remove unnecessary uint_t casts of 0

[unleashed.git] / kernel / vm / seg_vn.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2015, Joyent, Inc. All rights reserved.
 * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
 */

/*      Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
/*        All Rights Reserved   */

/*
 * University Copyright- Copyright (c) 1982, 1986, 1988
 * The Regents of the University of California
 * All Rights Reserved
 *
 * University Acknowledgment- Portions of this document are derived from
 * software developed by the University of California, Berkeley, and its
 * contributors.
 */

/*
 * VM - shared or copy-on-write from a vnode/anonymous memory.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/t_lock.h>
#include <sys/errno.h>
#include <sys/systm.h>
#include <sys/mman.h>
#include <sys/debug.h>
#include <sys/cred.h>
#include <sys/vmsystm.h>
#include <sys/tuneable.h>
#include <sys/bitmap.h>
#include <sys/swap.h>
#include <sys/kmem.h>
#include <sys/sysmacros.h>
#include <sys/vtrace.h>
#include <sys/cmn_err.h>
#include <sys/callb.h>
#include <sys/vm.h>
#include <sys/dumphdr.h>
#include <sys/lgrp.h>

#include <vm/hat.h>
#include <vm/as.h>
#include <vm/seg.h>
#include <vm/seg_vn.h>
#include <vm/pvn.h>
#include <vm/anon.h>
#include <vm/page.h>
#include <vm/vpage.h>
#include <sys/proc.h>
#include <sys/task.h>
#include <sys/project.h>
#include <sys/zone.h>
#include <sys/shm_impl.h>

/*
 * segvn_fault needs a temporary page list array.  To avoid calling kmem all
 * the time, it creates a small (FAULT_TMP_PAGES_NUM entry) array and uses
 * it if it can.  In the rare case when this page list is not large enough,
 * it goes and gets a large enough array from kmem.
 */
#define FAULT_TMP_PAGES_NUM     0x8
#define FAULT_TMP_PAGES_SZ      ptob(FAULT_TMP_PAGES_NUM)

/*
 * Private seg op routines.
 */
static int      segvn_dup(struct seg *seg, struct seg *newseg);
static int      segvn_unmap(struct seg *seg, caddr_t addr, size_t len);
static void     segvn_free(struct seg *seg);
static faultcode_t segvn_fault(struct hat *hat, struct seg *seg,
                    caddr_t addr, size_t len, enum fault_type type,
                    enum seg_rw rw);
static faultcode_t segvn_faulta(struct seg *seg, caddr_t addr);
static int      segvn_setprot(struct seg *seg, caddr_t addr,
                    size_t len, uint_t prot);
static int      segvn_checkprot(struct seg *seg, caddr_t addr,
                    size_t len, uint_t prot);
static int      segvn_kluster(struct seg *seg, caddr_t addr, ssize_t delta);
static int      segvn_sync(struct seg *seg, caddr_t addr, size_t len,
                    int attr, uint_t flags);
static size_t   segvn_incore(struct seg *seg, caddr_t addr, size_t len,
                    char *vec);
static int      segvn_lockop(struct seg *seg, caddr_t addr, size_t len,
                    int attr, int op, ulong_t *lockmap, size_t pos);
static int      segvn_getprot(struct seg *seg, caddr_t addr, size_t len,
                    uint_t *protv);
static uoff_t   segvn_getoffset(struct seg *seg, caddr_t addr);
static int      segvn_gettype(struct seg *seg, caddr_t addr);
static int      segvn_getvp(struct seg *seg, caddr_t addr,
                    struct vnode **vpp);
static int      segvn_advise(struct seg *seg, caddr_t addr, size_t len,
                    uint_t behav);
static void     segvn_dump(struct seg *seg);
static int      segvn_pagelock(struct seg *seg, caddr_t addr, size_t len,
                    struct page ***ppp, enum lock_type type, enum seg_rw rw);
static int      segvn_setpagesize(struct seg *seg, caddr_t addr, size_t len,
                    uint_t szc);
static int      segvn_getmemid(struct seg *seg, caddr_t addr,
                    memid_t *memidp);
static lgrp_mem_policy_info_t   *segvn_getpolicy(struct seg *, caddr_t);
static int      segvn_inherit(struct seg *, caddr_t, size_t, uint_t);

const struct seg_ops segvn_ops = {
        .dup            = segvn_dup,
        .unmap          = segvn_unmap,
        .free           = segvn_free,
        .fault          = segvn_fault,
        .faulta         = segvn_faulta,
        .setprot        = segvn_setprot,
        .checkprot      = segvn_checkprot,
        .kluster        = segvn_kluster,
        .sync           = segvn_sync,
        .incore         = segvn_incore,
        .lockop         = segvn_lockop,
        .getprot        = segvn_getprot,
        .getoffset      = segvn_getoffset,
        .gettype        = segvn_gettype,
        .getvp          = segvn_getvp,
        .advise         = segvn_advise,
        .dump           = segvn_dump,
        .pagelock       = segvn_pagelock,
        .setpagesize    = segvn_setpagesize,
        .getmemid       = segvn_getmemid,
        .getpolicy      = segvn_getpolicy,
        .inherit        = segvn_inherit,
};

/*
 * Common zfod structures, provided as a shorthand for others to use.
 */
static segvn_crargs_t zfod_segvn_crargs =
        SEGVN_ZFOD_ARGS(PROT_ZFOD, PROT_ALL);
static segvn_crargs_t kzfod_segvn_crargs =
        SEGVN_ZFOD_ARGS(PROT_ZFOD & ~PROT_USER,
        PROT_ALL & ~PROT_USER);
static segvn_crargs_t stack_noexec_crargs =
        SEGVN_ZFOD_ARGS(PROT_ZFOD & ~PROT_EXEC, PROT_ALL);

caddr_t zfod_argsp = (caddr_t)&zfod_segvn_crargs;       /* user zfod argsp */
caddr_t kzfod_argsp = (caddr_t)&kzfod_segvn_crargs;     /* kernel zfod argsp */
caddr_t stack_exec_argsp = (caddr_t)&zfod_segvn_crargs; /* executable stack */
caddr_t stack_noexec_argsp = (caddr_t)&stack_noexec_crargs; /* noexec stack */

#define vpgtob(n)       ((n) * sizeof (struct vpage))   /* For brevity */

size_t  segvn_comb_thrshld = UINT_MAX;  /* patchable -- see 1196681 */

size_t  segvn_pglock_comb_thrshld = (1UL << 16);        /* 64K */
size_t  segvn_pglock_comb_balign = (1UL << 16);         /* 64K */
uint_t  segvn_pglock_comb_bshift;
size_t  segvn_pglock_comb_palign;

static int      segvn_concat(struct seg *, struct seg *, int);
static int      segvn_extend_prev(struct seg *, struct seg *,
                    struct segvn_crargs *, size_t);
static int      segvn_extend_next(struct seg *, struct seg *,
                    struct segvn_crargs *, size_t);
static void     segvn_softunlock(struct seg *, caddr_t, size_t, enum seg_rw);
static void     segvn_pagelist_rele(page_t **);
static void     segvn_setvnode_mpss(vnode_t *);
static void     segvn_relocate_pages(page_t **, page_t *);
static int      segvn_full_szcpages(page_t **, uint_t, int *, uint_t *);
static int      segvn_fill_vp_pages(struct segvn_data *, vnode_t *, uoff_t,
    uint_t, page_t **, page_t **, uint_t *, int *);
static faultcode_t segvn_fault_vnodepages(struct hat *, struct seg *, caddr_t,
    caddr_t, enum fault_type, enum seg_rw, caddr_t, caddr_t, int);
static faultcode_t segvn_fault_anonpages(struct hat *, struct seg *, caddr_t,
    caddr_t, enum fault_type, enum seg_rw, caddr_t, caddr_t, int);
static faultcode_t segvn_faultpage(struct hat *, struct seg *, caddr_t,
    uoff_t, struct vpage *, page_t **, uint_t,
    enum fault_type, enum seg_rw, int);
static void     segvn_vpage(struct seg *);
static size_t   segvn_count_swap_by_vpages(struct seg *);

static void segvn_purge(struct seg *seg);
static int segvn_reclaim(void *, caddr_t, size_t, struct page **,
    enum seg_rw, int);
static int shamp_reclaim(void *, caddr_t, size_t, struct page **,
    enum seg_rw, int);

static int sameprot(struct seg *, caddr_t, size_t);

static int segvn_demote_range(struct seg *, caddr_t, size_t, int, uint_t);
static int segvn_clrszc(struct seg *);
static struct seg *segvn_split_seg(struct seg *, caddr_t);
static int segvn_claim_pages(struct seg *, struct vpage *, uoff_t,
    ulong_t, uint_t);

static void segvn_hat_rgn_unload_callback(caddr_t, caddr_t, caddr_t,
    size_t, void *, uoff_t);

static struct kmem_cache *segvn_cache;
static struct kmem_cache **segvn_szc_cache;

#ifdef VM_STATS
static struct segvnvmstats_str {
        ulong_t fill_vp_pages[31];
        ulong_t fltvnpages[49];
        ulong_t fullszcpages[10];
        ulong_t relocatepages[3];
        ulong_t fltanpages[17];
        ulong_t pagelock[2];
        ulong_t demoterange[3];
} segvnvmstats;
#endif /* VM_STATS */

#define SDR_RANGE       1               /* demote entire range */
#define SDR_END         2               /* demote non aligned ends only */

#define CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr, lpgeaddr) {          \
                if ((len) != 0) {                                             \
                        lpgaddr = (caddr_t)P2ALIGN((uintptr_t)(addr), pgsz);  \
                        ASSERT(lpgaddr >= (seg)->s_base);                     \
                        lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)((addr) +    \
                            (len)), pgsz);                                    \
                        ASSERT(lpgeaddr > lpgaddr);                           \
                        ASSERT(lpgeaddr <= (seg)->s_base + (seg)->s_size);    \
                } else {                                                      \
                        lpgeaddr = lpgaddr = (addr);                          \
                }                                                             \
        }

/*ARGSUSED*/
static int
segvn_cache_constructor(void *buf, void *cdrarg, int kmflags)
{
        struct segvn_data *svd = buf;

        rw_init(&svd->lock, NULL, RW_DEFAULT, NULL);
        mutex_init(&svd->segfree_syncmtx, NULL, MUTEX_DEFAULT, NULL);
        svd->svn_trnext = svd->svn_trprev = NULL;
        return (0);
}

/*ARGSUSED1*/
static void
segvn_cache_destructor(void *buf, void *cdrarg)
{
        struct segvn_data *svd = buf;

        rw_destroy(&svd->lock);
        mutex_destroy(&svd->segfree_syncmtx);
}

/*ARGSUSED*/
static int
svntr_cache_constructor(void *buf, void *cdrarg, int kmflags)
{
        bzero(buf, sizeof (svntr_t));
        return (0);
}

/*
 * Patching this variable to non-zero allows the system to run with
 * stacks marked as "not executable".  It's a bit of a kludge, but is
 * provided as a tweakable for platforms that export those ABIs
 * (e.g. sparc V8) that have executable stacks enabled by default.
 * There are also some restrictions for platforms that don't actually
 * implement 'noexec' protections.
 *
 * Once enabled, the system is (therefore) unable to provide a fully
 * ABI-compliant execution environment, though practically speaking,
 * most everything works.  The exceptions are generally some interpreters
 * and debuggers that create executable code on the stack and jump
 * into it (without explicitly mprotecting the address range to include
 * PROT_EXEC).
 *
 * One important class of applications that are disabled are those
 * that have been transformed into malicious agents using one of the
 * numerous "buffer overflow" attacks.  See 4007890.
 */
int noexec_user_stack = 0;
int noexec_user_stack_log = 1;

int segvn_lpg_disable = 0;
uint_t segvn_maxpgszc = 0;

ulong_t segvn_vmpss_clrszc_cnt;
ulong_t segvn_vmpss_clrszc_err;
ulong_t segvn_fltvnpages_clrszc_cnt;
ulong_t segvn_fltvnpages_clrszc_err;
ulong_t segvn_setpgsz_align_err;
ulong_t segvn_setpgsz_anon_align_err;
ulong_t segvn_setpgsz_getattr_err;
ulong_t segvn_setpgsz_eof_err;
ulong_t segvn_faultvnmpss_align_err1;
ulong_t segvn_faultvnmpss_align_err2;
ulong_t segvn_faultvnmpss_align_err3;
ulong_t segvn_faultvnmpss_align_err4;
ulong_t segvn_faultvnmpss_align_err5;
ulong_t segvn_vmpss_pageio_deadlk_err;

int segvn_use_regions = 1;

/*
 * Segvn supports text replication optimization for NUMA platforms. Text
 * replica's are represented by anon maps (amp). There's one amp per text file
 * region per lgroup. A process chooses the amp for each of its text mappings
 * based on the lgroup assignment of its main thread (t_tid = 1). All
 * processes that want a replica on a particular lgroup for the same text file
 * mapping share the same amp. amp's are looked up in svntr_hashtab hash table
 * with vp,off,size,szc used as a key. Text replication segments are read only
 * MAP_PRIVATE|MAP_TEXT segments that map vnode. Replication is achieved by
 * forcing COW faults from vnode to amp and mapping amp pages instead of vnode
 * pages. Replication amp is assigned to a segment when it gets its first
 * pagefault. To handle main thread lgroup rehoming segvn_trasync_thread
 * rechecks periodically if the process still maps an amp local to the main
 * thread. If not async thread forces process to remap to an amp in the new
 * home lgroup of the main thread. Current text replication implementation
 * only provides the benefit to workloads that do most of their work in the
 * main thread of a process or all the threads of a process run in the same
 * lgroup. To extend text replication benefit to different types of
 * multithreaded workloads further work would be needed in the hat layer to
 * allow the same virtual address in the same hat to simultaneously map
 * different physical addresses (i.e. page table replication would be needed
 * for x86).
 *
 * amp pages are used instead of vnode pages as long as segment has a very
 * simple life cycle.  It's created via segvn_create(), handles S_EXEC
 * (S_READ) pagefaults and is fully unmapped.  If anything more complicated
 * happens such as protection is changed, real COW fault happens, pagesize is
 * changed, MC_LOCK is requested or segment is partially unmapped we turn off
 * text replication by converting the segment back to vnode only segment
 * (unmap segment's address range and set svd->amp to NULL).
 *
 * The original file can be changed after amp is inserted into
 * svntr_hashtab. Processes that are launched after the file is already
 * changed can't use the replica's created prior to the file change. To
 * implement this functionality hash entries are timestamped. Replica's can
 * only be used if current file modification time is the same as the timestamp
 * saved when hash entry was created. However just timestamps alone are not
 * sufficient to detect file modification via mmap(MAP_SHARED) mappings. We
 * deal with file changes via MAP_SHARED mappings differently. When writable
 * MAP_SHARED mappings are created to vnodes marked as executable we mark all
 * existing replica's for this vnode as not usable for future text
 * mappings. And we don't create new replica's for files that currently have
 * potentially writable MAP_SHARED mappings (i.e. vn_is_mapped(V_WRITE) is
 * true).
 */

#define SEGVN_TEXTREPL_MAXBYTES_FACTOR  (20)
size_t  segvn_textrepl_max_bytes_factor = SEGVN_TEXTREPL_MAXBYTES_FACTOR;

static ulong_t                  svntr_hashtab_sz = 512;
static svntr_bucket_t           *svntr_hashtab = NULL;
static struct kmem_cache        *svntr_cache;
static svntr_stats_t            *segvn_textrepl_stats;
static ksema_t                  segvn_trasync_sem;

int                             segvn_disable_textrepl = 1;
size_t                          textrepl_size_thresh = (size_t)-1;
size_t                          segvn_textrepl_bytes = 0;
size_t                          segvn_textrepl_max_bytes = 0;
clock_t                         segvn_update_textrepl_interval = 0;
int                             segvn_update_tr_time = 10;
int                             segvn_disable_textrepl_update = 0;

static void segvn_textrepl(struct seg *);
static void segvn_textunrepl(struct seg *, int);
static void segvn_inval_trcache(vnode_t *);
static void segvn_trasync_thread(void);
static void segvn_trupdate_wakeup(void *);
static void segvn_trupdate(void);
static void segvn_trupdate_seg(struct seg *, segvn_data_t *, svntr_t *,
    ulong_t);

/*
 * Initialize segvn data structures
 */
void
segvn_init(void)
{
        uint_t maxszc;
        uint_t szc;
        size_t pgsz;

        segvn_cache = kmem_cache_create("segvn_cache",
            sizeof (struct segvn_data), 0,
            segvn_cache_constructor, segvn_cache_destructor, NULL,
            NULL, NULL, 0);

        if (segvn_lpg_disable == 0) {
                szc = maxszc = page_num_pagesizes() - 1;
                if (szc == 0) {
                        segvn_lpg_disable = 1;
                }
                if (page_get_pagesize(0) != PAGESIZE) {
                        panic("segvn_init: bad szc 0");
                        /*NOTREACHED*/
                }
                while (szc != 0) {
                        pgsz = page_get_pagesize(szc);
                        if (pgsz <= PAGESIZE || !IS_P2ALIGNED(pgsz, pgsz)) {
                                panic("segvn_init: bad szc %d", szc);
                                /*NOTREACHED*/
                        }
                        szc--;
                }
                if (segvn_maxpgszc == 0 || segvn_maxpgszc > maxszc)
                        segvn_maxpgszc = maxszc;
        }

        if (segvn_maxpgszc) {
                segvn_szc_cache = (struct kmem_cache **)kmem_alloc(
                    (segvn_maxpgszc + 1) * sizeof (struct kmem_cache *),
                    KM_SLEEP);
        }

        for (szc = 1; szc <= segvn_maxpgszc; szc++) {
                char    str[32];

                (void) sprintf(str, "segvn_szc_cache%d", szc);
                segvn_szc_cache[szc] = kmem_cache_create(str,
                    page_get_pagecnt(szc) * sizeof (page_t *), 0,
                    NULL, NULL, NULL, NULL, NULL, KMC_NODEBUG);
        }


        if (segvn_use_regions && !hat_supported(HAT_SHARED_REGIONS, NULL))
                segvn_use_regions = 0;

        /*
         * For now shared regions and text replication segvn support
         * are mutually exclusive. This is acceptable because
         * currently significant benefit from text replication was
         * only observed on AMD64 NUMA platforms (due to relatively
         * small L2$ size) and currently we don't support shared
         * regions on x86.
         */
        if (segvn_use_regions && !segvn_disable_textrepl) {
                segvn_disable_textrepl = 1;
        }

#if defined(_LP64)
        if (lgrp_optimizations() && textrepl_size_thresh != (size_t)-1 &&
            !segvn_disable_textrepl) {
                ulong_t i;
                size_t hsz = svntr_hashtab_sz * sizeof (svntr_bucket_t);

                svntr_cache = kmem_cache_create("svntr_cache",
                    sizeof (svntr_t), 0, svntr_cache_constructor, NULL,
                    NULL, NULL, NULL, 0);
                svntr_hashtab = kmem_zalloc(hsz, KM_SLEEP);
                for (i = 0; i < svntr_hashtab_sz; i++) {
                        mutex_init(&svntr_hashtab[i].tr_lock,  NULL,
                            MUTEX_DEFAULT, NULL);
                }
                segvn_textrepl_max_bytes = ptob(physmem) /
                    segvn_textrepl_max_bytes_factor;
                segvn_textrepl_stats = kmem_zalloc(NCPU *
                    sizeof (svntr_stats_t), KM_SLEEP);
                sema_init(&segvn_trasync_sem, 0, NULL, SEMA_DEFAULT, NULL);
                (void) thread_create(NULL, 0, segvn_trasync_thread,
                    NULL, 0, &p0, TS_RUN, minclsyspri);
        }
#endif

        if (!ISP2(segvn_pglock_comb_balign) ||
            segvn_pglock_comb_balign < PAGESIZE) {
                segvn_pglock_comb_balign = 1UL << 16; /* 64K */
        }
        segvn_pglock_comb_bshift = highbit(segvn_pglock_comb_balign) - 1;
        segvn_pglock_comb_palign = btop(segvn_pglock_comb_balign);
}

#define SEGVN_PAGEIO    ((void *)0x1)
#define SEGVN_NOPAGEIO  ((void *)0x2)

static void
segvn_setvnode_mpss(vnode_t *vp)
{
        int err;

        ASSERT(vp->v_mpssdata == NULL ||
            vp->v_mpssdata == SEGVN_PAGEIO ||
            vp->v_mpssdata == SEGVN_NOPAGEIO);

        if (vp->v_mpssdata == NULL) {
                if (vn_vmpss_usepageio(vp)) {
                        err = fop_pageio(vp, NULL,
                            0, 0, 0, CRED(), NULL);
                } else {
                        err = ENOSYS;
                }
                /*
                 * set v_mpssdata just once per vnode life
                 * so that it never changes.
                 */
                mutex_enter(&vp->v_lock);
                if (vp->v_mpssdata == NULL) {
                        if (err == EINVAL) {
                                vp->v_mpssdata = SEGVN_PAGEIO;
                        } else {
                                vp->v_mpssdata = SEGVN_NOPAGEIO;
                        }
                }
                mutex_exit(&vp->v_lock);
        }
}

int
segvn_create(struct seg *seg, void *argsp)
{
        extern lgrp_mem_policy_t lgrp_mem_default_policy;
        struct segvn_crargs *a = (struct segvn_crargs *)argsp;
        struct segvn_data *svd;
        size_t swresv = 0;
        struct cred *cred;
        struct anon_map *amp;
        int error = 0;
        size_t pgsz;
        lgrp_mem_policy_t mpolicy = lgrp_mem_default_policy;
        int use_rgn = 0;
        int trok = 0;

        ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));

        if (a->type != MAP_PRIVATE && a->type != MAP_SHARED) {
                panic("segvn_create type");
                /*NOTREACHED*/
        }

        /*
         * Check arguments.  If a shared anon structure is given then
         * it is illegal to also specify a vp.
         */
        if (a->amp != NULL && a->vp != NULL) {
                panic("segvn_create anon_map");
                /*NOTREACHED*/
        }

        if (a->type == MAP_PRIVATE && (a->flags & MAP_TEXT) &&
            a->vp != NULL && a->prot == (PROT_USER | PROT_READ | PROT_EXEC) &&
            segvn_use_regions) {
                use_rgn = 1;
        }

        /* MAP_NORESERVE on a MAP_SHARED segment is meaningless. */
        if (a->type == MAP_SHARED)
                a->flags &= ~MAP_NORESERVE;

        if (a->szc != 0) {
                if (segvn_lpg_disable != 0 || (a->szc == AS_MAP_NO_LPOOB) ||
                    (a->amp != NULL && a->type == MAP_PRIVATE) ||
                    (a->flags & MAP_NORESERVE) || seg->s_as == &kas) {
                        a->szc = 0;
                } else {
                        if (a->szc > segvn_maxpgszc)
                                a->szc = segvn_maxpgszc;
                        pgsz = page_get_pagesize(a->szc);
                        if (!IS_P2ALIGNED(seg->s_base, pgsz) ||
                            !IS_P2ALIGNED(seg->s_size, pgsz)) {
                                a->szc = 0;
                        } else if (a->vp != NULL) {
                                if (IS_SWAPFSVP(a->vp) || VN_ISKAS(a->vp)) {
                                        /*
                                         * paranoid check.
                                         * hat_page_demote() is not supported
                                         * on swapfs pages.
                                         */
                                        a->szc = 0;
                                } else if (map_addr_vacalign_check(seg->s_base,
                                    a->offset & PAGEMASK)) {
                                        a->szc = 0;
                                }
                        } else if (a->amp != NULL) {
                                pgcnt_t anum = btopr(a->offset);
                                pgcnt_t pgcnt = page_get_pagecnt(a->szc);
                                if (!IS_P2ALIGNED(anum, pgcnt)) {
                                        a->szc = 0;
                                }
                        }
                }
        }

        /*
         * If segment may need private pages, reserve them now.
         */
        if (!(a->flags & MAP_NORESERVE) && ((a->vp == NULL && a->amp == NULL) ||
            (a->type == MAP_PRIVATE && (a->prot & PROT_WRITE)))) {
                if (anon_resv_zone(seg->s_size,
                    seg->s_as->a_proc->p_zone) == 0)
                        return (EAGAIN);
                swresv = seg->s_size;
        }

        /*
         * Reserve any mapping structures that may be required.
         *
         * Don't do it for segments that may use regions. It's currently a
         * noop in the hat implementations anyway.
         */
        if (!use_rgn) {
                hat_map(seg->s_as->a_hat, seg->s_base, seg->s_size, HAT_MAP);
        }

        if (a->cred) {
                cred = a->cred;
                crhold(cred);
        } else {
                crhold(cred = CRED());
        }

        /* Inform the vnode of the new mapping */
        if (a->vp != NULL) {
                error = fop_addmap(a->vp, a->offset & PAGEMASK,
                    seg->s_as, seg->s_base, seg->s_size, a->prot,
                    a->maxprot, a->type, cred, NULL);
                if (error) {
                        if (swresv != 0) {
                                anon_unresv_zone(swresv,
                                    seg->s_as->a_proc->p_zone);
                        }
                        crfree(cred);
                        if (!use_rgn) {
                                hat_unload(seg->s_as->a_hat, seg->s_base,
                                    seg->s_size, HAT_UNLOAD_UNMAP);
                        }
                        return (error);
                }
                /*
                 * svntr_hashtab will be NULL if we support shared regions.
                 */
                trok = ((a->flags & MAP_TEXT) &&
                    (seg->s_size > textrepl_size_thresh ||
                    (a->flags & _MAP_TEXTREPL)) &&
                    lgrp_optimizations() && svntr_hashtab != NULL &&
                    a->type == MAP_PRIVATE && swresv == 0 &&
                    !(a->flags & MAP_NORESERVE) &&
                    seg->s_as != &kas && a->vp->v_type == VREG);

                ASSERT(!trok || !use_rgn);
        }

        /*
         * MAP_NORESERVE mappings don't count towards the VSZ of a process
         * until we fault the pages in.
         */
        if ((a->vp == NULL || a->vp->v_type != VREG) &&
            a->flags & MAP_NORESERVE) {
                seg->s_as->a_resvsize -= seg->s_size;
        }

        /*
         * If more than one segment in the address space, and they're adjacent
         * virtually, try to concatenate them.  Don't concatenate if an
         * explicit anon_map structure was supplied (e.g., SystemV shared
         * memory) or if we'll use text replication for this segment.
         */
        if (a->amp == NULL && !use_rgn && !trok) {
                struct seg *pseg, *nseg;
                struct segvn_data *psvd, *nsvd;
                lgrp_mem_policy_t ppolicy, npolicy;
                uint_t  lgrp_mem_policy_flags = 0;

                /*
                 * Memory policy flags (lgrp_mem_policy_flags) is valid when
                 * extending stack/heap segments.
                 */
                if ((a->vp == NULL) && (a->type == MAP_PRIVATE) &&
                    !(a->flags & MAP_NORESERVE) && (seg->s_as != &kas)) {
                        lgrp_mem_policy_flags = a->lgrp_mem_policy_flags;
                } else {
                        /*
                         * Get policy when not extending it from another segment
                         */
                        mpolicy = lgrp_mem_policy_default(seg->s_size, a->type);
                }

                /*
                 * First, try to concatenate the previous and new segments
                 */
                pseg = AS_SEGPREV(seg->s_as, seg);
                if (pseg != NULL &&
                    pseg->s_base + pseg->s_size == seg->s_base &&
                    pseg->s_ops == &segvn_ops) {
                        /*
                         * Get memory allocation policy from previous segment.
                         * When extension is specified (e.g. for heap) apply
                         * this policy to the new segment regardless of the
                         * outcome of segment concatenation.  Extension occurs
                         * for non-default policy otherwise default policy is
                         * used and is based on extended segment size.
                         */
                        psvd = (struct segvn_data *)pseg->s_data;
                        ppolicy = psvd->policy_info.mem_policy;
                        if (lgrp_mem_policy_flags ==
                            LGRP_MP_FLAG_EXTEND_UP) {
                                if (ppolicy != lgrp_mem_default_policy) {
                                        mpolicy = ppolicy;
                                } else {
                                        mpolicy = lgrp_mem_policy_default(
                                            pseg->s_size + seg->s_size,
                                            a->type);
                                }
                        }

                        if (mpolicy == ppolicy &&
                            (pseg->s_size + seg->s_size <=
                            segvn_comb_thrshld || psvd->amp == NULL) &&
                            segvn_extend_prev(pseg, seg, a, swresv) == 0) {
                                /*
                                 * success! now try to concatenate
                                 * with following seg
                                 */
                                crfree(cred);
                                nseg = AS_SEGNEXT(pseg->s_as, pseg);
                                if (nseg != NULL &&
                                    nseg != pseg &&
                                    nseg->s_ops == &segvn_ops &&
                                    pseg->s_base + pseg->s_size ==
                                    nseg->s_base)
                                        (void) segvn_concat(pseg, nseg, 0);
                                ASSERT(pseg->s_szc == 0 ||
                                    (a->szc == pseg->s_szc &&
                                    IS_P2ALIGNED(pseg->s_base, pgsz) &&
                                    IS_P2ALIGNED(pseg->s_size, pgsz)));
                                return (0);
                        }
                }

                /*
                 * Failed, so try to concatenate with following seg
                 */
                nseg = AS_SEGNEXT(seg->s_as, seg);
                if (nseg != NULL &&
                    seg->s_base + seg->s_size == nseg->s_base &&
                    nseg->s_ops == &segvn_ops) {
                        /*
                         * Get memory allocation policy from next segment.
                         * When extension is specified (e.g. for stack) apply
                         * this policy to the new segment regardless of the
                         * outcome of segment concatenation.  Extension occurs
                         * for non-default policy otherwise default policy is
                         * used and is based on extended segment size.
                         */
                        nsvd = (struct segvn_data *)nseg->s_data;
                        npolicy = nsvd->policy_info.mem_policy;
                        if (lgrp_mem_policy_flags ==
                            LGRP_MP_FLAG_EXTEND_DOWN) {
                                if (npolicy != lgrp_mem_default_policy) {
                                        mpolicy = npolicy;
                                } else {
                                        mpolicy = lgrp_mem_policy_default(
                                            nseg->s_size + seg->s_size,
                                            a->type);
                                }
                        }

                        if (mpolicy == npolicy &&
                            segvn_extend_next(seg, nseg, a, swresv) == 0) {
                                crfree(cred);
                                ASSERT(nseg->s_szc == 0 ||
                                    (a->szc == nseg->s_szc &&
                                    IS_P2ALIGNED(nseg->s_base, pgsz) &&
                                    IS_P2ALIGNED(nseg->s_size, pgsz)));
                                return (0);
                        }
                }
        }

        if (a->vp != NULL) {
                VN_HOLD(a->vp);
                if (a->type == MAP_SHARED)
                        lgrp_shm_policy_init(NULL, a->vp);
        }
        svd = kmem_cache_alloc(segvn_cache, KM_SLEEP);

        seg->s_ops = &segvn_ops;
        seg->s_data = (void *)svd;
        seg->s_szc = a->szc;

        svd->seg = seg;
        svd->vp = a->vp;
        /*
         * Anonymous mappings have no backing file so the offset is meaningless.
         */
        svd->offset = a->vp ? (a->offset & PAGEMASK) : 0;
        svd->prot = a->prot;
        svd->maxprot = a->maxprot;
        svd->pageprot = 0;
        svd->type = a->type;
        svd->vpage = NULL;
        svd->cred = cred;
        svd->advice = MADV_NORMAL;
        svd->pageadvice = 0;
        svd->flags = (ushort_t)a->flags;
        svd->softlockcnt = 0;
        svd->softlockcnt_sbase = 0;
        svd->softlockcnt_send = 0;
        svd->svn_inz = 0;
        svd->rcookie = HAT_INVALID_REGION_COOKIE;
        svd->pageswap = 0;

        if (a->szc != 0 && a->vp != NULL) {
                segvn_setvnode_mpss(a->vp);
        }
        if (svd->type == MAP_SHARED && svd->vp != NULL &&
            (svd->vp->v_flag & VVMEXEC) && (svd->prot & PROT_WRITE)) {
                ASSERT(vn_is_mapped(svd->vp, V_WRITE));
                segvn_inval_trcache(svd->vp);
        }

        amp = a->amp;
        if ((svd->amp = amp) == NULL) {
                svd->anon_index = 0;
                if (svd->type == MAP_SHARED) {
                        svd->swresv = 0;
                        /*
                         * Shared mappings to a vp need no other setup.
                         * If we have a shared mapping to an anon_map object
                         * which hasn't been allocated yet,  allocate the
                         * struct now so that it will be properly shared
                         * by remembering the swap reservation there.
                         */
                        if (a->vp == NULL) {
                                svd->amp = anonmap_alloc(seg->s_size, swresv,
                                    ANON_SLEEP);
                                svd->amp->a_szc = seg->s_szc;
                        }
                } else {
                        /*
                         * Private mapping (with or without a vp).
                         * Allocate anon_map when needed.
                         */
                        svd->swresv = swresv;
                }
        } else {
                pgcnt_t anon_num;

                /*
                 * Mapping to an existing anon_map structure without a vp.
                 * For now we will insure that the segment size isn't larger
                 * than the size - offset gives us.  Later on we may wish to
                 * have the anon array dynamically allocated itself so that
                 * we don't always have to allocate all the anon pointer slots.
                 * This of course involves adding extra code to check that we
                 * aren't trying to use an anon pointer slot beyond the end
                 * of the currently allocated anon array.
                 */
                if ((amp->size - a->offset) < seg->s_size) {
                        panic("segvn_create anon_map size");
                        /*NOTREACHED*/
                }

                anon_num = btopr(a->offset);

                if (a->type == MAP_SHARED) {
                        /*
                         * SHARED mapping to a given anon_map.
                         */
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        amp->refcnt++;
                        if (a->szc > amp->a_szc) {
                                amp->a_szc = a->szc;
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        svd->anon_index = anon_num;
                        svd->swresv = 0;
                } else {
                        /*
                         * PRIVATE mapping to a given anon_map.
                         * Make sure that all the needed anon
                         * structures are created (so that we will
                         * share the underlying pages if nothing
                         * is written by this mapping) and then
                         * duplicate the anon array as is done
                         * when a privately mapped segment is dup'ed.
                         */
                        struct anon *ap;
                        caddr_t addr;
                        caddr_t eaddr;
                        ulong_t anon_idx;
                        int hat_flag = HAT_LOAD;

                        if (svd->flags & MAP_TEXT) {
                                hat_flag |= HAT_LOAD_TEXT;
                        }

                        svd->amp = anonmap_alloc(seg->s_size, 0, ANON_SLEEP);
                        svd->amp->a_szc = seg->s_szc;
                        svd->anon_index = 0;
                        svd->swresv = swresv;

                        /*
                         * Prevent 2 threads from allocating anon
                         * slots simultaneously.
                         */
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        eaddr = seg->s_base + seg->s_size;

                        for (anon_idx = anon_num, addr = seg->s_base;
                            addr < eaddr; addr += PAGESIZE, anon_idx++) {
                                page_t *pp;

                                if ((ap = anon_get_ptr(amp->ahp,
                                    anon_idx)) != NULL)
                                        continue;

                                /*
                                 * Allocate the anon struct now.
                                 * Might as well load up translation
                                 * to the page while we're at it...
                                 */
                                pp = anon_zero(seg, addr, &ap, cred);
                                if (ap == NULL || pp == NULL) {
                                        panic("segvn_create anon_zero");
                                        /*NOTREACHED*/
                                }

                                /*
                                 * Re-acquire the anon_map lock and
                                 * initialize the anon array entry.
                                 */
                                ASSERT(anon_get_ptr(amp->ahp,
                                    anon_idx) == NULL);
                                (void) anon_set_ptr(amp->ahp, anon_idx, ap,
                                    ANON_SLEEP);

                                ASSERT(seg->s_szc == 0);
                                ASSERT(!IS_VMODSORT(pp->p_vnode));

                                ASSERT(use_rgn == 0);
                                hat_memload(seg->s_as->a_hat, addr, pp,
                                    svd->prot & ~PROT_WRITE, hat_flag);

                                page_unlock(pp);
                        }
                        ASSERT(seg->s_szc == 0);
                        anon_dup(amp->ahp, anon_num, svd->amp->ahp,
                            0, seg->s_size);
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }
        }

        /*
         * Set default memory allocation policy for segment
         *
         * Always set policy for private memory at least for initialization
         * even if this is a shared memory segment
         */
        (void) lgrp_privm_policy_set(mpolicy, &svd->policy_info, seg->s_size);

        if (svd->type == MAP_SHARED)
                (void) lgrp_shm_policy_set(mpolicy, svd->amp, svd->anon_index,
                    svd->vp, svd->offset, seg->s_size);

        if (use_rgn) {
                ASSERT(!trok);
                ASSERT(svd->amp == NULL);
                svd->rcookie = hat_join_region(seg->s_as->a_hat, seg->s_base,
                    seg->s_size, (void *)svd->vp, svd->offset, svd->prot,
                    (uchar_t)seg->s_szc, segvn_hat_rgn_unload_callback,
                    HAT_REGION_TEXT);
        }

        ASSERT(!trok || !(svd->prot & PROT_WRITE));
        svd->tr_state = trok ? SEGVN_TR_INIT : SEGVN_TR_OFF;

        return (0);
}

/*
 * Concatenate two existing segments, if possible.
 * Return 0 on success, -1 if two segments are not compatible
 * or -2 on memory allocation failure.
 * If amp_cat == 1 then try and concat segments with anon maps
 */
static int
segvn_concat(struct seg *seg1, struct seg *seg2, int amp_cat)
{
        struct segvn_data *svd1 = seg1->s_data;
        struct segvn_data *svd2 = seg2->s_data;
        struct anon_map *amp1 = svd1->amp;
        struct anon_map *amp2 = svd2->amp;
        struct vpage *vpage1 = svd1->vpage;
        struct vpage *vpage2 = svd2->vpage, *nvpage = NULL;
        size_t size, nvpsize;
        pgcnt_t npages1, npages2;

        ASSERT(seg1->s_as && seg2->s_as && seg1->s_as == seg2->s_as);
        ASSERT(AS_WRITE_HELD(seg1->s_as));
        ASSERT(seg1->s_ops == seg2->s_ops);

        if (HAT_IS_REGION_COOKIE_VALID(svd1->rcookie) ||
            HAT_IS_REGION_COOKIE_VALID(svd2->rcookie)) {
                return (-1);
        }

        /* both segments exist, try to merge them */
#define incompat(x)     (svd1->x != svd2->x)
        if (incompat(vp) || incompat(maxprot) ||
            (!svd1->pageadvice && !svd2->pageadvice && incompat(advice)) ||
            (!svd1->pageprot && !svd2->pageprot && incompat(prot)) ||
            incompat(type) || incompat(cred) || incompat(flags) ||
            seg1->s_szc != seg2->s_szc || incompat(policy_info.mem_policy) ||
            (svd2->softlockcnt > 0) || svd1->softlockcnt_send > 0)
                return (-1);
#undef incompat

        /*
         * vp == NULL implies zfod, offset doesn't matter
         */
        if (svd1->vp != NULL &&
            svd1->offset + seg1->s_size != svd2->offset) {
                return (-1);
        }

        /*
         * Don't concatenate if either segment uses text replication.
         */
        if (svd1->tr_state != SEGVN_TR_OFF || svd2->tr_state != SEGVN_TR_OFF) {
                return (-1);
        }

        /*
         * Fail early if we're not supposed to concatenate
         * segments with non NULL amp.
         */
        if (amp_cat == 0 && (amp1 != NULL || amp2 != NULL)) {
                return (-1);
        }

        if (svd1->vp == NULL && svd1->type == MAP_SHARED) {
                if (amp1 != amp2) {
                        return (-1);
                }
                if (amp1 != NULL && svd1->anon_index + btop(seg1->s_size) !=
                    svd2->anon_index) {
                        return (-1);
                }
                ASSERT(amp1 == NULL || amp1->refcnt >= 2);
        }

        /*
         * If either seg has vpages, create a new merged vpage array.
         */
        if (vpage1 != NULL || vpage2 != NULL) {
                struct vpage *vp, *evp;

                npages1 = seg_pages(seg1);
                npages2 = seg_pages(seg2);
                nvpsize = vpgtob(npages1 + npages2);

                if ((nvpage = kmem_zalloc(nvpsize, KM_NOSLEEP)) == NULL) {
                        return (-2);
                }

                if (vpage1 != NULL) {
                        bcopy(vpage1, nvpage, vpgtob(npages1));
                } else {
                        evp = nvpage + npages1;
                        for (vp = nvpage; vp < evp; vp++) {
                                VPP_SETPROT(vp, svd1->prot);
                                VPP_SETADVICE(vp, svd1->advice);
                        }
                }

                if (vpage2 != NULL) {
                        bcopy(vpage2, nvpage + npages1, vpgtob(npages2));
                } else {
                        evp = nvpage + npages1 + npages2;
                        for (vp = nvpage + npages1; vp < evp; vp++) {
                                VPP_SETPROT(vp, svd2->prot);
                                VPP_SETADVICE(vp, svd2->advice);
                        }
                }

                if (svd2->pageswap && (!svd1->pageswap && svd1->swresv)) {
                        ASSERT(svd1->swresv == seg1->s_size);
                        ASSERT(!(svd1->flags & MAP_NORESERVE));
                        ASSERT(!(svd2->flags & MAP_NORESERVE));
                        evp = nvpage + npages1;
                        for (vp = nvpage; vp < evp; vp++) {
                                VPP_SETSWAPRES(vp);
                        }
                }

                if (svd1->pageswap && (!svd2->pageswap && svd2->swresv)) {
                        ASSERT(svd2->swresv == seg2->s_size);
                        ASSERT(!(svd1->flags & MAP_NORESERVE));
                        ASSERT(!(svd2->flags & MAP_NORESERVE));
                        vp = nvpage + npages1;
                        evp = vp + npages2;
                        for (; vp < evp; vp++) {
                                VPP_SETSWAPRES(vp);
                        }
                }
        }
        ASSERT((vpage1 != NULL || vpage2 != NULL) ||
            (svd1->pageswap == 0 && svd2->pageswap == 0));

        /*
         * If either segment has private pages, create a new merged anon
         * array. If mergeing shared anon segments just decrement anon map's
         * refcnt.
         */
        if (amp1 != NULL && svd1->type == MAP_SHARED) {
                ASSERT(amp1 == amp2 && svd1->vp == NULL);
                ANON_LOCK_ENTER(&amp1->a_rwlock, RW_WRITER);
                ASSERT(amp1->refcnt >= 2);
                amp1->refcnt--;
                ANON_LOCK_EXIT(&amp1->a_rwlock);
                svd2->amp = NULL;
        } else if (amp1 != NULL || amp2 != NULL) {
                struct anon_hdr *nahp;
                struct anon_map *namp = NULL;
                size_t asize;

                ASSERT(svd1->type == MAP_PRIVATE);

                asize = seg1->s_size + seg2->s_size;
                if ((nahp = anon_create(btop(asize), ANON_NOSLEEP)) == NULL) {
                        if (nvpage != NULL) {
                                kmem_free(nvpage, nvpsize);
                        }
                        return (-2);
                }
                if (amp1 != NULL) {
                        /*
                         * XXX anon rwlock is not really needed because
                         * this is a private segment and we are writers.
                         */
                        ANON_LOCK_ENTER(&amp1->a_rwlock, RW_WRITER);
                        ASSERT(amp1->refcnt == 1);
                        if (anon_copy_ptr(amp1->ahp, svd1->anon_index,
                            nahp, 0, btop(seg1->s_size), ANON_NOSLEEP)) {
                                anon_release(nahp, btop(asize));
                                ANON_LOCK_EXIT(&amp1->a_rwlock);
                                if (nvpage != NULL) {
                                        kmem_free(nvpage, nvpsize);
                                }
                                return (-2);
                        }
                }
                if (amp2 != NULL) {
                        ANON_LOCK_ENTER(&amp2->a_rwlock, RW_WRITER);
                        ASSERT(amp2->refcnt == 1);
                        if (anon_copy_ptr(amp2->ahp, svd2->anon_index,
                            nahp, btop(seg1->s_size), btop(seg2->s_size),
                            ANON_NOSLEEP)) {
                                anon_release(nahp, btop(asize));
                                ANON_LOCK_EXIT(&amp2->a_rwlock);
                                if (amp1 != NULL) {
                                        ANON_LOCK_EXIT(&amp1->a_rwlock);
                                }
                                if (nvpage != NULL) {
                                        kmem_free(nvpage, nvpsize);
                                }
                                return (-2);
                        }
                }
                if (amp1 != NULL) {
                        namp = amp1;
                        anon_release(amp1->ahp, btop(amp1->size));
                }
                if (amp2 != NULL) {
                        if (namp == NULL) {
                                ASSERT(amp1 == NULL);
                                namp = amp2;
                                anon_release(amp2->ahp, btop(amp2->size));
                        } else {
                                amp2->refcnt--;
                                ANON_LOCK_EXIT(&amp2->a_rwlock);
                                anonmap_free(amp2);
                        }
                        svd2->amp = NULL; /* needed for seg_free */
                }
                namp->ahp = nahp;
                namp->size = asize;
                svd1->amp = namp;
                svd1->anon_index = 0;
                ANON_LOCK_EXIT(&namp->a_rwlock);
        }
        /*
         * Now free the old vpage structures.
         */
        if (nvpage != NULL) {
                if (vpage1 != NULL) {
                        kmem_free(vpage1, vpgtob(npages1));
                }
                if (vpage2 != NULL) {
                        svd2->vpage = NULL;
                        kmem_free(vpage2, vpgtob(npages2));
                }
                if (svd2->pageprot) {
                        svd1->pageprot = 1;
                }
                if (svd2->pageadvice) {
                        svd1->pageadvice = 1;
                }
                if (svd2->pageswap) {
                        svd1->pageswap = 1;
                }
                svd1->vpage = nvpage;
        }

        /* all looks ok, merge segments */
        svd1->swresv += svd2->swresv;
        svd2->swresv = 0;  /* so seg_free doesn't release swap space */
        size = seg2->s_size;
        seg_free(seg2);
        seg1->s_size += size;
        return (0);
}

/*
 * Extend the previous segment (seg1) to include the
 * new segment (seg2 + a), if possible.
 * Return 0 on success.
 */
static int
segvn_extend_prev(seg1, seg2, a, swresv)
        struct seg *seg1, *seg2;
        struct segvn_crargs *a;
        size_t swresv;
{
        struct segvn_data *svd1 = (struct segvn_data *)seg1->s_data;
        size_t size;
        struct anon_map *amp1;
        struct vpage *new_vpage;

        /*
         * We don't need any segment level locks for "segvn" data
         * since the address space is "write" locked.
         */
        ASSERT(seg1->s_as && AS_WRITE_HELD(seg1->s_as));

        if (HAT_IS_REGION_COOKIE_VALID(svd1->rcookie)) {
                return (-1);
        }

        /* second segment is new, try to extend first */
        /* XXX - should also check cred */
        if (svd1->vp != a->vp || svd1->maxprot != a->maxprot ||
            (!svd1->pageprot && (svd1->prot != a->prot)) ||
            svd1->type != a->type || svd1->flags != a->flags ||
            seg1->s_szc != a->szc || svd1->softlockcnt_send > 0)
                return (-1);

        /* vp == NULL implies zfod, offset doesn't matter */
        if (svd1->vp != NULL &&
            svd1->offset + seg1->s_size != (a->offset & PAGEMASK))
                return (-1);

        if (svd1->tr_state != SEGVN_TR_OFF) {
                return (-1);
        }

        amp1 = svd1->amp;
        if (amp1) {
                pgcnt_t newpgs;

                /*
                 * Segment has private pages, can data structures
                 * be expanded?
                 *
                 * Acquire the anon_map lock to prevent it from changing,
                 * if it is shared.  This ensures that the anon_map
                 * will not change while a thread which has a read/write
                 * lock on an address space references it.
                 * XXX - Don't need the anon_map lock at all if "refcnt"
                 * is 1.
                 *
                 * Can't grow a MAP_SHARED segment with an anonmap because
                 * there may be existing anon slots where we want to extend
                 * the segment and we wouldn't know what to do with them
                 * (e.g., for tmpfs right thing is to just leave them there,
                 * for /dev/zero they should be cleared out).
                 */
                if (svd1->type == MAP_SHARED)
                        return (-1);

                ANON_LOCK_ENTER(&amp1->a_rwlock, RW_WRITER);
                if (amp1->refcnt > 1) {
                        ANON_LOCK_EXIT(&amp1->a_rwlock);
                        return (-1);
                }
                newpgs = anon_grow(amp1->ahp, &svd1->anon_index,
                    btop(seg1->s_size), btop(seg2->s_size), ANON_NOSLEEP);

                if (newpgs == 0) {
                        ANON_LOCK_EXIT(&amp1->a_rwlock);
                        return (-1);
                }
                amp1->size = ptob(newpgs);
                ANON_LOCK_EXIT(&amp1->a_rwlock);
        }
        if (svd1->vpage != NULL) {
                struct vpage *vp, *evp;
                new_vpage =
                    kmem_zalloc(vpgtob(seg_pages(seg1) + seg_pages(seg2)),
                        KM_NOSLEEP);
                if (new_vpage == NULL)
                        return (-1);
                bcopy(svd1->vpage, new_vpage, vpgtob(seg_pages(seg1)));
                kmem_free(svd1->vpage, vpgtob(seg_pages(seg1)));
                svd1->vpage = new_vpage;

                vp = new_vpage + seg_pages(seg1);
                evp = vp + seg_pages(seg2);
                for (; vp < evp; vp++)
                        VPP_SETPROT(vp, a->prot);
                if (svd1->pageswap && swresv) {
                        ASSERT(!(svd1->flags & MAP_NORESERVE));
                        ASSERT(swresv == seg2->s_size);
                        vp = new_vpage + seg_pages(seg1);
                        for (; vp < evp; vp++) {
                                VPP_SETSWAPRES(vp);
                        }
                }
        }
        ASSERT(svd1->vpage != NULL || svd1->pageswap == 0);
        size = seg2->s_size;
        seg_free(seg2);
        seg1->s_size += size;
        svd1->swresv += swresv;
        if (svd1->pageprot && (a->prot & PROT_WRITE) &&
            svd1->type == MAP_SHARED && svd1->vp != NULL &&
            (svd1->vp->v_flag & VVMEXEC)) {
                ASSERT(vn_is_mapped(svd1->vp, V_WRITE));
                segvn_inval_trcache(svd1->vp);
        }
        return (0);
}

/*
 * Extend the next segment (seg2) to include the
 * new segment (seg1 + a), if possible.
 * Return 0 on success.
 */
static int
segvn_extend_next(
        struct seg *seg1,
        struct seg *seg2,
        struct segvn_crargs *a,
        size_t swresv)
{
        struct segvn_data *svd2 = (struct segvn_data *)seg2->s_data;
        size_t size;
        struct anon_map *amp2;
        struct vpage *new_vpage;

        /*
         * We don't need any segment level locks for "segvn" data
         * since the address space is "write" locked.
         */
        ASSERT(seg2->s_as && AS_WRITE_HELD(seg2->s_as));

        if (HAT_IS_REGION_COOKIE_VALID(svd2->rcookie)) {
                return (-1);
        }

        /* first segment is new, try to extend second */
        /* XXX - should also check cred */
        if (svd2->vp != a->vp || svd2->maxprot != a->maxprot ||
            (!svd2->pageprot && (svd2->prot != a->prot)) ||
            svd2->type != a->type || svd2->flags != a->flags ||
            seg2->s_szc != a->szc || svd2->softlockcnt_sbase > 0)
                return (-1);
        /* vp == NULL implies zfod, offset doesn't matter */
        if (svd2->vp != NULL &&
            (a->offset & PAGEMASK) + seg1->s_size != svd2->offset)
                return (-1);

        if (svd2->tr_state != SEGVN_TR_OFF) {
                return (-1);
        }

        amp2 = svd2->amp;
        if (amp2) {
                pgcnt_t newpgs;

                /*
                 * Segment has private pages, can data structures
                 * be expanded?
                 *
                 * Acquire the anon_map lock to prevent it from changing,
                 * if it is shared.  This ensures that the anon_map
                 * will not change while a thread which has a read/write
                 * lock on an address space references it.
                 *
                 * XXX - Don't need the anon_map lock at all if "refcnt"
                 * is 1.
                 */
                if (svd2->type == MAP_SHARED)
                        return (-1);

                ANON_LOCK_ENTER(&amp2->a_rwlock, RW_WRITER);
                if (amp2->refcnt > 1) {
                        ANON_LOCK_EXIT(&amp2->a_rwlock);
                        return (-1);
                }
                newpgs = anon_grow(amp2->ahp, &svd2->anon_index,
                    btop(seg2->s_size), btop(seg1->s_size),
                    ANON_NOSLEEP | ANON_GROWDOWN);

                if (newpgs == 0) {
                        ANON_LOCK_EXIT(&amp2->a_rwlock);
                        return (-1);
                }
                amp2->size = ptob(newpgs);
                ANON_LOCK_EXIT(&amp2->a_rwlock);
        }
        if (svd2->vpage != NULL) {
                struct vpage *vp, *evp;
                new_vpage =
                    kmem_zalloc(vpgtob(seg_pages(seg1) + seg_pages(seg2)),
                    KM_NOSLEEP);
                if (new_vpage == NULL) {
                        /* Not merging segments so adjust anon_index back */
                        if (amp2)
                                svd2->anon_index += seg_pages(seg1);
                        return (-1);
                }
                bcopy(svd2->vpage, new_vpage + seg_pages(seg1),
                    vpgtob(seg_pages(seg2)));
                kmem_free(svd2->vpage, vpgtob(seg_pages(seg2)));
                svd2->vpage = new_vpage;

                vp = new_vpage;
                evp = vp + seg_pages(seg1);
                for (; vp < evp; vp++)
                        VPP_SETPROT(vp, a->prot);
                if (svd2->pageswap && swresv) {
                        ASSERT(!(svd2->flags & MAP_NORESERVE));
                        ASSERT(swresv == seg1->s_size);
                        vp = new_vpage;
                        for (; vp < evp; vp++) {
                                VPP_SETSWAPRES(vp);
                        }
                }
        }
        ASSERT(svd2->vpage != NULL || svd2->pageswap == 0);
        size = seg1->s_size;
        seg_free(seg1);
        seg2->s_size += size;
        seg2->s_base -= size;
        svd2->offset -= size;
        svd2->swresv += swresv;
        if (svd2->pageprot && (a->prot & PROT_WRITE) &&
            svd2->type == MAP_SHARED && svd2->vp != NULL &&
            (svd2->vp->v_flag & VVMEXEC)) {
                ASSERT(vn_is_mapped(svd2->vp, V_WRITE));
                segvn_inval_trcache(svd2->vp);
        }
        return (0);
}

/*
 * Duplicate all the pages in the segment. This may break COW sharing for a
 * given page. If the page is marked with inherit zero set, then instead of
 * duplicating the page, we zero the page.
 */
static int
segvn_dup_pages(struct seg *seg, struct seg *newseg)
{
        int error;
        uint_t prot;
        page_t *pp;
        struct anon *ap, *newap;
        size_t i;
        caddr_t addr;

        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct segvn_data *newsvd = (struct segvn_data *)newseg->s_data;
        ulong_t old_idx = svd->anon_index;
        ulong_t new_idx = 0;

        i = btopr(seg->s_size);
        addr = seg->s_base;

        /*
         * XXX break cow sharing using PAGESIZE
         * pages. They will be relocated into larger
         * pages at fault time.
         */
        while (i-- > 0) {
                if ((ap = anon_get_ptr(svd->amp->ahp, old_idx)) != NULL) {
                        struct vpage *vpp;

                        vpp = &svd->vpage[seg_page(seg, addr)];

                        /*
                         * prot need not be computed below 'cause anon_private
                         * is going to ignore it anyway as child doesn't inherit
                         * pagelock from parent.
                         */
                        prot = svd->pageprot ? VPP_PROT(vpp) : svd->prot;

                        /*
                         * Check whether we should zero this or dup it.
                         */
                        if (svd->svn_inz == SEGVN_INZ_ALL ||
                            (svd->svn_inz == SEGVN_INZ_VPP &&
                            VPP_ISINHZERO(vpp))) {
                                pp = anon_zero(newseg, addr, &newap,
                                    newsvd->cred);
                        } else {
                                page_t *anon_pl[1+1];
                                uint_t vpprot;
                                error = anon_getpage(&ap, &vpprot, anon_pl,
                                    PAGESIZE, seg, addr, S_READ, svd->cred);
                                if (error != 0)
                                        return (error);

                                pp = anon_private(&newap, newseg, addr, prot,
                                    anon_pl[0], 0, newsvd->cred);
                        }
                        if (pp == NULL) {
                                return (ENOMEM);
                        }
                        (void) anon_set_ptr(newsvd->amp->ahp, new_idx, newap,
                            ANON_SLEEP);
                        page_unlock(pp);
                }
                addr += PAGESIZE;
                old_idx++;
                new_idx++;
        }

        return (0);
}

static int
segvn_dup(struct seg *seg, struct seg *newseg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct segvn_data *newsvd;
        pgcnt_t npages = seg_pages(seg);
        int error = 0;
        size_t len;
        struct anon_map *amp;

        ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));
        ASSERT(newseg->s_as->a_proc->p_parent == curproc);

        /*
         * If segment has anon reserved, reserve more for the new seg.
         * For a MAP_NORESERVE segment swresv will be a count of all the
         * allocated anon slots; thus we reserve for the child as many slots
         * as the parent has allocated. This semantic prevents the child or
         * parent from dieing during a copy-on-write fault caused by trying
         * to write a shared pre-existing anon page.
         */
        if ((len = svd->swresv) != 0) {
                if (anon_resv(svd->swresv) == 0)
                        return (ENOMEM);
        }

        newsvd = kmem_cache_alloc(segvn_cache, KM_SLEEP);

        newseg->s_ops = &segvn_ops;
        newseg->s_data = (void *)newsvd;
        newseg->s_szc = seg->s_szc;

        newsvd->seg = newseg;
        if ((newsvd->vp = svd->vp) != NULL) {
                VN_HOLD(svd->vp);
                if (svd->type == MAP_SHARED)
                        lgrp_shm_policy_init(NULL, svd->vp);
        }
        newsvd->offset = svd->offset;
        newsvd->prot = svd->prot;
        newsvd->maxprot = svd->maxprot;
        newsvd->pageprot = svd->pageprot;
        newsvd->type = svd->type;
        newsvd->cred = svd->cred;
        crhold(newsvd->cred);
        newsvd->advice = svd->advice;
        newsvd->pageadvice = svd->pageadvice;
        newsvd->svn_inz = svd->svn_inz;
        newsvd->swresv = svd->swresv;
        newsvd->pageswap = svd->pageswap;
        newsvd->flags = svd->flags;
        newsvd->softlockcnt = 0;
        newsvd->softlockcnt_sbase = 0;
        newsvd->softlockcnt_send = 0;
        newsvd->policy_info = svd->policy_info;
        newsvd->rcookie = HAT_INVALID_REGION_COOKIE;

        if ((amp = svd->amp) == NULL || svd->tr_state == SEGVN_TR_ON) {
                /*
                 * Not attaching to a shared anon object.
                 */
                ASSERT(!HAT_IS_REGION_COOKIE_VALID(svd->rcookie) ||
                    svd->tr_state == SEGVN_TR_OFF);
                if (svd->tr_state == SEGVN_TR_ON) {
                        ASSERT(newsvd->vp != NULL && amp != NULL);
                        newsvd->tr_state = SEGVN_TR_INIT;
                } else {
                        newsvd->tr_state = svd->tr_state;
                }
                newsvd->amp = NULL;
                newsvd->anon_index = 0;
        } else {
                /* regions for now are only used on pure vnode segments */
                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                newsvd->tr_state = SEGVN_TR_OFF;
                if (svd->type == MAP_SHARED) {
                        ASSERT(svd->svn_inz == SEGVN_INZ_NONE);
                        newsvd->amp = amp;
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        amp->refcnt++;
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        newsvd->anon_index = svd->anon_index;
                } else {
                        int reclaim = 1;

                        /*
                         * Allocate and initialize new anon_map structure.
                         */
                        newsvd->amp = anonmap_alloc(newseg->s_size, 0,
                            ANON_SLEEP);
                        newsvd->amp->a_szc = newseg->s_szc;
                        newsvd->anon_index = 0;
                        ASSERT(svd->svn_inz == SEGVN_INZ_NONE ||
                            svd->svn_inz == SEGVN_INZ_ALL ||
                            svd->svn_inz == SEGVN_INZ_VPP);

                        /*
                         * We don't have to acquire the anon_map lock
                         * for the new segment (since it belongs to an
                         * address space that is still not associated
                         * with any process), or the segment in the old
                         * address space (since all threads in it
                         * are stopped while duplicating the address space).
                         */

                        /*
                         * The goal of the following code is to make sure that
                         * softlocked pages do not end up as copy on write
                         * pages.  This would cause problems where one
                         * thread writes to a page that is COW and a different
                         * thread in the same process has softlocked it.  The
                         * softlock lock would move away from this process
                         * because the write would cause this process to get
                         * a copy (without the softlock).
                         *
                         * The strategy here is to just break the
                         * sharing on pages that could possibly be
                         * softlocked.
                         *
                         * In addition, if any pages have been marked that they
                         * should be inherited as zero, then we immediately go
                         * ahead and break COW and zero them. In the case of a
                         * softlocked page that should be inherited zero, we
                         * break COW and just get a zero page.
                         */
retry:
                        if (svd->softlockcnt ||
                            svd->svn_inz != SEGVN_INZ_NONE) {
                                /*
                                 * The softlock count might be non zero
                                 * because some pages are still stuck in the
                                 * cache for lazy reclaim. Flush the cache
                                 * now. This should drop the count to zero.
                                 * [or there is really I/O going on to these
                                 * pages]. Note, we have the writers lock so
                                 * nothing gets inserted during the flush.
                                 */
                                if (svd->softlockcnt && reclaim == 1) {
                                        segvn_purge(seg);
                                        reclaim = 0;
                                        goto retry;
                                }

                                error = segvn_dup_pages(seg, newseg);
                                if (error != 0) {
                                        newsvd->vpage = NULL;
                                        goto out;
                                }
                        } else {        /* common case */
                                if (seg->s_szc != 0) {
                                        /*
                                         * If at least one of anon slots of a
                                         * large page exists then make sure
                                         * all anon slots of a large page
                                         * exist to avoid partial cow sharing
                                         * of a large page in the future.
                                         */
                                        anon_dup_fill_holes(amp->ahp,
                                            svd->anon_index, newsvd->amp->ahp,
                                            0, seg->s_size, seg->s_szc,
                                            svd->vp != NULL);
                                } else {
                                        anon_dup(amp->ahp, svd->anon_index,
                                            newsvd->amp->ahp, 0, seg->s_size);
                                }

                                hat_clrattr(seg->s_as->a_hat, seg->s_base,
                                    seg->s_size, PROT_WRITE);
                        }
                }
        }
        /*
         * If necessary, create a vpage structure for the new segment.
         * Do not copy any page lock indications.
         */
        if (svd->vpage != NULL) {
                uint_t i;
                struct vpage *ovp = svd->vpage;
                struct vpage *nvp;

                nvp = newsvd->vpage =
                    kmem_alloc(vpgtob(npages), KM_SLEEP);
                for (i = 0; i < npages; i++) {
                        *nvp = *ovp++;
                        VPP_CLRPPLOCK(nvp++);
                }
        } else
                newsvd->vpage = NULL;

        /* Inform the vnode of the new mapping */
        if (newsvd->vp != NULL) {
                error = fop_addmap(newsvd->vp, (offset_t)newsvd->offset,
                    newseg->s_as, newseg->s_base, newseg->s_size, newsvd->prot,
                    newsvd->maxprot, newsvd->type, newsvd->cred, NULL);
        }
out:
        if (error == 0 && HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(newsvd->amp == NULL);
                ASSERT(newsvd->tr_state == SEGVN_TR_OFF);
                newsvd->rcookie = svd->rcookie;
                hat_dup_region(newseg->s_as->a_hat, newsvd->rcookie);
        }
        return (error);
}


/*
 * callback function to invoke free_vp_pages() for only those pages actually
 * processed by the HAT when a shared region is destroyed.
 */
extern int free_pages;

static void
segvn_hat_rgn_unload_callback(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
    size_t r_size, void *r_obj, uoff_t r_objoff)
{
        uoff_t off;
        size_t len;
        vnode_t *vp = (vnode_t *)r_obj;

        ASSERT(eaddr > saddr);
        ASSERT(saddr >= r_saddr);
        ASSERT(saddr < r_saddr + r_size);
        ASSERT(eaddr > r_saddr);
        ASSERT(eaddr <= r_saddr + r_size);
        ASSERT(vp != NULL);

        if (!free_pages) {
                return;
        }

        len = eaddr - saddr;
        off = (saddr - r_saddr) + r_objoff;
        free_vp_pages(&vp->v_object, off, len);
}

/*
 * callback function used by segvn_unmap to invoke free_vp_pages() for only
 * those pages actually processed by the HAT
 */
static void
segvn_hat_unload_callback(hat_callback_t *cb)
{
        struct seg              *seg = cb->hcb_data;
        struct segvn_data       *svd = (struct segvn_data *)seg->s_data;
        size_t                  len;
        uoff_t          off;

        ASSERT(svd->vp != NULL);
        ASSERT(cb->hcb_end_addr > cb->hcb_start_addr);
        ASSERT(cb->hcb_start_addr >= seg->s_base);

        len = cb->hcb_end_addr - cb->hcb_start_addr;
        off = cb->hcb_start_addr - seg->s_base;
        free_vp_pages(&svd->vp->v_object, svd->offset + off, len);
}

/*
 * This function determines the number of bytes of swap reserved by
 * a segment for which per-page accounting is present. It is used to
 * calculate the correct value of a segvn_data's swresv.
 */
static size_t
segvn_count_swap_by_vpages(struct seg *seg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vp, *evp;
        size_t nswappages = 0;

        ASSERT(svd->pageswap);
        ASSERT(svd->vpage != NULL);

        evp = &svd->vpage[seg_page(seg, seg->s_base + seg->s_size)];

        for (vp = svd->vpage; vp < evp; vp++) {
                if (VPP_ISSWAPRES(vp))
                        nswappages++;
        }

        return (nswappages << PAGESHIFT);
}

static int
segvn_unmap(struct seg *seg, caddr_t addr, size_t len)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct segvn_data *nsvd;
        struct seg *nseg;
        struct anon_map *amp;
        pgcnt_t opages;         /* old segment size in pages */
        pgcnt_t npages;         /* new segment size in pages */
        pgcnt_t dpages;         /* pages being deleted (unmapped) */
        hat_callback_t callback;        /* used for free_vp_pages() */
        hat_callback_t *cbp = NULL;
        caddr_t nbase;
        size_t nsize;
        size_t oswresv;
        int reclaim = 1;

        /*
         * We don't need any segment level locks for "segvn" data
         * since the address space is "write" locked.
         */
        ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));

        /*
         * Fail the unmap if pages are SOFTLOCKed through this mapping.
         * softlockcnt is protected from change by the as write lock.
         */
retry:
        if (svd->softlockcnt > 0) {
                ASSERT(svd->tr_state == SEGVN_TR_OFF);

                /*
                 * If this is shared segment non 0 softlockcnt
                 * means locked pages are still in use.
                 */
                if (svd->type == MAP_SHARED) {
                        return (EAGAIN);
                }

                /*
                 * since we do have the writers lock nobody can fill
                 * the cache during the purge. The flush either succeeds
                 * or we still have pending I/Os.
                 */
                if (reclaim == 1) {
                        segvn_purge(seg);
                        reclaim = 0;
                        goto retry;
                }
                return (EAGAIN);
        }

        /*
         * Check for bad sizes
         */
        if (addr < seg->s_base || addr + len > seg->s_base + seg->s_size ||
            (len & PAGEOFFSET) || ((uintptr_t)addr & PAGEOFFSET)) {
                panic("segvn_unmap");
                /*NOTREACHED*/
        }

        if (seg->s_szc != 0) {
                size_t pgsz = page_get_pagesize(seg->s_szc);
                int err;
                if (!IS_P2ALIGNED(addr, pgsz) || !IS_P2ALIGNED(len, pgsz)) {
                        ASSERT(seg->s_base != addr || seg->s_size != len);
                        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                                ASSERT(svd->amp == NULL);
                                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                                hat_leave_region(seg->s_as->a_hat,
                                    svd->rcookie, HAT_REGION_TEXT);
                                svd->rcookie = HAT_INVALID_REGION_COOKIE;
                                /*
                                 * could pass a flag to segvn_demote_range()
                                 * below to tell it not to do any unloads but
                                 * this case is rare enough to not bother for
                                 * now.
                                 */
                        } else if (svd->tr_state == SEGVN_TR_INIT) {
                                svd->tr_state = SEGVN_TR_OFF;
                        } else if (svd->tr_state == SEGVN_TR_ON) {
                                ASSERT(svd->amp != NULL);
                                segvn_textunrepl(seg, 1);
                                ASSERT(svd->amp == NULL);
                                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                        }
                        VM_STAT_ADD(segvnvmstats.demoterange[0]);
                        err = segvn_demote_range(seg, addr, len, SDR_END, 0);
                        if (err == 0) {
                                return (IE_RETRY);
                        }
                        return (err);
                }
        }

        /* Inform the vnode of the unmapping. */
        if (svd->vp) {
                int error;

                error = fop_delmap(svd->vp,
                    (offset_t)svd->offset + (uintptr_t)(addr - seg->s_base),
                    seg->s_as, addr, len, svd->prot, svd->maxprot,
                    svd->type, svd->cred, NULL);

                if (error == EAGAIN)
                        return (error);
        }

        /*
         * Remove any page locks set through this mapping.
         * If text replication is not off no page locks could have been
         * established via this mapping.
         */
        if (svd->tr_state == SEGVN_TR_OFF) {
                (void) segvn_lockop(seg, addr, len, 0, MC_UNLOCK, NULL, 0);
        }

        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(svd->amp == NULL);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                ASSERT(svd->type == MAP_PRIVATE);
                hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                    HAT_REGION_TEXT);
                svd->rcookie = HAT_INVALID_REGION_COOKIE;
        } else if (svd->tr_state == SEGVN_TR_ON) {
                ASSERT(svd->amp != NULL);
                ASSERT(svd->pageprot == 0 && !(svd->prot & PROT_WRITE));
                segvn_textunrepl(seg, 1);
                ASSERT(svd->amp == NULL && svd->tr_state == SEGVN_TR_OFF);
        } else {
                if (svd->tr_state != SEGVN_TR_OFF) {
                        ASSERT(svd->tr_state == SEGVN_TR_INIT);
                        svd->tr_state = SEGVN_TR_OFF;
                }
                /*
                 * Unload any hardware translations in the range to be taken
                 * out. Use a callback to invoke free_vp_pages() effectively.
                 */
                if (svd->vp != NULL && free_pages != 0) {
                        callback.hcb_data = seg;
                        callback.hcb_function = segvn_hat_unload_callback;
                        cbp = &callback;
                }
                hat_unload_callback(seg->s_as->a_hat, addr, len,
                    HAT_UNLOAD_UNMAP, cbp);

                if (svd->type == MAP_SHARED && svd->vp != NULL &&
                    (svd->vp->v_flag & VVMEXEC) &&
                    ((svd->prot & PROT_WRITE) || svd->pageprot)) {
                        segvn_inval_trcache(svd->vp);
                }
        }

        /*
         * Check for entire segment
         */
        if (addr == seg->s_base && len == seg->s_size) {
                seg_free(seg);
                return (0);
        }

        opages = seg_pages(seg);
        dpages = btop(len);
        npages = opages - dpages;
        amp = svd->amp;
        ASSERT(amp == NULL || amp->a_szc >= seg->s_szc);

        /*
         * Check for beginning of segment
         */
        if (addr == seg->s_base) {
                if (svd->vpage != NULL) {
                        size_t nbytes;
                        struct vpage *ovpage;

                        ovpage = svd->vpage;    /* keep pointer to vpage */

                        nbytes = vpgtob(npages);
                        svd->vpage = kmem_alloc(nbytes, KM_SLEEP);
                        bcopy(&ovpage[dpages], svd->vpage, nbytes);

                        /* free up old vpage */
                        kmem_free(ovpage, vpgtob(opages));
                }
                if (amp != NULL) {
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        if (amp->refcnt == 1 || svd->type == MAP_PRIVATE) {
                                /*
                                 * Shared anon map is no longer in use. Before
                                 * freeing its pages purge all entries from
                                 * pcache that belong to this amp.
                                 */
                                if (svd->type == MAP_SHARED) {
                                        ASSERT(amp->refcnt == 1);
                                        ASSERT(svd->softlockcnt == 0);
                                        anonmap_purge(amp);
                                }
                                /*
                                 * Free up now unused parts of anon_map array.
                                 */
                                if (amp->a_szc == seg->s_szc) {
                                        if (seg->s_szc != 0) {
                                                anon_free_pages(amp->ahp,
                                                    svd->anon_index, len,
                                                    seg->s_szc);
                                        } else {
                                                anon_free(amp->ahp,
                                                    svd->anon_index,
                                                    len);
                                        }
                                } else {
                                        ASSERT(svd->type == MAP_SHARED);
                                        ASSERT(amp->a_szc > seg->s_szc);
                                        anon_shmap_free_pages(amp,
                                            svd->anon_index, len);
                                }

                                /*
                                 * Unreserve swap space for the
                                 * unmapped chunk of this segment in
                                 * case it's MAP_SHARED
                                 */
                                if (svd->type == MAP_SHARED) {
                                        anon_unresv_zone(len,
                                            seg->s_as->a_proc->p_zone);
                                        amp->swresv -= len;
                                }
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        svd->anon_index += dpages;
                }
                if (svd->vp != NULL)
                        svd->offset += len;

                seg->s_base += len;
                seg->s_size -= len;

                if (svd->swresv) {
                        if (svd->flags & MAP_NORESERVE) {
                                ASSERT(amp);
                                oswresv = svd->swresv;

                                svd->swresv = ptob(anon_pages(amp->ahp,
                                    svd->anon_index, npages));
                                anon_unresv_zone(oswresv - svd->swresv,
                                    seg->s_as->a_proc->p_zone);
                                if (SEG_IS_PARTIAL_RESV(seg))
                                        seg->s_as->a_resvsize -= oswresv -
                                            svd->swresv;
                        } else {
                                size_t unlen;

                                if (svd->pageswap) {
                                        oswresv = svd->swresv;
                                        svd->swresv =
                                            segvn_count_swap_by_vpages(seg);
                                        ASSERT(oswresv >= svd->swresv);
                                        unlen = oswresv - svd->swresv;
                                } else {
                                        svd->swresv -= len;
                                        ASSERT(svd->swresv == seg->s_size);
                                        unlen = len;
                                }
                                anon_unresv_zone(unlen,
                                    seg->s_as->a_proc->p_zone);
                        }
                }

                return (0);
        }

        /*
         * Check for end of segment
         */
        if (addr + len == seg->s_base + seg->s_size) {
                if (svd->vpage != NULL) {
                        size_t nbytes;
                        struct vpage *ovpage;

                        ovpage = svd->vpage;    /* keep pointer to vpage */

                        nbytes = vpgtob(npages);
                        svd->vpage = kmem_alloc(nbytes, KM_SLEEP);
                        bcopy(ovpage, svd->vpage, nbytes);

                        /* free up old vpage */
                        kmem_free(ovpage, vpgtob(opages));

                }
                if (amp != NULL) {
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        if (amp->refcnt == 1 || svd->type == MAP_PRIVATE) {
                                /*
                                 * Free up now unused parts of anon_map array.
                                 */
                                ulong_t an_idx = svd->anon_index + npages;

                                /*
                                 * Shared anon map is no longer in use. Before
                                 * freeing its pages purge all entries from
                                 * pcache that belong to this amp.
                                 */
                                if (svd->type == MAP_SHARED) {
                                        ASSERT(amp->refcnt == 1);
                                        ASSERT(svd->softlockcnt == 0);
                                        anonmap_purge(amp);
                                }

                                if (amp->a_szc == seg->s_szc) {
                                        if (seg->s_szc != 0) {
                                                anon_free_pages(amp->ahp,
                                                    an_idx, len,
                                                    seg->s_szc);
                                        } else {
                                                anon_free(amp->ahp, an_idx,
                                                    len);
                                        }
                                } else {
                                        ASSERT(svd->type == MAP_SHARED);
                                        ASSERT(amp->a_szc > seg->s_szc);
                                        anon_shmap_free_pages(amp,
                                            an_idx, len);
                                }

                                /*
                                 * Unreserve swap space for the
                                 * unmapped chunk of this segment in
                                 * case it's MAP_SHARED
                                 */
                                if (svd->type == MAP_SHARED) {
                                        anon_unresv_zone(len,
                                            seg->s_as->a_proc->p_zone);
                                        amp->swresv -= len;
                                }
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }

                seg->s_size -= len;

                if (svd->swresv) {
                        if (svd->flags & MAP_NORESERVE) {
                                ASSERT(amp);
                                oswresv = svd->swresv;
                                svd->swresv = ptob(anon_pages(amp->ahp,
                                    svd->anon_index, npages));
                                anon_unresv_zone(oswresv - svd->swresv,
                                    seg->s_as->a_proc->p_zone);
                                if (SEG_IS_PARTIAL_RESV(seg))
                                        seg->s_as->a_resvsize -= oswresv -
                                            svd->swresv;
                        } else {
                                size_t unlen;

                                if (svd->pageswap) {
                                        oswresv = svd->swresv;
                                        svd->swresv =
                                            segvn_count_swap_by_vpages(seg);
                                        ASSERT(oswresv >= svd->swresv);
                                        unlen = oswresv - svd->swresv;
                                } else {
                                        svd->swresv -= len;
                                        ASSERT(svd->swresv == seg->s_size);
                                        unlen = len;
                                }
                                anon_unresv_zone(unlen,
                                    seg->s_as->a_proc->p_zone);
                        }
                }

                return (0);
        }

        /*
         * The section to go is in the middle of the segment,
         * have to make it into two segments.  nseg is made for
         * the high end while seg is cut down at the low end.
         */
        nbase = addr + len;                             /* new seg base */
        nsize = (seg->s_base + seg->s_size) - nbase;    /* new seg size */
        seg->s_size = addr - seg->s_base;               /* shrink old seg */
        nseg = seg_alloc(seg->s_as, nbase, nsize);
        if (nseg == NULL) {
                panic("segvn_unmap seg_alloc");
                /*NOTREACHED*/
        }
        nseg->s_ops = seg->s_ops;
        nsvd = kmem_cache_alloc(segvn_cache, KM_SLEEP);
        nseg->s_data = (void *)nsvd;
        nseg->s_szc = seg->s_szc;
        *nsvd = *svd;
        nsvd->seg = nseg;
        nsvd->offset = svd->offset + (uintptr_t)(nseg->s_base - seg->s_base);
        nsvd->swresv = 0;
        nsvd->softlockcnt = 0;
        nsvd->softlockcnt_sbase = 0;
        nsvd->softlockcnt_send = 0;
        nsvd->svn_inz = svd->svn_inz;
        ASSERT(nsvd->rcookie == HAT_INVALID_REGION_COOKIE);

        if (svd->vp != NULL) {
                VN_HOLD(nsvd->vp);
                if (nsvd->type == MAP_SHARED)
                        lgrp_shm_policy_init(NULL, nsvd->vp);
        }
        crhold(svd->cred);

        if (svd->vpage == NULL) {
                nsvd->vpage = NULL;
        } else {
                /* need to split vpage into two arrays */
                size_t nbytes;
                struct vpage *ovpage;

                ovpage = svd->vpage;            /* keep pointer to vpage */

                npages = seg_pages(seg);        /* seg has shrunk */
                nbytes = vpgtob(npages);
                svd->vpage = kmem_alloc(nbytes, KM_SLEEP);

                bcopy(ovpage, svd->vpage, nbytes);

                npages = seg_pages(nseg);
                nbytes = vpgtob(npages);
                nsvd->vpage = kmem_alloc(nbytes, KM_SLEEP);

                bcopy(&ovpage[opages - npages], nsvd->vpage, nbytes);

                /* free up old vpage */
                kmem_free(ovpage, vpgtob(opages));
        }

        if (amp == NULL) {
                nsvd->amp = NULL;
                nsvd->anon_index = 0;
        } else {
                /*
                 * Need to create a new anon map for the new segment.
                 * We'll also allocate a new smaller array for the old
                 * smaller segment to save space.
                 */
                opages = btop((uintptr_t)(addr - seg->s_base));
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                if (amp->refcnt == 1 || svd->type == MAP_PRIVATE) {
                        /*
                         * Free up now unused parts of anon_map array.
                         */
                        ulong_t an_idx = svd->anon_index + opages;

                        /*
                         * Shared anon map is no longer in use. Before
                         * freeing its pages purge all entries from
                         * pcache that belong to this amp.
                         */
                        if (svd->type == MAP_SHARED) {
                                ASSERT(amp->refcnt == 1);
                                ASSERT(svd->softlockcnt == 0);
                                anonmap_purge(amp);
                        }

                        if (amp->a_szc == seg->s_szc) {
                                if (seg->s_szc != 0) {
                                        anon_free_pages(amp->ahp, an_idx, len,
                                            seg->s_szc);
                                } else {
                                        anon_free(amp->ahp, an_idx,
                                            len);
                                }
                        } else {
                                ASSERT(svd->type == MAP_SHARED);
                                ASSERT(amp->a_szc > seg->s_szc);
                                anon_shmap_free_pages(amp, an_idx, len);
                        }

                        /*
                         * Unreserve swap space for the
                         * unmapped chunk of this segment in
                         * case it's MAP_SHARED
                         */
                        if (svd->type == MAP_SHARED) {
                                anon_unresv_zone(len,
                                    seg->s_as->a_proc->p_zone);
                                amp->swresv -= len;
                        }
                }
                nsvd->anon_index = svd->anon_index +
                    btop((uintptr_t)(nseg->s_base - seg->s_base));
                if (svd->type == MAP_SHARED) {
                        amp->refcnt++;
                        nsvd->amp = amp;
                } else {
                        struct anon_map *namp;
                        struct anon_hdr *nahp;

                        ASSERT(svd->type == MAP_PRIVATE);
                        nahp = anon_create(btop(seg->s_size), ANON_SLEEP);
                        namp = anonmap_alloc(nseg->s_size, 0, ANON_SLEEP);
                        namp->a_szc = seg->s_szc;
                        (void) anon_copy_ptr(amp->ahp, svd->anon_index, nahp,
                            0, btop(seg->s_size), ANON_SLEEP);
                        (void) anon_copy_ptr(amp->ahp, nsvd->anon_index,
                            namp->ahp, 0, btop(nseg->s_size), ANON_SLEEP);
                        anon_release(amp->ahp, btop(amp->size));
                        svd->anon_index = 0;
                        nsvd->anon_index = 0;
                        amp->ahp = nahp;
                        amp->size = seg->s_size;
                        nsvd->amp = namp;
                }
                ANON_LOCK_EXIT(&amp->a_rwlock);
        }
        if (svd->swresv) {
                if (svd->flags & MAP_NORESERVE) {
                        ASSERT(amp);
                        oswresv = svd->swresv;
                        svd->swresv = ptob(anon_pages(amp->ahp,
                            svd->anon_index, btop(seg->s_size)));
                        nsvd->swresv = ptob(anon_pages(nsvd->amp->ahp,
                            nsvd->anon_index, btop(nseg->s_size)));
                        ASSERT(oswresv >= (svd->swresv + nsvd->swresv));
                        anon_unresv_zone(oswresv - (svd->swresv + nsvd->swresv),
                            seg->s_as->a_proc->p_zone);
                        if (SEG_IS_PARTIAL_RESV(seg))
                                seg->s_as->a_resvsize -= oswresv -
                                    (svd->swresv + nsvd->swresv);
                } else {
                        size_t unlen;

                        if (svd->pageswap) {
                                oswresv = svd->swresv;
                                svd->swresv = segvn_count_swap_by_vpages(seg);
                                nsvd->swresv = segvn_count_swap_by_vpages(nseg);
                                ASSERT(oswresv >= (svd->swresv + nsvd->swresv));
                                unlen = oswresv - (svd->swresv + nsvd->swresv);
                        } else {
                                if (seg->s_size + nseg->s_size + len !=
                                    svd->swresv) {
                                        panic("segvn_unmap: cannot split "
                                            "swap reservation");
                                        /*NOTREACHED*/
                                }
                                svd->swresv = seg->s_size;
                                nsvd->swresv = nseg->s_size;
                                unlen = len;
                        }
                        anon_unresv_zone(unlen,
                            seg->s_as->a_proc->p_zone);
                }
        }

        return (0);                     /* I'm glad that's all over with! */
}

static void
segvn_free(struct seg *seg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        pgcnt_t npages = seg_pages(seg);
        struct anon_map *amp;
        size_t len;

        /*
         * We don't need any segment level locks for "segvn" data
         * since the address space is "write" locked.
         */
        ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));
        ASSERT(svd->tr_state == SEGVN_TR_OFF);

        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);

        /*
         * Be sure to unlock pages. XXX Why do things get free'ed instead
         * of unmapped? XXX
         */
        (void) segvn_lockop(seg, seg->s_base, seg->s_size,
            0, MC_UNLOCK, NULL, 0);

        /*
         * Deallocate the vpage and anon pointers if necessary and possible.
         */
        if (svd->vpage != NULL) {
                kmem_free(svd->vpage, vpgtob(npages));
                svd->vpage = NULL;
        }
        if ((amp = svd->amp) != NULL) {
                /*
                 * If there are no more references to this anon_map
                 * structure, then deallocate the structure after freeing
                 * up all the anon slot pointers that we can.
                 */
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                ASSERT(amp->a_szc >= seg->s_szc);
                if (--amp->refcnt == 0) {
                        if (svd->type == MAP_PRIVATE) {
                                /*
                                 * Private - we only need to anon_free
                                 * the part that this segment refers to.
                                 */
                                if (seg->s_szc != 0) {
                                        anon_free_pages(amp->ahp,
                                            svd->anon_index, seg->s_size,
                                            seg->s_szc);
                                } else {
                                        anon_free(amp->ahp, svd->anon_index,
                                            seg->s_size);
                                }
                        } else {

                                /*
                                 * Shared anon map is no longer in use. Before
                                 * freeing its pages purge all entries from
                                 * pcache that belong to this amp.
                                 */
                                ASSERT(svd->softlockcnt == 0);
                                anonmap_purge(amp);

                                /*
                                 * Shared - anon_free the entire
                                 * anon_map's worth of stuff and
                                 * release any swap reservation.
                                 */
                                if (amp->a_szc != 0) {
                                        anon_shmap_free_pages(amp, 0,
                                            amp->size);
                                } else {
                                        anon_free(amp->ahp, 0, amp->size);
                                }
                                if ((len = amp->swresv) != 0) {
                                        anon_unresv_zone(len,
                                            seg->s_as->a_proc->p_zone);
                                }
                        }
                        svd->amp = NULL;
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        anonmap_free(amp);
                } else if (svd->type == MAP_PRIVATE) {
                        /*
                         * We had a private mapping which still has
                         * a held anon_map so just free up all the
                         * anon slot pointers that we were using.
                         */
                        if (seg->s_szc != 0) {
                                anon_free_pages(amp->ahp, svd->anon_index,
                                    seg->s_size, seg->s_szc);
                        } else {
                                anon_free(amp->ahp, svd->anon_index,
                                    seg->s_size);
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                } else {
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }
        }

        /*
         * Release swap reservation.
         */
        if ((len = svd->swresv) != 0) {
                anon_unresv_zone(svd->swresv,
                    seg->s_as->a_proc->p_zone);
                if (SEG_IS_PARTIAL_RESV(seg))
                        seg->s_as->a_resvsize -= svd->swresv;
                svd->swresv = 0;
        }
        /*
         * Release claim on vnode, credentials, and finally free the
         * private data.
         */
        if (svd->vp != NULL) {
                if (svd->type == MAP_SHARED)
                        lgrp_shm_policy_fini(NULL, svd->vp);
                VN_RELE(svd->vp);
                svd->vp = NULL;
        }
        crfree(svd->cred);
        svd->pageprot = 0;
        svd->pageadvice = 0;
        svd->pageswap = 0;
        svd->cred = NULL;

        /*
         * Take segfree_syncmtx lock to let segvn_reclaim() finish if it's
         * still working with this segment without holding as lock (in case
         * it's called by pcache async thread).
         */
        ASSERT(svd->softlockcnt == 0);
        mutex_enter(&svd->segfree_syncmtx);
        mutex_exit(&svd->segfree_syncmtx);

        seg->s_data = NULL;
        kmem_cache_free(segvn_cache, svd);
}

/*
 * Do a F_SOFTUNLOCK call over the range requested.  The range must have
 * already been F_SOFTLOCK'ed.
 * Caller must always match addr and len of a softunlock with a previous
 * softlock with exactly the same addr and len.
 */
static void
segvn_softunlock(struct seg *seg, caddr_t addr, size_t len, enum seg_rw rw)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        page_t *pp;
        caddr_t adr;
        struct vnode *vp;
        uoff_t offset;
        ulong_t anon_index;
        struct anon_map *amp;
        struct anon *ap = NULL;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
        ASSERT(SEGVN_LOCK_HELD(seg->s_as, &svd->lock));

        if ((amp = svd->amp) != NULL)
                anon_index = svd->anon_index + seg_page(seg, addr);

        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                hat_unlock_region(seg->s_as->a_hat, addr, len, svd->rcookie);
        } else {
                hat_unlock(seg->s_as->a_hat, addr, len);
        }
        for (adr = addr; adr < addr + len; adr += PAGESIZE) {
                if (amp != NULL) {
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        if ((ap = anon_get_ptr(amp->ahp, anon_index++))
                            != NULL) {
                                swap_xlate(ap, &vp, &offset);
                        } else {
                                vp = svd->vp;
                                offset = svd->offset +
                                    (uintptr_t)(adr - seg->s_base);
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                } else {
                        vp = svd->vp;
                        offset = svd->offset +
                            (uintptr_t)(adr - seg->s_base);
                }

                /*
                 * Use page_find() instead of page_lookup() to
                 * find the page since we know that it is locked.
                 */
                pp = page_find(&vp->v_object, offset);
                if (pp == NULL) {
                        panic(
                            "segvn_softunlock: addr %p, ap %p, vp %p, off %llx",
                            (void *)adr, (void *)ap, (void *)vp, offset);
                        /*NOTREACHED*/
                }

                if (rw == S_WRITE) {
                        hat_setrefmod(pp);
                        if (seg->s_as->a_vbits)
                                hat_setstat(seg->s_as, adr, PAGESIZE,
                                    P_REF | P_MOD);
                } else if (rw != S_OTHER) {
                        hat_setref(pp);
                        if (seg->s_as->a_vbits)
                                hat_setstat(seg->s_as, adr, PAGESIZE, P_REF);
                }
                page_unlock(pp);
        }
        ASSERT(svd->softlockcnt >= btop(len));
        if (!atomic_add_long_nv((ulong_t *)&svd->softlockcnt, -btop(len))) {
                /*
                 * All SOFTLOCKS are gone. Wakeup any waiting
                 * unmappers so they can try again to unmap.
                 * Check for waiters first without the mutex
                 * held so we don't always grab the mutex on
                 * softunlocks.
                 */
                if (AS_ISUNMAPWAIT(seg->s_as)) {
                        mutex_enter(&seg->s_as->a_contents);
                        if (AS_ISUNMAPWAIT(seg->s_as)) {
                                AS_CLRUNMAPWAIT(seg->s_as);
                                cv_broadcast(&seg->s_as->a_cv);
                        }
                        mutex_exit(&seg->s_as->a_contents);
                }
        }
}

#define PAGE_HANDLED    ((page_t *)-1)

/*
 * Release all the pages in the NULL terminated ppp list
 * which haven't already been converted to PAGE_HANDLED.
 */
static void
segvn_pagelist_rele(page_t **ppp)
{
        for (; *ppp != NULL; ppp++) {
                if (*ppp != PAGE_HANDLED)
                        page_unlock(*ppp);
        }
}

static int stealcow = 1;

/*
 * Workaround for viking chip bug.  See bug id 1220902.
 * To fix this down in pagefault() would require importing so
 * much as and segvn code as to be unmaintainable.
 */
int enable_mbit_wa = 0;

/*
 * Handles all the dirty work of getting the right
 * anonymous pages and loading up the translations.
 * This routine is called only from segvn_fault()
 * when looping over the range of addresses requested.
 *
 * The basic algorithm here is:
 *      If this is an anon_zero case
 *              Call anon_zero to allocate page
 *              Load up translation
 *              Return
 *      endif
 *      If this is an anon page
 *              Use anon_getpage to get the page
 *      else
 *              Find page in pl[] list passed in
 *      endif
 *      If not a cow
 *              Load up the translation to the page
 *              return
 *      endif
 *      Call anon_private to handle cow
 *      Load up (writable) translation to new page
 */
static faultcode_t
segvn_faultpage(
        struct hat *hat,                /* the hat to use for mapping */
        struct seg *seg,                /* seg_vn of interest */
        caddr_t addr,                   /* address in as */
        uoff_t off,                     /* offset in vp */
        struct vpage *vpage,            /* pointer to vpage for vp, off */
        page_t *pl[],                   /* object source page pointer */
        uint_t vpprot,                  /* access allowed to object pages */
        enum fault_type type,           /* type of fault */
        enum seg_rw rw,                 /* type of access at fault */
        int brkcow)                     /* we may need to break cow */
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        page_t *pp, **ppp;
        uint_t pageflags = 0;
        page_t *anon_pl[1 + 1];
        page_t *opp = NULL;             /* original page */
        uint_t prot;
        int err;
        int cow;
        int claim;
        int steal = 0;
        ulong_t anon_index;
        struct anon *ap, *oldap;
        struct anon_map *amp;
        int hat_flag = (type == F_SOFTLOCK) ? HAT_LOAD_LOCK : HAT_LOAD;
        int anon_lock = 0;
        anon_sync_obj_t cookie;

        if (svd->flags & MAP_TEXT) {
                hat_flag |= HAT_LOAD_TEXT;
        }

        ASSERT(SEGVN_READ_HELD(seg->s_as, &svd->lock));
        ASSERT(seg->s_szc == 0);
        ASSERT(svd->tr_state != SEGVN_TR_INIT);

        /*
         * Initialize protection value for this page.
         * If we have per page protection values check it now.
         */
        if (svd->pageprot) {
                uint_t protchk;

                switch (rw) {
                case S_READ:
                        protchk = PROT_READ;
                        break;
                case S_WRITE:
                        protchk = PROT_WRITE;
                        break;
                case S_EXEC:
                        protchk = PROT_EXEC;
                        break;
                case S_OTHER:
                default:
                        protchk = PROT_READ | PROT_WRITE | PROT_EXEC;
                        break;
                }

                prot = VPP_PROT(vpage);
                if ((prot & protchk) == 0)
                        return (FC_PROT);       /* illegal access type */
        } else {
                prot = svd->prot;
        }

        if (type == F_SOFTLOCK) {
                atomic_inc_ulong((ulong_t *)&svd->softlockcnt);
        }

        /*
         * Always acquire the anon array lock to prevent 2 threads from
         * allocating separate anon slots for the same "addr".
         */

        if ((amp = svd->amp) != NULL) {
                ASSERT(RW_READ_HELD(&amp->a_rwlock));
                anon_index = svd->anon_index + seg_page(seg, addr);
                anon_array_enter(amp, anon_index, &cookie);
                anon_lock = 1;
        }

        if (svd->vp == NULL && amp != NULL) {
                if ((ap = anon_get_ptr(amp->ahp, anon_index)) == NULL) {
                        /*
                         * Allocate a (normally) writable anonymous page of
                         * zeroes. If no advance reservations, reserve now.
                         */
                        if (svd->flags & MAP_NORESERVE) {
                                if (anon_resv_zone(ptob(1),
                                    seg->s_as->a_proc->p_zone)) {
                                        atomic_add_long(&svd->swresv, ptob(1));
                                        atomic_add_long(&seg->s_as->a_resvsize,
                                            ptob(1));
                                } else {
                                        err = ENOMEM;
                                        goto out;
                                }
                        }
                        if ((pp = anon_zero(seg, addr, &ap,
                            svd->cred)) == NULL) {
                                err = ENOMEM;
                                goto out;       /* out of swap space */
                        }
                        /*
                         * Re-acquire the anon_map lock and
                         * initialize the anon array entry.
                         */
                        (void) anon_set_ptr(amp->ahp, anon_index, ap,
                            ANON_SLEEP);

                        ASSERT(pp->p_szc == 0);

                        /*
                         * Handle pages that have been marked for migration
                         */
                        if (lgrp_optimizations())
                                page_migrate(seg, addr, &pp, 1);

                        if (enable_mbit_wa) {
                                if (rw == S_WRITE)
                                        hat_setmod(pp);
                                else if (!hat_ismod(pp))
                                        prot &= ~PROT_WRITE;
                        }
                        /*
                         * If AS_PAGLCK is set in a_flags (via memcntl(2)
                         * with MC_LOCKAS, MCL_FUTURE) and this is a
                         * MAP_NORESERVE segment, we may need to
                         * permanently lock the page as it is being faulted
                         * for the first time. The following text applies
                         * only to MAP_NORESERVE segments:
                         *
                         * As per memcntl(2), if this segment was created
                         * after MCL_FUTURE was applied (a "future"
                         * segment), its pages must be locked.  If this
                         * segment existed at MCL_FUTURE application (a
                         * "past" segment), the interface is unclear.
                         *
                         * We decide to lock only if vpage is present:
                         *
                         * - "future" segments will have a vpage array (see
                         *    as_map), and so will be locked as required
                         *
                         * - "past" segments may not have a vpage array,
                         *    depending on whether events (such as
                         *    mprotect) have occurred. Locking if vpage
                         *    exists will preserve legacy behavior.  Not
                         *    locking if vpage is absent, will not break
                         *    the interface or legacy behavior.  Note that
                         *    allocating vpage here if it's absent requires
                         *    upgrading the segvn reader lock, the cost of
                         *    which does not seem worthwhile.
                         *
                         * Usually testing and setting VPP_ISPPLOCK and
                         * VPP_SETPPLOCK requires holding the segvn lock as
                         * writer, but in this case all readers are
                         * serializing on the anon array lock.
                         */
                        if (AS_ISPGLCK(seg->s_as) && vpage != NULL &&
                            (svd->flags & MAP_NORESERVE) &&
                            !VPP_ISPPLOCK(vpage)) {
                                proc_t *p = seg->s_as->a_proc;
                                ASSERT(svd->type == MAP_PRIVATE);
                                mutex_enter(&p->p_lock);
                                if (rctl_incr_locked_mem(p, NULL, PAGESIZE,
                                    1) == 0) {
                                        claim = VPP_PROT(vpage) & PROT_WRITE;
                                        if (page_pp_lock(pp, claim, 0)) {
                                                VPP_SETPPLOCK(vpage);
                                        } else {
                                                rctl_decr_locked_mem(p, NULL,
                                                    PAGESIZE, 1);
                                        }
                                }
                                mutex_exit(&p->p_lock);
                        }

                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                        hat_memload(hat, addr, pp, prot, hat_flag);

                        if (!(hat_flag & HAT_LOAD_LOCK))
                                page_unlock(pp);

                        anon_array_exit(&cookie);
                        return (0);
                }
        }

        /*
         * Obtain the page structure via anon_getpage() if it is
         * a private copy of an object (the result of a previous
         * copy-on-write).
         */
        if (amp != NULL) {
                if ((ap = anon_get_ptr(amp->ahp, anon_index)) != NULL) {
                        err = anon_getpage(&ap, &vpprot, anon_pl, PAGESIZE,
                            seg, addr, rw, svd->cred);
                        if (err)
                                goto out;

                        if (svd->type == MAP_SHARED) {
                                /*
                                 * If this is a shared mapping to an
                                 * anon_map, then ignore the write
                                 * permissions returned by anon_getpage().
                                 * They apply to the private mappings
                                 * of this anon_map.
                                 */
                                vpprot |= PROT_WRITE;
                        }
                        opp = anon_pl[0];
                }
        }

        /*
         * Search the pl[] list passed in if it is from the
         * original object (i.e., not a private copy).
         */
        if (opp == NULL) {
                /*
                 * Find original page.  We must be bringing it in
                 * from the list in pl[].
                 */
                for (ppp = pl; (opp = *ppp) != NULL; ppp++) {
                        if (opp == PAGE_HANDLED)
                                continue;
                        VERIFY(opp->p_object == &svd->vp->v_object); /* XXX */
                        ASSERT(opp->p_vnode == svd->vp); /* XXX */
                        if (opp->p_offset == off)
                                break;
                }
                if (opp == NULL) {
                        panic("segvn_faultpage not found");
                        /*NOTREACHED*/
                }
                *ppp = PAGE_HANDLED;

        }

        ASSERT(PAGE_LOCKED(opp));

        /*
         * The fault is treated as a copy-on-write fault if a
         * write occurs on a private segment and the object
         * page (i.e., mapping) is write protected.  We assume
         * that fatal protection checks have already been made.
         */

        if (brkcow) {
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                cow = !(vpprot & PROT_WRITE);
        } else if (svd->tr_state == SEGVN_TR_ON) {
                /*
                 * If we are doing text replication COW on first touch.
                 */
                ASSERT(amp != NULL);
                ASSERT(svd->vp != NULL);
                ASSERT(rw != S_WRITE);
                cow = (ap == NULL);
        } else {
                cow = 0;
        }

        /*
         * If not a copy-on-write case load the translation
         * and return.
         */
        if (cow == 0) {

                /*
                 * Handle pages that have been marked for migration
                 */
                if (lgrp_optimizations())
                        page_migrate(seg, addr, &opp, 1);

                if (IS_VMODSORT(opp->p_vnode) || enable_mbit_wa) {
                        if (rw == S_WRITE)
                                hat_setmod(opp);
                        else if (rw != S_OTHER && !hat_ismod(opp))
                                prot &= ~PROT_WRITE;
                }

                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE ||
                    (!svd->pageprot && svd->prot == (prot & vpprot)));
                ASSERT(amp == NULL ||
                    svd->rcookie == HAT_INVALID_REGION_COOKIE);
                hat_memload_region(hat, addr, opp, prot & vpprot, hat_flag,
                    svd->rcookie);

                if (!(hat_flag & HAT_LOAD_LOCK))
                        page_unlock(opp);

                if (anon_lock) {
                        anon_array_exit(&cookie);
                }
                return (0);
        }

        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);

        hat_setref(opp);

        ASSERT(amp != NULL && anon_lock);

        /*
         * Steal the page only if it isn't a private page
         * since stealing a private page is not worth the effort.
         */
        if ((ap = anon_get_ptr(amp->ahp, anon_index)) == NULL)
                steal = 1;

        /*
         * Steal the original page if the following conditions are true:
         *
         * We are low on memory, the page is not private, page is not large,
         * not shared, not modified, not `locked' or if we have it `locked'
         * (i.e., p_cowcnt == 1 and p_lckcnt == 0, which also implies
         * that the page is not shared) and if it doesn't have any
         * translations. page_struct_lock isn't needed to look at p_cowcnt
         * and p_lckcnt because we first get exclusive lock on page.
         */
        (void) hat_pagesync(opp, HAT_SYNC_DONTZERO | HAT_SYNC_STOPON_MOD);

        if (stealcow && freemem < minfree && steal && opp->p_szc == 0 &&
            page_tryupgrade(opp) && !hat_ismod(opp) &&
            ((opp->p_lckcnt == 0 && opp->p_cowcnt == 0) ||
            (opp->p_lckcnt == 0 && opp->p_cowcnt == 1 &&
            vpage != NULL && VPP_ISPPLOCK(vpage)))) {
                /*
                 * Check if this page has other translations
                 * after unloading our translation.
                 */
                if (hat_page_is_mapped(opp)) {
                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                        hat_unload(seg->s_as->a_hat, addr, PAGESIZE,
                            HAT_UNLOAD);
                }

                /*
                 * hat_unload() might sync back someone else's recent
                 * modification, so check again.
                 */
                if (!hat_ismod(opp) && !hat_page_is_mapped(opp))
                        pageflags |= STEAL_PAGE;
        }

        /*
         * If we have a vpage pointer, see if it indicates that we have
         * ``locked'' the page we map -- if so, tell anon_private to
         * transfer the locking resource to the new page.
         *
         * See Statement at the beginning of segvn_lockop regarding
         * the way lockcnts/cowcnts are handled during COW.
         *
         */
        if (vpage != NULL && VPP_ISPPLOCK(vpage))
                pageflags |= LOCK_PAGE;

        /*
         * Allocate a private page and perform the copy.
         * For MAP_NORESERVE reserve swap space now, unless this
         * is a cow fault on an existing anon page in which case
         * MAP_NORESERVE will have made advance reservations.
         */
        if ((svd->flags & MAP_NORESERVE) && (ap == NULL)) {
                if (anon_resv_zone(ptob(1), seg->s_as->a_proc->p_zone)) {
                        atomic_add_long(&svd->swresv, ptob(1));
                        atomic_add_long(&seg->s_as->a_resvsize, ptob(1));
                } else {
                        page_unlock(opp);
                        err = ENOMEM;
                        goto out;
                }
        }
        oldap = ap;
        pp = anon_private(&ap, seg, addr, prot, opp, pageflags, svd->cred);
        if (pp == NULL) {
                err = ENOMEM;   /* out of swap space */
                goto out;
        }

        /*
         * If we copied away from an anonymous page, then
         * we are one step closer to freeing up an anon slot.
         *
         * NOTE:  The original anon slot must be released while
         * holding the "anon_map" lock.  This is necessary to prevent
         * other threads from obtaining a pointer to the anon slot
         * which may be freed if its "refcnt" is 1.
         */
        if (oldap != NULL)
                anon_decref(oldap);

        (void) anon_set_ptr(amp->ahp, anon_index, ap, ANON_SLEEP);

        /*
         * Handle pages that have been marked for migration
         */
        if (lgrp_optimizations())
                page_migrate(seg, addr, &pp, 1);

        ASSERT(pp->p_szc == 0);

        ASSERT(!IS_VMODSORT(pp->p_vnode));
        if (enable_mbit_wa) {
                if (rw == S_WRITE)
                        hat_setmod(pp);
                else if (!hat_ismod(pp))
                        prot &= ~PROT_WRITE;
        }

        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
        hat_memload(hat, addr, pp, prot, hat_flag);

        if (!(hat_flag & HAT_LOAD_LOCK))
                page_unlock(pp);

        ASSERT(anon_lock);
        anon_array_exit(&cookie);
        return (0);
out:
        if (anon_lock)
                anon_array_exit(&cookie);

        if (type == F_SOFTLOCK) {
                atomic_dec_ulong((ulong_t *)&svd->softlockcnt);
        }
        return (FC_MAKE_ERR(err));
}

/*
 * relocate a bunch of smaller targ pages into one large repl page. all targ
 * pages must be complete pages smaller than replacement pages.
 * it's assumed that no page's szc can change since they are all PAGESIZE or
 * complete large pages locked SHARED.
 */
static void
segvn_relocate_pages(page_t **targ, page_t *replacement)
{
        page_t *pp;
        pgcnt_t repl_npgs, curnpgs;
        pgcnt_t i;
        uint_t repl_szc = replacement->p_szc;
        page_t *first_repl = replacement;
        page_t *repl;
        spgcnt_t npgs;

        VM_STAT_ADD(segvnvmstats.relocatepages[0]);

        ASSERT(repl_szc != 0);
        npgs = repl_npgs = page_get_pagecnt(repl_szc);

        i = 0;
        while (repl_npgs) {
                spgcnt_t nreloc;
                int err;
                ASSERT(replacement != NULL);
                pp = targ[i];
                ASSERT(pp->p_szc < repl_szc);
                ASSERT(PAGE_EXCL(pp));
                ASSERT(!PP_ISFREE(pp));
                curnpgs = page_get_pagecnt(pp->p_szc);
                if (curnpgs == 1) {
                        VM_STAT_ADD(segvnvmstats.relocatepages[1]);
                        repl = replacement;
                        page_sub(&replacement, repl);
                        ASSERT(PAGE_EXCL(repl));
                        ASSERT(!PP_ISFREE(repl));
                        ASSERT(repl->p_szc == repl_szc);
                } else {
                        page_t *repl_savepp;
                        int j;
                        VM_STAT_ADD(segvnvmstats.relocatepages[2]);
                        repl_savepp = replacement;
                        for (j = 0; j < curnpgs; j++) {
                                repl = replacement;
                                page_sub(&replacement, repl);
                                ASSERT(PAGE_EXCL(repl));
                                ASSERT(!PP_ISFREE(repl));
                                ASSERT(repl->p_szc == repl_szc);
                                ASSERT(page_pptonum(targ[i + j]) ==
                                    page_pptonum(targ[i]) + j);
                        }
                        repl = repl_savepp;
                        ASSERT(IS_P2ALIGNED(page_pptonum(repl), curnpgs));
                }
                err = page_relocate(&pp, &repl, 0, 1, &nreloc, NULL);
                if (err || nreloc != curnpgs) {
                        panic("segvn_relocate_pages: "
                            "page_relocate failed err=%d curnpgs=%ld "
                            "nreloc=%ld", err, curnpgs, nreloc);
                }
                ASSERT(curnpgs <= repl_npgs);
                repl_npgs -= curnpgs;
                i += curnpgs;
        }
        ASSERT(replacement == NULL);

        repl = first_repl;
        repl_npgs = npgs;
        for (i = 0; i < repl_npgs; i++) {
                ASSERT(PAGE_EXCL(repl));
                ASSERT(!PP_ISFREE(repl));
                targ[i] = repl;
                page_downgrade(targ[i]);
                repl++;
        }
}

/*
 * Check if all pages in ppa array are complete smaller than szc pages and
 * their roots will still be aligned relative to their current size if the
 * entire ppa array is relocated into one szc page. If these conditions are
 * not met return 0.
 *
 * If all pages are properly aligned attempt to upgrade their locks
 * to exclusive mode. If it fails set *upgrdfail to 1 and return 0.
 * upgrdfail was set to 0 by caller.
 *
 * Return 1 if all pages are aligned and locked exclusively.
 *
 * If all pages in ppa array happen to be physically contiguous to make one
 * szc page and all exclusive locks are successfully obtained promote the page
 * size to szc and set *pszc to szc. Return 1 with pages locked shared.
 */
static int
segvn_full_szcpages(page_t **ppa, uint_t szc, int *upgrdfail, uint_t *pszc)
{
        page_t *pp;
        pfn_t pfn;
        pgcnt_t totnpgs = page_get_pagecnt(szc);
        pfn_t first_pfn;
        int contig = 1;
        pgcnt_t i;
        pgcnt_t j;
        uint_t curszc;
        pgcnt_t curnpgs;
        int root = 0;

        ASSERT(szc > 0);

        VM_STAT_ADD(segvnvmstats.fullszcpages[0]);

        for (i = 0; i < totnpgs; i++) {
                pp = ppa[i];
                ASSERT(PAGE_SHARED(pp));
                ASSERT(!PP_ISFREE(pp));
                pfn = page_pptonum(pp);
                if (i == 0) {
                        if (!IS_P2ALIGNED(pfn, totnpgs)) {
                                contig = 0;
                        } else {
                                first_pfn = pfn;
                        }
                } else if (contig && pfn != first_pfn + i) {
                        contig = 0;
                }
                if (pp->p_szc == 0) {
                        if (root) {
                                VM_STAT_ADD(segvnvmstats.fullszcpages[1]);
                                return (0);
                        }
                } else if (!root) {
                        if ((curszc = pp->p_szc) >= szc) {
                                VM_STAT_ADD(segvnvmstats.fullszcpages[2]);
                                return (0);
                        }
                        if (curszc == 0) {
                                /*
                                 * p_szc changed means we don't have all pages
                                 * locked. return failure.
                                 */
                                VM_STAT_ADD(segvnvmstats.fullszcpages[3]);
                                return (0);
                        }
                        curnpgs = page_get_pagecnt(curszc);
                        if (!IS_P2ALIGNED(pfn, curnpgs) ||
                            !IS_P2ALIGNED(i, curnpgs)) {
                                VM_STAT_ADD(segvnvmstats.fullszcpages[4]);
                                return (0);
                        }
                        root = 1;
                } else {
                        ASSERT(i > 0);
                        VM_STAT_ADD(segvnvmstats.fullszcpages[5]);
                        if (pp->p_szc != curszc) {
                                VM_STAT_ADD(segvnvmstats.fullszcpages[6]);
                                return (0);
                        }
                        if (pfn - 1 != page_pptonum(ppa[i - 1])) {
                                panic("segvn_full_szcpages: "
                                    "large page not physically contiguous");
                        }
                        if (P2PHASE(pfn, curnpgs) == curnpgs - 1) {
                                root = 0;
                        }
                }
        }

        for (i = 0; i < totnpgs; i++) {
                ASSERT(ppa[i]->p_szc < szc);
                if (!page_tryupgrade(ppa[i])) {
                        for (j = 0; j < i; j++) {
                                page_downgrade(ppa[j]);
                        }
                        *pszc = ppa[i]->p_szc;
                        *upgrdfail = 1;
                        VM_STAT_ADD(segvnvmstats.fullszcpages[7]);
                        return (0);
                }
        }

        /*
         * When a page is put a free cachelist its szc is set to 0.  if file
         * system reclaimed pages from cachelist targ pages will be physically
         * contiguous with 0 p_szc.  in this case just upgrade szc of targ
         * pages without any relocations.
         * To avoid any hat issues with previous small mappings
         * hat_pageunload() the target pages first.
         */
        if (contig) {
                VM_STAT_ADD(segvnvmstats.fullszcpages[8]);
                for (i = 0; i < totnpgs; i++) {
                        (void) hat_pageunload(ppa[i], HAT_FORCE_PGUNLOAD);
                }
                for (i = 0; i < totnpgs; i++) {
                        ppa[i]->p_szc = szc;
                }
                for (i = 0; i < totnpgs; i++) {
                        ASSERT(PAGE_EXCL(ppa[i]));
                        page_downgrade(ppa[i]);
                }
                if (pszc != NULL) {
                        *pszc = szc;
                }
        }
        VM_STAT_ADD(segvnvmstats.fullszcpages[9]);
        return (1);
}

/*
 * Create physically contiguous pages for [vp, off] - [vp, off +
 * page_size(szc)) range and for private segment return them in ppa array.
 * Pages are created either via IO or relocations.
 *
 * Return 1 on success and 0 on failure.
 *
 * If physically contiguous pages already exist for this range return 1 without
 * filling ppa array. Caller initializes ppa[0] as NULL to detect that ppa
 * array wasn't filled. In this case caller fills ppa array via fop_getpage().
 */

static int
segvn_fill_vp_pages(struct segvn_data *svd, vnode_t *vp, uoff_t off,
    uint_t szc, page_t **ppa, page_t **ppplist, uint_t *ret_pszc,
    int *downsize)

{
        page_t *pplist = *ppplist;
        size_t pgsz = page_get_pagesize(szc);
        pgcnt_t pages = btop(pgsz);
        ulong_t start_off = off;
        uoff_t eoff = off + pgsz;
        spgcnt_t nreloc;
        uoff_t io_off = off;
        size_t io_len;
        page_t *io_pplist = NULL;
        page_t *done_pplist = NULL;
        pgcnt_t pgidx = 0;
        page_t *pp;
        page_t *newpp;
        page_t *targpp;
        int io_err = 0;
        int i;
        pfn_t pfn;
        ulong_t ppages;
        page_t *targ_pplist = NULL;
        page_t *repl_pplist = NULL;
        page_t *tmp_pplist;
        int nios = 0;
        uint_t pszc;
        struct vattr va;

        VM_STAT_ADD(segvnvmstats.fill_vp_pages[0]);

        ASSERT(szc != 0);
        ASSERT(pplist->p_szc == szc);

        /*
         * downsize will be set to 1 only if we fail to lock pages. this will
         * allow subsequent faults to try to relocate the page again. If we
         * fail due to misalignment don't downsize and let the caller map the
         * whole region with small mappings to avoid more faults into the area
         * where we can't get large pages anyway.
         */
        *downsize = 0;

        while (off < eoff) {
                newpp = pplist;
                ASSERT(newpp != NULL);
                ASSERT(PAGE_EXCL(newpp));
                ASSERT(!PP_ISFREE(newpp));
                /*
                 * we pass NULL for nrelocp to page_lookup_create()
                 * so that it doesn't relocate. We relocate here
                 * later only after we make sure we can lock all
                 * pages in the range we handle and they are all
                 * aligned.
                 */
                pp = page_lookup_create(&vp->v_object, off, SE_SHARED, newpp,
                                        NULL, 0);
                ASSERT(pp != NULL);
                ASSERT(!PP_ISFREE(pp));
                VERIFY(pp->p_object == &vp->v_object);
                ASSERT(pp->p_vnode == vp);
                ASSERT(pp->p_offset == off);
                if (pp == newpp) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[1]);
                        page_sub(&pplist, pp);
                        ASSERT(PAGE_EXCL(pp));
                        ASSERT(page_iolock_assert(pp));
                        page_list_concat(&io_pplist, &pp);
                        off += PAGESIZE;
                        continue;
                }
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[2]);
                pfn = page_pptonum(pp);
                pszc = pp->p_szc;
                if (pszc >= szc && targ_pplist == NULL && io_pplist == NULL &&
                    IS_P2ALIGNED(pfn, pages)) {
                        ASSERT(repl_pplist == NULL);
                        ASSERT(done_pplist == NULL);
                        ASSERT(pplist == *ppplist);
                        page_unlock(pp);
                        page_free_replacement_page(pplist);
                        page_create_putback(pages);
                        *ppplist = NULL;
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[3]);
                        return (1);
                }
                if (pszc >= szc) {
                        page_unlock(pp);
                        segvn_faultvnmpss_align_err1++;
                        goto out;
                }
                ppages = page_get_pagecnt(pszc);
                if (!IS_P2ALIGNED(pfn, ppages)) {
                        ASSERT(pszc > 0);
                        /*
                         * sizing down to pszc won't help.
                         */
                        page_unlock(pp);
                        segvn_faultvnmpss_align_err2++;
                        goto out;
                }
                pfn = page_pptonum(newpp);
                if (!IS_P2ALIGNED(pfn, ppages)) {
                        ASSERT(pszc > 0);
                        /*
                         * sizing down to pszc won't help.
                         */
                        page_unlock(pp);
                        segvn_faultvnmpss_align_err3++;
                        goto out;
                }
                if (!PAGE_EXCL(pp)) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[4]);
                        page_unlock(pp);
                        *downsize = 1;
                        *ret_pszc = pp->p_szc;
                        goto out;
                }
                targpp = pp;
                if (io_pplist != NULL) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[5]);
                        io_len = off - io_off;
                        /*
                         * Some file systems like NFS don't check EOF
                         * conditions in fop_pageio(). Check it here
                         * now that pages are locked SE_EXCL. Any file
                         * truncation will wait until the pages are
                         * unlocked so no need to worry that file will
                         * be truncated after we check its size here.
                         * XXX fix NFS to remove this check.
                         */
                        va.va_mask = AT_SIZE;
                        if (fop_getattr(vp, &va, ATTR_HINT, svd->cred, NULL)) {
                                VM_STAT_ADD(segvnvmstats.fill_vp_pages[6]);
                                page_unlock(targpp);
                                goto out;
                        }
                        if (btopr(va.va_size) < btopr(io_off + io_len)) {
                                VM_STAT_ADD(segvnvmstats.fill_vp_pages[7]);
                                *downsize = 1;
                                *ret_pszc = 0;
                                page_unlock(targpp);
                                goto out;
                        }
                        io_err = fop_pageio(vp, io_pplist, io_off, io_len,
                                B_READ, svd->cred, NULL);
                        if (io_err) {
                                VM_STAT_ADD(segvnvmstats.fill_vp_pages[8]);
                                page_unlock(targpp);
                                if (io_err == EDEADLK) {
                                        segvn_vmpss_pageio_deadlk_err++;
                                }
                                goto out;
                        }
                        nios++;
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[9]);
                        while (io_pplist != NULL) {
                                pp = io_pplist;
                                page_sub(&io_pplist, pp);
                                ASSERT(page_iolock_assert(pp));
                                page_io_unlock(pp);
                                pgidx = (pp->p_offset - start_off) >>
                                    PAGESHIFT;
                                ASSERT(pgidx < pages);
                                ppa[pgidx] = pp;
                                page_list_concat(&done_pplist, &pp);
                        }
                }
                pp = targpp;
                ASSERT(PAGE_EXCL(pp));
                ASSERT(pp->p_szc <= pszc);
                if (pszc != 0 && !group_page_trylock(pp, SE_EXCL)) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[10]);
                        page_unlock(pp);
                        *downsize = 1;
                        *ret_pszc = pp->p_szc;
                        goto out;
                }
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[11]);
                /*
                 * page szc chould have changed before the entire group was
                 * locked. reread page szc.
                 */
                pszc = pp->p_szc;
                ppages = page_get_pagecnt(pszc);

                /* link just the roots */
                page_list_concat(&targ_pplist, &pp);
                page_sub(&pplist, newpp);
                page_list_concat(&repl_pplist, &newpp);
                off += PAGESIZE;
                while (--ppages != 0) {
                        newpp = pplist;
                        page_sub(&pplist, newpp);
                        off += PAGESIZE;
                }
                io_off = off;
        }
        if (io_pplist != NULL) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[12]);
                io_len = eoff - io_off;
                va.va_mask = AT_SIZE;
                if (fop_getattr(vp, &va, ATTR_HINT, svd->cred, NULL) != 0) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[13]);
                        goto out;
                }
                if (btopr(va.va_size) < btopr(io_off + io_len)) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[14]);
                        *downsize = 1;
                        *ret_pszc = 0;
                        goto out;
                }
                io_err = fop_pageio(vp, io_pplist, io_off, io_len,
                    B_READ, svd->cred, NULL);
                if (io_err) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[15]);
                        if (io_err == EDEADLK) {
                                segvn_vmpss_pageio_deadlk_err++;
                        }
                        goto out;
                }
                nios++;
                while (io_pplist != NULL) {
                        pp = io_pplist;
                        page_sub(&io_pplist, pp);
                        ASSERT(page_iolock_assert(pp));
                        page_io_unlock(pp);
                        pgidx = (pp->p_offset - start_off) >> PAGESHIFT;
                        ASSERT(pgidx < pages);
                        ppa[pgidx] = pp;
                }
        }
        /*
         * we're now bound to succeed or panic.
         * remove pages from done_pplist. it's not needed anymore.
         */
        while (done_pplist != NULL) {
                pp = done_pplist;
                page_sub(&done_pplist, pp);
        }
        VM_STAT_ADD(segvnvmstats.fill_vp_pages[16]);
        ASSERT(pplist == NULL);
        *ppplist = NULL;
        while (targ_pplist != NULL) {
                int ret;
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[17]);
                ASSERT(repl_pplist);
                pp = targ_pplist;
                page_sub(&targ_pplist, pp);
                pgidx = (pp->p_offset - start_off) >> PAGESHIFT;
                newpp = repl_pplist;
                page_sub(&repl_pplist, newpp);
#ifdef DEBUG
                pfn = page_pptonum(pp);
                pszc = pp->p_szc;
                ppages = page_get_pagecnt(pszc);
                ASSERT(IS_P2ALIGNED(pfn, ppages));
                pfn = page_pptonum(newpp);
                ASSERT(IS_P2ALIGNED(pfn, ppages));
                ASSERT(P2PHASE(pfn, pages) == pgidx);
#endif
                nreloc = 0;
                ret = page_relocate(&pp, &newpp, 0, 1, &nreloc, NULL);
                if (ret != 0 || nreloc == 0) {
                        panic("segvn_fill_vp_pages: "
                            "page_relocate failed");
                }
                pp = newpp;
                while (nreloc-- != 0) {
                        ASSERT(PAGE_EXCL(pp));
                        VERIFY(pp->p_object == &vp->v_object);
                        ASSERT(pp->p_vnode == vp);
                        ASSERT(pgidx ==
                            ((pp->p_offset - start_off) >> PAGESHIFT));
                        ppa[pgidx++] = pp;
                        pp++;
                }
        }

        if (svd->type == MAP_PRIVATE) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[18]);
                for (i = 0; i < pages; i++) {
                        ASSERT(ppa[i] != NULL);
                        ASSERT(PAGE_EXCL(ppa[i]));
                        VERIFY(ppa[i]->p_object == &vp->v_object);
                        ASSERT(ppa[i]->p_vnode == vp);
                        ASSERT(ppa[i]->p_offset ==
                            start_off + (i << PAGESHIFT));
                        page_downgrade(ppa[i]);
                }
                ppa[pages] = NULL;
        } else {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[19]);
                /*
                 * the caller will still call fop_getpage() for shared segments
                 * to check FS write permissions. For private segments we map
                 * file read only anyway.  so no fop_getpage is needed.
                 */
                for (i = 0; i < pages; i++) {
                        ASSERT(ppa[i] != NULL);
                        ASSERT(PAGE_EXCL(ppa[i]));
                        VERIFY(ppa[i]->p_object == &vp->v_object);
                        ASSERT(ppa[i]->p_vnode == vp);
                        ASSERT(ppa[i]->p_offset ==
                            start_off + (i << PAGESHIFT));
                        page_unlock(ppa[i]);
                }
                ppa[0] = NULL;
        }

        return (1);
out:
        /*
         * Do the cleanup. Unlock target pages we didn't relocate. They are
         * linked on targ_pplist by root pages. reassemble unused replacement
         * and io pages back to pplist.
         */
        if (io_pplist != NULL) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[20]);
                pp = io_pplist;
                do {
                        VERIFY(pp->p_object == &vp->v_object);
                        ASSERT(pp->p_vnode == vp);
                        ASSERT(pp->p_offset == io_off);
                        ASSERT(page_iolock_assert(pp));
                        page_io_unlock(pp);
                        page_hashout(pp, false);
                        io_off += PAGESIZE;
                } while ((pp = pp->p_next) != io_pplist);
                page_list_concat(&io_pplist, &pplist);
                pplist = io_pplist;
        }
        tmp_pplist = NULL;
        while (targ_pplist != NULL) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[21]);
                pp = targ_pplist;
                ASSERT(PAGE_EXCL(pp));
                page_sub(&targ_pplist, pp);

                pszc = pp->p_szc;
                ppages = page_get_pagecnt(pszc);
                ASSERT(IS_P2ALIGNED(page_pptonum(pp), ppages));

                if (pszc != 0) {
                        group_page_unlock(pp);
                }
                page_unlock(pp);

                pp = repl_pplist;
                ASSERT(pp != NULL);
                ASSERT(PAGE_EXCL(pp));
                ASSERT(pp->p_szc == szc);
                page_sub(&repl_pplist, pp);

                ASSERT(IS_P2ALIGNED(page_pptonum(pp), ppages));

                /* relink replacement page */
                page_list_concat(&tmp_pplist, &pp);
                while (--ppages != 0) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[22]);
                        pp++;
                        ASSERT(PAGE_EXCL(pp));
                        ASSERT(pp->p_szc == szc);
                        page_list_concat(&tmp_pplist, &pp);
                }
        }
        if (tmp_pplist != NULL) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[23]);
                page_list_concat(&tmp_pplist, &pplist);
                pplist = tmp_pplist;
        }
        /*
         * at this point all pages are either on done_pplist or
         * pplist. They can't be all on done_pplist otherwise
         * we'd've been done.
         */
        ASSERT(pplist != NULL);
        if (nios != 0) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[24]);
                pp = pplist;
                do {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[25]);
                        ASSERT(pp->p_szc == szc);
                        ASSERT(PAGE_EXCL(pp));
                        VERIFY(pp->p_object != &vp->v_object);
                        ASSERT(pp->p_vnode != vp);
                        pp->p_szc = 0;
                } while ((pp = pp->p_next) != pplist);

                pp = done_pplist;
                do {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[26]);
                        ASSERT(pp->p_szc == szc);
                        ASSERT(PAGE_EXCL(pp));
                        VERIFY(pp->p_object == &vp->v_object);
                        ASSERT(pp->p_vnode == vp);
                        pp->p_szc = 0;
                } while ((pp = pp->p_next) != done_pplist);

                while (pplist != NULL) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[27]);
                        pp = pplist;
                        page_sub(&pplist, pp);
                        page_free(pp, 0);
                }

                while (done_pplist != NULL) {
                        VM_STAT_ADD(segvnvmstats.fill_vp_pages[28]);
                        pp = done_pplist;
                        page_sub(&done_pplist, pp);
                        page_unlock(pp);
                }
                *ppplist = NULL;
                return (0);
        }
        ASSERT(pplist == *ppplist);
        if (io_err) {
                VM_STAT_ADD(segvnvmstats.fill_vp_pages[29]);
                /*
                 * don't downsize on io error.
                 * see if vop_getpage succeeds.
                 * pplist may still be used in this case
                 * for relocations.
                 */
                return (0);
        }
        VM_STAT_ADD(segvnvmstats.fill_vp_pages[30]);
        page_free_replacement_page(pplist);
        page_create_putback(pages);
        *ppplist = NULL;
        return (0);
}

int segvn_anypgsz = 0;

#define SEGVN_RESTORE_SOFTLOCK_VP(type, pages)                          \
                if ((type) == F_SOFTLOCK) {                             \
                        atomic_add_long((ulong_t *)&(svd)->softlockcnt, \
                            -(pages));                                  \
                }

#define SEGVN_UPDATE_MODBITS(ppa, pages, rw, prot, vpprot)              \
                if (IS_VMODSORT((ppa)[0]->p_vnode)) {                   \
                        if ((rw) == S_WRITE) {                          \
                                for (i = 0; i < (pages); i++) {         \
                                        VERIFY((ppa)[i]->p_object ==    \
                                               (ppa)[i]->p_object);     \
                                        ASSERT((ppa)[i]->p_vnode ==     \
                                            (ppa)[0]->p_vnode);         \
                                        hat_setmod((ppa)[i]);           \
                                }                                       \
                        } else if ((rw) != S_OTHER &&                   \
                            ((prot) & (vpprot) & PROT_WRITE)) {         \
                                for (i = 0; i < (pages); i++) {         \
                                        VERIFY((ppa)[i]->p_object ==    \
                                               (ppa)[i]->p_object);     \
                                        ASSERT((ppa)[i]->p_vnode ==     \
                                            (ppa)[0]->p_vnode);         \
                                        if (!hat_ismod((ppa)[i])) {     \
                                                prot &= ~PROT_WRITE;    \
                                                break;                  \
                                        }                               \
                                }                                       \
                        }                                               \
                }

#define SEGVN_VMSTAT_FLTVNPAGES(idx)                                    \
                VM_STAT_ADD(segvnvmstats.fltvnpages[(idx)]);

static faultcode_t
segvn_fault_vnodepages(struct hat *hat, struct seg *seg, caddr_t lpgaddr,
    caddr_t lpgeaddr, enum fault_type type, enum seg_rw rw, caddr_t addr,
    caddr_t eaddr, int brkcow)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon_map *amp = svd->amp;
        uchar_t segtype = svd->type;
        uint_t szc = seg->s_szc;
        size_t pgsz = page_get_pagesize(szc);
        size_t maxpgsz = pgsz;
        pgcnt_t pages = btop(pgsz);
        pgcnt_t maxpages = pages;
        size_t ppasize = (pages + 1) * sizeof (page_t *);
        caddr_t a = lpgaddr;
        caddr_t maxlpgeaddr = lpgeaddr;
        uoff_t off = svd->offset + (uintptr_t)(a - seg->s_base);
        ulong_t aindx = svd->anon_index + seg_page(seg, a);
        struct vpage *vpage = (svd->vpage != NULL) ?
            &svd->vpage[seg_page(seg, a)] : NULL;
        vnode_t *vp = svd->vp;
        page_t **ppa;
        uint_t  pszc;
        size_t  ppgsz;
        pgcnt_t ppages;
        faultcode_t err = 0;
        int ierr;
        int vop_size_err = 0;
        uint_t protchk, prot, vpprot;
        ulong_t i;
        int hat_flag = (type == F_SOFTLOCK) ? HAT_LOAD_LOCK : HAT_LOAD;
        anon_sync_obj_t an_cookie;
        enum seg_rw arw;
        int alloc_failed = 0;
        int adjszc_chk;
        struct vattr va;
        page_t *pplist;
        pfn_t pfn;
        int physcontig;
        int upgrdfail;
        int segvn_anypgsz_vnode = 0; /* for now map vnode with 2 page sizes */
        int tron = (svd->tr_state == SEGVN_TR_ON);

        ASSERT(szc != 0);
        ASSERT(vp != NULL);
        ASSERT(brkcow == 0 || amp != NULL);
        ASSERT(tron == 0 || amp != NULL);
        ASSERT(enable_mbit_wa == 0); /* no mbit simulations with large pages */
        ASSERT(!(svd->flags & MAP_NORESERVE));
        ASSERT(type != F_SOFTUNLOCK);
        ASSERT(IS_P2ALIGNED(a, maxpgsz));
        ASSERT(amp == NULL || IS_P2ALIGNED(aindx, maxpages));
        ASSERT(SEGVN_LOCK_HELD(seg->s_as, &svd->lock));
        ASSERT(seg->s_szc < NBBY * sizeof (int));
        ASSERT(type != F_SOFTLOCK || lpgeaddr - a == maxpgsz);
        ASSERT(svd->tr_state != SEGVN_TR_INIT);

        VM_STAT_COND_ADD(type == F_SOFTLOCK, segvnvmstats.fltvnpages[0]);
        VM_STAT_COND_ADD(type != F_SOFTLOCK, segvnvmstats.fltvnpages[1]);

        if (svd->flags & MAP_TEXT) {
                hat_flag |= HAT_LOAD_TEXT;
        }

        if (svd->pageprot) {
                switch (rw) {
                case S_READ:
                        protchk = PROT_READ;
                        break;
                case S_WRITE:
                        protchk = PROT_WRITE;
                        break;
                case S_EXEC:
                        protchk = PROT_EXEC;
                        break;
                case S_OTHER:
                default:
                        protchk = PROT_READ | PROT_WRITE | PROT_EXEC;
                        break;
                }
        } else {
                prot = svd->prot;
                /* caller has already done segment level protection check. */
        }

        if (rw == S_WRITE && segtype == MAP_PRIVATE) {
                SEGVN_VMSTAT_FLTVNPAGES(2);
                arw = S_READ;
        } else {
                arw = rw;
        }

        ppa = kmem_alloc(ppasize, KM_SLEEP);

        VM_STAT_COND_ADD(amp != NULL, segvnvmstats.fltvnpages[3]);

        for (;;) {
                adjszc_chk = 0;
                for (; a < lpgeaddr; a += pgsz, off += pgsz, aindx += pages) {
                        if (adjszc_chk) {
                                while (szc < seg->s_szc) {
                                        uintptr_t e;
                                        uint_t tszc;
                                        tszc = segvn_anypgsz_vnode ? szc + 1 :
                                            seg->s_szc;
                                        ppgsz = page_get_pagesize(tszc);
                                        if (!IS_P2ALIGNED(a, ppgsz) ||
                                            ((alloc_failed >> tszc) & 0x1)) {
                                                break;
                                        }
                                        SEGVN_VMSTAT_FLTVNPAGES(4);
                                        szc = tszc;
                                        pgsz = ppgsz;
                                        pages = btop(pgsz);
                                        e = P2ROUNDUP((uintptr_t)eaddr, pgsz);
                                        lpgeaddr = (caddr_t)e;
                                }
                        }

                again:
                        if (IS_P2ALIGNED(a, maxpgsz) && amp != NULL) {
                                ASSERT(IS_P2ALIGNED(aindx, maxpages));
                                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                                anon_array_enter(amp, aindx, &an_cookie);
                                if (anon_get_ptr(amp->ahp, aindx) != NULL) {
                                        SEGVN_VMSTAT_FLTVNPAGES(5);
                                        ASSERT(anon_pages(amp->ahp, aindx,
                                            maxpages) == maxpages);
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                        err = segvn_fault_anonpages(hat, seg,
                                            a, a + maxpgsz, type, rw,
                                            MAX(a, addr),
                                            MIN(a + maxpgsz, eaddr), brkcow);
                                        if (err != 0) {
                                                SEGVN_VMSTAT_FLTVNPAGES(6);
                                                goto out;
                                        }
                                        if (szc < seg->s_szc) {
                                                szc = seg->s_szc;
                                                pgsz = maxpgsz;
                                                pages = maxpages;
                                                lpgeaddr = maxlpgeaddr;
                                        }
                                        goto next;
                                } else {
                                        ASSERT(anon_pages(amp->ahp, aindx,
                                            maxpages) == 0);
                                        SEGVN_VMSTAT_FLTVNPAGES(7);
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                        }
                        ASSERT(!brkcow || IS_P2ALIGNED(a, maxpgsz));
                        ASSERT(!tron || IS_P2ALIGNED(a, maxpgsz));

                        if (svd->pageprot != 0 && IS_P2ALIGNED(a, maxpgsz)) {
                                ASSERT(vpage != NULL);
                                prot = VPP_PROT(vpage);
                                ASSERT(sameprot(seg, a, maxpgsz));
                                if ((prot & protchk) == 0) {
                                        SEGVN_VMSTAT_FLTVNPAGES(8);
                                        err = FC_PROT;
                                        goto out;
                                }
                        }
                        if (type == F_SOFTLOCK) {
                                atomic_add_long((ulong_t *)&svd->softlockcnt,
                                    pages);
                        }

                        pplist = NULL;
                        physcontig = 0;
                        ppa[0] = NULL;
                        if (!brkcow && !tron && szc &&
                            !page_exists_physcontig(&vp->v_object, off, szc,
                            segtype == MAP_PRIVATE ? ppa : NULL)) {
                                SEGVN_VMSTAT_FLTVNPAGES(9);
                                if (page_alloc_pages(&vp->v_object, seg, a,
                                    &pplist, NULL, szc, 0, 0) &&
                                    type != F_SOFTLOCK) {
                                        SEGVN_VMSTAT_FLTVNPAGES(10);
                                        pszc = 0;
                                        ierr = -1;
                                        alloc_failed |= (1 << szc);
                                        break;
                                }
                                if (pplist != NULL &&
                                    vp->v_mpssdata == SEGVN_PAGEIO) {
                                        int downsize;
                                        SEGVN_VMSTAT_FLTVNPAGES(11);
                                        physcontig = segvn_fill_vp_pages(svd,
                                            vp, off, szc, ppa, &pplist,
                                            &pszc, &downsize);
                                        ASSERT(!physcontig || pplist == NULL);
                                        if (!physcontig && downsize &&
                                            type != F_SOFTLOCK) {
                                                ASSERT(pplist == NULL);
                                                SEGVN_VMSTAT_FLTVNPAGES(12);
                                                ierr = -1;
                                                break;
                                        }
                                        ASSERT(!physcontig ||
                                            segtype == MAP_PRIVATE ||
                                            ppa[0] == NULL);
                                        if (physcontig && ppa[0] == NULL) {
                                                physcontig = 0;
                                        }
                                }
                        } else if (!brkcow && !tron && szc && ppa[0] != NULL) {
                                SEGVN_VMSTAT_FLTVNPAGES(13);
                                ASSERT(segtype == MAP_PRIVATE);
                                physcontig = 1;
                        }

                        if (!physcontig) {
                                SEGVN_VMSTAT_FLTVNPAGES(14);
                                ppa[0] = NULL;
                                ierr = fop_getpage(vp, (offset_t)off, pgsz,
                                    &vpprot, ppa, pgsz, seg, a, arw,
                                    svd->cred, NULL);
#ifdef DEBUG
                                if (ierr == 0) {
                                        for (i = 0; i < pages; i++) {
                                                ASSERT(PAGE_LOCKED(ppa[i]));
                                                ASSERT(!PP_ISFREE(ppa[i]));
                                                VERIFY(ppa[i]->p_object ==
                                                       &vp->v_object);
                                                ASSERT(ppa[i]->p_vnode == vp);
                                                ASSERT(ppa[i]->p_offset ==
                                                    off + (i << PAGESHIFT));
                                        }
                                }
#endif /* DEBUG */
                                if (segtype == MAP_PRIVATE) {
                                        SEGVN_VMSTAT_FLTVNPAGES(15);
                                        vpprot &= ~PROT_WRITE;
                                }
                        } else {
                                ASSERT(segtype == MAP_PRIVATE);
                                SEGVN_VMSTAT_FLTVNPAGES(16);
                                vpprot = PROT_ALL & ~PROT_WRITE;
                                ierr = 0;
                        }

                        if (ierr != 0) {
                                SEGVN_VMSTAT_FLTVNPAGES(17);
                                if (pplist != NULL) {
                                        SEGVN_VMSTAT_FLTVNPAGES(18);
                                        page_free_replacement_page(pplist);
                                        page_create_putback(pages);
                                }
                                SEGVN_RESTORE_SOFTLOCK_VP(type, pages);
                                if (a + pgsz <= eaddr) {
                                        SEGVN_VMSTAT_FLTVNPAGES(19);
                                        err = FC_MAKE_ERR(ierr);
                                        goto out;
                                }
                                va.va_mask = AT_SIZE;
                                if (fop_getattr(vp, &va, 0, svd->cred, NULL)) {
                                        SEGVN_VMSTAT_FLTVNPAGES(20);
                                        err = FC_MAKE_ERR(EIO);
                                        goto out;
                                }
                                if (btopr(va.va_size) >= btopr(off + pgsz)) {
                                        SEGVN_VMSTAT_FLTVNPAGES(21);
                                        err = FC_MAKE_ERR(ierr);
                                        goto out;
                                }
                                if (btopr(va.va_size) <
                                    btopr(off + (eaddr - a))) {
                                        SEGVN_VMSTAT_FLTVNPAGES(22);
                                        err = FC_MAKE_ERR(ierr);
                                        goto out;
                                }
                                if (brkcow || tron || type == F_SOFTLOCK) {
                                        /* can't reduce map area */
                                        SEGVN_VMSTAT_FLTVNPAGES(23);
                                        vop_size_err = 1;
                                        goto out;
                                }
                                SEGVN_VMSTAT_FLTVNPAGES(24);
                                ASSERT(szc != 0);
                                pszc = 0;
                                ierr = -1;
                                break;
                        }

                        if (amp != NULL) {
                                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                                anon_array_enter(amp, aindx, &an_cookie);
                        }
                        if (amp != NULL &&
                            anon_get_ptr(amp->ahp, aindx) != NULL) {
                                ulong_t taindx = P2ALIGN(aindx, maxpages);

                                SEGVN_VMSTAT_FLTVNPAGES(25);
                                ASSERT(anon_pages(amp->ahp, taindx,
                                    maxpages) == maxpages);
                                for (i = 0; i < pages; i++) {
                                        page_unlock(ppa[i]);
                                }
                                anon_array_exit(&an_cookie);
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                if (pplist != NULL) {
                                        page_free_replacement_page(pplist);
                                        page_create_putback(pages);
                                }
                                SEGVN_RESTORE_SOFTLOCK_VP(type, pages);
                                if (szc < seg->s_szc) {
                                        SEGVN_VMSTAT_FLTVNPAGES(26);
                                        /*
                                         * For private segments SOFTLOCK
                                         * either always breaks cow (any rw
                                         * type except S_READ_NOCOW) or
                                         * address space is locked as writer
                                         * (S_READ_NOCOW case) and anon slots
                                         * can't show up on second check.
                                         * Therefore if we are here for
                                         * SOFTLOCK case it must be a cow
                                         * break but cow break never reduces
                                         * szc. text replication (tron) in
                                         * this case works as cow break.
                                         * Thus the assert below.
                                         */
                                        ASSERT(!brkcow && !tron &&
                                            type != F_SOFTLOCK);
                                        pszc = seg->s_szc;
                                        ierr = -2;
                                        break;
                                }
                                ASSERT(IS_P2ALIGNED(a, maxpgsz));
                                goto again;
                        }
#ifdef DEBUG
                        if (amp != NULL) {
                                ulong_t taindx = P2ALIGN(aindx, maxpages);
                                ASSERT(!anon_pages(amp->ahp, taindx, maxpages));
                        }
#endif /* DEBUG */

                        if (brkcow || tron) {
                                ASSERT(amp != NULL);
                                ASSERT(pplist == NULL);
                                ASSERT(szc == seg->s_szc);
                                ASSERT(IS_P2ALIGNED(a, maxpgsz));
                                ASSERT(IS_P2ALIGNED(aindx, maxpages));
                                SEGVN_VMSTAT_FLTVNPAGES(27);
                                ierr = anon_map_privatepages(amp, aindx, szc,
                                    seg, a, prot, ppa, vpage, segvn_anypgsz,
                                    tron ? PG_LOCAL : 0, svd->cred);
                                if (ierr != 0) {
                                        SEGVN_VMSTAT_FLTVNPAGES(28);
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                        SEGVN_RESTORE_SOFTLOCK_VP(type, pages);
                                        err = FC_MAKE_ERR(ierr);
                                        goto out;
                                }

                                ASSERT(!IS_VMODSORT(ppa[0]->p_vnode));
                                /*
                                 * p_szc can't be changed for locked
                                 * swapfs pages.
                                 */
                                ASSERT(svd->rcookie ==
                                    HAT_INVALID_REGION_COOKIE);
                                hat_memload_array(hat, a, pgsz, ppa, prot,
                                    hat_flag);

                                if (!(hat_flag & HAT_LOAD_LOCK)) {
                                        SEGVN_VMSTAT_FLTVNPAGES(29);
                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                }
                                anon_array_exit(&an_cookie);
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                goto next;
                        }

                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE ||
                            (!svd->pageprot && svd->prot == (prot & vpprot)));

                        pfn = page_pptonum(ppa[0]);
                        /*
                         * hat_page_demote() needs an SE_EXCL lock on one of
                         * constituent page_t's and it decreases root's p_szc
                         * last. This means if root's p_szc is equal szc and
                         * all its constituent pages are locked
                         * hat_page_demote() that could have changed p_szc to
                         * szc is already done and no new have page_demote()
                         * can start for this large page.
                         */

                        /*
                         * we need to make sure same mapping size is used for
                         * the same address range if there's a possibility the
                         * adddress is already mapped because hat layer panics
                         * when translation is loaded for the range already
                         * mapped with a different page size.  We achieve it
                         * by always using largest page size possible subject
                         * to the constraints of page size, segment page size
                         * and page alignment.  Since mappings are invalidated
                         * when those constraints change and make it
                         * impossible to use previously used mapping size no
                         * mapping size conflicts should happen.
                         */

                chkszc:
                        if ((pszc = ppa[0]->p_szc) == szc &&
                            IS_P2ALIGNED(pfn, pages)) {

                                SEGVN_VMSTAT_FLTVNPAGES(30);
#ifdef DEBUG
                                for (i = 0; i < pages; i++) {
                                        ASSERT(PAGE_LOCKED(ppa[i]));
                                        ASSERT(!PP_ISFREE(ppa[i]));
                                        ASSERT(page_pptonum(ppa[i]) ==
                                            pfn + i);
                                        ASSERT(ppa[i]->p_szc == szc);
                                        VERIFY(ppa[i]->p_object == &vp->v_object);
                                        ASSERT(ppa[i]->p_vnode == vp);
                                        ASSERT(ppa[i]->p_offset ==
                                            off + (i << PAGESHIFT));
                                }
#endif /* DEBUG */
                                /*
                                 * All pages are of szc we need and they are
                                 * all locked so they can't change szc. load
                                 * translations.
                                 *
                                 * if page got promoted since last check
                                 * we don't need pplist.
                                 */
                                if (pplist != NULL) {
                                        page_free_replacement_page(pplist);
                                        page_create_putback(pages);
                                }
                                if (PP_ISMIGRATE(ppa[0])) {
                                        page_migrate(seg, a, ppa, pages);
                                }
                                SEGVN_UPDATE_MODBITS(ppa, pages, rw,
                                    prot, vpprot);
                                hat_memload_array_region(hat, a, pgsz,
                                    ppa, prot & vpprot, hat_flag,
                                    svd->rcookie);

                                if (!(hat_flag & HAT_LOAD_LOCK)) {
                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                }
                                if (amp != NULL) {
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                                goto next;
                        }

                        /*
                         * See if upsize is possible.
                         */
                        if (pszc > szc && szc < seg->s_szc &&
                            (segvn_anypgsz_vnode || pszc >= seg->s_szc)) {
                                pgcnt_t aphase;
                                uint_t pszc1 = MIN(pszc, seg->s_szc);
                                ppgsz = page_get_pagesize(pszc1);
                                ppages = btop(ppgsz);
                                aphase = btop(P2PHASE((uintptr_t)a, ppgsz));

                                ASSERT(type != F_SOFTLOCK);

                                SEGVN_VMSTAT_FLTVNPAGES(31);
                                if (aphase != P2PHASE(pfn, ppages)) {
                                        segvn_faultvnmpss_align_err4++;
                                } else {
                                        SEGVN_VMSTAT_FLTVNPAGES(32);
                                        if (pplist != NULL) {
                                                page_t *pl = pplist;
                                                page_free_replacement_page(pl);
                                                page_create_putback(pages);
                                        }
                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                        if (amp != NULL) {
                                                anon_array_exit(&an_cookie);
                                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                        }
                                        pszc = pszc1;
                                        ierr = -2;
                                        break;
                                }
                        }

                        /*
                         * check if we should use smallest mapping size.
                         */
                        upgrdfail = 0;
                        if (szc == 0 ||
                            (pszc >= szc &&
                            !IS_P2ALIGNED(pfn, pages)) ||
                            (pszc < szc &&
                            !segvn_full_szcpages(ppa, szc, &upgrdfail,
                            &pszc))) {

                                if (upgrdfail && type != F_SOFTLOCK) {
                                        /*
                                         * segvn_full_szcpages failed to lock
                                         * all pages EXCL. Size down.
                                         */
                                        ASSERT(pszc < szc);

                                        SEGVN_VMSTAT_FLTVNPAGES(33);

                                        if (pplist != NULL) {
                                                page_t *pl = pplist;
                                                page_free_replacement_page(pl);
                                                page_create_putback(pages);
                                        }

                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                        if (amp != NULL) {
                                                anon_array_exit(&an_cookie);
                                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                        }
                                        ierr = -1;
                                        break;
                                }
                                if (szc != 0 && !upgrdfail) {
                                        segvn_faultvnmpss_align_err5++;
                                }
                                SEGVN_VMSTAT_FLTVNPAGES(34);
                                if (pplist != NULL) {
                                        page_free_replacement_page(pplist);
                                        page_create_putback(pages);
                                }
                                SEGVN_UPDATE_MODBITS(ppa, pages, rw,
                                    prot, vpprot);
                                if (upgrdfail && segvn_anypgsz_vnode) {
                                        /* SOFTLOCK case */
                                        hat_memload_array_region(hat, a, pgsz,
                                            ppa, prot & vpprot, hat_flag,
                                            svd->rcookie);
                                } else {
                                        for (i = 0; i < pages; i++) {
                                                hat_memload_region(hat,
                                                    a + (i << PAGESHIFT),
                                                    ppa[i], prot & vpprot,
                                                    hat_flag, svd->rcookie);
                                        }
                                }
                                if (!(hat_flag & HAT_LOAD_LOCK)) {
                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                }
                                if (amp != NULL) {
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                                goto next;
                        }

                        if (pszc == szc) {
                                /*
                                 * segvn_full_szcpages() upgraded pages szc.
                                 */
                                ASSERT(pszc == ppa[0]->p_szc);
                                ASSERT(IS_P2ALIGNED(pfn, pages));
                                goto chkszc;
                        }

                        if (pszc > szc) {
                                kmutex_t *szcmtx;
                                SEGVN_VMSTAT_FLTVNPAGES(35);
                                /*
                                 * p_szc of ppa[0] can change since we haven't
                                 * locked all constituent pages. Call
                                 * page_lock_szc() to prevent szc changes.
                                 * This should be a rare case that happens when
                                 * multiple segments use a different page size
                                 * to map the same file offsets.
                                 */
                                szcmtx = page_szc_lock(ppa[0]);
                                pszc = ppa[0]->p_szc;
                                ASSERT(szcmtx != NULL || pszc == 0);
                                ASSERT(ppa[0]->p_szc <= pszc);
                                if (pszc <= szc) {
                                        SEGVN_VMSTAT_FLTVNPAGES(36);
                                        if (szcmtx != NULL) {
                                                mutex_exit(szcmtx);
                                        }
                                        goto chkszc;
                                }
                                if (pplist != NULL) {
                                        /*
                                         * page got promoted since last check.
                                         * we don't need preaalocated large
                                         * page.
                                         */
                                        SEGVN_VMSTAT_FLTVNPAGES(37);
                                        page_free_replacement_page(pplist);
                                        page_create_putback(pages);
                                }
                                SEGVN_UPDATE_MODBITS(ppa, pages, rw,
                                    prot, vpprot);
                                hat_memload_array_region(hat, a, pgsz, ppa,
                                    prot & vpprot, hat_flag, svd->rcookie);
                                mutex_exit(szcmtx);
                                if (!(hat_flag & HAT_LOAD_LOCK)) {
                                        for (i = 0; i < pages; i++) {
                                                page_unlock(ppa[i]);
                                        }
                                }
                                if (amp != NULL) {
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                                goto next;
                        }

                        /*
                         * if page got demoted since last check
                         * we could have not allocated larger page.
                         * allocate now.
                         */
                        if (pplist == NULL &&
                            page_alloc_pages(&vp->v_object, seg, a, &pplist,
                            NULL, szc, 0, 0) && type != F_SOFTLOCK) {
                                SEGVN_VMSTAT_FLTVNPAGES(38);
                                for (i = 0; i < pages; i++) {
                                        page_unlock(ppa[i]);
                                }
                                if (amp != NULL) {
                                        anon_array_exit(&an_cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                                ierr = -1;
                                alloc_failed |= (1 << szc);
                                break;
                        }

                        SEGVN_VMSTAT_FLTVNPAGES(39);

                        if (pplist != NULL) {
                                segvn_relocate_pages(ppa, pplist);
#ifdef DEBUG
                        } else {
                                ASSERT(type == F_SOFTLOCK);
                                SEGVN_VMSTAT_FLTVNPAGES(40);
#endif /* DEBUG */
                        }

                        SEGVN_UPDATE_MODBITS(ppa, pages, rw, prot, vpprot);

                        if (pplist == NULL && segvn_anypgsz_vnode == 0) {
                                ASSERT(type == F_SOFTLOCK);
                                for (i = 0; i < pages; i++) {
                                        ASSERT(ppa[i]->p_szc < szc);
                                        hat_memload_region(hat,
                                            a + (i << PAGESHIFT),
                                            ppa[i], prot & vpprot, hat_flag,
                                            svd->rcookie);
                                }
                        } else {
                                ASSERT(pplist != NULL || type == F_SOFTLOCK);
                                hat_memload_array_region(hat, a, pgsz, ppa,
                                    prot & vpprot, hat_flag, svd->rcookie);
                        }
                        if (!(hat_flag & HAT_LOAD_LOCK)) {
                                for (i = 0; i < pages; i++) {
                                        ASSERT(PAGE_SHARED(ppa[i]));
                                        page_unlock(ppa[i]);
                                }
                        }
                        if (amp != NULL) {
                                anon_array_exit(&an_cookie);
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                        }

                next:
                        if (vpage != NULL) {
                                vpage += pages;
                        }
                        adjszc_chk = 1;
                }
                if (a == lpgeaddr)
                        break;
                ASSERT(a < lpgeaddr);

                ASSERT(!brkcow && !tron && type != F_SOFTLOCK);

                /*
                 * ierr == -1 means we failed to map with a large page.
                 * (either due to allocation/relocation failures or
                 * misalignment with other mappings to this file.
                 *
                 * ierr == -2 means some other thread allocated a large page
                 * after we gave up tp map with a large page.  retry with
                 * larger mapping.
                 */
                ASSERT(ierr == -1 || ierr == -2);
                ASSERT(ierr == -2 || szc != 0);
                ASSERT(ierr == -1 || szc < seg->s_szc);
                if (ierr == -2) {
                        SEGVN_VMSTAT_FLTVNPAGES(41);
                        ASSERT(pszc > szc && pszc <= seg->s_szc);
                        szc = pszc;
                } else if (segvn_anypgsz_vnode) {
                        SEGVN_VMSTAT_FLTVNPAGES(42);
                        szc--;
                } else {
                        SEGVN_VMSTAT_FLTVNPAGES(43);
                        ASSERT(pszc < szc);
                        /*
                         * other process created pszc large page.
                         * but we still have to drop to 0 szc.
                         */
                        szc = 0;
                }

                pgsz = page_get_pagesize(szc);
                pages = btop(pgsz);
                if (ierr == -2) {
                        /*
                         * Size up case. Note lpgaddr may only be needed for
                         * softlock case so we don't adjust it here.
                         */
                        a = (caddr_t)P2ALIGN((uintptr_t)a, pgsz);
                        ASSERT(a >= lpgaddr);
                        lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)eaddr, pgsz);
                        off = svd->offset + (uintptr_t)(a - seg->s_base);
                        aindx = svd->anon_index + seg_page(seg, a);
                        vpage = (svd->vpage != NULL) ?
                            &svd->vpage[seg_page(seg, a)] : NULL;
                } else {
                        /*
                         * Size down case. Note lpgaddr may only be needed for
                         * softlock case so we don't adjust it here.
                         */
                        ASSERT(IS_P2ALIGNED(a, pgsz));
                        ASSERT(IS_P2ALIGNED(lpgeaddr, pgsz));
                        lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)eaddr, pgsz);
                        ASSERT(a < lpgeaddr);
                        if (a < addr) {
                                SEGVN_VMSTAT_FLTVNPAGES(44);
                                /*
                                 * The beginning of the large page region can
                                 * be pulled to the right to make a smaller
                                 * region. We haven't yet faulted a single
                                 * page.
                                 */
                                a = (caddr_t)P2ALIGN((uintptr_t)addr, pgsz);
                                ASSERT(a >= lpgaddr);
                                off = svd->offset +
                                    (uintptr_t)(a - seg->s_base);
                                aindx = svd->anon_index + seg_page(seg, a);
                                vpage = (svd->vpage != NULL) ?
                                    &svd->vpage[seg_page(seg, a)] : NULL;
                        }
                }
        }
out:
        kmem_free(ppa, ppasize);
        if (!err && !vop_size_err) {
                SEGVN_VMSTAT_FLTVNPAGES(45);
                return (0);
        }
        if (type == F_SOFTLOCK && a > lpgaddr) {
                SEGVN_VMSTAT_FLTVNPAGES(46);
                segvn_softunlock(seg, lpgaddr, a - lpgaddr, S_OTHER);
        }
        if (!vop_size_err) {
                SEGVN_VMSTAT_FLTVNPAGES(47);
                return (err);
        }
        ASSERT(brkcow || tron || type == F_SOFTLOCK);
        /*
         * Large page end is mapped beyond the end of file and it's a cow
         * fault (can be a text replication induced cow) or softlock so we can't
         * reduce the map area.  For now just demote the segment. This should
         * really only happen if the end of the file changed after the mapping
         * was established since when large page segments are created we make
         * sure they don't extend beyond the end of the file.
         */
        SEGVN_VMSTAT_FLTVNPAGES(48);

        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
        err = 0;
        if (seg->s_szc != 0) {
                segvn_fltvnpages_clrszc_cnt++;
                ASSERT(svd->softlockcnt == 0);
                err = segvn_clrszc(seg);
                if (err != 0) {
                        segvn_fltvnpages_clrszc_err++;
                }
        }
        ASSERT(err || seg->s_szc == 0);
        SEGVN_LOCK_DOWNGRADE(seg->s_as, &svd->lock);
        /* segvn_fault will do its job as if szc had been zero to begin with */
        return (err == 0 ? IE_RETRY : FC_MAKE_ERR(err));
}

/*
 * This routine will attempt to fault in one large page.
 * it will use smaller pages if that fails.
 * It should only be called for pure anonymous segments.
 */
static faultcode_t
segvn_fault_anonpages(struct hat *hat, struct seg *seg, caddr_t lpgaddr,
    caddr_t lpgeaddr, enum fault_type type, enum seg_rw rw, caddr_t addr,
    caddr_t eaddr, int brkcow)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon_map *amp = svd->amp;
        uchar_t segtype = svd->type;
        uint_t szc = seg->s_szc;
        size_t pgsz = page_get_pagesize(szc);
        size_t maxpgsz = pgsz;
        pgcnt_t pages = btop(pgsz);
        uint_t ppaszc = szc;
        caddr_t a = lpgaddr;
        ulong_t aindx = svd->anon_index + seg_page(seg, a);
        struct vpage *vpage = (svd->vpage != NULL) ?
            &svd->vpage[seg_page(seg, a)] : NULL;
        page_t **ppa;
        uint_t  ppa_szc;
        faultcode_t err;
        int ierr;
        uint_t protchk, prot, vpprot;
        ulong_t i;
        int hat_flag = (type == F_SOFTLOCK) ? HAT_LOAD_LOCK : HAT_LOAD;
        anon_sync_obj_t cookie;
        int adjszc_chk;
        int pgflags = (svd->tr_state == SEGVN_TR_ON) ? PG_LOCAL : 0;

        ASSERT(szc != 0);
        ASSERT(amp != NULL);
        ASSERT(enable_mbit_wa == 0); /* no mbit simulations with large pages */
        ASSERT(!(svd->flags & MAP_NORESERVE));
        ASSERT(type != F_SOFTUNLOCK);
        ASSERT(IS_P2ALIGNED(a, maxpgsz));
        ASSERT(!brkcow || svd->tr_state == SEGVN_TR_OFF);
        ASSERT(svd->tr_state != SEGVN_TR_INIT);

        ASSERT(SEGVN_LOCK_HELD(seg->s_as, &svd->lock));

        VM_STAT_COND_ADD(type == F_SOFTLOCK, segvnvmstats.fltanpages[0]);
        VM_STAT_COND_ADD(type != F_SOFTLOCK, segvnvmstats.fltanpages[1]);

        if (svd->flags & MAP_TEXT) {
                hat_flag |= HAT_LOAD_TEXT;
        }

        if (svd->pageprot) {
                switch (rw) {
                case S_READ:
                        protchk = PROT_READ;
                        break;
                case S_WRITE:
                        protchk = PROT_WRITE;
                        break;
                case S_EXEC:
                        protchk = PROT_EXEC;
                        break;
                case S_OTHER:
                default:
                        protchk = PROT_READ | PROT_WRITE | PROT_EXEC;
                        break;
                }
                VM_STAT_ADD(segvnvmstats.fltanpages[2]);
        } else {
                prot = svd->prot;
                /* caller has already done segment level protection check. */
        }

        ppa = kmem_cache_alloc(segvn_szc_cache[ppaszc], KM_SLEEP);
        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
        for (;;) {
                adjszc_chk = 0;
                for (; a < lpgeaddr; a += pgsz, aindx += pages) {
                        if (svd->pageprot != 0 && IS_P2ALIGNED(a, maxpgsz)) {
                                VM_STAT_ADD(segvnvmstats.fltanpages[3]);
                                ASSERT(vpage != NULL);
                                prot = VPP_PROT(vpage);
                                ASSERT(sameprot(seg, a, maxpgsz));
                                if ((prot & protchk) == 0) {
                                        err = FC_PROT;
                                        goto error;
                                }
                        }
                        if (adjszc_chk && IS_P2ALIGNED(a, maxpgsz) &&
                            pgsz < maxpgsz) {
                                ASSERT(a > lpgaddr);
                                szc = seg->s_szc;
                                pgsz = maxpgsz;
                                pages = btop(pgsz);
                                ASSERT(IS_P2ALIGNED(aindx, pages));
                                lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)eaddr,
                                    pgsz);
                        }
                        if (type == F_SOFTLOCK) {
                                atomic_add_long((ulong_t *)&svd->softlockcnt,
                                    pages);
                        }
                        anon_array_enter(amp, aindx, &cookie);
                        ppa_szc = (uint_t)-1;
                        ierr = anon_map_getpages(amp, aindx, szc, seg, a,
                            prot, &vpprot, ppa, &ppa_szc, vpage, rw, brkcow,
                            segvn_anypgsz, pgflags, svd->cred);
                        if (ierr != 0) {
                                anon_array_exit(&cookie);
                                VM_STAT_ADD(segvnvmstats.fltanpages[4]);
                                if (type == F_SOFTLOCK) {
                                        atomic_add_long(
                                            (ulong_t *)&svd->softlockcnt,
                                            -pages);
                                }
                                if (ierr > 0) {
                                        VM_STAT_ADD(segvnvmstats.fltanpages[6]);
                                        err = FC_MAKE_ERR(ierr);
                                        goto error;
                                }
                                break;
                        }

                        ASSERT(!IS_VMODSORT(ppa[0]->p_vnode));

                        ASSERT(segtype == MAP_SHARED ||
                            ppa[0]->p_szc <= szc);
                        ASSERT(segtype == MAP_PRIVATE ||
                            ppa[0]->p_szc >= szc);

                        /*
                         * Handle pages that have been marked for migration
                         */
                        if (lgrp_optimizations())
                                page_migrate(seg, a, ppa, pages);

                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);

                        if (segtype == MAP_SHARED) {
                                vpprot |= PROT_WRITE;
                        }

                        hat_memload_array(hat, a, pgsz, ppa,
                            prot & vpprot, hat_flag);

                        if (hat_flag & HAT_LOAD_LOCK) {
                                VM_STAT_ADD(segvnvmstats.fltanpages[7]);
                        } else {
                                VM_STAT_ADD(segvnvmstats.fltanpages[8]);
                                for (i = 0; i < pages; i++)
                                        page_unlock(ppa[i]);
                        }
                        if (vpage != NULL)
                                vpage += pages;

                        anon_array_exit(&cookie);
                        adjszc_chk = 1;
                }
                if (a == lpgeaddr)
                        break;
                ASSERT(a < lpgeaddr);
                /*
                 * ierr == -1 means we failed to allocate a large page.
                 * so do a size down operation.
                 *
                 * ierr == -2 means some other process that privately shares
                 * pages with this process has allocated a larger page and we
                 * need to retry with larger pages. So do a size up
                 * operation. This relies on the fact that large pages are
                 * never partially shared i.e. if we share any constituent
                 * page of a large page with another process we must share the
                 * entire large page. Note this cannot happen for SOFTLOCK
                 * case, unless current address (a) is at the beginning of the
                 * next page size boundary because the other process couldn't
                 * have relocated locked pages.
                 */
                ASSERT(ierr == -1 || ierr == -2);

                if (segvn_anypgsz) {
                        ASSERT(ierr == -2 || szc != 0);
                        ASSERT(ierr == -1 || szc < seg->s_szc);
                        szc = (ierr == -1) ? szc - 1 : szc + 1;
                } else {
                        /*
                         * For non COW faults and segvn_anypgsz == 0
                         * we need to be careful not to loop forever
                         * if existing page is found with szc other
                         * than 0 or seg->s_szc. This could be due
                         * to page relocations on behalf of DR or
                         * more likely large page creation. For this
                         * case simply re-size to existing page's szc
                         * if returned by anon_map_getpages().
                         */
                        if (ppa_szc == (uint_t)-1) {
                                szc = (ierr == -1) ? 0 : seg->s_szc;
                        } else {
                                ASSERT(ppa_szc <= seg->s_szc);
                                ASSERT(ierr == -2 || ppa_szc < szc);
                                ASSERT(ierr == -1 || ppa_szc > szc);
                                szc = ppa_szc;
                        }
                }

                pgsz = page_get_pagesize(szc);
                pages = btop(pgsz);
                ASSERT(type != F_SOFTLOCK || ierr == -1 ||
                    (IS_P2ALIGNED(a, pgsz) && IS_P2ALIGNED(lpgeaddr, pgsz)));
                if (type == F_SOFTLOCK) {
                        /*
                         * For softlocks we cannot reduce the fault area
                         * (calculated based on the largest page size for this
                         * segment) for size down and a is already next
                         * page size aligned as assertted above for size
                         * ups. Therefore just continue in case of softlock.
                         */
                        VM_STAT_ADD(segvnvmstats.fltanpages[9]);
                        continue; /* keep lint happy */
                } else if (ierr == -2) {

                        /*
                         * Size up case. Note lpgaddr may only be needed for
                         * softlock case so we don't adjust it here.
                         */
                        VM_STAT_ADD(segvnvmstats.fltanpages[10]);
                        a = (caddr_t)P2ALIGN((uintptr_t)a, pgsz);
                        ASSERT(a >= lpgaddr);
                        lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)eaddr, pgsz);
                        aindx = svd->anon_index + seg_page(seg, a);
                        vpage = (svd->vpage != NULL) ?
                            &svd->vpage[seg_page(seg, a)] : NULL;
                } else {
                        /*
                         * Size down case. Note lpgaddr may only be needed for
                         * softlock case so we don't adjust it here.
                         */
                        VM_STAT_ADD(segvnvmstats.fltanpages[11]);
                        ASSERT(IS_P2ALIGNED(a, pgsz));
                        ASSERT(IS_P2ALIGNED(lpgeaddr, pgsz));
                        lpgeaddr = (caddr_t)P2ROUNDUP((uintptr_t)eaddr, pgsz);
                        ASSERT(a < lpgeaddr);
                        if (a < addr) {
                                /*
                                 * The beginning of the large page region can
                                 * be pulled to the right to make a smaller
                                 * region. We haven't yet faulted a single
                                 * page.
                                 */
                                VM_STAT_ADD(segvnvmstats.fltanpages[12]);
                                a = (caddr_t)P2ALIGN((uintptr_t)addr, pgsz);
                                ASSERT(a >= lpgaddr);
                                aindx = svd->anon_index + seg_page(seg, a);
                                vpage = (svd->vpage != NULL) ?
                                    &svd->vpage[seg_page(seg, a)] : NULL;
                        }
                }
        }
        VM_STAT_ADD(segvnvmstats.fltanpages[13]);
        ANON_LOCK_EXIT(&amp->a_rwlock);
        kmem_cache_free(segvn_szc_cache[ppaszc], ppa);
        return (0);
error:
        VM_STAT_ADD(segvnvmstats.fltanpages[14]);
        ANON_LOCK_EXIT(&amp->a_rwlock);
        kmem_cache_free(segvn_szc_cache[ppaszc], ppa);
        if (type == F_SOFTLOCK && a > lpgaddr) {
                VM_STAT_ADD(segvnvmstats.fltanpages[15]);
                segvn_softunlock(seg, lpgaddr, a - lpgaddr, S_OTHER);
        }
        return (err);
}

int fltadvice = 1;      /* set to free behind pages for sequential access */

/*
 * This routine is called via a machine specific fault handling routine.
 * It is also called by software routines wishing to lock or unlock
 * a range of addresses.
 *
 * Here is the basic algorithm:
 *      If unlocking
 *              Call segvn_softunlock
 *              Return
 *      endif
 *      Checking and set up work
 *      If we will need some non-anonymous pages
 *              Call fop_getpage over the range of non-anonymous pages
 *      endif
 *      Loop over all addresses requested
 *              Call segvn_faultpage passing in page list
 *                  to load up translations and handle anonymous pages
 *      endloop
 *      Load up translation to any additional pages in page list not
 *          already handled that fit into this segment
 */
static faultcode_t
segvn_fault(struct hat *hat, struct seg *seg, caddr_t addr, size_t len,
    enum fault_type type, enum seg_rw rw)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        page_t **plp, **ppp, *pp;
        uoff_t off;
        caddr_t a;
        struct vpage *vpage;
        uint_t vpprot, prot;
        int err;
        page_t *pl[FAULT_TMP_PAGES_NUM + 1];
        size_t plsz, pl_alloc_sz;
        size_t page;
        ulong_t anon_index;
        struct anon_map *amp;
        int dogetpage = 0;
        caddr_t lpgaddr, lpgeaddr;
        size_t pgsz;
        anon_sync_obj_t cookie;
        int brkcow = BREAK_COW_SHARE(rw, type, svd->type);

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
        ASSERT(svd->amp == NULL || svd->rcookie == HAT_INVALID_REGION_COOKIE);

        /*
         * First handle the easy stuff
         */
        if (type == F_SOFTUNLOCK) {
                if (rw == S_READ_NOCOW) {
                        rw = S_READ;
                        ASSERT(AS_WRITE_HELD(seg->s_as));
                }
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
                pgsz = (seg->s_szc == 0) ? PAGESIZE :
                    page_get_pagesize(seg->s_szc);
                VM_STAT_COND_ADD(pgsz > PAGESIZE, segvnvmstats.fltanpages[16]);
                CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr, lpgeaddr);
                segvn_softunlock(seg, lpgaddr, lpgeaddr - lpgaddr, rw);
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        ASSERT(svd->tr_state == SEGVN_TR_OFF ||
            !HAT_IS_REGION_COOKIE_VALID(svd->rcookie));
        if (brkcow == 0) {
                if (svd->tr_state == SEGVN_TR_INIT) {
                        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
                        if (svd->tr_state == SEGVN_TR_INIT) {
                                ASSERT(svd->vp != NULL && svd->amp == NULL);
                                ASSERT(svd->flags & MAP_TEXT);
                                ASSERT(svd->type == MAP_PRIVATE);
                                segvn_textrepl(seg);
                                ASSERT(svd->tr_state != SEGVN_TR_INIT);
                                ASSERT(svd->tr_state != SEGVN_TR_ON ||
                                    svd->amp != NULL);
                        }
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                }
        } else if (svd->tr_state != SEGVN_TR_OFF) {
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);

                if (rw == S_WRITE && svd->tr_state != SEGVN_TR_OFF) {
                        ASSERT(!svd->pageprot && !(svd->prot & PROT_WRITE));
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (FC_PROT);
                }

                if (svd->tr_state == SEGVN_TR_ON) {
                        ASSERT(svd->vp != NULL && svd->amp != NULL);
                        segvn_textunrepl(seg, 0);
                        ASSERT(svd->amp == NULL &&
                            svd->tr_state == SEGVN_TR_OFF);
                } else if (svd->tr_state != SEGVN_TR_OFF) {
                        svd->tr_state = SEGVN_TR_OFF;
                }
                ASSERT(svd->amp == NULL && svd->tr_state == SEGVN_TR_OFF);
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        }

top:
        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);

        /*
         * If we have the same protections for the entire segment,
         * insure that the access being attempted is legitimate.
         */

        if (svd->pageprot == 0) {
                uint_t protchk;

                switch (rw) {
                case S_READ:
                case S_READ_NOCOW:
                        protchk = PROT_READ;
                        break;
                case S_WRITE:
                        protchk = PROT_WRITE;
                        break;
                case S_EXEC:
                        protchk = PROT_EXEC;
                        break;
                case S_OTHER:
                default:
                        protchk = PROT_READ | PROT_WRITE | PROT_EXEC;
                        break;
                }

                if ((svd->prot & protchk) == 0) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (FC_PROT);       /* illegal access type */
                }
        }

        if (brkcow && HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                /* this must be SOFTLOCK S_READ fault */
                ASSERT(svd->amp == NULL);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
                if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                        /*
                         * this must be the first ever non S_READ_NOCOW
                         * softlock for this segment.
                         */
                        ASSERT(svd->softlockcnt == 0);
                        hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                            HAT_REGION_TEXT);
                        svd->rcookie = HAT_INVALID_REGION_COOKIE;
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                goto top;
        }

        /*
         * We can't allow the long term use of softlocks for vmpss segments,
         * because in some file truncation cases we should be able to demote
         * the segment, which requires that there are no softlocks.  The
         * only case where it's ok to allow a SOFTLOCK fault against a vmpss
         * segment is S_READ_NOCOW, where the caller holds the address space
         * locked as writer and calls softunlock before dropping the as lock.
         * S_READ_NOCOW is used by /proc to read memory from another user.
         *
         * Another deadlock between SOFTLOCK and file truncation can happen
         * because segvn_fault_vnodepages() calls the FS one pagesize at
         * a time. A second fop_getpage() call by segvn_fault_vnodepages()
         * can cause a deadlock because the first set of page_t's remain
         * locked SE_SHARED.  To avoid this, we demote segments on a first
         * SOFTLOCK if they have a length greater than the segment's
         * page size.
         *
         * So for now, we only avoid demoting a segment on a SOFTLOCK when
         * the access type is S_READ_NOCOW and the fault length is less than
         * or equal to the segment's page size. While this is quite restrictive,
         * it should be the most common case of SOFTLOCK against a vmpss
         * segment.
         *
         * For S_READ_NOCOW, it's safe not to do a copy on write because the
         * caller makes sure no COW will be caused by another thread for a
         * softlocked page.
         */
        if (type == F_SOFTLOCK && svd->vp != NULL && seg->s_szc != 0) {
                int demote = 0;

                if (rw != S_READ_NOCOW) {
                        demote = 1;
                }
                if (!demote && len > PAGESIZE) {
                        pgsz = page_get_pagesize(seg->s_szc);
                        CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr,
                            lpgeaddr);
                        if (lpgeaddr - lpgaddr > pgsz) {
                                demote = 1;
                        }
                }

                ASSERT(demote || AS_WRITE_HELD(seg->s_as));

                if (demote) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
                        if (seg->s_szc != 0) {
                                segvn_vmpss_clrszc_cnt++;
                                ASSERT(svd->softlockcnt == 0);
                                err = segvn_clrszc(seg);
                                if (err) {
                                        segvn_vmpss_clrszc_err++;
                                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                        return (FC_MAKE_ERR(err));
                                }
                        }
                        ASSERT(seg->s_szc == 0);
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        goto top;
                }
        }

        /*
         * Check to see if we need to allocate an anon_map structure.
         */
        if (svd->amp == NULL && (svd->vp == NULL || brkcow)) {
                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                /*
                 * Drop the "read" lock on the segment and acquire
                 * the "write" version since we have to allocate the
                 * anon_map.
                 */
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);

                if (svd->amp == NULL) {
                        svd->amp = anonmap_alloc(seg->s_size, 0, ANON_SLEEP);
                        svd->amp->a_szc = seg->s_szc;
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);

                /*
                 * Start all over again since segment protections
                 * may have changed after we dropped the "read" lock.
                 */
                goto top;
        }

        /*
         * S_READ_NOCOW vs S_READ distinction was
         * only needed for the code above. After
         * that we treat it as S_READ.
         */
        if (rw == S_READ_NOCOW) {
                ASSERT(type == F_SOFTLOCK);
                ASSERT(AS_WRITE_HELD(seg->s_as));
                rw = S_READ;
        }

        amp = svd->amp;

        /*
         * MADV_SEQUENTIAL work is ignored for large page segments.
         */
        if (seg->s_szc != 0) {
                pgsz = page_get_pagesize(seg->s_szc);
                ASSERT(SEGVN_LOCK_HELD(seg->s_as, &svd->lock));
                CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr, lpgeaddr);
                if (svd->vp == NULL) {
                        err = segvn_fault_anonpages(hat, seg, lpgaddr,
                            lpgeaddr, type, rw, addr, addr + len, brkcow);
                } else {
                        err = segvn_fault_vnodepages(hat, seg, lpgaddr,
                            lpgeaddr, type, rw, addr, addr + len, brkcow);
                        if (err == IE_RETRY) {
                                ASSERT(seg->s_szc == 0);
                                ASSERT(SEGVN_READ_HELD(seg->s_as, &svd->lock));
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                goto top;
                        }
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (err);
        }

        page = seg_page(seg, addr);
        if (amp != NULL) {
                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                anon_index = svd->anon_index + page;

                if (type == F_PROT && rw == S_READ &&
                    svd->tr_state == SEGVN_TR_OFF &&
                    svd->type == MAP_PRIVATE && svd->pageprot == 0) {
                        size_t index = anon_index;
                        struct anon *ap;

                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        /*
                         * The fast path could apply to S_WRITE also, except
                         * that the protection fault could be caused by lazy
                         * tlb flush when ro->rw. In this case, the pte is
                         * RW already. But RO in the other cpu's tlb causes
                         * the fault. Since hat_chgprot won't do anything if
                         * pte doesn't change, we may end up faulting
                         * indefinitely until the RO tlb entry gets replaced.
                         */
                        for (a = addr; a < addr + len; a += PAGESIZE, index++) {
                                anon_array_enter(amp, index, &cookie);
                                ap = anon_get_ptr(amp->ahp, index);
                                anon_array_exit(&cookie);
                                if ((ap == NULL) || (ap->an_refcnt != 1)) {
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                        goto slow;
                                }
                        }
                        hat_chgprot(seg->s_as->a_hat, addr, len, svd->prot);
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
        }
slow:

        if (svd->vpage == NULL)
                vpage = NULL;
        else
                vpage = &svd->vpage[page];

        off = svd->offset + (uintptr_t)(addr - seg->s_base);

        /*
         * If MADV_SEQUENTIAL has been set for the particular page we
         * are faulting on, free behind all pages in the segment and put
         * them on the free list.
         */

        if ((page != 0) && fltadvice && svd->tr_state != SEGVN_TR_ON) {
                struct vpage *vpp;
                ulong_t fanon_index;
                size_t fpage;
                uoff_t pgoff, fpgoff;
                struct vnode *fvp;
                struct anon *fap = NULL;

                if (svd->advice == MADV_SEQUENTIAL ||
                    (svd->pageadvice &&
                    VPP_ADVICE(vpage) == MADV_SEQUENTIAL)) {
                        pgoff = off - PAGESIZE;
                        fpage = page - 1;
                        if (vpage != NULL)
                                vpp = &svd->vpage[fpage];
                        if (amp != NULL)
                                fanon_index = svd->anon_index + fpage;

                        while (pgoff > svd->offset) {
                                if (svd->advice != MADV_SEQUENTIAL &&
                                    (!svd->pageadvice || (vpage &&
                                    VPP_ADVICE(vpp) != MADV_SEQUENTIAL)))
                                        break;

                                /*
                                 * If this is an anon page, we must find the
                                 * correct <vp, offset> for it
                                 */
                                fap = NULL;
                                if (amp != NULL) {
                                        ANON_LOCK_ENTER(&amp->a_rwlock,
                                            RW_READER);
                                        anon_array_enter(amp, fanon_index,
                                            &cookie);
                                        fap = anon_get_ptr(amp->ahp,
                                            fanon_index);
                                        if (fap != NULL) {
                                                swap_xlate(fap, &fvp, &fpgoff);
                                        } else {
                                                fpgoff = pgoff;
                                                fvp = svd->vp;
                                        }
                                        anon_array_exit(&cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                } else {
                                        fpgoff = pgoff;
                                        fvp = svd->vp;
                                }
                                if (fvp == NULL)
                                        break;  /* XXX */
                                /*
                                 * Skip pages that are free or have an
                                 * "exclusive" lock.
                                 */
                                pp = page_lookup_nowait(&fvp->v_object,
                                                        fpgoff, SE_SHARED);
                                if (pp == NULL)
                                        break;
                                /*
                                 * We don't need the page_struct_lock to test
                                 * as this is only advisory; even if we
                                 * acquire it someone might race in and lock
                                 * the page after we unlock and before the
                                 * PUTPAGE, then fop_putpage will do nothing.
                                 */
                                if (pp->p_lckcnt == 0 && pp->p_cowcnt == 0) {
                                        /*
                                         * Hold the vnode before releasing
                                         * the page lock to prevent it from
                                         * being freed and re-used by some
                                         * other thread.
                                         */
                                        VN_HOLD(fvp);
                                        page_unlock(pp);
                                        /*
                                         * We should build a page list
                                         * to kluster putpages XXX
                                         */
                                        (void) fop_putpage(fvp,
                                            (offset_t)fpgoff, PAGESIZE,
                                            (B_DONTNEED|B_FREE|B_ASYNC),
                                            svd->cred, NULL);
                                        VN_RELE(fvp);
                                } else {
                                        /*
                                         * XXX - Should the loop terminate if
                                         * the page is `locked'?
                                         */
                                        page_unlock(pp);
                                }
                                --vpp;
                                --fanon_index;
                                pgoff -= PAGESIZE;
                        }
                }
        }

        plp = pl;
        *plp = NULL;
        pl_alloc_sz = 0;

        /*
         * See if we need to call fop_getpage for
         * *any* of the range being faulted on.
         * We can skip all of this work if there
         * was no original vnode.
         */
        if (svd->vp != NULL) {
                uoff_t vp_off;
                size_t vp_len;
                struct anon *ap;
                vnode_t *vp;

                vp_off = off;
                vp_len = len;

                if (amp == NULL)
                        dogetpage = 1;
                else {
                        /*
                         * Only acquire reader lock to prevent amp->ahp
                         * from being changed.  It's ok to miss pages,
                         * hence we don't do anon_array_enter
                         */
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        ap = anon_get_ptr(amp->ahp, anon_index);

                        if (len <= PAGESIZE)
                                /* inline non_anon() */
                                dogetpage = (ap == NULL);
                        else
                                dogetpage = non_anon(amp->ahp, anon_index,
                                    &vp_off, &vp_len);
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }

                if (dogetpage) {
                        enum seg_rw arw;
                        struct as *as = seg->s_as;

                        if (len > FAULT_TMP_PAGES_SZ) {
                                /*
                                 * Page list won't fit in local array,
                                 * allocate one of the needed size.
                                 */
                                pl_alloc_sz =
                                    (btop(len) + 1) * sizeof (page_t *);
                                plp = kmem_alloc(pl_alloc_sz, KM_SLEEP);
                                plp[0] = NULL;
                                plsz = len;
                        } else if (rw == S_WRITE && svd->type == MAP_PRIVATE ||
                            svd->tr_state == SEGVN_TR_ON || rw == S_OTHER ||
                            (((size_t)(addr + PAGESIZE) <
                            (size_t)(seg->s_base + seg->s_size)) &&
                            hat_probe(as->a_hat, addr + PAGESIZE))) {
                                /*
                                 * Ask fop_getpage to return the exact number
                                 * of pages if
                                 * (a) this is a COW fault, or
                                 * (b) this is a software fault, or
                                 * (c) next page is already mapped.
                                 */
                                plsz = len;
                        } else {
                                /*
                                 * Ask fop_getpage to return adjacent pages
                                 * within the segment.
                                 */
                                plsz = MIN((size_t)FAULT_TMP_PAGES_SZ, (size_t)
                                    ((seg->s_base + seg->s_size) - addr));
                                ASSERT((addr + plsz) <=
                                    (seg->s_base + seg->s_size));
                        }

                        /*
                         * Need to get some non-anonymous pages.
                         * We need to make only one call to GETPAGE to do
                         * this to prevent certain deadlocking conditions
                         * when we are doing locking.  In this case
                         * non_anon() should have picked up the smallest
                         * range which includes all the non-anonymous
                         * pages in the requested range.  We have to
                         * be careful regarding which rw flag to pass in
                         * because on a private mapping, the underlying
                         * object is never allowed to be written.
                         */
                        if (rw == S_WRITE && svd->type == MAP_PRIVATE) {
                                arw = S_READ;
                        } else {
                                arw = rw;
                        }
                        vp = svd->vp;
                        err = fop_getpage(vp, (offset_t)vp_off, vp_len,
                            &vpprot, plp, plsz, seg, addr + (vp_off - off), arw,
                            svd->cred, NULL);
                        if (err) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                segvn_pagelist_rele(plp);
                                if (pl_alloc_sz)
                                        kmem_free(plp, pl_alloc_sz);
                                return (FC_MAKE_ERR(err));
                        }
                        if (svd->type == MAP_PRIVATE)
                                vpprot &= ~PROT_WRITE;
                }
        }

        /*
         * N.B. at this time the plp array has all the needed non-anon
         * pages in addition to (possibly) having some adjacent pages.
         */

        /*
         * Always acquire the anon_array_lock to prevent
         * 2 threads from allocating separate anon slots for
         * the same "addr".
         *
         * If this is a copy-on-write fault and we don't already
         * have the anon_array_lock, acquire it to prevent the
         * fault routine from handling multiple copy-on-write faults
         * on the same "addr" in the same address space.
         *
         * Only one thread should deal with the fault since after
         * it is handled, the other threads can acquire a translation
         * to the newly created private page.  This prevents two or
         * more threads from creating different private pages for the
         * same fault.
         *
         * We grab "serialization" lock here if this is a MAP_PRIVATE segment
         * to prevent deadlock between this thread and another thread
         * which has soft-locked this page and wants to acquire serial_lock.
         * ( bug 4026339 )
         *
         * The fix for bug 4026339 becomes unnecessary when using the
         * locking scheme with per amp rwlock and a global set of hash
         * lock, anon_array_lock.  If we steal a vnode page when low
         * on memory and upgrad the page lock through page_rename,
         * then the page is PAGE_HANDLED, nothing needs to be done
         * for this page after returning from segvn_faultpage.
         *
         * But really, the page lock should be downgraded after
         * the stolen page is page_rename'd.
         */

        if (amp != NULL)
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);

        /*
         * Ok, now loop over the address range and handle faults
         */
        for (a = addr; a < addr + len; a += PAGESIZE, off += PAGESIZE) {
                err = segvn_faultpage(hat, seg, a, off, vpage, plp, vpprot,
                    type, rw, brkcow);
                if (err) {
                        if (amp != NULL)
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                        if (type == F_SOFTLOCK && a > addr) {
                                segvn_softunlock(seg, addr, (a - addr),
                                    S_OTHER);
                        }
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        segvn_pagelist_rele(plp);
                        if (pl_alloc_sz)
                                kmem_free(plp, pl_alloc_sz);
                        return (err);
                }
                if (vpage) {
                        vpage++;
                } else if (svd->vpage) {
                        page = seg_page(seg, addr);
                        vpage = &svd->vpage[++page];
                }
        }

        /* Didn't get pages from the underlying fs so we're done */
        if (!dogetpage)
                goto done;

        /*
         * Now handle any other pages in the list returned.
         * If the page can be used, load up the translations now.
         * Note that the for loop will only be entered if "plp"
         * is pointing to a non-NULL page pointer which means that
         * fop_getpage() was called and vpprot has been initialized.
         */
        if (svd->pageprot == 0)
                prot = svd->prot & vpprot;


        /*
         * Large Files: diff should be unsigned value because we started
         * supporting > 2GB segment sizes from 2.5.1 and when a
         * large file of size > 2GB gets mapped to address space
         * the diff value can be > 2GB.
         */

        for (ppp = plp; (pp = *ppp) != NULL; ppp++) {
                size_t diff;
                struct anon *ap;
                int anon_index;
                anon_sync_obj_t cookie;
                int hat_flag = HAT_LOAD_ADV;

                if (svd->flags & MAP_TEXT) {
                        hat_flag |= HAT_LOAD_TEXT;
                }

                if (pp == PAGE_HANDLED)
                        continue;

                if (svd->tr_state != SEGVN_TR_ON &&
                    pp->p_offset >=  svd->offset &&
                    pp->p_offset < svd->offset + seg->s_size) {

                        diff = pp->p_offset - svd->offset;

                        /*
                         * Large Files: Following is the assertion
                         * validating the above cast.
                         */
                        VERIFY(&svd->vp->v_object == pp->p_object);
                        ASSERT(svd->vp == pp->p_vnode);

                        page = btop(diff);
                        if (svd->pageprot)
                                prot = VPP_PROT(&svd->vpage[page]) & vpprot;

                        /*
                         * Prevent other threads in the address space from
                         * creating private pages (i.e., allocating anon slots)
                         * while we are in the process of loading translations
                         * to additional pages returned by the underlying
                         * object.
                         */
                        if (amp != NULL) {
                                anon_index = svd->anon_index + page;
                                anon_array_enter(amp, anon_index, &cookie);
                                ap = anon_get_ptr(amp->ahp, anon_index);
                        }
                        if ((amp == NULL) || (ap == NULL)) {
                                if (IS_VMODSORT(pp->p_vnode) ||
                                    enable_mbit_wa) {
                                        if (rw == S_WRITE)
                                                hat_setmod(pp);
                                        else if (rw != S_OTHER &&
                                            !hat_ismod(pp))
                                                prot &= ~PROT_WRITE;
                                }
                                /*
                                 * Skip mapping read ahead pages marked
                                 * for migration, so they will get migrated
                                 * properly on fault
                                 */
                                ASSERT(amp == NULL ||
                                    svd->rcookie == HAT_INVALID_REGION_COOKIE);
                                if ((prot & PROT_READ) && !PP_ISMIGRATE(pp)) {
                                        hat_memload_region(hat,
                                            seg->s_base + diff,
                                            pp, prot, hat_flag,
                                            svd->rcookie);
                                }
                        }
                        if (amp != NULL)
                                anon_array_exit(&cookie);
                }
                page_unlock(pp);
        }
done:
        if (amp != NULL)
                ANON_LOCK_EXIT(&amp->a_rwlock);
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        if (pl_alloc_sz)
                kmem_free(plp, pl_alloc_sz);
        return (0);
}

/*
 * This routine is used to start I/O on pages asynchronously.  XXX it will
 * only create PAGESIZE pages. At fault time they will be relocated into
 * larger pages.
 */
static faultcode_t
segvn_faulta(struct seg *seg, caddr_t addr)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        int err;
        struct anon_map *amp;
        vnode_t *vp;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
        if ((amp = svd->amp) != NULL) {
                struct anon *ap;

                /*
                 * Reader lock to prevent amp->ahp from being changed.
                 * This is advisory, it's ok to miss a page, so
                 * we don't do anon_array_enter lock.
                 */
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                if ((ap = anon_get_ptr(amp->ahp,
                    svd->anon_index + seg_page(seg, addr))) != NULL) {

                        err = anon_getpage(&ap, NULL, NULL,
                            0, seg, addr, S_READ, svd->cred);

                        ANON_LOCK_EXIT(&amp->a_rwlock);
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        if (err)
                                return (FC_MAKE_ERR(err));
                        return (0);
                }
                ANON_LOCK_EXIT(&amp->a_rwlock);
        }

        if (svd->vp == NULL) {
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);                     /* zfod page - do nothing now */
        }

        vp = svd->vp;
        err = fop_getpage(vp,
            (offset_t)(svd->offset + (uintptr_t)(addr - seg->s_base)),
            PAGESIZE, NULL, NULL, 0, seg, addr,
            S_OTHER, svd->cred, NULL);

        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        if (err)
                return (FC_MAKE_ERR(err));
        return (0);
}

static int
segvn_setprot(struct seg *seg, caddr_t addr, size_t len, uint_t prot)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *cvp, *svp, *evp;
        struct vnode *vp;
        size_t pgsz;
        pgcnt_t pgcnt;
        anon_sync_obj_t cookie;
        int unload_done = 0;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        if ((svd->maxprot & prot) != prot)
                return (EACCES);                        /* violated maxprot */

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);

        /* return if prot is the same */
        if (!svd->pageprot && svd->prot == prot) {
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        /*
         * Since we change protections we first have to flush the cache.
         * This makes sure all the pagelock calls have to recheck
         * protections.
         */
        if (svd->softlockcnt > 0) {
                ASSERT(svd->tr_state == SEGVN_TR_OFF);

                /*
                 * If this is shared segment non 0 softlockcnt
                 * means locked pages are still in use.
                 */
                if (svd->type == MAP_SHARED) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EAGAIN);
                }

                /*
                 * Since we do have the segvn writers lock nobody can fill
                 * the cache with entries belonging to this seg during
                 * the purge. The flush either succeeds or we still have
                 * pending I/Os.
                 */
                segvn_purge(seg);
                if (svd->softlockcnt > 0) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EAGAIN);
                }
        }

        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(svd->amp == NULL);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                    HAT_REGION_TEXT);
                svd->rcookie = HAT_INVALID_REGION_COOKIE;
                unload_done = 1;
        } else if (svd->tr_state == SEGVN_TR_INIT) {
                svd->tr_state = SEGVN_TR_OFF;
        } else if (svd->tr_state == SEGVN_TR_ON) {
                ASSERT(svd->amp != NULL);
                segvn_textunrepl(seg, 0);
                ASSERT(svd->amp == NULL && svd->tr_state == SEGVN_TR_OFF);
                unload_done = 1;
        }

        if ((prot & PROT_WRITE) && svd->type == MAP_SHARED &&
            svd->vp != NULL && (svd->vp->v_flag & VVMEXEC)) {
                ASSERT(vn_is_mapped(svd->vp, V_WRITE));
                segvn_inval_trcache(svd->vp);
        }
        if (seg->s_szc != 0) {
                int err;
                pgsz = page_get_pagesize(seg->s_szc);
                pgcnt = pgsz >> PAGESHIFT;
                ASSERT(IS_P2ALIGNED(pgcnt, pgcnt));
                if (!IS_P2ALIGNED(addr, pgsz) || !IS_P2ALIGNED(len, pgsz)) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        ASSERT(seg->s_base != addr || seg->s_size != len);
                        /*
                         * If we are holding the as lock as a reader then
                         * we need to return IE_RETRY and let the as
                         * layer drop and re-acquire the lock as a writer.
                         */
                        if (AS_READ_HELD(seg->s_as))
                                return (IE_RETRY);
                        VM_STAT_ADD(segvnvmstats.demoterange[1]);
                        if (svd->type == MAP_PRIVATE || svd->vp != NULL) {
                                err = segvn_demote_range(seg, addr, len,
                                    SDR_END, 0);
                        } else {
                                uint_t szcvec = map_pgszcvec(seg->s_base,
                                    pgsz, (uintptr_t)seg->s_base,
                                    (svd->flags & MAP_TEXT), MAPPGSZC_SHM, 0);
                                err = segvn_demote_range(seg, addr, len,
                                    SDR_END, szcvec);
                        }
                        if (err == 0)
                                return (IE_RETRY);
                        if (err == ENOMEM)
                                return (IE_NOMEM);
                        return (err);
                }
        }


        /*
         * If it's a private mapping and we're making it writable then we
         * may have to reserve the additional swap space now. If we are
         * making writable only a part of the segment then we use its vpage
         * array to keep a record of the pages for which we have reserved
         * swap. In this case we set the pageswap field in the segment's
         * segvn structure to record this.
         *
         * If it's a private mapping to a file (i.e., vp != NULL) and we're
         * removing write permission on the entire segment and we haven't
         * modified any pages, we can release the swap space.
         */
        if (svd->type == MAP_PRIVATE) {
                if (prot & PROT_WRITE) {
                        if (!(svd->flags & MAP_NORESERVE) &&
                            !(svd->swresv && svd->pageswap == 0)) {
                                size_t sz = 0;

                                /*
                                 * Start by determining how much swap
                                 * space is required.
                                 */
                                if (addr == seg->s_base &&
                                    len == seg->s_size &&
                                    svd->pageswap == 0) {
                                        /* The whole segment */
                                        sz = seg->s_size;
                                } else {
                                        /*
                                         * Make sure that the vpage array
                                         * exists, and make a note of the
                                         * range of elements corresponding
                                         * to len.
                                         */
                                        segvn_vpage(seg);
                                        if (svd->vpage == NULL) {
                                                SEGVN_LOCK_EXIT(seg->s_as,
                                                    &svd->lock);
                                                return (ENOMEM);
                                        }
                                        svp = &svd->vpage[seg_page(seg, addr)];
                                        evp = &svd->vpage[seg_page(seg,
                                            addr + len)];

                                        if (svd->pageswap == 0) {
                                                /*
                                                 * This is the first time we've
                                                 * asked for a part of this
                                                 * segment, so we need to
                                                 * reserve everything we've
                                                 * been asked for.
                                                 */
                                                sz = len;
                                        } else {
                                                /*
                                                 * We have to count the number
                                                 * of pages required.
                                                 */
                                                for (cvp = svp;  cvp < evp;
                                                    cvp++) {
                                                        if (!VPP_ISSWAPRES(cvp))
                                                                sz++;
                                                }
                                                sz <<= PAGESHIFT;
                                        }
                                }

                                /* Try to reserve the necessary swap. */
                                if (anon_resv_zone(sz,
                                    seg->s_as->a_proc->p_zone) == 0) {
                                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                        return (IE_NOMEM);
                                }

                                /*
                                 * Make a note of how much swap space
                                 * we've reserved.
                                 */
                                if (svd->pageswap == 0 && sz == seg->s_size) {
                                        svd->swresv = sz;
                                } else {
                                        ASSERT(svd->vpage != NULL);
                                        svd->swresv += sz;
                                        svd->pageswap = 1;
                                        for (cvp = svp; cvp < evp; cvp++) {
                                                if (!VPP_ISSWAPRES(cvp))
                                                        VPP_SETSWAPRES(cvp);
                                        }
                                }
                        }
                } else {
                        /*
                         * Swap space is released only if this segment
                         * does not map anonymous memory, since read faults
                         * on such segments still need an anon slot to read
                         * in the data.
                         */
                        if (svd->swresv != 0 && svd->vp != NULL &&
                            svd->amp == NULL && addr == seg->s_base &&
                            len == seg->s_size && svd->pageprot == 0) {
                                ASSERT(svd->pageswap == 0);
                                anon_unresv_zone(svd->swresv,
                                    seg->s_as->a_proc->p_zone);
                                svd->swresv = 0;
                        }
                }
        }

        if (addr == seg->s_base && len == seg->s_size && svd->vpage == NULL) {
                if (svd->prot == prot) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);                     /* all done */
                }
                svd->prot = (uchar_t)prot;
        } else if (svd->type == MAP_PRIVATE) {
                struct anon *ap = NULL;
                page_t *pp;
                uoff_t offset, off;
                struct anon_map *amp;
                ulong_t anon_idx = 0;

                /*
                 * A vpage structure exists or else the change does not
                 * involve the entire segment.  Establish a vpage structure
                 * if none is there.  Then, for each page in the range,
                 * adjust its individual permissions.  Note that write-
                 * enabling a MAP_PRIVATE page can affect the claims for
                 * locked down memory.  Overcommitting memory terminates
                 * the operation.
                 */
                segvn_vpage(seg);
                if (svd->vpage == NULL) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (ENOMEM);
                }
                svd->pageprot = 1;
                if ((amp = svd->amp) != NULL) {
                        anon_idx = svd->anon_index + seg_page(seg, addr);
                        ASSERT(seg->s_szc == 0 ||
                            IS_P2ALIGNED(anon_idx, pgcnt));
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                }

                offset = svd->offset + (uintptr_t)(addr - seg->s_base);
                evp = &svd->vpage[seg_page(seg, addr + len)];

                /*
                 * See Statement at the beginning of segvn_lockop regarding
                 * the way cowcnts and lckcnts are handled.
                 */
                for (svp = &svd->vpage[seg_page(seg, addr)]; svp < evp; svp++) {

                        if (seg->s_szc != 0) {
                                if (amp != NULL) {
                                        anon_array_enter(amp, anon_idx,
                                            &cookie);
                                }
                                if (IS_P2ALIGNED(anon_idx, pgcnt) &&
                                    !segvn_claim_pages(seg, svp, offset,
                                    anon_idx, prot)) {
                                        if (amp != NULL) {
                                                anon_array_exit(&cookie);
                                        }
                                        break;
                                }
                                if (amp != NULL) {
                                        anon_array_exit(&cookie);
                                }
                                anon_idx++;
                        } else {
                                if (amp != NULL) {
                                        anon_array_enter(amp, anon_idx,
                                            &cookie);
                                        ap = anon_get_ptr(amp->ahp, anon_idx++);
                                }

                                if (VPP_ISPPLOCK(svp) &&
                                    VPP_PROT(svp) != prot) {

                                        if (amp == NULL || ap == NULL) {
                                                vp = svd->vp;
                                                off = offset;
                                        } else
                                                swap_xlate(ap, &vp, &off);
                                        if (amp != NULL)
                                                anon_array_exit(&cookie);

                                        if ((pp = page_lookup(&vp->v_object, off, SE_SHARED)) == NULL) {
                                                panic("segvn_setprot: no page");
                                                /*NOTREACHED*/
                                        }
                                        ASSERT(seg->s_szc == 0);
                                        if ((VPP_PROT(svp) ^ prot) &
                                            PROT_WRITE) {
                                                if (prot & PROT_WRITE) {
                                                        if (!page_addclaim(
                                                            pp)) {
                                                                page_unlock(pp);
                                                                break;
                                                        }
                                                } else {
                                                        if (!page_subclaim(
                                                            pp)) {
                                                                page_unlock(pp);
                                                                break;
                                                        }
                                                }
                                        }
                                        page_unlock(pp);
                                } else if (amp != NULL)
                                        anon_array_exit(&cookie);
                        }
                        VPP_SETPROT(svp, prot);
                        offset += PAGESIZE;
                }
                if (amp != NULL)
                        ANON_LOCK_EXIT(&amp->a_rwlock);

                /*
                 * Did we terminate prematurely?  If so, simply unload
                 * the translations to the things we've updated so far.
                 */
                if (svp != evp) {
                        if (unload_done) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (IE_NOMEM);
                        }
                        len = (svp - &svd->vpage[seg_page(seg, addr)]) *
                            PAGESIZE;
                        ASSERT(seg->s_szc == 0 || IS_P2ALIGNED(len, pgsz));
                        if (len != 0)
                                hat_unload(seg->s_as->a_hat, addr,
                                    len, HAT_UNLOAD);
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (IE_NOMEM);
                }
        } else {
                segvn_vpage(seg);
                if (svd->vpage == NULL) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (ENOMEM);
                }
                svd->pageprot = 1;
                evp = &svd->vpage[seg_page(seg, addr + len)];
                for (svp = &svd->vpage[seg_page(seg, addr)]; svp < evp; svp++) {
                        VPP_SETPROT(svp, prot);
                }
        }

        if (unload_done) {
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        if (((prot & PROT_WRITE) != 0 &&
            (svd->vp != NULL || svd->type == MAP_PRIVATE)) ||
            (prot & ~PROT_USER) == PROT_NONE) {
                /*
                 * Either private or shared data with write access (in
                 * which case we need to throw out all former translations
                 * so that we get the right translations set up on fault
                 * and we don't allow write access to any copy-on-write pages
                 * that might be around or to prevent write access to pages
                 * representing holes in a file), or we don't have permission
                 * to access the memory at all (in which case we have to
                 * unload any current translations that might exist).
                 */
                hat_unload(seg->s_as->a_hat, addr, len, HAT_UNLOAD);
        } else {
                /*
                 * A shared mapping or a private mapping in which write
                 * protection is going to be denied - just change all the
                 * protections over the range of addresses in question.
                 * segvn does not support any other attributes other
                 * than prot so we can use hat_chgattr.
                 */
                hat_chgattr(seg->s_as->a_hat, addr, len, prot);
        }

        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);

        return (0);
}

/*
 * segvn_setpagesize is called via segop_setpagesize from as_setpagesize,
 * to determine if the seg is capable of mapping the requested szc.
 */
static int
segvn_setpagesize(struct seg *seg, caddr_t addr, size_t len, uint_t szc)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct segvn_data *nsvd;
        struct anon_map *amp = svd->amp;
        struct seg *nseg;
        caddr_t eaddr = addr + len, a;
        size_t pgsz = page_get_pagesize(szc);
        pgcnt_t pgcnt = page_get_pagecnt(szc);
        int err;
        uoff_t off = svd->offset + (uintptr_t)(addr - seg->s_base);

        ASSERT(seg->s_as && AS_WRITE_HELD(seg->s_as));
        ASSERT(addr >= seg->s_base && eaddr <= seg->s_base + seg->s_size);

        if (seg->s_szc == szc || segvn_lpg_disable != 0) {
                return (0);
        }

        /*
         * addr should always be pgsz aligned but eaddr may be misaligned if
         * it's at the end of the segment.
         *
         * XXX we should assert this condition since as_setpagesize() logic
         * guarantees it.
         */
        if (!IS_P2ALIGNED(addr, pgsz) ||
            (!IS_P2ALIGNED(eaddr, pgsz) &&
            eaddr != seg->s_base + seg->s_size)) {

                segvn_setpgsz_align_err++;
                return (EINVAL);
        }

        if (amp != NULL && svd->type == MAP_SHARED) {
                ulong_t an_idx = svd->anon_index + seg_page(seg, addr);
                if (!IS_P2ALIGNED(an_idx, pgcnt)) {

                        segvn_setpgsz_anon_align_err++;
                        return (EINVAL);
                }
        }

        if ((svd->flags & MAP_NORESERVE) || seg->s_as == &kas ||
            szc > segvn_maxpgszc) {
                return (EINVAL);
        }

        /* paranoid check */
        if (svd->vp != NULL &&
            (IS_SWAPFSVP(svd->vp) || VN_ISKAS(svd->vp))) {
                return (EINVAL);
        }

        if (seg->s_szc == 0 && svd->vp != NULL &&
            map_addr_vacalign_check(addr, off)) {
                return (EINVAL);
        }

        /*
         * Check that protections are the same within new page
         * size boundaries.
         */
        if (svd->pageprot) {
                for (a = addr; a < eaddr; a += pgsz) {
                        if ((a + pgsz) > eaddr) {
                                if (!sameprot(seg, a, eaddr - a)) {
                                        return (EINVAL);
                                }
                        } else {
                                if (!sameprot(seg, a, pgsz)) {
                                        return (EINVAL);
                                }
                        }
                }
        }

        /*
         * Since we are changing page size we first have to flush
         * the cache. This makes sure all the pagelock calls have
         * to recheck protections.
         */
        if (svd->softlockcnt > 0) {
                ASSERT(svd->tr_state == SEGVN_TR_OFF);

                /*
                 * If this is shared segment non 0 softlockcnt
                 * means locked pages are still in use.
                 */
                if (svd->type == MAP_SHARED) {
                        return (EAGAIN);
                }

                /*
                 * Since we do have the segvn writers lock nobody can fill
                 * the cache with entries belonging to this seg during
                 * the purge. The flush either succeeds or we still have
                 * pending I/Os.
                 */
                segvn_purge(seg);
                if (svd->softlockcnt > 0) {
                        return (EAGAIN);
                }
        }

        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(svd->amp == NULL);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                    HAT_REGION_TEXT);
                svd->rcookie = HAT_INVALID_REGION_COOKIE;
        } else if (svd->tr_state == SEGVN_TR_INIT) {
                svd->tr_state = SEGVN_TR_OFF;
        } else if (svd->tr_state == SEGVN_TR_ON) {
                ASSERT(svd->amp != NULL);
                segvn_textunrepl(seg, 1);
                ASSERT(svd->amp == NULL && svd->tr_state == SEGVN_TR_OFF);
                amp = NULL;
        }

        /*
         * Operation for sub range of existing segment.
         */
        if (addr != seg->s_base || eaddr != (seg->s_base + seg->s_size)) {
                if (szc < seg->s_szc) {
                        VM_STAT_ADD(segvnvmstats.demoterange[2]);
                        err = segvn_demote_range(seg, addr, len, SDR_RANGE, 0);
                        if (err == 0) {
                                return (IE_RETRY);
                        }
                        if (err == ENOMEM) {
                                return (IE_NOMEM);
                        }
                        return (err);
                }
                if (addr != seg->s_base) {
                        nseg = segvn_split_seg(seg, addr);
                        if (eaddr != (nseg->s_base + nseg->s_size)) {
                                /* eaddr is szc aligned */
                                (void) segvn_split_seg(nseg, eaddr);
                        }
                        return (IE_RETRY);
                }
                if (eaddr != (seg->s_base + seg->s_size)) {
                        /* eaddr is szc aligned */
                        (void) segvn_split_seg(seg, eaddr);
                }
                return (IE_RETRY);
        }

        /*
         * Break any low level sharing and reset seg->s_szc to 0.
         */
        if ((err = segvn_clrszc(seg)) != 0) {
                if (err == ENOMEM) {
                        err = IE_NOMEM;
                }
                return (err);
        }
        ASSERT(seg->s_szc == 0);

        /*
         * If the end of the current segment is not pgsz aligned
         * then attempt to concatenate with the next segment.
         */
        if (!IS_P2ALIGNED(eaddr, pgsz)) {
                nseg = AS_SEGNEXT(seg->s_as, seg);
                if (nseg == NULL || nseg == seg || eaddr != nseg->s_base) {
                        return (ENOMEM);
                }
                if (nseg->s_ops != &segvn_ops) {
                        return (EINVAL);
                }
                nsvd = (struct segvn_data *)nseg->s_data;
                if (nsvd->softlockcnt > 0) {
                        /*
                         * If this is shared segment non 0 softlockcnt
                         * means locked pages are still in use.
                         */
                        if (nsvd->type == MAP_SHARED) {
                                return (EAGAIN);
                        }
                        segvn_purge(nseg);
                        if (nsvd->softlockcnt > 0) {
                                return (EAGAIN);
                        }
                }
                err = segvn_clrszc(nseg);
                if (err == ENOMEM) {
                        err = IE_NOMEM;
                }
                if (err != 0) {
                        return (err);
                }
                ASSERT(nsvd->rcookie == HAT_INVALID_REGION_COOKIE);
                err = segvn_concat(seg, nseg, 1);
                if (err == -1) {
                        return (EINVAL);
                }
                if (err == -2) {
                        return (IE_NOMEM);
                }
                return (IE_RETRY);
        }

        /*
         * May need to re-align anon array to
         * new szc.
         */
        if (amp != NULL) {
                if (!IS_P2ALIGNED(svd->anon_index, pgcnt)) {
                        struct anon_hdr *nahp;

                        ASSERT(svd->type == MAP_PRIVATE);

                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                        ASSERT(amp->refcnt == 1);
                        nahp = anon_create(btop(amp->size), ANON_NOSLEEP);
                        if (nahp == NULL) {
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                return (IE_NOMEM);
                        }
                        if (anon_copy_ptr(amp->ahp, svd->anon_index,
                            nahp, 0, btop(seg->s_size), ANON_NOSLEEP)) {
                                anon_release(nahp, btop(amp->size));
                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                return (IE_NOMEM);
                        }
                        anon_release(amp->ahp, btop(amp->size));
                        amp->ahp = nahp;
                        svd->anon_index = 0;
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }
        }
        if (svd->vp != NULL && szc != 0) {
                struct vattr va;
                uoff_t eoffpage = svd->offset;
                va.va_mask = AT_SIZE;
                eoffpage += seg->s_size;
                eoffpage = btopr(eoffpage);
                if (fop_getattr(svd->vp, &va, 0, svd->cred, NULL) != 0) {
                        segvn_setpgsz_getattr_err++;
                        return (EINVAL);
                }
                if (btopr(va.va_size) < eoffpage) {
                        segvn_setpgsz_eof_err++;
                        return (EINVAL);
                }
                if (amp != NULL) {
                        /*
                         * anon_fill_cow_holes() may call fop_getpage().
                         * don't take anon map lock here to avoid holding it
                         * across fop_getpage() calls that may call back into
                         * segvn for klsutering checks. We don't really need
                         * anon map lock here since it's a private segment and
                         * we hold as level lock as writers.
                         */
                        if ((err = anon_fill_cow_holes(seg, seg->s_base,
                            amp->ahp, svd->anon_index, svd->vp, svd->offset,
                            seg->s_size, szc, svd->prot, svd->vpage,
                            svd->cred)) != 0) {
                                return (EINVAL);
                        }
                }
                segvn_setvnode_mpss(svd->vp);
        }

        if (amp != NULL) {
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
                if (svd->type == MAP_PRIVATE) {
                        amp->a_szc = szc;
                } else if (szc > amp->a_szc) {
                        amp->a_szc = szc;
                }
                ANON_LOCK_EXIT(&amp->a_rwlock);
        }

        seg->s_szc = szc;

        return (0);
}

static int
segvn_clrszc(struct seg *seg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon_map *amp = svd->amp;
        size_t pgsz;
        pgcnt_t pages;
        int err = 0;
        caddr_t a = seg->s_base;
        caddr_t ea = a + seg->s_size;
        ulong_t an_idx = svd->anon_index;
        vnode_t *vp = svd->vp;
        struct vpage *vpage = svd->vpage;
        page_t *anon_pl[1 + 1], *pp;
        struct anon *ap, *oldap;
        uint_t prot = svd->prot, vpprot;
        int pageflag = 0;

        ASSERT(AS_WRITE_HELD(seg->s_as) ||
            SEGVN_WRITE_HELD(seg->s_as, &svd->lock));
        ASSERT(svd->softlockcnt == 0);

        if (vp == NULL && amp == NULL) {
                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                seg->s_szc = 0;
                return (0);
        }

        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                ASSERT(svd->amp == NULL);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                    HAT_REGION_TEXT);
                svd->rcookie = HAT_INVALID_REGION_COOKIE;
        } else if (svd->tr_state == SEGVN_TR_ON) {
                ASSERT(svd->amp != NULL);
                segvn_textunrepl(seg, 1);
                ASSERT(svd->amp == NULL && svd->tr_state == SEGVN_TR_OFF);
                amp = NULL;
        } else {
                if (svd->tr_state != SEGVN_TR_OFF) {
                        ASSERT(svd->tr_state == SEGVN_TR_INIT);
                        svd->tr_state = SEGVN_TR_OFF;
                }

                /*
                 * do HAT_UNLOAD_UNMAP since we are changing the pagesize.
                 * unload argument is 0 when we are freeing the segment
                 * and unload was already done.
                 */
                hat_unload(seg->s_as->a_hat, seg->s_base, seg->s_size,
                    HAT_UNLOAD_UNMAP);
        }

        if (amp == NULL || svd->type == MAP_SHARED) {
                seg->s_szc = 0;
                return (0);
        }

        pgsz = page_get_pagesize(seg->s_szc);
        pages = btop(pgsz);

        /*
         * XXX anon rwlock is not really needed because this is a
         * private segment and we are writers.
         */
        ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);

        for (; a < ea; a += pgsz, an_idx += pages) {
                if ((oldap = anon_get_ptr(amp->ahp, an_idx)) != NULL) {
                        ASSERT(vpage != NULL || svd->pageprot == 0);
                        if (vpage != NULL) {
                                ASSERT(sameprot(seg, a, pgsz));
                                prot = VPP_PROT(vpage);
                                pageflag = VPP_ISPPLOCK(vpage) ? LOCK_PAGE : 0;
                        }
                        if (seg->s_szc != 0) {
                                ASSERT(vp == NULL || anon_pages(amp->ahp,
                                    an_idx, pages) == pages);
                                if ((err = anon_map_demotepages(amp, an_idx,
                                    seg, a, prot, vpage, svd->cred)) != 0) {
                                        goto out;
                                }
                        } else {
                                if (oldap->an_refcnt == 1) {
                                        continue;
                                }
                                if ((err = anon_getpage(&oldap, &vpprot,
                                    anon_pl, PAGESIZE, seg, a, S_READ,
                                    svd->cred))) {
                                        goto out;
                                }
                                if ((pp = anon_private(&ap, seg, a, prot,
                                    anon_pl[0], pageflag, svd->cred)) == NULL) {
                                        err = ENOMEM;
                                        goto out;
                                }
                                anon_decref(oldap);
                                (void) anon_set_ptr(amp->ahp, an_idx, ap,
                                    ANON_SLEEP);
                                page_unlock(pp);
                        }
                }
                vpage = (vpage == NULL) ? NULL : vpage + pages;
        }

        amp->a_szc = 0;
        seg->s_szc = 0;
out:
        ANON_LOCK_EXIT(&amp->a_rwlock);
        return (err);
}

static int
segvn_claim_pages(
        struct seg *seg,
        struct vpage *svp,
        uoff_t off,
        ulong_t anon_idx,
        uint_t prot)
{
        pgcnt_t pgcnt = page_get_pagecnt(seg->s_szc);
        size_t ppasize = (pgcnt + 1) * sizeof (page_t *);
        page_t  **ppa;
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon_map *amp = svd->amp;
        struct vpage *evp = svp + pgcnt;
        caddr_t addr = ((uintptr_t)(svp - svd->vpage) << PAGESHIFT)
            + seg->s_base;
        struct anon *ap;
        struct vnode *vp = svd->vp;
        page_t *pp;
        pgcnt_t pg_idx, i;
        int err = 0;
        anoff_t aoff;
        int anon = (amp != NULL) ? 1 : 0;

        ASSERT(svd->type == MAP_PRIVATE);
        ASSERT(svd->vpage != NULL);
        ASSERT(seg->s_szc != 0);
        ASSERT(IS_P2ALIGNED(pgcnt, pgcnt));
        ASSERT(amp == NULL || IS_P2ALIGNED(anon_idx, pgcnt));
        ASSERT(sameprot(seg, addr, pgcnt << PAGESHIFT));

        if (VPP_PROT(svp) == prot)
                return (1);
        if (!((VPP_PROT(svp) ^ prot) & PROT_WRITE))
                return (1);

        ppa = kmem_alloc(ppasize, KM_SLEEP);
        if (anon && vp != NULL) {
                if (anon_get_ptr(amp->ahp, anon_idx) == NULL) {
                        anon = 0;
                        ASSERT(!anon_pages(amp->ahp, anon_idx, pgcnt));
                }
                ASSERT(!anon ||
                    anon_pages(amp->ahp, anon_idx, pgcnt) == pgcnt);
        }

        for (*ppa = NULL, pg_idx = 0; svp < evp; svp++, anon_idx++) {
                if (!VPP_ISPPLOCK(svp))
                        continue;
                if (anon) {
                        ap = anon_get_ptr(amp->ahp, anon_idx);
                        if (ap == NULL) {
                                panic("segvn_claim_pages: no anon slot");
                        }
                        swap_xlate(ap, &vp, &aoff);
                        off = (uoff_t)aoff;
                }
                ASSERT(vp != NULL);
                if ((pp = page_lookup(&vp->v_object, (uoff_t)off, SE_SHARED)) == NULL) {
                        panic("segvn_claim_pages: no page");
                }
                ppa[pg_idx++] = pp;
                off += PAGESIZE;
        }

        if (ppa[0] == NULL) {
                kmem_free(ppa, ppasize);
                return (1);
        }

        ASSERT(pg_idx <= pgcnt);
        ppa[pg_idx] = NULL;


        /* Find each large page within ppa, and adjust its claim */

        /* Does ppa cover a single large page? */
        if (ppa[0]->p_szc == seg->s_szc) {
                if (prot & PROT_WRITE)
                        err = page_addclaim_pages(ppa);
                else
                        err = page_subclaim_pages(ppa);
        } else {
                for (i = 0; ppa[i]; i += pgcnt) {
                        ASSERT(IS_P2ALIGNED(page_pptonum(ppa[i]), pgcnt));
                        if (prot & PROT_WRITE)
                                err = page_addclaim_pages(&ppa[i]);
                        else
                                err = page_subclaim_pages(&ppa[i]);
                        if (err == 0)
                                break;
                }
        }

        for (i = 0; i < pg_idx; i++) {
                ASSERT(ppa[i] != NULL);
                page_unlock(ppa[i]);
        }

        kmem_free(ppa, ppasize);
        return (err);
}

/*
 * Returns right (upper address) segment if split occurred.
 * If the address is equal to the beginning or end of its segment it returns
 * the current segment.
 */
static struct seg *
segvn_split_seg(struct seg *seg, caddr_t addr)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct seg *nseg;
        size_t nsize;
        struct segvn_data *nsvd;

        ASSERT(AS_WRITE_HELD(seg->s_as));
        ASSERT(svd->tr_state == SEGVN_TR_OFF);

        ASSERT(addr >= seg->s_base);
        ASSERT(addr <= seg->s_base + seg->s_size);
        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);

        if (addr == seg->s_base || addr == seg->s_base + seg->s_size)
                return (seg);

        nsize = seg->s_base + seg->s_size - addr;
        seg->s_size = addr - seg->s_base;
        nseg = seg_alloc(seg->s_as, addr, nsize);
        ASSERT(nseg != NULL);
        nseg->s_ops = seg->s_ops;
        nsvd = kmem_cache_alloc(segvn_cache, KM_SLEEP);
        nseg->s_data = (void *)nsvd;
        nseg->s_szc = seg->s_szc;
        *nsvd = *svd;
        ASSERT(nsvd->rcookie == HAT_INVALID_REGION_COOKIE);
        nsvd->seg = nseg;
        rw_init(&nsvd->lock, NULL, RW_DEFAULT, NULL);

        if (nsvd->vp != NULL) {
                VN_HOLD(nsvd->vp);
                nsvd->offset = svd->offset +
                    (uintptr_t)(nseg->s_base - seg->s_base);
                if (nsvd->type == MAP_SHARED)
                        lgrp_shm_policy_init(NULL, nsvd->vp);
        } else {
                /*
                 * The offset for an anonymous segment has no signifigance in
                 * terms of an offset into a file. If we were to use the above
                 * calculation instead, the structures read out of
                 * /proc/<pid>/xmap would be more difficult to decipher since
                 * it would be unclear whether two seemingly contiguous
                 * prxmap_t structures represented different segments or a
                 * single segment that had been split up into multiple prxmap_t
                 * structures (e.g. if some part of the segment had not yet
                 * been faulted in).
                 */
                nsvd->offset = 0;
        }

        ASSERT(svd->softlockcnt == 0);
        ASSERT(svd->softlockcnt_sbase == 0);
        ASSERT(svd->softlockcnt_send == 0);
        crhold(svd->cred);

        if (svd->vpage != NULL) {
                size_t bytes = vpgtob(seg_pages(seg));
                size_t nbytes = vpgtob(seg_pages(nseg));
                struct vpage *ovpage = svd->vpage;

                svd->vpage = kmem_alloc(bytes, KM_SLEEP);
                bcopy(ovpage, svd->vpage, bytes);
                nsvd->vpage = kmem_alloc(nbytes, KM_SLEEP);
                bcopy(ovpage + seg_pages(seg), nsvd->vpage, nbytes);
                kmem_free(ovpage, bytes + nbytes);
        }
        if (svd->amp != NULL && svd->type == MAP_PRIVATE) {
                struct anon_map *oamp = svd->amp, *namp;
                struct anon_hdr *nahp;

                ANON_LOCK_ENTER(&oamp->a_rwlock, RW_WRITER);
                ASSERT(oamp->refcnt == 1);
                nahp = anon_create(btop(seg->s_size), ANON_SLEEP);
                (void) anon_copy_ptr(oamp->ahp, svd->anon_index,
                    nahp, 0, btop(seg->s_size), ANON_SLEEP);

                namp = anonmap_alloc(nseg->s_size, 0, ANON_SLEEP);
                namp->a_szc = nseg->s_szc;
                (void) anon_copy_ptr(oamp->ahp,
                    svd->anon_index + btop(seg->s_size),
                    namp->ahp, 0, btop(nseg->s_size), ANON_SLEEP);
                anon_release(oamp->ahp, btop(oamp->size));
                oamp->ahp = nahp;
                oamp->size = seg->s_size;
                svd->anon_index = 0;
                nsvd->amp = namp;
                nsvd->anon_index = 0;
                ANON_LOCK_EXIT(&oamp->a_rwlock);
        } else if (svd->amp != NULL) {
                pgcnt_t pgcnt = page_get_pagecnt(seg->s_szc);
                ASSERT(svd->amp == nsvd->amp);
                ASSERT(seg->s_szc <= svd->amp->a_szc);
                nsvd->anon_index = svd->anon_index + seg_pages(seg);
                ASSERT(IS_P2ALIGNED(nsvd->anon_index, pgcnt));
                ANON_LOCK_ENTER(&svd->amp->a_rwlock, RW_WRITER);
                svd->amp->refcnt++;
                ANON_LOCK_EXIT(&svd->amp->a_rwlock);
        }

        /*
         * Split the amount of swap reserved.
         */
        if (svd->swresv) {
                /*
                 * For MAP_NORESERVE, only allocate swap reserve for pages
                 * being used.  Other segments get enough to cover whole
                 * segment.
                 */
                if (svd->flags & MAP_NORESERVE) {
                        size_t  oswresv;

                        ASSERT(svd->amp);
                        oswresv = svd->swresv;
                        svd->swresv = ptob(anon_pages(svd->amp->ahp,
                            svd->anon_index, btop(seg->s_size)));
                        nsvd->swresv = ptob(anon_pages(nsvd->amp->ahp,
                            nsvd->anon_index, btop(nseg->s_size)));
                        ASSERT(oswresv >= (svd->swresv + nsvd->swresv));
                } else {
                        if (svd->pageswap) {
                                svd->swresv = segvn_count_swap_by_vpages(seg);
                                ASSERT(nsvd->swresv >= svd->swresv);
                                nsvd->swresv -= svd->swresv;
                        } else {
                                ASSERT(svd->swresv == seg->s_size +
                                    nseg->s_size);
                                svd->swresv = seg->s_size;
                                nsvd->swresv = nseg->s_size;
                        }
                }
        }

        return (nseg);
}

/*
 * called on memory operations (unmap, setprot, setpagesize) for a subset
 * of a large page segment to either demote the memory range (SDR_RANGE)
 * or the ends (SDR_END) by addr/len.
 *
 * returns 0 on success. returns errno, including ENOMEM, on failure.
 */
static int
segvn_demote_range(
        struct seg *seg,
        caddr_t addr,
        size_t len,
        int flag,
        uint_t szcvec)
{
        caddr_t eaddr = addr + len;
        caddr_t lpgaddr, lpgeaddr;
        struct seg *nseg;
        struct seg *badseg1 = NULL;
        struct seg *badseg2 = NULL;
        size_t pgsz;
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        int err;
        uint_t szc = seg->s_szc;
        uint_t tszcvec;

        ASSERT(AS_WRITE_HELD(seg->s_as));
        ASSERT(svd->tr_state == SEGVN_TR_OFF);
        ASSERT(szc != 0);
        pgsz = page_get_pagesize(szc);
        ASSERT(seg->s_base != addr || seg->s_size != len);
        ASSERT(addr >= seg->s_base && eaddr <= seg->s_base + seg->s_size);
        ASSERT(svd->softlockcnt == 0);
        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
        ASSERT(szcvec == 0 || (flag == SDR_END && svd->type == MAP_SHARED));

        CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr, lpgeaddr);
        ASSERT(flag == SDR_RANGE || eaddr < lpgeaddr || addr > lpgaddr);
        if (flag == SDR_RANGE) {
                /* demote entire range */
                badseg1 = nseg = segvn_split_seg(seg, lpgaddr);
                (void) segvn_split_seg(nseg, lpgeaddr);
                ASSERT(badseg1->s_base == lpgaddr);
                ASSERT(badseg1->s_size == lpgeaddr - lpgaddr);
        } else if (addr != lpgaddr) {
                ASSERT(flag == SDR_END);
                badseg1 = nseg = segvn_split_seg(seg, lpgaddr);
                if (eaddr != lpgeaddr && eaddr > lpgaddr + pgsz &&
                    eaddr < lpgaddr + 2 * pgsz) {
                        (void) segvn_split_seg(nseg, lpgeaddr);
                        ASSERT(badseg1->s_base == lpgaddr);
                        ASSERT(badseg1->s_size == 2 * pgsz);
                } else {
                        nseg = segvn_split_seg(nseg, lpgaddr + pgsz);
                        ASSERT(badseg1->s_base == lpgaddr);
                        ASSERT(badseg1->s_size == pgsz);
                        if (eaddr != lpgeaddr && eaddr > lpgaddr + pgsz) {
                                ASSERT(lpgeaddr - lpgaddr > 2 * pgsz);
                                nseg = segvn_split_seg(nseg, lpgeaddr - pgsz);
                                badseg2 = nseg;
                                (void) segvn_split_seg(nseg, lpgeaddr);
                                ASSERT(badseg2->s_base == lpgeaddr - pgsz);
                                ASSERT(badseg2->s_size == pgsz);
                        }
                }
        } else {
                ASSERT(flag == SDR_END);
                ASSERT(eaddr < lpgeaddr);
                badseg1 = nseg = segvn_split_seg(seg, lpgeaddr - pgsz);
                (void) segvn_split_seg(nseg, lpgeaddr);
                ASSERT(badseg1->s_base == lpgeaddr - pgsz);
                ASSERT(badseg1->s_size == pgsz);
        }

        ASSERT(badseg1 != NULL);
        ASSERT(badseg1->s_szc == szc);
        ASSERT(flag == SDR_RANGE || badseg1->s_size == pgsz ||
            badseg1->s_size == 2 * pgsz);
        ASSERT(sameprot(badseg1, badseg1->s_base, pgsz));
        ASSERT(badseg1->s_size == pgsz ||
            sameprot(badseg1, badseg1->s_base + pgsz, pgsz));
        if (err = segvn_clrszc(badseg1)) {
                return (err);
        }
        ASSERT(badseg1->s_szc == 0);

        if (szc > 1 && (tszcvec = P2PHASE(szcvec, 1 << szc)) > 1) {
                uint_t tszc = highbit(tszcvec) - 1;
                caddr_t ta = MAX(addr, badseg1->s_base);
                caddr_t te;
                size_t tpgsz = page_get_pagesize(tszc);

                ASSERT(svd->type == MAP_SHARED);
                ASSERT(flag == SDR_END);
                ASSERT(tszc < szc && tszc > 0);

                if (eaddr > badseg1->s_base + badseg1->s_size) {
                        te = badseg1->s_base + badseg1->s_size;
                } else {
                        te = eaddr;
                }

                ASSERT(ta <= te);
                badseg1->s_szc = tszc;
                if (!IS_P2ALIGNED(ta, tpgsz) || !IS_P2ALIGNED(te, tpgsz)) {
                        if (badseg2 != NULL) {
                                err = segvn_demote_range(badseg1, ta, te - ta,
                                    SDR_END, tszcvec);
                                if (err != 0) {
                                        return (err);
                                }
                        } else {
                                return (segvn_demote_range(badseg1, ta,
                                    te - ta, SDR_END, tszcvec));
                        }
                }
        }

        if (badseg2 == NULL)
                return (0);
        ASSERT(badseg2->s_szc == szc);
        ASSERT(badseg2->s_size == pgsz);
        ASSERT(sameprot(badseg2, badseg2->s_base, badseg2->s_size));
        if (err = segvn_clrszc(badseg2)) {
                return (err);
        }
        ASSERT(badseg2->s_szc == 0);

        if (szc > 1 && (tszcvec = P2PHASE(szcvec, 1 << szc)) > 1) {
                uint_t tszc = highbit(tszcvec) - 1;
                size_t tpgsz = page_get_pagesize(tszc);

                ASSERT(svd->type == MAP_SHARED);
                ASSERT(flag == SDR_END);
                ASSERT(tszc < szc && tszc > 0);
                ASSERT(badseg2->s_base > addr);
                ASSERT(eaddr > badseg2->s_base);
                ASSERT(eaddr < badseg2->s_base + badseg2->s_size);

                badseg2->s_szc = tszc;
                if (!IS_P2ALIGNED(eaddr, tpgsz)) {
                        return (segvn_demote_range(badseg2, badseg2->s_base,
                            eaddr - badseg2->s_base, SDR_END, tszcvec));
                }
        }

        return (0);
}

static int
segvn_checkprot(struct seg *seg, caddr_t addr, size_t len, uint_t prot)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vp, *evp;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
        /*
         * If segment protection can be used, simply check against them.
         */
        if (svd->pageprot == 0) {
                int err;

                err = ((svd->prot & prot) != prot) ? EACCES : 0;
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (err);
        }

        /*
         * Have to check down to the vpage level.
         */
        evp = &svd->vpage[seg_page(seg, addr + len)];
        for (vp = &svd->vpage[seg_page(seg, addr)]; vp < evp; vp++) {
                if ((VPP_PROT(vp) & prot) != prot) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EACCES);
                }
        }
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        return (0);
}

static int
segvn_getprot(struct seg *seg, caddr_t addr, size_t len, uint_t *protv)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        size_t pgno = seg_page(seg, addr + len) - seg_page(seg, addr) + 1;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        if (pgno != 0) {
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
                if (svd->pageprot == 0) {
                        do {
                                protv[--pgno] = svd->prot;
                        } while (pgno != 0);
                } else {
                        size_t pgoff = seg_page(seg, addr);

                        do {
                                pgno--;
                                protv[pgno] = VPP_PROT(&svd->vpage[pgno+pgoff]);
                        } while (pgno != 0);
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        }
        return (0);
}

static uoff_t
segvn_getoffset(struct seg *seg, caddr_t addr)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        return (svd->offset + (uintptr_t)(addr - seg->s_base));
}

/*ARGSUSED*/
static int
segvn_gettype(struct seg *seg, caddr_t addr)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        return (svd->type | (svd->flags & (MAP_NORESERVE | MAP_TEXT |
            MAP_INITDATA)));
}

/*ARGSUSED*/
static int
segvn_getvp(struct seg *seg, caddr_t addr, struct vnode **vpp)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        *vpp = svd->vp;
        return (0);
}

/*
 * Check to see if it makes sense to do kluster/read ahead to
 * addr + delta relative to the mapping at addr.  We assume here
 * that delta is a signed PAGESIZE'd multiple (which can be negative).
 *
 * For segvn, we currently "approve" of the action if we are
 * still in the segment and it maps from the same vp/off,
 * or if the advice stored in segvn_data or vpages allows it.
 * Currently, klustering is not allowed only if MADV_RANDOM is set.
 */
static int
segvn_kluster(struct seg *seg, caddr_t addr, ssize_t delta)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon *oap, *ap;
        ssize_t pd;
        size_t page;
        struct vnode *vp1, *vp2;
        uoff_t off1, off2;
        struct anon_map *amp;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
        ASSERT(AS_WRITE_HELD(seg->s_as) ||
            SEGVN_LOCK_HELD(seg->s_as, &svd->lock));

        if (addr + delta < seg->s_base ||
            addr + delta >= (seg->s_base + seg->s_size))
                return (-1);            /* exceeded segment bounds */

        pd = delta / (ssize_t)PAGESIZE; /* divide to preserve sign bit */
        page = seg_page(seg, addr);

        /*
         * Check to see if either of the pages addr or addr + delta
         * have advice set that prevents klustering (if MADV_RANDOM advice
         * is set for entire segment, or MADV_SEQUENTIAL is set and delta
         * is negative).
         */
        if (svd->advice == MADV_RANDOM ||
            svd->advice == MADV_SEQUENTIAL && delta < 0)
                return (-1);
        else if (svd->pageadvice && svd->vpage) {
                struct vpage *bvpp, *evpp;

                bvpp = &svd->vpage[page];
                evpp = &svd->vpage[page + pd];
                if (VPP_ADVICE(bvpp) == MADV_RANDOM ||
                    VPP_ADVICE(evpp) == MADV_SEQUENTIAL && delta < 0)
                        return (-1);
                if (VPP_ADVICE(bvpp) != VPP_ADVICE(evpp) &&
                    VPP_ADVICE(evpp) == MADV_RANDOM)
                        return (-1);
        }

        if (svd->type == MAP_SHARED)
                return (0);             /* shared mapping - all ok */

        if ((amp = svd->amp) == NULL)
                return (0);             /* off original vnode */

        page += svd->anon_index;

        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);

        oap = anon_get_ptr(amp->ahp, page);
        ap = anon_get_ptr(amp->ahp, page + pd);

        ANON_LOCK_EXIT(&amp->a_rwlock);

        if ((oap == NULL && ap != NULL) || (oap != NULL && ap == NULL)) {
                return (-1);            /* one with and one without an anon */
        }

        if (oap == NULL) {              /* implies that ap == NULL */
                return (0);             /* off original vnode */
        }

        /*
         * Now we know we have two anon pointers - check to
         * see if they happen to be properly allocated.
         */

        /*
         * XXX We cheat here and don't lock the anon slots. We can't because
         * we may have been called from the anon layer which might already
         * have locked them. We are holding a refcnt on the slots so they
         * can't disappear. The worst that will happen is we'll get the wrong
         * names (vp, off) for the slots and make a poor klustering decision.
         */
        swap_xlate(ap, &vp1, &off1);
        swap_xlate(oap, &vp2, &off2);


        if (!fop_cmp(vp1, vp2, NULL) || off1 - off2 != delta)
                return (-1);
        return (0);
}

/*
 * Synchronize primary storage cache with real object in virtual memory.
 *
 * XXX - Anonymous pages should not be sync'ed out at all.
 */
static int
segvn_sync(struct seg *seg, caddr_t addr, size_t len, int attr, uint_t flags)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vpp;
        page_t *pp;
        uoff_t offset;
        struct vnode *vp;
        uoff_t off;
        caddr_t eaddr;
        int bflags;
        int err = 0;
        int segtype;
        int pageprot;
        int prot;
        ulong_t anon_index;
        struct anon_map *amp;
        struct anon *ap;
        anon_sync_obj_t cookie;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);

        if (svd->softlockcnt > 0) {
                /*
                 * If this is shared segment non 0 softlockcnt
                 * means locked pages are still in use.
                 */
                if (svd->type == MAP_SHARED) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EAGAIN);
                }

                /*
                 * flush all pages from seg cache
                 * otherwise we may deadlock in swap_putpage
                 * for B_INVAL page (4175402).
                 *
                 * Even if we grab segvn WRITER's lock
                 * here, there might be another thread which could've
                 * successfully performed lookup/insert just before
                 * we acquired the lock here.  So, grabbing either
                 * lock here is of not much use.  Until we devise
                 * a strategy at upper layers to solve the
                 * synchronization issues completely, we expect
                 * applications to handle this appropriately.
                 */
                segvn_purge(seg);
                if (svd->softlockcnt > 0) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EAGAIN);
                }
        } else if (svd->type == MAP_SHARED && svd->amp != NULL &&
            svd->amp->a_softlockcnt > 0) {
                /*
                 * Try to purge this amp's entries from pcache. It will
                 * succeed only if other segments that share the amp have no
                 * outstanding softlock's.
                 */
                segvn_purge(seg);
                if (svd->amp->a_softlockcnt > 0 || svd->softlockcnt > 0) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EAGAIN);
                }
        }

        vpp = svd->vpage;
        offset = svd->offset + (uintptr_t)(addr - seg->s_base);
        bflags = ((flags & MS_ASYNC) ? B_ASYNC : 0) |
            ((flags & MS_INVALIDATE) ? B_INVAL : 0);

        if (attr) {
                pageprot = attr & ~(SHARED|PRIVATE);
                segtype = (attr & SHARED) ? MAP_SHARED : MAP_PRIVATE;

                /*
                 * We are done if the segment types don't match
                 * or if we have segment level protections and
                 * they don't match.
                 */
                if (svd->type != segtype) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
                if (vpp == NULL) {
                        if (svd->prot != pageprot) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (0);
                        }
                        prot = svd->prot;
                } else
                        vpp = &svd->vpage[seg_page(seg, addr)];

        } else if (svd->vp && svd->amp == NULL &&
            (flags & MS_INVALIDATE) == 0) {

                /*
                 * No attributes, no anonymous pages and MS_INVALIDATE flag
                 * is not on, just use one big request.
                 */
                err = fop_putpage(svd->vp, (offset_t)offset, len,
                    bflags, svd->cred, NULL);
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (err);
        }

        if ((amp = svd->amp) != NULL)
                anon_index = svd->anon_index + seg_page(seg, addr);

        for (eaddr = addr + len; addr < eaddr; addr += PAGESIZE) {
                ap = NULL;
                if (amp != NULL) {
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        anon_array_enter(amp, anon_index, &cookie);
                        ap = anon_get_ptr(amp->ahp, anon_index++);
                        if (ap != NULL) {
                                swap_xlate(ap, &vp, &off);
                        } else {
                                vp = svd->vp;
                                off = offset;
                        }
                        anon_array_exit(&cookie);
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                } else {
                        vp = svd->vp;
                        off = offset;
                }
                offset += PAGESIZE;

                if (vp == NULL)         /* untouched zfod page */
                        continue;

                if (attr) {
                        if (vpp) {
                                prot = VPP_PROT(vpp);
                                vpp++;
                        }
                        if (prot != pageprot) {
                                continue;
                        }
                }

                /*
                 * See if any of these pages are locked --  if so, then we
                 * will have to truncate an invalidate request at the first
                 * locked one. We don't need the page_struct_lock to test
                 * as this is only advisory; even if we acquire it someone
                 * might race in and lock the page after we unlock and before
                 * we do the PUTPAGE, then PUTPAGE simply does nothing.
                 */
                if (flags & MS_INVALIDATE) {
                        if ((pp = page_lookup(&vp->v_object, off, SE_SHARED)) != NULL) {
                                if (pp->p_lckcnt != 0 || pp->p_cowcnt != 0) {
                                        page_unlock(pp);
                                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                        return (EBUSY);
                                }
                                if (ap != NULL && pp->p_szc != 0 &&
                                    page_tryupgrade(pp)) {
                                        if (pp->p_lckcnt == 0 &&
                                            pp->p_cowcnt == 0) {
                                                /*
                                                 * swapfs VN_DISPOSE() won't
                                                 * invalidate large pages.
                                                 * Attempt to demote.
                                                 * XXX can't help it if it
                                                 * fails. But for swapfs
                                                 * pages it is no big deal.
                                                 */
                                                (void) page_try_demote_pages(
                                                    pp);
                                        }
                                }
                                page_unlock(pp);
                        }
                } else if (svd->type == MAP_SHARED && amp != NULL) {
                        /*
                         * Avoid writing out to disk ISM's large pages
                         * because segspt_free_pages() relies on NULL an_pvp
                         * of anon slots of such pages.
                         */

                        ASSERT(svd->vp == NULL);
                        /*
                         * swapfs uses page_lookup_nowait if not freeing or
                         * invalidating and skips a page if
                         * page_lookup_nowait returns NULL.
                         */
                        pp = page_lookup_nowait(&vp->v_object, off, SE_SHARED);
                        if (pp == NULL) {
                                continue;
                        }
                        if (pp->p_szc != 0) {
                                page_unlock(pp);
                                continue;
                        }

                        /*
                         * Note ISM pages are created large so (vp, off)'s
                         * page cannot suddenly become large after we unlock
                         * pp.
                         */
                        page_unlock(pp);
                }
                /*
                 * XXX - Should ultimately try to kluster
                 * calls to fop_putpage() for performance.
                 */
                VN_HOLD(vp);
                err = fop_putpage(vp, (offset_t)off, PAGESIZE,
                    (bflags | (IS_SWAPFSVP(vp) ? B_PAGE_NOWAIT : 0)),
                    svd->cred, NULL);

                VN_RELE(vp);
                if (err)
                        break;
        }
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        return (err);
}

/*
 * Determine if we have data corresponding to pages in the
 * primary storage virtual memory cache (i.e., "in core").
 */
static size_t
segvn_incore(struct seg *seg, caddr_t addr, size_t len, char *vec)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vnode *vp, *avp;
        uoff_t offset, aoffset;
        size_t p, ep;
        int ret;
        struct vpage *vpp;
        page_t *pp;
        uint_t start;
        struct anon_map *amp;           /* XXX - for locknest */
        struct anon *ap;
        uint_t attr;
        anon_sync_obj_t cookie;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
        if (svd->amp == NULL && svd->vp == NULL) {
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                bzero(vec, btopr(len));
                return (len);   /* no anonymous pages created yet */
        }

        p = seg_page(seg, addr);
        ep = seg_page(seg, addr + len);
        start = svd->vp ? SEG_PAGE_VNODEBACKED : 0;

        amp = svd->amp;
        for (; p < ep; p++, addr += PAGESIZE) {
                vpp = (svd->vpage) ? &svd->vpage[p]: NULL;
                ret = start;
                ap = NULL;
                avp = NULL;
                /* Grab the vnode/offset for the anon slot */
                if (amp != NULL) {
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        anon_array_enter(amp, svd->anon_index + p, &cookie);
                        ap = anon_get_ptr(amp->ahp, svd->anon_index + p);
                        if (ap != NULL) {
                                swap_xlate(ap, &avp, &aoffset);
                        }
                        anon_array_exit(&cookie);
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }
                if ((avp != NULL) && page_exists(&avp->v_object, aoffset)) {
                        /* A page exists for the anon slot */
                        ret |= SEG_PAGE_INCORE;

                        /*
                         * If page is mapped and writable
                         */
                        attr = 0;
                        if ((hat_getattr(seg->s_as->a_hat, addr,
                            &attr) != -1) && (attr & PROT_WRITE)) {
                                ret |= SEG_PAGE_ANON;
                        }
                        /*
                         * Don't get page_struct lock for lckcnt and cowcnt,
                         * since this is purely advisory.
                         */
                        if ((pp = page_lookup_nowait(&avp->v_object,
                                                     aoffset,
                                                     SE_SHARED)) != NULL) {
                                if (pp->p_lckcnt)
                                        ret |= SEG_PAGE_SOFTLOCK;
                                if (pp->p_cowcnt)
                                        ret |= SEG_PAGE_HASCOW;
                                page_unlock(pp);
                        }
                }

                /* Gather vnode statistics */
                vp = svd->vp;
                offset = svd->offset + (uintptr_t)(addr - seg->s_base);

                if (vp != NULL) {
                        /*
                         * Try to obtain a "shared" lock on the page
                         * without blocking.  If this fails, determine
                         * if the page is in memory.
                         */
                        pp = page_lookup_nowait(&vp->v_object, offset,
                                                SE_SHARED);
                        if ((pp == NULL) && (page_exists(&vp->v_object, offset))) {
                                /* Page is incore, and is named */
                                ret |= (SEG_PAGE_INCORE | SEG_PAGE_VNODE);
                        }
                        /*
                         * Don't get page_struct lock for lckcnt and cowcnt,
                         * since this is purely advisory.
                         */
                        if (pp != NULL) {
                                ret |= (SEG_PAGE_INCORE | SEG_PAGE_VNODE);
                                if (pp->p_lckcnt)
                                        ret |= SEG_PAGE_SOFTLOCK;
                                if (pp->p_cowcnt)
                                        ret |= SEG_PAGE_HASCOW;
                                page_unlock(pp);
                        }
                }

                /* Gather virtual page information */
                if (vpp) {
                        if (VPP_ISPPLOCK(vpp))
                                ret |= SEG_PAGE_LOCKED;
                        vpp++;
                }

                *vec++ = (char)ret;
        }
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        return (len);
}

/*
 * Statement for p_cowcnts/p_lckcnts.
 *
 * p_cowcnt is updated while mlock/munlocking MAP_PRIVATE and PROT_WRITE region
 * irrespective of the following factors or anything else:
 *
 *      (1) anon slots are populated or not
 *      (2) cow is broken or not
 *      (3) refcnt on ap is 1 or greater than 1
 *
 * If it's not MAP_PRIVATE and PROT_WRITE, p_lckcnt is updated during mlock
 * and munlock.
 *
 *
 * Handling p_cowcnts/p_lckcnts during copy-on-write fault:
 *
 *      if vpage has PROT_WRITE
 *              transfer cowcnt on the oldpage -> cowcnt on the newpage
 *      else
 *              transfer lckcnt on the oldpage -> lckcnt on the newpage
 *
 *      During copy-on-write, decrement p_cowcnt on the oldpage and increment
 *      p_cowcnt on the newpage *if* the corresponding vpage has PROT_WRITE.
 *
 *      We may also break COW if softlocking on read access in the physio case.
 *      In this case, vpage may not have PROT_WRITE. So, we need to decrement
 *      p_lckcnt on the oldpage and increment p_lckcnt on the newpage *if* the
 *      vpage doesn't have PROT_WRITE.
 *
 *
 * Handling p_cowcnts/p_lckcnts during mprotect on mlocked region:
 *
 *      If a MAP_PRIVATE region loses PROT_WRITE, we decrement p_cowcnt and
 *      increment p_lckcnt by calling page_subclaim() which takes care of
 *      availrmem accounting and p_lckcnt overflow.
 *
 *      If a MAP_PRIVATE region gains PROT_WRITE, we decrement p_lckcnt and
 *      increment p_cowcnt by calling page_addclaim() which takes care of
 *      availrmem availability and p_cowcnt overflow.
 */

/*
 * Lock down (or unlock) pages mapped by this segment.
 *
 * XXX only creates PAGESIZE pages if anon slots are not initialized.
 * At fault time they will be relocated into larger pages.
 */
static int
segvn_lockop(struct seg *seg, caddr_t addr, size_t len,
    int attr, int op, ulong_t *lockmap, size_t pos)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vpp;
        struct vpage *evp;
        page_t *pp;
        uoff_t offset;
        uoff_t off;
        int segtype;
        int pageprot;
        int claim;
        struct vnode *vp;
        ulong_t anon_index;
        struct anon_map *amp;
        struct anon *ap;
        struct vattr va;
        anon_sync_obj_t cookie;
        struct kshmid *sp = NULL;
        struct proc     *p = curproc;
        kproject_t      *proj = NULL;
        int chargeproc = 1;
        size_t locked_bytes = 0;
        size_t unlocked_bytes = 0;
        int err = 0;

        /*
         * Hold write lock on address space because may split or concatenate
         * segments
         */
        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        /*
         * If this is a shm, use shm's project and zone, else use
         * project and zone of calling process
         */

        /* Determine if this segment backs a sysV shm */
        if (svd->amp != NULL && svd->amp->a_sp != NULL) {
                ASSERT(svd->type == MAP_SHARED);
                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                sp = svd->amp->a_sp;
                proj = sp->shm_perm.ipc_proj;
                chargeproc = 0;
        }

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
        if (attr) {
                pageprot = attr & ~(SHARED|PRIVATE);
                segtype = attr & SHARED ? MAP_SHARED : MAP_PRIVATE;

                /*
                 * We are done if the segment types don't match
                 * or if we have segment level protections and
                 * they don't match.
                 */
                if (svd->type != segtype) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
                if (svd->pageprot == 0 && svd->prot != pageprot) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
        }

        if (op == MC_LOCK) {
                if (svd->tr_state == SEGVN_TR_INIT) {
                        svd->tr_state = SEGVN_TR_OFF;
                } else if (svd->tr_state == SEGVN_TR_ON) {
                        ASSERT(svd->amp != NULL);
                        segvn_textunrepl(seg, 0);
                        ASSERT(svd->amp == NULL &&
                            svd->tr_state == SEGVN_TR_OFF);
                }
        }

        /*
         * If we're locking, then we must create a vpage structure if
         * none exists.  If we're unlocking, then check to see if there
         * is a vpage --  if not, then we could not have locked anything.
         */

        if ((vpp = svd->vpage) == NULL) {
                if (op == MC_LOCK) {
                        segvn_vpage(seg);
                        if (svd->vpage == NULL) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (ENOMEM);
                        }
                } else {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
        }

        /*
         * The anonymous data vector (i.e., previously
         * unreferenced mapping to swap space) can be allocated
         * by lazily testing for its existence.
         */
        if (op == MC_LOCK && svd->amp == NULL && svd->vp == NULL) {
                ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                svd->amp = anonmap_alloc(seg->s_size, 0, ANON_SLEEP);
                svd->amp->a_szc = seg->s_szc;
        }

        if ((amp = svd->amp) != NULL) {
                anon_index = svd->anon_index + seg_page(seg, addr);
        }

        offset = svd->offset + (uintptr_t)(addr - seg->s_base);
        evp = &svd->vpage[seg_page(seg, addr + len)];

        if (sp != NULL)
                mutex_enter(&sp->shm_mlock);

        /* determine number of unlocked bytes in range for lock operation */
        if (op == MC_LOCK) {

                if (sp == NULL) {
                        for (vpp = &svd->vpage[seg_page(seg, addr)]; vpp < evp;
                            vpp++) {
                                if (!VPP_ISPPLOCK(vpp))
                                        unlocked_bytes += PAGESIZE;
                        }
                } else {
                        ulong_t         i_idx, i_edx;
                        anon_sync_obj_t i_cookie;
                        struct anon     *i_ap;
                        struct vnode    *i_vp;
                        uoff_t  i_off;

                        /* Only count sysV pages once for locked memory */
                        i_edx = svd->anon_index + seg_page(seg, addr + len);
                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        for (i_idx = anon_index; i_idx < i_edx; i_idx++) {
                                anon_array_enter(amp, i_idx, &i_cookie);
                                i_ap = anon_get_ptr(amp->ahp, i_idx);
                                if (i_ap == NULL) {
                                        unlocked_bytes += PAGESIZE;
                                        anon_array_exit(&i_cookie);
                                        continue;
                                }
                                swap_xlate(i_ap, &i_vp, &i_off);
                                anon_array_exit(&i_cookie);
                                pp = page_lookup(&i_vp->v_object, i_off,
                                                 SE_SHARED);
                                if (pp == NULL) {
                                        unlocked_bytes += PAGESIZE;
                                        continue;
                                } else if (pp->p_lckcnt == 0)
                                        unlocked_bytes += PAGESIZE;
                                page_unlock(pp);
                        }
                        ANON_LOCK_EXIT(&amp->a_rwlock);
                }

                mutex_enter(&p->p_lock);
                err = rctl_incr_locked_mem(p, proj, unlocked_bytes,
                    chargeproc);
                mutex_exit(&p->p_lock);

                if (err) {
                        if (sp != NULL)
                                mutex_exit(&sp->shm_mlock);
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (err);
                }
        }
        /*
         * Loop over all pages in the range.  Process if we're locking and
         * page has not already been locked in this mapping; or if we're
         * unlocking and the page has been locked.
         */
        for (vpp = &svd->vpage[seg_page(seg, addr)]; vpp < evp;
            vpp++, pos++, addr += PAGESIZE, offset += PAGESIZE, anon_index++) {
                if ((attr == 0 || VPP_PROT(vpp) == pageprot) &&
                    ((op == MC_LOCK && !VPP_ISPPLOCK(vpp)) ||
                    (op == MC_UNLOCK && VPP_ISPPLOCK(vpp)))) {

                        if (amp != NULL)
                                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        /*
                         * If this isn't a MAP_NORESERVE segment and
                         * we're locking, allocate anon slots if they
                         * don't exist.  The page is brought in later on.
                         */
                        if (op == MC_LOCK && svd->vp == NULL &&
                            ((svd->flags & MAP_NORESERVE) == 0) &&
                            amp != NULL &&
                            ((ap = anon_get_ptr(amp->ahp, anon_index))
                            == NULL)) {
                                anon_array_enter(amp, anon_index, &cookie);

                                if ((ap = anon_get_ptr(amp->ahp,
                                    anon_index)) == NULL) {
                                        pp = anon_zero(seg, addr, &ap,
                                            svd->cred);
                                        if (pp == NULL) {
                                                anon_array_exit(&cookie);
                                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                                err = ENOMEM;
                                                goto out;
                                        }
                                        ASSERT(anon_get_ptr(amp->ahp,
                                            anon_index) == NULL);
                                        (void) anon_set_ptr(amp->ahp,
                                            anon_index, ap, ANON_SLEEP);
                                        page_unlock(pp);
                                }
                                anon_array_exit(&cookie);
                        }

                        /*
                         * Get name for page, accounting for
                         * existence of private copy.
                         */
                        ap = NULL;
                        if (amp != NULL) {
                                anon_array_enter(amp, anon_index, &cookie);
                                ap = anon_get_ptr(amp->ahp, anon_index);
                                if (ap != NULL) {
                                        swap_xlate(ap, &vp, &off);
                                } else {
                                        if (svd->vp == NULL &&
                                            (svd->flags & MAP_NORESERVE)) {
                                                anon_array_exit(&cookie);
                                                ANON_LOCK_EXIT(&amp->a_rwlock);
                                                continue;
                                        }
                                        vp = svd->vp;
                                        off = offset;
                                }
                                if (op != MC_LOCK || ap == NULL) {
                                        anon_array_exit(&cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                        } else {
                                vp = svd->vp;
                                off = offset;
                        }

                        /*
                         * Get page frame.  It's ok if the page is
                         * not available when we're unlocking, as this
                         * may simply mean that a page we locked got
                         * truncated out of existence after we locked it.
                         *
                         * Invoke fop_getpage() to obtain the page struct
                         * since we may need to read it from disk if its
                         * been paged out.
                         */
                        if (op != MC_LOCK)
                                pp = page_lookup(&vp->v_object, off,
                                                 SE_SHARED);
                        else {
                                page_t *pl[1 + 1];
                                int error;

                                ASSERT(vp != NULL);

                                error = fop_getpage(vp, (offset_t)off, PAGESIZE,
                                    (uint_t *)NULL, pl, PAGESIZE, seg, addr,
                                    S_OTHER, svd->cred, NULL);

                                if (error && ap != NULL) {
                                        anon_array_exit(&cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }

                                /*
                                 * If the error is EDEADLK then we must bounce
                                 * up and drop all vm subsystem locks and then
                                 * retry the operation later
                                 * This behavior is a temporary measure because
                                 * ufs/sds logging is badly designed and will
                                 * deadlock if we don't allow this bounce to
                                 * happen.  The real solution is to re-design
                                 * the logging code to work properly.  See bug
                                 * 4125102 for details of the problem.
                                 */
                                if (error == EDEADLK) {
                                        err = error;
                                        goto out;
                                }
                                /*
                                 * Quit if we fail to fault in the page.  Treat
                                 * the failure as an error, unless the addr
                                 * is mapped beyond the end of a file.
                                 */
                                if (error && svd->vp) {
                                        va.va_mask = AT_SIZE;
                                        if (fop_getattr(svd->vp, &va, 0,
                                            svd->cred, NULL) != 0) {
                                                err = EIO;
                                                goto out;
                                        }
                                        if (btopr(va.va_size) >=
                                            btopr(off + 1)) {
                                                err = EIO;
                                                goto out;
                                        }
                                        goto out;

                                } else if (error) {
                                        err = EIO;
                                        goto out;
                                }
                                pp = pl[0];
                                ASSERT(pp != NULL);
                        }

                        /*
                         * See Statement at the beginning of this routine.
                         *
                         * claim is always set if MAP_PRIVATE and PROT_WRITE
                         * irrespective of following factors:
                         *
                         * (1) anon slots are populated or not
                         * (2) cow is broken or not
                         * (3) refcnt on ap is 1 or greater than 1
                         *
                         * See 4140683 for details
                         */
                        claim = ((VPP_PROT(vpp) & PROT_WRITE) &&
                            (svd->type == MAP_PRIVATE));

                        /*
                         * Perform page-level operation appropriate to
                         * operation.  If locking, undo the SOFTLOCK
                         * performed to bring the page into memory
                         * after setting the lock.  If unlocking,
                         * and no page was found, account for the claim
                         * separately.
                         */
                        if (op == MC_LOCK) {
                                int ret = 1;    /* Assume success */

                                ASSERT(!VPP_ISPPLOCK(vpp));

                                ret = page_pp_lock(pp, claim, 0);
                                if (ap != NULL) {
                                        if (ap->an_pvp != NULL) {
                                                anon_swap_free(ap, pp);
                                        }
                                        anon_array_exit(&cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                }
                                if (ret == 0) {
                                        /* locking page failed */
                                        page_unlock(pp);
                                        err = EAGAIN;
                                        goto out;
                                }
                                VPP_SETPPLOCK(vpp);
                                if (sp != NULL) {
                                        if (pp->p_lckcnt == 1)
                                                locked_bytes += PAGESIZE;
                                } else
                                        locked_bytes += PAGESIZE;

                                if (lockmap != NULL)
                                        BT_SET(lockmap, pos);

                                page_unlock(pp);
                        } else {
                                ASSERT(VPP_ISPPLOCK(vpp));
                                if (pp != NULL) {
                                        /* sysV pages should be locked */
                                        ASSERT(sp == NULL || pp->p_lckcnt > 0);
                                        page_pp_unlock(pp, claim, 0);
                                        if (sp != NULL) {
                                                if (pp->p_lckcnt == 0)
                                                        unlocked_bytes
                                                            += PAGESIZE;
                                        } else
                                                unlocked_bytes += PAGESIZE;
                                        page_unlock(pp);
                                } else {
                                        ASSERT(sp == NULL);
                                        unlocked_bytes += PAGESIZE;
                                }
                                VPP_CLRPPLOCK(vpp);
                        }
                }
        }
out:
        if (op == MC_LOCK) {
                /* Credit back bytes that did not get locked */
                if ((unlocked_bytes - locked_bytes) > 0) {
                        if (proj == NULL)
                                mutex_enter(&p->p_lock);
                        rctl_decr_locked_mem(p, proj,
                            (unlocked_bytes - locked_bytes), chargeproc);
                        if (proj == NULL)
                                mutex_exit(&p->p_lock);
                }

        } else {
                /* Account bytes that were unlocked */
                if (unlocked_bytes > 0) {
                        if (proj == NULL)
                                mutex_enter(&p->p_lock);
                        rctl_decr_locked_mem(p, proj, unlocked_bytes,
                            chargeproc);
                        if (proj == NULL)
                                mutex_exit(&p->p_lock);
                }
        }
        if (sp != NULL)
                mutex_exit(&sp->shm_mlock);
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);

        return (err);
}

/*
 * Set advice from user for specified pages
 * There are 10 types of advice:
 *      MADV_NORMAL     - Normal (default) behavior (whatever that is)
 *      MADV_RANDOM     - Random page references
 *                              do not allow readahead or 'klustering'
 *      MADV_SEQUENTIAL - Sequential page references
 *                              Pages previous to the one currently being
 *                              accessed (determined by fault) are 'not needed'
 *                              and are freed immediately
 *      MADV_WILLNEED   - Pages are likely to be used (fault ahead in mctl)
 *      MADV_DONTNEED   - Pages are not needed (synced out in mctl)
 *      MADV_FREE       - Contents can be discarded
 *      MADV_ACCESS_DEFAULT- Default access
 *      MADV_ACCESS_LWP - Next LWP will access heavily
 *      MADV_ACCESS_MANY- Many LWPs or processes will access heavily
 *      MADV_PURGE      - Contents will be immediately discarded
 */
static int
segvn_advise(struct seg *seg, caddr_t addr, size_t len, uint_t behav)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        size_t page;
        int err = 0;
        int already_set;
        struct anon_map *amp;
        ulong_t anon_index;
        struct seg *next;
        lgrp_mem_policy_t policy;
        struct seg *prev;
        struct vnode *vp;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        /*
         * In case of MADV_FREE/MADV_PURGE, we won't be modifying any segment
         * private data structures; so, we only need to grab READER's lock
         */
        if (behav != MADV_FREE && behav != MADV_PURGE) {
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);
                if (svd->tr_state != SEGVN_TR_OFF) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }
        } else {
                SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
        }

        /*
         * Large pages are assumed to be only turned on when accesses to the
         * segment's address range have spatial and temporal locality. That
         * justifies ignoring MADV_SEQUENTIAL for large page segments.
         * Also, ignore advice affecting lgroup memory allocation
         * if don't need to do lgroup optimizations on this system
         */

        if ((behav == MADV_SEQUENTIAL &&
            (seg->s_szc != 0 || HAT_IS_REGION_COOKIE_VALID(svd->rcookie))) ||
            (!lgrp_optimizations() && (behav == MADV_ACCESS_DEFAULT ||
            behav == MADV_ACCESS_LWP || behav == MADV_ACCESS_MANY))) {
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        if (behav == MADV_SEQUENTIAL || behav == MADV_ACCESS_DEFAULT ||
            behav == MADV_ACCESS_LWP || behav == MADV_ACCESS_MANY) {
                /*
                 * Since we are going to unload hat mappings
                 * we first have to flush the cache. Otherwise
                 * this might lead to system panic if another
                 * thread is doing physio on the range whose
                 * mappings are unloaded by madvise(3C).
                 */
                if (svd->softlockcnt > 0) {
                        /*
                         * If this is shared segment non 0 softlockcnt
                         * means locked pages are still in use.
                         */
                        if (svd->type == MAP_SHARED) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (EAGAIN);
                        }
                        /*
                         * Since we do have the segvn writers lock
                         * nobody can fill the cache with entries
                         * belonging to this seg during the purge.
                         * The flush either succeeds or we still
                         * have pending I/Os. In the later case,
                         * madvise(3C) fails.
                         */
                        segvn_purge(seg);
                        if (svd->softlockcnt > 0) {
                                /*
                                 * Since madvise(3C) is advisory and
                                 * it's not part of UNIX98, madvise(3C)
                                 * failure here doesn't cause any hardship.
                                 * Note that we don't block in "as" layer.
                                 */
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (EAGAIN);
                        }
                } else if (svd->type == MAP_SHARED && svd->amp != NULL &&
                    svd->amp->a_softlockcnt > 0) {
                        /*
                         * Try to purge this amp's entries from pcache. It
                         * will succeed only if other segments that share the
                         * amp have no outstanding softlock's.
                         */
                        segvn_purge(seg);
                }
        }

        amp = svd->amp;
        vp = svd->vp;
        if (behav == MADV_FREE || behav == MADV_PURGE) {
                pgcnt_t purged;

                if (behav == MADV_FREE && (vp != NULL || amp == NULL)) {
                        /*
                         * MADV_FREE is not supported for segments with an
                         * underlying object; if anonmap is NULL, anon slots
                         * are not yet populated and there is nothing for us
                         * to do. As MADV_FREE is advisory, we don't return an
                         * error in either case.
                         */
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (0);
                }

                if (amp == NULL) {
                        /*
                         * If we're here with a NULL anonmap, it's because we
                         * are doing a MADV_PURGE.  We have nothing to do, but
                         * because MADV_PURGE isn't merely advisory, we return
                         * an error in this case.
                         */
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (EBUSY);
                }

                segvn_purge(seg);

                page = seg_page(seg, addr);
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                err = anon_disclaim(amp,
                    svd->anon_index + page, len, behav, &purged);

                if (purged != 0 && (svd->flags & MAP_NORESERVE)) {
                        /*
                         * If we purged pages on a MAP_NORESERVE mapping, we
                         * need to be sure to now unreserve our reserved swap.
                         * (We use the atomic operations to manipulate our
                         * segment and address space counters because we only
                         * have the corresponding locks held as reader, not
                         * writer.)
                         */
                        ssize_t bytes = ptob(purged);

                        anon_unresv_zone(bytes, seg->s_as->a_proc->p_zone);
                        atomic_add_long(&svd->swresv, -bytes);
                        atomic_add_long(&seg->s_as->a_resvsize, -bytes);
                }

                ANON_LOCK_EXIT(&amp->a_rwlock);
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);

                /*
                 * MADV_PURGE and MADV_FREE differ in their return semantics:
                 * because MADV_PURGE is designed to be bug-for-bug compatible
                 * with its clumsy Linux forebear, it will fail where MADV_FREE
                 * does not.
                 */
                return (behav == MADV_PURGE ? err : 0);
        }

        /*
         * If advice is to be applied to entire segment,
         * use advice field in seg_data structure
         * otherwise use appropriate vpage entry.
         */
        if ((addr == seg->s_base) && (len == seg->s_size)) {
                switch (behav) {
                case MADV_ACCESS_LWP:
                case MADV_ACCESS_MANY:
                case MADV_ACCESS_DEFAULT:
                        /*
                         * Set memory allocation policy for this segment
                         */
                        policy = lgrp_madv_to_policy(behav, len, svd->type);
                        if (svd->type == MAP_SHARED)
                                already_set = lgrp_shm_policy_set(policy, amp,
                                    svd->anon_index, vp, svd->offset, len);
                        else {
                                /*
                                 * For private memory, need writers lock on
                                 * address space because the segment may be
                                 * split or concatenated when changing policy
                                 */
                                if (AS_READ_HELD(seg->s_as)) {
                                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                        return (IE_RETRY);
                                }

                                already_set = lgrp_privm_policy_set(policy,
                                    &svd->policy_info, len);
                        }

                        /*
                         * If policy set already and it shouldn't be reapplied,
                         * don't do anything.
                         */
                        if (already_set &&
                            !LGRP_MEM_POLICY_REAPPLICABLE(policy))
                                break;

                        /*
                         * Mark any existing pages in given range for
                         * migration
                         */
                        page_mark_migrate(seg, addr, len, amp, svd->anon_index,
                            &vp->v_object, svd->offset, 1);

                        /*
                         * If same policy set already or this is a shared
                         * memory segment, don't need to try to concatenate
                         * segment with adjacent ones.
                         */
                        if (already_set || svd->type == MAP_SHARED)
                                break;

                        /*
                         * Try to concatenate this segment with previous
                         * one and next one, since we changed policy for
                         * this one and it may be compatible with adjacent
                         * ones now.
                         */
                        prev = AS_SEGPREV(seg->s_as, seg);
                        next = AS_SEGNEXT(seg->s_as, seg);

                        if (next && next->s_ops == &segvn_ops &&
                            addr + len == next->s_base)
                                (void) segvn_concat(seg, next, 1);

                        if (prev && prev->s_ops == &segvn_ops &&
                            addr == prev->s_base + prev->s_size) {
                                /*
                                 * Drop lock for private data of current
                                 * segment before concatenating (deleting) it
                                 * and return IE_REATTACH to tell as_ctl() that
                                 * current segment has changed
                                 */
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                if (!segvn_concat(prev, seg, 1))
                                        err = IE_REATTACH;

                                return (err);
                        }
                        break;

                case MADV_SEQUENTIAL:
                        /*
                         * unloading mapping guarantees
                         * detection in segvn_fault
                         */
                        ASSERT(seg->s_szc == 0);
                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                        hat_unload(seg->s_as->a_hat, addr, len,
                            HAT_UNLOAD);
                        /* FALLTHROUGH */
                case MADV_NORMAL:
                case MADV_RANDOM:
                        svd->advice = (uchar_t)behav;
                        svd->pageadvice = 0;
                        break;
                case MADV_WILLNEED:     /* handled in memcntl */
                case MADV_DONTNEED:     /* handled in memcntl */
                case MADV_FREE:         /* handled above */
                case MADV_PURGE:        /* handled above */
                        break;
                default:
                        err = EINVAL;
                }
        } else {
                caddr_t                 eaddr;
                struct seg              *new_seg;
                struct segvn_data       *new_svd;
                uoff_t          off;
                caddr_t                 oldeaddr;

                page = seg_page(seg, addr);

                segvn_vpage(seg);
                if (svd->vpage == NULL) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        return (ENOMEM);
                }

                switch (behav) {
                        struct vpage *bvpp, *evpp;

                case MADV_ACCESS_LWP:
                case MADV_ACCESS_MANY:
                case MADV_ACCESS_DEFAULT:
                        /*
                         * Set memory allocation policy for portion of this
                         * segment
                         */

                        /*
                         * Align address and length of advice to page
                         * boundaries for large pages
                         */
                        if (seg->s_szc != 0) {
                                size_t  pgsz;

                                pgsz = page_get_pagesize(seg->s_szc);
                                addr = (caddr_t)P2ALIGN((uintptr_t)addr, pgsz);
                                len = P2ROUNDUP(len, pgsz);
                        }

                        /*
                         * Check to see whether policy is set already
                         */
                        policy = lgrp_madv_to_policy(behav, len, svd->type);

                        anon_index = svd->anon_index + page;
                        off = svd->offset + (uintptr_t)(addr - seg->s_base);

                        if (svd->type == MAP_SHARED)
                                already_set = lgrp_shm_policy_set(policy, amp,
                                    anon_index, vp, off, len);
                        else
                                already_set =
                                    (policy == svd->policy_info.mem_policy);

                        /*
                         * If policy set already and it shouldn't be reapplied,
                         * don't do anything.
                         */
                        if (already_set &&
                            !LGRP_MEM_POLICY_REAPPLICABLE(policy))
                                break;

                        /*
                         * For private memory, need writers lock on
                         * address space because the segment may be
                         * split or concatenated when changing policy
                         */
                        if (svd->type == MAP_PRIVATE &&
                            AS_READ_HELD(seg->s_as)) {
                                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                                return (IE_RETRY);
                        }

                        /*
                         * Mark any existing pages in given range for
                         * migration
                         */
                        page_mark_migrate(seg, addr, len, amp, svd->anon_index,
                            &vp->v_object, svd->offset, 1);

                        /*
                         * Don't need to try to split or concatenate
                         * segments, since policy is same or this is a shared
                         * memory segment
                         */
                        if (already_set || svd->type == MAP_SHARED)
                                break;

                        if (HAT_IS_REGION_COOKIE_VALID(svd->rcookie)) {
                                ASSERT(svd->amp == NULL);
                                ASSERT(svd->tr_state == SEGVN_TR_OFF);
                                ASSERT(svd->softlockcnt == 0);
                                hat_leave_region(seg->s_as->a_hat, svd->rcookie,
                                    HAT_REGION_TEXT);
                                svd->rcookie = HAT_INVALID_REGION_COOKIE;
                        }

                        /*
                         * Split off new segment if advice only applies to a
                         * portion of existing segment starting in middle
                         */
                        new_seg = NULL;
                        eaddr = addr + len;
                        oldeaddr = seg->s_base + seg->s_size;
                        if (addr > seg->s_base) {
                                /*
                                 * Must flush I/O page cache
                                 * before splitting segment
                                 */
                                if (svd->softlockcnt > 0)
                                        segvn_purge(seg);

                                /*
                                 * Split segment and return IE_REATTACH to tell
                                 * as_ctl() that current segment changed
                                 */
                                new_seg = segvn_split_seg(seg, addr);
                                new_svd = (struct segvn_data *)new_seg->s_data;
                                err = IE_REATTACH;

                                /*
                                 * If new segment ends where old one
                                 * did, try to concatenate the new
                                 * segment with next one.
                                 */
                                if (eaddr == oldeaddr) {
                                        /*
                                         * Set policy for new segment
                                         */
                                        (void) lgrp_privm_policy_set(policy,
                                            &new_svd->policy_info,
                                            new_seg->s_size);

                                        next = AS_SEGNEXT(new_seg->s_as,
                                            new_seg);

                                        if (next &&
                                            next->s_ops == &segvn_ops &&
                                            eaddr == next->s_base)
                                                (void) segvn_concat(new_seg,
                                                    next, 1);
                                }
                        }

                        /*
                         * Split off end of existing segment if advice only
                         * applies to a portion of segment ending before
                         * end of the existing segment
                         */
                        if (eaddr < oldeaddr) {
                                /*
                                 * Must flush I/O page cache
                                 * before splitting segment
                                 */
                                if (svd->softlockcnt > 0)
                                        segvn_purge(seg);

                                /*
                                 * If beginning of old segment was already
                                 * split off, use new segment to split end off
                                 * from.
                                 */
                                if (new_seg != NULL && new_seg != seg) {
                                        /*
                                         * Split segment
                                         */
                                        (void) segvn_split_seg(new_seg, eaddr);

                                        /*
                                         * Set policy for new segment
                                         */
                                        (void) lgrp_privm_policy_set(policy,
                                            &new_svd->policy_info,
                                            new_seg->s_size);
                                } else {
                                        /*
                                         * Split segment and return IE_REATTACH
                                         * to tell as_ctl() that current
                                         * segment changed
                                         */
                                        (void) segvn_split_seg(seg, eaddr);
                                        err = IE_REATTACH;

                                        (void) lgrp_privm_policy_set(policy,
                                            &svd->policy_info, seg->s_size);

                                        /*
                                         * If new segment starts where old one
                                         * did, try to concatenate it with
                                         * previous segment.
                                         */
                                        if (addr == seg->s_base) {
                                                prev = AS_SEGPREV(seg->s_as,
                                                    seg);

                                                /*
                                                 * Drop lock for private data
                                                 * of current segment before
                                                 * concatenating (deleting) it
                                                 */
                                                if (prev &&
                                                    prev->s_ops ==
                                                    &segvn_ops &&
                                                    addr == prev->s_base +
                                                    prev->s_size) {
                                                        SEGVN_LOCK_EXIT(
                                                            seg->s_as,
                                                            &svd->lock);
                                                        (void) segvn_concat(
                                                            prev, seg, 1);
                                                        return (err);
                                                }
                                        }
                                }
                        }
                        break;
                case MADV_SEQUENTIAL:
                        ASSERT(seg->s_szc == 0);
                        ASSERT(svd->rcookie == HAT_INVALID_REGION_COOKIE);
                        hat_unload(seg->s_as->a_hat, addr, len, HAT_UNLOAD);
                        /* FALLTHROUGH */
                case MADV_NORMAL:
                case MADV_RANDOM:
                        bvpp = &svd->vpage[page];
                        evpp = &svd->vpage[page + (len >> PAGESHIFT)];
                        for (; bvpp < evpp; bvpp++)
                                VPP_SETADVICE(bvpp, behav);
                        svd->advice = MADV_NORMAL;
                        break;
                case MADV_WILLNEED:     /* handled in memcntl */
                case MADV_DONTNEED:     /* handled in memcntl */
                case MADV_FREE:         /* handled above */
                case MADV_PURGE:        /* handled above */
                        break;
                default:
                        err = EINVAL;
                }
        }
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        return (err);
}

/*
 * There is one kind of inheritance that can be specified for pages:
 *
 *     SEGP_INH_ZERO - Pages should be zeroed in the child
 */
static int
segvn_inherit(struct seg *seg, caddr_t addr, size_t len, uint_t behav)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *bvpp, *evpp;
        size_t page;
        int ret = 0;

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));

        /* Can't support something we don't know about */
        if (behav != SEGP_INH_ZERO)
                return (ENOTSUP);

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_WRITER);

        /*
         * This must be a straightforward anonymous segment that is mapped
         * privately and is not backed by a vnode.
         */
        if (svd->tr_state != SEGVN_TR_OFF ||
            svd->type != MAP_PRIVATE ||
            svd->vp != NULL) {
                ret = EINVAL;
                goto out;
        }

        /*
         * If the entire segment has been marked as inherit zero, then no reason
         * to do anything else.
         */
        if (svd->svn_inz == SEGVN_INZ_ALL) {
                ret = 0;
                goto out;
        }

        /*
         * If this applies to the entire segment, simply mark it and we're done.
         */
        if ((addr == seg->s_base) && (len == seg->s_size)) {
                svd->svn_inz = SEGVN_INZ_ALL;
                ret = 0;
                goto out;
        }

        /*
         * We've been asked to mark a subset of this segment as inherit zero,
         * therefore we need to mainpulate its vpages.
         */
        if (svd->vpage == NULL) {
                segvn_vpage(seg);
                if (svd->vpage == NULL) {
                        ret = ENOMEM;
                        goto out;
                }
        }

        svd->svn_inz = SEGVN_INZ_VPP;
        page = seg_page(seg, addr);
        bvpp = &svd->vpage[page];
        evpp = &svd->vpage[page + (len >> PAGESHIFT)];
        for (; bvpp < evpp; bvpp++)
                VPP_SETINHZERO(bvpp);
        ret = 0;

out:
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        return (ret);
}

/*
 * Create a vpage structure for this seg.
 */
static void
segvn_vpage(struct seg *seg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vp, *evp;
        static pgcnt_t page_limit = 0;

        ASSERT(SEGVN_WRITE_HELD(seg->s_as, &svd->lock));

        /*
         * If no vpage structure exists, allocate one.  Copy the protections
         * and the advice from the segment itself to the individual pages.
         */
        if (svd->vpage == NULL) {
                /*
                 * Start by calculating the number of pages we must allocate to
                 * track the per-page vpage structs needs for this entire
                 * segment. If we know now that it will require more than our
                 * heuristic for the maximum amount of kmem we can consume then
                 * fail. We do this here, instead of trying to detect this deep
                 * in page_resv and propagating the error up, since the entire
                 * memory allocation stack is not amenable to passing this
                 * back. Instead, it wants to keep trying.
                 *
                 * As a heuristic we set a page limit of 5/8s of total_pages
                 * for this allocation. We use shifts so that no floating
                 * point conversion takes place and only need to do the
                 * calculation once.
                 */
                ulong_t mem_needed = seg_pages(seg) * sizeof (struct vpage);
                pgcnt_t npages = mem_needed >> PAGESHIFT;

                if (page_limit == 0)
                        page_limit = (total_pages >> 1) + (total_pages >> 3);

                if (npages > page_limit)
                        return;

                svd->pageadvice = 1;
                svd->vpage = kmem_zalloc(mem_needed, KM_SLEEP);
                evp = &svd->vpage[seg_page(seg, seg->s_base + seg->s_size)];
                for (vp = svd->vpage; vp < evp; vp++) {
                        VPP_SETPROT(vp, svd->prot);
                        VPP_SETADVICE(vp, svd->advice);
                }
        }
}

/*
 * Dump the pages belonging to this segvn segment.
 */
static void
segvn_dump(struct seg *seg)
{
        struct segvn_data *svd;
        page_t *pp;
        struct anon_map *amp;
        ulong_t anon_index;
        struct vnode *vp;
        uoff_t off, offset;
        pfn_t pfn;
        pgcnt_t page, npages;
        caddr_t addr;

        npages = seg_pages(seg);
        svd = (struct segvn_data *)seg->s_data;
        vp = svd->vp;
        off = offset = svd->offset;
        addr = seg->s_base;

        if ((amp = svd->amp) != NULL) {
                anon_index = svd->anon_index;
                ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
        }

        for (page = 0; page < npages; page++, offset += PAGESIZE) {
                struct anon *ap;
                int we_own_it = 0;

                if (amp && (ap = anon_get_ptr(svd->amp->ahp, anon_index++))) {
                        swap_xlate_nopanic(ap, &vp, &off);
                } else {
                        vp = svd->vp;
                        off = offset;
                }

                /*
                 * If pp == NULL, the page either does not exist
                 * or is exclusively locked.  So determine if it
                 * exists before searching for it.
                 */

                if ((pp = page_lookup_nowait(&vp->v_object, off, SE_SHARED)))
                        we_own_it = 1;
                else
                        pp = page_exists(&vp->v_object, off);

                if (pp) {
                        pfn = page_pptonum(pp);
                        dump_addpage(seg->s_as, addr, pfn);
                        if (we_own_it)
                                page_unlock(pp);
                }
                addr += PAGESIZE;
                dump_timeleft = dump_timeout;
        }

        if (amp != NULL)
                ANON_LOCK_EXIT(&amp->a_rwlock);
}

#ifdef DEBUG
static uint32_t segvn_pglock_mtbf = 0;
#endif

#define PCACHE_SHWLIST          ((page_t *)-2)
#define NOPCACHE_SHWLIST        ((page_t *)-1)

/*
 * Lock/Unlock anon pages over a given range. Return shadow list. This routine
 * uses global segment pcache to cache shadow lists (i.e. pp arrays) of pages
 * to avoid the overhead of per page locking, unlocking for subsequent IOs to
 * the same parts of the segment. Currently shadow list creation is only
 * supported for pure anon segments. MAP_PRIVATE segment pcache entries are
 * tagged with segment pointer, starting virtual address and length. This
 * approach for MAP_SHARED segments may add many pcache entries for the same
 * set of pages and lead to long hash chains that decrease pcache lookup
 * performance. To avoid this issue for shared segments shared anon map and
 * starting anon index are used for pcache entry tagging. This allows all
 * segments to share pcache entries for the same anon range and reduces pcache
 * chain's length as well as memory overhead from duplicate shadow lists and
 * pcache entries.
 *
 * softlockcnt field in segvn_data structure counts the number of F_SOFTLOCK'd
 * pages via segvn_fault() and pagelock'd pages via this routine. But pagelock
 * part of softlockcnt accounting is done differently for private and shared
 * segments. In private segment case softlock is only incremented when a new
 * shadow list is created but not when an existing one is found via
 * seg_plookup(). pcache entries have reference count incremented/decremented
 * by each seg_plookup()/seg_pinactive() operation. Only entries that have 0
 * reference count can be purged (and purging is needed before segment can be
 * freed). When a private segment pcache entry is purged segvn_reclaim() will
 * decrement softlockcnt. Since in private segment case each of its pcache
 * entries only belongs to this segment we can expect that when
 * segvn_pagelock(L_PAGEUNLOCK) was called for all outstanding IOs in this
 * segment purge will succeed and softlockcnt will drop to 0. In shared
 * segment case reference count in pcache entry counts active locks from many
 * different segments so we can't expect segment purging to succeed even when
 * segvn_pagelock(L_PAGEUNLOCK) was called for all outstanding IOs in this
 * segment. To be able to determine when there're no pending pagelocks in
 * shared segment case we don't rely on purging to make softlockcnt drop to 0
 * but instead softlockcnt is incremented and decremented for every
 * segvn_pagelock(L_PAGELOCK/L_PAGEUNLOCK) call regardless if a new shadow
 * list was created or an existing one was found. When softlockcnt drops to 0
 * this segment no longer has any claims for pcached shadow lists and the
 * segment can be freed even if there're still active pcache entries
 * shared by this segment anon map. Shared segment pcache entries belong to
 * anon map and are typically removed when anon map is freed after all
 * processes destroy the segments that use this anon map.
 */
static int
segvn_pagelock(struct seg *seg, caddr_t addr, size_t len, struct page ***ppp,
    enum lock_type type, enum seg_rw rw)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        size_t np;
        pgcnt_t adjustpages;
        pgcnt_t npages;
        ulong_t anon_index;
        uint_t protchk = (rw == S_READ) ? PROT_READ : PROT_WRITE;
        uint_t error;
        struct anon_map *amp;
        pgcnt_t anpgcnt;
        struct page **pplist, **pl, *pp;
        caddr_t a;
        size_t page;
        caddr_t lpgaddr, lpgeaddr;
        anon_sync_obj_t cookie;
        int anlock;
        struct anon_map *pamp;
        caddr_t paddr;
        seg_preclaim_cbfunc_t preclaim_callback;
        size_t pgsz;
        int use_pcache;
        size_t wlen;
        uint_t pflags = 0;
        int sftlck_sbase = 0;
        int sftlck_send = 0;

#ifdef DEBUG
        if (type == L_PAGELOCK && segvn_pglock_mtbf) {
                hrtime_t ts = gethrtime();
                if ((ts % segvn_pglock_mtbf) == 0) {
                        return (ENOTSUP);
                }
                if ((ts % segvn_pglock_mtbf) == 1) {
                        return (EFAULT);
                }
        }
#endif

        ASSERT(seg->s_as && AS_LOCK_HELD(seg->s_as));
        ASSERT(type == L_PAGELOCK || type == L_PAGEUNLOCK);

        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);

        /*
         * for now we only support pagelock to anon memory. We would have to
         * check protections for vnode objects and call into the vnode driver.
         * That's too much for a fast path. Let the fault entry point handle
         * it.
         */
        if (svd->vp != NULL) {
                if (type == L_PAGELOCK) {
                        error = ENOTSUP;
                        goto out;
                }
                panic("segvn_pagelock(L_PAGEUNLOCK): vp != NULL");
        }
        if ((amp = svd->amp) == NULL) {
                if (type == L_PAGELOCK) {
                        error = EFAULT;
                        goto out;
                }
                panic("segvn_pagelock(L_PAGEUNLOCK): amp == NULL");
        }
        if (rw != S_READ && rw != S_WRITE) {
                if (type == L_PAGELOCK) {
                        error = ENOTSUP;
                        goto out;
                }
                panic("segvn_pagelock(L_PAGEUNLOCK): bad rw");
        }

        if (seg->s_szc != 0) {
                /*
                 * We are adjusting the pagelock region to the large page size
                 * boundary because the unlocked part of a large page cannot
                 * be freed anyway unless all constituent pages of a large
                 * page are locked. Bigger regions reduce pcache chain length
                 * and improve lookup performance. The tradeoff is that the
                 * very first segvn_pagelock() call for a given page is more
                 * expensive if only 1 page_t is needed for IO. This is only
                 * an issue if pcache entry doesn't get reused by several
                 * subsequent calls. We optimize here for the case when pcache
                 * is heavily used by repeated IOs to the same address range.
                 *
                 * Note segment's page size cannot change while we are holding
                 * as lock.  And then it cannot change while softlockcnt is
                 * not 0. This will allow us to correctly recalculate large
                 * page size region for the matching pageunlock/reclaim call
                 * since as_pageunlock() caller must always match
                 * as_pagelock() call's addr and len.
                 *
                 * For pageunlock *ppp points to the pointer of page_t that
                 * corresponds to the real unadjusted start address. Similar
                 * for pagelock *ppp must point to the pointer of page_t that
                 * corresponds to the real unadjusted start address.
                 */
                pgsz = page_get_pagesize(seg->s_szc);
                CALC_LPG_REGION(pgsz, seg, addr, len, lpgaddr, lpgeaddr);
                adjustpages = btop((uintptr_t)(addr - lpgaddr));
        } else if (len < segvn_pglock_comb_thrshld) {
                lpgaddr = addr;
                lpgeaddr = addr + len;
                adjustpages = 0;
                pgsz = PAGESIZE;
        } else {
                /*
                 * Align the address range of large enough requests to allow
                 * combining of different shadow lists into 1 to reduce memory
                 * overhead from potentially overlapping large shadow lists
                 * (worst case is we have a 1MB IO into buffers with start
                 * addresses separated by 4K).  Alignment is only possible if
                 * padded chunks have sufficient access permissions. Note
                 * permissions won't change between L_PAGELOCK and
                 * L_PAGEUNLOCK calls since non 0 softlockcnt will force
                 * segvn_setprot() to wait until softlockcnt drops to 0. This
                 * allows us to determine in L_PAGEUNLOCK the same range we
                 * computed in L_PAGELOCK.
                 *
                 * If alignment is limited by segment ends set
                 * sftlck_sbase/sftlck_send flags. In L_PAGELOCK case when
                 * these flags are set bump softlockcnt_sbase/softlockcnt_send
                 * per segment counters. In L_PAGEUNLOCK case decrease
                 * softlockcnt_sbase/softlockcnt_send counters if
                 * sftlck_sbase/sftlck_send flags are set.  When
                 * softlockcnt_sbase/softlockcnt_send are non 0
                 * segvn_concat()/segvn_extend_prev()/segvn_extend_next()
                 * won't merge the segments. This restriction combined with
                 * restriction on segment unmapping and splitting for segments
                 * that have non 0 softlockcnt allows L_PAGEUNLOCK to
                 * correctly determine the same range that was previously
                 * locked by matching L_PAGELOCK.
                 */
                pflags = SEGP_PSHIFT | (segvn_pglock_comb_bshift << 16);
                pgsz = PAGESIZE;
                if (svd->type == MAP_PRIVATE) {
                        lpgaddr = (caddr_t)P2ALIGN((uintptr_t)addr,
                            segvn_pglock_comb_balign);
                        if (lpgaddr < seg->s_base) {
                                lpgaddr = seg->s_base;
                                sftlck_sbase = 1;
                        }
                } else {
                        ulong_t aix = svd->anon_index + seg_page(seg, addr);
                        ulong_t aaix = P2ALIGN(aix, segvn_pglock_comb_palign);
                        if (aaix < svd->anon_index) {
                                lpgaddr = seg->s_base;
                                sftlck_sbase = 1;
                        } else {
                                lpgaddr = addr - ptob(aix - aaix);
                                ASSERT(lpgaddr >= seg->s_base);
                        }
                }
                if (svd->pageprot && lpgaddr != addr) {
                        struct vpage *vp = &svd->vpage[seg_page(seg, lpgaddr)];
                        struct vpage *evp = &svd->vpage[seg_page(seg, addr)];
                        while (vp < evp) {
                                if ((VPP_PROT(vp) & protchk) == 0) {
                                        break;
                                }
                                vp++;
                        }
                        if (vp < evp) {
                                lpgaddr = addr;
                                pflags = 0;
                        }
                }
                lpgeaddr = addr + len;
                if (pflags) {
                        if (svd->type == MAP_PRIVATE) {
                                lpgeaddr = (caddr_t)P2ROUNDUP(
                                    (uintptr_t)lpgeaddr,
                                    segvn_pglock_comb_balign);
                        } else {
                                ulong_t aix = svd->anon_index +
                                    seg_page(seg, lpgeaddr);
                                ulong_t aaix = P2ROUNDUP(aix,
                                    segvn_pglock_comb_palign);
                                if (aaix < aix) {
                                        lpgeaddr = 0;
                                } else {
                                        lpgeaddr += ptob(aaix - aix);
                                }
                        }
                        if (lpgeaddr == 0 ||
                            lpgeaddr > seg->s_base + seg->s_size) {
                                lpgeaddr = seg->s_base + seg->s_size;
                                sftlck_send = 1;
                        }
                }
                if (svd->pageprot && lpgeaddr != addr + len) {
                        struct vpage *vp;
                        struct vpage *evp;

                        vp = &svd->vpage[seg_page(seg, addr + len)];
                        evp = &svd->vpage[seg_page(seg, lpgeaddr)];

                        while (vp < evp) {
                                if ((VPP_PROT(vp) & protchk) == 0) {
                                        break;
                                }
                                vp++;
                        }
                        if (vp < evp) {
                                lpgeaddr = addr + len;
                        }
                }
                adjustpages = btop((uintptr_t)(addr - lpgaddr));
        }

        /*
         * For MAP_SHARED segments we create pcache entries tagged by amp and
         * anon index so that we can share pcache entries with other segments
         * that map this amp.  For private segments pcache entries are tagged
         * with segment and virtual address.
         */
        if (svd->type == MAP_SHARED) {
                pamp = amp;
                paddr = (caddr_t)((lpgaddr - seg->s_base) +
                    ptob(svd->anon_index));
                preclaim_callback = shamp_reclaim;
        } else {
                pamp = NULL;
                paddr = lpgaddr;
                preclaim_callback = segvn_reclaim;
        }

        if (type == L_PAGEUNLOCK) {
                VM_STAT_ADD(segvnvmstats.pagelock[0]);

                /*
                 * update hat ref bits for /proc. We need to make sure
                 * that threads tracing the ref and mod bits of the
                 * address space get the right data.
                 * Note: page ref and mod bits are updated at reclaim time
                 */
                if (seg->s_as->a_vbits) {
                        for (a = addr; a < addr + len; a += PAGESIZE) {
                                if (rw == S_WRITE) {
                                        hat_setstat(seg->s_as, a,
                                            PAGESIZE, P_REF | P_MOD);
                                } else {
                                        hat_setstat(seg->s_as, a,
                                            PAGESIZE, P_REF);
                                }
                        }
                }

                /*
                 * Check the shadow list entry after the last page used in
                 * this IO request. If it's NOPCACHE_SHWLIST the shadow list
                 * was not inserted into pcache and is not large page
                 * adjusted.  In this case call reclaim callback directly and
                 * don't adjust the shadow list start and size for large
                 * pages.
                 */
                npages = btop(len);
                if ((*ppp)[npages] == NOPCACHE_SHWLIST) {
                        void *ptag;
                        if (pamp != NULL) {
                                ASSERT(svd->type == MAP_SHARED);
                                ptag = (void *)pamp;
                                paddr = (caddr_t)((addr - seg->s_base) +
                                    ptob(svd->anon_index));
                        } else {
                                ptag = (void *)seg;
                                paddr = addr;
                        }
                        (*preclaim_callback)(ptag, paddr, len, *ppp, rw, 0);
                } else {
                        ASSERT((*ppp)[npages] == PCACHE_SHWLIST ||
                            IS_SWAPFSVP((*ppp)[npages]->p_vnode));
                        len = lpgeaddr - lpgaddr;
                        npages = btop(len);
                        seg_pinactive(seg, pamp, paddr, len,
                            *ppp - adjustpages, rw, pflags, preclaim_callback);
                }

                if (pamp != NULL) {
                        ASSERT(svd->type == MAP_SHARED);
                        ASSERT(svd->softlockcnt >= npages);
                        atomic_add_long((ulong_t *)&svd->softlockcnt, -npages);
                }

                if (sftlck_sbase) {
                        ASSERT(svd->softlockcnt_sbase > 0);
                        atomic_dec_ulong((ulong_t *)&svd->softlockcnt_sbase);
                }
                if (sftlck_send) {
                        ASSERT(svd->softlockcnt_send > 0);
                        atomic_dec_ulong((ulong_t *)&svd->softlockcnt_send);
                }

                /*
                 * If someone is blocked while unmapping, we purge
                 * segment page cache and thus reclaim pplist synchronously
                 * without waiting for seg_pasync_thread. This speeds up
                 * unmapping in cases where munmap(2) is called, while
                 * raw async i/o is still in progress or where a thread
                 * exits on data fault in a multithreaded application.
                 */
                if (AS_ISUNMAPWAIT(seg->s_as)) {
                        if (svd->softlockcnt == 0) {
                                mutex_enter(&seg->s_as->a_contents);
                                if (AS_ISUNMAPWAIT(seg->s_as)) {
                                        AS_CLRUNMAPWAIT(seg->s_as);
                                        cv_broadcast(&seg->s_as->a_cv);
                                }
                                mutex_exit(&seg->s_as->a_contents);
                        } else if (pamp == NULL) {
                                /*
                                 * softlockcnt is not 0 and this is a
                                 * MAP_PRIVATE segment. Try to purge its
                                 * pcache entries to reduce softlockcnt.
                                 * If it drops to 0 segvn_reclaim()
                                 * will wake up a thread waiting on
                                 * unmapwait flag.
                                 *
                                 * We don't purge MAP_SHARED segments with non
                                 * 0 softlockcnt since IO is still in progress
                                 * for such segments.
                                 */
                                ASSERT(svd->type == MAP_PRIVATE);
                                segvn_purge(seg);
                        }
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        /* The L_PAGELOCK case ... */

        VM_STAT_ADD(segvnvmstats.pagelock[1]);

        /*
         * For MAP_SHARED segments we have to check protections before
         * seg_plookup() since pcache entries may be shared by many segments
         * with potentially different page protections.
         */
        if (pamp != NULL) {
                ASSERT(svd->type == MAP_SHARED);
                if (svd->pageprot == 0) {
                        if ((svd->prot & protchk) == 0) {
                                error = EACCES;
                                goto out;
                        }
                } else {
                        /*
                         * check page protections
                         */
                        caddr_t ea;

                        if (seg->s_szc) {
                                a = lpgaddr;
                                ea = lpgeaddr;
                        } else {
                                a = addr;
                                ea = addr + len;
                        }
                        for (; a < ea; a += pgsz) {
                                struct vpage *vp;

                                ASSERT(seg->s_szc == 0 ||
                                    sameprot(seg, a, pgsz));
                                vp = &svd->vpage[seg_page(seg, a)];
                                if ((VPP_PROT(vp) & protchk) == 0) {
                                        error = EACCES;
                                        goto out;
                                }
                        }
                }
        }

        /*
         * try to find pages in segment page cache
         */
        pplist = seg_plookup(seg, pamp, paddr, lpgeaddr - lpgaddr, rw, pflags);
        if (pplist != NULL) {
                if (pamp != NULL) {
                        npages = btop((uintptr_t)(lpgeaddr - lpgaddr));
                        ASSERT(svd->type == MAP_SHARED);
                        atomic_add_long((ulong_t *)&svd->softlockcnt,
                            npages);
                }
                if (sftlck_sbase) {
                        atomic_inc_ulong((ulong_t *)&svd->softlockcnt_sbase);
                }
                if (sftlck_send) {
                        atomic_inc_ulong((ulong_t *)&svd->softlockcnt_send);
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                *ppp = pplist + adjustpages;
                return (0);
        }

        /*
         * For MAP_SHARED segments we already verified above that segment
         * protections allow this pagelock operation.
         */
        if (pamp == NULL) {
                ASSERT(svd->type == MAP_PRIVATE);
                if (svd->pageprot == 0) {
                        if ((svd->prot & protchk) == 0) {
                                error = EACCES;
                                goto out;
                        }
                        if (svd->prot & PROT_WRITE) {
                                wlen = lpgeaddr - lpgaddr;
                        } else {
                                wlen = 0;
                                ASSERT(rw == S_READ);
                        }
                } else {
                        int wcont = 1;
                        /*
                         * check page protections
                         */
                        for (a = lpgaddr, wlen = 0; a < lpgeaddr; a += pgsz) {
                                struct vpage *vp;

                                ASSERT(seg->s_szc == 0 ||
                                    sameprot(seg, a, pgsz));
                                vp = &svd->vpage[seg_page(seg, a)];
                                if ((VPP_PROT(vp) & protchk) == 0) {
                                        error = EACCES;
                                        goto out;
                                }
                                if (wcont && (VPP_PROT(vp) & PROT_WRITE)) {
                                        wlen += pgsz;
                                } else {
                                        wcont = 0;
                                        ASSERT(rw == S_READ);
                                }
                        }
                }
                ASSERT(rw == S_READ || wlen == lpgeaddr - lpgaddr);
                ASSERT(rw == S_WRITE || wlen <= lpgeaddr - lpgaddr);
        }

        /*
         * Only build large page adjusted shadow list if we expect to insert
         * it into pcache. For large enough pages it's a big overhead to
         * create a shadow list of the entire large page. But this overhead
         * should be amortized over repeated pcache hits on subsequent reuse
         * of this shadow list (IO into any range within this shadow list will
         * find it in pcache since we large page align the request for pcache
         * lookups). pcache performance is improved with bigger shadow lists
         * as it reduces the time to pcache the entire big segment and reduces
         * pcache chain length.
         */
        if (seg_pinsert_check(seg, pamp, paddr,
            lpgeaddr - lpgaddr, pflags) == SEGP_SUCCESS) {
                addr = lpgaddr;
                len = lpgeaddr - lpgaddr;
                use_pcache = 1;
        } else {
                use_pcache = 0;
                /*
                 * Since this entry will not be inserted into the pcache, we
                 * will not do any adjustments to the starting address or
                 * size of the memory to be locked.
                 */
                adjustpages = 0;
        }
        npages = btop(len);

        pplist = kmem_alloc(sizeof (page_t *) * (npages + 1), KM_SLEEP);
        pl = pplist;
        *ppp = pplist + adjustpages;
        /*
         * If use_pcache is 0 this shadow list is not large page adjusted.
         * Record this info in the last entry of shadow array so that
         * L_PAGEUNLOCK can determine if it should large page adjust the
         * address range to find the real range that was locked.
         */
        pl[npages] = use_pcache ? PCACHE_SHWLIST : NOPCACHE_SHWLIST;

        page = seg_page(seg, addr);
        anon_index = svd->anon_index + page;

        anlock = 0;
        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
        ASSERT(amp->a_szc >= seg->s_szc);
        anpgcnt = page_get_pagecnt(amp->a_szc);
        for (a = addr; a < addr + len; a += PAGESIZE, anon_index++) {
                struct anon *ap;
                struct vnode *vp;
                uoff_t off;

                /*
                 * Lock and unlock anon array only once per large page.
                 * anon_array_enter() locks the root anon slot according to
                 * a_szc which can't change while anon map is locked.  We lock
                 * anon the first time through this loop and each time we
                 * reach anon index that corresponds to a root of a large
                 * page.
                 */
                if (a == addr || P2PHASE(anon_index, anpgcnt) == 0) {
                        ASSERT(anlock == 0);
                        anon_array_enter(amp, anon_index, &cookie);
                        anlock = 1;
                }
                ap = anon_get_ptr(amp->ahp, anon_index);

                /*
                 * We must never use seg_pcache for COW pages
                 * because we might end up with original page still
                 * lying in seg_pcache even after private page is
                 * created. This leads to data corruption as
                 * aio_write refers to the page still in cache
                 * while all other accesses refer to the private
                 * page.
                 */
                if (ap == NULL || ap->an_refcnt != 1) {
                        struct vpage *vpage;

                        if (seg->s_szc) {
                                error = EFAULT;
                                break;
                        }
                        if (svd->vpage != NULL) {
                                vpage = &svd->vpage[seg_page(seg, a)];
                        } else {
                                vpage = NULL;
                        }
                        ASSERT(anlock);
                        anon_array_exit(&cookie);
                        anlock = 0;
                        pp = NULL;
                        error = segvn_faultpage(seg->s_as->a_hat, seg, a, 0,
                            vpage, &pp, 0, F_INVAL, rw, 1);
                        if (error) {
                                error = fc_decode(error);
                                break;
                        }
                        anon_array_enter(amp, anon_index, &cookie);
                        anlock = 1;
                        ap = anon_get_ptr(amp->ahp, anon_index);
                        if (ap == NULL || ap->an_refcnt != 1) {
                                error = EFAULT;
                                break;
                        }
                }
                swap_xlate(ap, &vp, &off);
                pp = page_lookup_nowait(&vp->v_object, off, SE_SHARED);
                if (pp == NULL) {
                        error = EFAULT;
                        break;
                }
                if (ap->an_pvp != NULL) {
                        anon_swap_free(ap, pp);
                }
                /*
                 * Unlock anon if this is the last slot in a large page.
                 */
                if (P2PHASE(anon_index, anpgcnt) == anpgcnt - 1) {
                        ASSERT(anlock);
                        anon_array_exit(&cookie);
                        anlock = 0;
                }
                *pplist++ = pp;
        }
        if (anlock) {           /* Ensure the lock is dropped */
                anon_array_exit(&cookie);
        }
        ANON_LOCK_EXIT(&amp->a_rwlock);

        if (a >= addr + len) {
                atomic_add_long((ulong_t *)&svd->softlockcnt, npages);
                if (pamp != NULL) {
                        ASSERT(svd->type == MAP_SHARED);
                        atomic_add_long((ulong_t *)&pamp->a_softlockcnt,
                            npages);
                        wlen = len;
                }
                if (sftlck_sbase) {
                        atomic_inc_ulong((ulong_t *)&svd->softlockcnt_sbase);
                }
                if (sftlck_send) {
                        atomic_inc_ulong((ulong_t *)&svd->softlockcnt_send);
                }
                if (use_pcache) {
                        (void) seg_pinsert(seg, pamp, paddr, len, wlen, pl,
                            rw, pflags, preclaim_callback);
                }
                SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                return (0);
        }

        pplist = pl;
        np = ((uintptr_t)(a - addr)) >> PAGESHIFT;
        while (np > 0) {
                ASSERT(PAGE_LOCKED(*pplist));
                page_unlock(*pplist);
                np--;
                pplist++;
        }
        kmem_free(pl, sizeof (page_t *) * (npages + 1));
out:
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        *ppp = NULL;
        return (error);
}

/*
 * purge any cached pages in the I/O page cache
 */
static void
segvn_purge(struct seg *seg)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;

        /*
         * pcache is only used by pure anon segments.
         */
        if (svd->amp == NULL || svd->vp != NULL) {
                return;
        }

        /*
         * For MAP_SHARED segments non 0 segment's softlockcnt means
         * active IO is still in progress via this segment. So we only
         * purge MAP_SHARED segments when their softlockcnt is 0.
         */
        if (svd->type == MAP_PRIVATE) {
                if (svd->softlockcnt) {
                        seg_ppurge(seg, NULL, 0);
                }
        } else if (svd->softlockcnt == 0 && svd->amp->a_softlockcnt != 0) {
                seg_ppurge(seg, svd->amp, 0);
        }
}

/*
 * If async argument is not 0 we are called from pcache async thread and don't
 * hold AS lock.
 */

/*ARGSUSED*/
static int
segvn_reclaim(void *ptag, caddr_t addr, size_t len, struct page **pplist,
        enum seg_rw rw, int async)
{
        struct seg *seg = (struct seg *)ptag;
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        pgcnt_t np, npages;
        struct page **pl;

        npages = np = btop(len);
        ASSERT(npages);

        ASSERT(svd->vp == NULL && svd->amp != NULL);
        ASSERT(svd->softlockcnt >= npages);
        ASSERT(async || AS_LOCK_HELD(seg->s_as));

        pl = pplist;

        ASSERT(pl[np] == NOPCACHE_SHWLIST || pl[np] == PCACHE_SHWLIST);
        ASSERT(!async || pl[np] == PCACHE_SHWLIST);

        while (np > 0) {
                if (rw == S_WRITE) {
                        hat_setrefmod(*pplist);
                } else {
                        hat_setref(*pplist);
                }
                page_unlock(*pplist);
                np--;
                pplist++;
        }

        kmem_free(pl, sizeof (page_t *) * (npages + 1));

        /*
         * If we are pcache async thread we don't hold AS lock. This means if
         * softlockcnt drops to 0 after the decrement below address space may
         * get freed. We can't allow it since after softlock derement to 0 we
         * still need to access as structure for possible wakeup of unmap
         * waiters. To prevent the disappearance of as we take this segment
         * segfree_syncmtx. segvn_free() also takes this mutex as a barrier to
         * make sure this routine completes before segment is freed.
         *
         * The second complication we have to deal with in async case is a
         * possibility of missed wake up of unmap wait thread. When we don't
         * hold as lock here we may take a_contents lock before unmap wait
         * thread that was first to see softlockcnt was still not 0. As a
         * result we'll fail to wake up an unmap wait thread. To avoid this
         * race we set nounmapwait flag in as structure if we drop softlockcnt
         * to 0 when we were called by pcache async thread.  unmapwait thread
         * will not block if this flag is set.
         */
        if (async) {
                mutex_enter(&svd->segfree_syncmtx);
        }

        if (!atomic_add_long_nv((ulong_t *)&svd->softlockcnt, -npages)) {
                if (async || AS_ISUNMAPWAIT(seg->s_as)) {
                        mutex_enter(&seg->s_as->a_contents);
                        if (async) {
                                AS_SETNOUNMAPWAIT(seg->s_as);
                        }
                        if (AS_ISUNMAPWAIT(seg->s_as)) {
                                AS_CLRUNMAPWAIT(seg->s_as);
                                cv_broadcast(&seg->s_as->a_cv);
                        }
                        mutex_exit(&seg->s_as->a_contents);
                }
        }

        if (async) {
                mutex_exit(&svd->segfree_syncmtx);
        }
        return (0);
}

/*ARGSUSED*/
static int
shamp_reclaim(void *ptag, caddr_t addr, size_t len, struct page **pplist,
        enum seg_rw rw, int async)
{
        amp_t *amp = (amp_t *)ptag;
        pgcnt_t np, npages;
        struct page **pl;

        npages = np = btop(len);
        ASSERT(npages);
        ASSERT(amp->a_softlockcnt >= npages);

        pl = pplist;

        ASSERT(pl[np] == NOPCACHE_SHWLIST || pl[np] == PCACHE_SHWLIST);
        ASSERT(!async || pl[np] == PCACHE_SHWLIST);

        while (np > 0) {
                if (rw == S_WRITE) {
                        hat_setrefmod(*pplist);
                } else {
                        hat_setref(*pplist);
                }
                page_unlock(*pplist);
                np--;
                pplist++;
        }

        kmem_free(pl, sizeof (page_t *) * (npages + 1));

        /*
         * If somebody sleeps in anonmap_purge() wake them up if a_softlockcnt
         * drops to 0. anon map can't be freed until a_softlockcnt drops to 0
         * and anonmap_purge() acquires a_purgemtx.
         */
        mutex_enter(&amp->a_purgemtx);
        if (!atomic_add_long_nv((ulong_t *)&amp->a_softlockcnt, -npages) &&
            amp->a_purgewait) {
                amp->a_purgewait = 0;
                cv_broadcast(&amp->a_purgecv);
        }
        mutex_exit(&amp->a_purgemtx);
        return (0);
}

/*
 * get a memory ID for an addr in a given segment
 *
 * XXX only creates PAGESIZE pages if anon slots are not initialized.
 * At fault time they will be relocated into larger pages.
 */
static int
segvn_getmemid(struct seg *seg, caddr_t addr, memid_t *memidp)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct anon     *ap = NULL;
        ulong_t         anon_index;
        struct anon_map *amp;
        anon_sync_obj_t cookie;

        if (svd->type == MAP_PRIVATE) {
                memidp->val[0] = (uintptr_t)seg->s_as;
                memidp->val[1] = (uintptr_t)addr;
                return (0);
        }

        if (svd->type == MAP_SHARED) {
                if (svd->vp) {
                        memidp->val[0] = (uintptr_t)svd->vp;
                        memidp->val[1] = (u_longlong_t)svd->offset +
                            (uintptr_t)(addr - seg->s_base);
                        return (0);
                } else {

                        SEGVN_LOCK_ENTER(seg->s_as, &svd->lock, RW_READER);
                        if ((amp = svd->amp) != NULL) {
                                anon_index = svd->anon_index +
                                    seg_page(seg, addr);
                        }
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);

                        ASSERT(amp != NULL);

                        ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
                        anon_array_enter(amp, anon_index, &cookie);
                        ap = anon_get_ptr(amp->ahp, anon_index);
                        if (ap == NULL) {
                                page_t          *pp;

                                pp = anon_zero(seg, addr, &ap, svd->cred);
                                if (pp == NULL) {
                                        anon_array_exit(&cookie);
                                        ANON_LOCK_EXIT(&amp->a_rwlock);
                                        return (ENOMEM);
                                }
                                ASSERT(anon_get_ptr(amp->ahp, anon_index)
                                    == NULL);
                                (void) anon_set_ptr(amp->ahp, anon_index,
                                    ap, ANON_SLEEP);
                                page_unlock(pp);
                        }

                        anon_array_exit(&cookie);
                        ANON_LOCK_EXIT(&amp->a_rwlock);

                        memidp->val[0] = (uintptr_t)ap;
                        memidp->val[1] = (uintptr_t)addr & PAGEOFFSET;
                        return (0);
                }
        }
        return (EINVAL);
}

static int
sameprot(struct seg *seg, caddr_t a, size_t len)
{
        struct segvn_data *svd = (struct segvn_data *)seg->s_data;
        struct vpage *vpage;
        spgcnt_t pages = btop(len);
        uint_t prot;

        if (svd->pageprot == 0)
                return (1);

        ASSERT(svd->vpage != NULL);

        vpage = &svd->vpage[seg_page(seg, a)];
        prot = VPP_PROT(vpage);
        vpage++;
        pages--;
        while (pages-- > 0) {
                if (prot != VPP_PROT(vpage))
                        return (0);
                vpage++;
        }
        return (1);
}

/*
 * Get memory allocation policy info for specified address in given segment
 */
static lgrp_mem_policy_info_t *
segvn_getpolicy(struct seg *seg, caddr_t addr)
{
        struct anon_map         *amp;
        ulong_t                 anon_index;
        lgrp_mem_policy_info_t  *policy_info;
        struct segvn_data       *svn_data;
        uoff_t          vn_off;
        vnode_t                 *vp;

        ASSERT(seg != NULL);

        svn_data = (struct segvn_data *)seg->s_data;
        if (svn_data == NULL)
                return (NULL);

        /*
         * Get policy info for private or shared memory
         */
        if (svn_data->type != MAP_SHARED) {
                if (svn_data->tr_state != SEGVN_TR_ON) {
                        policy_info = &svn_data->policy_info;
                } else {
                        policy_info = &svn_data->tr_policy_info;
                        ASSERT(policy_info->mem_policy ==
                            LGRP_MEM_POLICY_NEXT_SEG);
                }
        } else {
                amp = svn_data->amp;
                anon_index = svn_data->anon_index + seg_page(seg, addr);
                vp = svn_data->vp;
                vn_off = svn_data->offset + (uintptr_t)(addr - seg->s_base);
                policy_info = lgrp_shm_policy_get(amp, anon_index, vp, vn_off);
        }

        return (policy_info);
}

/*
 * Bind text vnode segment to an amp. If we bind successfully mappings will be
 * established to per vnode mapping per lgroup amp pages instead of to vnode
 * pages. There's one amp per vnode text mapping per lgroup. Many processes
 * may share the same text replication amp. If a suitable amp doesn't already
 * exist in svntr hash table create a new one.  We may fail to bind to amp if
 * segment is not eligible for text replication.  Code below first checks for
 * these conditions. If binding is successful segment tr_state is set to on
 * and svd->amp points to the amp to use. Otherwise tr_state is set to off and
 * svd->amp remains as NULL.
 */
static void
segvn_textrepl(struct seg *seg)
{
        struct segvn_data       *svd = (struct segvn_data *)seg->s_data;
        vnode_t                 *vp = svd->vp;
        uoff_t          off = svd->offset;
        size_t                  size = seg->s_size;
        uoff_t          eoff = off + size;
        uint_t                  szc = seg->s_szc;
        ulong_t                 hash = SVNTR_HASH_FUNC(vp);
        svntr_t                 *svntrp;
        struct vattr            va;
        proc_t                  *p = seg->s_as->a_proc;
        lgrp_id_t               lgrp_id;
        lgrp_id_t               olid;
        int                     first;
        struct anon_map         *amp;

        ASSERT(AS_LOCK_HELD(seg->s_as));
        ASSERT(SEGVN_WRITE_HELD(seg->s_as, &svd->lock));
        ASSERT(p != NULL);
        ASSERT(svd->tr_state == SEGVN_TR_INIT);
        ASSERT(!HAT_IS_REGION_COOKIE_VALID(svd->rcookie));
        ASSERT(svd->flags & MAP_TEXT);
        ASSERT(svd->type == MAP_PRIVATE);
        ASSERT(vp != NULL && svd->amp == NULL);
        ASSERT(!svd->pageprot && !(svd->prot & PROT_WRITE));
        ASSERT(!(svd->flags & MAP_NORESERVE) && svd->swresv == 0);
        ASSERT(seg->s_as != &kas);
        ASSERT(off < eoff);
        ASSERT(svntr_hashtab != NULL);

        /*
         * If numa optimizations are no longer desired bail out.
         */
        if (!lgrp_optimizations()) {
                svd->tr_state = SEGVN_TR_OFF;
                return;
        }

        /*
         * Avoid creating anon maps with size bigger than the file size.
         * If fop_getattr() call fails bail out.
         */
        va.va_mask = AT_SIZE | AT_MTIME | AT_CTIME;
        if (fop_getattr(vp, &va, 0, svd->cred, NULL) != 0) {
                svd->tr_state = SEGVN_TR_OFF;
                SEGVN_TR_ADDSTAT(gaerr);
                return;
        }
        if (btopr(va.va_size) < btopr(eoff)) {
                svd->tr_state = SEGVN_TR_OFF;
                SEGVN_TR_ADDSTAT(overmap);
                return;
        }

        /*
         * VVMEXEC may not be set yet if exec() prefaults text segment. Set
         * this flag now before vn_is_mapped(V_WRITE) so that MAP_SHARED
         * mapping that checks if trcache for this vnode needs to be
         * invalidated can't miss us.
         */
        if (!(vp->v_flag & VVMEXEC)) {
                mutex_enter(&vp->v_lock);
                vp->v_flag |= VVMEXEC;
                mutex_exit(&vp->v_lock);
        }
        mutex_enter(&svntr_hashtab[hash].tr_lock);
        /*
         * Bail out if potentially MAP_SHARED writable mappings exist to this
         * vnode.  We don't want to use old file contents from existing
         * replicas if this mapping was established after the original file
         * was changed.
         */
        if (vn_is_mapped(vp, V_WRITE)) {
                mutex_exit(&svntr_hashtab[hash].tr_lock);
                svd->tr_state = SEGVN_TR_OFF;
                SEGVN_TR_ADDSTAT(wrcnt);
                return;
        }
        svntrp = svntr_hashtab[hash].tr_head;
        for (; svntrp != NULL; svntrp = svntrp->tr_next) {
                ASSERT(svntrp->tr_refcnt != 0);
                if (svntrp->tr_vp != vp) {
                        continue;
                }

                /*
                 * Bail out if the file or its attributes were changed after
                 * this replication entry was created since we need to use the
                 * latest file contents. Note that mtime test alone is not
                 * sufficient because a user can explicitly change mtime via
                 * utimes(2) interfaces back to the old value after modifiying
                 * the file contents. To detect this case we also have to test
                 * ctime which among other things records the time of the last
                 * mtime change by utimes(2). ctime is not changed when the file
                 * is only read or executed so we expect that typically existing
                 * replication amp's can be used most of the time.
                 */
                if (!svntrp->tr_valid ||
                    svntrp->tr_mtime.tv_sec != va.va_mtime.tv_sec ||
                    svntrp->tr_mtime.tv_nsec != va.va_mtime.tv_nsec ||
                    svntrp->tr_ctime.tv_sec != va.va_ctime.tv_sec ||
                    svntrp->tr_ctime.tv_nsec != va.va_ctime.tv_nsec) {
                        mutex_exit(&svntr_hashtab[hash].tr_lock);
                        svd->tr_state = SEGVN_TR_OFF;
                        SEGVN_TR_ADDSTAT(stale);
                        return;
                }
                /*
                 * if off, eoff and szc match current segment we found the
                 * existing entry we can use.
                 */
                if (svntrp->tr_off == off && svntrp->tr_eoff == eoff &&
                    svntrp->tr_szc == szc) {
                        break;
                }
                /*
                 * Don't create different but overlapping in file offsets
                 * entries to avoid replication of the same file pages more
                 * than once per lgroup.
                 */
                if ((off >= svntrp->tr_off && off < svntrp->tr_eoff) ||
                    (eoff > svntrp->tr_off && eoff <= svntrp->tr_eoff)) {
                        mutex_exit(&svntr_hashtab[hash].tr_lock);
                        svd->tr_state = SEGVN_TR_OFF;
                        SEGVN_TR_ADDSTAT(overlap);
                        return;
                }
        }
        /*
         * If we didn't find existing entry create a new one.
         */
        if (svntrp == NULL) {
                svntrp = kmem_cache_alloc(svntr_cache, KM_NOSLEEP);
                if (svntrp == NULL) {
                        mutex_exit(&svntr_hashtab[hash].tr_lock);
                        svd->tr_state = SEGVN_TR_OFF;
                        SEGVN_TR_ADDSTAT(nokmem);
                        return;
                }
#ifdef DEBUG
                {
                        lgrp_id_t i;
                        for (i = 0; i < NLGRPS_MAX; i++) {
                                ASSERT(svntrp->tr_amp[i] == NULL);
                        }
                }
#endif /* DEBUG */
                svntrp->tr_vp = vp;
                svntrp->tr_off = off;
                svntrp->tr_eoff = eoff;
                svntrp->tr_szc = szc;
                svntrp->tr_valid = 1;
                svntrp->tr_mtime = va.va_mtime;
                svntrp->tr_ctime = va.va_ctime;
                svntrp->tr_refcnt = 0;
                svntrp->tr_next = svntr_hashtab[hash].tr_head;
                svntr_hashtab[hash].tr_head = svntrp;
        }
        first = 1;
again:
        /*
         * We want to pick a replica with pages on main thread's (t_tid = 1,
         * aka T1) lgrp. Currently text replication is only optimized for
         * workloads that either have all threads of a process on the same
         * lgrp or execute their large text primarily on main thread.
         */
        lgrp_id = p->p_t1_lgrpid;
        if (lgrp_id == LGRP_NONE) {
                /*
                 * In case exec() prefaults text on non main thread use
                 * current thread lgrpid.  It will become main thread anyway
                 * soon.
                 */
                lgrp_id = lgrp_home_id(curthread);
        }
        /*
         * Set p_tr_lgrpid to lgrpid if it hasn't been set yet.  Otherwise
         * just set it to NLGRPS_MAX if it's different from current process T1
         * home lgrp.  p_tr_lgrpid is used to detect if process uses text
         * replication and T1 new home is different from lgrp used for text
         * replication. When this happens asyncronous segvn thread rechecks if
         * segments should change lgrps used for text replication.  If we fail
         * to set p_tr_lgrpid with atomic_cas_32 then set it to NLGRPS_MAX
         * without cas if it's not already NLGRPS_MAX and not equal lgrp_id
         * we want to use.  We don't need to use cas in this case because
         * another thread that races in between our non atomic check and set
         * may only change p_tr_lgrpid to NLGRPS_MAX at this point.
         */
        ASSERT(lgrp_id != LGRP_NONE && lgrp_id < NLGRPS_MAX);
        olid = p->p_tr_lgrpid;
        if (lgrp_id != olid && olid != NLGRPS_MAX) {
                lgrp_id_t nlid = (olid == LGRP_NONE) ? lgrp_id : NLGRPS_MAX;
                if (atomic_cas_32((uint32_t *)&p->p_tr_lgrpid, olid, nlid) !=
                    olid) {
                        olid = p->p_tr_lgrpid;
                        ASSERT(olid != LGRP_NONE);
                        if (olid != lgrp_id && olid != NLGRPS_MAX) {
                                p->p_tr_lgrpid = NLGRPS_MAX;
                        }
                }
                ASSERT(p->p_tr_lgrpid != LGRP_NONE);
                membar_producer();
                /*
                 * lgrp_move_thread() won't schedule async recheck after
                 * p->p_t1_lgrpid update unless p->p_tr_lgrpid is not
                 * LGRP_NONE. Recheck p_t1_lgrpid once now that p->p_tr_lgrpid
                 * is not LGRP_NONE.
                 */
                if (first && p->p_t1_lgrpid != LGRP_NONE &&
                    p->p_t1_lgrpid != lgrp_id) {
                        first = 0;
                        goto again;
                }
        }
        /*
         * If no amp was created yet for lgrp_id create a new one as long as
         * we have enough memory to afford it.
         */
        if ((amp = svntrp->tr_amp[lgrp_id]) == NULL) {
                size_t trmem = atomic_add_long_nv(&segvn_textrepl_bytes, size);
                if (trmem > segvn_textrepl_max_bytes) {
                        SEGVN_TR_ADDSTAT(normem);
                        goto fail;
                }
                if (anon_try_resv_zone(size, NULL) == 0) {
                        SEGVN_TR_ADDSTAT(noanon);
                        goto fail;
                }
                amp = anonmap_alloc(size, size, ANON_NOSLEEP);
                if (amp == NULL) {
                        anon_unresv_zone(size, NULL);
                        SEGVN_TR_ADDSTAT(nokmem);
                        goto fail;
                }
                ASSERT(amp->refcnt == 1);
                amp->a_szc = szc;
                svntrp->tr_amp[lgrp_id] = amp;
                SEGVN_TR_ADDSTAT(newamp);
        }
        svntrp->tr_refcnt++;
        ASSERT(svd->svn_trnext == NULL);
        ASSERT(svd->svn_trprev == NULL);
        svd->svn_trnext = svntrp->tr_svnhead;
        svd->svn_trprev = NULL;
        if (svntrp->tr_svnhead != NULL) {
                svntrp->tr_svnhead->svn_trprev = svd;
        }
        svntrp->tr_svnhead = svd;
        ASSERT(amp->a_szc == szc && amp->size == size && amp->swresv == size);
        ASSERT(amp->refcnt >= 1);
        svd->amp = amp;
        svd->anon_index = 0;
        svd->tr_policy_info.mem_policy = LGRP_MEM_POLICY_NEXT_SEG;
        svd->tr_policy_info.mem_lgrpid = lgrp_id;
        svd->tr_state = SEGVN_TR_ON;
        mutex_exit(&svntr_hashtab[hash].tr_lock);
        SEGVN_TR_ADDSTAT(repl);
        return;
fail:
        ASSERT(segvn_textrepl_bytes >= size);
        atomic_add_long(&segvn_textrepl_bytes, -size);
        ASSERT(svntrp != NULL);
        ASSERT(svntrp->tr_amp[lgrp_id] == NULL);
        if (svntrp->tr_refcnt == 0) {
                ASSERT(svntrp == svntr_hashtab[hash].tr_head);
                svntr_hashtab[hash].tr_head = svntrp->tr_next;
                mutex_exit(&svntr_hashtab[hash].tr_lock);
                kmem_cache_free(svntr_cache, svntrp);
        } else {
                mutex_exit(&svntr_hashtab[hash].tr_lock);
        }
        svd->tr_state = SEGVN_TR_OFF;
}

/*
 * Convert seg back to regular vnode mapping seg by unbinding it from its text
 * replication amp.  This routine is most typically called when segment is
 * unmapped but can also be called when segment no longer qualifies for text
 * replication (e.g. due to protection changes). If unload_unmap is set use
 * HAT_UNLOAD_UNMAP flag in hat_unload_callback().  If we are the last user of
 * svntr free all its anon maps and remove it from the hash table.
 */
static void
segvn_textunrepl(struct seg *seg, int unload_unmap)
{
        struct segvn_data       *svd = (struct segvn_data *)seg->s_data;
        vnode_t                 *vp = svd->vp;
        uoff_t          off = svd->offset;
        size_t                  size = seg->s_size;
        uoff_t          eoff = off + size;
        uint_t                  szc = seg->s_szc;
        ulong_t                 hash = SVNTR_HASH_FUNC(vp);
        svntr_t                 *svntrp;
        svntr_t                 **prv_svntrp;
        lgrp_id_t               lgrp_id = svd->tr_policy_info.mem_lgrpid;
        lgrp_id_t               i;

        ASSERT(AS_LOCK_HELD(seg->s_as));
        ASSERT(AS_WRITE_HELD(seg->s_as) ||
            SEGVN_WRITE_HELD(seg->s_as, &svd->lock));
        ASSERT(svd->tr_state == SEGVN_TR_ON);
        ASSERT(!HAT_IS_REGION_COOKIE_VALID(svd->rcookie));
        ASSERT(svd->amp != NULL);
        ASSERT(svd->amp->refcnt >= 1);
        ASSERT(svd->anon_index == 0);
        ASSERT(lgrp_id != LGRP_NONE && lgrp_id < NLGRPS_MAX);
        ASSERT(svntr_hashtab != NULL);

        mutex_enter(&svntr_hashtab[hash].tr_lock);
        prv_svntrp = &svntr_hashtab[hash].tr_head;
        for (; (svntrp = *prv_svntrp) != NULL; prv_svntrp = &svntrp->tr_next) {
                ASSERT(svntrp->tr_refcnt != 0);
                if (svntrp->tr_vp == vp && svntrp->tr_off == off &&
                    svntrp->tr_eoff == eoff && svntrp->tr_szc == szc) {
                        break;
                }
        }
        if (svntrp == NULL) {
                panic("segvn_textunrepl: svntr record not found");
        }
        if (svntrp->tr_amp[lgrp_id] != svd->amp) {
                panic("segvn_textunrepl: amp mismatch");
        }
        svd->tr_state = SEGVN_TR_OFF;
        svd->amp = NULL;
        if (svd->svn_trprev == NULL) {
                ASSERT(svntrp->tr_svnhead == svd);
                svntrp->tr_svnhead = svd->svn_trnext;
                if (svntrp->tr_svnhead != NULL) {
                        svntrp->tr_svnhead->svn_trprev = NULL;
                }
                svd->svn_trnext = NULL;
        } else {
                svd->svn_trprev->svn_trnext = svd->svn_trnext;
                if (svd->svn_trnext != NULL) {
                        svd->svn_trnext->svn_trprev = svd->svn_trprev;
                        svd->svn_trnext = NULL;
                }
                svd->svn_trprev = NULL;
        }
        if (--svntrp->tr_refcnt) {
                mutex_exit(&svntr_hashtab[hash].tr_lock);
                goto done;
        }
        *prv_svntrp = svntrp->tr_next;
        mutex_exit(&svntr_hashtab[hash].tr_lock);
        for (i = 0; i < NLGRPS_MAX; i++) {
                struct anon_map *amp = svntrp->tr_amp[i];
                if (amp == NULL) {
                        continue;
                }
                ASSERT(amp->refcnt == 1);
                ASSERT(amp->swresv == size);
                ASSERT(amp->size == size);
                ASSERT(amp->a_szc == szc);
                if (amp->a_szc != 0) {
                        anon_free_pages(amp->ahp, 0, size, szc);
                } else {
                        anon_free(amp->ahp, 0, size);
                }
                svntrp->tr_amp[i] = NULL;
                ASSERT(segvn_textrepl_bytes >= size);
                atomic_add_long(&segvn_textrepl_bytes, -size);
                anon_unresv_zone(amp->swresv, NULL);
                amp->refcnt = 0;
                anonmap_free(amp);
        }
        kmem_cache_free(svntr_cache, svntrp);
done:
        hat_unload_callback(seg->s_as->a_hat, seg->s_base, size,
            unload_unmap ? HAT_UNLOAD_UNMAP : 0, NULL);
}

/*
 * This is called when a MAP_SHARED writable mapping is created to a vnode
 * that is currently used for execution (VVMEXEC flag is set). In this case we
 * need to prevent further use of existing replicas.
 */
static void
segvn_inval_trcache(vnode_t *vp)
{
        ulong_t                 hash = SVNTR_HASH_FUNC(vp);
        svntr_t                 *svntrp;

        ASSERT(vp->v_flag & VVMEXEC);

        if (svntr_hashtab == NULL) {
                return;
        }

        mutex_enter(&svntr_hashtab[hash].tr_lock);
        svntrp = svntr_hashtab[hash].tr_head;
        for (; svntrp != NULL; svntrp = svntrp->tr_next) {
                ASSERT(svntrp->tr_refcnt != 0);
                if (svntrp->tr_vp == vp && svntrp->tr_valid) {
                        svntrp->tr_valid = 0;
                }
        }
        mutex_exit(&svntr_hashtab[hash].tr_lock);
}

static void
segvn_trasync_thread(void)
{
        callb_cpr_t cpr_info;
        kmutex_t cpr_lock;      /* just for CPR stuff */

        mutex_init(&cpr_lock, NULL, MUTEX_DEFAULT, NULL);

        CALLB_CPR_INIT(&cpr_info, &cpr_lock,
            callb_generic_cpr, "segvn_async");

        if (segvn_update_textrepl_interval == 0) {
                segvn_update_textrepl_interval = segvn_update_tr_time * hz;
        } else {
                segvn_update_textrepl_interval *= hz;
        }
        (void) timeout(segvn_trupdate_wakeup, NULL,
            segvn_update_textrepl_interval);

        for (;;) {
                mutex_enter(&cpr_lock);
                CALLB_CPR_SAFE_BEGIN(&cpr_info);
                mutex_exit(&cpr_lock);
                sema_p(&segvn_trasync_sem);
                mutex_enter(&cpr_lock);
                CALLB_CPR_SAFE_END(&cpr_info, &cpr_lock);
                mutex_exit(&cpr_lock);
                segvn_trupdate();
        }
}

static uint64_t segvn_lgrp_trthr_migrs_snpsht = 0;

static void
segvn_trupdate_wakeup(void *dummy)
{
        uint64_t cur_lgrp_trthr_migrs = lgrp_get_trthr_migrations();

        if (cur_lgrp_trthr_migrs != segvn_lgrp_trthr_migrs_snpsht) {
                segvn_lgrp_trthr_migrs_snpsht = cur_lgrp_trthr_migrs;
                sema_v(&segvn_trasync_sem);
        }

        if (!segvn_disable_textrepl_update &&
            segvn_update_textrepl_interval != 0) {
                (void) timeout(segvn_trupdate_wakeup, dummy,
                    segvn_update_textrepl_interval);
        }
}

static void
segvn_trupdate(void)
{
        ulong_t         hash;
        svntr_t         *svntrp;
        segvn_data_t    *svd;

        ASSERT(svntr_hashtab != NULL);

        for (hash = 0; hash < svntr_hashtab_sz; hash++) {
                mutex_enter(&svntr_hashtab[hash].tr_lock);
                svntrp = svntr_hashtab[hash].tr_head;
                for (; svntrp != NULL; svntrp = svntrp->tr_next) {
                        ASSERT(svntrp->tr_refcnt != 0);
                        svd = svntrp->tr_svnhead;
                        for (; svd != NULL; svd = svd->svn_trnext) {
                                segvn_trupdate_seg(svd->seg, svd, svntrp,
                                    hash);
                        }
                }
                mutex_exit(&svntr_hashtab[hash].tr_lock);
        }
}

static void
segvn_trupdate_seg(struct seg *seg,
        segvn_data_t *svd,
        svntr_t *svntrp,
        ulong_t hash)
{
        proc_t                  *p;
        lgrp_id_t               lgrp_id;
        struct as               *as;
        size_t                  size;
        struct anon_map         *amp;

        ASSERT(svd->vp != NULL);
        ASSERT(svd->vp == svntrp->tr_vp);
        ASSERT(svd->offset == svntrp->tr_off);
        ASSERT(svd->offset + seg->s_size == svntrp->tr_eoff);
        ASSERT(seg != NULL);
        ASSERT(svd->seg == seg);
        ASSERT(seg->s_data == (void *)svd);
        ASSERT(seg->s_szc == svntrp->tr_szc);
        ASSERT(svd->tr_state == SEGVN_TR_ON);
        ASSERT(!HAT_IS_REGION_COOKIE_VALID(svd->rcookie));
        ASSERT(svd->amp != NULL);
        ASSERT(svd->tr_policy_info.mem_policy == LGRP_MEM_POLICY_NEXT_SEG);
        ASSERT(svd->tr_policy_info.mem_lgrpid != LGRP_NONE);
        ASSERT(svd->tr_policy_info.mem_lgrpid < NLGRPS_MAX);
        ASSERT(svntrp->tr_amp[svd->tr_policy_info.mem_lgrpid] == svd->amp);
        ASSERT(svntrp->tr_refcnt != 0);
        ASSERT(mutex_owned(&svntr_hashtab[hash].tr_lock));

        as = seg->s_as;
        ASSERT(as != NULL && as != &kas);
        p = as->a_proc;
        ASSERT(p != NULL);
        ASSERT(p->p_tr_lgrpid != LGRP_NONE);
        lgrp_id = p->p_t1_lgrpid;
        if (lgrp_id == LGRP_NONE) {
                return;
        }
        ASSERT(lgrp_id < NLGRPS_MAX);
        if (svd->tr_policy_info.mem_lgrpid == lgrp_id) {
                return;
        }

        /*
         * Use tryenter locking since we are locking as/seg and svntr hash
         * lock in reverse from syncrounous thread order.
         */
        if (!AS_LOCK_TRYENTER(as, RW_READER)) {
                SEGVN_TR_ADDSTAT(nolock);
                if (segvn_lgrp_trthr_migrs_snpsht) {
                        segvn_lgrp_trthr_migrs_snpsht = 0;
                }
                return;
        }
        if (!SEGVN_LOCK_TRYENTER(seg->s_as, &svd->lock, RW_WRITER)) {
                AS_LOCK_EXIT(as);
                SEGVN_TR_ADDSTAT(nolock);
                if (segvn_lgrp_trthr_migrs_snpsht) {
                        segvn_lgrp_trthr_migrs_snpsht = 0;
                }
                return;
        }
        size = seg->s_size;
        if (svntrp->tr_amp[lgrp_id] == NULL) {
                size_t trmem = atomic_add_long_nv(&segvn_textrepl_bytes, size);
                if (trmem > segvn_textrepl_max_bytes) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        AS_LOCK_EXIT(as);
                        atomic_add_long(&segvn_textrepl_bytes, -size);
                        SEGVN_TR_ADDSTAT(normem);
                        return;
                }
                if (anon_try_resv_zone(size, NULL) == 0) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        AS_LOCK_EXIT(as);
                        atomic_add_long(&segvn_textrepl_bytes, -size);
                        SEGVN_TR_ADDSTAT(noanon);
                        return;
                }
                amp = anonmap_alloc(size, size, KM_NOSLEEP);
                if (amp == NULL) {
                        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
                        AS_LOCK_EXIT(as);
                        atomic_add_long(&segvn_textrepl_bytes, -size);
                        anon_unresv_zone(size, NULL);
                        SEGVN_TR_ADDSTAT(nokmem);
                        return;
                }
                ASSERT(amp->refcnt == 1);
                amp->a_szc = seg->s_szc;
                svntrp->tr_amp[lgrp_id] = amp;
        }
        /*
         * We don't need to drop the bucket lock but here we give other
         * threads a chance.  svntr and svd can't be unlinked as long as
         * segment lock is held as a writer and AS held as well.  After we
         * retake bucket lock we'll continue from where we left. We'll be able
         * to reach the end of either list since new entries are always added
         * to the beginning of the lists.
         */
        mutex_exit(&svntr_hashtab[hash].tr_lock);
        hat_unload_callback(as->a_hat, seg->s_base, size, 0, NULL);
        mutex_enter(&svntr_hashtab[hash].tr_lock);

        ASSERT(svd->tr_state == SEGVN_TR_ON);
        ASSERT(svd->amp != NULL);
        ASSERT(svd->tr_policy_info.mem_policy == LGRP_MEM_POLICY_NEXT_SEG);
        ASSERT(svd->tr_policy_info.mem_lgrpid != lgrp_id);
        ASSERT(svd->amp != svntrp->tr_amp[lgrp_id]);

        svd->tr_policy_info.mem_lgrpid = lgrp_id;
        svd->amp = svntrp->tr_amp[lgrp_id];
        p->p_tr_lgrpid = NLGRPS_MAX;
        SEGVN_LOCK_EXIT(seg->s_as, &svd->lock);
        AS_LOCK_EXIT(as);

        ASSERT(svntrp->tr_refcnt != 0);
        ASSERT(svd->vp == svntrp->tr_vp);
        ASSERT(svd->tr_policy_info.mem_lgrpid == lgrp_id);
        ASSERT(svd->amp != NULL && svd->amp == svntrp->tr_amp[lgrp_id]);
        ASSERT(svd->seg == seg);
        ASSERT(svd->tr_state == SEGVN_TR_ON);

        SEGVN_TR_ADDSTAT(asyncrepl);
}