xref: /netvirt/usr/src/uts/common/vm/vm_as.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
/*	  All Rights Reserved  	*/

/*
 * University Copyright- Copyright (c) 1982, 1986, 1988
 * The Regents of the University of California
 * All Rights Reserved
 *
 * University Acknowledgment- Portions of this document are derived from
 * software developed by the University of California, Berkeley, and its
 * contributors.
 */

#pragma ident	"@(#)vm_as.c	1.175	07/12/10 SMI"

/*
 * VM - address spaces.
 */

#include <sys/types.h>
#include <sys/t_lock.h>
#include <sys/param.h>
#include <sys/errno.h>
#include <sys/systm.h>
#include <sys/mman.h>
#include <sys/sysmacros.h>
#include <sys/cpuvar.h>
#include <sys/sysinfo.h>
#include <sys/kmem.h>
#include <sys/vnode.h>
#include <sys/vmsystm.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/tnf_probe.h>
#include <sys/vtrace.h>

#include <vm/hat.h>
#include <vm/xhat.h>
#include <vm/as.h>
#include <vm/seg.h>
#include <vm/seg_vn.h>
#include <vm/seg_dev.h>
#include <vm/seg_kmem.h>
#include <vm/seg_map.h>
#include <vm/seg_spt.h>
#include <vm/page.h>

clock_t deadlk_wait = 1; /* number of ticks to wait before retrying */

static struct kmem_cache *as_cache;

static void as_setwatchprot(struct as *, caddr_t, size_t, uint_t);
static void as_clearwatchprot(struct as *, caddr_t, size_t);
int as_map_locked(struct as *, caddr_t, size_t, int ((*)()), void *);


/*
 * Verifying the segment lists is very time-consuming; it may not be
 * desirable always to define VERIFY_SEGLIST when DEBUG is set.
 */
#ifdef DEBUG
#define	VERIFY_SEGLIST
int do_as_verify = 0;
#endif

/*
 * Allocate a new callback data structure entry and fill in the events of
 * interest, the address range of interest, and the callback argument.
 * Link the entry on the as->a_callbacks list. A callback entry for the
 * entire address space may be specified with vaddr = 0 and size = -1.
 *
 * CALLERS RESPONSIBILITY: If not calling from within the process context for
 * the specified as, the caller must guarantee persistence of the specified as
 * for the duration of this function (eg. pages being locked within the as
 * will guarantee persistence).
 */
int
as_add_callback(struct as *as, void (*cb_func)(), void *arg, uint_t events,
		caddr_t vaddr, size_t size, int sleepflag)
{
	struct as_callback 	*current_head, *cb;
	caddr_t 		saddr;
	size_t 			rsize;

	/* callback function and an event are mandatory */
	if ((cb_func == NULL) || ((events & AS_ALL_EVENT) == 0))
		return (EINVAL);

	/* Adding a callback after as_free has been called is not allowed */
	if (as == &kas)
		return (ENOMEM);

	/*
	 * vaddr = 0 and size = -1 is used to indicate that the callback range
	 * is the entire address space so no rounding is done in that case.
	 */
	if (size != -1) {
		saddr = (caddr_t)((uintptr_t)vaddr & (uintptr_t)PAGEMASK);
		rsize = (((size_t)(vaddr + size) + PAGEOFFSET) & PAGEMASK) -
		    (size_t)saddr;
		/* check for wraparound */
		if (saddr + rsize < saddr)
			return (ENOMEM);
	} else {
		if (vaddr != 0)
			return (EINVAL);
		saddr = vaddr;
		rsize = size;
	}

	/* Allocate and initialize a callback entry */
	cb = kmem_zalloc(sizeof (struct as_callback), sleepflag);
	if (cb == NULL)
		return (EAGAIN);

	cb->ascb_func = cb_func;
	cb->ascb_arg = arg;
	cb->ascb_events = events;
	cb->ascb_saddr = saddr;
	cb->ascb_len = rsize;

	/* Add the entry to the list */
	mutex_enter(&as->a_contents);
	current_head = as->a_callbacks;
	as->a_callbacks = cb;
	cb->ascb_next = current_head;

	/*
	 * The call to this function may lose in a race with
	 * a pertinent event - eg. a thread does long term memory locking
	 * but before the callback is added another thread executes as_unmap.
	 * A broadcast here resolves that.
	 */
	if ((cb->ascb_events & AS_UNMAPWAIT_EVENT) && AS_ISUNMAPWAIT(as)) {
		AS_CLRUNMAPWAIT(as);
		cv_broadcast(&as->a_cv);
	}

	mutex_exit(&as->a_contents);
	return (0);
}

/*
 * Search the callback list for an entry which pertains to arg.
 *
 * This is called from within the client upon completion of the callback.
 * RETURN VALUES:
 *	AS_CALLBACK_DELETED  (callback entry found and deleted)
 *	AS_CALLBACK_NOTFOUND (no callback entry found - this is ok)
 *	AS_CALLBACK_DELETE_DEFERRED (callback is in process, delete of this
 *			entry will be made in as_do_callbacks)
 *
 * If as_delete_callback encounters a matching entry with AS_CALLBACK_CALLED
 * set, it indicates that as_do_callbacks is processing this entry.  The
 * AS_ALL_EVENT events are cleared in the entry, and a broadcast is made
 * to unblock as_do_callbacks, in case it is blocked.
 *
 * CALLERS RESPONSIBILITY: If not calling from within the process context for
 * the specified as, the caller must guarantee persistence of the specified as
 * for the duration of this function (eg. pages being locked within the as
 * will guarantee persistence).
 */
uint_t
as_delete_callback(struct as *as, void *arg)
{
	struct as_callback **prevcb = &as->a_callbacks;
	struct as_callback *cb;
	uint_t rc = AS_CALLBACK_NOTFOUND;

	mutex_enter(&as->a_contents);
	for (cb = as->a_callbacks; cb; prevcb = &cb->ascb_next, cb = *prevcb) {
		if (cb->ascb_arg != arg)
			continue;

		/*
		 * If the events indicate AS_CALLBACK_CALLED, just clear
		 * AS_ALL_EVENT in the events field and wakeup the thread
		 * that may be waiting in as_do_callbacks.  as_do_callbacks
		 * will take care of removing this entry from the list.  In
		 * that case, return AS_CALLBACK_DELETE_DEFERRED.  Otherwise
		 * (AS_CALLBACK_CALLED not set), just remove it from the
		 * list, return the memory and return AS_CALLBACK_DELETED.
		 */
		if ((cb->ascb_events & AS_CALLBACK_CALLED) != 0) {
			/* leave AS_CALLBACK_CALLED */
			cb->ascb_events &= ~AS_ALL_EVENT;
			rc = AS_CALLBACK_DELETE_DEFERRED;
			cv_broadcast(&as->a_cv);
		} else {
			*prevcb = cb->ascb_next;
			kmem_free(cb, sizeof (struct as_callback));
			rc = AS_CALLBACK_DELETED;
		}
		break;
	}
	mutex_exit(&as->a_contents);
	return (rc);
}

/*
 * Searches the as callback list for a matching entry.
 * Returns a pointer to the first matching callback, or NULL if
 * nothing is found.
 * This function never sleeps so it is ok to call it with more
 * locks held but the (required) a_contents mutex.
 *
 * See also comment on as_do_callbacks below.
 */
static struct as_callback *
as_find_callback(struct as *as, uint_t events, caddr_t event_addr,
			size_t event_len)
{
	struct as_callback	*cb;

	ASSERT(MUTEX_HELD(&as->a_contents));
	for (cb = as->a_callbacks; cb != NULL; cb = cb->ascb_next) {
		/*
		 * If the callback has not already been called, then
		 * check if events or address range pertains.  An event_len
		 * of zero means do an unconditional callback.
		 */
		if (((cb->ascb_events & AS_CALLBACK_CALLED) != 0) ||
		    ((event_len != 0) && (((cb->ascb_events & events) == 0) ||
		    (event_addr + event_len < cb->ascb_saddr) ||
		    (event_addr > (cb->ascb_saddr + cb->ascb_len))))) {
			continue;
		}
		break;
	}
	return (cb);
}

/*
 * Executes a given callback and removes it from the callback list for
 * this address space.
 * This function may sleep so the caller must drop all locks except
 * a_contents before calling this func.
 *
 * See also comments on as_do_callbacks below.
 */
static void
as_execute_callback(struct as *as, struct as_callback *cb,
				uint_t events)
{
	struct as_callback **prevcb;
	void	*cb_arg;

	ASSERT(MUTEX_HELD(&as->a_contents) && (cb->ascb_events & events));
	cb->ascb_events |= AS_CALLBACK_CALLED;
	mutex_exit(&as->a_contents);
	(*cb->ascb_func)(as, cb->ascb_arg, events);
	mutex_enter(&as->a_contents);
	/*
	 * the callback function is required to delete the callback
	 * when the callback function determines it is OK for
	 * this thread to continue. as_delete_callback will clear
	 * the AS_ALL_EVENT in the events field when it is deleted.
	 * If the callback function called as_delete_callback,
	 * events will already be cleared and there will be no blocking.
	 */
	while ((cb->ascb_events & events) != 0) {
		cv_wait(&as->a_cv, &as->a_contents);
	}
	/*
	 * This entry needs to be taken off the list. Normally, the
	 * callback func itself does that, but unfortunately the list
	 * may have changed while the callback was running because the
	 * a_contents mutex was dropped and someone else other than the
	 * callback func itself could have called as_delete_callback,
	 * so we have to search to find this entry again.  The entry
	 * must have AS_CALLBACK_CALLED, and have the same 'arg'.
	 */
	cb_arg = cb->ascb_arg;
	prevcb = &as->a_callbacks;
	for (cb = as->a_callbacks; cb != NULL;
	    prevcb = &cb->ascb_next, cb = *prevcb) {
		if (((cb->ascb_events & AS_CALLBACK_CALLED) == 0) ||
		    (cb_arg != cb->ascb_arg)) {
			continue;
		}
		*prevcb = cb->ascb_next;
		kmem_free(cb, sizeof (struct as_callback));
		break;
	}
}

/*
 * Check the callback list for a matching event and intersection of
 * address range. If there is a match invoke the callback.  Skip an entry if:
 *    - a callback is already in progress for this entry (AS_CALLBACK_CALLED)
 *    - not event of interest
 *    - not address range of interest
 *
 * An event_len of zero indicates a request for an unconditional callback
 * (regardless of event), only the AS_CALLBACK_CALLED is checked.  The
 * a_contents lock must be dropped before a callback, so only one callback
 * can be done before returning. Return -1 (true) if a callback was
 * executed and removed from the list, else return 0 (false).
 *
 * The logically separate parts, i.e. finding a matching callback and
 * executing a given callback have been separated into two functions
 * so that they can be called with different sets of locks held beyond
 * the always-required a_contents. as_find_callback does not sleep so
 * it is ok to call it if more locks than a_contents (i.e. the a_lock
 * rwlock) are held. as_execute_callback on the other hand may sleep
 * so all locks beyond a_contents must be dropped by the caller if one
 * does not want to end comatose.
 */
static int
as_do_callbacks(struct as *as, uint_t events, caddr_t event_addr,
			size_t event_len)
{
	struct as_callback *cb;

	if ((cb = as_find_callback(as, events, event_addr, event_len))) {
		as_execute_callback(as, cb, events);
		return (-1);
	}
	return (0);
}

/*
 * Search for the segment containing addr. If a segment containing addr
 * exists, that segment is returned.  If no such segment exists, and
 * the list spans addresses greater than addr, then the first segment
 * whose base is greater than addr is returned; otherwise, NULL is
 * returned unless tail is true, in which case the last element of the
 * list is returned.
 *
 * a_seglast is used to cache the last found segment for repeated
 * searches to the same addr (which happens frequently).
 */
struct seg *
as_findseg(struct as *as, caddr_t addr, int tail)
{
	struct seg *seg = as->a_seglast;
	avl_index_t where;

	ASSERT(AS_LOCK_HELD(as, &as->a_lock));

	if (seg != NULL &&
	    seg->s_base <= addr &&
	    addr < seg->s_base + seg->s_size)
		return (seg);

	seg = avl_find(&as->a_segtree, &addr, &where);
	if (seg != NULL)
		return (as->a_seglast = seg);

	seg = avl_nearest(&as->a_segtree, where, AVL_AFTER);
	if (seg == NULL && tail)
		seg = avl_last(&as->a_segtree);
	return (as->a_seglast = seg);
}

#ifdef VERIFY_SEGLIST
/*
 * verify that the linked list is coherent
 */
static void
as_verify(struct as *as)
{
	struct seg *seg, *seglast, *p, *n;
	uint_t nsegs = 0;

	if (do_as_verify == 0)
		return;

	seglast = as->a_seglast;

	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
		ASSERT(seg->s_as == as);
		p = AS_SEGPREV(as, seg);
		n = AS_SEGNEXT(as, seg);
		ASSERT(p == NULL || p->s_as == as);
		ASSERT(p == NULL || p->s_base < seg->s_base);
		ASSERT(n == NULL || n->s_base > seg->s_base);
		ASSERT(n != NULL || seg == avl_last(&as->a_segtree));
		if (seg == seglast)
			seglast = NULL;
		nsegs++;
	}
	ASSERT(seglast == NULL);
	ASSERT(avl_numnodes(&as->a_segtree) == nsegs);
}
#endif /* VERIFY_SEGLIST */

/*
 * Add a new segment to the address space. The avl_find()
 * may be expensive so we attempt to use last segment accessed
 * in as_gap() as an insertion point.
 */
int
as_addseg(struct as  *as, struct seg *newseg)
{
	struct seg *seg;
	caddr_t addr;
	caddr_t eaddr;
	avl_index_t where;

	ASSERT(AS_WRITE_HELD(as, &as->a_lock));

	as->a_updatedir = 1;	/* inform /proc */
	gethrestime(&as->a_updatetime);

	if (as->a_lastgaphl != NULL) {
		struct seg *hseg = NULL;
		struct seg *lseg = NULL;

		if (as->a_lastgaphl->s_base > newseg->s_base) {
			hseg = as->a_lastgaphl;
			lseg = AVL_PREV(&as->a_segtree, hseg);
		} else {
			lseg = as->a_lastgaphl;
			hseg = AVL_NEXT(&as->a_segtree, lseg);
		}

		if (hseg && lseg && lseg->s_base < newseg->s_base &&
		    hseg->s_base > newseg->s_base) {
			avl_insert_here(&as->a_segtree, newseg, lseg,
			    AVL_AFTER);
			as->a_lastgaphl = NULL;
			as->a_seglast = newseg;
			return (0);
		}
		as->a_lastgaphl = NULL;
	}

	addr = newseg->s_base;
	eaddr = addr + newseg->s_size;
again:

	seg = avl_find(&as->a_segtree, &addr, &where);

	if (seg == NULL)
		seg = avl_nearest(&as->a_segtree, where, AVL_AFTER);

	if (seg == NULL)
		seg = avl_last(&as->a_segtree);

	if (seg != NULL) {
		caddr_t base = seg->s_base;

		/*
		 * If top of seg is below the requested address, then
		 * the insertion point is at the end of the linked list,
		 * and seg points to the tail of the list.  Otherwise,
		 * the insertion point is immediately before seg.
		 */
		if (base + seg->s_size > addr) {
			if (addr >= base || eaddr > base) {
#ifdef __sparc
				extern struct seg_ops segnf_ops;

				/*
				 * no-fault segs must disappear if overlaid.
				 * XXX need new segment type so
				 * we don't have to check s_ops
				 */
				if (seg->s_ops == &segnf_ops) {
					seg_unmap(seg);
					goto again;
				}
#endif
				return (-1);	/* overlapping segment */
			}
		}
	}
	as->a_seglast = newseg;
	avl_insert(&as->a_segtree, newseg, where);

#ifdef VERIFY_SEGLIST
	as_verify(as);
#endif
	return (0);
}

struct seg *
as_removeseg(struct as *as, struct seg *seg)
{
	avl_tree_t *t;

	ASSERT(AS_WRITE_HELD(as, &as->a_lock));

	as->a_updatedir = 1;	/* inform /proc */
	gethrestime(&as->a_updatetime);

	if (seg == NULL)
		return (NULL);

	t = &as->a_segtree;
	if (as->a_seglast == seg)
		as->a_seglast = NULL;
	as->a_lastgaphl = NULL;

	/*
	 * if this segment is at an address higher than
	 * a_lastgap, set a_lastgap to the next segment (NULL if last segment)
	 */
	if (as->a_lastgap &&
	    (seg == as->a_lastgap || seg->s_base > as->a_lastgap->s_base))
		as->a_lastgap = AVL_NEXT(t, seg);

	/*
	 * remove the segment from the seg tree
	 */
	avl_remove(t, seg);

#ifdef VERIFY_SEGLIST
	as_verify(as);
#endif
	return (seg);
}

/*
 * Find a segment containing addr.
 */
struct seg *
as_segat(struct as *as, caddr_t addr)
{
	struct seg *seg = as->a_seglast;

	ASSERT(AS_LOCK_HELD(as, &as->a_lock));

	if (seg != NULL && seg->s_base <= addr &&
	    addr < seg->s_base + seg->s_size)
		return (seg);

	seg = avl_find(&as->a_segtree, &addr, NULL);
	return (seg);
}

/*
 * Serialize all searches for holes in an address space to
 * prevent two or more threads from allocating the same virtual
 * address range.  The address space must not be "read/write"
 * locked by the caller since we may block.
 */
void
as_rangelock(struct as *as)
{
	mutex_enter(&as->a_contents);
	while (AS_ISCLAIMGAP(as))
		cv_wait(&as->a_cv, &as->a_contents);
	AS_SETCLAIMGAP(as);
	mutex_exit(&as->a_contents);
}

/*
 * Release hold on a_state & AS_CLAIMGAP and signal any other blocked threads.
 */
void
as_rangeunlock(struct as *as)
{
	mutex_enter(&as->a_contents);
	AS_CLRCLAIMGAP(as);
	cv_signal(&as->a_cv);
	mutex_exit(&as->a_contents);
}

/*
 * compar segments (or just an address) by segment address range
 */
static int
as_segcompar(const void *x, const void *y)
{
	struct seg *a = (struct seg *)x;
	struct seg *b = (struct seg *)y;

	if (a->s_base < b->s_base)
		return (-1);
	if (a->s_base >= b->s_base + b->s_size)
		return (1);
	return (0);
}


void
as_avlinit(struct as *as)
{
	avl_create(&as->a_segtree, as_segcompar, sizeof (struct seg),
	    offsetof(struct seg, s_tree));
	avl_create(&as->a_wpage, wp_compare, sizeof (struct watched_page),
	    offsetof(struct watched_page, wp_link));
}

/*ARGSUSED*/
static int
as_constructor(void *buf, void *cdrarg, int kmflags)
{
	struct as *as = buf;

	mutex_init(&as->a_contents, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&as->a_cv, NULL, CV_DEFAULT, NULL);
	rw_init(&as->a_lock, NULL, RW_DEFAULT, NULL);
	as_avlinit(as);
	return (0);
}

/*ARGSUSED1*/
static void
as_destructor(void *buf, void *cdrarg)
{
	struct as *as = buf;

	avl_destroy(&as->a_segtree);
	mutex_destroy(&as->a_contents);
	cv_destroy(&as->a_cv);
	rw_destroy(&as->a_lock);
}

void
as_init(void)
{
	as_cache = kmem_cache_create("as_cache", sizeof (struct as), 0,
	    as_constructor, as_destructor, NULL, NULL, NULL, 0);
}

/*
 * Allocate and initialize an address space data structure.
 * We call hat_alloc to allow any machine dependent
 * information in the hat structure to be initialized.
 */
struct as *
as_alloc(void)
{
	struct as *as;

	as = kmem_cache_alloc(as_cache, KM_SLEEP);

	as->a_flags		= 0;
	as->a_vbits		= 0;
	as->a_hrm		= NULL;
	as->a_seglast		= NULL;
	as->a_size		= 0;
	as->a_updatedir		= 0;
	gethrestime(&as->a_updatetime);
	as->a_objectdir		= NULL;
	as->a_sizedir		= 0;
	as->a_userlimit		= (caddr_t)USERLIMIT;
	as->a_lastgap		= NULL;
	as->a_lastgaphl		= NULL;
	as->a_callbacks		= NULL;

	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
	as->a_hat = hat_alloc(as);	/* create hat for default system mmu */
	AS_LOCK_EXIT(as, &as->a_lock);

	as->a_xhat = NULL;

	return (as);
}

/*
 * Free an address space data structure.
 * Need to free the hat first and then
 * all the segments on this as and finally
 * the space for the as struct itself.
 */
void
as_free(struct as *as)
{
	struct hat *hat = as->a_hat;
	struct seg *seg, *next;
	int called = 0;

top:
	/*
	 * Invoke ALL callbacks. as_do_callbacks will do one callback
	 * per call, and not return (-1) until the callback has completed.
	 * When as_do_callbacks returns zero, all callbacks have completed.
	 */
	mutex_enter(&as->a_contents);
	while (as->a_callbacks && as_do_callbacks(as, AS_ALL_EVENT, 0, 0))
		;

	/* This will prevent new XHATs from attaching to as */
	if (!called)
		AS_SETBUSY(as);
	mutex_exit(&as->a_contents);
	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);

	if (!called) {
		called = 1;
		hat_free_start(hat);
		if (as->a_xhat != NULL)
			xhat_free_start_all(as);
	}
	for (seg = AS_SEGFIRST(as); seg != NULL; seg = next) {
		int err;

		next = AS_SEGNEXT(as, seg);
		err = SEGOP_UNMAP(seg, seg->s_base, seg->s_size);
		if (err == EAGAIN) {
			mutex_enter(&as->a_contents);
			if (as->a_callbacks) {
				AS_LOCK_EXIT(as, &as->a_lock);
			} else {
				/*
				 * Memory is currently locked. Wait for a
				 * cv_signal that it has been unlocked, then
				 * try the operation again.
				 */
				if (AS_ISUNMAPWAIT(as) == 0)
					cv_broadcast(&as->a_cv);
				AS_SETUNMAPWAIT(as);
				AS_LOCK_EXIT(as, &as->a_lock);
				while (AS_ISUNMAPWAIT(as))
					cv_wait(&as->a_cv, &as->a_contents);
			}
			mutex_exit(&as->a_contents);
			goto top;
		} else {
			/*
			 * We do not expect any other error return at this
			 * time. This is similar to an ASSERT in seg_unmap()
			 */
			ASSERT(err == 0);
		}
	}
	hat_free_end(hat);
	if (as->a_xhat != NULL)
		xhat_free_end_all(as);
	AS_LOCK_EXIT(as, &as->a_lock);

	/* /proc stuff */
	ASSERT(avl_numnodes(&as->a_wpage) == 0);
	if (as->a_objectdir) {
		kmem_free(as->a_objectdir, as->a_sizedir * sizeof (vnode_t *));
		as->a_objectdir = NULL;
		as->a_sizedir = 0;
	}

	/*
	 * Free the struct as back to kmem.  Assert it has no segments.
	 */
	ASSERT(avl_numnodes(&as->a_segtree) == 0);
	kmem_cache_free(as_cache, as);
}

int
as_dup(struct as *as, struct as **outas)
{
	struct as *newas;
	struct seg *seg, *newseg;
	int error;

	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
	as_clearwatch(as);
	newas = as_alloc();
	newas->a_userlimit = as->a_userlimit;
	AS_LOCK_ENTER(newas, &newas->a_lock, RW_WRITER);

	/* This will prevent new XHATs from attaching */
	mutex_enter(&as->a_contents);
	AS_SETBUSY(as);
	mutex_exit(&as->a_contents);
	mutex_enter(&newas->a_contents);
	AS_SETBUSY(newas);
	mutex_exit(&newas->a_contents);

	(void) hat_dup(as->a_hat, newas->a_hat, NULL, 0, HAT_DUP_SRD);

	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {

		if (seg->s_flags & S_PURGE)
			continue;

		newseg = seg_alloc(newas, seg->s_base, seg->s_size);
		if (newseg == NULL) {
			AS_LOCK_EXIT(newas, &newas->a_lock);
			as_setwatch(as);
			mutex_enter(&as->a_contents);
			AS_CLRBUSY(as);
			mutex_exit(&as->a_contents);
			AS_LOCK_EXIT(as, &as->a_lock);
			as_free(newas);
			return (-1);
		}
		if ((error = SEGOP_DUP(seg, newseg)) != 0) {
			/*
			 * We call seg_free() on the new seg
			 * because the segment is not set up
			 * completely; i.e. it has no ops.
			 */
			as_setwatch(as);
			mutex_enter(&as->a_contents);
			AS_CLRBUSY(as);
			mutex_exit(&as->a_contents);
			AS_LOCK_EXIT(as, &as->a_lock);
			seg_free(newseg);
			AS_LOCK_EXIT(newas, &newas->a_lock);
			as_free(newas);
			return (error);
		}
		newas->a_size += seg->s_size;
	}

	error = hat_dup(as->a_hat, newas->a_hat, NULL, 0, HAT_DUP_ALL);
	if (as->a_xhat != NULL)
		error |= xhat_dup_all(as, newas, NULL, 0, HAT_DUP_ALL);

	mutex_enter(&newas->a_contents);
	AS_CLRBUSY(newas);
	mutex_exit(&newas->a_contents);
	AS_LOCK_EXIT(newas, &newas->a_lock);

	as_setwatch(as);
	mutex_enter(&as->a_contents);
	AS_CLRBUSY(as);
	mutex_exit(&as->a_contents);
	AS_LOCK_EXIT(as, &as->a_lock);
	if (error != 0) {
		as_free(newas);
		return (error);
	}
	*outas = newas;
	return (0);
}

/*
 * Handle a ``fault'' at addr for size bytes.
 */
faultcode_t
as_fault(struct hat *hat, struct as *as, caddr_t addr, size_t size,
	enum fault_type type, enum seg_rw rw)
{
	struct seg *seg;
	caddr_t raddr;			/* rounded down addr */
	size_t rsize;			/* rounded up size */
	size_t ssize;
	faultcode_t res = 0;
	caddr_t addrsav;
	struct seg *segsav;
	int as_lock_held;
	klwp_t *lwp = ttolwp(curthread);
	int is_xhat = 0;
	int holding_wpage = 0;
	extern struct seg_ops   segdev_ops;



	if (as->a_hat != hat) {
		/* This must be an XHAT then */
		is_xhat = 1;

		if ((type != F_INVAL) || (as == &kas))
			return (FC_NOSUPPORT);
	}

retry:
	if (!is_xhat) {
		/*
		 * Indicate that the lwp is not to be stopped while waiting
		 * for a pagefault.  This is to avoid deadlock while debugging
		 * a process via /proc over NFS (in particular).
		 */
		if (lwp != NULL)
			lwp->lwp_nostop++;

		/*
		 * same length must be used when we softlock and softunlock.
		 * We don't support softunlocking lengths less than
		 * the original length when there is largepage support.
		 * See seg_dev.c for more comments.
		 */
		switch (type) {

		case F_SOFTLOCK:
			CPU_STATS_ADD_K(vm, softlock, 1);
			break;

		case F_SOFTUNLOCK:
			break;

		case F_PROT:
			CPU_STATS_ADD_K(vm, prot_fault, 1);
			break;

		case F_INVAL:
			CPU_STATS_ENTER_K();
			CPU_STATS_ADDQ(CPU, vm, as_fault, 1);
			if (as == &kas)
				CPU_STATS_ADDQ(CPU, vm, kernel_asflt, 1);
			CPU_STATS_EXIT_K();
			break;
		}
	}

	/* Kernel probe */
	TNF_PROBE_3(address_fault, "vm pagefault", /* CSTYLED */,
	    tnf_opaque,	address,	addr,
	    tnf_fault_type,	fault_type,	type,
	    tnf_seg_access,	access,		rw);

	raddr = (caddr_t)((uintptr_t)addr & (uintptr_t)PAGEMASK);
	rsize = (((size_t)(addr + size) + PAGEOFFSET) & PAGEMASK) -
	    (size_t)raddr;

	/*
	 * XXX -- Don't grab the as lock for segkmap. We should grab it for
	 * correctness, but then we could be stuck holding this lock for
	 * a LONG time if the fault needs to be resolved on a slow
	 * filesystem, and then no-one will be able to exec new commands,
	 * as exec'ing requires the write lock on the as.
	 */
	if (as == &kas && segkmap && segkmap->s_base <= raddr &&
	    raddr + size < segkmap->s_base + segkmap->s_size) {
		/*
		 * if (as==&kas), this can't be XHAT: we've already returned
		 * FC_NOSUPPORT.
		 */
		seg = segkmap;
		as_lock_held = 0;
	} else {
		AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
		if (is_xhat && avl_numnodes(&as->a_wpage) != 0) {
			/*
			 * Grab and hold the writers' lock on the as
			 * if the fault is to a watched page.
			 * This will keep CPUs from "peeking" at the
			 * address range while we're temporarily boosting
			 * the permissions for the XHAT device to
			 * resolve the fault in the segment layer.
			 *
			 * We could check whether faulted address
			 * is within a watched page and only then grab
			 * the writer lock, but this is simpler.
			 */
			AS_LOCK_EXIT(as, &as->a_lock);
			AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
		}

		seg = as_segat(as, raddr);
		if (seg == NULL) {
			AS_LOCK_EXIT(as, &as->a_lock);
			if ((lwp != NULL) && (!is_xhat))
				lwp->lwp_nostop--;
			return (FC_NOMAP);
		}

		as_lock_held = 1;
	}

	addrsav = raddr;
	segsav = seg;

	for (; rsize != 0; rsize -= ssize, raddr += ssize) {
		if (raddr >= seg->s_base + seg->s_size) {
			seg = AS_SEGNEXT(as, seg);
			if (seg == NULL || raddr != seg->s_base) {
				res = FC_NOMAP;
				break;
			}
		}
		if (raddr + rsize > seg->s_base + seg->s_size)
			ssize = seg->s_base + seg->s_size - raddr;
		else
			ssize = rsize;

		if (!is_xhat || (seg->s_ops != &segdev_ops)) {

			if (is_xhat && avl_numnodes(&as->a_wpage) != 0 &&
			    pr_is_watchpage_as(raddr, rw, as)) {
				/*
				 * Handle watch pages.  If we're faulting on a
				 * watched page from an X-hat, we have to
				 * restore the original permissions while we
				 * handle the fault.
				 */
				as_clearwatch(as);
				holding_wpage = 1;
			}

			res = SEGOP_FAULT(hat, seg, raddr, ssize, type, rw);

			/* Restore watchpoints */
			if (holding_wpage) {
				as_setwatch(as);
				holding_wpage = 0;
			}

			if (res != 0)
				break;
		} else {
			/* XHAT does not support seg_dev */
			res = FC_NOSUPPORT;
			break;
		}
	}

	/*
	 * If we were SOFTLOCKing and encountered a failure,
	 * we must SOFTUNLOCK the range we already did. (Maybe we
	 * should just panic if we are SOFTLOCKing or even SOFTUNLOCKing
	 * right here...)
	 */
	if (res != 0 && type == F_SOFTLOCK) {
		for (seg = segsav; addrsav < raddr; addrsav += ssize) {
			if (addrsav >= seg->s_base + seg->s_size)
				seg = AS_SEGNEXT(as, seg);
			ASSERT(seg != NULL);
			/*
			 * Now call the fault routine again to perform the
			 * unlock using S_OTHER instead of the rw variable
			 * since we never got a chance to touch the pages.
			 */
			if (raddr > seg->s_base + seg->s_size)
				ssize = seg->s_base + seg->s_size - addrsav;
			else
				ssize = raddr - addrsav;
			(void) SEGOP_FAULT(hat, seg, addrsav, ssize,
			    F_SOFTUNLOCK, S_OTHER);
		}
	}
	if (as_lock_held)
		AS_LOCK_EXIT(as, &as->a_lock);
	if ((lwp != NULL) && (!is_xhat))
		lwp->lwp_nostop--;

	/*
	 * If the lower levels returned EDEADLK for a fault,
	 * It means that we should retry the fault.  Let's wait
	 * a bit also to let the deadlock causing condition clear.
	 * This is part of a gross hack to work around a design flaw
	 * in the ufs/sds logging code and should go away when the
	 * logging code is re-designed to fix the problem. See bug
	 * 4125102 for details of the problem.
	 */
	if (FC_ERRNO(res) == EDEADLK) {
		delay(deadlk_wait);
		res = 0;
		goto retry;
	}
	return (res);
}



/*
 * Asynchronous ``fault'' at addr for size bytes.
 */
faultcode_t
as_faulta(struct as *as, caddr_t addr, size_t size)
{
	struct seg *seg;
	caddr_t raddr;			/* rounded down addr */
	size_t rsize;			/* rounded up size */
	faultcode_t res = 0;
	klwp_t *lwp = ttolwp(curthread);

retry:
	/*
	 * Indicate that the lwp is not to be stopped while waiting
	 * for a pagefault.  This is to a