page, its hat_tlb_inval() will do a global TLB invalidate.
2822 	 */
2823 	while (vaddr < eaddr) {
2824 		ASSERT(!IN_VA_HOLE(vaddr));
2825 		/*
2826 		 * find the pagetable that would map the current address
2827 		 */
2828 		ht = htable_lookup(hat, vaddr, 0);
2829 		if (ht != NULL) {
2830 			if (ht->ht_flags & HTABLE_SHARED_PFN) {
2831 				/*
2832 				 * clear mapped pages count, set valid_cnt to 0
2833 				 * and let htable_release() finish the job
2834 				 */
2835 				atomic_add_long(&hat->hat_pages_mapped[0],
2836 				    -ht->ht_valid_cnt);
2837 				ht->ht_valid_cnt = 0;
2838 				need_demaps = 1;
2839 			}
2840 			htable_release(ht);
2841 		}
2842 		vaddr = (vaddr & LEVEL_MASK(1)) + LEVEL_SIZE(1);
2843 	}
2844 
2845 	/*
2846 	 * flush the TLBs - since we're probably dealing with MANY mappings
2847 	 * we do just one CR3 reload.
2848 	 */
2849 	if (!(hat->hat_flags & HAT_FREEING) && need_demaps)
2850 		hat_tlb_inval(hat, DEMAP_ALL_ADDR);
2851 
2852 	/*
2853 	 * Now go back and clean up any unaligned mappings that
2854 	 * couldn't share pagetables.
2855 	 */
2856 	hat_unload(hat, addr, len, HAT_UNLOAD_UNMAP);
2857 }
2858 
2859 
2860 /*
2861  * hat_reserve() does nothing
2862  */
2863 /*ARGSUSED*/
2864 void
2865 hat_reserve(struct as *as, caddr_t addr, size_t len)
2866 {
2867 }
2868 
2869 
2870 /*
2871  * Called when all mappings to a page should have write permission removed.
2872  * Mostly stolem from hat_pagesync()
2873  */
2874 static void
2875 hati_page_clrwrt(struct page *pp)
2876 {
2877 	hment_t		*hm = NULL;
2878 	htable_t	*ht;
2879 	uint_t		entry;
2880 	x86pte_t	old;
2881 	x86pte_t	new;
2882 	uint_t		pszc = 0;
2883 
2884 next_size:
2885 	/*
2886 	 * walk thru the mapping list clearing write permission
2887 	 */
2888 	x86_hm_enter(pp);
2889 	while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) {
2890 		if (ht->ht_level < pszc)
2891 			continue;
2892 		old = x86pte_get(ht, entry);
2893 
2894 		for (;;) {
2895 			/*
2896 			 * Is this mapping of interest?
2897 			 */
2898 			if (PTE2PFN(old, ht->ht_level) != pp->p_pagenum ||
2899 			    PTE_GET(old, PT_WRITABLE) == 0)
2900 				break;
2901 
2902 			/*
2903 			 * Clear ref/mod writable bits. This requires cross
2904 			 * calls to ensure any executing TLBs see cleared bits.
2905 			 */
2906 			new = old;
2907 			PTE_CLR(new, PT_REF | PT_MOD | PT_WRITABLE);
2908 			old = hati_update_pte(ht, entry, old, new);
2909 			if (old != 0)
2910 				continue;
2911 
2912 			break;
2913 		}
2914 	}
2915 	x86_hm_exit(pp);
2916 	while (pszc < pp->p_szc) {
2917 		page_t *tpp;
2918 		pszc++;
2919 		tpp = PP_GROUPLEADER(pp, pszc);
2920 		if (pp != tpp) {
2921 			pp = tpp;
2922 			goto next_size;
2923 		}
2924 	}
2925 }
2926 
2927 /*
2928  * void hat_page_setattr(pp, flag)
2929  * void hat_page_clrattr(pp, flag)
2930  *	used to set/clr ref/mod bits.
2931  */
2932 void
2933 hat_page_setattr(struct page *pp, uint_t flag)
2934 {
2935 	vnode_t		*vp = pp->p_vnode;
2936 	kmutex_t	*vphm = NULL;
2937 	page_t		**listp;
2938 
2939 	if (PP_GETRM(pp, flag) == flag)
2940 		return;
2941 
2942 	if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
2943 		vphm = page_vnode_mutex(vp);
2944 		mutex_enter(vphm);
2945 	}
2946 
2947 	PP_SETRM(pp, flag);
2948 
2949 	if (vphm != NULL) {
2950 
2951 		/*
2952 		 * Some File Systems examine v_pages for NULL w/o
2953 		 * grabbing the vphm mutex. Must not let it become NULL when
2954 		 * pp is the only page on the list.
2955 		 */
2956 		if (pp->p_vpnext != pp) {
2957 			page_vpsub(&vp->v_pages, pp);
2958 			if (vp->v_pages != NULL)
2959 				listp = &vp->v_pages->p_vpprev->p_vpnext;
2960 			else
2961 				listp = &vp->v_pages;
2962 			page_vpadd(listp, pp);
2963 		}
2964 		mutex_exit(vphm);
2965 	}
2966 }
2967 
2968 void
2969 hat_page_clrattr(struct page *pp, uint_t flag)
2970 {
2971 	vnode_t		*vp = pp->p_vnode;
2972 	ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
2973 
2974 	/*
2975 	 * Caller is expected to hold page's io lock for VMODSORT to work
2976 	 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
2977 	 * bit is cleared.
2978 	 * We don't have assert to avoid tripping some existing third party
2979 	 * code. The dirty page is moved back to top of the v_page list
2980 	 * after IO is done in pvn_write_done().
2981 	 */
2982 	PP_CLRRM(pp, flag);
2983 
2984 	if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
2985 
2986 		/*
2987 		 * VMODSORT works by removing write permissions and getting
2988 		 * a fault when a page is made dirty. At this point
2989 		 * we need to remove write permission from all mappings
2990 		 * to this page.
2991 		 */
2992 		hati_page_clrwrt(pp);
2993 	}
2994 }
2995 
2996 /*
2997  *	If flag is specified, returns 0 if attribute is disabled
2998  *	and non zero if enabled.  If flag specifes multiple attributs
2999  *	then returns 0 if ALL atriibutes are disabled.  This is an advisory
3000  *	call.
3001  */
3002 uint_t
3003 hat_page_getattr(struct page *pp, uint_t flag)
3004 {
3005 	return (PP_GETRM(pp, flag));
3006 }
3007 
3008 
3009 /*
3010  * common code used by hat_pageunload() and hment_steal()
3011  */
3012 hment_t *
3013 hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry)
3014 {
3015 	x86pte_t old_pte;
3016 	pfn_t pfn = pp->p_pagenum;
3017 	hment_t *hm;
3018 
3019 	/*
3020 	 * We need to acquire a hold on the htable in order to
3021 	 * do the invalidate. We know the htable must exist, since
3022 	 * unmap's don't release the htable until after removing any
3023 	 * hment. Having x86_hm_enter() keeps that from proceeding.
3024 	 */
3025 	htable_acquire(ht);
3026 
3027 	/*
3028 	 * Invalidate the PTE and remove the hment.
3029 	 */
3030 	old_pte = x86pte_inval(ht, entry, 0, NULL);
3031 	if (PTE2PFN(old_pte, ht->ht_level) != pfn) {
3032 		panic("x86pte_inval() failure found PTE = " FMT_PTE
3033 		    " pfn being unmapped is %lx ht=0x%lx entry=0x%x",
3034 		    old_pte, pfn, (uintptr_t)ht, entry);
3035 	}
3036 
3037 	/*
3038 	 * Clean up all the htable information for this mapping
3039 	 */
3040 	ASSERT(ht->ht_valid_cnt > 0);
3041 	HTABLE_DEC(ht->ht_valid_cnt);
3042 	PGCNT_DEC(ht->ht_hat, ht->ht_level);
3043 
3044 	/*
3045 	 * sync ref/mod bits to the page_t
3046 	 */
3047 	if (PTE_GET(old_pte, PT_SOFTWARE) < PT_NOSYNC)
3048 		hati_sync_pte_to_page(pp, old_pte, ht->ht_level);
3049 
3050 	/*
3051 	 * Remove the mapping list entry for this page.
3052 	 */
3053 	hm = hment_remove(pp, ht, entry);
3054 
3055 	/*
3056 	 * drop the mapping list lock so that we might free the
3057 	 * hment and htable.
3058 	 */
3059 	x86_hm_exit(pp);
3060 	htable_release(ht);
3061 	return (hm);
3062 }
3063 
3064 extern int	vpm_enable;
3065 /*
3066  * Unload all translations to a page. If the page is a subpage of a large
3067  * page, the large page mappings are also removed.
3068  *
3069  * The forceflags are unused.
3070  */
3071 
3072 /*ARGSUSED*/
3073 static int
3074 hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag)
3075 {
3076 	page_t		*cur_pp = pp;
3077 	hment_t		*hm;
3078 	hment_t		*prev;
3079 	htable_t	*ht;
3080 	uint_t		entry;
3081 	level_t		level;
3082 
3083 #if defined(__amd64)
3084 	/*
3085 	 * clear the vpm ref.
3086 	 */
3087 	if (vpm_enable) {
3088 		pp->p_vpmref = 0;
3089 	}
3090 #endif
3091 	/*
3092 	 * The loop with next_size handles pages with multiple pagesize mappings
3093 	 */
3094 next_size:
3095 	for (;;) {
3096 
3097 		/*
3098 		 * Get a mapping list entry
3099 		 */
3100 		x86_hm_enter(cur_pp);
3101 		for (prev = NULL; ; prev = hm) {
3102 			hm = hment_walk(cur_pp, &ht, &entry, prev);
3103 			if (hm == NULL) {
3104 				x86_hm_exit(cur_pp);
3105 
3106 				/*
3107 				 * If not part of a larger page, we're done.
3108 				 */
3109 				if (cur_pp->p_szc <= pg_szcd) {
3110 					return (0);
3111 				}
3112 
3113 				/*
3114 				 * Else check the next larger page size.
3115 				 * hat_page_demote() may decrease p_szc
3116 				 * but that's ok we'll just take an extra
3117 				 * trip discover there're no larger mappings
3118 				 * and return.
3119 				 */
3120 				++pg_szcd;
3121 				cur_pp = PP_GROUPLEADER(cur_pp, pg_szcd);
3122 				goto next_size;
3123 			}
3124 
3125 			/*
3126 			 * If this mapping size matches, remove it.
3127 			 */
3128 			level = ht->ht_level;
3129 			if (level == pg_szcd)
3130 				break;
3131 		}
3132 
3133 		/*
3134 		 * Remove the mapping list entry for this page.
3135 		 * Note this does the x86_hm_exit() for us.
3136 		 */
3137 		hm = hati_page_unmap(cur_pp, ht, entry);
3138 		if (hm != NULL)
3139 			hment_free(hm);
3140 	}
3141 }
3142 
3143 int
3144 hat_pageunload(struct page *pp, uint_t forceflag)
3145 {
3146 	ASSERT(PAGE_EXCL(pp));
3147 	return (hati_pageunload(pp, 0, forceflag));
3148 }
3149 
3150 /*
3151  * Unload all large mappings to pp and reduce by 1 p_szc field of every large
3152  * page level that included pp.
3153  *
3154  * pp must be locked EXCL. Even though no other constituent pages are locked
3155  * it's legal to unload large mappings to pp because all constituent pages of
3156  * large locked mappings have to be locked SHARED.  therefore if we have EXCL
3157  * lock on one of constituent pages none of the large mappings to pp are
3158  * locked.
3159  *
3160  * Change (always decrease) p_szc field starting from the last constituent
3161  * page and ending with root constituent page so that root's pszc always shows
3162  * the area where hat_page_demote() may be active.
3163  *
3164  * This mechanism is only used for file system pages where it's not always
3165  * possible to get EXCL locks on all constituent pages to demote the size code
3166  * (as is done for anonymous or kernel large pages).
3167  */
3168 void
3169 hat_page_demote(page_t *pp)
3170 {
3171 	uint_t		pszc;
3172 	uint_t		rszc;
3173 	uint_t		szc;
3174 	page_t		*rootpp;
3175 	page_t		*firstpp;
3176 	page_t		*lastpp;
3177 	pgcnt_t		pgcnt;
3178 
3179 	ASSERT(PAGE_EXCL(pp));
3180 	ASSERT(!PP_ISFREE(pp));
3181 	ASSERT(page_szc_lock_assert(pp));
3182 
3183 	if (pp->p_szc == 0)
3184 		return;
3185 
3186 	rootpp = PP_GROUPLEADER(pp, 1);
3187 	(void) hati_pageunload(rootpp, 1, HAT_FORCE_PGUNLOAD);
3188 
3189 	/*
3190 	 * all large mappings to pp are gone
3191 	 * and no new can be setup since pp is locked exclusively.
3192 	 *
3193 	 * Lock the root to make sure there's only one hat_page_demote()
3194 	 * outstanding within the area of this root's pszc.
3195 	 *
3196 	 * Second potential hat_page_demote() is already eliminated by upper
3197 	 * VM layer via page_szc_lock() but we don't rely on it and use our
3198 	 * own locking (so that upper layer locking can be changed without
3199 	 * assumptions that hat depends on upper layer VM to prevent multiple
3200 	 * hat_page_demote() to be issued simultaneously to the same large
3201 	 * page).
3202 	 */
3203 again:
3204 	pszc = pp->p_szc;
3205 	if (pszc == 0)
3206 		return;
3207 	rootpp = PP_GROUPLEADER(pp, pszc);
3208 	x86_hm_enter(rootpp);
3209 	/*
3210 	 * If root's p_szc is different from pszc we raced with another
3211 	 * hat_page_demote().  Drop the lock and try to find the root again.
3212 	 * If root's p_szc is greater than pszc previous hat_page_demote() is
3213 	 * not done yet.  Take and release mlist lock of root's root to wait
3214 	 * for previous hat_page_demote() to complete.
3215 	 */
3216 	if ((rszc = rootpp->p_szc) != pszc) {
3217 		x86_hm_exit(rootpp);
3218 		if (rszc > pszc) {
3219 			/* p_szc of a locked non free page can't increase */
3220 			ASSERT(pp != rootpp);
3221 
3222 			rootpp = PP_GROUPLEADER(rootpp, rszc);
3223 			x86_hm_enter(rootpp);
3224 			x86_hm_exit(rootpp);
3225 		}
3226 		goto again;
3227 	}
3228 	ASSERT(pp->p_szc == pszc);
3229 
3230 	/*
3231 	 * Decrement by 1 p_szc of every constituent page of a region that
3232 	 * covered pp. For example if original szc is 3 it gets changed to 2
3233 	 * everywhere except in region 2 that covered pp. Region 2 that
3234 	 * covered pp gets demoted to 1 everywhere except in region 1 that
3235 	 * covered pp. The region 1 that covered pp is demoted to region
3236 	 * 0. It's done this way because from region 3 we removed level 3
3237 	 * mappings, from region 2 that covered pp we removed level 2 mappings
3238 	 * and from region 1 that covered pp we removed level 1 mappings.  All
3239 	 * changes are done from from high pfn's to low pfn's so that roots
3240 	 * are changed last allowing one to know the largest region where
3241 	 * hat_page_demote() is stil active by only looking at the root page.
3242 	 *
3243 	 * This algorithm is implemented in 2 while loops. First loop changes
3244 	 * p_szc of pages to the right of pp's level 1 region and second
3245 	 * loop changes p_szc of pages of level 1 region that covers pp
3246 	 * and all pages to the left of level 1 region that covers pp.
3247 	 * In the first loop p_szc keeps dropping with every iteration
3248 	 * and in the second loop it keeps increasing with every iteration.
3249 	 *
3250 	 * First loop description: Demote pages to the right of pp outside of
3251 	 * level 1 region that covers pp.  In every iteration of the while
3252 	 * loop below find the last page of szc region and the first page of
3253 	 * (szc - 1) region that is immediately to the right of (szc - 1)
3254 	 * region that covers pp.  From last such page to first such page
3255 	 * change every page's szc to szc - 1. Decrement szc and continue
3256 	 * looping until szc is 1. If pp belongs to the last (szc - 1) region
3257 	 * of szc region skip to the next iteration.
3258 	 */
3259 	szc = pszc;
3260 	while (szc > 1) {
3261 		lastpp = PP_GROUPLEADER(pp, szc);
3262 		pgcnt = page_get_pagecnt(szc);
3263 		lastpp += pgcnt - 1;
3264 		firstpp = PP_GROUPLEADER(pp, (szc - 1));
3265 		pgcnt = page_get_pagecnt(szc - 1);
3266 		if (lastpp - firstpp < pgcnt) {
3267 			szc--;
3268 			continue;
3269 		}
3270 		firstpp += pgcnt;
3271 		while (lastpp != firstpp) {
3272 			ASSERT(lastpp->p_szc == pszc);
3273 			lastpp->p_szc = szc - 1;
3274 			lastpp--;
3275 		}
3276 		firstpp->p_szc = szc - 1;
3277 		szc--;
3278 	}
3279 
3280 	/*
3281 	 * Second loop description:
3282 	 * First iteration changes p_szc to 0 of every
3283 	 * page of level 1 region that covers pp.
3284 	 * Subsequent iterations find last page of szc region
3285 	 * immediately to the left of szc region that covered pp
3286 	 * and first page of (szc + 1) region that covers pp.
3287 	 * From last to first page change p_szc of every page to szc.
3288 	 * Increment szc and continue looping until szc is pszc.
3289 	 * If pp belongs to the fist szc region of (szc + 1) region
3290 	 * skip to the next iteration.
3291 	 *
3292 	 */
3293 	szc = 0;
3294 	while (szc < pszc) {
3295 		firstpp = PP_GROUPLEADER(pp, (szc + 1));
3296 		if (szc == 0) {
3297 			pgcnt = page_get_pagecnt(1);
3298 			lastpp = firstpp + (pgcnt - 1);
3299 		} else {
3300 			lastpp = PP_GROUPLEADER(pp, szc);
3301 			if (firstpp == lastpp) {
3302 				szc++;
3303 				continue;
3304 			}
3305 			lastpp--;
3306 			pgcnt = page_get_pagecnt(szc);
3307 		}
3308 		while (lastpp != firstpp) {
3309 			ASSERT(lastpp->p_szc == pszc);
3310 			lastpp->p_szc = szc;
3311 			lastpp--;
3312 		}
3313 		firstpp->p_szc = szc;
3314 		if (firstpp == rootpp)
3315 			break;
3316 		szc++;
3317 	}
3318 	x86_hm_exit(rootpp);
3319 }
3320 
3321 /*
3322  * get hw stats from hardware into page struct and reset hw stats
3323  * returns attributes of page
3324  * Flags for hat_pagesync, hat_getstat, hat_sync
3325  *
3326  * define	HAT_SYNC_ZERORM		0x01
3327  *
3328  * Additional flags for hat_pagesync
3329  *
3330  * define	HAT_SYNC_STOPON_REF	0x02
3331  * define	HAT_SYNC_STOPON_MOD	0x04
3332  * define	HAT_SYNC_STOPON_RM	0x06
3333  * define	HAT_SYNC_STOPON_SHARED	0x08
3334  */
3335 uint_t
3336 hat_pagesync(struct page *pp, uint_t flags)
3337 {
3338 	hment_t		*hm = NULL;
3339 	htable_t	*ht;
3340 	uint_t		entry;
3341 	x86pte_t	old, save_old;
3342 	x86pte_t	new;
3343 	uchar_t		nrmbits = P_REF|P_MOD|P_RO;
3344 	extern ulong_t	po_share;
3345 	page_t		*save_pp = pp;
3346 	uint_t		pszc = 0;
3347 
3348 	ASSERT(PAGE_LOCKED(pp) || panicstr);
3349 
3350 	if (PP_ISRO(pp) && (flags & HAT_SYNC_STOPON_MOD))
3351 		return (pp->p_nrm & nrmbits);
3352 
3353 	if ((flags & HAT_SYNC_ZERORM) == 0) {
3354 
3355 		if ((flags & HAT_SYNC_STOPON_REF) != 0 && PP_ISREF(pp))
3356 			return (pp->p_nrm & nrmbits);
3357 
3358 		if ((flags & HAT_SYNC_STOPON_MOD) != 0 && PP_ISMOD(pp))
3359 			return (pp->p_nrm & nrmbits);
3360 
3361 		if ((flags & HAT_SYNC_STOPON_SHARED) != 0 &&
3362 		    hat_page_getshare(pp) > po_share) {
3363 			if (PP_ISRO(pp))
3364 				PP_SETREF(pp);
3365 			return (pp->p_nrm & nrmbits);
3366 		}
3367 	}
3368 
3369 next_size:
3370 	/*
3371 	 * walk thru the mapping list syncing (and clearing) ref/mod bits.
3372 	 */
3373 	x86_hm_enter(pp);
3374 	while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) {
3375 		if (ht->ht_level < pszc)
3376 			continue;
3377 		old = x86pte_get(ht, entry);
3378 try_again:
3379 
3380 		ASSERT(PTE2PFN(old, ht->ht_level) == pp->p_pagenum);
3381 
3382 		if (PTE_GET(old, PT_REF | PT_MOD) == 0)
3383 			continue;
3384 
3385 		save_old = old;
3386 		if ((flags & HAT_SYNC_ZERORM) != 0) {
3387 
3388 			/*
3389 			 * Need to clear ref or mod bits. Need to demap
3390 			 * to make sure any executing TLBs see cleared bits.
3391 			 */
3392 			new = old;
3393 			PTE_CLR(new, PT_REF | PT_MOD);
3394 			old = hati_update_pte(ht, entry, old, new);
3395 			if (old != 0)
3396 				goto try_again;
3397 
3398 			old = save_old;
3399 		}
3400 
3401 		/*
3402 		 * Sync the PTE
3403 		 */
3404 		if (!(flags & HAT_SYNC_ZERORM) &&
3405 		    PTE_GET(old, PT_SOFTWARE) <= PT_NOSYNC)
3406 			hati_sync_pte_to_page(pp, old, ht->ht_level);
3407 
3408 		/*
3409 		 * can stop short if we found a ref'd or mod'd page
3410 		 */
3411 		if ((flags & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp) ||
3412 		    (flags & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)) {
3413 			x86_hm_exit(pp);
3414 			goto done;
3415 		}
3416 	}
3417 	x86_hm_exit(pp);
3418 	while (pszc < pp->p_szc) {
3419 		page_t *tpp;
3420 		pszc++;
3421 		tpp = PP_GROUPLEADER(pp, pszc);
3422 		if (pp != tpp) {
3423 			pp = tpp;
3424 			goto next_size;
3425 		}
3426 	}
3427 done:
3428 	return (save_pp->p_nrm & nrmbits);
3429 }
3430 
3431 /*
3432  * returns approx number of mappings to this pp.  A return of 0 implies
3433  * there are no mappings to the page.
3434  */
3435 ulong_t
3436 hat_page_getshare(page_t *pp)
3437 {
3438 	uint_t cnt;
3439 	cnt = hment_mapcnt(pp);
3440 #if defined(__amd64)
3441 	if (vpm_enable && pp->p_vpmref) {
3442 		cnt += 1;
3443 	}
3444 #endif
3445 	return (cnt);
3446 }
3447 
3448 /*
3449  * hat_softlock isn't supported anymore
3450  */
3451 /*ARGSUSED*/
3452 faultcode_t
3453 hat_softlock(
3454 	hat_t *hat,
3455 	caddr_t addr,
3456 	size_t *len,
3457 	struct page **page_array,
3458 	uint_t flags)
3459 {
3460 	return (FC_NOSUPPORT);
3461 }
3462 
3463 
3464 
3465 /*
3466  * Routine to expose supported HAT features to platform independent code.
3467  */
3468 /*ARGSUSED*/
3469 int
3470 hat_supported(enum hat_features feature, void *arg)
3471 {
3472 	switch (feature) {
3473 
3474 	case HAT_SHARED_PT:	/* this is really ISM */
3475 		return (1);
3476 
3477 	case HAT_DYNAMIC_ISM_UNMAP:
3478 		return (0);
3479 
3480 	case HAT_VMODSORT:
3481 		return (1);
3482 
3483 	default:
3484 		panic("hat_supported() - unknown feature");
3485 	}
3486 	return (0);
3487 }
3488 
3489 /*
3490  * Called when a thread is exiting and has been switched to the kernel AS
3491  */
3492 void
3493 hat_thread_exit(kthread_t *thd)
3494 {
3495 	ASSERT(thd->t_procp->p_as == &kas);
3496 	hat_switch(thd->t_procp->p_as->a_hat);
3497 }
3498 
3499 /*
3500  * Setup the given brand new hat structure as the new HAT on this cpu's mmu.
3501  */
3502 /*ARGSUSED*/
3503 void
3504 hat_setup(hat_t *hat, int flags)
3505 {
3506 	kpreempt_disable();
3507 
3508 	hat_switch(hat);
3509 
3510 	kpreempt_enable();
3511 }
3512 
3513 /*
3514  * Prepare for a CPU private mapping for the given address.
3515  *
3516  * The address can only be used from a single CPU and can be remapped
3517  * using hat_mempte_remap().  Return the address of the PTE.
3518  *
3519  * We do the htable_create() if necessary and increment the valid count so
3520  * the htable can't disappear.  We also hat_devload() the page table into
3521  * kernel so that the PTE is quickly accessed.
3522  */
3523 hat_mempte_t
3524 hat_mempte_setup(caddr_t addr)
3525 {
3526 	uintptr_t	va = (uintptr_t)addr;
3527 	htable_t	*ht;
3528 	uint_t		entry;
3529 	x86pte_t	oldpte;
3530 	hat_mempte_t	p;
3531 
3532 	ASSERT(IS_PAGEALIGNED(va));
3533 	ASSERT(!IN_VA_HOLE(va));
3534 	++curthread->t_hatdepth;
3535 	ht = htable_getpte(kas.a_hat, va, &entry, &oldpte, 0);
3536 	if (ht == NULL) {
3537 		ht = htable_create(kas.a_hat, va, 0, NULL);
3538 		entry = htable_va2entry(va, ht);
3539 		ASSERT(ht->ht_level == 0);
3540 		oldpte = x86pte_get(ht, entry);
3541 	}
3542 	if (PTE_ISVALID(oldpte))
3543 		panic("hat_mempte_setup(): address already mapped"
3544 		    "ht=%p, entry=%d, pte=" FMT_PTE, ht, entry, oldpte);
3545 
3546 	/*
3547 	 * increment ht_valid_cnt so that the pagetable can't disappear
3548 	 */
3549 	HTABLE_INC(ht->ht_valid_cnt);
3550 
3551 	/*
3552 	 * return the PTE physical address to the caller.
3553 	 */
3554 	htable_release(ht);
3555 	p = PT_INDEX_PHYSADDR(pfn_to_pa(ht->ht_pfn), entry);
3556 	--curthread->t_hatdepth;
3557 	return (p);
3558 }
3559 
3560 /*
3561  * Release a CPU private mapping for the given address.
3562  * We decrement the htable valid count so it might be destroyed.
3563  */
3564 /*ARGSUSED1*/
3565 void
3566 hat_mempte_release(caddr_t addr, hat_mempte_t pte_pa)
3567 {
3568 	htable_t	*ht;
3569 
3570 	/*
3571 	 * invalidate any left over mapping and decrement the htable valid count
3572 	 */
3573 	{
3574 		x86pte_t *pteptr;
3575 
3576 		pteptr = x86pte_mapin(mmu_btop(pte_pa),
3577 		    (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
3578 		if (mmu.pae_hat)
3579 			*pteptr = 0;
3580 		else
3581 			*(x86pte32_t *)pteptr = 0;
3582 		mmu_tlbflush_entry(addr);
3583 		x86pte_mapout();
3584 	}
3585 
3586 	ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0);
3587 	if (ht == NULL)
3588 		panic("hat_mempte_release(): invalid address");
3589 	ASSERT(ht->ht_level == 0);
3590 	HTABLE_DEC(ht->ht_valid_cnt);
3591 	htable_release(ht);
3592 }
3593 
3594 /*
3595  * Apply a temporary CPU private mapping to a page. We flush the TLB only
3596  * on this CPU, so this ought to have been called with preemption disabled.
3597  */
3598 void
3599 hat_mempte_remap(
3600 	pfn_t		pfn,
3601 	caddr_t		addr,
3602 	hat_mempte_t	pte_pa,
3603 	uint_t		attr,
3604 	uint_t		flags)
3605 {
3606 	uintptr_t	va = (uintptr_t)addr;
3607 	x86pte_t	pte;
3608 
3609 	/*
3610 	 * Remap the given PTE to the new page's PFN. Invalidate only
3611 	 * on this CPU.
3612 	 */
3613 #ifdef DEBUG
3614 	htable_t	*ht;
3615 	uint_t		entry;
3616 
3617 	ASSERT(IS_PAGEALIGNED(va));
3618 	ASSERT(!IN_VA_HOLE(va));
3619 	ht = htable_getpte(kas.a_hat, va, &entry, NULL, 0);
3620 	ASSERT(ht != NULL);
3621 	ASSERT(ht->ht_level == 0);
3622 	ASSERT(ht->ht_valid_cnt > 0);
3623 	ASSERT(ht->ht_pfn == mmu_btop(pte_pa));
3624 	htable_release(ht);
3625 #endif
3626 	pte = hati_mkpte(pfn, attr, 0, flags);
3627 	{
3628 		x86pte_t *pteptr;
3629 
3630 		pteptr = x86pte_mapin(mmu_btop(pte_pa),
3631 		    (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
3632 		if (mmu.pae_hat)
3633 			*(x86pte_t *)pteptr = pte;
3634 		else
3635 			*(x86pte32_t *)pteptr = (x86pte32_t)pte;
3636 		mmu_tlbflush_entry(addr);
3637 		x86pte_mapout();
3638 	}
3639 }
3640 
3641 
3642 
3643 /*
3644  * Hat locking functions
3645  * XXX - these two functions are currently being used by hatstats
3646  * 	they can be removed by using a per-as mutex for hatstats.
3647  */
3648 void
3649 hat_enter(hat_t *hat)
3650 {
3651 	mutex_enter(&hat->hat_mutex);
3652 }
3653 
3654 void
3655 hat_exit(hat_t *hat)
3656 {
3657 	mutex_exit(&hat->hat_mutex);
3658 }
3659 
3660 /*
3661  * HAT part of cpu initialization.
3662  */
3663 void
3664 hat_cpu_online(struct cpu *cpup)
3665 {
3666 	if (cpup != CPU) {
3667 		x86pte_cpu_init(cpup);
3668 		hat_vlp_setup(cpup);
3669 	}
3670 	CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id);
3671 }
3672 
3673 /*
3674  * HAT part of cpu deletion.
3675  * (currently, we only call this after the cpu is safely passivated.)
3676  */
3677 void
3678 hat_cpu_offline(struct cpu *cpup)
3679 {
3680 	ASSERT(cpup != CPU);
3681 
3682 	CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id);
3683 	x86pte_cpu_fini(cpup);
3684 	hat_vlp_teardown(cpup);
3685 }
3686 
3687 /*
3688  * Function called after all CPUs are brought online.
3689  * Used to remove low address boot mappings.
3690  */
3691 void
3692 clear_boot_mappings(uintptr_t low, uintptr_t high)
3693 {
3694 	uintptr_t vaddr = low;
3695 	htable_t *ht = NULL;
3696 	level_t level;
3697 	uint_t entry;
3698 	x86pte_t pte;
3699 
3700 	/*
3701 	 * On 1st CPU we can unload the prom mappings, basically we blow away
3702 	 * all virtual mappings under _userlimit.
3703 	 */
3704 	while (vaddr < high) {
3705 		pte = htable_walk(kas.a_hat, &ht, &vaddr, high);
3706 		if (ht == NULL)
3707 			break;
3708 
3709 		level = ht->ht_level;
3710 		entry = htable_va2entry(vaddr, ht);
3711 		ASSERT(level <= mmu.max_page_level);
3712 		ASSERT(PTE_ISPAGE(pte, level));
3713 
3714 		/*
3715 		 * Unload the mapping from the page tables.
3716 		 */
3717 		(void) x86pte_inval(ht, entry, 0, NULL);
3718 		ASSERT(ht->ht_valid_cnt > 0);
3719 		HTABLE_DEC(ht->ht_valid_cnt);
3720 		PGCNT_DEC(ht->ht_hat, ht->ht_level);
3721 
3722 		vaddr += LEVEL_SIZE(ht->ht_level);
3723 	}
3724 	if (ht)
3725 		htable_release(ht);
3726 }
3727 
3728 /*
3729  * Atomically update a new translation for a single page.  If the
3730  * currently installed PTE doesn't match the value we expect to find,
3731  * it's not updated and we return the PTE we found.
3732  *
3733  * If activating nosync or NOWRITE and the page was modified we need to sync
3734  * with the page_t. Also sync with page_t if clearing ref/mod bits.
3735  */
3736 static x86pte_t
3737 hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, x86pte_t new)
3738 {
3739 	page_t		*pp;
3740 	uint_t		rm = 0;
3741 	x86pte_t	replaced;
3742 
3743 	if (PTE_GET(expected, PT_SOFTWARE) < PT_NOSYNC &&
3744 	    PTE_GET(expected, PT_MOD | PT_REF) &&
3745 	    (PTE_GET(new, PT_NOSYNC) || !PTE_GET(new, PT_WRITABLE) ||
3746 		!PTE_GET(new, PT_MOD | PT_REF))) {
3747 
3748 		ASSERT(!pfn_is_foreign(PTE2PFN(expected, ht->ht_level)));
3749 		pp = page_numtopp_nolock(PTE2PFN(expected, ht->ht_level));
3750 		ASSERT(pp != NULL);
3751 		if (PTE_GET(expected, PT_MOD))
3752 			rm |= P_MOD;
3753 		if (PTE_GET(expected, PT_REF))
3754 			rm |= P_REF;
3755 		PTE_CLR(new, PT_MOD | PT_REF);
3756 	}
3757 
3758 	replaced = x86pte_update(ht, entry, expected, new);
3759 	if (replaced != expected)
3760 		return (replaced);
3761 
3762 	if (rm) {
3763 		/*
3764 		 * sync to all constituent pages of a large page
3765 		 */
3766 		pgcnt_t pgcnt = page_get_pagecnt(ht->ht_level);
3767 		ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt));
3768 		while (pgcnt-- > 0) {
3769 			/*
3770 			 * hat_page_demote() can't decrease
3771 			 * pszc below this mapping size
3772 			 * since large mapping existed after we
3773 			 * took mlist lock.
3774 			 */
3775 			ASSERT(pp->p_szc >= ht->ht_level);
3776 			hat_page_setattr(pp, rm);
3777 			++pp;
3778 		}
3779 	}
3780 
3781 	return (0);
3782 }
3783 
3784 /*
3785  * Kernel Physical Mapping (kpm) facility
3786  *
3787  * Most of the routines needed to support segkpm are almost no-ops on the
3788  * x86 platform.  We map in the entire segment when it is created and leave
3789  * it mapped in, so there is no additional work required to set up and tear
3790  * down individual mappings.  All of these routines were created to support
3791  * SPARC platforms that have to avoid aliasing in their virtually indexed
3792  * caches.
3793  *
3794  * Most of the routines have sanity checks in them (e.g. verifying that the
3795  * passed-in page is locked).  We don't actually care about most of these
3796  * checks on x86, but we leave them in place to identify problems in the
3797  * upper levels.
3798  */
3799 
3800 /*
3801  * Map in a locked page and return the vaddr.
3802  */
3803 /*ARGSUSED*/
3804 caddr_t
3805 hat_kpm_mapin(struct page *pp, struct kpme *kpme)
3806 {
3807 	caddr_t		vaddr;
3808 
3809 #ifdef DEBUG
3810 	if (kpm_enable == 0) {
3811 		cmn_err(CE_WARN, "hat_kpm_mapin: kpm_enable not set\n");
3812 		return ((caddr_t)NULL);
3813 	}
3814 
3815 	if (pp == NULL || PAGE_LOCKED(pp) == 0) {
3816 		cmn_err(CE_WARN, "hat_kpm_mapin: pp zero or not locked\n");
3817 		return ((caddr_t)NULL);
3818 	}
3819 #endif
3820 
3821 	vaddr = hat_kpm_page2va(pp, 1);
3822 
3823 	return (vaddr);
3824 }
3825 
3826 /*
3827  * Mapout a locked page.
3828  */
3829 /*ARGSUSED*/
3830 void
3831 hat_kpm_mapout(struct page *pp, struct kpme *kpme, caddr_t vaddr)
3832 {
3833 #ifdef DEBUG
3834 	if (kpm_enable == 0) {
3835 		cmn_err(CE_WARN, "hat_kpm_mapout: kpm_enable not set\n");
3836 		return;
3837 	}
3838 
3839 	if (IS_KPM_ADDR(vaddr) == 0) {
3840 		cmn_err(CE_WARN, "hat_kpm_mapout: no kpm address\n");
3841 		return;
3842 	}
3843 
3844 	if (pp == NULL || PAGE_LOCKED(pp) == 0) {
3845 		cmn_err(CE_WARN, "hat_kpm_mapout: page zero or not locked\n");
3846 		return;
3847 	}
3848 #endif
3849 }
3850 
3851 /*
3852  * Return the kpm virtual address for a specific pfn
3853  */
3854 caddr_t
3855 hat_kpm_pfn2va(pfn_t pfn)
3856 {
3857 	uintptr_t vaddr = (uintptr_t)kpm_vbase + mmu_ptob(pfn);
3858 
3859 	return ((caddr_t)vaddr);
3860 }
3861 
3862 /*
3863  * Return the kpm virtual address for the page at pp.
3864  */
3865 /*ARGSUSED*/
3866 caddr_t
3867 hat_kpm_page2va(struct page *pp, int checkswap)
3868 {
3869 	return (hat_kpm_pfn2va(pp->p_pagenum));
3870 }
3871 
3872 /*
3873  * Return the page frame number for the kpm virtual address vaddr.
3874  */
3875 pfn_t
3876 hat_kpm_va2pfn(caddr_t vaddr)
3877 {
3878 	pfn_t		pfn;
3879 
3880 	ASSERT(IS_KPM_ADDR(vaddr));
3881 
3882 	pfn = (pfn_t)btop(vaddr - kpm_vbase);
3883 
3884 	return (pfn);
3885 }
3886 
3887 
3888 /*
3889  * Return the page for the kpm virtual address vaddr.
3890  */
3891 page_t *
3892 hat_kpm_vaddr2page(caddr_t vaddr)
3893 {
3894 	pfn_t		pfn;
3895 
3896 	ASSERT(IS_KPM_ADDR(vaddr));
3897 
3898 	pfn = hat_kpm_va2pfn(vaddr);
3899 
3900 	return (page_numtopp_nolock(pfn));
3901 }
3902 
3903 /*
3904  * hat_kpm_fault is called from segkpm_fault when we take a page fault on a
3905  * KPM page.  This should never happen on x86
3906  */
3907 int
3908 hat_kpm_fault(hat_t *hat, caddr_t vaddr)
3909 {
3910 	panic("pagefault in seg_kpm.  hat: 0x%p  vaddr: 0x%p", hat, vaddr);
3911 
3912 	return (0);
3913 }
3914 
3915 /*ARGSUSED*/
3916 void
3917 hat_kpm_mseghash_clear(int nentries)
3918 {}
3919 
3920 /*ARGSUSED*/
3921 void
3922 hat_kpm_mseghash_update(pgcnt_t inx, struct memseg *msp)
3923 {}
3924