Home | History | Annotate | Line # | Download | only in ibm4xx
      1 /*	$NetBSD: pmap.c,v 1.112 2026/06/17 15:08:54 rkujawa Exp $	*/
      2 
      3 /*
      4  * Copyright 2001 Wasabi Systems, Inc.
      5  * All rights reserved.
      6  *
      7  * Written by Eduardo Horvath and Simon Burge for Wasabi Systems, Inc.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. All advertising materials mentioning features or use of this software
     18  *    must display the following acknowledgement:
     19  *      This product includes software developed for the NetBSD Project by
     20  *      Wasabi Systems, Inc.
     21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
     22  *    or promote products derived from this software without specific prior
     23  *    written permission.
     24  *
     25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
     26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
     29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     35  * POSSIBILITY OF SUCH DAMAGE.
     36  */
     37 
     38 /*
     39  * Copyright (C) 1995, 1996 Wolfgang Solfrank.
     40  * Copyright (C) 1995, 1996 TooLs GmbH.
     41  * All rights reserved.
     42  *
     43  * Redistribution and use in source and binary forms, with or without
     44  * modification, are permitted provided that the following conditions
     45  * are met:
     46  * 1. Redistributions of source code must retain the above copyright
     47  *    notice, this list of conditions and the following disclaimer.
     48  * 2. Redistributions in binary form must reproduce the above copyright
     49  *    notice, this list of conditions and the following disclaimer in the
     50  *    documentation and/or other materials provided with the distribution.
     51  * 3. All advertising materials mentioning features or use of this software
     52  *    must display the following acknowledgement:
     53  *	This product includes software developed by TooLs GmbH.
     54  * 4. The name of TooLs GmbH may not be used to endorse or promote products
     55  *    derived from this software without specific prior written permission.
     56  *
     57  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
     58  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     59  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     60  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     61  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
     62  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
     63  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
     64  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
     65  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
     66  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     67  */
     68 
     69 #include <sys/cdefs.h>
     70 __KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.112 2026/06/17 15:08:54 rkujawa Exp $");
     71 
     72 #ifdef _KERNEL_OPT
     73 #include "opt_ddb.h"
     74 #include "opt_pmap.h"
     75 #include "opt_ppcarch.h"
     76 #endif
     77 
     78 #include <sys/param.h>
     79 #include <sys/cpu.h>
     80 #include <sys/device.h>
     81 #include <sys/kmem.h>
     82 #include <sys/pool.h>
     83 #include <sys/proc.h>
     84 #include <sys/queue.h>
     85 #include <sys/systm.h>
     86 
     87 #include <uvm/uvm.h>
     88 
     89 #include <machine/powerpc.h>
     90 
     91 #include <powerpc/pcb.h>
     92 
     93 #include <powerpc/spr.h>
     94 #include <powerpc/ibm4xx/spr.h>
     95 
     96 #include <powerpc/ibm4xx/cpu.h>
     97 #include <powerpc/ibm4xx/tlb.h>
     98 
     99 /*
    100  * kernmap is an array of PTEs large enough to map in
    101  * 4GB.  At 16KB/page it is 256K entries or 2MB.
    102  */
    103 #define KERNMAP_SIZE	((0xffffffffU / PAGE_SIZE) + 1)
    104 void *kernmap;
    105 
    106 #define MINCTX		2
    107 #define NUMCTX		256
    108 
    109 volatile struct pmap *ctxbusy[NUMCTX];
    110 
    111 #define TLBF_USED	0x1
    112 #define	TLBF_REF	0x2
    113 #define	TLBF_LOCKED	0x4
    114 #define	TLB_LOCKED(i)	(tlb_info[(i)].ti_flags & TLBF_LOCKED)
    115 
    116 typedef struct tlb_info_s {
    117 	char	ti_flags;
    118 	char	ti_ctx;		/* TLB_PID assiciated with the entry */
    119 	u_int	ti_va;
    120 } tlb_info_t;
    121 
    122 volatile tlb_info_t tlb_info[NTLB];
    123 /* We'll use a modified FIFO replacement policy cause it's cheap */
    124 volatile int tlbnext;
    125 
    126 static int tlb_nreserved = 0;
    127 static int pmap_bootstrap_done = 0;
    128 
    129 /* Event counters */
    130 struct evcnt tlbmiss_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
    131     NULL, "cpu", "tlbmiss");
    132 struct evcnt tlbflush_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
    133     NULL, "cpu", "tlbflush");
    134 struct evcnt tlbenter_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
    135     NULL, "cpu", "tlbenter");
    136 EVCNT_ATTACH_STATIC(tlbmiss_ev);
    137 EVCNT_ATTACH_STATIC(tlbflush_ev);
    138 EVCNT_ATTACH_STATIC(tlbenter_ev);
    139 
    140 struct pmap kernel_pmap_;
    141 struct pmap *const kernel_pmap_ptr = &kernel_pmap_;
    142 
    143 static int npgs;
    144 static u_int nextavail;
    145 #ifndef MSGBUFADDR
    146 extern paddr_t msgbuf_paddr;
    147 #endif
    148 
    149 static struct mem_region *mem, *avail;
    150 
    151 /*
    152  * This is a cache of referenced/modified bits.
    153  * Bits herein are shifted by ATTRSHFT.
    154  */
    155 static char *pmap_attrib;
    156 
    157 #define PV_WIRED	0x1
    158 #define PV_WIRE(pv)	((pv)->pv_va |= PV_WIRED)
    159 #define PV_UNWIRE(pv)	((pv)->pv_va &= ~PV_WIRED)
    160 #define PV_ISWIRED(pv)	((pv)->pv_va & PV_WIRED)
    161 #define PV_VA(pv)	((pv)->pv_va & ~PV_WIRED)
    162 #define PV_CMPVA(va,pv)	(!(PV_VA(pv) ^ (va)))
    163 
    164 struct pv_entry {
    165 	struct pv_entry *pv_next;	/* Linked list of mappings */
    166 	struct pmap *pv_pm;
    167 	vaddr_t pv_va;			/* virtual address of mapping */
    168 };
    169 
    170 /* Each index corresponds to TLB_SIZE_* value. */
    171 static size_t tlbsize[] = {
    172 	1024, 		/* TLB_SIZE_1K */
    173 	4096, 		/* TLB_SIZE_4K */
    174 	16384, 		/* TLB_SIZE_16K */
    175 	65536, 		/* TLB_SIZE_64K */
    176 	262144, 	/* TLB_SIZE_256K */
    177 	1048576, 	/* TLB_SIZE_1M */
    178 #ifdef PPC_IBM440
    179 	0,		/* encoding 6 unused on 440 (no 4M page size) */
    180 #else
    181 	4194304, 	/* TLB_SIZE_4M */
    182 #endif
    183 	16777216, 	/* TLB_SIZE_16M */
    184 };
    185 
    186 #ifdef PPC_IBM440
    187 static struct tlb44_resv {
    188 	uint64_t tr_pa;		/* 36-bit physical address */
    189 	vaddr_t	 tr_va;
    190 	psize_t	 tr_size;
    191 } tlb44_resv[NTLB];
    192 #endif
    193 
    194 struct pv_entry *pv_table;
    195 static struct pool pv_pool;
    196 
    197 static int pmap_initialized;
    198 
    199 static void ctx_flush(int);
    200 
    201 struct pv_entry *pa_to_pv(paddr_t);
    202 static inline char *pa_to_attr(paddr_t);
    203 
    204 static inline volatile u_int *pte_find(struct pmap *, vaddr_t);
    205 static inline int pte_enter(struct pmap *, vaddr_t, u_int);
    206 
    207 static inline int pmap_enter_pv(struct pmap *, vaddr_t, paddr_t, int);
    208 static void pmap_remove_pv(struct pmap *, vaddr_t, paddr_t);
    209 
    210 static inline void tlb_invalidate_entry(int);
    211 
    212 #ifndef PPC_IBM440
    213 static int ppc4xx_tlb_size_mask(size_t, int *, int *);
    214 #endif
    215 
    216 
    217 struct pv_entry *
    218 pa_to_pv(paddr_t pa)
    219 {
    220 	uvm_physseg_t bank;
    221 	psize_t pg;
    222 
    223 	bank = uvm_physseg_find(atop(pa), &pg);
    224 	if (bank == UVM_PHYSSEG_TYPE_INVALID)
    225 		return NULL;
    226 	return &uvm_physseg_get_pmseg(bank)->pvent[pg];
    227 }
    228 
    229 static inline char *
    230 pa_to_attr(paddr_t pa)
    231 {
    232 	uvm_physseg_t bank;
    233 	psize_t pg;
    234 
    235 	bank = uvm_physseg_find(atop(pa), &pg);
    236 	if (bank == UVM_PHYSSEG_TYPE_INVALID)
    237 		return NULL;
    238 	return &uvm_physseg_get_pmseg(bank)->attrs[pg];
    239 }
    240 
    241 /*
    242  * Insert PTE into page table.
    243  */
    244 static inline int
    245 pte_enter(struct pmap *pm, vaddr_t va, u_int pte)
    246 {
    247 	int seg = STIDX(va), ptn = PTIDX(va);
    248 	u_int oldpte;
    249 
    250 	if (!pm->pm_ptbl[seg]) {
    251 		/* Don't allocate a page to clear a non-existent mapping. */
    252 		if (!pte)
    253 			return 0;
    254 
    255 		vaddr_t km = uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
    256 		    UVM_KMF_WIRED | UVM_KMF_ZERO | UVM_KMF_NOWAIT);
    257 
    258 		if (__predict_false(km == 0))
    259 			return ENOMEM;
    260 
    261 		pm->pm_ptbl[seg] = (u_int *)km;
    262 	}
    263 	oldpte = pm->pm_ptbl[seg][ptn];
    264 	pm->pm_ptbl[seg][ptn] = pte;
    265 
    266 	/* Flush entry. */
    267 	ppc4xx_tlb_flush(va, pm->pm_ctx);
    268 	if (oldpte != pte) {
    269 		if (pte == 0)
    270 			pm->pm_stats.resident_count--;
    271 		else
    272 			pm->pm_stats.resident_count++;
    273 	}
    274 	return 0;
    275 }
    276 
    277 /*
    278  * Get a pointer to a PTE in a page table.
    279  */
    280 volatile u_int *
    281 pte_find(struct pmap *pm, vaddr_t va)
    282 {
    283 	int seg = STIDX(va), ptn = PTIDX(va);
    284 
    285 	if (pm->pm_ptbl[seg])
    286 		return &pm->pm_ptbl[seg][ptn];
    287 
    288 	return NULL;
    289 }
    290 
    291 /*
    292  * This is called during initppc, before the system is really initialized.
    293  */
    294 void
    295 pmap_bootstrap(u_int kernelstart, u_int kernelend)
    296 {
    297 	struct mem_region *mp, *mp1;
    298 	int cnt, i;
    299 	u_int s, e, sz;
    300 
    301 	tlbnext = tlb_nreserved;
    302 
    303 	/*
    304 	 * Allocate the kernel page table at the end of
    305 	 * kernel space so it's in the locked TTE.
    306 	 */
    307 	kernmap = (void *)kernelend;
    308 
    309 	/*
    310 	 * Initialize kernel page table.
    311 	 */
    312 	for (i = 0; i < STSZ; i++)
    313 		pmap_kernel()->pm_ptbl[i] = NULL;
    314 	ctxbusy[0] = ctxbusy[1] = pmap_kernel();
    315 
    316 	/*
    317 	 * Announce page-size to the VM-system
    318 	 */
    319 	uvmexp.pagesize = NBPG;
    320 	uvm_md_init();
    321 
    322 	/*
    323 	 * Get memory.
    324 	 */
    325 	mem_regions(&mem, &avail);
    326 	for (mp = mem; mp->size; mp++) {
    327 		physmem += btoc(mp->size);
    328 		printf("+%lx,", mp->size);
    329 	}
    330 	printf("\n");
    331 	ppc4xx_tlb_init();
    332 	/*
    333 	 * Count the number of available entries.
    334 	 */
    335 	for (cnt = 0, mp = avail; mp->size; mp++)
    336 		cnt++;
    337 
    338 	/*
    339 	 * Page align all regions.
    340 	 * Non-page aligned memory isn't very interesting to us.
    341 	 * Also, sort the entries for ascending addresses.
    342 	 */
    343 	kernelstart &= ~PGOFSET;
    344 	kernelend = (kernelend + PGOFSET) & ~PGOFSET;
    345 	for (mp = avail; mp->size; mp++) {
    346 		s = mp->start;
    347 		e = mp->start + mp->size;
    348 		printf("%08x-%08x -> ", s, e);
    349 		/*
    350 		 * Check whether this region holds all of the kernel.
    351 		 */
    352 		if (s < kernelstart && e > kernelend) {
    353 			avail[cnt].start = kernelend;
    354 			avail[cnt++].size = e - kernelend;
    355 			e = kernelstart;
    356 		}
    357 		/*
    358 		 * Look whether this regions starts within the kernel.
    359 		 */
    360 		if (s >= kernelstart && s < kernelend) {
    361 			if (e <= kernelend)
    362 				goto empty;
    363 			s = kernelend;
    364 		}
    365 		/*
    366 		 * Now look whether this region ends within the kernel.
    367 		 */
    368 		if (e > kernelstart && e <= kernelend) {
    369 			if (s >= kernelstart)
    370 				goto empty;
    371 			e = kernelstart;
    372 		}
    373 		/*
    374 		 * Now page align the start and size of the region.
    375 		 */
    376 		s = round_page(s);
    377 		e = trunc_page(e);
    378 		if (e < s)
    379 			e = s;
    380 		sz = e - s;
    381 		printf("%08x-%08x = %x\n", s, e, sz);
    382 		/*
    383 		 * Check whether some memory is left here.
    384 		 */
    385 		if (sz == 0) {
    386  empty:
    387 			memmove(mp, mp + 1,
    388 			    (cnt - (mp - avail)) * sizeof(*mp));
    389 			cnt--;
    390 			mp--;
    391 			continue;
    392 		}
    393 		/*
    394 		 * Do an insertion sort.
    395 		 */
    396 		npgs += btoc(sz);
    397 		for (mp1 = avail; mp1 < mp; mp1++)
    398 			if (s < mp1->start)
    399 				break;
    400 		if (mp1 < mp) {
    401 			memmove(mp1 + 1, mp1, (char *)mp - (char *)mp1);
    402 			mp1->start = s;
    403 			mp1->size = sz;
    404 		} else {
    405 			mp->start = s;
    406 			mp->size = sz;
    407 		}
    408 	}
    409 
    410 	/*
    411 	 * We cannot do pmap_steal_memory here,
    412 	 * since we don't run with translation enabled yet.
    413 	 */
    414 #ifndef MSGBUFADDR
    415 	/*
    416 	 * allow for msgbuf
    417 	 */
    418 	sz = round_page(MSGBUFSIZE);
    419 	mp = NULL;
    420 	for (mp1 = avail; mp1->size; mp1++)
    421 		if (mp1->size >= sz)
    422 			mp = mp1;
    423 	if (mp == NULL)
    424 		panic("not enough memory?");
    425 
    426 	npgs -= btoc(sz);
    427 	msgbuf_paddr = mp->start + mp->size - sz;
    428 	mp->size -= sz;
    429 	if (mp->size <= 0)
    430 		memmove(mp, mp + 1, (cnt - (mp - avail)) * sizeof(*mp));
    431 #endif
    432 
    433 	for (mp = avail; mp->size; mp++)
    434 		uvm_page_physload(atop(mp->start), atop(mp->start + mp->size),
    435 		    atop(mp->start), atop(mp->start + mp->size),
    436 		    VM_FREELIST_DEFAULT);
    437 
    438 	/*
    439 	 * Initialize kernel pmap and hardware.
    440 	 */
    441 	/* Setup TLB pid allocator so it knows we alreadu using PID 1 */
    442 	pmap_kernel()->pm_ctx = KERNEL_PID;
    443 	nextavail = avail->start;
    444 
    445 	pmap_bootstrap_done = 1;
    446 }
    447 
    448 /*
    449  * Restrict given range to physical memory
    450  *
    451  * (Used by /dev/mem)
    452  */
    453 void
    454 pmap_real_memory(paddr_t *start, psize_t *size)
    455 {
    456 	struct mem_region *mp;
    457 
    458 	for (mp = mem; mp->size; mp++) {
    459 		if (*start + *size > mp->start &&
    460 		    *start < mp->start + mp->size) {
    461 			if (*start < mp->start) {
    462 				*size -= mp->start - *start;
    463 				*start = mp->start;
    464 			}
    465 			if (*start + *size > mp->start + mp->size)
    466 				*size = mp->start + mp->size - *start;
    467 			return;
    468 		}
    469 	}
    470 	*size = 0;
    471 }
    472 
    473 /*
    474  * Initialize anything else for pmap handling.
    475  * Called during vm_init().
    476  */
    477 void
    478 pmap_init(void)
    479 {
    480 	struct pv_entry *pv;
    481 	vsize_t sz;
    482 	vaddr_t addr;
    483 	int bank, i, s;
    484 	char *attr;
    485 
    486 	sz = (vsize_t)((sizeof(struct pv_entry) + 1) * npgs);
    487 	sz = round_page(sz);
    488 	addr = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED | UVM_KMF_ZERO);
    489 
    490 	s = splvm();
    491 
    492 	pv = pv_table = (struct pv_entry *)addr;
    493 	for (i = npgs; --i >= 0;)
    494 		pv++->pv_pm = NULL;
    495 	pmap_attrib = (char *)pv;
    496 	memset(pv, 0, npgs);
    497 
    498 	pv = pv_table;
    499 	attr = pmap_attrib;
    500 	for (bank = uvm_physseg_get_first(); uvm_physseg_valid_p(bank);
    501 	     bank = uvm_physseg_get_next(bank)) {
    502 		sz = uvm_physseg_get_end(bank) - uvm_physseg_get_start(bank);
    503 		uvm_physseg_get_pmseg(bank)->pvent = pv;
    504 		uvm_physseg_get_pmseg(bank)->attrs = attr;
    505 		pv += sz;
    506 		attr += sz;
    507 	}
    508 
    509 	pmap_initialized = 1;
    510 
    511 	splx(s);
    512 
    513 	/* Setup a pool for additional pvlist structures */
    514 	pool_init(&pv_pool, sizeof(struct pv_entry), 0, 0, 0, "pv_entry",
    515 	    NULL, IPL_VM);
    516 }
    517 
    518 /*
    519  * How much virtual space is available to the kernel?
    520  */
    521 void
    522 pmap_virtual_space(vaddr_t *start, vaddr_t *end)
    523 {
    524 
    525 	*start = (vaddr_t) VM_MIN_KERNEL_ADDRESS;
    526 	*end = (vaddr_t) VM_MAX_KERNEL_ADDRESS;
    527 }
    528 
    529 #ifdef PMAP_GROWKERNEL
    530 /*
    531  * Preallocate kernel page tables to a specified VA.
    532  * This simply loops through the first TTE for each
    533  * page table from the beginning of the kernel pmap,
    534  * reads the entry, and if the result is
    535  * zero (either invalid entry or no page table) it stores
    536  * a zero there, populating page tables in the process.
    537  * This is not the most efficient technique but i don't
    538  * expect it to be called that often.
    539  */
    540 extern struct vm_page *vm_page_alloc1(void);
    541 extern void vm_page_free1(struct vm_page *);
    542 
    543 vaddr_t kbreak = VM_MIN_KERNEL_ADDRESS;
    544 
    545 vaddr_t
    546 pmap_growkernel(vaddr_t maxkvaddr)
    547 {
    548 	struct pmap *pm = pmap_kernel();
    549 	paddr_t pg;
    550 	int seg, s;
    551 
    552 	s = splvm();
    553 
    554 	/* Align with the start of a page table */
    555 	for (kbreak &= ~(PTMAP - 1); kbreak < maxkvaddr; kbreak += PTMAP) {
    556 		seg = STIDX(kbreak);
    557 
    558 		if (pte_find(pm, kbreak))
    559 			continue;
    560 
    561 		if (uvm.page_init_done)
    562 			pg = (paddr_t)VM_PAGE_TO_PHYS(vm_page_alloc1());
    563 		else if (!uvm_page_physget(&pg))
    564 			panic("pmap_growkernel: no memory");
    565 		if (!pg)
    566 			panic("pmap_growkernel: no pages");
    567 		pmap_zero_page((paddr_t)pg);
    568 
    569 		/* XXX This is based on all phymem being addressable */
    570 		pm->pm_ptbl[seg] = (u_int *)pg;
    571 	}
    572 
    573 	splx(s);
    574 
    575 	return kbreak;
    576 }
    577 
    578 /*
    579  *	vm_page_alloc1:
    580  *
    581  *	Allocate and return a memory cell with no associated object.
    582  */
    583 struct vm_page *
    584 vm_page_alloc1(void)
    585 {
    586 	struct vm_page *pg;
    587 
    588 	pg = uvm_pagealloc(NULL, 0, NULL, UVM_PGA_USERESERVE);
    589 	if (pg) {
    590 		pg->wire_count = 1;	/* no mappings yet */
    591 		pg->flags &= ~PG_BUSY;	/* never busy */
    592 	}
    593 	return pg;
    594 }
    595 
    596 /*
    597  *	vm_page_free1:
    598  *
    599  *	Returns the given page to the free list,
    600  *	disassociating it with any VM object.
    601  *
    602  *	Object and page must be locked prior to entry.
    603  */
    604 void
    605 vm_page_free1(struct vm_page *pg)
    606 {
    607 
    608 	KASSERTMSG(pg->flags == (PG_CLEAN | PG_FAKE),
    609 	    "invalid page pg = %p, pa = %" PRIxPADDR,
    610 	    pg, VM_PAGE_TO_PHYS(pg));
    611 
    612 	pg->flags |= PG_BUSY;
    613 	pg->wire_count = 0;
    614 	uvm_pagefree(pg);
    615 }
    616 #endif
    617 
    618 /*
    619  * Create and return a physical map.
    620  */
    621 struct pmap *
    622 pmap_create(void)
    623 {
    624 	struct pmap *pm;
    625 
    626 	pm = kmem_alloc(sizeof(*pm), KM_SLEEP);
    627 	memset(pm, 0, sizeof(*pm));
    628 	pm->pm_refs = 1;
    629 	return pm;
    630 }
    631 
    632 /*
    633  * Add a reference to the given pmap.
    634  */
    635 void
    636 pmap_reference(struct pmap *pm)
    637 {
    638 
    639 	pm->pm_refs++;
    640 }
    641 
    642 /*
    643  * Retire the given pmap from service.
    644  * Should only be called if the map contains no valid mappings.
    645  */
    646 void
    647 pmap_destroy(struct pmap *pm)
    648 {
    649 	int i;
    650 
    651 	if (--pm->pm_refs > 0)
    652 		return;
    653 	KASSERT(pm->pm_stats.resident_count == 0);
    654 	KASSERT(pm->pm_stats.wired_count == 0);
    655 	for (i = 0; i < STSZ; i++)
    656 		if (pm->pm_ptbl[i]) {
    657 			uvm_km_free(kernel_map, (vaddr_t)pm->pm_ptbl[i],
    658 			    PAGE_SIZE, UVM_KMF_WIRED);
    659 			pm->pm_ptbl[i] = NULL;
    660 		}
    661 	if (pm->pm_ctx)
    662 		ctx_free(pm);
    663 	kmem_free(pm, sizeof(*pm));
    664 }
    665 
    666 /*
    667  * Copy the range specified by src_addr/len
    668  * from the source map to the range dst_addr/len
    669  * in the destination map.
    670  *
    671  * This routine is only advisory and need not do anything.
    672  */
    673 void
    674 pmap_copy(struct pmap *dst_pmap, struct pmap *src_pmap, vaddr_t dst_addr,
    675 	  vsize_t len, vaddr_t src_addr)
    676 {
    677 }
    678 
    679 /*
    680  * Require that all active physical maps contain no
    681  * incorrect entries NOW.
    682  */
    683 void
    684 pmap_update(struct pmap *pmap)
    685 {
    686 }
    687 
    688 /*
    689  * Fill the given physical page with zeroes.
    690  */
    691 void
    692 pmap_zero_page(paddr_t pa)
    693 {
    694 	int i;
    695 
    696 #ifdef PPC_4XX_NOCACHE
    697 	memset((void *)pa, 0, PAGE_SIZE);
    698 #else
    699 
    700 	for (i = PAGE_SIZE/CACHELINESIZE; i > 0; i--) {
    701 		__asm volatile ("dcbz 0,%0" : : "r" (pa));
    702 		pa += CACHELINESIZE;
    703 	}
    704 #endif
    705 }
    706 
    707 /*
    708  * Copy the given physical source page to its destination.
    709  */
    710 void
    711 pmap_copy_page(paddr_t src, paddr_t dst)
    712 {
    713 
    714 #ifdef PPC_IBM440
    715 	ibm4xx_blkcpy((void *)dst, (void *)src, PAGE_SIZE, true);
    716 #else
    717 	memcpy((void *)dst, (void *)src, PAGE_SIZE);
    718 #endif
    719 	dcache_wbinv_page(dst);
    720 }
    721 
    722 static inline int
    723 pmap_enter_pv(struct pmap *pm, vaddr_t va, paddr_t pa, int flags)
    724 {
    725 	struct pv_entry *pv, *npv;
    726 	int s;
    727 
    728 	KASSERT(pmap_initialized);
    729 
    730 	s = splvm();
    731 
    732 	pv = pa_to_pv(pa);
    733 	if (!pv->pv_pm) {
    734 		/*
    735 		 * No entries yet, use header as the first entry.
    736 		 */
    737 		pv->pv_va = va;
    738 		pv->pv_pm = pm;
    739 		pv->pv_next = NULL;
    740 	} else {
    741 		/*
    742 		 * There is at least one other VA mapping this page.
    743 		 * Place this entry after the header.
    744 		 */
    745 		npv = pool_get(&pv_pool, PR_NOWAIT);
    746 		if (npv == NULL) {
    747 			if ((flags & PMAP_CANFAIL) == 0)
    748 				panic("pmap_enter_pv: failed");
    749 			splx(s);
    750 			return ENOMEM;
    751 		}
    752 		npv->pv_va = va;
    753 		npv->pv_pm = pm;
    754 		npv->pv_next = pv->pv_next;
    755 		pv->pv_next = npv;
    756 		pv = npv;
    757 	}
    758 	if (flags & PMAP_WIRED) {
    759 		PV_WIRE(pv);
    760 		pm->pm_stats.wired_count++;
    761 	}
    762 
    763 	splx(s);
    764 
    765 	return 0;
    766 }
    767 
    768 static void
    769 pmap_remove_pv(struct pmap *pm, vaddr_t va, paddr_t pa)
    770 {
    771 	struct pv_entry *pv, *npv;
    772 
    773 	/*
    774 	 * Remove from the PV table.
    775 	 */
    776 	pv = pa_to_pv(pa);
    777 	if (!pv)
    778 		return;
    779 
    780 	/*
    781 	 * If it is the first entry on the list, it is actually
    782 	 * in the header and we must copy the following entry up
    783 	 * to the header.  Otherwise we must search the list for
    784 	 * the entry.  In either case we free the now unused entry.
    785 	 */
    786 	if (pm == pv->pv_pm && PV_CMPVA(va, pv)) {
    787 		if (PV_ISWIRED(pv))
    788 			pm->pm_stats.wired_count--;
    789 		if ((npv = pv->pv_next)) {
    790 			*pv = *npv;
    791 			pool_put(&pv_pool, npv);
    792 		} else
    793 			pv->pv_pm = NULL;
    794 	} else {
    795 		for (; (npv = pv->pv_next) != NULL; pv = npv)
    796 			if (pm == npv->pv_pm && PV_CMPVA(va, npv))
    797 				break;
    798 		if (npv) {
    799 			pv->pv_next = npv->pv_next;
    800 			if (PV_ISWIRED(npv)) {
    801 				pm->pm_stats.wired_count--;
    802 			}
    803 			pool_put(&pv_pool, npv);
    804 		}
    805 	}
    806 }
    807 
    808 /*
    809  * Insert physical page at pa into the given pmap at virtual address va.
    810  */
    811 int
    812 pmap_enter(struct pmap *pm, vaddr_t va, paddr_t pa, vm_prot_t prot, u_int flags)
    813 {
    814 	u_int tte;
    815 	bool managed;
    816 	int s;
    817 
    818 	/*
    819 	 * Have to remove any existing mapping first.
    820 	 */
    821 	pmap_remove(pm, va, va + PAGE_SIZE);
    822 
    823 	if (flags & PMAP_WIRED)
    824 		flags |= prot;
    825 
    826 	managed = uvm_pageismanaged(pa);
    827 
    828 	/*
    829 	 * Generate TTE.
    830 	 */
    831 	tte = TTE_PA(pa);
    832 	/* XXXX -- need to support multiple page sizes. */
    833 	tte |= TTE_SZ_16K;
    834 
    835 	KASSERT((flags & (PMAP_NOCACHE | PME_WRITETHROUG)) !=
    836 	    (PMAP_NOCACHE | PME_WRITETHROUG));
    837 
    838 	if (flags & PMAP_NOCACHE) {
    839 		/* Must be I/O mapping */
    840 		tte |= TTE_I | TTE_G;
    841 	}
    842 #ifdef PPC_4XX_NOCACHE
    843 	tte |= TTE_I;
    844 #else
    845 	else if (flags & PME_WRITETHROUG) {
    846 		/* Uncached and writethrough are not compatible */
    847 		tte |= TTE_W;
    848 	}
    849 #endif
    850 
    851 	if (pm == pmap_kernel())
    852 		tte |= TTE_ZONE(ZONE_PRIV);
    853 	else
    854 		tte |= TTE_ZONE(ZONE_USER);
    855 
    856 	if (flags & VM_PROT_WRITE)
    857 		tte |= TTE_WR;
    858 
    859 	if (flags & VM_PROT_EXECUTE)
    860 		tte |= TTE_EX;
    861 
    862 	/*
    863 	 * Now record mapping for later back-translation.
    864 	 */
    865 	if (pmap_initialized && managed) {
    866 		char *attr;
    867 
    868 		if (pmap_enter_pv(pm, va, pa, flags)) {
    869 			/* Could not enter pv on a managed page */
    870 			return ENOMEM;
    871 		}
    872 
    873 		/* Now set attributes. */
    874 		attr = pa_to_attr(pa);
    875 		KASSERT(attr);
    876 		if (flags & VM_PROT_ALL)
    877 			*attr |= PMAP_ATTR_REF;
    878 		if (flags & VM_PROT_WRITE)
    879 			*attr |= PMAP_ATTR_CHG;
    880 	}
    881 
    882 	s = splvm();
    883 
    884 	/* Insert page into page table. */
    885 	if (__predict_false(pte_enter(pm, va, tte))) {
    886 		if (__predict_false((flags & PMAP_CANFAIL) == 0))
    887 			panic("%s: pte_enter", __func__);
    888 		splx(s);
    889 		return ENOMEM;
    890 	}
    891 
    892 	/* If this is a real fault, enter it in the tlb */
    893 	if (tte && ((flags & PMAP_WIRED) == 0)) {
    894 		int s2 = splhigh();
    895 		ppc4xx_tlb_enter(pm->pm_ctx, va, tte);
    896 		splx(s2);
    897 	}
    898 
    899 	splx(s);
    900 
    901 	/* Flush the real memory from the instruction cache. */
    902 	if ((prot & VM_PROT_EXECUTE) && (tte & TTE_I) == 0)
    903 		__syncicache((void *)pa, PAGE_SIZE);
    904 
    905 	return 0;
    906 }
    907 
    908 void
    909 pmap_unwire(struct pmap *pm, vaddr_t va)
    910 {
    911 	struct pv_entry *pv;
    912 	paddr_t pa;
    913 	int s;
    914 
    915 	if (!pmap_extract(pm, va, &pa))
    916 		return;
    917 
    918 	pv = pa_to_pv(pa);
    919 	if (!pv)
    920 		return;
    921 
    922 	s = splvm();
    923 
    924 	while (pv != NULL) {
    925 		if (pm == pv->pv_pm && PV_CMPVA(va, pv)) {
    926 			if (PV_ISWIRED(pv)) {
    927 				PV_UNWIRE(pv);
    928 				pm->pm_stats.wired_count--;
    929 			}
    930 			break;
    931 		}
    932 		pv = pv->pv_next;
    933 	}
    934 
    935 	splx(s);
    936 }
    937 
    938 void
    939 pmap_kenter_pa(vaddr_t va, paddr_t pa, vm_prot_t prot, u_int flags)
    940 {
    941 	struct pmap *pm = pmap_kernel();
    942 	u_int tte;
    943 	int s;
    944 
    945 	/*
    946 	 * Generate TTE.
    947 	 *
    948 	 * XXXX
    949 	 *
    950 	 * Since the kernel does not handle execution privileges properly,
    951 	 * we will handle read and execute permissions together.
    952 	 */
    953 	tte = 0;
    954 	if (prot & VM_PROT_ALL) {
    955 		tte = TTE_PA(pa) | TTE_EX | TTE_ZONE(ZONE_PRIV);
    956 		/* XXXX -- need to support multiple page sizes. */
    957 		tte |= TTE_SZ_16K;
    958 
    959 		KASSERT((flags & (PMAP_NOCACHE | PME_WRITETHROUG)) !=
    960 		    (PMAP_NOCACHE | PME_WRITETHROUG));
    961 
    962 		if (flags & PMAP_NOCACHE)
    963 			/* Must be I/O mapping */
    964 			tte |= TTE_I | TTE_G;
    965 #ifdef PPC_4XX_NOCACHE
    966 		tte |= TTE_I;
    967 #else
    968 		else if (prot & PME_WRITETHROUG) {
    969 			/* Uncached and writethrough are not compatible */
    970 			tte |= TTE_W;
    971 		}
    972 #endif
    973 		if (prot & VM_PROT_WRITE)
    974 			tte |= TTE_WR;
    975 	}
    976 
    977 	s = splvm();
    978 
    979 	/* Insert page into page table. */
    980 	if (__predict_false(pte_enter(pm, va, tte)))
    981 		panic("%s: pte_enter", __func__);
    982 
    983 	splx(s);
    984 }
    985 
    986 void
    987 pmap_kremove(vaddr_t va, vsize_t len)
    988 {
    989 
    990 	while (len > 0) {
    991 		(void)pte_enter(pmap_kernel(), va, 0);	/* never fail */
    992 		va += PAGE_SIZE;
    993 		len -= PAGE_SIZE;
    994 	}
    995 }
    996 
    997 /*
    998  * Remove the given range of mapping entries.
    999  */
   1000 void
   1001 pmap_remove(struct pmap *pm, vaddr_t va, vaddr_t endva)
   1002 {
   1003 	paddr_t pa;
   1004 	volatile u_int *ptp;
   1005 	int s;
   1006 
   1007 	s = splvm();
   1008 
   1009 	while (va < endva) {
   1010 		if ((ptp = pte_find(pm, va)) && (pa = *ptp)) {
   1011 			pa = TTE_PA(pa);
   1012 			pmap_remove_pv(pm, va, pa);
   1013 			*ptp = 0;
   1014 			ppc4xx_tlb_flush(va, pm->pm_ctx);
   1015 			pm->pm_stats.resident_count--;
   1016 		}
   1017 		va += PAGE_SIZE;
   1018 	}
   1019 
   1020 	splx(s);
   1021 }
   1022 
   1023 /*
   1024  * Get the physical page address for the given pmap/virtual address.
   1025  */
   1026 bool
   1027 pmap_extract(struct pmap *pm, vaddr_t va, paddr_t *pap)
   1028 {
   1029 	int seg = STIDX(va), ptn = PTIDX(va);
   1030 	u_int pa = 0;
   1031 	int s;
   1032 
   1033 	s = splvm();
   1034 
   1035 	if (pm->pm_ptbl[seg] && (pa = pm->pm_ptbl[seg][ptn]) && pap)
   1036 		*pap = TTE_PA(pa) | (va & PGOFSET);
   1037 
   1038 	splx(s);
   1039 
   1040 	return pa != 0;
   1041 }
   1042 
   1043 /*
   1044  * Lower the protection on the specified range of this pmap.
   1045  *
   1046  * There are only two cases: either the protection is going to 0,
   1047  * or it is going to read-only.
   1048  */
   1049 void
   1050 pmap_protect(struct pmap *pm, vaddr_t sva, vaddr_t eva, vm_prot_t prot)
   1051 {
   1052 	volatile u_int *ptp;
   1053 	int s, bic;
   1054 
   1055 	if ((prot & VM_PROT_READ) == 0) {
   1056 		pmap_remove(pm, sva, eva);
   1057 		return;
   1058 	}
   1059 	bic = 0;
   1060 	if ((prot & VM_PROT_WRITE) == 0)
   1061 		bic |= TTE_WR;
   1062 	if ((prot & VM_PROT_EXECUTE) == 0)
   1063 		bic |= TTE_EX;
   1064 	if (bic == 0)
   1065 		return;
   1066 
   1067 	s = splvm();
   1068 
   1069 	while (sva < eva) {
   1070 		if ((ptp = pte_find(pm, sva)) != NULL) {
   1071 			*ptp &= ~bic;
   1072 			ppc4xx_tlb_flush(sva, pm->pm_ctx);
   1073 		}
   1074 		sva += PAGE_SIZE;
   1075 	}
   1076 
   1077 	splx(s);
   1078 }
   1079 
   1080 bool
   1081 pmap_check_attr(struct vm_page *pg, u_int mask, int clear)
   1082 {
   1083 	paddr_t pa;
   1084 	char *attr;
   1085 	int s, rv;
   1086 
   1087 	/*
   1088 	 * First modify bits in cache.
   1089 	 */
   1090 	pa = VM_PAGE_TO_PHYS(pg);
   1091 	attr = pa_to_attr(pa);
   1092 	if (attr == NULL)
   1093 		return false;
   1094 
   1095 	s = splvm();
   1096 
   1097 	rv = (*attr & mask) != 0;
   1098 	if (clear) {
   1099 		*attr &= ~mask;
   1100 		pmap_page_protect(pg,
   1101 		    mask == PMAP_ATTR_CHG ? VM_PROT_READ : 0);
   1102 	}
   1103 
   1104 	splx(s);
   1105 
   1106 	return rv;
   1107 }
   1108 
   1109 
   1110 /*
   1111  * Lower the protection on the specified physical page.
   1112  *
   1113  * There are only two cases: either the protection is going to 0,
   1114  * or it is going to read-only.
   1115  */
   1116 void
   1117 pmap_page_protect(struct vm_page *pg, vm_prot_t prot)
   1118 {
   1119 	struct pv_entry *pvh, *pv, *npv;
   1120 	struct pmap *pm;
   1121 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
   1122 	vaddr_t va;
   1123 
   1124 	pvh = pa_to_pv(pa);
   1125 	if (pvh == NULL)
   1126 		return;
   1127 
   1128 	/* Handle extra pvs which may be deleted in the operation */
   1129 	for (pv = pvh->pv_next; pv; pv = npv) {
   1130 		npv = pv->pv_next;
   1131 
   1132 		pm = pv->pv_pm;
   1133 		va = PV_VA(pv);
   1134 		pmap_protect(pm, va, va + PAGE_SIZE, prot);
   1135 	}
   1136 
   1137 	/* Now check the head pv */
   1138 	if (pvh->pv_pm) {
   1139 		pv = pvh;
   1140 		pm = pv->pv_pm;
   1141 		va = PV_VA(pv);
   1142 		pmap_protect(pm, va, va + PAGE_SIZE, prot);
   1143 	}
   1144 }
   1145 
   1146 /*
   1147  * Activate the address space for the specified process.  If the process
   1148  * is the current process, load the new MMU context.
   1149  */
   1150 void
   1151 pmap_activate(struct lwp *l)
   1152 {
   1153 #if 0
   1154 	struct pcb *pcb = lwp_getpcb(l);
   1155 	pmap_t pmap = l->l_proc->p_vmspace->vm_map.pmap;
   1156 
   1157 	/*
   1158 	 * XXX Normally performed in cpu_lwp_fork().
   1159 	 */
   1160 	printf("pmap_activate(%p), pmap=%p\n",l,pmap);
   1161 	pcb->pcb_pm = pmap;
   1162 #endif
   1163 }
   1164 
   1165 /*
   1166  * Deactivate the specified process's address space.
   1167  */
   1168 void
   1169 pmap_deactivate(struct lwp *l)
   1170 {
   1171 }
   1172 
   1173 /*
   1174  * Synchronize caches corresponding to [addr, addr+len) in p.
   1175  */
   1176 void
   1177 pmap_procwr(struct proc *p, vaddr_t va, size_t len)
   1178 {
   1179 	struct pmap *pm = p->p_vmspace->vm_map.pmap;
   1180 
   1181 	if (__predict_true(p == curproc)) {
   1182 		int msr, ctx, pid;
   1183 
   1184 		/*
   1185 		 * Take it easy! TLB miss handler takes care of us.
   1186 		 */
   1187 
   1188 		/*
   1189 	 	 * Need to turn off IMMU and switch to user context.
   1190 		 * (icbi uses DMMU).
   1191 		 */
   1192 
   1193 		if (!(ctx = pm->pm_ctx)) {
   1194 			/* No context -- assign it one */
   1195 			ctx_alloc(pm);
   1196 			ctx = pm->pm_ctx;
   1197 		}
   1198 
   1199 		__asm volatile (
   1200 			"mfmsr	%[msr];"
   1201 			"li	%[pid],0x20;"		/* Turn off IMMU */
   1202 			"andc	%[pid],%[msr],%[pid];"
   1203 			"ori	%[pid],%[pid],0x10;" /* Turn on DMMU for sure */
   1204 			"mtmsr	%[pid];"
   1205 			"isync;"
   1206 			MFPID(%[pid])
   1207 			MTPID(%[ctx])
   1208 			"isync;"
   1209 		"1:"
   1210 			"dcbst	0,%[va];"
   1211 			"icbi	0,%[va];"
   1212 			"add	%[va],%[va],%[size];"
   1213 			"sub.	%[len],%[len],%[size];"
   1214 			"bge	1b;"
   1215 			"sync;"
   1216 			MTPID(%[pid])
   1217 			"mtmsr	%[msr];"
   1218 			"isync;"
   1219 			: [msr] "=&r" (msr), [pid] "=&r" (pid)
   1220 			: [ctx] "r" (ctx), [va] "r" (va), [len] "r" (len),
   1221 			  [size] "r" (CACHELINESIZE));
   1222 	} else {
   1223 		paddr_t pa;
   1224 		vaddr_t tva, eva;
   1225 		int tlen;
   1226 
   1227 		/*
   1228 		 * For p != curproc, we cannot rely upon TLB miss handler in
   1229 		 * user context. Therefore, extract pa and operate against it.
   1230 		 *
   1231 		 * Note that va below VM_MIN_KERNEL_ADDRESS is reserved for
   1232 		 * direct mapping.
   1233 		 */
   1234 
   1235 		for (tva = va; len > 0; tva = eva, len -= tlen) {
   1236 			eva = uimin(tva + len, trunc_page(tva + PAGE_SIZE));
   1237 			tlen = eva - tva;
   1238 			if (!pmap_extract(pm, tva, &pa)) {
   1239 				/* XXX should be already unmapped */
   1240 				continue;
   1241 			}
   1242 			__syncicache((void *)pa, tlen);
   1243 		}
   1244 	}
   1245 }
   1246 
   1247 static inline void
   1248 tlb_invalidate_entry(int i)
   1249 {
   1250 #if defined(PMAP_TLBDEBUG) && !defined(PPC_IBM440)
   1251 	/*
   1252 	 * Clear only TLBHI[V] bit so that we can track invalidated entry.
   1253 	 */
   1254 	register_t msr, pid, hi;
   1255 
   1256 	KASSERT(mfspr(SPR_PID) == KERNEL_PID);
   1257 
   1258 	__asm volatile (
   1259 		"mfmsr	%[msr];"
   1260 		"li	%[pid],0;"
   1261 		"mtmsr	%[pid];"
   1262 		MFPID(%[pid])
   1263 		"tlbre	%[hi],%[i],0;"
   1264 		"andc	%[hi],%[hi],%[valid];"
   1265 		"tlbwe	%[hi],%[i],0;"
   1266 		MTPID(%[pid])
   1267 		"mtmsr	%[msr];"
   1268 		"isync;"
   1269 		: [msr] "=&r" (msr), [pid] "=&r" (pid), [hi] "=&r" (hi)
   1270 		: [i] "r" (i), [valid] "r" (TLB_VALID));
   1271 #else
   1272 	/*
   1273 	 * Just clear entire TLBHI register.
   1274 	 */
   1275 	__asm volatile (
   1276 		"tlbwe	%0,%1,0;"
   1277 		"isync;"
   1278 		: : "r" (0), "r" (i));
   1279 #endif
   1280 
   1281 	tlb_info[i].ti_ctx = 0;
   1282 	tlb_info[i].ti_flags = 0;
   1283 }
   1284 
   1285 /* This has to be done in real mode !!! */
   1286 void
   1287 ppc4xx_tlb_flush(vaddr_t va, int pid)
   1288 {
   1289 	u_long msr, i, found;
   1290 
   1291 	/* If there's no context then it can't be mapped. */
   1292 	if (!pid)
   1293 		return;
   1294 
   1295 #ifdef PPC_IBM440
   1296 	/*
   1297 	 * PID and space come from MMUCR, not the PID SPR!!!
   1298 	 */
   1299 	{
   1300 		u_long omm, tmp;
   1301 
   1302 		__asm volatile (
   1303 			"mfmsr	%[msr];"
   1304 			"wrteei	0;"
   1305 			MFMMUCR(%[omm])
   1306 			"andc	%[tmp],%[omm],%[clr];"
   1307 			"or	%[tmp],%[tmp],%[stspid];"
   1308 			MTMMUCR(%[tmp])
   1309 			"isync;"
   1310 			"tlbsx.	%[i],0,%[va];"
   1311 			MTMMUCR(%[omm])
   1312 			"mtmsr	%[msr];"
   1313 			"isync;"
   1314 			"li	%[found],1;"
   1315 			"beq	1f;"
   1316 			"li	%[found],0;"
   1317 		"1:"
   1318 			: [i] "=&r" (i), [found] "=&r" (found),
   1319 			  [msr] "=&r" (msr), [omm] "=&r" (omm),
   1320 			  [tmp] "=&r" (tmp)
   1321 			: [va] "r" (va),
   1322 			  [stspid] "r" (MMUCR_STS | (pid & MMUCR_STID)),
   1323 			  [clr] "r" (MMUCR_STS | MMUCR_STID)
   1324 			: "cr0");
   1325 	}
   1326 #else
   1327 	__asm volatile (
   1328 		MFPID(%[found])		/* Save PID */
   1329 		"mfmsr	%[msr];"	/* Save MSR */
   1330 		"li	%[i],0;"	/* Now clear MSR */
   1331 		"mtmsr	%[i];"
   1332 		"isync;"
   1333 		MTPID(%[pid])		/* Set PID */
   1334 		"isync;"
   1335 		"tlbsx.	%[i],0,%[va];"	/* Search TLB */
   1336 		"isync;"
   1337 		MTPID(%[found])		/* Restore PID */
   1338 		"mtmsr	%[msr];"	/* Restore MSR */
   1339 		"isync;"
   1340 		"li	%[found],1;"
   1341 		"beq	1f;"
   1342 		"li	%[found],0;"
   1343 	"1:"
   1344 		: [i] "=&r" (i), [found] "=&r" (found), [msr] "=&r" (msr)
   1345 		: [va] "r" (va), [pid] "r" (pid));
   1346 #endif
   1347 
   1348 	if (found && !TLB_LOCKED(i)) {
   1349 		/* Now flush translation */
   1350 		tlb_invalidate_entry(i);
   1351 		tlbnext = i;
   1352 		/* Successful flushes */
   1353 		tlbflush_ev.ev_count++;
   1354 	}
   1355 }
   1356 
   1357 void
   1358 ppc4xx_tlb_flush_all(void)
   1359 {
   1360 	u_long i;
   1361 
   1362 	for (i = 0; i < NTLB; i++)
   1363 		if (!TLB_LOCKED(i))
   1364 			tlb_invalidate_entry(i);
   1365 
   1366 	__asm volatile ("isync");
   1367 }
   1368 
   1369 /* Find a TLB entry to evict. */
   1370 static int
   1371 ppc4xx_tlb_find_victim(void)
   1372 {
   1373 	int flags;
   1374 
   1375 	for (;;) {
   1376 		if (++tlbnext >= NTLB)
   1377 			tlbnext = tlb_nreserved;
   1378 		flags = tlb_info[tlbnext].ti_flags;
   1379 		if (!(flags & TLBF_USED) ||
   1380 		    (flags & (TLBF_LOCKED | TLBF_REF)) == 0) {
   1381 			u_long va, stack = (u_long)&va;
   1382 
   1383 			if (!((tlb_info[tlbnext].ti_va ^ stack) &
   1384 				(~PGOFSET)) &&
   1385 			    (tlb_info[tlbnext].ti_ctx == KERNEL_PID) &&
   1386 			    (flags & TLBF_USED)) {
   1387 				/* Kernel stack page */
   1388 				flags |= TLBF_REF;
   1389 				tlb_info[tlbnext].ti_flags = flags;
   1390 			} else {
   1391 				/* Found it! */
   1392 				return tlbnext;
   1393 			}
   1394 		} else
   1395 			tlb_info[tlbnext].ti_flags = (flags & ~TLBF_REF);
   1396 	}
   1397 }
   1398 
   1399 #ifdef PPC_IBM440
   1400 /*
   1401  * Convert the 40x-style software TTE permission/attribute bits into
   1402  * 440 TLB word 2.
   1403  */
   1404 static inline u_int
   1405 tte_to_tlb44_word2(u_int pte)
   1406 {
   1407 	u_int w2;
   1408 
   1409 	w2 = TLB44_WIMG(pte) | TLB44_SR;
   1410 	if (pte & TTE_WR)
   1411 		w2 |= TLB44_SW;
   1412 	if (pte & TTE_EX)
   1413 		w2 |= TLB44_SX;
   1414 	if (((pte & TTE_ZSEL_MASK) >> TTE_ZSEL_SHFT) == ZONE_USER) {
   1415 		w2 |= TLB44_UR;
   1416 		if (pte & TTE_WR)
   1417 			w2 |= TLB44_UW;
   1418 		if (pte & TTE_EX)
   1419 			w2 |= TLB44_UX;
   1420 	}
   1421 	return w2;
   1422 }
   1423 #endif /* PPC_IBM440 */
   1424 
   1425 void
   1426 ppc4xx_tlb_enter(int ctx, vaddr_t va, u_int pte)
   1427 {
   1428 #ifdef PPC_IBM440
   1429 	u_long w0, w1, w2, omm, tmp, i;
   1430 	paddr_t pa;
   1431 	int msr, sz;
   1432 #else
   1433 	u_long hi, lo, i;
   1434 	paddr_t pa;
   1435 	int msr, pid, sz;
   1436 #endif
   1437 
   1438 	tlbenter_ev.ev_count++;
   1439 
   1440 	sz = (pte & TTE_SZ_MASK) >> TTE_SZ_SHIFT;
   1441 	pa = (pte & TTE_RPN_MASK(sz));
   1442 #ifdef PPC_IBM440
   1443 	w0 = (va & ~(tlbsize[sz] - 1)) | (sz << TLB44_SIZE_SHFT) |
   1444 	    TLB44_V | TLB44_TS;
   1445 	w1 = pa;		/* ERPN=0: RAM is below 4GB */
   1446 	w2 = tte_to_tlb44_word2(pte);
   1447 #else
   1448 	hi = (va & TLB_EPN_MASK) | (sz << TLB_SIZE_SHFT) | TLB_VALID;
   1449 	lo = (pte & ~TLB_RPN_MASK) | pa;
   1450 	lo |= ppc4xx_tlbflags(va, pa);
   1451 #endif
   1452 
   1453 	i = ppc4xx_tlb_find_victim();
   1454 
   1455 	KASSERTMSG(i >= tlb_nreserved && i < NTLB,
   1456 	    "invalid entry %ld", i);
   1457 
   1458 	tlb_info[i].ti_va = (va & TLB_EPN_MASK);
   1459 	tlb_info[i].ti_ctx = ctx;
   1460 	tlb_info[i].ti_flags = TLBF_USED | TLBF_REF;
   1461 
   1462 #ifdef PPC_IBM440
   1463 	/*
   1464 	 * ID is taken from MMUCR[STID] when word 0 is written.
   1465 	 */
   1466 	__asm volatile (
   1467 		"mfmsr	%[msr];"
   1468 		"wrteei	0;"
   1469 		MFMMUCR(%[omm])
   1470 		"andc	%[tmp],%[omm],%[clr];"
   1471 		"or	%[tmp],%[tmp],%[ctx];"
   1472 		MTMMUCR(%[tmp])
   1473 		"isync;"
   1474 		"tlbwe	%[w2],%[i],2;"
   1475 		"tlbwe	%[w1],%[i],1;"
   1476 		"tlbwe	%[w0],%[i],0;"
   1477 		"isync;"
   1478 		MTMMUCR(%[omm])
   1479 		"mtmsr	%[msr];"
   1480 		"isync;"
   1481 		: [msr] "=&r" (msr), [omm] "=&r" (omm),
   1482 		  [tmp] "=&r" (tmp)
   1483 		: [ctx] "r" (ctx & MMUCR_STID),
   1484 		  [clr] "r" (MMUCR_STS | MMUCR_STID), [i] "r" (i),
   1485 		  [w0] "r" (w0), [w1] "r" (w1), [w2] "r" (w2));
   1486 #else
   1487 	__asm volatile (
   1488 		"mfmsr	%[msr];"		/* Save MSR */
   1489 		"li	%[pid],0;"
   1490 		"mtmsr	%[pid];"		/* Clear MSR */
   1491 		"isync;"
   1492 		"tlbwe	%[pid],%[i],0;"		/* Invalidate old entry. */
   1493 		MFPID(%[pid])			/* Save old PID */
   1494 		MTPID(%[ctx])			/* Load translation ctx */
   1495 		"isync;"
   1496 		"tlbwe	%[lo],%[i],1;"		/* Set TLB */
   1497 		"tlbwe	%[hi],%[i],0;"
   1498 		"isync;"
   1499 		MTPID(%[pid])			/* Restore PID */
   1500 		"mtmsr	%[msr];"		/* and MSR */
   1501 		"isync;"
   1502 		: [msr] "=&r" (msr), [pid] "=&r" (pid)
   1503 		: [ctx] "r" (ctx), [i] "r" (i), [lo] "r" (lo), [hi] "r" (hi));
   1504 #endif
   1505 }
   1506 
   1507 void
   1508 ppc4xx_tlb_init(void)
   1509 {
   1510 	int i;
   1511 
   1512 	/* Mark reserved TLB entries */
   1513 	for (i = 0; i < tlb_nreserved; i++) {
   1514 		tlb_info[i].ti_flags = TLBF_LOCKED | TLBF_USED;
   1515 		tlb_info[i].ti_ctx = KERNEL_PID;
   1516 	}
   1517 
   1518 #ifndef PPC_IBM440
   1519 	/* Setup security zones */
   1520 	/* Z0 - accessible by kernel only if TLB entry permissions allow
   1521 	 * Z1,Z2 - access is controlled by TLB entry permissions
   1522 	 * Z3 - full access regardless of TLB entry permissions
   1523 	 */
   1524 
   1525 	__asm volatile (
   1526 		"mtspr	%0,%1;"
   1527 		"isync;"
   1528 		: : "K" (SPR_ZPR), "r" (0x1b000000));
   1529 #endif
   1530 }
   1531 
   1532 #ifndef PPC_IBM440
   1533 /*
   1534  * ppc4xx_tlb_size_mask:
   1535  *
   1536  * 	Roundup size to supported page size, return TLBHI mask and real size.
   1537  */
   1538 static int
   1539 ppc4xx_tlb_size_mask(size_t size, int *mask, int *rsiz)
   1540 {
   1541 	int i;
   1542 
   1543 	for (i = 0; i < __arraycount(tlbsize); i++)
   1544 		if (size <= tlbsize[i]) {
   1545 			*mask = (i << TLB_SIZE_SHFT);
   1546 			*rsiz = tlbsize[i];
   1547 			return 0;
   1548 		}
   1549 	return EINVAL;
   1550 }
   1551 #endif /* !PPC_IBM440 */
   1552 
   1553 /*
   1554  * ppc4xx_tlb_mapiodev:
   1555  *
   1556  * 	Lookup virtual address of mapping previously entered via
   1557  * 	ppc4xx_tlb_reserve. Search TLB directly so that we don't
   1558  * 	need to waste extra storage for reserved mappings. Note
   1559  * 	that reading TLBHI also sets PID, but all reserved mappings
   1560  * 	use KERNEL_PID, so the side effect is nil.
   1561  */
   1562 void *
   1563 ppc4xx_tlb_mapiodev(paddr_t base, psize_t len)
   1564 {
   1565 #ifdef PPC_IBM440
   1566 	int i, j;
   1567 
   1568 	/*
   1569 	 * Match against the 32-bit (on-chip bus) address; the ERPN
   1570 	 * extension is recorded in the reserved-mapping table only.
   1571 	 */
   1572 	for (i = 0; i < tlb_nreserved; i++) {
   1573 		const uint32_t pa32 = (uint32_t)tlb44_resv[i].tr_pa;
   1574 		uint64_t end_pa;
   1575 		vaddr_t va, end_va;
   1576 		bool grew;
   1577 
   1578 		if (tlb44_resv[i].tr_size == 0)
   1579 			continue;
   1580 		if (base < pa32 || base >= pa32 + tlb44_resv[i].tr_size)
   1581 			continue;
   1582 
   1583 		va = tlb44_resv[i].tr_va + (base - pa32);
   1584 		end_pa = tlb44_resv[i].tr_pa + tlb44_resv[i].tr_size;
   1585 		end_va = tlb44_resv[i].tr_va + tlb44_resv[i].tr_size;
   1586 
   1587 		do {
   1588 			if (base + len <= (uint32_t)end_pa)
   1589 				return (void *)va;
   1590 			grew = false;
   1591 			for (j = 0; j < tlb_nreserved; j++) {
   1592 				if (tlb44_resv[j].tr_size != 0 &&
   1593 				    tlb44_resv[j].tr_pa == end_pa &&
   1594 				    tlb44_resv[j].tr_va == end_va) {
   1595 					end_pa += tlb44_resv[j].tr_size;
   1596 					end_va += tlb44_resv[j].tr_size;
   1597 					grew = true;
   1598 					break;
   1599 				}
   1600 			}
   1601 		} while (grew);
   1602 		/* run ended before covering len; no other entry can */
   1603 		return NULL;
   1604 	}
   1605 
   1606 	return NULL;
   1607 #else
   1608 	paddr_t pa;
   1609 	vaddr_t va;
   1610 	u_int lo, hi, sz;
   1611 	int i;
   1612 
   1613 	/* tlb_nreserved is only allowed to grow, so this is safe. */
   1614 	for (i = 0; i < tlb_nreserved; i++) {
   1615 		__asm volatile (
   1616 			"tlbre	%[lo],%[i],1;" 	/* TLBLO */
   1617 			"tlbre	%[hi],%[i],0;" 	/* TLBHI */
   1618 			: [lo] "=&r" (lo), [hi] "=&r" (hi)
   1619 			: [i] "r" (i));
   1620 
   1621 		KASSERT(hi & TLB_VALID);
   1622 		KASSERT(mfspr(SPR_PID) == KERNEL_PID);
   1623 
   1624 		pa = (lo & TLB_RPN_MASK);
   1625 		if (base < pa)
   1626 			continue;
   1627 
   1628 		sz = tlbsize[(hi & TLB_SIZE_MASK) >> TLB_SIZE_SHFT];
   1629 		if (base + len > pa + sz)
   1630 			continue;
   1631 
   1632 		va = (hi & TLB_EPN_MASK) + (base & (sz - 1)); 	/* sz = 2^n */
   1633 		return (void *)va;
   1634 	}
   1635 
   1636 	return NULL;
   1637 #endif
   1638 }
   1639 
   1640 #ifdef PPC_IBM440
   1641 bool
   1642 ppc44x_tlb_reverse(vaddr_t va, paddr_t *pap)
   1643 {
   1644 	int i;
   1645 
   1646 	for (i = 0; i < tlb_nreserved; i++) {
   1647 		if (tlb44_resv[i].tr_size == 0)
   1648 			continue;
   1649 		if (va >= tlb44_resv[i].tr_va &&
   1650 		    va < tlb44_resv[i].tr_va + tlb44_resv[i].tr_size) {
   1651 			*pap = (uint32_t)tlb44_resv[i].tr_pa +
   1652 			    (va - tlb44_resv[i].tr_va);
   1653 			return true;
   1654 		}
   1655 	}
   1656 	return false;
   1657 }
   1658 
   1659 void
   1660 ppc44x_tlb_boot_reserved(int n)
   1661 {
   1662 
   1663 	KASSERT(tlb_nreserved == 0);
   1664 	KASSERT(n < NTLB);
   1665 
   1666 	/* zero-size entries never match in ppc4xx_tlb_mapiodev() */
   1667 	tlb_nreserved = n;
   1668 }
   1669 
   1670 void
   1671 ppc44x_tlb_reserve(uint64_t pa, vaddr_t va, size_t size, int flags)
   1672 {
   1673 	static const struct {
   1674 		size_t size;
   1675 		int enc;
   1676 	} sizetab[] = {
   1677 		{ 0x00000400, TLB_SIZE_1K },
   1678 		{ 0x00001000, TLB_SIZE_4K },
   1679 		{ 0x00004000, TLB_SIZE_16K },
   1680 		{ 0x00010000, TLB_SIZE_64K },
   1681 		{ 0x00040000, TLB_SIZE_256K },
   1682 		{ 0x00100000, TLB_SIZE_1M },
   1683 		{ 0x01000000, TLB_SIZE_16M },
   1684 		{ 0x10000000, TLB44_SIZE_256M },
   1685 	};
   1686 	u_long w0, w1, w2, msr, omm, tmp;
   1687 	size_t rsize = 0;
   1688 	int i, enc = -1;
   1689 
   1690 	/* Called before pmap_bootstrap(), va outside kernel space. */
   1691 	KASSERT(va < VM_MIN_KERNEL_ADDRESS || va >= VM_MAX_KERNEL_ADDRESS);
   1692 	KASSERT(!pmap_bootstrap_done);
   1693 	KASSERT(tlb_nreserved < NTLB);
   1694 
   1695 	for (i = 0; i < __arraycount(sizetab); i++)
   1696 		if (size <= sizetab[i].size) {
   1697 			rsize = sizetab[i].size;
   1698 			enc = sizetab[i].enc;
   1699 			break;
   1700 		}
   1701 	if (enc < 0)
   1702 		panic("ppc44x_tlb_reserve: entry %d, %zuB too large",
   1703 		    tlb_nreserved, size);
   1704 
   1705 	pa &= ~(uint64_t)(rsize - 1);
   1706 	va &= ~(rsize - 1);
   1707 
   1708 	w0 = va | TLB44_V | TLB44_TS | (enc << TLB44_SIZE_SHFT);
   1709 	w1 = (u_long)pa | ((u_long)(pa >> 32) & TLB44_ERPN_MASK);
   1710 	w2 = TLB44_WIMG(flags) | TLB44_SR | TLB44_SW;
   1711 	if (flags & TLB_EX)
   1712 		w2 |= TLB44_SX;
   1713 #ifdef PPC_4XX_NOCACHE
   1714 	w2 |= TLB44_I;
   1715 #endif
   1716 
   1717 	tlb44_resv[tlb_nreserved].tr_pa = pa;
   1718 	tlb44_resv[tlb_nreserved].tr_va = va;
   1719 	tlb44_resv[tlb_nreserved].tr_size = rsize;
   1720 
   1721 	__asm volatile (
   1722 		"mfmsr	%[msr];"
   1723 		"wrteei	0;"
   1724 		MFMMUCR(%[omm])
   1725 		"andc	%[tmp],%[omm],%[clr];"
   1726 		"ori	%[tmp],%[tmp],%[pid];"
   1727 		MTMMUCR(%[tmp])
   1728 		"isync;"
   1729 		"tlbwe	%[w2],%[i],2;"
   1730 		"tlbwe	%[w1],%[i],1;"
   1731 		"tlbwe	%[w0],%[i],0;"
   1732 		"isync;"
   1733 		MTMMUCR(%[omm])
   1734 		"mtmsr	%[msr];"
   1735 		"isync;"
   1736 		: [msr] "=&r" (msr), [omm] "=&r" (omm), [tmp] "=&r" (tmp)
   1737 		: [pid] "K" (KERNEL_PID),
   1738 		  [clr] "r" (MMUCR_STS | MMUCR_STID), [i] "r" (tlb_nreserved),
   1739 		  [w0] "r" (w0), [w1] "r" (w1), [w2] "r" (w2));
   1740 
   1741 	tlb_nreserved++;
   1742 }
   1743 
   1744 /*
   1745  * Pin a TS=0 identity entry for a 256MB chunk of RAM.
   1746  * Should be enough for everyone.
   1747  */
   1748 void
   1749 ppc44x_tlb_reserve_ts0(paddr_t pa)
   1750 {
   1751 	const size_t size = 0x10000000;	/* 256MB */
   1752 	u_long w0, w1, w2, msr, omm, tmp;
   1753 
   1754 	KASSERT(!pmap_bootstrap_done);
   1755 	KASSERT(tlb_nreserved < NTLB);
   1756 	KASSERT((pa & (size - 1)) == 0);
   1757 
   1758 	w0 = (u_long)pa | TLB44_V | (TLB44_SIZE_256M << TLB44_SIZE_SHFT);
   1759 	w1 = (u_long)pa;		/* ERPN = 0: RAM is below 4GB */
   1760 	w2 = TLB44_SR | TLB44_SW | TLB44_SX;
   1761 #ifdef PPC_4XX_NOCACHE
   1762 	w2 |= TLB44_I;
   1763 #endif
   1764 
   1765 	__asm volatile (
   1766 		"mfmsr	%[msr];"
   1767 		"wrteei	0;"
   1768 		MFMMUCR(%[omm])
   1769 		"andc	%[tmp],%[omm],%[clr];"	/* STS = 0, STID = 0 */
   1770 		MTMMUCR(%[tmp])
   1771 		"isync;"
   1772 		"tlbwe	%[w2],%[i],2;"
   1773 		"tlbwe	%[w1],%[i],1;"
   1774 		"tlbwe	%[w0],%[i],0;"
   1775 		"isync;"
   1776 		MTMMUCR(%[omm])
   1777 		"mtmsr	%[msr];"
   1778 		"isync;"
   1779 		: [msr] "=&r" (msr), [omm] "=&r" (omm), [tmp] "=&r" (tmp)
   1780 		: [clr] "r" (MMUCR_STS | MMUCR_STID), [i] "r" (tlb_nreserved),
   1781 		  [w0] "r" (w0), [w1] "r" (w1), [w2] "r" (w2));
   1782 
   1783 	tlb_nreserved++;
   1784 }
   1785 
   1786 void
   1787 ppc4xx_tlb_reserve(paddr_t pa, vaddr_t va, size_t size, int flags)
   1788 {
   1789 
   1790 	ppc44x_tlb_reserve((uint64_t)pa, va, size, flags);
   1791 }
   1792 #else /* !PPC_IBM440 */
   1793 /*
   1794  * ppc4xx_tlb_reserve:
   1795  *
   1796  * 	Map physical range to kernel virtual chunk via reserved TLB entry.
   1797  */
   1798 void
   1799 ppc4xx_tlb_reserve(paddr_t pa, vaddr_t va, size_t size, int flags)
   1800 {
   1801 	u_int lo, hi;
   1802 	int szmask, rsize;
   1803 
   1804 	/* Called before pmap_bootstrap(), va outside kernel space. */
   1805 	KASSERT(va < VM_MIN_KERNEL_ADDRESS || va >= VM_MAX_KERNEL_ADDRESS);
   1806 	KASSERT(!pmap_bootstrap_done);
   1807 	KASSERT(tlb_nreserved < NTLB);
   1808 
   1809 	/* Resolve size. */
   1810 	if (ppc4xx_tlb_size_mask(size, &szmask, &rsize) != 0)
   1811 		panic("ppc4xx_tlb_reserve: entry %d, %zuB too large",
   1812 		    size, tlb_nreserved);
   1813 
   1814 	/* Real size will be power of two >= 1024, so this is OK. */
   1815 	pa &= ~(rsize - 1); 	/* RPN */
   1816 	va &= ~(rsize - 1); 	/* EPN */
   1817 
   1818 	lo = pa | TLB_WR | flags;
   1819 	hi = va | TLB_VALID | szmask;
   1820 
   1821 #ifdef PPC_4XX_NOCACHE
   1822 	lo |= TLB_I;
   1823 #endif
   1824 
   1825 	__asm volatile (
   1826 		"tlbwe	%[lo],%[i],1;"	/* write TLBLO */
   1827 		"tlbwe	%[hi],%[i],0;"	/* write TLBHI */
   1828 		"isync;"
   1829 		: : [i] "r" (tlb_nreserved), [lo] "r" (lo), [hi] "r" (hi));
   1830 
   1831 	tlb_nreserved++;
   1832 }
   1833 #endif /* PPC_IBM440 */
   1834 
   1835 /*
   1836  * We should pass the ctx in from trap code.
   1837  */
   1838 int
   1839 pmap_tlbmiss(vaddr_t va, int ctx)
   1840 {
   1841 	volatile u_int *pte;
   1842 	u_long tte;
   1843 
   1844 	tlbmiss_ev.ev_count++;
   1845 
   1846 	/*
   1847 	 * We will reserve 0 upto VM_MIN_KERNEL_ADDRESS for va == pa mappings.
   1848 	 * Physical RAM is expected to live in this range, care must be taken
   1849 	 * to not clobber 0 upto ${physmem} with device mappings in machdep
   1850 	 * code.
   1851 	 */
   1852 	if (ctx != KERNEL_PID ||
   1853 	    (va >= VM_MIN_KERNEL_ADDRESS && va < VM_MAX_KERNEL_ADDRESS)) {
   1854 		pte = pte_find((struct pmap *)__UNVOLATILE(ctxbusy[ctx]), va);
   1855 		if (pte == NULL) {
   1856 			/*
   1857 			 * Map unmanaged addresses directly for
   1858 			 * kernel access
   1859 			 */
   1860 			return 1;
   1861 		}
   1862 		tte = *pte;
   1863 		if (tte == 0)
   1864 			return 1;
   1865 	} else {
   1866 		/* Create a 16MB writable mapping. */
   1867 		tte = TTE_PA(va) | TTE_ZONE(ZONE_PRIV) | TTE_SZ_16M | TTE_WR;
   1868 #ifdef PPC_4XX_NOCACHE
   1869 		tte |= TTE_I;
   1870 #endif
   1871 	}
   1872 	ppc4xx_tlb_enter(ctx, va, tte);
   1873 
   1874 	return 0;
   1875 }
   1876 
   1877 /*
   1878  * Flush all the entries matching a context from the TLB.
   1879  */
   1880 static void
   1881 ctx_flush(int cnum)
   1882 {
   1883 	int i;
   1884 
   1885 	/* We gotta steal this context */
   1886 	for (i = tlb_nreserved; i < NTLB; i++) {
   1887 		if (tlb_info[i].ti_ctx == cnum) {
   1888 			/* Can't steal ctx if it has locked/reserved entry. */
   1889 			KASSERTMSG(!TLB_LOCKED(i) && i >= tlb_nreserved,
   1890 			    "locked/reserved entry %d for ctx %d",
   1891 			    i, cnum);
   1892 			/*
   1893 			 * Invalidate particular TLB entry regardless of
   1894 			 * locked status
   1895 			 */
   1896 			tlb_invalidate_entry(i);
   1897 		}
   1898 	}
   1899 }
   1900 
   1901 /*
   1902  * Allocate a context.  If necessary, steal one from someone else.
   1903  *
   1904  * The new context is flushed from the TLB before returning.
   1905  */
   1906 int
   1907 ctx_alloc(struct pmap *pm)
   1908 {
   1909 	static int next = MINCTX;
   1910 	int cnum, s;
   1911 
   1912 	KASSERT(pm != pmap_kernel());
   1913 
   1914 	s = splvm();
   1915 
   1916 	/* Find a likely context. */
   1917 	cnum = next;
   1918 	do {
   1919 		if (++cnum >= NUMCTX)
   1920 			cnum = MINCTX;
   1921 	} while (ctxbusy[cnum] != NULL && cnum != next);
   1922 
   1923 	/* Now clean it out */
   1924 	if (cnum < MINCTX)
   1925 		cnum = MINCTX; /* Never steal ctx 0 or 1 */
   1926 	ctx_flush(cnum);
   1927 
   1928 	if (ctxbusy[cnum]) {
   1929 #ifdef DEBUG
   1930 		/* We should identify this pmap and clear it */
   1931 		printf("Warning: stealing context %d\n", cnum);
   1932 #endif
   1933 		ctxbusy[cnum]->pm_ctx = 0;
   1934 	}
   1935 	ctxbusy[cnum] = pm;
   1936 	next = cnum;
   1937 
   1938 	splx(s);
   1939 
   1940 	pm->pm_ctx = cnum;
   1941 
   1942 	return cnum;
   1943 }
   1944 
   1945 /*
   1946  * Give away a context.
   1947  */
   1948 void
   1949 ctx_free(struct pmap *pm)
   1950 {
   1951 	int oldctx;
   1952 
   1953 	oldctx = pm->pm_ctx;
   1954 
   1955 	if (oldctx == 0)
   1956 		panic("ctx_free: freeing kernel context");
   1957 
   1958 	KASSERTMSG(ctxbusy[oldctx] == pm,
   1959 	    "ctxbusy[%d] = %p, pm->pm_ctx = %p",
   1960 	    oldctx, ctxbusy[oldctx], pm);
   1961 
   1962 	/* We should verify it has not been stolen and reallocated... */
   1963 	ctxbusy[oldctx] = NULL;
   1964 	ctx_flush(oldctx);
   1965 }
   1966 
   1967 #ifdef DEBUG
   1968 /*
   1969  * Test ref/modify handling.
   1970  */
   1971 void pmap_testout(void);
   1972 void
   1973 pmap_testout(void)
   1974 {
   1975 	struct vm_page *pg;
   1976 	vaddr_t va;
   1977 	paddr_t pa;
   1978 	volatile int *loc;
   1979 	int ref, mod, val = 0;
   1980 
   1981 	/* Allocate a page */
   1982 	va = (vaddr_t)uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
   1983 	    UVM_KMF_WIRED | UVM_KMF_ZERO);
   1984 	loc = (int *)va;
   1985 
   1986 	pmap_extract(pmap_kernel(), va, &pa);
   1987 	pg = PHYS_TO_VM_PAGE(pa);
   1988 	pmap_unwire(pmap_kernel(), va);
   1989 
   1990 	pmap_kremove(va, PAGE_SIZE);
   1991 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
   1992 	pmap_update(pmap_kernel());
   1993 
   1994 	/* Now clear reference and modify */
   1995 	ref = pmap_clear_reference(pg);
   1996 	mod = pmap_clear_modify(pg);
   1997 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   1998 	    (void *)(u_long)va, (long)pa, ref, mod);
   1999 
   2000 	/* Check it's properly cleared */
   2001 	ref = pmap_is_referenced(pg);
   2002 	mod = pmap_is_modified(pg);
   2003 	printf("Checking cleared page: ref %d, mod %d\n", ref, mod);
   2004 
   2005 	/* Reference page */
   2006 	val = *loc;
   2007 
   2008 	ref = pmap_is_referenced(pg);
   2009 	mod = pmap_is_modified(pg);
   2010 	printf("Referenced page: ref %d, mod %d val %x\n", ref, mod, val);
   2011 
   2012 	/* Now clear reference and modify */
   2013 	ref = pmap_clear_reference(pg);
   2014 	mod = pmap_clear_modify(pg);
   2015 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2016 	    (void *)(u_long)va, (long)pa, ref, mod);
   2017 
   2018 	/* Modify page */
   2019 	*loc = 1;
   2020 
   2021 	ref = pmap_is_referenced(pg);
   2022 	mod = pmap_is_modified(pg);
   2023 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2024 
   2025 	/* Now clear reference and modify */
   2026 	ref = pmap_clear_reference(pg);
   2027 	mod = pmap_clear_modify(pg);
   2028 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2029 	    (void *)(u_long)va, (long)pa, ref, mod);
   2030 
   2031 	/* Check it's properly cleared */
   2032 	ref = pmap_is_referenced(pg);
   2033 	mod = pmap_is_modified(pg);
   2034 	printf("Checking cleared page: ref %d, mod %d\n", ref, mod);
   2035 
   2036 	/* Modify page */
   2037 	*loc = 1;
   2038 
   2039 	ref = pmap_is_referenced(pg);
   2040 	mod = pmap_is_modified(pg);
   2041 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2042 
   2043 	/* Check pmap_protect() */
   2044 	pmap_protect(pmap_kernel(), va, va + PAGE_SIZE, VM_PROT_READ);
   2045 	pmap_update(pmap_kernel());
   2046 	ref = pmap_is_referenced(pg);
   2047 	mod = pmap_is_modified(pg);
   2048 	printf("pmap_protect(VM_PROT_READ): ref %d, mod %d\n", ref, mod);
   2049 
   2050 	/* Now clear reference and modify */
   2051 	ref = pmap_clear_reference(pg);
   2052 	mod = pmap_clear_modify(pg);
   2053 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2054 	    (void *)(u_long)va, (long)pa, ref, mod);
   2055 
   2056 	/* Reference page */
   2057 	val = *loc;
   2058 
   2059 	ref = pmap_is_referenced(pg);
   2060 	mod = pmap_is_modified(pg);
   2061 	printf("Referenced page: ref %d, mod %d val %x\n", ref, mod, val);
   2062 
   2063 	/* Now clear reference and modify */
   2064 	ref = pmap_clear_reference(pg);
   2065 	mod = pmap_clear_modify(pg);
   2066 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2067 	    (void *)(u_long)va, (long)pa, ref, mod);
   2068 
   2069 	/* Modify page */
   2070 #if 0
   2071 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
   2072 	pmap_update(pmap_kernel());
   2073 #endif
   2074 	*loc = 1;
   2075 
   2076 	ref = pmap_is_referenced(pg);
   2077 	mod = pmap_is_modified(pg);
   2078 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2079 
   2080 	/* Check pmap_protect() */
   2081 	pmap_protect(pmap_kernel(), va, va + PAGE_SIZE, VM_PROT_NONE);
   2082 	pmap_update(pmap_kernel());
   2083 	ref = pmap_is_referenced(pg);
   2084 	mod = pmap_is_modified(pg);
   2085 	printf("pmap_protect(): ref %d, mod %d\n", ref, mod);
   2086 
   2087 	/* Now clear reference and modify */
   2088 	ref = pmap_clear_reference(pg);
   2089 	mod = pmap_clear_modify(pg);
   2090 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2091 	    (void *)(u_long)va, (long)pa, ref, mod);
   2092 
   2093 	/* Reference page */
   2094 	val = *loc;
   2095 
   2096 	ref = pmap_is_referenced(pg);
   2097 	mod = pmap_is_modified(pg);
   2098 	printf("Referenced page: ref %d, mod %d val %x\n", ref, mod, val);
   2099 
   2100 	/* Now clear reference and modify */
   2101 	ref = pmap_clear_reference(pg);
   2102 	mod = pmap_clear_modify(pg);
   2103 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2104 	    (void *)(u_long)va, (long)pa, ref, mod);
   2105 
   2106 	/* Modify page */
   2107 #if 0
   2108 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
   2109 	pmap_update(pmap_kernel());
   2110 #endif
   2111 	*loc = 1;
   2112 
   2113 	ref = pmap_is_referenced(pg);
   2114 	mod = pmap_is_modified(pg);
   2115 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2116 
   2117 	/* Check pmap_pag_protect() */
   2118 	pmap_page_protect(pg, VM_PROT_READ);
   2119 	ref = pmap_is_referenced(pg);
   2120 	mod = pmap_is_modified(pg);
   2121 	printf("pmap_page_protect(VM_PROT_READ): ref %d, mod %d\n", ref, mod);
   2122 
   2123 	/* Now clear reference and modify */
   2124 	ref = pmap_clear_reference(pg);
   2125 	mod = pmap_clear_modify(pg);
   2126 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2127 	    (void *)(u_long)va, (long)pa, ref, mod);
   2128 
   2129 	/* Reference page */
   2130 	val = *loc;
   2131 
   2132 	ref = pmap_is_referenced(pg);
   2133 	mod = pmap_is_modified(pg);
   2134 	printf("Referenced page: ref %d, mod %d val %x\n", ref, mod, val);
   2135 
   2136 	/* Now clear reference and modify */
   2137 	ref = pmap_clear_reference(pg);
   2138 	mod = pmap_clear_modify(pg);
   2139 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2140 	    (void *)(u_long)va, (long)pa, ref, mod);
   2141 
   2142 	/* Modify page */
   2143 #if 0
   2144 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
   2145 	pmap_update(pmap_kernel());
   2146 #endif
   2147 	*loc = 1;
   2148 
   2149 	ref = pmap_is_referenced(pg);
   2150 	mod = pmap_is_modified(pg);
   2151 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2152 
   2153 	/* Check pmap_pag_protect() */
   2154 	pmap_page_protect(pg, VM_PROT_NONE);
   2155 	ref = pmap_is_referenced(pg);
   2156 	mod = pmap_is_modified(pg);
   2157 	printf("pmap_page_protect(): ref %d, mod %d\n", ref, mod);
   2158 
   2159 	/* Now clear reference and modify */
   2160 	ref = pmap_clear_reference(pg);
   2161 	mod = pmap_clear_modify(pg);
   2162 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2163 	    (void *)(u_long)va, (long)pa, ref, mod);
   2164 
   2165 
   2166 	/* Reference page */
   2167 	val = *loc;
   2168 
   2169 	ref = pmap_is_referenced(pg);
   2170 	mod = pmap_is_modified(pg);
   2171 	printf("Referenced page: ref %d, mod %d val %x\n", ref, mod, val);
   2172 
   2173 	/* Now clear reference and modify */
   2174 	ref = pmap_clear_reference(pg);
   2175 	mod = pmap_clear_modify(pg);
   2176 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2177 	    (void *)(u_long)va, (long)pa, ref, mod);
   2178 
   2179 	/* Modify page */
   2180 #if 0
   2181 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
   2182 	pmap_update(pmap_kernel());
   2183 #endif
   2184 	*loc = 1;
   2185 
   2186 	ref = pmap_is_referenced(pg);
   2187 	mod = pmap_is_modified(pg);
   2188 	printf("Modified page: ref %d, mod %d\n", ref, mod);
   2189 
   2190 	/* Unmap page */
   2191 	pmap_remove(pmap_kernel(), va, va + PAGE_SIZE);
   2192 	pmap_update(pmap_kernel());
   2193 	ref = pmap_is_referenced(pg);
   2194 	mod = pmap_is_modified(pg);
   2195 	printf("Unmapped page: ref %d, mod %d\n", ref, mod);
   2196 
   2197 	/* Now clear reference and modify */
   2198 	ref = pmap_clear_reference(pg);
   2199 	mod = pmap_clear_modify(pg);
   2200 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
   2201 	    (void *)(u_long)va, (long)pa, ref, mod);
   2202 
   2203 	/* Check it's properly cleared */
   2204 	ref = pmap_is_referenced(pg);
   2205 	mod = pmap_is_modified(pg);
   2206 	printf("Checking cleared page: ref %d, mod %d\n", ref, mod);
   2207 
   2208 	pmap_remove(pmap_kernel(), va, va + PAGE_SIZE);
   2209 	pmap_kenter_pa(va, pa, VM_PROT_ALL, 0);
   2210 	uvm_km_free(kernel_map, (vaddr_t)va, PAGE_SIZE, UVM_KMF_WIRED);
   2211 }
   2212 #endif
   2213