Home | History | Annotate | Line # | Download | only in arm32
pmap.c revision 1.106
      1 /*	$NetBSD: pmap.c,v 1.106 2002/08/09 21:49:09 thorpej Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2002 Wasabi Systems, Inc.
      5  * Copyright (c) 2001 Richard Earnshaw
      6  * Copyright (c) 2001 Christopher Gilbert
      7  * All rights reserved.
      8  *
      9  * 1. Redistributions of source code must retain the above copyright
     10  *    notice, this list of conditions and the following disclaimer.
     11  * 2. Redistributions in binary form must reproduce the above copyright
     12  *    notice, this list of conditions and the following disclaimer in the
     13  *    documentation and/or other materials provided with the distribution.
     14  * 3. The name of the company nor the name of the author may be used to
     15  *    endorse or promote products derived from this software without specific
     16  *    prior written permission.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
     19  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
     20  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     21  * IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
     22  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
     24  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     28  * SUCH DAMAGE.
     29  */
     30 
     31 /*-
     32  * Copyright (c) 1999 The NetBSD Foundation, Inc.
     33  * All rights reserved.
     34  *
     35  * This code is derived from software contributed to The NetBSD Foundation
     36  * by Charles M. Hannum.
     37  *
     38  * Redistribution and use in source and binary forms, with or without
     39  * modification, are permitted provided that the following conditions
     40  * are met:
     41  * 1. Redistributions of source code must retain the above copyright
     42  *    notice, this list of conditions and the following disclaimer.
     43  * 2. Redistributions in binary form must reproduce the above copyright
     44  *    notice, this list of conditions and the following disclaimer in the
     45  *    documentation and/or other materials provided with the distribution.
     46  * 3. All advertising materials mentioning features or use of this software
     47  *    must display the following acknowledgement:
     48  *        This product includes software developed by the NetBSD
     49  *        Foundation, Inc. and its contributors.
     50  * 4. Neither the name of The NetBSD Foundation nor the names of its
     51  *    contributors may be used to endorse or promote products derived
     52  *    from this software without specific prior written permission.
     53  *
     54  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     55  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     56  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     57  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     58  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     59  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     60  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     61  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     62  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     63  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     64  * POSSIBILITY OF SUCH DAMAGE.
     65  */
     66 
     67 /*
     68  * Copyright (c) 1994-1998 Mark Brinicombe.
     69  * Copyright (c) 1994 Brini.
     70  * All rights reserved.
     71  *
     72  * This code is derived from software written for Brini by Mark Brinicombe
     73  *
     74  * Redistribution and use in source and binary forms, with or without
     75  * modification, are permitted provided that the following conditions
     76  * are met:
     77  * 1. Redistributions of source code must retain the above copyright
     78  *    notice, this list of conditions and the following disclaimer.
     79  * 2. Redistributions in binary form must reproduce the above copyright
     80  *    notice, this list of conditions and the following disclaimer in the
     81  *    documentation and/or other materials provided with the distribution.
     82  * 3. All advertising materials mentioning features or use of this software
     83  *    must display the following acknowledgement:
     84  *	This product includes software developed by Mark Brinicombe.
     85  * 4. The name of the author may not be used to endorse or promote products
     86  *    derived from this software without specific prior written permission.
     87  *
     88  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     89  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     90  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     91  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     92  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     93  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     94  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     95  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     96  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     97  *
     98  * RiscBSD kernel project
     99  *
    100  * pmap.c
    101  *
    102  * Machine dependant vm stuff
    103  *
    104  * Created      : 20/09/94
    105  */
    106 
    107 /*
    108  * Performance improvements, UVM changes, overhauls and part-rewrites
    109  * were contributed by Neil A. Carson <neil (at) causality.com>.
    110  */
    111 
    112 /*
    113  * The dram block info is currently referenced from the bootconfig.
    114  * This should be placed in a separate structure.
    115  */
    116 
    117 /*
    118  * Special compilation symbols
    119  * PMAP_DEBUG		- Build in pmap_debug_level code
    120  */
    121 
    122 /* Include header files */
    123 
    124 #include "opt_pmap_debug.h"
    125 #include "opt_ddb.h"
    126 
    127 #include <sys/types.h>
    128 #include <sys/param.h>
    129 #include <sys/kernel.h>
    130 #include <sys/systm.h>
    131 #include <sys/proc.h>
    132 #include <sys/malloc.h>
    133 #include <sys/user.h>
    134 #include <sys/pool.h>
    135 #include <sys/cdefs.h>
    136 
    137 #include <uvm/uvm.h>
    138 
    139 #include <machine/bootconfig.h>
    140 #include <machine/bus.h>
    141 #include <machine/pmap.h>
    142 #include <machine/pcb.h>
    143 #include <machine/param.h>
    144 #include <arm/arm32/katelib.h>
    145 
    146 __KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.106 2002/08/09 21:49:09 thorpej Exp $");
    147 #ifdef PMAP_DEBUG
    148 #define	PDEBUG(_lev_,_stat_) \
    149 	if (pmap_debug_level >= (_lev_)) \
    150         	((_stat_))
    151 int pmap_debug_level = -2;
    152 void pmap_dump_pvlist(vaddr_t phys, char *m);
    153 
    154 /*
    155  * for switching to potentially finer grained debugging
    156  */
    157 #define	PDB_FOLLOW	0x0001
    158 #define	PDB_INIT	0x0002
    159 #define	PDB_ENTER	0x0004
    160 #define	PDB_REMOVE	0x0008
    161 #define	PDB_CREATE	0x0010
    162 #define	PDB_PTPAGE	0x0020
    163 #define	PDB_GROWKERN	0x0040
    164 #define	PDB_BITS	0x0080
    165 #define	PDB_COLLECT	0x0100
    166 #define	PDB_PROTECT	0x0200
    167 #define	PDB_MAP_L1	0x0400
    168 #define	PDB_BOOTSTRAP	0x1000
    169 #define	PDB_PARANOIA	0x2000
    170 #define	PDB_WIRING	0x4000
    171 #define	PDB_PVDUMP	0x8000
    172 
    173 int debugmap = 0;
    174 int pmapdebug = PDB_PARANOIA | PDB_FOLLOW;
    175 #define	NPDEBUG(_lev_,_stat_) \
    176 	if (pmapdebug & (_lev_)) \
    177         	((_stat_))
    178 
    179 #else	/* PMAP_DEBUG */
    180 #define	PDEBUG(_lev_,_stat_) /* Nothing */
    181 #define NPDEBUG(_lev_,_stat_) /* Nothing */
    182 #endif	/* PMAP_DEBUG */
    183 
    184 struct pmap     kernel_pmap_store;
    185 
    186 /*
    187  * linked list of all non-kernel pmaps
    188  */
    189 
    190 static LIST_HEAD(, pmap) pmaps;
    191 
    192 /*
    193  * pool that pmap structures are allocated from
    194  */
    195 
    196 struct pool pmap_pmap_pool;
    197 
    198 static pt_entry_t *csrc_pte, *cdst_pte;
    199 static vaddr_t csrcp, cdstp;
    200 
    201 char *memhook;
    202 extern caddr_t msgbufaddr;
    203 
    204 boolean_t pmap_initialized = FALSE;	/* Has pmap_init completed? */
    205 /*
    206  * locking data structures
    207  */
    208 
    209 static struct lock pmap_main_lock;
    210 static struct simplelock pvalloc_lock;
    211 static struct simplelock pmaps_lock;
    212 #ifdef LOCKDEBUG
    213 #define PMAP_MAP_TO_HEAD_LOCK() \
    214      (void) spinlockmgr(&pmap_main_lock, LK_SHARED, NULL)
    215 #define PMAP_MAP_TO_HEAD_UNLOCK() \
    216      (void) spinlockmgr(&pmap_main_lock, LK_RELEASE, NULL)
    217 
    218 #define PMAP_HEAD_TO_MAP_LOCK() \
    219      (void) spinlockmgr(&pmap_main_lock, LK_EXCLUSIVE, NULL)
    220 #define PMAP_HEAD_TO_MAP_UNLOCK() \
    221      (void) spinlockmgr(&pmap_main_lock, LK_RELEASE, NULL)
    222 #else
    223 #define	PMAP_MAP_TO_HEAD_LOCK()		/* nothing */
    224 #define	PMAP_MAP_TO_HEAD_UNLOCK()	/* nothing */
    225 #define	PMAP_HEAD_TO_MAP_LOCK()		/* nothing */
    226 #define	PMAP_HEAD_TO_MAP_UNLOCK()	/* nothing */
    227 #endif /* LOCKDEBUG */
    228 
    229 /*
    230  * pv_page management structures: locked by pvalloc_lock
    231  */
    232 
    233 TAILQ_HEAD(pv_pagelist, pv_page);
    234 static struct pv_pagelist pv_freepages;	/* list of pv_pages with free entrys */
    235 static struct pv_pagelist pv_unusedpgs; /* list of unused pv_pages */
    236 static int pv_nfpvents;			/* # of free pv entries */
    237 static struct pv_page *pv_initpage;	/* bootstrap page from kernel_map */
    238 static vaddr_t pv_cachedva;		/* cached VA for later use */
    239 
    240 #define PVE_LOWAT (PVE_PER_PVPAGE / 2)	/* free pv_entry low water mark */
    241 #define PVE_HIWAT (PVE_LOWAT + (PVE_PER_PVPAGE * 2))
    242 					/* high water mark */
    243 
    244 /*
    245  * local prototypes
    246  */
    247 
    248 static struct pv_entry	*pmap_add_pvpage __P((struct pv_page *, boolean_t));
    249 static struct pv_entry	*pmap_alloc_pv __P((struct pmap *, int)); /* see codes below */
    250 #define ALLOCPV_NEED	0	/* need PV now */
    251 #define ALLOCPV_TRY	1	/* just try to allocate, don't steal */
    252 #define ALLOCPV_NONEED	2	/* don't need PV, just growing cache */
    253 static struct pv_entry	*pmap_alloc_pvpage __P((struct pmap *, int));
    254 static void		 pmap_enter_pv __P((struct vm_page *,
    255 					    struct pv_entry *, struct pmap *,
    256 					    vaddr_t, struct vm_page *, int));
    257 static void		 pmap_free_pv __P((struct pmap *, struct pv_entry *));
    258 static void		 pmap_free_pvs __P((struct pmap *, struct pv_entry *));
    259 static void		 pmap_free_pv_doit __P((struct pv_entry *));
    260 static void		 pmap_free_pvpage __P((void));
    261 static boolean_t	 pmap_is_curpmap __P((struct pmap *));
    262 static struct pv_entry	*pmap_remove_pv __P((struct vm_page *, struct pmap *,
    263 			vaddr_t));
    264 #define PMAP_REMOVE_ALL		0	/* remove all mappings */
    265 #define PMAP_REMOVE_SKIPWIRED	1	/* skip wired mappings */
    266 
    267 static u_int pmap_modify_pv __P((struct pmap *, vaddr_t, struct vm_page *,
    268 	u_int, u_int));
    269 
    270 /*
    271  * Structure that describes and L1 table.
    272  */
    273 struct l1pt {
    274 	SIMPLEQ_ENTRY(l1pt)	pt_queue;	/* Queue pointers */
    275 	struct pglist		pt_plist;	/* Allocated page list */
    276 	vaddr_t			pt_va;		/* Allocated virtual address */
    277 	int			pt_flags;	/* Flags */
    278 };
    279 #define	PTFLAG_STATIC		0x01		/* Statically allocated */
    280 #define	PTFLAG_KPT		0x02		/* Kernel pt's are mapped */
    281 #define	PTFLAG_CLEAN		0x04		/* L1 is clean */
    282 
    283 static void pmap_free_l1pt __P((struct l1pt *));
    284 static int pmap_allocpagedir __P((struct pmap *));
    285 static int pmap_clean_page __P((struct pv_entry *, boolean_t));
    286 static void pmap_remove_all __P((struct vm_page *));
    287 
    288 static int pmap_alloc_ptpt(struct pmap *);
    289 static void pmap_free_ptpt(struct pmap *);
    290 
    291 static struct vm_page	*pmap_alloc_ptp __P((struct pmap *, vaddr_t));
    292 static struct vm_page	*pmap_get_ptp __P((struct pmap *, vaddr_t));
    293 __inline static void pmap_clearbit __P((struct vm_page *, unsigned int));
    294 
    295 extern paddr_t physical_start;
    296 extern paddr_t physical_end;
    297 extern unsigned int free_pages;
    298 extern int max_processes;
    299 
    300 vaddr_t virtual_avail;
    301 vaddr_t virtual_end;
    302 vaddr_t pmap_curmaxkvaddr;
    303 
    304 vaddr_t avail_start;
    305 vaddr_t avail_end;
    306 
    307 extern pv_addr_t systempage;
    308 
    309 /* Variables used by the L1 page table queue code */
    310 SIMPLEQ_HEAD(l1pt_queue, l1pt);
    311 static struct l1pt_queue l1pt_static_queue; /* head of our static l1 queue */
    312 static int l1pt_static_queue_count;	    /* items in the static l1 queue */
    313 static int l1pt_static_create_count;	    /* static l1 items created */
    314 static struct l1pt_queue l1pt_queue;	    /* head of our l1 queue */
    315 static int l1pt_queue_count;		    /* items in the l1 queue */
    316 static int l1pt_create_count;		    /* stat - L1's create count */
    317 static int l1pt_reuse_count;		    /* stat - L1's reused count */
    318 
    319 /* Local function prototypes (not used outside this file) */
    320 void pmap_pinit __P((struct pmap *));
    321 void pmap_freepagedir __P((struct pmap *));
    322 
    323 /* Other function prototypes */
    324 extern void bzero_page __P((vaddr_t));
    325 extern void bcopy_page __P((vaddr_t, vaddr_t));
    326 
    327 struct l1pt *pmap_alloc_l1pt __P((void));
    328 static __inline void pmap_map_in_l1 __P((struct pmap *pmap, vaddr_t va,
    329      vaddr_t l2pa, boolean_t));
    330 
    331 static pt_entry_t *pmap_map_ptes __P((struct pmap *));
    332 static void pmap_unmap_ptes __P((struct pmap *));
    333 
    334 __inline static void pmap_vac_me_harder __P((struct pmap *, struct vm_page *,
    335     pt_entry_t *, boolean_t));
    336 static void pmap_vac_me_kpmap __P((struct pmap *, struct vm_page *,
    337     pt_entry_t *, boolean_t));
    338 static void pmap_vac_me_user __P((struct pmap *, struct vm_page *,
    339     pt_entry_t *, boolean_t));
    340 
    341 /*
    342  * real definition of pv_entry.
    343  */
    344 
    345 struct pv_entry {
    346 	struct pv_entry *pv_next;       /* next pv_entry */
    347 	struct pmap     *pv_pmap;        /* pmap where mapping lies */
    348 	vaddr_t         pv_va;          /* virtual address for mapping */
    349 	int             pv_flags;       /* flags */
    350 	struct vm_page	*pv_ptp;	/* vm_page for the ptp */
    351 };
    352 
    353 /*
    354  * pv_entrys are dynamically allocated in chunks from a single page.
    355  * we keep track of how many pv_entrys are in use for each page and
    356  * we can free pv_entry pages if needed.  there is one lock for the
    357  * entire allocation system.
    358  */
    359 
    360 struct pv_page_info {
    361 	TAILQ_ENTRY(pv_page) pvpi_list;
    362 	struct pv_entry *pvpi_pvfree;
    363 	int pvpi_nfree;
    364 };
    365 
    366 /*
    367  * number of pv_entry's in a pv_page
    368  * (note: won't work on systems where NPBG isn't a constant)
    369  */
    370 
    371 #define PVE_PER_PVPAGE ((NBPG - sizeof(struct pv_page_info)) / \
    372 			sizeof(struct pv_entry))
    373 
    374 /*
    375  * a pv_page: where pv_entrys are allocated from
    376  */
    377 
    378 struct pv_page {
    379 	struct pv_page_info pvinfo;
    380 	struct pv_entry pvents[PVE_PER_PVPAGE];
    381 };
    382 
    383 #ifdef MYCROFT_HACK
    384 int mycroft_hack = 0;
    385 #endif
    386 
    387 /* Function to set the debug level of the pmap code */
    388 
    389 #ifdef PMAP_DEBUG
    390 void
    391 pmap_debug(int level)
    392 {
    393 	pmap_debug_level = level;
    394 	printf("pmap_debug: level=%d\n", pmap_debug_level);
    395 }
    396 #endif	/* PMAP_DEBUG */
    397 
    398 __inline static boolean_t
    399 pmap_is_curpmap(struct pmap *pmap)
    400 {
    401 
    402 	if ((curproc && curproc->p_vmspace->vm_map.pmap == pmap) ||
    403 	    pmap == pmap_kernel())
    404 		return (TRUE);
    405 
    406 	return (FALSE);
    407 }
    408 
    409 /*
    410  * p v _ e n t r y   f u n c t i o n s
    411  */
    412 
    413 /*
    414  * pv_entry allocation functions:
    415  *   the main pv_entry allocation functions are:
    416  *     pmap_alloc_pv: allocate a pv_entry structure
    417  *     pmap_free_pv: free one pv_entry
    418  *     pmap_free_pvs: free a list of pv_entrys
    419  *
    420  * the rest are helper functions
    421  */
    422 
    423 /*
    424  * pmap_alloc_pv: inline function to allocate a pv_entry structure
    425  * => we lock pvalloc_lock
    426  * => if we fail, we call out to pmap_alloc_pvpage
    427  * => 3 modes:
    428  *    ALLOCPV_NEED   = we really need a pv_entry, even if we have to steal it
    429  *    ALLOCPV_TRY    = we want a pv_entry, but not enough to steal
    430  *    ALLOCPV_NONEED = we are trying to grow our free list, don't really need
    431  *			one now
    432  *
    433  * "try" is for optional functions like pmap_copy().
    434  */
    435 
    436 __inline static struct pv_entry *
    437 pmap_alloc_pv(struct pmap *pmap, int mode)
    438 {
    439 	struct pv_page *pvpage;
    440 	struct pv_entry *pv;
    441 
    442 	simple_lock(&pvalloc_lock);
    443 
    444 	pvpage = TAILQ_FIRST(&pv_freepages);
    445 
    446 	if (pvpage != NULL) {
    447 		pvpage->pvinfo.pvpi_nfree--;
    448 		if (pvpage->pvinfo.pvpi_nfree == 0) {
    449 			/* nothing left in this one? */
    450 			TAILQ_REMOVE(&pv_freepages, pvpage, pvinfo.pvpi_list);
    451 		}
    452 		pv = pvpage->pvinfo.pvpi_pvfree;
    453 		KASSERT(pv);
    454 		pvpage->pvinfo.pvpi_pvfree = pv->pv_next;
    455 		pv_nfpvents--;  /* took one from pool */
    456 	} else {
    457 		pv = NULL;		/* need more of them */
    458 	}
    459 
    460 	/*
    461 	 * if below low water mark or we didn't get a pv_entry we try and
    462 	 * create more pv_entrys ...
    463 	 */
    464 
    465 	if (pv_nfpvents < PVE_LOWAT || pv == NULL) {
    466 		if (pv == NULL)
    467 			pv = pmap_alloc_pvpage(pmap, (mode == ALLOCPV_TRY) ?
    468 					       mode : ALLOCPV_NEED);
    469 		else
    470 			(void) pmap_alloc_pvpage(pmap, ALLOCPV_NONEED);
    471 	}
    472 
    473 	simple_unlock(&pvalloc_lock);
    474 	return(pv);
    475 }
    476 
    477 /*
    478  * pmap_alloc_pvpage: maybe allocate a new pvpage
    479  *
    480  * if need_entry is false: try and allocate a new pv_page
    481  * if need_entry is true: try and allocate a new pv_page and return a
    482  *	new pv_entry from it.   if we are unable to allocate a pv_page
    483  *	we make a last ditch effort to steal a pv_page from some other
    484  *	mapping.    if that fails, we panic...
    485  *
    486  * => we assume that the caller holds pvalloc_lock
    487  */
    488 
    489 static struct pv_entry *
    490 pmap_alloc_pvpage(struct pmap *pmap, int mode)
    491 {
    492 	struct vm_page *pg;
    493 	struct pv_page *pvpage;
    494 	struct pv_entry *pv;
    495 	int s;
    496 
    497 	/*
    498 	 * if we need_entry and we've got unused pv_pages, allocate from there
    499 	 */
    500 
    501 	pvpage = TAILQ_FIRST(&pv_unusedpgs);
    502 	if (mode != ALLOCPV_NONEED && pvpage != NULL) {
    503 
    504 		/* move it to pv_freepages list */
    505 		TAILQ_REMOVE(&pv_unusedpgs, pvpage, pvinfo.pvpi_list);
    506 		TAILQ_INSERT_HEAD(&pv_freepages, pvpage, pvinfo.pvpi_list);
    507 
    508 		/* allocate a pv_entry */
    509 		pvpage->pvinfo.pvpi_nfree--;	/* can't go to zero */
    510 		pv = pvpage->pvinfo.pvpi_pvfree;
    511 		KASSERT(pv);
    512 		pvpage->pvinfo.pvpi_pvfree = pv->pv_next;
    513 
    514 		pv_nfpvents--;  /* took one from pool */
    515 		return(pv);
    516 	}
    517 
    518 	/*
    519 	 *  see if we've got a cached unmapped VA that we can map a page in.
    520 	 * if not, try to allocate one.
    521 	 */
    522 
    523 
    524 	if (pv_cachedva == 0) {
    525 		s = splvm();
    526 		pv_cachedva = uvm_km_kmemalloc(kmem_map, NULL,
    527 		    PAGE_SIZE, UVM_KMF_TRYLOCK|UVM_KMF_VALLOC);
    528 		splx(s);
    529 		if (pv_cachedva == 0) {
    530 			return (NULL);
    531 		}
    532 	}
    533 
    534 	pg = uvm_pagealloc(NULL, pv_cachedva - vm_map_min(kernel_map), NULL,
    535 	    UVM_PGA_USERESERVE);
    536 
    537 	if (pg == NULL)
    538 		return (NULL);
    539 	pg->flags &= ~PG_BUSY;	/* never busy */
    540 
    541 	/*
    542 	 * add a mapping for our new pv_page and free its entrys (save one!)
    543 	 *
    544 	 * NOTE: If we are allocating a PV page for the kernel pmap, the
    545 	 * pmap is already locked!  (...but entering the mapping is safe...)
    546 	 */
    547 
    548 	pmap_kenter_pa(pv_cachedva, VM_PAGE_TO_PHYS(pg),
    549 		VM_PROT_READ|VM_PROT_WRITE);
    550 	pmap_update(pmap_kernel());
    551 	pvpage = (struct pv_page *) pv_cachedva;
    552 	pv_cachedva = 0;
    553 	return (pmap_add_pvpage(pvpage, mode != ALLOCPV_NONEED));
    554 }
    555 
    556 /*
    557  * pmap_add_pvpage: add a pv_page's pv_entrys to the free list
    558  *
    559  * => caller must hold pvalloc_lock
    560  * => if need_entry is true, we allocate and return one pv_entry
    561  */
    562 
    563 static struct pv_entry *
    564 pmap_add_pvpage(struct pv_page *pvp, boolean_t need_entry)
    565 {
    566 	int tofree, lcv;
    567 
    568 	/* do we need to return one? */
    569 	tofree = (need_entry) ? PVE_PER_PVPAGE - 1 : PVE_PER_PVPAGE;
    570 
    571 	pvp->pvinfo.pvpi_pvfree = NULL;
    572 	pvp->pvinfo.pvpi_nfree = tofree;
    573 	for (lcv = 0 ; lcv < tofree ; lcv++) {
    574 		pvp->pvents[lcv].pv_next = pvp->pvinfo.pvpi_pvfree;
    575 		pvp->pvinfo.pvpi_pvfree = &pvp->pvents[lcv];
    576 	}
    577 	if (need_entry)
    578 		TAILQ_INSERT_TAIL(&pv_freepages, pvp, pvinfo.pvpi_list);
    579 	else
    580 		TAILQ_INSERT_TAIL(&pv_unusedpgs, pvp, pvinfo.pvpi_list);
    581 	pv_nfpvents += tofree;
    582 	return((need_entry) ? &pvp->pvents[lcv] : NULL);
    583 }
    584 
    585 /*
    586  * pmap_free_pv_doit: actually free a pv_entry
    587  *
    588  * => do not call this directly!  instead use either
    589  *    1. pmap_free_pv ==> free a single pv_entry
    590  *    2. pmap_free_pvs => free a list of pv_entrys
    591  * => we must be holding pvalloc_lock
    592  */
    593 
    594 __inline static void
    595 pmap_free_pv_doit(struct pv_entry *pv)
    596 {
    597 	struct pv_page *pvp;
    598 
    599 	pvp = (struct pv_page *) arm_trunc_page((vaddr_t)pv);
    600 	pv_nfpvents++;
    601 	pvp->pvinfo.pvpi_nfree++;
    602 
    603 	/* nfree == 1 => fully allocated page just became partly allocated */
    604 	if (pvp->pvinfo.pvpi_nfree == 1) {
    605 		TAILQ_INSERT_HEAD(&pv_freepages, pvp, pvinfo.pvpi_list);
    606 	}
    607 
    608 	/* free it */
    609 	pv->pv_next = pvp->pvinfo.pvpi_pvfree;
    610 	pvp->pvinfo.pvpi_pvfree = pv;
    611 
    612 	/*
    613 	 * are all pv_page's pv_entry's free?  move it to unused queue.
    614 	 */
    615 
    616 	if (pvp->pvinfo.pvpi_nfree == PVE_PER_PVPAGE) {
    617 		TAILQ_REMOVE(&pv_freepages, pvp, pvinfo.pvpi_list);
    618 		TAILQ_INSERT_HEAD(&pv_unusedpgs, pvp, pvinfo.pvpi_list);
    619 	}
    620 }
    621 
    622 /*
    623  * pmap_free_pv: free a single pv_entry
    624  *
    625  * => we gain the pvalloc_lock
    626  */
    627 
    628 __inline static void
    629 pmap_free_pv(struct pmap *pmap, struct pv_entry *pv)
    630 {
    631 	simple_lock(&pvalloc_lock);
    632 	pmap_free_pv_doit(pv);
    633 
    634 	/*
    635 	 * Can't free the PV page if the PV entries were associated with
    636 	 * the kernel pmap; the pmap is already locked.
    637 	 */
    638 	if (pv_nfpvents > PVE_HIWAT && TAILQ_FIRST(&pv_unusedpgs) != NULL &&
    639 	    pmap != pmap_kernel())
    640 		pmap_free_pvpage();
    641 
    642 	simple_unlock(&pvalloc_lock);
    643 }
    644 
    645 /*
    646  * pmap_free_pvs: free a list of pv_entrys
    647  *
    648  * => we gain the pvalloc_lock
    649  */
    650 
    651 __inline static void
    652 pmap_free_pvs(struct pmap *pmap, struct pv_entry *pvs)
    653 {
    654 	struct pv_entry *nextpv;
    655 
    656 	simple_lock(&pvalloc_lock);
    657 
    658 	for ( /* null */ ; pvs != NULL ; pvs = nextpv) {
    659 		nextpv = pvs->pv_next;
    660 		pmap_free_pv_doit(pvs);
    661 	}
    662 
    663 	/*
    664 	 * Can't free the PV page if the PV entries were associated with
    665 	 * the kernel pmap; the pmap is already locked.
    666 	 */
    667 	if (pv_nfpvents > PVE_HIWAT && TAILQ_FIRST(&pv_unusedpgs) != NULL &&
    668 	    pmap != pmap_kernel())
    669 		pmap_free_pvpage();
    670 
    671 	simple_unlock(&pvalloc_lock);
    672 }
    673 
    674 
    675 /*
    676  * pmap_free_pvpage: try and free an unused pv_page structure
    677  *
    678  * => assume caller is holding the pvalloc_lock and that
    679  *	there is a page on the pv_unusedpgs list
    680  * => if we can't get a lock on the kmem_map we try again later
    681  */
    682 
    683 static void
    684 pmap_free_pvpage(void)
    685 {
    686 	int s;
    687 	struct vm_map *map;
    688 	struct vm_map_entry *dead_entries;
    689 	struct pv_page *pvp;
    690 
    691 	s = splvm(); /* protect kmem_map */
    692 
    693 	pvp = TAILQ_FIRST(&pv_unusedpgs);
    694 
    695 	/*
    696 	 * note: watch out for pv_initpage which is allocated out of
    697 	 * kernel_map rather than kmem_map.
    698 	 */
    699 	if (pvp == pv_initpage)
    700 		map = kernel_map;
    701 	else
    702 		map = kmem_map;
    703 	if (vm_map_lock_try(map)) {
    704 
    705 		/* remove pvp from pv_unusedpgs */
    706 		TAILQ_REMOVE(&pv_unusedpgs, pvp, pvinfo.pvpi_list);
    707 
    708 		/* unmap the page */
    709 		dead_entries = NULL;
    710 		uvm_unmap_remove(map, (vaddr_t)pvp, ((vaddr_t)pvp) + PAGE_SIZE,
    711 		    &dead_entries);
    712 		vm_map_unlock(map);
    713 
    714 		if (dead_entries != NULL)
    715 			uvm_unmap_detach(dead_entries, 0);
    716 
    717 		pv_nfpvents -= PVE_PER_PVPAGE;  /* update free count */
    718 	}
    719 	if (pvp == pv_initpage)
    720 		/* no more initpage, we've freed it */
    721 		pv_initpage = NULL;
    722 
    723 	splx(s);
    724 }
    725 
    726 /*
    727  * main pv_entry manipulation functions:
    728  *   pmap_enter_pv: enter a mapping onto a vm_page list
    729  *   pmap_remove_pv: remove a mappiing from a vm_page list
    730  *
    731  * NOTE: pmap_enter_pv expects to lock the pvh itself
    732  *       pmap_remove_pv expects te caller to lock the pvh before calling
    733  */
    734 
    735 /*
    736  * pmap_enter_pv: enter a mapping onto a vm_page lst
    737  *
    738  * => caller should hold the proper lock on pmap_main_lock
    739  * => caller should have pmap locked
    740  * => we will gain the lock on the vm_page and allocate the new pv_entry
    741  * => caller should adjust ptp's wire_count before calling
    742  * => caller should not adjust pmap's wire_count
    743  */
    744 
    745 __inline static void
    746 pmap_enter_pv(struct vm_page *pg, struct pv_entry *pve, struct pmap *pmap,
    747     vaddr_t va, struct vm_page *ptp, int flags)
    748 {
    749 	pve->pv_pmap = pmap;
    750 	pve->pv_va = va;
    751 	pve->pv_ptp = ptp;			/* NULL for kernel pmap */
    752 	pve->pv_flags = flags;
    753 	simple_lock(&pg->mdpage.pvh_slock);	/* lock vm_page */
    754 	pve->pv_next = pg->mdpage.pvh_list;	/* add to ... */
    755 	pg->mdpage.pvh_list = pve;		/* ... locked list */
    756 	simple_unlock(&pg->mdpage.pvh_slock);	/* unlock, done! */
    757 	if (pve->pv_flags & PVF_WIRED)
    758 		++pmap->pm_stats.wired_count;
    759 #ifdef PMAP_ALIAS_DEBUG
    760     {
    761 	int s = splhigh();
    762 	if (pve->pv_flags & PVF_WRITE)
    763 		pg->mdpage.rw_mappings++;
    764 	else
    765 		pg->mdpage.ro_mappings++;
    766 	if (pg->mdpage.rw_mappings != 0 &&
    767 	    (pg->mdpage.kro_mappings != 0 || pg->mdpage.krw_mappings != 0)) {
    768 		printf("pmap_enter_pv: rw %u, kro %u, krw %u\n",
    769 		    pg->mdpage.rw_mappings, pg->mdpage.kro_mappings,
    770 		    pg->mdpage.krw_mappings);
    771 	}
    772 	splx(s);
    773     }
    774 #endif /* PMAP_ALIAS_DEBUG */
    775 }
    776 
    777 /*
    778  * pmap_remove_pv: try to remove a mapping from a pv_list
    779  *
    780  * => caller should hold proper lock on pmap_main_lock
    781  * => pmap should be locked
    782  * => caller should hold lock on vm_page [so that attrs can be adjusted]
    783  * => caller should adjust ptp's wire_count and free PTP if needed
    784  * => caller should NOT adjust pmap's wire_count
    785  * => we return the removed pve
    786  */
    787 
    788 __inline static struct pv_entry *
    789 pmap_remove_pv(struct vm_page *pg, struct pmap *pmap, vaddr_t va)
    790 {
    791 	struct pv_entry *pve, **prevptr;
    792 
    793 	prevptr = &pg->mdpage.pvh_list;		/* previous pv_entry pointer */
    794 	pve = *prevptr;
    795 	while (pve) {
    796 		if (pve->pv_pmap == pmap && pve->pv_va == va) {	/* match? */
    797 			*prevptr = pve->pv_next;		/* remove it! */
    798 			if (pve->pv_flags & PVF_WIRED)
    799 			    --pmap->pm_stats.wired_count;
    800 #ifdef PMAP_ALIAS_DEBUG
    801     {
    802 			int s = splhigh();
    803 			if (pve->pv_flags & PVF_WRITE) {
    804 				KASSERT(pg->mdpage.rw_mappings != 0);
    805 				pg->mdpage.rw_mappings--;
    806 			} else {
    807 				KASSERT(pg->mdpage.ro_mappings != 0);
    808 				pg->mdpage.ro_mappings--;
    809 			}
    810 			splx(s);
    811     }
    812 #endif /* PMAP_ALIAS_DEBUG */
    813 			break;
    814 		}
    815 		prevptr = &pve->pv_next;		/* previous pointer */
    816 		pve = pve->pv_next;			/* advance */
    817 	}
    818 	return(pve);				/* return removed pve */
    819 }
    820 
    821 /*
    822  *
    823  * pmap_modify_pv: Update pv flags
    824  *
    825  * => caller should hold lock on vm_page [so that attrs can be adjusted]
    826  * => caller should NOT adjust pmap's wire_count
    827  * => caller must call pmap_vac_me_harder() if writable status of a page
    828  *    may have changed.
    829  * => we return the old flags
    830  *
    831  * Modify a physical-virtual mapping in the pv table
    832  */
    833 
    834 static /* __inline */ u_int
    835 pmap_modify_pv(struct pmap *pmap, vaddr_t va, struct vm_page *pg,
    836     u_int bic_mask, u_int eor_mask)
    837 {
    838 	struct pv_entry *npv;
    839 	u_int flags, oflags;
    840 
    841 	/*
    842 	 * There is at least one VA mapping this page.
    843 	 */
    844 
    845 	for (npv = pg->mdpage.pvh_list; npv; npv = npv->pv_next) {
    846 		if (pmap == npv->pv_pmap && va == npv->pv_va) {
    847 			oflags = npv->pv_flags;
    848 			npv->pv_flags = flags =
    849 			    ((oflags & ~bic_mask) ^ eor_mask);
    850 			if ((flags ^ oflags) & PVF_WIRED) {
    851 				if (flags & PVF_WIRED)
    852 					++pmap->pm_stats.wired_count;
    853 				else
    854 					--pmap->pm_stats.wired_count;
    855 			}
    856 #ifdef PMAP_ALIAS_DEBUG
    857     {
    858 			int s = splhigh();
    859 			if ((flags ^ oflags) & PVF_WRITE) {
    860 				if (flags & PVF_WRITE) {
    861 					pg->mdpage.rw_mappings++;
    862 					pg->mdpage.ro_mappings--;
    863 					if (pg->mdpage.rw_mappings != 0 &&
    864 					    (pg->mdpage.kro_mappings != 0 ||
    865 					     pg->mdpage.krw_mappings != 0)) {
    866 						printf("pmap_modify_pv: rw %u, "
    867 						    "kro %u, krw %u\n",
    868 						    pg->mdpage.rw_mappings,
    869 						    pg->mdpage.kro_mappings,
    870 						    pg->mdpage.krw_mappings);
    871 					}
    872 				} else {
    873 					KASSERT(pg->mdpage.rw_mappings != 0);
    874 					pg->mdpage.rw_mappings--;
    875 					pg->mdpage.ro_mappings++;
    876 				}
    877 			}
    878 			splx(s);
    879     }
    880 #endif /* PMAP_ALIAS_DEBUG */
    881 			return (oflags);
    882 		}
    883 	}
    884 	return (0);
    885 }
    886 
    887 /*
    888  * Map the specified level 2 pagetable into the level 1 page table for
    889  * the given pmap to cover a chunk of virtual address space starting from the
    890  * address specified.
    891  */
    892 static __inline void
    893 pmap_map_in_l1(struct pmap *pmap, vaddr_t va, paddr_t l2pa, boolean_t selfref)
    894 {
    895 	vaddr_t ptva;
    896 
    897 	/* Calculate the index into the L1 page table. */
    898 	ptva = (va >> L1_S_SHIFT) & ~3;
    899 
    900 	/* Map page table into the L1. */
    901 	pmap->pm_pdir[ptva + 0] = L1_C_PROTO | (l2pa + 0x000);
    902 	pmap->pm_pdir[ptva + 1] = L1_C_PROTO | (l2pa + 0x400);
    903 	pmap->pm_pdir[ptva + 2] = L1_C_PROTO | (l2pa + 0x800);
    904 	pmap->pm_pdir[ptva + 3] = L1_C_PROTO | (l2pa + 0xc00);
    905 
    906 	/* Map the page table into the page table area. */
    907 	if (selfref)
    908 		*((pt_entry_t *)(pmap->pm_vptpt + ptva)) = L2_S_PROTO | l2pa |
    909 		    L2_S_PROT(PTE_KERNEL, VM_PROT_READ|VM_PROT_WRITE);
    910 }
    911 
    912 #if 0
    913 static __inline void
    914 pmap_unmap_in_l1(struct pmap *pmap, vaddr_t va)
    915 {
    916 	vaddr_t ptva;
    917 
    918 	/* Calculate the index into the L1 page table. */
    919 	ptva = (va >> L1_S_SHIFT) & ~3;
    920 
    921 	/* Unmap page table from the L1. */
    922 	pmap->pm_pdir[ptva + 0] = 0;
    923 	pmap->pm_pdir[ptva + 1] = 0;
    924 	pmap->pm_pdir[ptva + 2] = 0;
    925 	pmap->pm_pdir[ptva + 3] = 0;
    926 
    927 	/* Unmap the page table from the page table area. */
    928 	*((pt_entry_t *)(pmap->pm_vptpt + ptva)) = 0;
    929 }
    930 #endif
    931 
    932 /*
    933  *	Used to map a range of physical addresses into kernel
    934  *	virtual address space.
    935  *
    936  *	For now, VM is already on, we only need to map the
    937  *	specified memory.
    938  *
    939  *	XXX This routine should eventually go away; it's only used
    940  *	XXX by machine-dependent crash dump code.
    941  */
    942 vaddr_t
    943 pmap_map(vaddr_t va, paddr_t spa, paddr_t epa, vm_prot_t prot)
    944 {
    945 	pt_entry_t *pte;
    946 
    947 	while (spa < epa) {
    948 		pte = vtopte(va);
    949 
    950 		*pte = L2_S_PROTO | spa |
    951 		    L2_S_PROT(PTE_KERNEL, prot) | pte_l2_s_cache_mode;
    952 		cpu_tlb_flushID_SE(va);
    953 		va += NBPG;
    954 		spa += NBPG;
    955 	}
    956 	pmap_update(pmap_kernel());
    957 	return(va);
    958 }
    959 
    960 
    961 /*
    962  * void pmap_bootstrap(pd_entry_t *kernel_l1pt, pv_addr_t kernel_ptpt)
    963  *
    964  * bootstrap the pmap system. This is called from initarm and allows
    965  * the pmap system to initailise any structures it requires.
    966  *
    967  * Currently this sets up the kernel_pmap that is statically allocated
    968  * and also allocated virtual addresses for certain page hooks.
    969  * Currently the only one page hook is allocated that is used
    970  * to zero physical pages of memory.
    971  * It also initialises the start and end address of the kernel data space.
    972  */
    973 
    974 char *boot_head;
    975 
    976 void
    977 pmap_bootstrap(pd_entry_t *kernel_l1pt, pv_addr_t kernel_ptpt)
    978 {
    979 	pt_entry_t *pte;
    980 
    981 	pmap_kernel()->pm_pdir = kernel_l1pt;
    982 	pmap_kernel()->pm_pptpt = kernel_ptpt.pv_pa;
    983 	pmap_kernel()->pm_vptpt = kernel_ptpt.pv_va;
    984 	simple_lock_init(&pmap_kernel()->pm_lock);
    985 	pmap_kernel()->pm_obj.pgops = NULL;
    986 	TAILQ_INIT(&(pmap_kernel()->pm_obj.memq));
    987 	pmap_kernel()->pm_obj.uo_npages = 0;
    988 	pmap_kernel()->pm_obj.uo_refs = 1;
    989 
    990 	virtual_avail = KERNEL_VM_BASE;
    991 	virtual_end = KERNEL_VM_BASE + KERNEL_VM_SIZE;
    992 
    993 	/*
    994 	 * now we allocate the "special" VAs which are used for tmp mappings
    995 	 * by the pmap (and other modules).  we allocate the VAs by advancing
    996 	 * virtual_avail (note that there are no pages mapped at these VAs).
    997 	 * we find the PTE that maps the allocated VA via the linear PTE
    998 	 * mapping.
    999 	 */
   1000 
   1001 	pte = ((pt_entry_t *) PTE_BASE) + atop(virtual_avail);
   1002 
   1003 	csrcp = virtual_avail; csrc_pte = pte;
   1004 	virtual_avail += PAGE_SIZE; pte++;
   1005 
   1006 	cdstp = virtual_avail; cdst_pte = pte;
   1007 	virtual_avail += PAGE_SIZE; pte++;
   1008 
   1009 	memhook = (char *) virtual_avail;	/* don't need pte */
   1010 	virtual_avail += PAGE_SIZE; pte++;
   1011 
   1012 	msgbufaddr = (caddr_t) virtual_avail;	/* don't need pte */
   1013 	virtual_avail += round_page(MSGBUFSIZE);
   1014 	pte += atop(round_page(MSGBUFSIZE));
   1015 
   1016 	/*
   1017 	 * init the static-global locks and global lists.
   1018 	 */
   1019 	spinlockinit(&pmap_main_lock, "pmaplk", 0);
   1020 	simple_lock_init(&pvalloc_lock);
   1021 	simple_lock_init(&pmaps_lock);
   1022 	LIST_INIT(&pmaps);
   1023 	TAILQ_INIT(&pv_freepages);
   1024 	TAILQ_INIT(&pv_unusedpgs);
   1025 
   1026 	/*
   1027 	 * initialize the pmap pool.
   1028 	 */
   1029 
   1030 	pool_init(&pmap_pmap_pool, sizeof(struct pmap), 0, 0, 0, "pmappl",
   1031 		  &pool_allocator_nointr);
   1032 
   1033 	cpu_dcache_wbinv_all();
   1034 }
   1035 
   1036 /*
   1037  * void pmap_init(void)
   1038  *
   1039  * Initialize the pmap module.
   1040  * Called by vm_init() in vm/vm_init.c in order to initialise
   1041  * any structures that the pmap system needs to map virtual memory.
   1042  */
   1043 
   1044 extern int physmem;
   1045 
   1046 void
   1047 pmap_init(void)
   1048 {
   1049 
   1050 	/*
   1051 	 * Set the available memory vars - These do not map to real memory
   1052 	 * addresses and cannot as the physical memory is fragmented.
   1053 	 * They are used by ps for %mem calculations.
   1054 	 * One could argue whether this should be the entire memory or just
   1055 	 * the memory that is useable in a user process.
   1056 	 */
   1057 	avail_start = 0;
   1058 	avail_end = physmem * NBPG;
   1059 
   1060 	/*
   1061 	 * now we need to free enough pv_entry structures to allow us to get
   1062 	 * the kmem_map/kmem_object allocated and inited (done after this
   1063 	 * function is finished).  to do this we allocate one bootstrap page out
   1064 	 * of kernel_map and use it to provide an initial pool of pv_entry
   1065 	 * structures.   we never free this page.
   1066 	 */
   1067 
   1068 	pv_initpage = (struct pv_page *) uvm_km_alloc(kernel_map, PAGE_SIZE);
   1069 	if (pv_initpage == NULL)
   1070 		panic("pmap_init: pv_initpage");
   1071 	pv_cachedva = 0;   /* a VA we have allocated but not used yet */
   1072 	pv_nfpvents = 0;
   1073 	(void) pmap_add_pvpage(pv_initpage, FALSE);
   1074 
   1075 	pmap_initialized = TRUE;
   1076 
   1077 	/* Initialise our L1 page table queues and counters */
   1078 	SIMPLEQ_INIT(&l1pt_static_queue);
   1079 	l1pt_static_queue_count = 0;
   1080 	l1pt_static_create_count = 0;
   1081 	SIMPLEQ_INIT(&l1pt_queue);
   1082 	l1pt_queue_count = 0;
   1083 	l1pt_create_count = 0;
   1084 	l1pt_reuse_count = 0;
   1085 }
   1086 
   1087 /*
   1088  * pmap_postinit()
   1089  *
   1090  * This routine is called after the vm and kmem subsystems have been
   1091  * initialised. This allows the pmap code to perform any initialisation
   1092  * that can only be done one the memory allocation is in place.
   1093  */
   1094 
   1095 void
   1096 pmap_postinit(void)
   1097 {
   1098 	int loop;
   1099 	struct l1pt *pt;
   1100 
   1101 #ifdef PMAP_STATIC_L1S
   1102 	for (loop = 0; loop < PMAP_STATIC_L1S; ++loop) {
   1103 #else	/* PMAP_STATIC_L1S */
   1104 	for (loop = 0; loop < max_processes; ++loop) {
   1105 #endif	/* PMAP_STATIC_L1S */
   1106 		/* Allocate a L1 page table */
   1107 		pt = pmap_alloc_l1pt();
   1108 		if (!pt)
   1109 			panic("Cannot allocate static L1 page tables\n");
   1110 
   1111 		/* Clean it */
   1112 		bzero((void *)pt->pt_va, L1_TABLE_SIZE);
   1113 		pt->pt_flags |= (PTFLAG_STATIC | PTFLAG_CLEAN);
   1114 		/* Add the page table to the queue */
   1115 		SIMPLEQ_INSERT_TAIL(&l1pt_static_queue, pt, pt_queue);
   1116 		++l1pt_static_queue_count;
   1117 		++l1pt_static_create_count;
   1118 	}
   1119 }
   1120 
   1121 
   1122 /*
   1123  * Create and return a physical map.
   1124  *
   1125  * If the size specified for the map is zero, the map is an actual physical
   1126  * map, and may be referenced by the hardware.
   1127  *
   1128  * If the size specified is non-zero, the map will be used in software only,
   1129  * and is bounded by that size.
   1130  */
   1131 
   1132 pmap_t
   1133 pmap_create(void)
   1134 {
   1135 	struct pmap *pmap;
   1136 
   1137 	/*
   1138 	 * Fetch pmap entry from the pool
   1139 	 */
   1140 
   1141 	pmap = pool_get(&pmap_pmap_pool, PR_WAITOK);
   1142 	/* XXX is this really needed! */
   1143 	memset(pmap, 0, sizeof(*pmap));
   1144 
   1145 	simple_lock_init(&pmap->pm_obj.vmobjlock);
   1146 	pmap->pm_obj.pgops = NULL;	/* currently not a mappable object */
   1147 	TAILQ_INIT(&pmap->pm_obj.memq);
   1148 	pmap->pm_obj.uo_npages = 0;
   1149 	pmap->pm_obj.uo_refs = 1;
   1150 	pmap->pm_stats.wired_count = 0;
   1151 	pmap->pm_stats.resident_count = 1;
   1152 	pmap->pm_ptphint = NULL;
   1153 
   1154 	/* Now init the machine part of the pmap */
   1155 	pmap_pinit(pmap);
   1156 	return(pmap);
   1157 }
   1158 
   1159 /*
   1160  * pmap_alloc_l1pt()
   1161  *
   1162  * This routine allocates physical and virtual memory for a L1 page table
   1163  * and wires it.
   1164  * A l1pt structure is returned to describe the allocated page table.
   1165  *
   1166  * This routine is allowed to fail if the required memory cannot be allocated.
   1167  * In this case NULL is returned.
   1168  */
   1169 
   1170 struct l1pt *
   1171 pmap_alloc_l1pt(void)
   1172 {
   1173 	paddr_t pa;
   1174 	vaddr_t va;
   1175 	struct l1pt *pt;
   1176 	int error;
   1177 	struct vm_page *m;
   1178 	pt_entry_t *pte;
   1179 
   1180 	/* Allocate virtual address space for the L1 page table */
   1181 	va = uvm_km_valloc(kernel_map, L1_TABLE_SIZE);
   1182 	if (va == 0) {
   1183 #ifdef DIAGNOSTIC
   1184 		PDEBUG(0,
   1185 		    printf("pmap: Cannot allocate pageable memory for L1\n"));
   1186 #endif	/* DIAGNOSTIC */
   1187 		return(NULL);
   1188 	}
   1189 
   1190 	/* Allocate memory for the l1pt structure */
   1191 	pt = (struct l1pt *)malloc(sizeof(struct l1pt), M_VMPMAP, M_WAITOK);
   1192 
   1193 	/*
   1194 	 * Allocate pages from the VM system.
   1195 	 */
   1196 	error = uvm_pglistalloc(L1_TABLE_SIZE, physical_start, physical_end,
   1197 	    L1_TABLE_SIZE, 0, &pt->pt_plist, 1, M_WAITOK);
   1198 	if (error) {
   1199 #ifdef DIAGNOSTIC
   1200 		PDEBUG(0,
   1201 		    printf("pmap: Cannot allocate physical mem for L1 (%d)\n",
   1202 		    error));
   1203 #endif	/* DIAGNOSTIC */
   1204 		/* Release the resources we already have claimed */
   1205 		free(pt, M_VMPMAP);
   1206 		uvm_km_free(kernel_map, va, L1_TABLE_SIZE);
   1207 		return(NULL);
   1208 	}
   1209 
   1210 	/* Map our physical pages into our virtual space */
   1211 	pt->pt_va = va;
   1212 	m = TAILQ_FIRST(&pt->pt_plist);
   1213 	while (m && va < (pt->pt_va + L1_TABLE_SIZE)) {
   1214 		pa = VM_PAGE_TO_PHYS(m);
   1215 
   1216 		pte = vtopte(va);
   1217 
   1218 		/*
   1219 		 * Assert that the PTE is invalid.  If it's invalid,
   1220 		 * then we are guaranteed that there won't be an entry
   1221 		 * for this VA in the TLB.
   1222 		 */
   1223 		KDASSERT(pmap_pte_v(pte) == 0);
   1224 
   1225 		*pte = L2_S_PROTO | VM_PAGE_TO_PHYS(m) |
   1226 		    L2_S_PROT(PTE_KERNEL, VM_PROT_READ|VM_PROT_WRITE);
   1227 
   1228 		va += NBPG;
   1229 		m = m->pageq.tqe_next;
   1230 	}
   1231 
   1232 #ifdef DIAGNOSTIC
   1233 	if (m)
   1234 		panic("pmap_alloc_l1pt: pglist not empty\n");
   1235 #endif	/* DIAGNOSTIC */
   1236 
   1237 	pt->pt_flags = 0;
   1238 	return(pt);
   1239 }
   1240 
   1241 /*
   1242  * Free a L1 page table previously allocated with pmap_alloc_l1pt().
   1243  */
   1244 static void
   1245 pmap_free_l1pt(struct l1pt *pt)
   1246 {
   1247 	/* Separate the physical memory for the virtual space */
   1248 	pmap_kremove(pt->pt_va, L1_TABLE_SIZE);
   1249 	pmap_update(pmap_kernel());
   1250 
   1251 	/* Return the physical memory */
   1252 	uvm_pglistfree(&pt->pt_plist);
   1253 
   1254 	/* Free the virtual space */
   1255 	uvm_km_free(kernel_map, pt->pt_va, L1_TABLE_SIZE);
   1256 
   1257 	/* Free the l1pt structure */
   1258 	free(pt, M_VMPMAP);
   1259 }
   1260 
   1261 /*
   1262  * pmap_alloc_ptpt:
   1263  *
   1264  *	Allocate the page table that maps the PTE array.
   1265  */
   1266 static int
   1267 pmap_alloc_ptpt(struct pmap *pmap)
   1268 {
   1269 	struct vm_page *pg;
   1270 	pt_entry_t *pte;
   1271 
   1272 	KASSERT(pmap->pm_vptpt == 0);
   1273 
   1274 	pmap->pm_vptpt = uvm_km_valloc(kernel_map, L2_TABLE_SIZE);
   1275 	if (pmap->pm_vptpt == 0) {
   1276 		PDEBUG(0,
   1277 		    printf("pmap_alloc_ptpt: no KVA for PTPT\n"));
   1278 		return (ENOMEM);
   1279 	}
   1280 
   1281 	for (;;) {
   1282 		pg = uvm_pagealloc(NULL, 0, NULL, UVM_PGA_ZERO);
   1283 		if (pg != NULL)
   1284 			break;
   1285 		uvm_wait("pmap_ptpt");
   1286 	}
   1287 
   1288 	pmap->pm_pptpt = VM_PAGE_TO_PHYS(pg);
   1289 
   1290 	pte = vtopte(pmap->pm_vptpt);
   1291 
   1292 	KDASSERT(pmap_pte_v(pte) == 0);
   1293 
   1294 	*pte = L2_S_PROTO | pmap->pm_pptpt |
   1295 	    L2_S_PROT(PTE_KERNEL, VM_PROT_READ|VM_PROT_WRITE);
   1296 #ifdef PMAP_ALIAS_DEBUG
   1297     {
   1298 	int s = splhigh();
   1299 	pg->mdpage.krw_mappings++;
   1300 	splx(s);
   1301     }
   1302 #endif /* PMAP_ALIAS_DEBUG */
   1303 
   1304 	return (0);
   1305 }
   1306 
   1307 /*
   1308  * pmap_free_ptpt:
   1309  *
   1310  *	Free the page table that maps the PTE array.
   1311  */
   1312 static void
   1313 pmap_free_ptpt(struct pmap *pmap)
   1314 {
   1315 
   1316 	pmap_kremove(pmap->pm_vptpt, L2_TABLE_SIZE);
   1317 	pmap_update(pmap_kernel());
   1318 
   1319 	uvm_pagefree(PHYS_TO_VM_PAGE(pmap->pm_pptpt));
   1320 
   1321 	uvm_km_free(kernel_map, pmap->pm_vptpt, L2_TABLE_SIZE);
   1322 }
   1323 
   1324 /*
   1325  * Allocate a page directory.
   1326  * This routine will either allocate a new page directory from the pool
   1327  * of L1 page tables currently held by the kernel or it will allocate
   1328  * a new one via pmap_alloc_l1pt().
   1329  * It will then initialise the l1 page table for use.
   1330  */
   1331 static int
   1332 pmap_allocpagedir(struct pmap *pmap)
   1333 {
   1334 	paddr_t pa;
   1335 	struct l1pt *pt;
   1336 	int error;
   1337 
   1338 	PDEBUG(0, printf("pmap_allocpagedir(%p)\n", pmap));
   1339 
   1340 	/* Do we have any spare L1's lying around ? */
   1341 	if (l1pt_static_queue_count) {
   1342 		--l1pt_static_queue_count;
   1343 		pt = SIMPLEQ_FIRST(&l1pt_static_queue);
   1344 		SIMPLEQ_REMOVE_HEAD(&l1pt_static_queue, pt_queue);
   1345 	} else if (l1pt_queue_count) {
   1346 		--l1pt_queue_count;
   1347 		pt = SIMPLEQ_FIRST(&l1pt_queue);
   1348 		SIMPLEQ_REMOVE_HEAD(&l1pt_queue, pt_queue);
   1349 		++l1pt_reuse_count;
   1350 	} else {
   1351 		pt = pmap_alloc_l1pt();
   1352 		if (!pt)
   1353 			return(ENOMEM);
   1354 		++l1pt_create_count;
   1355 	}
   1356 
   1357 	/* Store the pointer to the l1 descriptor in the pmap. */
   1358 	pmap->pm_l1pt = pt;
   1359 
   1360 	/* Get the physical address of the start of the l1 */
   1361 	pa = VM_PAGE_TO_PHYS(TAILQ_FIRST(&pt->pt_plist));
   1362 
   1363 	/* Store the virtual address of the l1 in the pmap. */
   1364 	pmap->pm_pdir = (pd_entry_t *)pt->pt_va;
   1365 
   1366 	/* Clean the L1 if it is dirty */
   1367 	if (!(pt->pt_flags & PTFLAG_CLEAN))
   1368 		bzero((void *)pmap->pm_pdir, (L1_TABLE_SIZE - KERNEL_PD_SIZE));
   1369 
   1370 	/* Allocate a page table to map all the page tables for this pmap */
   1371 	if ((error = pmap_alloc_ptpt(pmap)) != 0) {
   1372 		pmap_freepagedir(pmap);
   1373 		return (error);
   1374 	}
   1375 
   1376 	/* need to lock this all up for growkernel */
   1377 	simple_lock(&pmaps_lock);
   1378 
   1379 	/* Duplicate the kernel mappings. */
   1380 	bcopy((char *)pmap_kernel()->pm_pdir + (L1_TABLE_SIZE - KERNEL_PD_SIZE),
   1381 		(char *)pmap->pm_pdir + (L1_TABLE_SIZE - KERNEL_PD_SIZE),
   1382 		KERNEL_PD_SIZE);
   1383 
   1384 	/* Wire in this page table */
   1385 	pmap_map_in_l1(pmap, PTE_BASE, pmap->pm_pptpt, TRUE);
   1386 
   1387 	pt->pt_flags &= ~PTFLAG_CLEAN;	/* L1 is dirty now */
   1388 
   1389 	/*
   1390 	 * Map the kernel page tables into the new PT map.
   1391 	 */
   1392 	bcopy((char *)(PTE_BASE
   1393 	    + (PTE_BASE >> (PGSHIFT - 2))
   1394 	    + ((L1_TABLE_SIZE - KERNEL_PD_SIZE) >> 2)),
   1395 	    (char *)pmap->pm_vptpt + ((L1_TABLE_SIZE - KERNEL_PD_SIZE) >> 2),
   1396 	    (KERNEL_PD_SIZE >> 2));
   1397 
   1398 	LIST_INSERT_HEAD(&pmaps, pmap, pm_list);
   1399 	simple_unlock(&pmaps_lock);
   1400 
   1401 	return(0);
   1402 }
   1403 
   1404 
   1405 /*
   1406  * Initialize a preallocated and zeroed pmap structure,
   1407  * such as one in a vmspace structure.
   1408  */
   1409 
   1410 void
   1411 pmap_pinit(struct pmap *pmap)
   1412 {
   1413 	int backoff = 6;
   1414 	int retry = 10;
   1415 
   1416 	PDEBUG(0, printf("pmap_pinit(%p)\n", pmap));
   1417 
   1418 	/* Keep looping until we succeed in allocating a page directory */
   1419 	while (pmap_allocpagedir(pmap) != 0) {
   1420 		/*
   1421 		 * Ok we failed to allocate a suitable block of memory for an
   1422 		 * L1 page table. This means that either:
   1423 		 * 1. 16KB of virtual address space could not be allocated
   1424 		 * 2. 16KB of physically contiguous memory on a 16KB boundary
   1425 		 *    could not be allocated.
   1426 		 *
   1427 		 * Since we cannot fail we will sleep for a while and try
   1428 		 * again.
   1429 		 *
   1430 		 * Searching for a suitable L1 PT is expensive:
   1431 		 * to avoid hogging the system when memory is really
   1432 		 * scarce, use an exponential back-off so that
   1433 		 * eventually we won't retry more than once every 8
   1434 		 * seconds.  This should allow other processes to run
   1435 		 * to completion and free up resources.
   1436 		 */
   1437 		(void) ltsleep(&lbolt, PVM, "l1ptwait", (hz << 3) >> backoff,
   1438 		    NULL);
   1439 		if (--retry == 0) {
   1440 			retry = 10;
   1441 			if (backoff)
   1442 				--backoff;
   1443 		}
   1444 	}
   1445 
   1446 	if (vector_page < KERNEL_BASE) {
   1447 		/*
   1448 		 * Map the vector page.  This will also allocate and map
   1449 		 * an L2 table for it.
   1450 		 */
   1451 		pmap_enter(pmap, vector_page, systempage.pv_pa,
   1452 		    VM_PROT_READ, VM_PROT_READ | PMAP_WIRED);
   1453 		pmap_update(pmap);
   1454 	}
   1455 }
   1456 
   1457 
   1458 void
   1459 pmap_freepagedir(struct pmap *pmap)
   1460 {
   1461 	/* Free the memory used for the page table mapping */
   1462 	if (pmap->pm_vptpt != 0)
   1463 		pmap_free_ptpt(pmap);
   1464 
   1465 	/* junk the L1 page table */
   1466 	if (pmap->pm_l1pt->pt_flags & PTFLAG_STATIC) {
   1467 		/* Add the page table to the queue */
   1468 		SIMPLEQ_INSERT_TAIL(&l1pt_static_queue, pmap->pm_l1pt, pt_queue);
   1469 		++l1pt_static_queue_count;
   1470 	} else if (l1pt_queue_count < 8) {
   1471 		/* Add the page table to the queue */
   1472 		SIMPLEQ_INSERT_TAIL(&l1pt_queue, pmap->pm_l1pt, pt_queue);
   1473 		++l1pt_queue_count;
   1474 	} else
   1475 		pmap_free_l1pt(pmap->pm_l1pt);
   1476 }
   1477 
   1478 
   1479 /*
   1480  * Retire the given physical map from service.
   1481  * Should only be called if the map contains no valid mappings.
   1482  */
   1483 
   1484 void
   1485 pmap_destroy(struct pmap *pmap)
   1486 {
   1487 	struct vm_page *page;
   1488 	int count;
   1489 
   1490 	if (pmap == NULL)
   1491 		return;
   1492 
   1493 	PDEBUG(0, printf("pmap_destroy(%p)\n", pmap));
   1494 
   1495 	/*
   1496 	 * Drop reference count
   1497 	 */
   1498 	simple_lock(&pmap->pm_obj.vmobjlock);
   1499 	count = --pmap->pm_obj.uo_refs;
   1500 	simple_unlock(&pmap->pm_obj.vmobjlock);
   1501 	if (count > 0) {
   1502 		return;
   1503 	}
   1504 
   1505 	/*
   1506 	 * reference count is zero, free pmap resources and then free pmap.
   1507 	 */
   1508 
   1509 	/*
   1510 	 * remove it from global list of pmaps
   1511 	 */
   1512 
   1513 	simple_lock(&pmaps_lock);
   1514 	LIST_REMOVE(pmap, pm_list);
   1515 	simple_unlock(&pmaps_lock);
   1516 
   1517 	if (vector_page < KERNEL_BASE) {
   1518 		/* Remove the vector page mapping */
   1519 		pmap_remove(pmap, vector_page, vector_page + NBPG);
   1520 		pmap_update(pmap);
   1521 	}
   1522 
   1523 	/*
   1524 	 * Free any page tables still mapped
   1525 	 * This is only temporay until pmap_enter can count the number
   1526 	 * of mappings made in a page table. Then pmap_remove() can
   1527 	 * reduce the count and free the pagetable when the count
   1528 	 * reaches zero.  Note that entries in this list should match the
   1529 	 * contents of the ptpt, however this is faster than walking a 1024
   1530 	 * entries looking for pt's
   1531 	 * taken from i386 pmap.c
   1532 	 */
   1533 	/*
   1534 	 * vmobjlock must be held while freeing pages
   1535 	 */
   1536 	simple_lock(&pmap->pm_obj.vmobjlock);
   1537 	while ((page = TAILQ_FIRST(&pmap->pm_obj.memq)) != NULL) {
   1538 		KASSERT((page->flags & PG_BUSY) == 0);
   1539 		page->wire_count = 0;
   1540 		uvm_pagefree(page);
   1541 	}
   1542 	simple_unlock(&pmap->pm_obj.vmobjlock);
   1543 
   1544 	/* Free the page dir */
   1545 	pmap_freepagedir(pmap);
   1546 
   1547 	/* return the pmap to the pool */
   1548 	pool_put(&pmap_pmap_pool, pmap);
   1549 }
   1550 
   1551 
   1552 /*
   1553  * void pmap_reference(struct pmap *pmap)
   1554  *
   1555  * Add a reference to the specified pmap.
   1556  */
   1557 
   1558 void
   1559 pmap_reference(struct pmap *pmap)
   1560 {
   1561 	if (pmap == NULL)
   1562 		return;
   1563 
   1564 	simple_lock(&pmap->pm_lock);
   1565 	pmap->pm_obj.uo_refs++;
   1566 	simple_unlock(&pmap->pm_lock);
   1567 }
   1568 
   1569 /*
   1570  * void pmap_virtual_space(vaddr_t *start, vaddr_t *end)
   1571  *
   1572  * Return the start and end addresses of the kernel's virtual space.
   1573  * These values are setup in pmap_bootstrap and are updated as pages
   1574  * are allocated.
   1575  */
   1576 
   1577 void
   1578 pmap_virtual_space(vaddr_t *start, vaddr_t *end)
   1579 {
   1580 	*start = virtual_avail;
   1581 	*end = virtual_end;
   1582 }
   1583 
   1584 /*
   1585  * Activate the address space for the specified process.  If the process
   1586  * is the current process, load the new MMU context.
   1587  */
   1588 void
   1589 pmap_activate(struct proc *p)
   1590 {
   1591 	struct pmap *pmap = p->p_vmspace->vm_map.pmap;
   1592 	struct pcb *pcb = &p->p_addr->u_pcb;
   1593 
   1594 	(void) pmap_extract(pmap_kernel(), (vaddr_t)pmap->pm_pdir,
   1595 	    (paddr_t *)&pcb->pcb_pagedir);
   1596 
   1597 	PDEBUG(0, printf("pmap_activate: p=%p pmap=%p pcb=%p pdir=%p l1=%p\n",
   1598 	    p, pmap, pcb, pmap->pm_pdir, pcb->pcb_pagedir));
   1599 
   1600 	if (p == curproc) {
   1601 		PDEBUG(0, printf("pmap_activate: setting TTB\n"));
   1602 		setttb((u_int)pcb->pcb_pagedir);
   1603 	}
   1604 }
   1605 
   1606 /*
   1607  * Deactivate the address space of the specified process.
   1608  */
   1609 void
   1610 pmap_deactivate(struct proc *p)
   1611 {
   1612 }
   1613 
   1614 /*
   1615  * Perform any deferred pmap operations.
   1616  */
   1617 void
   1618 pmap_update(struct pmap *pmap)
   1619 {
   1620 
   1621 	/*
   1622 	 * We haven't deferred any pmap operations, but we do need to
   1623 	 * make sure TLB/cache operations have completed.
   1624 	 */
   1625 	cpu_cpwait();
   1626 }
   1627 
   1628 /*
   1629  * pmap_clean_page()
   1630  *
   1631  * This is a local function used to work out the best strategy to clean
   1632  * a single page referenced by its entry in the PV table. It's used by
   1633  * pmap_copy_page, pmap_zero page and maybe some others later on.
   1634  *
   1635  * Its policy is effectively:
   1636  *  o If there are no mappings, we don't bother doing anything with the cache.
   1637  *  o If there is one mapping, we clean just that page.
   1638  *  o If there are multiple mappings, we clean the entire cache.
   1639  *
   1640  * So that some functions can be further optimised, it returns 0 if it didn't
   1641  * clean the entire cache, or 1 if it did.
   1642  *
   1643  * XXX One bug in this routine is that if the pv_entry has a single page
   1644  * mapped at 0x00000000 a whole cache clean will be performed rather than
   1645  * just the 1 page. Since this should not occur in everyday use and if it does
   1646  * it will just result in not the most efficient clean for the page.
   1647  */
   1648 static int
   1649 pmap_clean_page(struct pv_entry *pv, boolean_t is_src)
   1650 {
   1651 	struct pmap *pmap;
   1652 	struct pv_entry *npv;
   1653 	int cache_needs_cleaning = 0;
   1654 	vaddr_t page_to_clean = 0;
   1655 
   1656 	if (pv == NULL)
   1657 		/* nothing mapped in so nothing to flush */
   1658 		return (0);
   1659 
   1660 	/* Since we flush the cache each time we change curproc, we
   1661 	 * only need to flush the page if it is in the current pmap.
   1662 	 */
   1663 	if (curproc)
   1664 		pmap = curproc->p_vmspace->vm_map.pmap;
   1665 	else
   1666 		pmap = pmap_kernel();
   1667 
   1668 	for (npv = pv; npv; npv = npv->pv_next) {
   1669 		if (npv->pv_pmap == pmap) {
   1670 			/* The page is mapped non-cacheable in
   1671 			 * this map.  No need to flush the cache.
   1672 			 */
   1673 			if (npv->pv_flags & PVF_NC) {
   1674 #ifdef DIAGNOSTIC
   1675 				if (cache_needs_cleaning)
   1676 					panic("pmap_clean_page: "
   1677 							"cache inconsistency");
   1678 #endif
   1679 				break;
   1680 			}
   1681 #if 0
   1682 			/*
   1683 			 * XXX Can't do this because pmap_protect doesn't
   1684 			 * XXX clean the page when it does a write-protect.
   1685 			 */
   1686 			else if (is_src && (npv->pv_flags & PVF_WRITE) == 0)
   1687 				continue;
   1688 #endif
   1689 			if (cache_needs_cleaning){
   1690 				page_to_clean = 0;
   1691 				break;
   1692 			}
   1693 			else
   1694 				page_to_clean = npv->pv_va;
   1695 			cache_needs_cleaning = 1;
   1696 		}
   1697 	}
   1698 
   1699 	if (page_to_clean)
   1700 		cpu_idcache_wbinv_range(page_to_clean, NBPG);
   1701 	else if (cache_needs_cleaning) {
   1702 		cpu_idcache_wbinv_all();
   1703 		return (1);
   1704 	}
   1705 	return (0);
   1706 }
   1707 
   1708 /*
   1709  * pmap_zero_page()
   1710  *
   1711  * Zero a given physical page by mapping it at a page hook point.
   1712  * In doing the zero page op, the page we zero is mapped cachable, as with
   1713  * StrongARM accesses to non-cached pages are non-burst making writing
   1714  * _any_ bulk data very slow.
   1715  */
   1716 #if ARM_MMU_GENERIC == 1
   1717 void
   1718 pmap_zero_page_generic(paddr_t phys)
   1719 {
   1720 #ifdef DEBUG
   1721 	struct vm_page *pg = PHYS_TO_VM_PAGE(phys);
   1722 
   1723 	if (pg->mdpage.pvh_list != NULL)
   1724 		panic("pmap_zero_page: page has mappings");
   1725 #endif
   1726 
   1727 	KDASSERT((phys & PGOFSET) == 0);
   1728 
   1729 	/*
   1730 	 * Hook in the page, zero it, and purge the cache for that
   1731 	 * zeroed page. Invalidate the TLB as needed.
   1732 	 */
   1733 	*cdst_pte = L2_S_PROTO | phys |
   1734 	    L2_S_PROT(PTE_KERNEL, VM_PROT_WRITE) | pte_l2_s_cache_mode;
   1735 	cpu_tlb_flushD_SE(cdstp);
   1736 	cpu_cpwait();
   1737 	bzero_page(cdstp);
   1738 	cpu_dcache_wbinv_range(cdstp, NBPG);
   1739 }
   1740 #endif /* ARM_MMU_GENERIC == 1 */
   1741 
   1742 #if ARM_MMU_XSCALE == 1
   1743 void
   1744 pmap_zero_page_xscale(paddr_t phys)
   1745 {
   1746 #ifdef DEBUG
   1747 	struct vm_page *pg = PHYS_TO_VM_PAGE(phys);
   1748 
   1749 	if (pg->mdpage.pvh_list != NULL)
   1750 		panic("pmap_zero_page: page has mappings");
   1751 #endif
   1752 
   1753 	KDASSERT((phys & PGOFSET) == 0);
   1754 
   1755 	/*
   1756 	 * Hook in the page, zero it, and purge the cache for that
   1757 	 * zeroed page. Invalidate the TLB as needed.
   1758 	 */
   1759 	*cdst_pte = L2_S_PROTO | phys |
   1760 	    L2_S_PROT(PTE_KERNEL, VM_PROT_WRITE) |
   1761 	    L2_C | L2_XSCALE_T_TEX(TEX_XSCALE_X);	/* mini-data */
   1762 	cpu_tlb_flushD_SE(cdstp);
   1763 	cpu_cpwait();
   1764 	bzero_page(cdstp);
   1765 	xscale_cache_clean_minidata();
   1766 }
   1767 #endif /* ARM_MMU_XSCALE == 1 */
   1768 
   1769 /* pmap_pageidlezero()
   1770  *
   1771  * The same as above, except that we assume that the page is not
   1772  * mapped.  This means we never have to flush the cache first.  Called
   1773  * from the idle loop.
   1774  */
   1775 boolean_t
   1776 pmap_pageidlezero(paddr_t phys)
   1777 {
   1778 	int i, *ptr;
   1779 	boolean_t rv = TRUE;
   1780 #ifdef DEBUG
   1781 	struct vm_page *pg;
   1782 
   1783 	pg = PHYS_TO_VM_PAGE(phys);
   1784 	if (pg->mdpage.pvh_list != NULL)
   1785 		panic("pmap_pageidlezero: page has mappings");
   1786 #endif
   1787 
   1788 	KDASSERT((phys & PGOFSET) == 0);
   1789 
   1790 	/*
   1791 	 * Hook in the page, zero it, and purge the cache for that
   1792 	 * zeroed page. Invalidate the TLB as needed.
   1793 	 */
   1794 	*cdst_pte = L2_S_PROTO | phys |
   1795 	    L2_S_PROT(PTE_KERNEL, VM_PROT_WRITE) | pte_l2_s_cache_mode;
   1796 	cpu_tlb_flushD_SE(cdstp);
   1797 	cpu_cpwait();
   1798 
   1799 	for (i = 0, ptr = (int *)cdstp;
   1800 			i < (NBPG / sizeof(int)); i++) {
   1801 		if (sched_whichqs != 0) {
   1802 			/*
   1803 			 * A process has become ready.  Abort now,
   1804 			 * so we don't keep it waiting while we
   1805 			 * do slow memory access to finish this
   1806 			 * page.
   1807 			 */
   1808 			rv = FALSE;
   1809 			break;
   1810 		}
   1811 		*ptr++ = 0;
   1812 	}
   1813 
   1814 	if (rv)
   1815 		/*
   1816 		 * if we aborted we'll rezero this page again later so don't
   1817 		 * purge it unless we finished it
   1818 		 */
   1819 		cpu_dcache_wbinv_range(cdstp, NBPG);
   1820 	return (rv);
   1821 }
   1822 
   1823 /*
   1824  * pmap_copy_page()
   1825  *
   1826  * Copy one physical page into another, by mapping the pages into
   1827  * hook points. The same comment regarding cachability as in
   1828  * pmap_zero_page also applies here.
   1829  */
   1830 #if ARM_MMU_GENERIC == 1
   1831 void
   1832 pmap_copy_page_generic(paddr_t src, paddr_t dst)
   1833 {
   1834 	struct vm_page *src_pg = PHYS_TO_VM_PAGE(src);
   1835 #ifdef DEBUG
   1836 	struct vm_page *dst_pg = PHYS_TO_VM_PAGE(dst);
   1837 
   1838 	if (dst_pg->mdpage.pvh_list != NULL)
   1839 		panic("pmap_copy_page: dst page has mappings");
   1840 #endif
   1841 
   1842 	KDASSERT((src & PGOFSET) == 0);
   1843 	KDASSERT((dst & PGOFSET) == 0);
   1844 
   1845 	/*
   1846 	 * Clean the source page.  Hold the source page's lock for
   1847 	 * the duration of the copy so that no other mappings can
   1848 	 * be created while we have a potentially aliased mapping.
   1849 	 */
   1850 	simple_lock(&src_pg->mdpage.pvh_slock);
   1851 	(void) pmap_clean_page(src_pg->mdpage.pvh_list, TRUE);
   1852 
   1853 	/*
   1854 	 * Map the pages into the page hook points, copy them, and purge
   1855 	 * the cache for the appropriate page. Invalidate the TLB
   1856 	 * as required.
   1857 	 */
   1858 	*csrc_pte = L2_S_PROTO | src |
   1859 	    L2_S_PROT(PTE_KERNEL, VM_PROT_READ) | pte_l2_s_cache_mode;
   1860 	*cdst_pte = L2_S_PROTO | dst |
   1861 	    L2_S_PROT(PTE_KERNEL, VM_PROT_WRITE) | pte_l2_s_cache_mode;
   1862 	cpu_tlb_flushD_SE(csrcp);
   1863 	cpu_tlb_flushD_SE(cdstp);
   1864 	cpu_cpwait();
   1865 	bcopy_page(csrcp, cdstp);
   1866 	cpu_dcache_inv_range(csrcp, NBPG);
   1867 	simple_unlock(&src_pg->mdpage.pvh_slock); /* cache is safe again */
   1868 	cpu_dcache_wbinv_range(cdstp, NBPG);
   1869 }
   1870 #endif /* ARM_MMU_GENERIC == 1 */
   1871 
   1872 #if ARM_MMU_XSCALE == 1
   1873 void
   1874 pmap_copy_page_xscale(paddr_t src, paddr_t dst)
   1875 {
   1876 	struct vm_page *src_pg = PHYS_TO_VM_PAGE(src);
   1877 #ifdef DEBUG
   1878 	struct vm_page *dst_pg = PHYS_TO_VM_PAGE(dst);
   1879 
   1880 	if (dst_pg->mdpage.pvh_list != NULL)
   1881 		panic("pmap_copy_page: dst page has mappings");
   1882 #endif
   1883 
   1884 	KDASSERT((src & PGOFSET) == 0);
   1885 	KDASSERT((dst & PGOFSET) == 0);
   1886 
   1887 	/*
   1888 	 * Clean the source page.  Hold the source page's lock for
   1889 	 * the duration of the copy so that no other mappings can
   1890 	 * be created while we have a potentially aliased mapping.
   1891 	 */
   1892 	simple_lock(&src_pg->mdpage.pvh_slock);
   1893 	(void) pmap_clean_page(src_pg->mdpage.pvh_list, TRUE);
   1894 
   1895 	/*
   1896 	 * Map the pages into the page hook points, copy them, and purge
   1897 	 * the cache for the appropriate page. Invalidate the TLB
   1898 	 * as required.
   1899 	 */
   1900 	*csrc_pte = L2_S_PROTO | src |
   1901 	    L2_S_PROT(PTE_KERNEL, VM_PROT_READ) |
   1902 	    L2_C | L2_XSCALE_T_TEX(TEX_XSCALE_X);	/* mini-data */
   1903 	*cdst_pte = L2_S_PROTO | dst |
   1904 	    L2_S_PROT(PTE_KERNEL, VM_PROT_WRITE) |
   1905 	    L2_C | L2_XSCALE_T_TEX(TEX_XSCALE_X);	/* mini-data */
   1906 	cpu_tlb_flushD_SE(csrcp);
   1907 	cpu_tlb_flushD_SE(cdstp);
   1908 	cpu_cpwait();
   1909 	bcopy_page(csrcp, cdstp);
   1910 	simple_unlock(&src_pg->mdpage.pvh_slock); /* cache is safe again */
   1911 	xscale_cache_clean_minidata();
   1912 }
   1913 #endif /* ARM_MMU_XSCALE == 1 */
   1914 
   1915 #if 0
   1916 void
   1917 pmap_pte_addref(struct pmap *pmap, vaddr_t va)
   1918 {
   1919 	pd_entry_t *pde;
   1920 	paddr_t pa;
   1921 	struct vm_page *m;
   1922 
   1923 	if (pmap == pmap_kernel())
   1924 		return;
   1925 
   1926 	pde = pmap_pde(pmap, va & ~(3 << L1_S_SHIFT));
   1927 	pa = pmap_pte_pa(pde);
   1928 	m = PHYS_TO_VM_PAGE(pa);
   1929 	++m->wire_count;
   1930 #ifdef MYCROFT_HACK
   1931 	printf("addref pmap=%p va=%08lx pde=%p pa=%08lx m=%p wire=%d\n",
   1932 	    pmap, va, pde, pa, m, m->wire_count);
   1933 #endif
   1934 }
   1935 
   1936 void
   1937 pmap_pte_delref(struct pmap *pmap, vaddr_t va)
   1938 {
   1939 	pd_entry_t *pde;
   1940 	paddr_t pa;
   1941 	struct vm_page *m;
   1942 
   1943 	if (pmap == pmap_kernel())
   1944 		return;
   1945 
   1946 	pde = pmap_pde(pmap, va & ~(3 << L1_S_SHIFT));
   1947 	pa = pmap_pte_pa(pde);
   1948 	m = PHYS_TO_VM_PAGE(pa);
   1949 	--m->wire_count;
   1950 #ifdef MYCROFT_HACK
   1951 	printf("delref pmap=%p va=%08lx pde=%p pa=%08lx m=%p wire=%d\n",
   1952 	    pmap, va, pde, pa, m, m->wire_count);
   1953 #endif
   1954 	if (m->wire_count == 0) {
   1955 #ifdef MYCROFT_HACK
   1956 		printf("delref pmap=%p va=%08lx pde=%p pa=%08lx m=%p\n",
   1957 		    pmap, va, pde, pa, m);
   1958 #endif
   1959 		pmap_unmap_in_l1(pmap, va);
   1960 		uvm_pagefree(m);
   1961 		--pmap->pm_stats.resident_count;
   1962 	}
   1963 }
   1964 #else
   1965 #define	pmap_pte_addref(pmap, va)
   1966 #define	pmap_pte_delref(pmap, va)
   1967 #endif
   1968 
   1969 /*
   1970  * Since we have a virtually indexed cache, we may need to inhibit caching if
   1971  * there is more than one mapping and at least one of them is writable.
   1972  * Since we purge the cache on every context switch, we only need to check for
   1973  * other mappings within the same pmap, or kernel_pmap.
   1974  * This function is also called when a page is unmapped, to possibly reenable
   1975  * caching on any remaining mappings.
   1976  *
   1977  * The code implements the following logic, where:
   1978  *
   1979  * KW = # of kernel read/write pages
   1980  * KR = # of kernel read only pages
   1981  * UW = # of user read/write pages
   1982  * UR = # of user read only pages
   1983  * OW = # of user read/write pages in another pmap, then
   1984  *
   1985  * KC = kernel mapping is cacheable
   1986  * UC = user mapping is cacheable
   1987  *
   1988  *                     KW=0,KR=0  KW=0,KR>0  KW=1,KR=0  KW>1,KR>=0
   1989  *                   +---------------------------------------------
   1990  * UW=0,UR=0,OW=0    | ---        KC=1       KC=1       KC=0
   1991  * UW=0,UR>0,OW=0    | UC=1       KC=1,UC=1  KC=0,UC=0  KC=0,UC=0
   1992  * UW=0,UR>0,OW>0    | UC=1       KC=0,UC=1  KC=0,UC=0  KC=0,UC=0
   1993  * UW=1,UR=0,OW=0    | UC=1       KC=0,UC=0  KC=0,UC=0  KC=0,UC=0
   1994  * UW>1,UR>=0,OW>=0  | UC=0       KC=0,UC=0  KC=0,UC=0  KC=0,UC=0
   1995  *
   1996  * Note that the pmap must have it's ptes mapped in, and passed with ptes.
   1997  */
   1998 __inline static void
   1999 pmap_vac_me_harder(struct pmap *pmap, struct vm_page *pg, pt_entry_t *ptes,
   2000 	boolean_t clear_cache)
   2001 {
   2002 	if (pmap == pmap_kernel())
   2003 		pmap_vac_me_kpmap(pmap, pg, ptes, clear_cache);
   2004 	else
   2005 		pmap_vac_me_user(pmap, pg, ptes, clear_cache);
   2006 }
   2007 
   2008 static void
   2009 pmap_vac_me_kpmap(struct pmap *pmap, struct vm_page *pg, pt_entry_t *ptes,
   2010 	boolean_t clear_cache)
   2011 {
   2012 	int user_entries = 0;
   2013 	int user_writable = 0;
   2014 	int user_cacheable = 0;
   2015 	int kernel_entries = 0;
   2016 	int kernel_writable = 0;
   2017 	int kernel_cacheable = 0;
   2018 	struct pv_entry *pv;
   2019 	struct pmap *last_pmap = pmap;
   2020 
   2021 #ifdef DIAGNOSTIC
   2022 	if (pmap != pmap_kernel())
   2023 		panic("pmap_vac_me_kpmap: pmap != pmap_kernel()");
   2024 #endif
   2025 
   2026 	/*
   2027 	 * Pass one, see if there are both kernel and user pmaps for
   2028 	 * this page.  Calculate whether there are user-writable or
   2029 	 * kernel-writable pages.
   2030 	 */
   2031 	for (pv = pg->mdpage.pvh_list; pv != NULL; pv = pv->pv_next) {
   2032 		if (pv->pv_pmap != pmap) {
   2033 			user_entries++;
   2034 			if (pv->pv_flags & PVF_WRITE)
   2035 				user_writable++;
   2036 			if ((pv->pv_flags & PVF_NC) == 0)
   2037 				user_cacheable++;
   2038 		} else {
   2039 			kernel_entries++;
   2040 			if (pv->pv_flags & PVF_WRITE)
   2041 				kernel_writable++;
   2042 			if ((pv->pv_flags & PVF_NC) == 0)
   2043 				kernel_cacheable++;
   2044 		}
   2045 	}
   2046 
   2047 	/*
   2048 	 * We know we have just been updating a kernel entry, so if
   2049 	 * all user pages are already cacheable, then there is nothing
   2050 	 * further to do.
   2051 	 */
   2052 	if (kernel_entries == 0 &&
   2053 	    user_cacheable == user_entries)
   2054 		return;
   2055 
   2056 	if (user_entries) {
   2057 		/*
   2058 		 * Scan over the list again, for each entry, if it
   2059 		 * might not be set correctly, call pmap_vac_me_user
   2060 		 * to recalculate the settings.
   2061 		 */
   2062 		for (pv = pg->mdpage.pvh_list; pv; pv = pv->pv_next) {
   2063 			/*
   2064 			 * We know kernel mappings will get set
   2065 			 * correctly in other calls.  We also know
   2066 			 * that if the pmap is the same as last_pmap
   2067 			 * then we've just handled this entry.
   2068 			 */
   2069 			if (pv->pv_pmap == pmap || pv->pv_pmap == last_pmap)
   2070 				continue;
   2071 			/*
   2072 			 * If there are kernel entries and this page
   2073 			 * is writable but non-cacheable, then we can
   2074 			 * skip this entry also.
   2075 			 */
   2076 			if (kernel_entries > 0 &&
   2077 			    (pv->pv_flags & (PVF_NC | PVF_WRITE)) ==
   2078 			    (PVF_NC | PVF_WRITE))
   2079 				continue;
   2080 			/*
   2081 			 * Similarly if there are no kernel-writable
   2082 			 * entries and the page is already
   2083 			 * read-only/cacheable.
   2084 			 */
   2085 			if (kernel_writable == 0 &&
   2086 			    (pv->pv_flags & (PVF_NC | PVF_WRITE)) == 0)
   2087 				continue;
   2088 			/*
   2089 			 * For some of the remaining cases, we know
   2090 			 * that we must recalculate, but for others we
   2091 			 * can't tell if they are correct or not, so
   2092 			 * we recalculate anyway.
   2093 			 */
   2094 			pmap_unmap_ptes(last_pmap);
   2095 			last_pmap = pv->pv_pmap;
   2096 			ptes = pmap_map_ptes(last_pmap);
   2097 			pmap_vac_me_user(last_pmap, pg, ptes,
   2098 			    pmap_is_curpmap(last_pmap));
   2099 		}
   2100 		/* Restore the pte mapping that was passed to us.  */
   2101 		if (last_pmap != pmap) {
   2102 			pmap_unmap_ptes(last_pmap);
   2103 			ptes = pmap_map_ptes(pmap);
   2104 		}
   2105 		if (kernel_entries == 0)
   2106 			return;
   2107 	}
   2108 
   2109 	pmap_vac_me_user(pmap, pg, ptes, clear_cache);
   2110 	return;
   2111 }
   2112 
   2113 static void
   2114 pmap_vac_me_user(struct pmap *pmap, struct vm_page *pg, pt_entry_t *ptes,
   2115 	boolean_t clear_cache)
   2116 {
   2117 	struct pmap *kpmap = pmap_kernel();
   2118 	struct pv_entry *pv, *npv;
   2119 	int entries = 0;
   2120 	int writable = 0;
   2121 	int cacheable_entries = 0;
   2122 	int kern_cacheable = 0;
   2123 	int other_writable = 0;
   2124 
   2125 	pv = pg->mdpage.pvh_list;
   2126 	KASSERT(ptes != NULL);
   2127 
   2128 	/*
   2129 	 * Count mappings and writable mappings in this pmap.
   2130 	 * Include kernel mappings as part of our own.
   2131 	 * Keep a pointer to the first one.
   2132 	 */
   2133 	for (npv = pv; npv; npv = npv->pv_next) {
   2134 		/* Count mappings in the same pmap */
   2135 		if (pmap == npv->pv_pmap ||
   2136 		    kpmap == npv->pv_pmap) {
   2137 			if (entries++ == 0)
   2138 				pv = npv;
   2139 			/* Cacheable mappings */
   2140 			if ((npv->pv_flags & PVF_NC) == 0) {
   2141 				cacheable_entries++;
   2142 				if (kpmap == npv->pv_pmap)
   2143 					kern_cacheable++;
   2144 			}
   2145 			/* Writable mappings */
   2146 			if (npv->pv_flags & PVF_WRITE)
   2147 				++writable;
   2148 		} else if (npv->pv_flags & PVF_WRITE)
   2149 			other_writable = 1;
   2150 	}
   2151 
   2152 	PDEBUG(3,printf("pmap_vac_me_harder: pmap %p Entries %d, "
   2153 		"writable %d cacheable %d %s\n", pmap, entries, writable,
   2154 	    	cacheable_entries, clear_cache ? "clean" : "no clean"));
   2155 
   2156 	/*
   2157 	 * Enable or disable caching as necessary.
   2158 	 * Note: the first entry might be part of the kernel pmap,
   2159 	 * so we can't assume this is indicative of the state of the
   2160 	 * other (maybe non-kpmap) entries.
   2161 	 */
   2162 	if ((entries > 1 && writable) ||
   2163 	    (entries > 0 && pmap == kpmap && other_writable)) {
   2164 		if (cacheable_entries == 0)
   2165 		    return;
   2166 		for (npv = pv; npv; npv = npv->pv_next) {
   2167 			if ((pmap == npv->pv_pmap
   2168 			    || kpmap == npv->pv_pmap) &&
   2169 			    (npv->pv_flags & PVF_NC) == 0) {
   2170 				ptes[arm_btop(npv->pv_va)] &= ~L2_S_CACHE_MASK;
   2171  				npv->pv_flags |= PVF_NC;
   2172 				/*
   2173 				 * If this page needs flushing from the
   2174 				 * cache, and we aren't going to do it
   2175 				 * below, do it now.
   2176 				 */
   2177 				if ((cacheable_entries < 4 &&
   2178 				    (clear_cache || npv->pv_pmap == kpmap)) ||
   2179 				    (npv->pv_pmap == kpmap &&
   2180 				    !clear_cache && kern_cacheable < 4)) {
   2181 					cpu_idcache_wbinv_range(npv->pv_va,
   2182 					    NBPG);
   2183 					cpu_tlb_flushID_SE(npv->pv_va);
   2184 				}
   2185 			}
   2186 		}
   2187 		if ((clear_cache && cacheable_entries >= 4) ||
   2188 		    kern_cacheable >= 4) {
   2189 			cpu_idcache_wbinv_all();
   2190 			cpu_tlb_flushID();
   2191 		}
   2192 		cpu_cpwait();
   2193 	} else if (entries > 0) {
   2194 		/*
   2195 		 * Turn cacheing back on for some pages.  If it is a kernel
   2196 		 * page, only do so if there are no other writable pages.
   2197 		 */
   2198 		for (npv = pv; npv; npv = npv->pv_next) {
   2199 			if ((pmap == npv->pv_pmap ||
   2200 			    (kpmap == npv->pv_pmap && other_writable == 0)) &&
   2201 			    (npv->pv_flags & PVF_NC)) {
   2202 				ptes[arm_btop(npv->pv_va)] |=
   2203 				    pte_l2_s_cache_mode;
   2204 				npv->pv_flags &= ~PVF_NC;
   2205 			}
   2206 		}
   2207 	}
   2208 }
   2209 
   2210 /*
   2211  * pmap_remove()
   2212  *
   2213  * pmap_remove is responsible for nuking a number of mappings for a range
   2214  * of virtual address space in the current pmap. To do this efficiently
   2215  * is interesting, because in a number of cases a wide virtual address
   2216  * range may be supplied that contains few actual mappings. So, the
   2217  * optimisations are:
   2218  *  1. Try and skip over hunks of address space for which an L1 entry
   2219  *     does not exist.
   2220  *  2. Build up a list of pages we've hit, up to a maximum, so we can
   2221  *     maybe do just a partial cache clean. This path of execution is
   2222  *     complicated by the fact that the cache must be flushed _before_
   2223  *     the PTE is nuked, being a VAC :-)
   2224  *  3. Maybe later fast-case a single page, but I don't think this is
   2225  *     going to make _that_ much difference overall.
   2226  */
   2227 
   2228 #define PMAP_REMOVE_CLEAN_LIST_SIZE	3
   2229 
   2230 void
   2231 pmap_remove(struct pmap *pmap, vaddr_t sva, vaddr_t eva)
   2232 {
   2233 	int cleanlist_idx = 0;
   2234 	struct pagelist {
   2235 		vaddr_t va;
   2236 		pt_entry_t *pte;
   2237 	} cleanlist[PMAP_REMOVE_CLEAN_LIST_SIZE];
   2238 	pt_entry_t *pte = 0, *ptes;
   2239 	paddr_t pa;
   2240 	int pmap_active;
   2241 	struct vm_page *pg;
   2242 
   2243 	/* Exit quick if there is no pmap */
   2244 	if (!pmap)
   2245 		return;
   2246 
   2247 	PDEBUG(0, printf("pmap_remove: pmap=%p sva=%08lx eva=%08lx\n",
   2248 	    pmap, sva, eva));
   2249 
   2250 	/*
   2251 	 * we lock in the pmap => vm_page direction
   2252 	 */
   2253 	PMAP_MAP_TO_HEAD_LOCK();
   2254 
   2255 	ptes = pmap_map_ptes(pmap);
   2256 	/* Get a page table pointer */
   2257 	while (sva < eva) {
   2258 		if (pmap_pde_page(pmap_pde(pmap, sva)))
   2259 			break;
   2260 		sva = (sva & L1_S_FRAME) + L1_S_SIZE;
   2261 	}
   2262 
   2263 	pte = &ptes[arm_btop(sva)];
   2264 	/* Note if the pmap is active thus require cache and tlb cleans */
   2265 	pmap_active = pmap_is_curpmap(pmap);
   2266 
   2267 	/* Now loop along */
   2268 	while (sva < eva) {
   2269 		/* Check if we can move to the next PDE (l1 chunk) */
   2270 		if (!(sva & L2_ADDR_BITS))
   2271 			if (!pmap_pde_page(pmap_pde(pmap, sva))) {
   2272 				sva += L1_S_SIZE;
   2273 				pte += arm_btop(L1_S_SIZE);
   2274 				continue;
   2275 			}
   2276 
   2277 		/* We've found a valid PTE, so this page of PTEs has to go. */
   2278 		if (pmap_pte_v(pte)) {
   2279 			/* Update statistics */
   2280 			--pmap->pm_stats.resident_count;
   2281 
   2282 			/*
   2283 			 * Add this page to our cache remove list, if we can.
   2284 			 * If, however the cache remove list is totally full,
   2285 			 * then do a complete cache invalidation taking note
   2286 			 * to backtrack the PTE table beforehand, and ignore
   2287 			 * the lists in future because there's no longer any
   2288 			 * point in bothering with them (we've paid the
   2289 			 * penalty, so will carry on unhindered). Otherwise,
   2290 			 * when we fall out, we just clean the list.
   2291 			 */
   2292 			PDEBUG(10, printf("remove: inv pte at %p(%x) ", pte, *pte));
   2293 			pa = pmap_pte_pa(pte);
   2294 
   2295 			if (cleanlist_idx < PMAP_REMOVE_CLEAN_LIST_SIZE) {
   2296 				/* Add to the clean list. */
   2297 				cleanlist[cleanlist_idx].pte = pte;
   2298 				cleanlist[cleanlist_idx].va = sva;
   2299 				cleanlist_idx++;
   2300 			} else if (cleanlist_idx == PMAP_REMOVE_CLEAN_LIST_SIZE) {
   2301 				int cnt;
   2302 
   2303 				/* Nuke everything if needed. */
   2304 				if (pmap_active) {
   2305 					cpu_idcache_wbinv_all();
   2306 					cpu_tlb_flushID();
   2307 				}
   2308 
   2309 				/*
   2310 				 * Roll back the previous PTE list,
   2311 				 * and zero out the current PTE.
   2312 				 */
   2313 				for (cnt = 0; cnt < PMAP_REMOVE_CLEAN_LIST_SIZE; cnt++) {
   2314 					*cleanlist[cnt].pte = 0;
   2315 					pmap_pte_delref(pmap, cleanlist[cnt].va);
   2316 				}
   2317 				*pte = 0;
   2318 				pmap_pte_delref(pmap, sva);
   2319 				cleanlist_idx++;
   2320 			} else {
   2321 				/*
   2322 				 * We've already nuked the cache and
   2323 				 * TLB, so just carry on regardless,
   2324 				 * and we won't need to do it again
   2325 				 */
   2326 				*pte = 0;
   2327 				pmap_pte_delref(pmap, sva);
   2328 			}
   2329 
   2330 			/*
   2331 			 * Update flags. In a number of circumstances,
   2332 			 * we could cluster a lot of these and do a
   2333 			 * number of sequential pages in one go.
   2334 			 */
   2335 			if ((pg = PHYS_TO_VM_PAGE(pa)) != NULL) {
   2336 				struct pv_entry *pve;
   2337 				simple_lock(&pg->mdpage.pvh_slock);
   2338 				pve = pmap_remove_pv(pg, pmap, sva);
   2339 				pmap_free_pv(pmap, pve);
   2340 				pmap_vac_me_harder(pmap, pg, ptes, FALSE);
   2341 				simple_unlock(&pg->mdpage.pvh_slock);
   2342 			}
   2343 		}
   2344 		sva += NBPG;
   2345 		pte++;
   2346 	}
   2347 
   2348 	/*
   2349 	 * Now, if we've fallen through down to here, chances are that there
   2350 	 * are less than PMAP_REMOVE_CLEAN_LIST_SIZE mappings left.
   2351 	 */
   2352 	if (cleanlist_idx <= PMAP_REMOVE_CLEAN_LIST_SIZE) {
   2353 		u_int cnt;
   2354 
   2355 		for (cnt = 0; cnt < cleanlist_idx; cnt++) {
   2356 			if (pmap_active) {
   2357 				cpu_idcache_wbinv_range(cleanlist[cnt].va,
   2358 				    NBPG);
   2359 				*cleanlist[cnt].pte = 0;
   2360 				cpu_tlb_flushID_SE(cleanlist[cnt].va);
   2361 			} else
   2362 				*cleanlist[cnt].pte = 0;
   2363 			pmap_pte_delref(pmap, cleanlist[cnt].va);
   2364 		}
   2365 	}
   2366 
   2367 	pmap_unmap_ptes(pmap);
   2368 
   2369 	PMAP_MAP_TO_HEAD_UNLOCK();
   2370 }
   2371 
   2372 /*
   2373  * Routine:	pmap_remove_all
   2374  * Function:
   2375  *		Removes this physical page from
   2376  *		all physical maps in which it resides.
   2377  *		Reflects back modify bits to the pager.
   2378  */
   2379 
   2380 static void
   2381 pmap_remove_all(struct vm_page *pg)
   2382 {
   2383 	struct pv_entry *pv, *npv;
   2384 	struct pmap *pmap;
   2385 	pt_entry_t *pte, *ptes;
   2386 
   2387 	PDEBUG(0, printf("pmap_remove_all: pa=%lx ", VM_PAGE_TO_PHYS(pg)));
   2388 
   2389 	/* set vm_page => pmap locking */
   2390 	PMAP_HEAD_TO_MAP_LOCK();
   2391 
   2392 	simple_lock(&pg->mdpage.pvh_slock);
   2393 
   2394 	pv = pg->mdpage.pvh_list;
   2395 	if (pv == NULL) {
   2396 		PDEBUG(0, printf("free page\n"));
   2397 		simple_unlock(&pg->mdpage.pvh_slock);
   2398 		PMAP_HEAD_TO_MAP_UNLOCK();
   2399 		return;
   2400 	}
   2401 	pmap_clean_page(pv, FALSE);
   2402 
   2403 	while (pv) {
   2404 		pmap = pv->pv_pmap;
   2405 		ptes = pmap_map_ptes(pmap);
   2406 		pte = &ptes[arm_btop(pv->pv_va)];
   2407 
   2408 		PDEBUG(0, printf("[%p,%08x,%08lx,%08x] ", pmap, *pte,
   2409 		    pv->pv_va, pv->pv_flags));
   2410 #ifdef DEBUG
   2411 		if (pmap_pde_page(pmap_pde(pmap, pv->pv_va)) == 0 ||
   2412 		    pmap_pte_v(pte) == 0 ||
   2413 		    pmap_pte_pa(pte) != VM_PAGE_TO_PHYS(pg))
   2414 			panic("pmap_remove_all: bad mapping");
   2415 #endif	/* DEBUG */
   2416 
   2417 		/*
   2418 		 * Update statistics
   2419 		 */
   2420 		--pmap->pm_stats.resident_count;
   2421 
   2422 		/* Wired bit */
   2423 		if (pv->pv_flags & PVF_WIRED)
   2424 			--pmap->pm_stats.wired_count;
   2425 
   2426 		/*
   2427 		 * Invalidate the PTEs.
   2428 		 * XXX: should cluster them up and invalidate as many
   2429 		 * as possible at once.
   2430 		 */
   2431 
   2432 #ifdef needednotdone
   2433 reduce wiring count on page table pages as references drop
   2434 #endif
   2435 
   2436 		*pte = 0;
   2437 		pmap_pte_delref(pmap, pv->pv_va);
   2438 
   2439 		npv = pv->pv_next;
   2440 		pmap_free_pv(pmap, pv);
   2441 		pv = npv;
   2442 		pmap_unmap_ptes(pmap);
   2443 	}
   2444 	pg->mdpage.pvh_list = NULL;
   2445 	simple_unlock(&pg->mdpage.pvh_slock);
   2446 	PMAP_HEAD_TO_MAP_UNLOCK();
   2447 
   2448 	PDEBUG(0, printf("done\n"));
   2449 	cpu_tlb_flushID();
   2450 	cpu_cpwait();
   2451 }
   2452 
   2453 
   2454 /*
   2455  * Set the physical protection on the specified range of this map as requested.
   2456  */
   2457 
   2458 void
   2459 pmap_protect(struct pmap *pmap, vaddr_t sva, vaddr_t eva, vm_prot_t prot)
   2460 {
   2461 	pt_entry_t *pte = NULL, *ptes;
   2462 	struct vm_page *pg;
   2463 	int armprot;
   2464 	int flush = 0;
   2465 	paddr_t pa;
   2466 
   2467 	PDEBUG(0, printf("pmap_protect: pmap=%p %08lx->%08lx %x\n",
   2468 	    pmap, sva, eva, prot));
   2469 
   2470 	if (~prot & VM_PROT_READ) {
   2471 		/* Just remove the mappings. */
   2472 		pmap_remove(pmap, sva, eva);
   2473 		/* pmap_update not needed as it should be called by the caller
   2474 		 * of pmap_protect */
   2475 		return;
   2476 	}
   2477 	if (prot & VM_PROT_WRITE) {
   2478 		/*
   2479 		 * If this is a read->write transition, just ignore it and let
   2480 		 * uvm_fault() take care of it later.
   2481 		 */
   2482 		return;
   2483 	}
   2484 
   2485 	/* Need to lock map->head */
   2486 	PMAP_MAP_TO_HEAD_LOCK();
   2487 
   2488 	ptes = pmap_map_ptes(pmap);
   2489 
   2490 	/*
   2491 	 * OK, at this point, we know we're doing write-protect operation.
   2492 	 * If the pmap is active, write-back the range.
   2493 	 */
   2494 	if (pmap_is_curpmap(pmap))
   2495 		cpu_dcache_wb_range(sva, eva - sva);
   2496 
   2497 	/*
   2498 	 * We need to acquire a pointer to a page table page before entering
   2499 	 * the following loop.
   2500 	 */
   2501 	while (sva < eva) {
   2502 		if (pmap_pde_page(pmap_pde(pmap, sva)))
   2503 			break;
   2504 		sva = (sva & L1_S_FRAME) + L1_S_SIZE;
   2505 	}
   2506 
   2507 	pte = &ptes[arm_btop(sva)];
   2508 
   2509 	while (sva < eva) {
   2510 		/* only check once in a while */
   2511 		if ((sva & L2_ADDR_BITS) == 0) {
   2512 			if (!pmap_pde_page(pmap_pde(pmap, sva))) {
   2513 				/* We can race ahead here, to the next pde. */
   2514 				sva += L1_S_SIZE;
   2515 				pte += arm_btop(L1_S_SIZE);
   2516 				continue;
   2517 			}
   2518 		}
   2519 
   2520 		if (!pmap_pte_v(pte))
   2521 			goto next;
   2522 
   2523 		flush = 1;
   2524 
   2525 		armprot = 0;
   2526 		if (sva < VM_MAXUSER_ADDRESS)
   2527 			armprot |= L2_S_PROT_U;
   2528 		else if (sva < VM_MAX_ADDRESS)
   2529 			armprot |= L2_S_PROT_W;  /* XXX Ekk what is this ? */
   2530 		*pte = (*pte & 0xfffff00f) | armprot;
   2531 
   2532 		pa = pmap_pte_pa(pte);
   2533 
   2534 		/* Get the physical page index */
   2535 
   2536 		/* Clear write flag */
   2537 		if ((pg = PHYS_TO_VM_PAGE(pa)) != NULL) {
   2538 			simple_lock(&pg->mdpage.pvh_slock);
   2539 			(void) pmap_modify_pv(pmap, sva, pg, PVF_WRITE, 0);
   2540 			pmap_vac_me_harder(pmap, pg, ptes, FALSE);
   2541 			simple_unlock(&pg->mdpage.pvh_slock);
   2542 		}
   2543 
   2544 next:
   2545 		sva += NBPG;
   2546 		pte++;
   2547 	}
   2548 	pmap_unmap_ptes(pmap);
   2549 	PMAP_MAP_TO_HEAD_UNLOCK();
   2550 	if (flush)
   2551 		cpu_tlb_flushID();
   2552 }
   2553 
   2554 /*
   2555  * void pmap_enter(struct pmap *pmap, vaddr_t va, paddr_t pa, vm_prot_t prot,
   2556  * int flags)
   2557  *
   2558  *      Insert the given physical page (p) at
   2559  *      the specified virtual address (v) in the
   2560  *      target physical map with the protection requested.
   2561  *
   2562  *      If specified, the page will be wired down, meaning
   2563  *      that the related pte can not be reclaimed.
   2564  *
   2565  *      NB:  This is the only routine which MAY NOT lazy-evaluate
   2566  *      or lose information.  That is, this routine must actually
   2567  *      insert this page into the given map NOW.
   2568  */
   2569 
   2570 int
   2571 pmap_enter(struct pmap *pmap, vaddr_t va, paddr_t pa, vm_prot_t prot,
   2572     int flags)
   2573 {
   2574 	pt_entry_t *ptes, opte, npte;
   2575 	paddr_t opa;
   2576 	boolean_t wired = (flags & PMAP_WIRED) != 0;
   2577 	struct vm_page *pg;
   2578 	struct pv_entry *pve;
   2579 	int error, nflags;
   2580 
   2581 	PDEBUG(5, printf("pmap_enter: V%08lx P%08lx in pmap %p prot=%08x, wired = %d\n",
   2582 	    va, pa, pmap, prot, wired));
   2583 
   2584 #ifdef DIAGNOSTIC
   2585 	/* Valid address ? */
   2586 	if (va >= (pmap_curmaxkvaddr))
   2587 		panic("pmap_enter: too big");
   2588 	if (pmap != pmap_kernel() && va != 0) {
   2589 		if (va < VM_MIN_ADDRESS || va >= VM_MAXUSER_ADDRESS)
   2590 			panic("pmap_enter: kernel page in user map");
   2591 	} else {
   2592 		if (va >= VM_MIN_ADDRESS && va < VM_MAXUSER_ADDRESS)
   2593 			panic("pmap_enter: user page in kernel map");
   2594 		if (va >= VM_MAXUSER_ADDRESS && va < VM_MAX_ADDRESS)
   2595 			panic("pmap_enter: entering PT page");
   2596 	}
   2597 #endif
   2598 
   2599 	KDASSERT(((va | pa) & PGOFSET) == 0);
   2600 
   2601 	/*
   2602 	 * Get a pointer to the page.  Later on in this function, we
   2603 	 * test for a managed page by checking pg != NULL.
   2604 	 */
   2605 	pg = pmap_initialized ? PHYS_TO_VM_PAGE(pa) : NULL;
   2606 
   2607 	/* get lock */
   2608 	PMAP_MAP_TO_HEAD_LOCK();
   2609 
   2610 	/*
   2611 	 * map the ptes.  If there's not already an L2 table for this
   2612 	 * address, allocate one.
   2613 	 */
   2614 	ptes = pmap_map_ptes(pmap);		/* locks pmap */
   2615 	if (pmap_pde_v(pmap_pde(pmap, va)) == 0) {
   2616 		struct vm_page *ptp;
   2617 
   2618 		/* kernel should be pre-grown */
   2619 		KASSERT(pmap != pmap_kernel());
   2620 
   2621 		/* if failure is allowed then don't try too hard */
   2622 		ptp = pmap_get_ptp(pmap, va & L1_S_FRAME);
   2623 		if (ptp == NULL) {
   2624 			if (flags & PMAP_CANFAIL) {
   2625 				error = ENOMEM;
   2626 				goto out;
   2627 			}
   2628 			panic("pmap_enter: get ptp failed");
   2629 		}
   2630 	}
   2631 	opte = ptes[arm_btop(va)];
   2632 
   2633 	nflags = 0;
   2634 	if (prot & VM_PROT_WRITE)
   2635 		nflags |= PVF_WRITE;
   2636 	if (wired)
   2637 		nflags |= PVF_WIRED;
   2638 
   2639 	/* Is the pte valid ? If so then this page is already mapped */
   2640 	if (l2pte_valid(opte)) {
   2641 		/* Get the physical address of the current page mapped */
   2642 		opa = l2pte_pa(opte);
   2643 
   2644 		/* Are we mapping the same page ? */
   2645 		if (opa == pa) {
   2646 			/* Check to see if we're doing rw->ro. */
   2647 			if ((opte & L2_S_PROT_W) != 0 &&
   2648 			    (prot & VM_PROT_WRITE) == 0) {
   2649 				/* Yup, flush the cache if current pmap. */
   2650 				if (pmap_is_curpmap(pmap))
   2651 					cpu_dcache_wb_range(va, NBPG);
   2652 			}
   2653 
   2654 			/* Has the wiring changed ? */
   2655 			if (pg != NULL) {
   2656 				simple_lock(&pg->mdpage.pvh_slock);
   2657 				(void) pmap_modify_pv(pmap, va, pg,
   2658 				    PVF_WRITE | PVF_WIRED, nflags);
   2659 				simple_unlock(&pg->mdpage.pvh_slock);
   2660  			}
   2661 		} else {
   2662 			struct vm_page *opg;
   2663 
   2664 			/* We are replacing the page with a new one. */
   2665 			cpu_idcache_wbinv_range(va, NBPG);
   2666 
   2667 			/*
   2668 			 * If it is part of our managed memory then we
   2669 			 * must remove it from the PV list
   2670 			 */
   2671 			if ((opg = PHYS_TO_VM_PAGE(opa)) != NULL) {
   2672 				simple_lock(&opg->mdpage.pvh_slock);
   2673 				pve = pmap_remove_pv(opg, pmap, va);
   2674 				simple_unlock(&opg->mdpage.pvh_slock);
   2675 			} else {
   2676 				pve = NULL;
   2677 			}
   2678 
   2679 			goto enter;
   2680 		}
   2681 	} else {
   2682 		opa = 0;
   2683 		pve = NULL;
   2684 		pmap_pte_addref(pmap, va);
   2685 
   2686 		/* pte is not valid so we must be hooking in a new page */
   2687 		++pmap->pm_stats.resident_count;
   2688 
   2689 	enter:
   2690 		/*
   2691 		 * Enter on the PV list if part of our managed memory
   2692 		 */
   2693 		if (pg != NULL) {
   2694 			if (pve == NULL) {
   2695 				pve = pmap_alloc_pv(pmap, ALLOCPV_NEED);
   2696 				if (pve == NULL) {
   2697 					if (flags & PMAP_CANFAIL) {
   2698 						error = ENOMEM;
   2699 						goto out;
   2700 					}
   2701 					panic("pmap_enter: no pv entries "
   2702 					    "available");
   2703 				}
   2704 			}
   2705 			/* enter_pv locks pvh when adding */
   2706 			pmap_enter_pv(pg, pve, pmap, va, NULL, nflags);
   2707 		} else {
   2708 			if (pve != NULL)
   2709 				pmap_free_pv(pmap, pve);
   2710 		}
   2711 	}
   2712 
   2713 	/* Construct the pte, giving the correct access. */
   2714 	npte = pa;
   2715 
   2716 	/* VA 0 is magic. */
   2717 	if (pmap != pmap_kernel() && va != vector_page)
   2718 		npte |= L2_S_PROT_U;
   2719 
   2720 	if (pg != NULL) {
   2721 #ifdef DIAGNOSTIC
   2722 		if ((flags & VM_PROT_ALL) & ~prot)
   2723 			panic("pmap_enter: access_type exceeds prot");
   2724 #endif
   2725 		npte |= pte_l2_s_cache_mode;
   2726 		if (flags & VM_PROT_WRITE) {
   2727 			npte |= L2_S_PROTO | L2_S_PROT_W;
   2728 			pg->mdpage.pvh_attrs |= PVF_REF | PVF_MOD;
   2729 		} else if (flags & VM_PROT_ALL) {
   2730 			npte |= L2_S_PROTO;
   2731 			pg->mdpage.pvh_attrs |= PVF_REF;
   2732 		} else
   2733 			npte |= L2_TYPE_INV;
   2734 	} else {
   2735 		if (prot & VM_PROT_WRITE)
   2736 			npte |= L2_S_PROTO | L2_S_PROT_W;
   2737 		else if (prot & VM_PROT_ALL)
   2738 			npte |= L2_S_PROTO;
   2739 		else
   2740 			npte |= L2_TYPE_INV;
   2741 	}
   2742 
   2743 	ptes[arm_btop(va)] = npte;
   2744 
   2745 	if (pg != NULL) {
   2746 		simple_lock(&pg->mdpage.pvh_slock);
   2747  		pmap_vac_me_harder(pmap, pg, ptes, pmap_is_curpmap(pmap));
   2748 		simple_unlock(&pg->mdpage.pvh_slock);
   2749 	}
   2750 
   2751 	/* Better flush the TLB ... */
   2752 	cpu_tlb_flushID_SE(va);
   2753 	error = 0;
   2754 out:
   2755 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   2756 	PMAP_MAP_TO_HEAD_UNLOCK();
   2757 
   2758 	return error;
   2759 }
   2760 
   2761 /*
   2762  * pmap_kenter_pa: enter a kernel mapping
   2763  *
   2764  * => no need to lock anything assume va is already allocated
   2765  * => should be faster than normal pmap enter function
   2766  */
   2767 void
   2768 pmap_kenter_pa(vaddr_t va, paddr_t pa, vm_prot_t prot)
   2769 {
   2770 	pt_entry_t *pte;
   2771 
   2772 	pte = vtopte(va);
   2773 	KASSERT(!pmap_pte_v(pte));
   2774 
   2775 #ifdef PMAP_ALIAS_DEBUG
   2776     {
   2777 	struct vm_page *pg;
   2778 	int s;
   2779 
   2780 	pg = PHYS_TO_VM_PAGE(pa);
   2781 	if (pg != NULL) {
   2782 		s = splhigh();
   2783 		if (pg->mdpage.ro_mappings == 0 &&
   2784 		    pg->mdpage.rw_mappings == 0 &&
   2785 		    pg->mdpage.kro_mappings == 0 &&
   2786 		    pg->mdpage.krw_mappings == 0) {
   2787 			/* This case is okay. */
   2788 		} else if (pg->mdpage.rw_mappings == 0 &&
   2789 			   pg->mdpage.krw_mappings == 0 &&
   2790 			   (prot & VM_PROT_WRITE) == 0) {
   2791 			/* This case is okay. */
   2792 		} else {
   2793 			/* Something is awry. */
   2794 			printf("pmap_kenter_pa: ro %u, rw %u, kro %u, krw %u "
   2795 			    "prot 0x%x\n", pg->mdpage.ro_mappings,
   2796 			    pg->mdpage.rw_mappings, pg->mdpage.kro_mappings,
   2797 			    pg->mdpage.krw_mappings, prot);
   2798 			Debugger();
   2799 		}
   2800 		if (prot & VM_PROT_WRITE)
   2801 			pg->mdpage.krw_mappings++;
   2802 		else
   2803 			pg->mdpage.kro_mappings++;
   2804 		splx(s);
   2805 	}
   2806     }
   2807 #endif /* PMAP_ALIAS_DEBUG */
   2808 
   2809 	*pte = L2_S_PROTO | pa |
   2810 	    L2_S_PROT(PTE_KERNEL, prot) | pte_l2_s_cache_mode;
   2811 }
   2812 
   2813 void
   2814 pmap_kremove(vaddr_t va, vsize_t len)
   2815 {
   2816 	pt_entry_t *pte;
   2817 
   2818 	for (len >>= PAGE_SHIFT; len > 0; len--, va += PAGE_SIZE) {
   2819 
   2820 		/*
   2821 		 * We assume that we will only be called with small
   2822 		 * regions of memory.
   2823 		 */
   2824 
   2825 		KASSERT(pmap_pde_page(pmap_pde(pmap_kernel(), va)));
   2826 		pte = vtopte(va);
   2827 #ifdef PMAP_ALIAS_DEBUG
   2828     {
   2829 		struct vm_page *pg;
   2830 		int s;
   2831 
   2832 		if ((*pte & L2_TYPE_MASK) != L2_TYPE_INV &&
   2833 		    (pg = PHYS_TO_VM_PAGE(*pte & L2_S_FRAME)) != NULL) {
   2834 			s = splhigh();
   2835 			if (*pte & L2_S_PROT_W) {
   2836 				KASSERT(pg->mdpage.krw_mappings != 0);
   2837 				pg->mdpage.krw_mappings--;
   2838 			} else {
   2839 				KASSERT(pg->mdpage.kro_mappings != 0);
   2840 				pg->mdpage.kro_mappings--;
   2841 			}
   2842 			splx(s);
   2843 		}
   2844     }
   2845 #endif /* PMAP_ALIAS_DEBUG */
   2846 		cpu_idcache_wbinv_range(va, PAGE_SIZE);
   2847 		*pte = 0;
   2848 		cpu_tlb_flushID_SE(va);
   2849 	}
   2850 }
   2851 
   2852 /*
   2853  * pmap_page_protect:
   2854  *
   2855  * Lower the permission for all mappings to a given page.
   2856  */
   2857 
   2858 void
   2859 pmap_page_protect(struct vm_page *pg, vm_prot_t prot)
   2860 {
   2861 
   2862 	PDEBUG(0, printf("pmap_page_protect(pa=%lx, prot=%d)\n",
   2863 	    VM_PAGE_TO_PHYS(pg), prot));
   2864 
   2865 	switch(prot) {
   2866 	case VM_PROT_READ|VM_PROT_WRITE|VM_PROT_EXECUTE:
   2867 	case VM_PROT_READ|VM_PROT_WRITE:
   2868 		return;
   2869 
   2870 	case VM_PROT_READ:
   2871 	case VM_PROT_READ|VM_PROT_EXECUTE:
   2872 		pmap_clearbit(pg, PVF_WRITE);
   2873 		break;
   2874 
   2875 	default:
   2876 		pmap_remove_all(pg);
   2877 		break;
   2878 	}
   2879 }
   2880 
   2881 
   2882 /*
   2883  * Routine:	pmap_unwire
   2884  * Function:	Clear the wired attribute for a map/virtual-address
   2885  *		pair.
   2886  * In/out conditions:
   2887  *		The mapping must already exist in the pmap.
   2888  */
   2889 
   2890 void
   2891 pmap_unwire(struct pmap *pmap, vaddr_t va)
   2892 {
   2893 	pt_entry_t *ptes;
   2894 	struct vm_page *pg;
   2895 	paddr_t pa;
   2896 
   2897 	PMAP_MAP_TO_HEAD_LOCK();
   2898 	ptes = pmap_map_ptes(pmap);		/* locks pmap */
   2899 
   2900 	if (pmap_pde_v(pmap_pde(pmap, va))) {
   2901 #ifdef DIAGNOSTIC
   2902 		if (l2pte_valid(ptes[arm_btop(va)]) == 0)
   2903 			panic("pmap_unwire: invalid L2 PTE");
   2904 #endif
   2905 		/* Extract the physical address of the page */
   2906 		pa = l2pte_pa(ptes[arm_btop(va)]);
   2907 
   2908 		if ((pg = PHYS_TO_VM_PAGE(pa)) == NULL)
   2909 			goto out;
   2910 
   2911 		/* Update the wired bit in the pv entry for this page. */
   2912 		simple_lock(&pg->mdpage.pvh_slock);
   2913 		(void) pmap_modify_pv(pmap, va, pg, PVF_WIRED, 0);
   2914 		simple_unlock(&pg->mdpage.pvh_slock);
   2915 	}
   2916 #ifdef DIAGNOSTIC
   2917 	else {
   2918 		panic("pmap_unwire: invalid L1 PTE");
   2919 	}
   2920 #endif
   2921  out:
   2922 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   2923 	PMAP_MAP_TO_HEAD_UNLOCK();
   2924 }
   2925 
   2926 /*
   2927  * Routine:  pmap_extract
   2928  * Function:
   2929  *           Extract the physical page address associated
   2930  *           with the given map/virtual_address pair.
   2931  */
   2932 boolean_t
   2933 pmap_extract(struct pmap *pmap, vaddr_t va, paddr_t *pap)
   2934 {
   2935 	pd_entry_t *pde;
   2936 	pt_entry_t *pte, *ptes;
   2937 	paddr_t pa;
   2938 
   2939 	PDEBUG(5, printf("pmap_extract: pmap=%p, va=0x%08lx -> ", pmap, va));
   2940 
   2941 	ptes = pmap_map_ptes(pmap);		/* locks pmap */
   2942 
   2943 	pde = pmap_pde(pmap, va);
   2944 	pte = &ptes[arm_btop(va)];
   2945 
   2946 	if (pmap_pde_section(pde)) {
   2947 		pa = (*pde & L1_S_FRAME) | (va & L1_S_OFFSET);
   2948 		PDEBUG(5, printf("section pa=0x%08lx\n", pa));
   2949 		goto out;
   2950 	} else if (pmap_pde_page(pde) == 0 || pmap_pte_v(pte) == 0) {
   2951 		PDEBUG(5, printf("no mapping\n"));
   2952 		goto failed;
   2953 	}
   2954 
   2955 	if ((*pte & L2_TYPE_MASK) == L2_TYPE_L) {
   2956 		pa = (*pte & L2_L_FRAME) | (va & L2_L_OFFSET);
   2957 		PDEBUG(5, printf("large page pa=0x%08lx\n", pa));
   2958 		goto out;
   2959 	}
   2960 
   2961 	pa = (*pte & L2_S_FRAME) | (va & L2_S_OFFSET);
   2962 	PDEBUG(5, printf("small page pa=0x%08lx\n", pa));
   2963 
   2964  out:
   2965 	if (pap != NULL)
   2966 		*pap = pa;
   2967 
   2968 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   2969 	return (TRUE);
   2970 
   2971  failed:
   2972 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   2973 	return (FALSE);
   2974 }
   2975 
   2976 
   2977 /*
   2978  * pmap_copy:
   2979  *
   2980  *	Copy the range specified by src_addr/len from the source map to the
   2981  *	range dst_addr/len in the destination map.
   2982  *
   2983  *	This routine is only advisory and need not do anything.
   2984  */
   2985 /* Call deleted in <arm/arm32/pmap.h> */
   2986 
   2987 #if defined(PMAP_DEBUG)
   2988 void
   2989 pmap_dump_pvlist(phys, m)
   2990 	vaddr_t phys;
   2991 	char *m;
   2992 {
   2993 	struct vm_page *pg;
   2994 	struct pv_entry *pv;
   2995 
   2996 	if ((pg = PHYS_TO_VM_PAGE(phys)) == NULL) {
   2997 		printf("INVALID PA\n");
   2998 		return;
   2999 	}
   3000 	simple_lock(&pg->mdpage.pvh_slock);
   3001 	printf("%s %08lx:", m, phys);
   3002 	if (pg->mdpage.pvh_list == NULL) {
   3003 		simple_unlock(&pg->mdpage.pvh_slock);
   3004 		printf(" no mappings\n");
   3005 		return;
   3006 	}
   3007 
   3008 	for (pv = pg->mdpage.pvh_list; pv; pv = pv->pv_next)
   3009 		printf(" pmap %p va %08lx flags %08x", pv->pv_pmap,
   3010 		    pv->pv_va, pv->pv_flags);
   3011 
   3012 	printf("\n");
   3013 	simple_unlock(&pg->mdpage.pvh_slock);
   3014 }
   3015 
   3016 #endif	/* PMAP_DEBUG */
   3017 
   3018 static pt_entry_t *
   3019 pmap_map_ptes(struct pmap *pmap)
   3020 {
   3021 	struct proc *p;
   3022 
   3023     	/* the kernel's pmap is always accessible */
   3024 	if (pmap == pmap_kernel()) {
   3025 		return (pt_entry_t *)PTE_BASE;
   3026 	}
   3027 
   3028 	if (pmap_is_curpmap(pmap)) {
   3029 		simple_lock(&pmap->pm_obj.vmobjlock);
   3030 		return (pt_entry_t *)PTE_BASE;
   3031 	}
   3032 
   3033 	p = curproc;
   3034 	KDASSERT(p != NULL);
   3035 
   3036 	/* need to lock both curpmap and pmap: use ordered locking */
   3037 	if ((vaddr_t) pmap < (vaddr_t) p->p_vmspace->vm_map.pmap) {
   3038 		simple_lock(&pmap->pm_obj.vmobjlock);
   3039 		simple_lock(&p->p_vmspace->vm_map.pmap->pm_obj.vmobjlock);
   3040 	} else {
   3041 		simple_lock(&p->p_vmspace->vm_map.pmap->pm_obj.vmobjlock);
   3042 		simple_lock(&pmap->pm_obj.vmobjlock);
   3043 	}
   3044 
   3045 	pmap_map_in_l1(p->p_vmspace->vm_map.pmap, APTE_BASE, pmap->pm_pptpt,
   3046 	    FALSE);
   3047 	cpu_tlb_flushD();
   3048 	cpu_cpwait();
   3049 	return (pt_entry_t *)APTE_BASE;
   3050 }
   3051 
   3052 /*
   3053  * pmap_unmap_ptes: unlock the PTE mapping of "pmap"
   3054  */
   3055 
   3056 static void
   3057 pmap_unmap_ptes(struct pmap *pmap)
   3058 {
   3059 
   3060 	if (pmap == pmap_kernel()) {
   3061 		return;
   3062 	}
   3063 	if (pmap_is_curpmap(pmap)) {
   3064 		simple_unlock(&pmap->pm_obj.vmobjlock);
   3065 	} else {
   3066 		KDASSERT(curproc != NULL);
   3067 		simple_unlock(&pmap->pm_obj.vmobjlock);
   3068 		simple_unlock(
   3069 		    &curproc->p_vmspace->vm_map.pmap->pm_obj.vmobjlock);
   3070 	}
   3071 }
   3072 
   3073 /*
   3074  * Modify pte bits for all ptes corresponding to the given physical address.
   3075  * We use `maskbits' rather than `clearbits' because we're always passing
   3076  * constants and the latter would require an extra inversion at run-time.
   3077  */
   3078 
   3079 static void
   3080 pmap_clearbit(struct vm_page *pg, u_int maskbits)
   3081 {
   3082 	struct pv_entry *pv;
   3083 	pt_entry_t *ptes, npte, opte;
   3084 	vaddr_t va;
   3085 	int tlbentry;
   3086 
   3087 	PDEBUG(1, printf("pmap_clearbit: pa=%08lx mask=%08x\n",
   3088 	    VM_PAGE_TO_PHYS(pg), maskbits));
   3089 
   3090 	tlbentry = 0;
   3091 
   3092 	PMAP_HEAD_TO_MAP_LOCK();
   3093 	simple_lock(&pg->mdpage.pvh_slock);
   3094 
   3095 	/*
   3096 	 * Clear saved attributes (modify, reference)
   3097 	 */
   3098 	pg->mdpage.pvh_attrs &= ~maskbits;
   3099 
   3100 	if (pg->mdpage.pvh_list == NULL) {
   3101 		simple_unlock(&pg->mdpage.pvh_slock);
   3102 		PMAP_HEAD_TO_MAP_UNLOCK();
   3103 		return;
   3104 	}
   3105 
   3106 	/*
   3107 	 * Loop over all current mappings setting/clearing as appropos
   3108 	 */
   3109 	for (pv = pg->mdpage.pvh_list; pv; pv = pv->pv_next) {
   3110 #ifdef PMAP_ALIAS_DEBUG
   3111     {
   3112 		int s = splhigh();
   3113 		if ((maskbits & PVF_WRITE) != 0 &&
   3114 		    (pv->pv_flags & PVF_WRITE) != 0) {
   3115 			KASSERT(pg->mdpage.rw_mappings != 0);
   3116 			pg->mdpage.rw_mappings--;
   3117 			pg->mdpage.ro_mappings++;
   3118 		}
   3119 		splx(s);
   3120     }
   3121 #endif /* PMAP_ALIAS_DEBUG */
   3122 		va = pv->pv_va;
   3123 		pv->pv_flags &= ~maskbits;
   3124 		ptes = pmap_map_ptes(pv->pv_pmap);	/* locks pmap */
   3125 		KASSERT(pmap_pde_v(pmap_pde(pv->pv_pmap, va)));
   3126 		npte = opte = ptes[arm_btop(va)];
   3127 		if (maskbits & (PVF_WRITE|PVF_MOD)) {
   3128 			if ((pv->pv_flags & PVF_NC)) {
   3129 				/*
   3130 				 * Entry is not cacheable: reenable
   3131 				 * the cache, nothing to flush
   3132 				 *
   3133 				 * Don't turn caching on again if this
   3134 				 * is a modified emulation.  This
   3135 				 * would be inconsitent with the
   3136 				 * settings created by
   3137 				 * pmap_vac_me_harder().
   3138 				 *
   3139 				 * There's no need to call
   3140 				 * pmap_vac_me_harder() here: all
   3141 				 * pages are loosing their write
   3142 				 * permission.
   3143 				 *
   3144 				 */
   3145 				if (maskbits & PVF_WRITE) {
   3146 					npte |= pte_l2_s_cache_mode;
   3147 					pv->pv_flags &= ~PVF_NC;
   3148 				}
   3149 			} else if (pmap_is_curpmap(pv->pv_pmap)) {
   3150 				/*
   3151 				 * Entry is cacheable: check if pmap is
   3152 				 * current if it is flush it,
   3153 				 * otherwise it won't be in the cache
   3154 				 */
   3155 				cpu_idcache_wbinv_range(pv->pv_va, NBPG);
   3156 			}
   3157 
   3158 			/* make the pte read only */
   3159 			npte &= ~L2_S_PROT_W;
   3160 		}
   3161 
   3162 		if (maskbits & PVF_REF) {
   3163 			if (pmap_is_curpmap(pv->pv_pmap) &&
   3164 			    (pv->pv_flags & PVF_NC) == 0) {
   3165 				/*
   3166 				 * Check npte here; we may have already
   3167 				 * done the wbinv above, and the validity
   3168 				 * of the PTE is the same for opte and
   3169 				 * npte.
   3170 				 */
   3171 				if (npte & L2_S_PROT_W) {
   3172 					cpu_idcache_wbinv_range(pv->pv_va,
   3173 					    NBPG);
   3174 				} else if ((npte & L2_TYPE_MASK)
   3175 					   != L2_TYPE_INV) {
   3176 					/* XXXJRT need idcache_inv_range */
   3177 					cpu_idcache_wbinv_range(pv->pv_va,
   3178 					    NBPG);
   3179 				}
   3180 			}
   3181 
   3182 			/* make the pte invalid */
   3183 			npte = (npte & ~L2_TYPE_MASK) | L2_TYPE_INV;
   3184 		}
   3185 
   3186 		if (npte != opte) {
   3187 			ptes[arm_btop(va)] = npte;
   3188 			/* Flush the TLB entry if a current pmap. */
   3189 			if (pmap_is_curpmap(pv->pv_pmap))
   3190 				cpu_tlb_flushID_SE(pv->pv_va);
   3191 		}
   3192 
   3193 		pmap_unmap_ptes(pv->pv_pmap);		/* unlocks pmap */
   3194 	}
   3195 	cpu_cpwait();
   3196 
   3197 	simple_unlock(&pg->mdpage.pvh_slock);
   3198 	PMAP_HEAD_TO_MAP_UNLOCK();
   3199 }
   3200 
   3201 /*
   3202  * pmap_clear_modify:
   3203  *
   3204  *	Clear the "modified" attribute for a page.
   3205  */
   3206 boolean_t
   3207 pmap_clear_modify(struct vm_page *pg)
   3208 {
   3209 	boolean_t rv;
   3210 
   3211 	if (pg->mdpage.pvh_attrs & PVF_MOD) {
   3212 		rv = TRUE;
   3213 		pmap_clearbit(pg, PVF_MOD);
   3214 	} else
   3215 		rv = FALSE;
   3216 
   3217 	PDEBUG(0, printf("pmap_clear_modify pa=%08lx -> %d\n",
   3218 	    VM_PAGE_TO_PHYS(pg), rv));
   3219 
   3220 	return (rv);
   3221 }
   3222 
   3223 /*
   3224  * pmap_clear_reference:
   3225  *
   3226  *	Clear the "referenced" attribute for a page.
   3227  */
   3228 boolean_t
   3229 pmap_clear_reference(struct vm_page *pg)
   3230 {
   3231 	boolean_t rv;
   3232 
   3233 	if (pg->mdpage.pvh_attrs & PVF_REF) {
   3234 		rv = TRUE;
   3235 		pmap_clearbit(pg, PVF_REF);
   3236 	} else
   3237 		rv = FALSE;
   3238 
   3239 	PDEBUG(0, printf("pmap_clear_reference pa=%08lx -> %d\n",
   3240 	    VM_PAGE_TO_PHYS(pg), rv));
   3241 
   3242 	return (rv);
   3243 }
   3244 
   3245 /*
   3246  * pmap_is_modified:
   3247  *
   3248  *	Test if a page has the "modified" attribute.
   3249  */
   3250 /* See <arm/arm32/pmap.h> */
   3251 
   3252 /*
   3253  * pmap_is_referenced:
   3254  *
   3255  *	Test if a page has the "referenced" attribute.
   3256  */
   3257 /* See <arm/arm32/pmap.h> */
   3258 
   3259 int
   3260 pmap_modified_emulation(struct pmap *pmap, vaddr_t va)
   3261 {
   3262 	pt_entry_t *ptes;
   3263 	struct vm_page *pg;
   3264 	paddr_t pa;
   3265 	u_int flags;
   3266 	int rv = 0;
   3267 
   3268 	PDEBUG(2, printf("pmap_modified_emulation\n"));
   3269 
   3270 	PMAP_MAP_TO_HEAD_LOCK();
   3271 	ptes = pmap_map_ptes(pmap);		/* locks pmap */
   3272 
   3273 	if (pmap_pde_v(pmap_pde(pmap, va)) == 0) {
   3274 		PDEBUG(2, printf("L1 PTE invalid\n"));
   3275 		goto out;
   3276 	}
   3277 
   3278 	PDEBUG(1, printf("pte=%08x\n", ptes[arm_btop(va)]));
   3279 
   3280 	/* Check for a invalid pte */
   3281 	if (l2pte_valid(ptes[arm_btop(va)]) == 0)
   3282 		goto out;
   3283 
   3284 	/* This can happen if user code tries to access kernel memory. */
   3285 	if ((ptes[arm_btop(va)] & L2_S_PROT_W) != 0)
   3286 		goto out;
   3287 
   3288 	/* Extract the physical address of the page */
   3289 	pa = l2pte_pa(ptes[arm_btop(va)]);
   3290 	if ((pg = PHYS_TO_VM_PAGE(pa)) == NULL)
   3291 		goto out;
   3292 
   3293 	/* Get the current flags for this page. */
   3294 	simple_lock(&pg->mdpage.pvh_slock);
   3295 
   3296 	flags = pmap_modify_pv(pmap, va, pg, 0, 0);
   3297 	PDEBUG(2, printf("pmap_modified_emulation: flags = %08x\n", flags));
   3298 
   3299 	/*
   3300 	 * Do the flags say this page is writable ? If not then it is a
   3301 	 * genuine write fault. If yes then the write fault is our fault
   3302 	 * as we did not reflect the write access in the PTE. Now we know
   3303 	 * a write has occurred we can correct this and also set the
   3304 	 * modified bit
   3305 	 */
   3306 	if (~flags & PVF_WRITE) {
   3307 	    	simple_unlock(&pg->mdpage.pvh_slock);
   3308 		goto out;
   3309 	}
   3310 
   3311 	PDEBUG(0,
   3312 	    printf("pmap_modified_emulation: Got a hit va=%08lx, pte = %08x\n",
   3313 	    va, ptes[arm_btop(va)]));
   3314 	pg->mdpage.pvh_attrs |= PVF_REF | PVF_MOD;
   3315 
   3316 	/*
   3317 	 * Re-enable write permissions for the page.  No need to call
   3318 	 * pmap_vac_me_harder(), since this is just a
   3319 	 * modified-emulation fault, and the PVF_WRITE bit isn't changing.
   3320 	 * We've already set the cacheable bits based on the assumption
   3321 	 * that we can write to this page.
   3322 	 */
   3323 	ptes[arm_btop(va)] =
   3324 	    (ptes[arm_btop(va)] & ~L2_TYPE_MASK) | L2_S_PROTO | L2_S_PROT_W;
   3325 	PDEBUG(0, printf("->(%08x)\n", ptes[arm_btop(va)]));
   3326 
   3327 	simple_unlock(&pg->mdpage.pvh_slock);
   3328 
   3329 	cpu_tlb_flushID_SE(va);
   3330 	cpu_cpwait();
   3331 	rv = 1;
   3332  out:
   3333 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   3334 	PMAP_MAP_TO_HEAD_UNLOCK();
   3335 	return (rv);
   3336 }
   3337 
   3338 int
   3339 pmap_handled_emulation(struct pmap *pmap, vaddr_t va)
   3340 {
   3341 	pt_entry_t *ptes;
   3342 	struct vm_page *pg;
   3343 	paddr_t pa;
   3344 	int rv = 0;
   3345 
   3346 	PDEBUG(2, printf("pmap_handled_emulation\n"));
   3347 
   3348 	PMAP_MAP_TO_HEAD_LOCK();
   3349 	ptes = pmap_map_ptes(pmap);		/* locks pmap */
   3350 
   3351 	if (pmap_pde_v(pmap_pde(pmap, va)) == 0) {
   3352 		PDEBUG(2, printf("L1 PTE invalid\n"));
   3353 		goto out;
   3354 	}
   3355 
   3356 	PDEBUG(1, printf("pte=%08x\n", ptes[arm_btop(va)]));
   3357 
   3358 	/* Check for invalid pte */
   3359 	if (l2pte_valid(ptes[arm_btop(va)]) == 0)
   3360 		goto out;
   3361 
   3362 	/* This can happen if user code tries to access kernel memory. */
   3363 	if ((ptes[arm_btop(va)] & L2_TYPE_MASK) != L2_TYPE_INV)
   3364 		goto out;
   3365 
   3366 	/* Extract the physical address of the page */
   3367 	pa = l2pte_pa(ptes[arm_btop(va)]);
   3368 	if ((pg = PHYS_TO_VM_PAGE(pa)) == NULL)
   3369 		goto out;
   3370 
   3371 	simple_lock(&pg->mdpage.pvh_slock);
   3372 
   3373 	/*
   3374 	 * Ok we just enable the pte and mark the attibs as handled
   3375 	 * XXX Should we traverse the PV list and enable all PTEs?
   3376 	 */
   3377 	PDEBUG(0,
   3378 	    printf("pmap_handled_emulation: Got a hit va=%08lx pte = %08x\n",
   3379 	    va, ptes[arm_btop(va)]));
   3380 	pg->mdpage.pvh_attrs |= PVF_REF;
   3381 
   3382 	ptes[arm_btop(va)] = (ptes[arm_btop(va)] & ~L2_TYPE_MASK) | L2_S_PROTO;
   3383 	PDEBUG(0, printf("->(%08x)\n", ptes[arm_btop(va)]));
   3384 
   3385 	simple_unlock(&pg->mdpage.pvh_slock);
   3386 
   3387 	cpu_tlb_flushID_SE(va);
   3388 	cpu_cpwait();
   3389 	rv = 1;
   3390  out:
   3391 	pmap_unmap_ptes(pmap);			/* unlocks pmap */
   3392 	PMAP_MAP_TO_HEAD_UNLOCK();
   3393 	return (rv);
   3394 }
   3395 
   3396 /*
   3397  * pmap_collect: free resources held by a pmap
   3398  *
   3399  * => optional function.
   3400  * => called when a process is swapped out to free memory.
   3401  */
   3402 
   3403 void
   3404 pmap_collect(struct pmap *pmap)
   3405 {
   3406 }
   3407 
   3408 /*
   3409  * Routine:	pmap_procwr
   3410  *
   3411  * Function:
   3412  *	Synchronize caches corresponding to [addr, addr+len) in p.
   3413  *
   3414  */
   3415 void
   3416 pmap_procwr(struct proc *p, vaddr_t va, int len)
   3417 {
   3418 	/* We only need to do anything if it is the current process. */
   3419 	if (p == curproc)
   3420 		cpu_icache_sync_range(va, len);
   3421 }
   3422 /*
   3423  * PTP functions
   3424  */
   3425 
   3426 /*
   3427  * pmap_get_ptp: get a PTP (if there isn't one, allocate a new one)
   3428  *
   3429  * => pmap should NOT be pmap_kernel()
   3430  * => pmap should be locked
   3431  */
   3432 
   3433 static struct vm_page *
   3434 pmap_get_ptp(struct pmap *pmap, vaddr_t va)
   3435 {
   3436 	struct vm_page *ptp;
   3437 
   3438 	if (pmap_pde_page(pmap_pde(pmap, va))) {
   3439 
   3440 		/* valid... check hint (saves us a PA->PG lookup) */
   3441 		if (pmap->pm_ptphint &&
   3442 		    (pmap->pm_pdir[pmap_pdei(va)] & L2_S_FRAME) ==
   3443 		    VM_PAGE_TO_PHYS(pmap->pm_ptphint))
   3444 			return (pmap->pm_ptphint);
   3445 		ptp = uvm_pagelookup(&pmap->pm_obj, va);
   3446 #ifdef DIAGNOSTIC
   3447 		if (ptp == NULL)
   3448 			panic("pmap_get_ptp: unmanaged user PTP");
   3449 #endif
   3450 		pmap->pm_ptphint = ptp;
   3451 		return(ptp);
   3452 	}
   3453 
   3454 	/* allocate a new PTP (updates ptphint) */
   3455 	return(pmap_alloc_ptp(pmap, va));
   3456 }
   3457 
   3458 /*
   3459  * pmap_alloc_ptp: allocate a PTP for a PMAP
   3460  *
   3461  * => pmap should already be locked by caller
   3462  * => we use the ptp's wire_count to count the number of active mappings
   3463  *	in the PTP (we start it at one to prevent any chance this PTP
   3464  *	will ever leak onto the active/inactive queues)
   3465  */
   3466 
   3467 /*__inline */ static struct vm_page *
   3468 pmap_alloc_ptp(struct pmap *pmap, vaddr_t va)
   3469 {
   3470 	struct vm_page *ptp;
   3471 
   3472 	ptp = uvm_pagealloc(&pmap->pm_obj, va, NULL,
   3473 		UVM_PGA_USERESERVE|UVM_PGA_ZERO);
   3474 	if (ptp == NULL)
   3475 		return (NULL);
   3476 
   3477 	/* got one! */
   3478 	ptp->flags &= ~PG_BUSY;	/* never busy */
   3479 	ptp->wire_count = 1;	/* no mappings yet */
   3480 	pmap_map_in_l1(pmap, va, VM_PAGE_TO_PHYS(ptp), TRUE);
   3481 	pmap->pm_stats.resident_count++;	/* count PTP as resident */
   3482 	pmap->pm_ptphint = ptp;
   3483 	return (ptp);
   3484 }
   3485 
   3486 vaddr_t
   3487 pmap_growkernel(vaddr_t maxkvaddr)
   3488 {
   3489 	struct pmap *kpm = pmap_kernel(), *pm;
   3490 	int s;
   3491 	paddr_t ptaddr;
   3492 	struct vm_page *ptp;
   3493 
   3494 	if (maxkvaddr <= pmap_curmaxkvaddr)
   3495 		goto out;		/* we are OK */
   3496 	NPDEBUG(PDB_GROWKERN, printf("pmap_growkernel: growing kernel from %lx to %lx\n",
   3497 		    pmap_curmaxkvaddr, maxkvaddr));
   3498 
   3499 	/*
   3500 	 * whoops!   we need to add kernel PTPs
   3501 	 */
   3502 
   3503 	s = splhigh();	/* to be safe */
   3504 	simple_lock(&kpm->pm_obj.vmobjlock);
   3505 	/* due to the way the arm pmap works we map 4MB at a time */
   3506 	for (/*null*/ ; pmap_curmaxkvaddr < maxkvaddr;
   3507 	     pmap_curmaxkvaddr += 4 * L1_S_SIZE) {
   3508 
   3509 		if (uvm.page_init_done == FALSE) {
   3510 
   3511 			/*
   3512 			 * we're growing the kernel pmap early (from
   3513 			 * uvm_pageboot_alloc()).  this case must be
   3514 			 * handled a little differently.
   3515 			 */
   3516 
   3517 			if (uvm_page_physget(&ptaddr) == FALSE)
   3518 				panic("pmap_growkernel: out of memory");
   3519 			pmap_zero_page(ptaddr);
   3520 
   3521 			/* map this page in */
   3522 			pmap_map_in_l1(kpm, pmap_curmaxkvaddr, ptaddr, TRUE);
   3523 
   3524 			/* count PTP as resident */
   3525 			kpm->pm_stats.resident_count++;
   3526 			continue;
   3527 		}
   3528 
   3529 		/*
   3530 		 * THIS *MUST* BE CODED SO AS TO WORK IN THE
   3531 		 * pmap_initialized == FALSE CASE!  WE MAY BE
   3532 		 * INVOKED WHILE pmap_init() IS RUNNING!
   3533 		 */
   3534 
   3535 		if ((ptp = pmap_alloc_ptp(kpm, pmap_curmaxkvaddr)) == NULL)
   3536 			panic("pmap_growkernel: alloc ptp failed");
   3537 
   3538 		/* distribute new kernel PTP to all active pmaps */
   3539 		simple_lock(&pmaps_lock);
   3540 		LIST_FOREACH(pm, &pmaps, pm_list) {
   3541 			pmap_map_in_l1(pm, pmap_curmaxkvaddr,
   3542 			    VM_PAGE_TO_PHYS(ptp), TRUE);
   3543 		}
   3544 
   3545 		simple_unlock(&pmaps_lock);
   3546 	}
   3547 
   3548 	/*
   3549 	 * flush out the cache, expensive but growkernel will happen so
   3550 	 * rarely
   3551 	 */
   3552 	cpu_tlb_flushD();
   3553 	cpu_cpwait();
   3554 
   3555 	simple_unlock(&kpm->pm_obj.vmobjlock);
   3556 	splx(s);
   3557 
   3558 out:
   3559 	return (pmap_curmaxkvaddr);
   3560 }
   3561 
   3562 /************************ Utility routines ****************************/
   3563 
   3564 /*
   3565  * vector_page_setprot:
   3566  *
   3567  *	Manipulate the protection of the vector page.
   3568  */
   3569 void
   3570 vector_page_setprot(int prot)
   3571 {
   3572 	pt_entry_t *pte;
   3573 
   3574 	pte = vtopte(vector_page);
   3575 
   3576 	*pte = (*pte & ~L1_S_PROT_MASK) | L2_S_PROT(PTE_KERNEL, prot);
   3577 	cpu_tlb_flushD_SE(vector_page);
   3578 	cpu_cpwait();
   3579 }
   3580 
   3581 /************************ Bootstrapping routines ****************************/
   3582 
   3583 /*
   3584  * This list exists for the benefit of pmap_map_chunk().  It keeps track
   3585  * of the kernel L2 tables during bootstrap, so that pmap_map_chunk() can
   3586  * find them as necessary.
   3587  *
   3588  * Note that the data on this list is not valid after initarm() returns.
   3589  */
   3590 SLIST_HEAD(, pv_addr) kernel_pt_list = SLIST_HEAD_INITIALIZER(kernel_pt_list);
   3591 
   3592 static vaddr_t
   3593 kernel_pt_lookup(paddr_t pa)
   3594 {
   3595 	pv_addr_t *pv;
   3596 
   3597 	SLIST_FOREACH(pv, &kernel_pt_list, pv_list) {
   3598 		if (pv->pv_pa == pa)
   3599 			return (pv->pv_va);
   3600 	}
   3601 	return (0);
   3602 }
   3603 
   3604 /*
   3605  * pmap_map_section:
   3606  *
   3607  *	Create a single section mapping.
   3608  */
   3609 void
   3610 pmap_map_section(vaddr_t l1pt, vaddr_t va, paddr_t pa, int prot, int cache)
   3611 {
   3612 	pd_entry_t *pde = (pd_entry_t *) l1pt;
   3613 	pd_entry_t fl = (cache == PTE_CACHE) ? pte_l1_s_cache_mode : 0;
   3614 
   3615 	KASSERT(((va | pa) & L1_S_OFFSET) == 0);
   3616 
   3617 	pde[va >> L1_S_SHIFT] = L1_S_PROTO | pa |
   3618 	    L1_S_PROT(PTE_KERNEL, prot) | fl;
   3619 }
   3620 
   3621 /*
   3622  * pmap_map_entry:
   3623  *
   3624  *	Create a single page mapping.
   3625  */
   3626 void
   3627 pmap_map_entry(vaddr_t l1pt, vaddr_t va, paddr_t pa, int prot, int cache)
   3628 {
   3629 	pd_entry_t *pde = (pd_entry_t *) l1pt;
   3630 	pt_entry_t fl = (cache == PTE_CACHE) ? pte_l2_s_cache_mode : 0;
   3631 	pt_entry_t *pte;
   3632 
   3633 	KASSERT(((va | pa) & PGOFSET) == 0);
   3634 
   3635 	if ((pde[va >> L1_S_SHIFT] & L1_TYPE_MASK) != L1_TYPE_C)
   3636 		panic("pmap_map_entry: no L2 table for VA 0x%08lx", va);
   3637 
   3638 	pte = (pt_entry_t *)
   3639 	    kernel_pt_lookup(pde[va >> L1_S_SHIFT] & L2_S_FRAME);
   3640 	if (pte == NULL)
   3641 		panic("pmap_map_entry: can't find L2 table for VA 0x%08lx", va);
   3642 
   3643 	pte[(va >> PGSHIFT) & 0x3ff] = L2_S_PROTO | pa |
   3644 	    L2_S_PROT(PTE_KERNEL, prot) | fl;
   3645 }
   3646 
   3647 /*
   3648  * pmap_link_l2pt:
   3649  *
   3650  *	Link the L2 page table specified by "pa" into the L1
   3651  *	page table at the slot for "va".
   3652  */
   3653 void
   3654 pmap_link_l2pt(vaddr_t l1pt, vaddr_t va, pv_addr_t *l2pv)
   3655 {
   3656 	pd_entry_t *pde = (pd_entry_t *) l1pt;
   3657 	u_int slot = va >> L1_S_SHIFT;
   3658 
   3659 	KASSERT((l2pv->pv_pa & PGOFSET) == 0);
   3660 
   3661 	pde[slot + 0] = L1_C_PROTO | (l2pv->pv_pa + 0x000);
   3662 	pde[slot + 1] = L1_C_PROTO | (l2pv->pv_pa + 0x400);
   3663 	pde[slot + 2] = L1_C_PROTO | (l2pv->pv_pa + 0x800);
   3664 	pde[slot + 3] = L1_C_PROTO | (l2pv->pv_pa + 0xc00);
   3665 
   3666 	SLIST_INSERT_HEAD(&kernel_pt_list, l2pv, pv_list);
   3667 }
   3668 
   3669 /*
   3670  * pmap_map_chunk:
   3671  *
   3672  *	Map a chunk of memory using the most efficient mappings
   3673  *	possible (section, large page, small page) into the
   3674  *	provided L1 and L2 tables at the specified virtual address.
   3675  */
   3676 vsize_t
   3677 pmap_map_chunk(vaddr_t l1pt, vaddr_t va, paddr_t pa, vsize_t size,
   3678     int prot, int cache)
   3679 {
   3680 	pd_entry_t *pde = (pd_entry_t *) l1pt;
   3681 	pt_entry_t *pte, fl;
   3682 	vsize_t resid;
   3683 	int i;
   3684 
   3685 	resid = (size + (NBPG - 1)) & ~(NBPG - 1);
   3686 
   3687 	if (l1pt == 0)
   3688 		panic("pmap_map_chunk: no L1 table provided");
   3689 
   3690 #ifdef VERBOSE_INIT_ARM
   3691 	printf("pmap_map_chunk: pa=0x%lx va=0x%lx size=0x%lx resid=0x%lx "
   3692 	    "prot=0x%x cache=%d\n", pa, va, size, resid, prot, cache);
   3693 #endif
   3694 
   3695 	size = resid;
   3696 
   3697 	while (resid > 0) {
   3698 		/* See if we can use a section mapping. */
   3699 		if (((pa | va) & L1_S_OFFSET) == 0 &&
   3700 		    resid >= L1_S_SIZE) {
   3701 			fl = (cache == PTE_CACHE) ? pte_l1_s_cache_mode : 0;
   3702 #ifdef VERBOSE_INIT_ARM
   3703 			printf("S");
   3704 #endif
   3705 			pde[va >> L1_S_SHIFT] = L1_S_PROTO | pa |
   3706 			    L1_S_PROT(PTE_KERNEL, prot) | fl;
   3707 			va += L1_S_SIZE;
   3708 			pa += L1_S_SIZE;
   3709 			resid -= L1_S_SIZE;
   3710 			continue;
   3711 		}
   3712 
   3713 		/*
   3714 		 * Ok, we're going to use an L2 table.  Make sure
   3715 		 * one is actually in the corresponding L1 slot
   3716 		 * for the current VA.
   3717 		 */
   3718 		if ((pde[va >> L1_S_SHIFT] & L1_TYPE_MASK) != L1_TYPE_C)
   3719 			panic("pmap_map_chunk: no L2 table for VA 0x%08lx", va);
   3720 
   3721 		pte = (pt_entry_t *)
   3722 		    kernel_pt_lookup(pde[va >> L1_S_SHIFT] & L2_S_FRAME);
   3723 		if (pte == NULL)
   3724 			panic("pmap_map_chunk: can't find L2 table for VA"
   3725 			    "0x%08lx", va);
   3726 
   3727 		/* See if we can use a L2 large page mapping. */
   3728 		if (((pa | va) & L2_L_OFFSET) == 0 &&
   3729 		    resid >= L2_L_SIZE) {
   3730 			fl = (cache == PTE_CACHE) ? pte_l2_l_cache_mode : 0;
   3731 #ifdef VERBOSE_INIT_ARM
   3732 			printf("L");
   3733 #endif
   3734 			for (i = 0; i < 16; i++) {
   3735 				pte[((va >> PGSHIFT) & 0x3f0) + i] =
   3736 				    L2_L_PROTO | pa |
   3737 				    L2_L_PROT(PTE_KERNEL, prot) | fl;
   3738 			}
   3739 			va += L2_L_SIZE;
   3740 			pa += L2_L_SIZE;
   3741 			resid -= L2_L_SIZE;
   3742 			continue;
   3743 		}
   3744 
   3745 		/* Use a small page mapping. */
   3746 		fl = (cache == PTE_CACHE) ? pte_l2_s_cache_mode : 0;
   3747 #ifdef VERBOSE_INIT_ARM
   3748 		printf("P");
   3749 #endif
   3750 		pte[(va >> PGSHIFT) & 0x3ff] = L2_S_PROTO | pa |
   3751 		    L2_S_PROT(PTE_KERNEL, prot) | fl;
   3752 		va += NBPG;
   3753 		pa += NBPG;
   3754 		resid -= NBPG;
   3755 	}
   3756 #ifdef VERBOSE_INIT_ARM
   3757 	printf("\n");
   3758 #endif
   3759 	return (size);
   3760 }
   3761 
   3762 /********************** PTE initialization routines **************************/
   3763 
   3764 /*
   3765  * These routines are called when the CPU type is identified to set up
   3766  * the PTE prototypes, cache modes, etc.
   3767  *
   3768  * The variables are always here, just in case LKMs need to reference
   3769  * them (though, they shouldn't).
   3770  */
   3771 
   3772 pt_entry_t	pte_l1_s_cache_mode;
   3773 pt_entry_t	pte_l1_s_cache_mask;
   3774 
   3775 pt_entry_t	pte_l2_l_cache_mode;
   3776 pt_entry_t	pte_l2_l_cache_mask;
   3777 
   3778 pt_entry_t	pte_l2_s_cache_mode;
   3779 pt_entry_t	pte_l2_s_cache_mask;
   3780 
   3781 pt_entry_t	pte_l2_s_prot_u;
   3782 pt_entry_t	pte_l2_s_prot_w;
   3783 pt_entry_t	pte_l2_s_prot_mask;
   3784 
   3785 pt_entry_t	pte_l1_s_proto;
   3786 pt_entry_t	pte_l1_c_proto;
   3787 pt_entry_t	pte_l2_s_proto;
   3788 
   3789 void		(*pmap_copy_page_func)(paddr_t, paddr_t);
   3790 void		(*pmap_zero_page_func)(paddr_t);
   3791 
   3792 #if ARM_MMU_GENERIC == 1
   3793 void
   3794 pmap_pte_init_generic(void)
   3795 {
   3796 
   3797 	pte_l1_s_cache_mode = L1_S_B|L1_S_C;
   3798 	pte_l1_s_cache_mask = L1_S_CACHE_MASK_generic;
   3799 
   3800 	pte_l2_l_cache_mode = L2_B|L2_C;
   3801 	pte_l2_l_cache_mask = L2_L_CACHE_MASK_generic;
   3802 
   3803 	pte_l2_s_cache_mode = L2_B|L2_C;
   3804 	pte_l2_s_cache_mask = L2_S_CACHE_MASK_generic;
   3805 
   3806 	pte_l2_s_prot_u = L2_S_PROT_U_generic;
   3807 	pte_l2_s_prot_w = L2_S_PROT_W_generic;
   3808 	pte_l2_s_prot_mask = L2_S_PROT_MASK_generic;
   3809 
   3810 	pte_l1_s_proto = L1_S_PROTO_generic;
   3811 	pte_l1_c_proto = L1_C_PROTO_generic;
   3812 	pte_l2_s_proto = L2_S_PROTO_generic;
   3813 
   3814 	pmap_copy_page_func = pmap_copy_page_generic;
   3815 	pmap_zero_page_func = pmap_zero_page_generic;
   3816 }
   3817 
   3818 #if defined(CPU_ARM9)
   3819 void
   3820 pmap_pte_init_arm9(void)
   3821 {
   3822 
   3823 	/*
   3824 	 * ARM9 is compatible with generic, but we want to use
   3825 	 * write-through caching for now.
   3826 	 */
   3827 	pmap_pte_init_generic();
   3828 
   3829 	pte_l1_s_cache_mode = L1_S_C;
   3830 	pte_l2_l_cache_mode = L2_C;
   3831 	pte_l2_s_cache_mode = L2_C;
   3832 }
   3833 #endif /* CPU_ARM9 */
   3834 #endif /* ARM_MMU_GENERIC == 1 */
   3835 
   3836 #if ARM_MMU_XSCALE == 1
   3837 void
   3838 pmap_pte_init_xscale(void)
   3839 {
   3840 	uint32_t auxctl;
   3841 
   3842 	pte_l1_s_cache_mode = L1_S_B|L1_S_C;
   3843 	pte_l1_s_cache_mask = L1_S_CACHE_MASK_xscale;
   3844 
   3845 	pte_l2_l_cache_mode = L2_B|L2_C;
   3846 	pte_l2_l_cache_mask = L2_L_CACHE_MASK_xscale;
   3847 
   3848 	pte_l2_s_cache_mode = L2_B|L2_C;
   3849 	pte_l2_s_cache_mask = L2_S_CACHE_MASK_xscale;
   3850 
   3851 #ifdef XSCALE_CACHE_READ_WRITE_ALLOCATE
   3852 	/*
   3853 	 * The XScale core has an enhanced mode where writes that
   3854 	 * miss the cache cause a cache line to be allocated.  This
   3855 	 * is significantly faster than the traditional, write-through
   3856 	 * behavior of this case.
   3857 	 *
   3858 	 * However, there is a bug lurking in this pmap module, or in
   3859 	 * other parts of the VM system, or both, which causes corruption
   3860 	 * of NFS-backed files when this cache mode is used.  We have
   3861 	 * an ugly work-around for this problem (disable r/w-allocate
   3862 	 * for managed kernel mappings), but the bug is still evil enough
   3863 	 * to consider this cache mode "experimental".
   3864 	 */
   3865 	pte_l1_s_cache_mode |= L1_S_XSCALE_TEX(TEX_XSCALE_X);
   3866 	pte_l2_l_cache_mode |= L2_XSCALE_L_TEX(TEX_XSCALE_X);
   3867 	pte_l2_s_cache_mode |= L2_XSCALE_T_TEX(TEX_XSCALE_X);
   3868 #endif /* XSCALE_CACHE_READ_WRITE_ALLOCATE */
   3869 
   3870 #ifdef XSCALE_CACHE_WRITE_THROUGH
   3871 	/*
   3872 	 * Some versions of the XScale core have various bugs in
   3873 	 * their cache units, the work-around for which is to run
   3874 	 * the cache in write-through mode.  Unfortunately, this
   3875 	 * has a major (negative) impact on performance.  So, we
   3876 	 * go ahead and run fast-and-loose, in the hopes that we
   3877 	 * don't line up the planets in a way that will trip the
   3878 	 * bugs.
   3879 	 *
   3880 	 * However, we give you the option to be slow-but-correct.
   3881 	 */
   3882 	pte_l1_s_cache_mode = L1_S_C;
   3883 	pte_l2_l_cache_mode = L2_C;
   3884 	pte_l2_s_cache_mode = L2_C;
   3885 #endif /* XSCALE_CACHE_WRITE_THROUGH */
   3886 
   3887 	pte_l2_s_prot_u = L2_S_PROT_U_xscale;
   3888 	pte_l2_s_prot_w = L2_S_PROT_W_xscale;
   3889 	pte_l2_s_prot_mask = L2_S_PROT_MASK_xscale;
   3890 
   3891 	pte_l1_s_proto = L1_S_PROTO_xscale;
   3892 	pte_l1_c_proto = L1_C_PROTO_xscale;
   3893 	pte_l2_s_proto = L2_S_PROTO_xscale;
   3894 
   3895 	pmap_copy_page_func = pmap_copy_page_xscale;
   3896 	pmap_zero_page_func = pmap_zero_page_xscale;
   3897 
   3898 	/*
   3899 	 * Disable ECC protection of page table access, for now.
   3900 	 */
   3901 	__asm __volatile("mrc p15, 0, %0, c1, c0, 1"
   3902 		: "=r" (auxctl));
   3903 	auxctl &= ~XSCALE_AUXCTL_P;
   3904 	__asm __volatile("mcr p15, 0, %0, c1, c0, 1"
   3905 		:
   3906 		: "r" (auxctl));
   3907 }
   3908 
   3909 /*
   3910  * xscale_setup_minidata:
   3911  *
   3912  *	Set up the mini-data cache clean area.  We require the
   3913  *	caller to allocate the right amount of physically and
   3914  *	virtually contiguous space.
   3915  */
   3916 void
   3917 xscale_setup_minidata(vaddr_t l1pt, vaddr_t va, paddr_t pa)
   3918 {
   3919 	extern vaddr_t xscale_minidata_clean_addr;
   3920 	extern vsize_t xscale_minidata_clean_size; /* already initialized */
   3921 	pd_entry_t *pde = (pd_entry_t *) l1pt;
   3922 	pt_entry_t *pte;
   3923 	vsize_t size;
   3924 	uint32_t auxctl;
   3925 
   3926 	xscale_minidata_clean_addr = va;
   3927 
   3928 	/* Round it to page size. */
   3929 	size = (xscale_minidata_clean_size + L2_S_OFFSET) & L2_S_FRAME;
   3930 
   3931 	for (; size != 0;
   3932 	     va += L2_S_SIZE, pa += L2_S_SIZE, size -= L2_S_SIZE) {
   3933 		pte = (pt_entry_t *)
   3934 		    kernel_pt_lookup(pde[va >> L1_S_SHIFT] & L2_S_FRAME);
   3935 		if (pte == NULL)
   3936 			panic("xscale_setup_minidata: can't find L2 table for "
   3937 			    "VA 0x%08lx", va);
   3938 		pte[(va >> PGSHIFT) & 0x3ff] = L2_S_PROTO | pa |
   3939 		    L2_S_PROT(PTE_KERNEL, VM_PROT_READ) |
   3940 		    L2_C | L2_XSCALE_T_TEX(TEX_XSCALE_X);
   3941 	}
   3942 
   3943 	/*
   3944 	 * Configure the mini-data cache for write-back with
   3945 	 * read/write-allocate.
   3946 	 *
   3947 	 * NOTE: In order to reconfigure the mini-data cache, we must
   3948 	 * make sure it contains no valid data!  In order to do that,
   3949 	 * we must issue a global data cache invalidate command!
   3950 	 *
   3951 	 * WE ASSUME WE ARE RUNNING UN-CACHED WHEN THIS ROUTINE IS CALLED!
   3952 	 * THIS IS VERY IMPORTANT!
   3953 	 */
   3954 
   3955 	/* Invalidate data and mini-data. */
   3956 	__asm __volatile("mcr p15, 0, %0, c7, c6, 0"
   3957 		:
   3958 		: "r" (auxctl));
   3959 
   3960 
   3961 	__asm __volatile("mrc p15, 0, %0, c1, c0, 1"
   3962 		: "=r" (auxctl));
   3963 	auxctl = (auxctl & ~XSCALE_AUXCTL_MD_MASK) | XSCALE_AUXCTL_MD_WB_RWA;
   3964 	__asm __volatile("mcr p15, 0, %0, c1, c0, 1"
   3965 		:
   3966 		: "r" (auxctl));
   3967 }
   3968 #endif /* ARM_MMU_XSCALE == 1 */
   3969