xref: /netbsd-src/sys/arch/powerpc/ibm4xx/pmap.c (revision 4d342c046e3288fb5a1edcd33cfec48c41c80664)
1 /*	$NetBSD: pmap.c,v 1.95 2020/09/10 04:36:24 rin Exp $	*/
2 
3 /*
4  * Copyright 2001 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Eduardo Horvath and Simon Burge for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *      This product includes software developed for the NetBSD Project by
20  *      Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Copyright (C) 1995, 1996 Wolfgang Solfrank.
40  * Copyright (C) 1995, 1996 TooLs GmbH.
41  * All rights reserved.
42  *
43  * Redistribution and use in source and binary forms, with or without
44  * modification, are permitted provided that the following conditions
45  * are met:
46  * 1. Redistributions of source code must retain the above copyright
47  *    notice, this list of conditions and the following disclaimer.
48  * 2. Redistributions in binary form must reproduce the above copyright
49  *    notice, this list of conditions and the following disclaimer in the
50  *    documentation and/or other materials provided with the distribution.
51  * 3. All advertising materials mentioning features or use of this software
52  *    must display the following acknowledgement:
53  *	This product includes software developed by TooLs GmbH.
54  * 4. The name of TooLs GmbH may not be used to endorse or promote products
55  *    derived from this software without specific prior written permission.
56  *
57  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
58  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
59  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
60  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
61  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
62  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
63  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
64  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
65  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
66  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
67  */
68 
69 #include <sys/cdefs.h>
70 __KERNEL_RCSID(0, "$NetBSD: pmap.c,v 1.95 2020/09/10 04:36:24 rin Exp $");
71 
72 #ifdef _KERNEL_OPT
73 #include "opt_ddb.h"
74 #include "opt_pmap.h"
75 #endif
76 
77 #include <sys/param.h>
78 #include <sys/cpu.h>
79 #include <sys/device.h>
80 #include <sys/kmem.h>
81 #include <sys/pool.h>
82 #include <sys/proc.h>
83 #include <sys/queue.h>
84 #include <sys/systm.h>
85 
86 #include <uvm/uvm.h>
87 
88 #include <machine/powerpc.h>
89 #include <machine/tlb.h>
90 
91 #include <powerpc/pcb.h>
92 
93 #include <powerpc/spr.h>
94 #include <powerpc/ibm4xx/spr.h>
95 
96 #include <powerpc/ibm4xx/cpu.h>
97 
98 /*
99  * kernmap is an array of PTEs large enough to map in
100  * 4GB.  At 16KB/page it is 256K entries or 2MB.
101  */
102 #define KERNMAP_SIZE	((0xffffffffU/PAGE_SIZE)+1)
103 void *kernmap;
104 
105 #define MINCTX		2
106 #define NUMCTX		256
107 
108 volatile struct pmap *ctxbusy[NUMCTX];
109 
110 #define TLBF_USED	0x1
111 #define	TLBF_REF	0x2
112 #define	TLBF_LOCKED	0x4
113 #define	TLB_LOCKED(i)	(tlb_info[(i)].ti_flags & TLBF_LOCKED)
114 
115 typedef struct tlb_info_s {
116 	char	ti_flags;
117 	char	ti_ctx;		/* TLB_PID assiciated with the entry */
118 	u_int	ti_va;
119 } tlb_info_t;
120 
121 volatile tlb_info_t tlb_info[NTLB];
122 /* We'll use a modified FIFO replacement policy cause it's cheap */
123 volatile int tlbnext;
124 
125 static int tlb_nreserved = 0;
126 static int pmap_bootstrap_done = 0;
127 
128 /* Event counters */
129 struct evcnt tlbmiss_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
130 	NULL, "cpu", "tlbmiss");
131 struct evcnt tlbflush_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
132 	NULL, "cpu", "tlbflush");
133 struct evcnt tlbenter_ev = EVCNT_INITIALIZER(EVCNT_TYPE_TRAP,
134 	NULL, "cpu", "tlbenter");
135 EVCNT_ATTACH_STATIC(tlbmiss_ev);
136 EVCNT_ATTACH_STATIC(tlbflush_ev);
137 EVCNT_ATTACH_STATIC(tlbenter_ev);
138 
139 struct pmap kernel_pmap_;
140 struct pmap *const kernel_pmap_ptr = &kernel_pmap_;
141 
142 static int npgs;
143 static u_int nextavail;
144 #ifndef MSGBUFADDR
145 extern paddr_t msgbuf_paddr;
146 #endif
147 
148 static struct mem_region *mem, *avail;
149 
150 /*
151  * This is a cache of referenced/modified bits.
152  * Bits herein are shifted by ATTRSHFT.
153  */
154 static char *pmap_attrib;
155 
156 #define PV_WIRED	0x1
157 #define PV_WIRE(pv)	((pv)->pv_va |= PV_WIRED)
158 #define PV_UNWIRE(pv)	((pv)->pv_va &= ~PV_WIRED)
159 #define PV_ISWIRED(pv)	((pv)->pv_va & PV_WIRED)
160 #define PV_VA(pv)	((pv)->pv_va & ~PV_WIRED)
161 #define PV_CMPVA(va,pv)	(!(PV_VA(pv) ^ (va)))
162 
163 struct pv_entry {
164 	struct pv_entry *pv_next;	/* Linked list of mappings */
165 	struct pmap *pv_pm;
166 	vaddr_t pv_va;			/* virtual address of mapping */
167 };
168 
169 /* Each index corresponds to TLB_SIZE_* value. */
170 static size_t tlbsize[] = {
171 	1024, 		/* TLB_SIZE_1K */
172 	4096, 		/* TLB_SIZE_4K */
173 	16384, 		/* TLB_SIZE_16K */
174 	65536, 		/* TLB_SIZE_64K */
175 	262144, 	/* TLB_SIZE_256K */
176 	1048576, 	/* TLB_SIZE_1M */
177 	4194304, 	/* TLB_SIZE_4M */
178 	16777216, 	/* TLB_SIZE_16M */
179 };
180 
181 struct pv_entry *pv_table;
182 static struct pool pv_pool;
183 
184 static int pmap_initialized;
185 
186 static int ctx_flush(int);
187 
188 struct pv_entry *pa_to_pv(paddr_t);
189 static inline char *pa_to_attr(paddr_t);
190 
191 static inline volatile u_int *pte_find(struct pmap *, vaddr_t);
192 static inline int pte_enter(struct pmap *, vaddr_t, u_int);
193 
194 static inline int pmap_enter_pv(struct pmap *, vaddr_t, paddr_t, int);
195 static void pmap_remove_pv(struct pmap *, vaddr_t, paddr_t);
196 
197 static inline void tlb_invalidate_entry(int);
198 
199 static int ppc4xx_tlb_size_mask(size_t, int *, int *);
200 
201 
202 struct pv_entry *
203 pa_to_pv(paddr_t pa)
204 {
205 	uvm_physseg_t bank;
206 	psize_t pg;
207 
208 	bank = uvm_physseg_find(atop(pa), &pg);
209 	if (bank == UVM_PHYSSEG_TYPE_INVALID)
210 		return NULL;
211 	return &uvm_physseg_get_pmseg(bank)->pvent[pg];
212 }
213 
214 static inline char *
215 pa_to_attr(paddr_t pa)
216 {
217 	uvm_physseg_t bank;
218 	psize_t pg;
219 
220 	bank = uvm_physseg_find(atop(pa), &pg);
221 	if (bank == UVM_PHYSSEG_TYPE_INVALID)
222 		return NULL;
223 	return &uvm_physseg_get_pmseg(bank)->attrs[pg];
224 }
225 
226 /*
227  * Insert PTE into page table.
228  */
229 int
230 pte_enter(struct pmap *pm, vaddr_t va, u_int pte)
231 {
232 	int seg = STIDX(va);
233 	int ptn = PTIDX(va);
234 	u_int oldpte;
235 
236 	if (!pm->pm_ptbl[seg]) {
237 		/* Don't allocate a page to clear a non-existent mapping. */
238 		if (!pte)
239 			return (0);
240 		/* Allocate a page XXXX this will sleep! */
241 		pm->pm_ptbl[seg] =
242 		    (uint *)uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
243 		    UVM_KMF_WIRED | UVM_KMF_ZERO);
244 	}
245 	oldpte = pm->pm_ptbl[seg][ptn];
246 	pm->pm_ptbl[seg][ptn] = pte;
247 
248 	/* Flush entry. */
249 	ppc4xx_tlb_flush(va, pm->pm_ctx);
250 	if (oldpte != pte) {
251 		if (pte == 0)
252 			pm->pm_stats.resident_count--;
253 		else
254 			pm->pm_stats.resident_count++;
255 	}
256 	return (1);
257 }
258 
259 /*
260  * Get a pointer to a PTE in a page table.
261  */
262 volatile u_int *
263 pte_find(struct pmap *pm, vaddr_t va)
264 {
265 	int seg = STIDX(va);
266 	int ptn = PTIDX(va);
267 
268 	if (pm->pm_ptbl[seg])
269 		return (&pm->pm_ptbl[seg][ptn]);
270 
271 	return (NULL);
272 }
273 
274 /*
275  * This is called during initppc, before the system is really initialized.
276  */
277 void
278 pmap_bootstrap(u_int kernelstart, u_int kernelend)
279 {
280 	struct mem_region *mp, *mp1;
281 	int cnt, i;
282 	u_int s, e, sz;
283 
284 	tlbnext = tlb_nreserved;
285 
286 	/*
287 	 * Allocate the kernel page table at the end of
288 	 * kernel space so it's in the locked TTE.
289 	 */
290 	kernmap = (void *)kernelend;
291 
292 	/*
293 	 * Initialize kernel page table.
294 	 */
295 	for (i = 0; i < STSZ; i++) {
296 		pmap_kernel()->pm_ptbl[i] = 0;
297 	}
298 	ctxbusy[0] = ctxbusy[1] = pmap_kernel();
299 
300 	/*
301 	 * Announce page-size to the VM-system
302 	 */
303 	uvmexp.pagesize = NBPG;
304 	uvm_md_init();
305 
306 	/*
307 	 * Get memory.
308 	 */
309 	mem_regions(&mem, &avail);
310 	for (mp = mem; mp->size; mp++) {
311 		physmem += btoc(mp->size);
312 		printf("+%lx,",mp->size);
313 	}
314 	printf("\n");
315 	ppc4xx_tlb_init();
316 	/*
317 	 * Count the number of available entries.
318 	 */
319 	for (cnt = 0, mp = avail; mp->size; mp++)
320 		cnt++;
321 
322 	/*
323 	 * Page align all regions.
324 	 * Non-page aligned memory isn't very interesting to us.
325 	 * Also, sort the entries for ascending addresses.
326 	 */
327 	kernelstart &= ~PGOFSET;
328 	kernelend = (kernelend + PGOFSET) & ~PGOFSET;
329 	for (mp = avail; mp->size; mp++) {
330 		s = mp->start;
331 		e = mp->start + mp->size;
332 		printf("%08x-%08x -> ",s,e);
333 		/*
334 		 * Check whether this region holds all of the kernel.
335 		 */
336 		if (s < kernelstart && e > kernelend) {
337 			avail[cnt].start = kernelend;
338 			avail[cnt++].size = e - kernelend;
339 			e = kernelstart;
340 		}
341 		/*
342 		 * Look whether this regions starts within the kernel.
343 		 */
344 		if (s >= kernelstart && s < kernelend) {
345 			if (e <= kernelend)
346 				goto empty;
347 			s = kernelend;
348 		}
349 		/*
350 		 * Now look whether this region ends within the kernel.
351 		 */
352 		if (e > kernelstart && e <= kernelend) {
353 			if (s >= kernelstart)
354 				goto empty;
355 			e = kernelstart;
356 		}
357 		/*
358 		 * Now page align the start and size of the region.
359 		 */
360 		s = round_page(s);
361 		e = trunc_page(e);
362 		if (e < s)
363 			e = s;
364 		sz = e - s;
365 		printf("%08x-%08x = %x\n",s,e,sz);
366 		/*
367 		 * Check whether some memory is left here.
368 		 */
369 		if (sz == 0) {
370 		empty:
371 			memmove(mp, mp + 1,
372 				(cnt - (mp - avail)) * sizeof *mp);
373 			cnt--;
374 			mp--;
375 			continue;
376 		}
377 		/*
378 		 * Do an insertion sort.
379 		 */
380 		npgs += btoc(sz);
381 		for (mp1 = avail; mp1 < mp; mp1++)
382 			if (s < mp1->start)
383 				break;
384 		if (mp1 < mp) {
385 			memmove(mp1 + 1, mp1, (char *)mp - (char *)mp1);
386 			mp1->start = s;
387 			mp1->size = sz;
388 		} else {
389 			mp->start = s;
390 			mp->size = sz;
391 		}
392 	}
393 
394 	/*
395 	 * We cannot do pmap_steal_memory here,
396 	 * since we don't run with translation enabled yet.
397 	 */
398 #ifndef MSGBUFADDR
399 	/*
400 	 * allow for msgbuf
401 	 */
402 	sz = round_page(MSGBUFSIZE);
403 	mp = NULL;
404 	for (mp1 = avail; mp1->size; mp1++)
405 		if (mp1->size >= sz)
406 			mp = mp1;
407 	if (mp == NULL)
408 		panic("not enough memory?");
409 
410 	npgs -= btoc(sz);
411 	msgbuf_paddr = mp->start + mp->size - sz;
412 	mp->size -= sz;
413 	if (mp->size <= 0)
414 		memmove(mp, mp + 1, (cnt - (mp - avail)) * sizeof *mp);
415 #endif
416 
417 	for (mp = avail; mp->size; mp++)
418 		uvm_page_physload(atop(mp->start), atop(mp->start + mp->size),
419 			atop(mp->start), atop(mp->start + mp->size),
420 			VM_FREELIST_DEFAULT);
421 
422 	/*
423 	 * Initialize kernel pmap and hardware.
424 	 */
425 	/* Setup TLB pid allocator so it knows we alreadu using PID 1 */
426 	pmap_kernel()->pm_ctx = KERNEL_PID;
427 	nextavail = avail->start;
428 
429 	pmap_bootstrap_done = 1;
430 }
431 
432 /*
433  * Restrict given range to physical memory
434  *
435  * (Used by /dev/mem)
436  */
437 void
438 pmap_real_memory(paddr_t *start, psize_t *size)
439 {
440 	struct mem_region *mp;
441 
442 	for (mp = mem; mp->size; mp++) {
443 		if (*start + *size > mp->start &&
444 		    *start < mp->start + mp->size) {
445 			if (*start < mp->start) {
446 				*size -= mp->start - *start;
447 				*start = mp->start;
448 			}
449 			if (*start + *size > mp->start + mp->size)
450 				*size = mp->start + mp->size - *start;
451 			return;
452 		}
453 	}
454 	*size = 0;
455 }
456 
457 /*
458  * Initialize anything else for pmap handling.
459  * Called during vm_init().
460  */
461 void
462 pmap_init(void)
463 {
464 	struct pv_entry *pv;
465 	vsize_t sz;
466 	vaddr_t addr;
467 	int i, s;
468 	int bank;
469 	char *attr;
470 
471 	sz = (vsize_t)((sizeof(struct pv_entry) + 1) * npgs);
472 	sz = round_page(sz);
473 	addr = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED | UVM_KMF_ZERO);
474 	s = splvm();
475 	pv = pv_table = (struct pv_entry *)addr;
476 	for (i = npgs; --i >= 0;)
477 		pv++->pv_pm = NULL;
478 	pmap_attrib = (char *)pv;
479 	memset(pv, 0, npgs);
480 
481 	pv = pv_table;
482 	attr = pmap_attrib;
483 	for (bank = uvm_physseg_get_first();
484 	     uvm_physseg_valid_p(bank);
485 	     bank = uvm_physseg_get_next(bank)) {
486 		sz = uvm_physseg_get_end(bank) - uvm_physseg_get_start(bank);
487 		uvm_physseg_get_pmseg(bank)->pvent = pv;
488 		uvm_physseg_get_pmseg(bank)->attrs = attr;
489 		pv += sz;
490 		attr += sz;
491 	}
492 
493 	pmap_initialized = 1;
494 	splx(s);
495 
496 	/* Setup a pool for additional pvlist structures */
497 	pool_init(&pv_pool, sizeof(struct pv_entry), 0, 0, 0, "pv_entry", NULL,
498 	    IPL_VM);
499 }
500 
501 /*
502  * How much virtual space is available to the kernel?
503  */
504 void
505 pmap_virtual_space(vaddr_t *start, vaddr_t *end)
506 {
507 
508 #if 0
509 	/*
510 	 * Reserve one segment for kernel virtual memory
511 	 */
512 	*start = (vaddr_t)(KERNEL_SR << ADDR_SR_SHFT);
513 	*end = *start + SEGMENT_LENGTH;
514 #else
515 	*start = (vaddr_t) VM_MIN_KERNEL_ADDRESS;
516 	*end = (vaddr_t) VM_MAX_KERNEL_ADDRESS;
517 #endif
518 }
519 
520 #ifdef PMAP_GROWKERNEL
521 /*
522  * Preallocate kernel page tables to a specified VA.
523  * This simply loops through the first TTE for each
524  * page table from the beginning of the kernel pmap,
525  * reads the entry, and if the result is
526  * zero (either invalid entry or no page table) it stores
527  * a zero there, populating page tables in the process.
528  * This is not the most efficient technique but i don't
529  * expect it to be called that often.
530  */
531 extern struct vm_page *vm_page_alloc1(void);
532 extern void vm_page_free1(struct vm_page *);
533 
534 vaddr_t kbreak = VM_MIN_KERNEL_ADDRESS;
535 
536 vaddr_t
537 pmap_growkernel(vaddr_t maxkvaddr)
538 {
539 	int s;
540 	int seg;
541 	paddr_t pg;
542 	struct pmap *pm = pmap_kernel();
543 
544 	s = splvm();
545 
546 	/* Align with the start of a page table */
547 	for (kbreak &= ~(PTMAP-1); kbreak < maxkvaddr;
548 	     kbreak += PTMAP) {
549 		seg = STIDX(kbreak);
550 
551 		if (pte_find(pm, kbreak))
552 			continue;
553 
554 		if (uvm.page_init_done) {
555 			pg = (paddr_t)VM_PAGE_TO_PHYS(vm_page_alloc1());
556 		} else {
557 			if (!uvm_page_physget(&pg))
558 				panic("pmap_growkernel: no memory");
559 		}
560 		if (!pg)
561 			panic("pmap_growkernel: no pages");
562 		pmap_zero_page((paddr_t)pg);
563 
564 		/* XXX This is based on all phymem being addressable */
565 		pm->pm_ptbl[seg] = (u_int *)pg;
566 	}
567 	splx(s);
568 	return (kbreak);
569 }
570 
571 /*
572  *	vm_page_alloc1:
573  *
574  *	Allocate and return a memory cell with no associated object.
575  */
576 struct vm_page *
577 vm_page_alloc1(void)
578 {
579 	struct vm_page *pg;
580 
581 	pg = uvm_pagealloc(NULL, 0, NULL, UVM_PGA_USERESERVE);
582 	if (pg) {
583 		pg->wire_count = 1;	/* no mappings yet */
584 		pg->flags &= ~PG_BUSY;	/* never busy */
585 	}
586 	return pg;
587 }
588 
589 /*
590  *	vm_page_free1:
591  *
592  *	Returns the given page to the free list,
593  *	disassociating it with any VM object.
594  *
595  *	Object and page must be locked prior to entry.
596  */
597 void
598 vm_page_free1(struct vm_page *pg)
599 {
600 #ifdef DIAGNOSTIC
601 	if (pg->flags != (PG_CLEAN|PG_FAKE)) {
602 		printf("Freeing invalid page %p\n", pg);
603 		printf("pa = %llx\n", (unsigned long long)VM_PAGE_TO_PHYS(pg));
604 #ifdef DDB
605 		Debugger();
606 #endif
607 		return;
608 	}
609 #endif
610 	pg->flags |= PG_BUSY;
611 	pg->wire_count = 0;
612 	uvm_pagefree(pg);
613 }
614 #endif
615 
616 /*
617  * Create and return a physical map.
618  */
619 struct pmap *
620 pmap_create(void)
621 {
622 	struct pmap *pm;
623 
624 	pm = kmem_alloc(sizeof(*pm), KM_SLEEP);
625 	memset(pm, 0, sizeof *pm);
626 	pm->pm_refs = 1;
627 	return pm;
628 }
629 
630 /*
631  * Add a reference to the given pmap.
632  */
633 void
634 pmap_reference(struct pmap *pm)
635 {
636 
637 	pm->pm_refs++;
638 }
639 
640 /*
641  * Retire the given pmap from service.
642  * Should only be called if the map contains no valid mappings.
643  */
644 void
645 pmap_destroy(struct pmap *pm)
646 {
647 	int i;
648 
649 	if (--pm->pm_refs > 0) {
650 		return;
651 	}
652 	KASSERT(pm->pm_stats.resident_count == 0);
653 	KASSERT(pm->pm_stats.wired_count == 0);
654 	for (i = 0; i < STSZ; i++)
655 		if (pm->pm_ptbl[i]) {
656 			uvm_km_free(kernel_map, (vaddr_t)pm->pm_ptbl[i],
657 			    PAGE_SIZE, UVM_KMF_WIRED);
658 			pm->pm_ptbl[i] = NULL;
659 		}
660 	if (pm->pm_ctx)
661 		ctx_free(pm);
662 	kmem_free(pm, sizeof(*pm));
663 }
664 
665 /*
666  * Copy the range specified by src_addr/len
667  * from the source map to the range dst_addr/len
668  * in the destination map.
669  *
670  * This routine is only advisory and need not do anything.
671  */
672 void
673 pmap_copy(struct pmap *dst_pmap, struct pmap *src_pmap, vaddr_t dst_addr,
674 	  vsize_t len, vaddr_t src_addr)
675 {
676 }
677 
678 /*
679  * Require that all active physical maps contain no
680  * incorrect entries NOW.
681  */
682 void
683 pmap_update(struct pmap *pmap)
684 {
685 }
686 
687 /*
688  * Fill the given physical page with zeroes.
689  */
690 void
691 pmap_zero_page(paddr_t pa)
692 {
693 
694 #ifdef PPC_4XX_NOCACHE
695 	memset((void *)pa, 0, PAGE_SIZE);
696 #else
697 	int i;
698 
699 	for (i = PAGE_SIZE/CACHELINESIZE; i > 0; i--) {
700 		__asm volatile ("dcbz 0,%0" :: "r"(pa));
701 		pa += CACHELINESIZE;
702 	}
703 #endif
704 }
705 
706 /*
707  * Copy the given physical source page to its destination.
708  */
709 void
710 pmap_copy_page(paddr_t src, paddr_t dst)
711 {
712 
713 	memcpy((void *)dst, (void *)src, PAGE_SIZE);
714 	dcache_wbinv_page(dst);
715 }
716 
717 /*
718  * This returns != 0 on success.
719  */
720 static inline int
721 pmap_enter_pv(struct pmap *pm, vaddr_t va, paddr_t pa, int flags)
722 {
723 	struct pv_entry *pv, *npv = NULL;
724 	int s;
725 
726 	if (!pmap_initialized)
727 		return 0;
728 
729 	s = splvm();
730 	pv = pa_to_pv(pa);
731 	if (!pv->pv_pm) {
732 		/*
733 		 * No entries yet, use header as the first entry.
734 		 */
735 		pv->pv_va = va;
736 		pv->pv_pm = pm;
737 		pv->pv_next = NULL;
738 	} else {
739 		/*
740 		 * There is at least one other VA mapping this page.
741 		 * Place this entry after the header.
742 		 */
743 		npv = pool_get(&pv_pool, PR_NOWAIT);
744 		if (npv == NULL) {
745 			if ((flags & PMAP_CANFAIL) == 0)
746 				panic("pmap_enter_pv: failed");
747 			splx(s);
748 			return 0;
749 		}
750 		npv->pv_va = va;
751 		npv->pv_pm = pm;
752 		npv->pv_next = pv->pv_next;
753 		pv->pv_next = npv;
754 		pv = npv;
755 	}
756 	if (flags & PMAP_WIRED) {
757 		PV_WIRE(pv);
758 		pm->pm_stats.wired_count++;
759 	}
760 	splx(s);
761 	return (1);
762 }
763 
764 static void
765 pmap_remove_pv(struct pmap *pm, vaddr_t va, paddr_t pa)
766 {
767 	struct pv_entry *pv, *npv;
768 
769 	/*
770 	 * Remove from the PV table.
771 	 */
772 	pv = pa_to_pv(pa);
773 	if (!pv)
774 		return;
775 
776 	/*
777 	 * If it is the first entry on the list, it is actually
778 	 * in the header and we must copy the following entry up
779 	 * to the header.  Otherwise we must search the list for
780 	 * the entry.  In either case we free the now unused entry.
781 	 */
782 	if (pm == pv->pv_pm && PV_CMPVA(va, pv)) {
783 		if (PV_ISWIRED(pv)) {
784 			pm->pm_stats.wired_count--;
785 		}
786 		if ((npv = pv->pv_next)) {
787 			*pv = *npv;
788 			pool_put(&pv_pool, npv);
789 		} else
790 			pv->pv_pm = NULL;
791 	} else {
792 		for (; (npv = pv->pv_next) != NULL; pv = npv)
793 			if (pm == npv->pv_pm && PV_CMPVA(va, npv))
794 				break;
795 		if (npv) {
796 			pv->pv_next = npv->pv_next;
797 			if (PV_ISWIRED(npv)) {
798 				pm->pm_stats.wired_count--;
799 			}
800 			pool_put(&pv_pool, npv);
801 		}
802 	}
803 }
804 
805 /*
806  * Insert physical page at pa into the given pmap at virtual address va.
807  */
808 int
809 pmap_enter(struct pmap *pm, vaddr_t va, paddr_t pa, vm_prot_t prot, u_int flags)
810 {
811 	int s;
812 	u_int tte;
813 	bool managed;
814 
815 	/*
816 	 * Have to remove any existing mapping first.
817 	 */
818 	pmap_remove(pm, va, va + PAGE_SIZE);
819 
820 	if (flags & PMAP_WIRED)
821 		flags |= prot;
822 
823 	managed = uvm_pageismanaged(pa);
824 
825 	/*
826 	 * Generate TTE.
827 	 */
828 	tte = TTE_PA(pa);
829 	/* XXXX -- need to support multiple page sizes. */
830 	tte |= TTE_SZ_16K;
831 #ifdef	DIAGNOSTIC
832 	if ((flags & (PMAP_NOCACHE | PME_WRITETHROUG)) ==
833 		(PMAP_NOCACHE | PME_WRITETHROUG))
834 		panic("pmap_enter: uncached & writethrough");
835 #endif
836 	if (flags & PMAP_NOCACHE)
837 		/* Must be I/O mapping */
838 		tte |= TTE_I | TTE_G;
839 #ifdef PPC_4XX_NOCACHE
840 	tte |= TTE_I;
841 #else
842 	else if (flags & PME_WRITETHROUG)
843 		/* Uncached and writethrough are not compatible */
844 		tte |= TTE_W;
845 #endif
846 	if (pm == pmap_kernel())
847 		tte |= TTE_ZONE(ZONE_PRIV);
848 	else
849 		tte |= TTE_ZONE(ZONE_USER);
850 
851 	if (flags & VM_PROT_WRITE)
852 		tte |= TTE_WR;
853 
854 	if (flags & VM_PROT_EXECUTE)
855 		tte |= TTE_EX;
856 
857 	/*
858 	 * Now record mapping for later back-translation.
859 	 */
860 	if (pmap_initialized && managed) {
861 		char *attr;
862 
863 		if (!pmap_enter_pv(pm, va, pa, flags)) {
864 			/* Could not enter pv on a managed page */
865 			return 1;
866 		}
867 
868 		/* Now set attributes. */
869 		attr = pa_to_attr(pa);
870 #ifdef DIAGNOSTIC
871 		if (!attr)
872 			panic("managed but no attr");
873 #endif
874 		if (flags & VM_PROT_ALL)
875 			*attr |= PMAP_ATTR_REF;
876 		if (flags & VM_PROT_WRITE)
877 			*attr |= PMAP_ATTR_CHG;
878 	}
879 
880 	s = splvm();
881 
882 	/* Insert page into page table. */
883 	pte_enter(pm, va, tte);
884 
885 	/* If this is a real fault, enter it in the tlb */
886 	if (tte && ((flags & PMAP_WIRED) == 0)) {
887 		int s2 = splhigh();
888 		ppc4xx_tlb_enter(pm->pm_ctx, va, tte);
889 		splx(s2);
890 	}
891 	splx(s);
892 
893 	/* Flush the real memory from the instruction cache. */
894 	if ((prot & VM_PROT_EXECUTE) && (tte & TTE_I) == 0)
895 		__syncicache((void *)pa, PAGE_SIZE);
896 
897 	return 0;
898 }
899 
900 void
901 pmap_unwire(struct pmap *pm, vaddr_t va)
902 {
903 	struct pv_entry *pv;
904 	paddr_t pa;
905 	int s;
906 
907 	if (!pmap_extract(pm, va, &pa)) {
908 		return;
909 	}
910 
911 	pv = pa_to_pv(pa);
912 	if (!pv)
913 		return;
914 
915 	s = splvm();
916 	while (pv != NULL) {
917 		if (pm == pv->pv_pm && PV_CMPVA(va, pv)) {
918 			if (PV_ISWIRED(pv)) {
919 				PV_UNWIRE(pv);
920 				pm->pm_stats.wired_count--;
921 			}
922 			break;
923 		}
924 		pv = pv->pv_next;
925 	}
926 	splx(s);
927 }
928 
929 void
930 pmap_kenter_pa(vaddr_t va, paddr_t pa, vm_prot_t prot, u_int flags)
931 {
932 	int s;
933 	u_int tte;
934 	struct pmap *pm = pmap_kernel();
935 
936 	/*
937 	 * Generate TTE.
938 	 *
939 	 * XXXX
940 	 *
941 	 * Since the kernel does not handle execution privileges properly,
942 	 * we will handle read and execute permissions together.
943 	 */
944 	tte = 0;
945 	if (prot & VM_PROT_ALL) {
946 
947 		tte = TTE_PA(pa) | TTE_EX | TTE_ZONE(ZONE_PRIV);
948 		/* XXXX -- need to support multiple page sizes. */
949 		tte |= TTE_SZ_16K;
950 #ifdef DIAGNOSTIC
951 		if ((flags & (PMAP_NOCACHE | PME_WRITETHROUG)) ==
952 			(PMAP_NOCACHE | PME_WRITETHROUG))
953 			panic("pmap_kenter_pa: uncached & writethrough");
954 #endif
955 		if (flags & PMAP_NOCACHE)
956 			/* Must be I/O mapping */
957 			tte |= TTE_I | TTE_G;
958 #ifdef PPC_4XX_NOCACHE
959 		tte |= TTE_I;
960 #else
961 		else if (prot & PME_WRITETHROUG)
962 			/* Uncached and writethrough are not compatible */
963 			tte |= TTE_W;
964 #endif
965 		if (prot & VM_PROT_WRITE)
966 			tte |= TTE_WR;
967 	}
968 
969 	s = splvm();
970 
971 	/* Insert page into page table. */
972 	pte_enter(pm, va, tte);
973 	splx(s);
974 }
975 
976 void
977 pmap_kremove(vaddr_t va, vsize_t len)
978 {
979 
980 	while (len > 0) {
981 		pte_enter(pmap_kernel(), va, 0);
982 		va += PAGE_SIZE;
983 		len -= PAGE_SIZE;
984 	}
985 }
986 
987 /*
988  * Remove the given range of mapping entries.
989  */
990 void
991 pmap_remove(struct pmap *pm, vaddr_t va, vaddr_t endva)
992 {
993 	int s;
994 	paddr_t pa;
995 	volatile u_int *ptp;
996 
997 	s = splvm();
998 	while (va < endva) {
999 
1000 		if ((ptp = pte_find(pm, va)) && (pa = *ptp)) {
1001 			pa = TTE_PA(pa);
1002 			pmap_remove_pv(pm, va, pa);
1003 			*ptp = 0;
1004 			ppc4xx_tlb_flush(va, pm->pm_ctx);
1005 			pm->pm_stats.resident_count--;
1006 		}
1007 		va += PAGE_SIZE;
1008 	}
1009 
1010 	splx(s);
1011 }
1012 
1013 /*
1014  * Get the physical page address for the given pmap/virtual address.
1015  */
1016 bool
1017 pmap_extract(struct pmap *pm, vaddr_t va, paddr_t *pap)
1018 {
1019 	int seg = STIDX(va);
1020 	int ptn = PTIDX(va);
1021 	u_int pa = 0;
1022 	int s;
1023 
1024 	s = splvm();
1025 	if (pm->pm_ptbl[seg] && (pa = pm->pm_ptbl[seg][ptn]) && pap) {
1026 		*pap = TTE_PA(pa) | (va & PGOFSET);
1027 	}
1028 	splx(s);
1029 	return (pa != 0);
1030 }
1031 
1032 /*
1033  * Lower the protection on the specified range of this pmap.
1034  *
1035  * There are only two cases: either the protection is going to 0,
1036  * or it is going to read-only.
1037  */
1038 void
1039 pmap_protect(struct pmap *pm, vaddr_t sva, vaddr_t eva, vm_prot_t prot)
1040 {
1041 	volatile u_int *ptp;
1042 	int s, bic;
1043 
1044 	if ((prot & VM_PROT_READ) == 0) {
1045 		pmap_remove(pm, sva, eva);
1046 		return;
1047 	}
1048 	bic = 0;
1049 	if ((prot & VM_PROT_WRITE) == 0) {
1050 		bic |= TTE_WR;
1051 	}
1052 	if ((prot & VM_PROT_EXECUTE) == 0) {
1053 		bic |= TTE_EX;
1054 	}
1055 	if (bic == 0) {
1056 		return;
1057 	}
1058 	s = splvm();
1059 	while (sva < eva) {
1060 		if ((ptp = pte_find(pm, sva)) != NULL) {
1061 			*ptp &= ~bic;
1062 			ppc4xx_tlb_flush(sva, pm->pm_ctx);
1063 		}
1064 		sva += PAGE_SIZE;
1065 	}
1066 	splx(s);
1067 }
1068 
1069 bool
1070 pmap_check_attr(struct vm_page *pg, u_int mask, int clear)
1071 {
1072 	paddr_t pa;
1073 	char *attr;
1074 	int s, rv;
1075 
1076 	/*
1077 	 * First modify bits in cache.
1078 	 */
1079 	pa = VM_PAGE_TO_PHYS(pg);
1080 	attr = pa_to_attr(pa);
1081 	if (attr == NULL)
1082 		return false;
1083 
1084 	s = splvm();
1085 	rv = ((*attr & mask) != 0);
1086 	if (clear) {
1087 		*attr &= ~mask;
1088 		pmap_page_protect(pg, mask == PMAP_ATTR_CHG ? VM_PROT_READ : 0);
1089 	}
1090 	splx(s);
1091 	return rv;
1092 }
1093 
1094 
1095 /*
1096  * Lower the protection on the specified physical page.
1097  *
1098  * There are only two cases: either the protection is going to 0,
1099  * or it is going to read-only.
1100  */
1101 void
1102 pmap_page_protect(struct vm_page *pg, vm_prot_t prot)
1103 {
1104 	paddr_t pa = VM_PAGE_TO_PHYS(pg);
1105 	vaddr_t va;
1106 	struct pv_entry *pvh, *pv, *npv;
1107 	struct pmap *pm;
1108 
1109 	pvh = pa_to_pv(pa);
1110 	if (pvh == NULL)
1111 		return;
1112 
1113 	/* Handle extra pvs which may be deleted in the operation */
1114 	for (pv = pvh->pv_next; pv; pv = npv) {
1115 		npv = pv->pv_next;
1116 
1117 		pm = pv->pv_pm;
1118 		va = PV_VA(pv);
1119 		pmap_protect(pm, va, va + PAGE_SIZE, prot);
1120 	}
1121 	/* Now check the head pv */
1122 	if (pvh->pv_pm) {
1123 		pv = pvh;
1124 		pm = pv->pv_pm;
1125 		va = PV_VA(pv);
1126 		pmap_protect(pm, va, va + PAGE_SIZE, prot);
1127 	}
1128 }
1129 
1130 /*
1131  * Activate the address space for the specified process.  If the process
1132  * is the current process, load the new MMU context.
1133  */
1134 void
1135 pmap_activate(struct lwp *l)
1136 {
1137 #if 0
1138 	struct pcb *pcb = lwp_getpcb(l);
1139 	pmap_t pmap = l->l_proc->p_vmspace->vm_map.pmap;
1140 
1141 	/*
1142 	 * XXX Normally performed in cpu_lwp_fork().
1143 	 */
1144 	printf("pmap_activate(%p), pmap=%p\n",l,pmap);
1145 	pcb->pcb_pm = pmap;
1146 #endif
1147 }
1148 
1149 /*
1150  * Deactivate the specified process's address space.
1151  */
1152 void
1153 pmap_deactivate(struct lwp *l)
1154 {
1155 }
1156 
1157 /*
1158  * Synchronize caches corresponding to [addr, addr+len) in p.
1159  */
1160 void
1161 pmap_procwr(struct proc *p, vaddr_t va, size_t len)
1162 {
1163 	struct pmap *pm = p->p_vmspace->vm_map.pmap;
1164 
1165 	if (__predict_true(p == curproc)) {
1166 		int msr, ctx, opid;
1167 
1168 		/*
1169 		 * Take it easy! TLB miss handler takes care of us.
1170 		 */
1171 
1172 		/*
1173 	 	 * Need to turn off IMMU and switch to user context.
1174 		 * (icbi uses DMMU).
1175 		 */
1176 
1177 		if (!(ctx = pm->pm_ctx)) {
1178 			/* No context -- assign it one */
1179 			ctx_alloc(pm);
1180 			ctx = pm->pm_ctx;
1181 		}
1182 
1183 		__asm volatile(
1184 			"mfmsr %0;"
1185 			"li %1,0x20;"		/* Turn off IMMU */
1186 			"andc %1,%0,%1;"
1187 			"ori %1,%1,0x10;"	/* Turn on DMMU for sure */
1188 			"mtmsr %1;"
1189 			"isync;"
1190 			"mfpid %1;"
1191 			"mtpid %2;"
1192 			"isync;"
1193 		"1:"
1194 			"dcbst 0,%3;"
1195 			"icbi 0,%3;"
1196 			"add %3,%3,%5;"
1197 			"sub. %4,%4,%5;"
1198 			"bge 1b;"
1199 			"sync;"
1200 			"mtpid %1;"
1201 			"mtmsr %0;"
1202 			"isync;"
1203 			: "=&r" (msr), "=&r" (opid)
1204 			: "r" (ctx), "r" (va), "r" (len), "r" (CACHELINESIZE));
1205 	} else {
1206 		paddr_t pa;
1207 		vaddr_t tva, eva;
1208 		int tlen;
1209 
1210 		/*
1211 		 * For p != curproc, we cannot rely upon TLB miss handler in
1212 		 * user context. Therefore, extract pa and operate againt it.
1213 		 *
1214 		 * Note that va below VM_MIN_KERNEL_ADDRESS is reserved for
1215 		 * direct mapping.
1216 		 */
1217 
1218 		for (tva = va; len > 0; tva = eva, len -= tlen) {
1219 			eva = uimin(tva + len, trunc_page(tva + PAGE_SIZE));
1220 			tlen = eva - tva;
1221 			if (!pmap_extract(pm, tva, &pa)) {
1222 				/* XXX should be already unmapped */
1223 				continue;
1224 			}
1225 			__syncicache((void *)pa, tlen);
1226 		}
1227 	}
1228 }
1229 
1230 static inline void
1231 tlb_invalidate_entry(int i)
1232 {
1233 #ifdef PMAP_TLBDEBUG
1234 	/*
1235 	 * Clear only TLBHI[V] bit so that we can track invalidated entry.
1236 	 */
1237 	register_t msr, pid, hi;
1238 
1239 	KASSERT(mfspr(SPR_PID) == KERNEL_PID);
1240 
1241 	__asm volatile(
1242 		"mfmsr	%0;"
1243 		"li	%1,0;"
1244 		"mtmsr	%1;"
1245 		"mfpid	%1;"
1246 		"tlbre	%2,%3,0;"
1247 		"andc	%2,%2,%4;"
1248 		"tlbwe	%2,%3,0;"
1249 		"mtpid	%1;"
1250 		"mtmsr	%0;"
1251 		"isync;"
1252 		: "=&r" (msr), "=&r" (pid), "=&r" (hi)
1253 		: "r" (i), "r" (TLB_VALID));
1254 #else
1255 	/*
1256 	 * Just clear entire TLBHI register.
1257 	 */
1258 	__asm volatile(
1259 		"tlbwe %0,%1,0;"
1260 		"isync;"
1261 		: : "r" (0), "r" (i));
1262 #endif
1263 
1264 	tlb_info[i].ti_ctx = 0;
1265 	tlb_info[i].ti_flags = 0;
1266 }
1267 
1268 /* This has to be done in real mode !!! */
1269 void
1270 ppc4xx_tlb_flush(vaddr_t va, int pid)
1271 {
1272 	u_long i, found;
1273 	u_long msr;
1274 
1275 	/* If there's no context then it can't be mapped. */
1276 	if (!pid)
1277 		return;
1278 
1279 	__asm volatile(
1280 		"mfpid %1;"		/* Save PID */
1281 		"mfmsr %2;"		/* Save MSR */
1282 		"li %0,0;"		/* Now clear MSR */
1283 		"mtmsr %0;"
1284 		"isync;"
1285 		"mtpid %4;"		/* Set PID */
1286 		"isync;"
1287 		"tlbsx. %0,0,%3;"	/* Search TLB */
1288 		"isync;"
1289 		"mtpid %1;"		/* Restore PID */
1290 		"mtmsr %2;"		/* Restore MSR */
1291 		"isync;"
1292 		"li %1,1;"
1293 		"beq 1f;"
1294 		"li %1,0;"
1295 		"1:"
1296 		: "=&r" (i), "=&r" (found), "=&r" (msr)
1297 		: "r" (va), "r" (pid));
1298 	if (found && !TLB_LOCKED(i)) {
1299 		/* Now flush translation */
1300 		tlb_invalidate_entry(i);
1301 		tlbnext = i;
1302 		/* Successful flushes */
1303 		tlbflush_ev.ev_count++;
1304 	}
1305 }
1306 
1307 void
1308 ppc4xx_tlb_flush_all(void)
1309 {
1310 	u_long i;
1311 
1312 	for (i = 0; i < NTLB; i++)
1313 		if (!TLB_LOCKED(i))
1314 			tlb_invalidate_entry(i);
1315 
1316 	__asm volatile("isync");
1317 }
1318 
1319 /* Find a TLB entry to evict. */
1320 static int
1321 ppc4xx_tlb_find_victim(void)
1322 {
1323 	int flags;
1324 
1325 	for (;;) {
1326 		if (++tlbnext >= NTLB)
1327 			tlbnext = tlb_nreserved;
1328 		flags = tlb_info[tlbnext].ti_flags;
1329 		if (!(flags & TLBF_USED) ||
1330 			(flags & (TLBF_LOCKED | TLBF_REF)) == 0) {
1331 			u_long va, stack = (u_long)&va;
1332 
1333 			if (!((tlb_info[tlbnext].ti_va ^ stack) & (~PGOFSET)) &&
1334 			    (tlb_info[tlbnext].ti_ctx == KERNEL_PID) &&
1335 			     (flags & TLBF_USED)) {
1336 				/* Kernel stack page */
1337 				flags |= TLBF_REF;
1338 				tlb_info[tlbnext].ti_flags = flags;
1339 			} else {
1340 				/* Found it! */
1341 				return (tlbnext);
1342 			}
1343 		} else {
1344 			tlb_info[tlbnext].ti_flags = (flags & ~TLBF_REF);
1345 		}
1346 	}
1347 }
1348 
1349 void
1350 ppc4xx_tlb_enter(int ctx, vaddr_t va, u_int pte)
1351 {
1352 	u_long th, tl, idx;
1353 	int msr, pid;
1354 	paddr_t pa;
1355 	int sz;
1356 
1357 	tlbenter_ev.ev_count++;
1358 
1359 	sz = (pte & TTE_SZ_MASK) >> TTE_SZ_SHIFT;
1360 	pa = (pte & TTE_RPN_MASK(sz));
1361 	th = (va & TLB_EPN_MASK) | (sz << TLB_SIZE_SHFT) | TLB_VALID;
1362 	tl = (pte & ~TLB_RPN_MASK) | pa;
1363 	tl |= ppc4xx_tlbflags(va, pa);
1364 
1365 	idx = ppc4xx_tlb_find_victim();
1366 
1367 #ifdef DIAGNOSTIC
1368 	if ((idx < tlb_nreserved) || (idx >= NTLB) || (idx & 63) == 0) {
1369 		panic("ppc4xx_tlb_enter: replacing entry %ld", idx);
1370 	}
1371 #endif
1372 
1373 	tlb_info[idx].ti_va = (va & TLB_EPN_MASK);
1374 	tlb_info[idx].ti_ctx = ctx;
1375 	tlb_info[idx].ti_flags = TLBF_USED | TLBF_REF;
1376 
1377 	__asm volatile(
1378 		"mfmsr %0;"			/* Save MSR */
1379 		"li %1,0;"
1380 		"mtmsr %1;"			/* Clear MSR */
1381 		"isync;"
1382 		"tlbwe %1,%3,0;"		/* Invalidate old entry. */
1383 		"mfpid %1;"			/* Save old PID */
1384 		"mtpid %2;"			/* Load translation ctx */
1385 		"isync;"
1386 		"tlbwe %4,%3,1; tlbwe %5,%3,0;"	/* Set TLB */
1387 		"isync;"
1388 		"mtpid %1; mtmsr %0;"		/* Restore PID and MSR */
1389 		"isync;"
1390 	: "=&r" (msr), "=&r" (pid)
1391 	: "r" (ctx), "r" (idx), "r" (tl), "r" (th));
1392 }
1393 
1394 void
1395 ppc4xx_tlb_init(void)
1396 {
1397 	int i;
1398 
1399 	/* Mark reserved TLB entries */
1400 	for (i = 0; i < tlb_nreserved; i++) {
1401 		tlb_info[i].ti_flags = TLBF_LOCKED | TLBF_USED;
1402 		tlb_info[i].ti_ctx = KERNEL_PID;
1403 	}
1404 
1405 	/* Setup security zones */
1406 	/* Z0 - accessible by kernel only if TLB entry permissions allow
1407 	 * Z1,Z2 - access is controlled by TLB entry permissions
1408 	 * Z3 - full access regardless of TLB entry permissions
1409 	 */
1410 
1411 	__asm volatile(
1412 		"mtspr %0,%1;"
1413 		"isync;"
1414 		::  "K"(SPR_ZPR), "r" (0x1b000000));
1415 }
1416 
1417 /*
1418  * ppc4xx_tlb_size_mask:
1419  *
1420  * 	Roundup size to supported page size, return TLBHI mask and real size.
1421  */
1422 static int
1423 ppc4xx_tlb_size_mask(size_t size, int *mask, int *rsiz)
1424 {
1425 	int 			i;
1426 
1427 	for (i = 0; i < __arraycount(tlbsize); i++)
1428 		if (size <= tlbsize[i]) {
1429 			*mask = (i << TLB_SIZE_SHFT);
1430 			*rsiz = tlbsize[i];
1431 			return (0);
1432 		}
1433 	return (EINVAL);
1434 }
1435 
1436 /*
1437  * ppc4xx_tlb_mapiodev:
1438  *
1439  * 	Lookup virtual address of mapping previously entered via
1440  * 	ppc4xx_tlb_reserve. Search TLB directly so that we don't
1441  * 	need to waste extra storage for reserved mappings. Note
1442  * 	that reading TLBHI also sets PID, but all reserved mappings
1443  * 	use KERNEL_PID, so the side effect is nil.
1444  */
1445 void *
1446 ppc4xx_tlb_mapiodev(paddr_t base, psize_t len)
1447 {
1448 	paddr_t 		pa;
1449 	vaddr_t 		va;
1450 	u_int 			lo, hi, sz;
1451 	int 			i;
1452 
1453 	/* tlb_nreserved is only allowed to grow, so this is safe. */
1454 	for (i = 0; i < tlb_nreserved; i++) {
1455 		__asm volatile (
1456 		    "	tlbre %0,%2,1 	\n" 	/* TLBLO */
1457 		    "	tlbre %1,%2,0 	\n" 	/* TLBHI */
1458 		    : "=&r" (lo), "=&r" (hi)
1459 		    : "r" (i));
1460 
1461 		KASSERT(hi & TLB_VALID);
1462 		KASSERT(mfspr(SPR_PID) == KERNEL_PID);
1463 
1464 		pa = (lo & TLB_RPN_MASK);
1465 		if (base < pa)
1466 			continue;
1467 
1468 		sz = tlbsize[(hi & TLB_SIZE_MASK) >> TLB_SIZE_SHFT];
1469 		if ((base + len) > (pa + sz))
1470 			continue;
1471 
1472 		va = (hi & TLB_EPN_MASK) + (base & (sz - 1)); 	/* sz = 2^n */
1473 		return (void *)(va);
1474 	}
1475 
1476 	return (NULL);
1477 }
1478 
1479 /*
1480  * ppc4xx_tlb_reserve:
1481  *
1482  * 	Map physical range to kernel virtual chunk via reserved TLB entry.
1483  */
1484 void
1485 ppc4xx_tlb_reserve(paddr_t pa, vaddr_t va, size_t size, int flags)
1486 {
1487 	u_int 			lo, hi;
1488 	int 			szmask, rsize;
1489 
1490 	/* Called before pmap_bootstrap(), va outside kernel space. */
1491 	KASSERT(va < VM_MIN_KERNEL_ADDRESS || va >= VM_MAX_KERNEL_ADDRESS);
1492 	KASSERT(! pmap_bootstrap_done);
1493 	KASSERT(tlb_nreserved < NTLB);
1494 
1495 	/* Resolve size. */
1496 	if (ppc4xx_tlb_size_mask(size, &szmask, &rsize) != 0)
1497 		panic("ppc4xx_tlb_reserve: entry %d, %zuB too large",
1498 		    size, tlb_nreserved);
1499 
1500 	/* Real size will be power of two >= 1024, so this is OK. */
1501 	pa &= ~(rsize - 1); 	/* RPN */
1502 	va &= ~(rsize - 1); 	/* EPN */
1503 
1504 	lo = pa | TLB_WR | flags;
1505 	hi = va | TLB_VALID | szmask;
1506 
1507 #ifdef PPC_4XX_NOCACHE
1508 	lo |= TLB_I;
1509 #endif
1510 
1511 	__asm volatile(
1512 	    "	tlbwe %1,%0,1 	\n" 	/* write TLBLO */
1513 	    "	tlbwe %2,%0,0 	\n" 	/* write TLBHI */
1514 	    "	isync 		\n"
1515 	    : : "r" (tlb_nreserved), "r" (lo), "r" (hi));
1516 
1517 	tlb_nreserved++;
1518 }
1519 
1520 /*
1521  * We should pass the ctx in from trap code.
1522  */
1523 int
1524 pmap_tlbmiss(vaddr_t va, int ctx)
1525 {
1526 	volatile u_int *pte;
1527 	u_long tte;
1528 
1529 	tlbmiss_ev.ev_count++;
1530 
1531 	/*
1532 	 * We will reserve 0 upto VM_MIN_KERNEL_ADDRESS for va == pa mappings.
1533 	 * Physical RAM is expected to live in this range, care must be taken
1534 	 * to not clobber 0 upto ${physmem} with device mappings in machdep
1535 	 * code.
1536 	 */
1537 	if (ctx != KERNEL_PID ||
1538 	    (va >= VM_MIN_KERNEL_ADDRESS && va < VM_MAX_KERNEL_ADDRESS)) {
1539 		pte = pte_find((struct pmap *)__UNVOLATILE(ctxbusy[ctx]), va);
1540 		if (pte == NULL) {
1541 			/* Map unmanaged addresses directly for kernel access */
1542 			return 1;
1543 		}
1544 		tte = *pte;
1545 		if (tte == 0) {
1546 			return 1;
1547 		}
1548 	} else {
1549 		/* Create a 16MB writable mapping. */
1550 #ifdef PPC_4XX_NOCACHE
1551 		tte = TTE_PA(va) | TTE_ZONE(ZONE_PRIV) | TTE_SZ_16M | TTE_I |TTE_WR;
1552 #else
1553 		tte = TTE_PA(va) | TTE_ZONE(ZONE_PRIV) | TTE_SZ_16M | TTE_WR;
1554 #endif
1555 	}
1556 	ppc4xx_tlb_enter(ctx, va, tte);
1557 
1558 	return 0;
1559 }
1560 
1561 /*
1562  * Flush all the entries matching a context from the TLB.
1563  */
1564 static int
1565 ctx_flush(int cnum)
1566 {
1567 	int i;
1568 
1569 	/* We gotta steal this context */
1570 	for (i = tlb_nreserved; i < NTLB; i++) {
1571 		if (tlb_info[i].ti_ctx == cnum) {
1572 			/* Can't steal ctx if it has a locked entry. */
1573 			if (TLB_LOCKED(i)) {
1574 #ifdef DIAGNOSTIC
1575 				printf("ctx_flush: can't invalidate "
1576 					"locked mapping %d "
1577 					"for context %d\n", i, cnum);
1578 #ifdef DDB
1579 				Debugger();
1580 #endif
1581 #endif
1582 				return (1);
1583 			}
1584 #ifdef DIAGNOSTIC
1585 			if (i < tlb_nreserved)
1586 				panic("TLB entry %d not locked", i);
1587 #endif
1588 			/*
1589 			 * Invalidate particular TLB entry regardless of
1590 			 * locked status
1591 			 */
1592 			tlb_invalidate_entry(i);
1593 		}
1594 	}
1595 	return (0);
1596 }
1597 
1598 /*
1599  * Allocate a context.  If necessary, steal one from someone else.
1600  *
1601  * The new context is flushed from the TLB before returning.
1602  */
1603 int
1604 ctx_alloc(struct pmap *pm)
1605 {
1606 	int s, cnum;
1607 	static int next = MINCTX;
1608 
1609 	if (pm == pmap_kernel()) {
1610 #ifdef DIAGNOSTIC
1611 		printf("ctx_alloc: kernel pmap!\n");
1612 #endif
1613 		return (0);
1614 	}
1615 	s = splvm();
1616 
1617 	/* Find a likely context. */
1618 	cnum = next;
1619 	do {
1620 		if ((++cnum) >= NUMCTX)
1621 			cnum = MINCTX;
1622 	} while (ctxbusy[cnum] != NULL && cnum != next);
1623 
1624 	/* Now clean it out */
1625 oops:
1626 	if (cnum < MINCTX)
1627 		cnum = MINCTX; /* Never steal ctx 0 or 1 */
1628 	if (ctx_flush(cnum)) {
1629 		/* oops -- something's wired. */
1630 		if ((++cnum) >= NUMCTX)
1631 			cnum = MINCTX;
1632 		goto oops;
1633 	}
1634 
1635 	if (ctxbusy[cnum]) {
1636 #ifdef DEBUG
1637 		/* We should identify this pmap and clear it */
1638 		printf("Warning: stealing context %d\n", cnum);
1639 #endif
1640 		ctxbusy[cnum]->pm_ctx = 0;
1641 	}
1642 	ctxbusy[cnum] = pm;
1643 	next = cnum;
1644 	splx(s);
1645 	pm->pm_ctx = cnum;
1646 
1647 	return cnum;
1648 }
1649 
1650 /*
1651  * Give away a context.
1652  */
1653 void
1654 ctx_free(struct pmap *pm)
1655 {
1656 	int oldctx;
1657 
1658 	oldctx = pm->pm_ctx;
1659 
1660 	if (oldctx == 0)
1661 		panic("ctx_free: freeing kernel context");
1662 #ifdef DIAGNOSTIC
1663 	if (ctxbusy[oldctx] == 0)
1664 		printf("ctx_free: freeing free context %d\n", oldctx);
1665 	if (ctxbusy[oldctx] != pm) {
1666 		printf("ctx_free: freeing someone esle's context\n "
1667 		       "ctxbusy[%d] = %p, pm->pm_ctx = %p\n",
1668 		       oldctx, (void *)(u_long)ctxbusy[oldctx], pm);
1669 #ifdef DDB
1670 		Debugger();
1671 #endif
1672 	}
1673 #endif
1674 	/* We should verify it has not been stolen and reallocated... */
1675 	ctxbusy[oldctx] = NULL;
1676 	ctx_flush(oldctx);
1677 }
1678 
1679 
1680 #ifdef DEBUG
1681 /*
1682  * Test ref/modify handling.
1683  */
1684 void pmap_testout(void);
1685 void
1686 pmap_testout(void)
1687 {
1688 	vaddr_t va;
1689 	volatile int *loc;
1690 	int val = 0;
1691 	paddr_t pa;
1692 	struct vm_page *pg;
1693 	int ref, mod;
1694 
1695 	/* Allocate a page */
1696 	va = (vaddr_t)uvm_km_alloc(kernel_map, PAGE_SIZE, 0,
1697 	    UVM_KMF_WIRED | UVM_KMF_ZERO);
1698 	loc = (int*)va;
1699 
1700 	pmap_extract(pmap_kernel(), va, &pa);
1701 	pg = PHYS_TO_VM_PAGE(pa);
1702 	pmap_unwire(pmap_kernel(), va);
1703 
1704 	pmap_kremove(va, PAGE_SIZE);
1705 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
1706 	pmap_update(pmap_kernel());
1707 
1708 	/* Now clear reference and modify */
1709 	ref = pmap_clear_reference(pg);
1710 	mod = pmap_clear_modify(pg);
1711 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1712 	       (void *)(u_long)va, (long)pa,
1713 	       ref, mod);
1714 
1715 	/* Check it's properly cleared */
1716 	ref = pmap_is_referenced(pg);
1717 	mod = pmap_is_modified(pg);
1718 	printf("Checking cleared page: ref %d, mod %d\n",
1719 	       ref, mod);
1720 
1721 	/* Reference page */
1722 	val = *loc;
1723 
1724 	ref = pmap_is_referenced(pg);
1725 	mod = pmap_is_modified(pg);
1726 	printf("Referenced page: ref %d, mod %d val %x\n",
1727 	       ref, mod, val);
1728 
1729 	/* Now clear reference and modify */
1730 	ref = pmap_clear_reference(pg);
1731 	mod = pmap_clear_modify(pg);
1732 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1733 	       (void *)(u_long)va, (long)pa,
1734 	       ref, mod);
1735 
1736 	/* Modify page */
1737 	*loc = 1;
1738 
1739 	ref = pmap_is_referenced(pg);
1740 	mod = pmap_is_modified(pg);
1741 	printf("Modified page: ref %d, mod %d\n",
1742 	       ref, mod);
1743 
1744 	/* Now clear reference and modify */
1745 	ref = pmap_clear_reference(pg);
1746 	mod = pmap_clear_modify(pg);
1747 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1748 	       (void *)(u_long)va, (long)pa,
1749 	       ref, mod);
1750 
1751 	/* Check it's properly cleared */
1752 	ref = pmap_is_referenced(pg);
1753 	mod = pmap_is_modified(pg);
1754 	printf("Checking cleared page: ref %d, mod %d\n",
1755 	       ref, mod);
1756 
1757 	/* Modify page */
1758 	*loc = 1;
1759 
1760 	ref = pmap_is_referenced(pg);
1761 	mod = pmap_is_modified(pg);
1762 	printf("Modified page: ref %d, mod %d\n",
1763 	       ref, mod);
1764 
1765 	/* Check pmap_protect() */
1766 	pmap_protect(pmap_kernel(), va, va+1, VM_PROT_READ);
1767 	pmap_update(pmap_kernel());
1768 	ref = pmap_is_referenced(pg);
1769 	mod = pmap_is_modified(pg);
1770 	printf("pmap_protect(VM_PROT_READ): ref %d, mod %d\n",
1771 	       ref, mod);
1772 
1773 	/* Now clear reference and modify */
1774 	ref = pmap_clear_reference(pg);
1775 	mod = pmap_clear_modify(pg);
1776 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1777 	       (void *)(u_long)va, (long)pa,
1778 	       ref, mod);
1779 
1780 	/* Reference page */
1781 	val = *loc;
1782 
1783 	ref = pmap_is_referenced(pg);
1784 	mod = pmap_is_modified(pg);
1785 	printf("Referenced page: ref %d, mod %d val %x\n",
1786 	       ref, mod, val);
1787 
1788 	/* Now clear reference and modify */
1789 	ref = pmap_clear_reference(pg);
1790 	mod = pmap_clear_modify(pg);
1791 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1792 	       (void *)(u_long)va, (long)pa,
1793 	       ref, mod);
1794 
1795 	/* Modify page */
1796 #if 0
1797 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
1798 	pmap_update(pmap_kernel());
1799 #endif
1800 	*loc = 1;
1801 
1802 	ref = pmap_is_referenced(pg);
1803 	mod = pmap_is_modified(pg);
1804 	printf("Modified page: ref %d, mod %d\n",
1805 	       ref, mod);
1806 
1807 	/* Check pmap_protect() */
1808 	pmap_protect(pmap_kernel(), va, va+1, VM_PROT_NONE);
1809 	pmap_update(pmap_kernel());
1810 	ref = pmap_is_referenced(pg);
1811 	mod = pmap_is_modified(pg);
1812 	printf("pmap_protect(): ref %d, mod %d\n",
1813 	       ref, mod);
1814 
1815 	/* Now clear reference and modify */
1816 	ref = pmap_clear_reference(pg);
1817 	mod = pmap_clear_modify(pg);
1818 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1819 	       (void *)(u_long)va, (long)pa,
1820 	       ref, mod);
1821 
1822 	/* Reference page */
1823 	val = *loc;
1824 
1825 	ref = pmap_is_referenced(pg);
1826 	mod = pmap_is_modified(pg);
1827 	printf("Referenced page: ref %d, mod %d val %x\n",
1828 	       ref, mod, val);
1829 
1830 	/* Now clear reference and modify */
1831 	ref = pmap_clear_reference(pg);
1832 	mod = pmap_clear_modify(pg);
1833 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1834 	       (void *)(u_long)va, (long)pa,
1835 	       ref, mod);
1836 
1837 	/* Modify page */
1838 #if 0
1839 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
1840 	pmap_update(pmap_kernel());
1841 #endif
1842 	*loc = 1;
1843 
1844 	ref = pmap_is_referenced(pg);
1845 	mod = pmap_is_modified(pg);
1846 	printf("Modified page: ref %d, mod %d\n",
1847 	       ref, mod);
1848 
1849 	/* Check pmap_pag_protect() */
1850 	pmap_page_protect(pg, VM_PROT_READ);
1851 	ref = pmap_is_referenced(pg);
1852 	mod = pmap_is_modified(pg);
1853 	printf("pmap_page_protect(VM_PROT_READ): ref %d, mod %d\n",
1854 	       ref, mod);
1855 
1856 	/* Now clear reference and modify */
1857 	ref = pmap_clear_reference(pg);
1858 	mod = pmap_clear_modify(pg);
1859 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1860 	       (void *)(u_long)va, (long)pa,
1861 	       ref, mod);
1862 
1863 	/* Reference page */
1864 	val = *loc;
1865 
1866 	ref = pmap_is_referenced(pg);
1867 	mod = pmap_is_modified(pg);
1868 	printf("Referenced page: ref %d, mod %d val %x\n",
1869 	       ref, mod, val);
1870 
1871 	/* Now clear reference and modify */
1872 	ref = pmap_clear_reference(pg);
1873 	mod = pmap_clear_modify(pg);
1874 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1875 	       (void *)(u_long)va, (long)pa,
1876 	       ref, mod);
1877 
1878 	/* Modify page */
1879 #if 0
1880 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
1881 	pmap_update(pmap_kernel());
1882 #endif
1883 	*loc = 1;
1884 
1885 	ref = pmap_is_referenced(pg);
1886 	mod = pmap_is_modified(pg);
1887 	printf("Modified page: ref %d, mod %d\n",
1888 	       ref, mod);
1889 
1890 	/* Check pmap_pag_protect() */
1891 	pmap_page_protect(pg, VM_PROT_NONE);
1892 	ref = pmap_is_referenced(pg);
1893 	mod = pmap_is_modified(pg);
1894 	printf("pmap_page_protect(): ref %d, mod %d\n",
1895 	       ref, mod);
1896 
1897 	/* Now clear reference and modify */
1898 	ref = pmap_clear_reference(pg);
1899 	mod = pmap_clear_modify(pg);
1900 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1901 	       (void *)(u_long)va, (long)pa,
1902 	       ref, mod);
1903 
1904 
1905 	/* Reference page */
1906 	val = *loc;
1907 
1908 	ref = pmap_is_referenced(pg);
1909 	mod = pmap_is_modified(pg);
1910 	printf("Referenced page: ref %d, mod %d val %x\n",
1911 	       ref, mod, val);
1912 
1913 	/* Now clear reference and modify */
1914 	ref = pmap_clear_reference(pg);
1915 	mod = pmap_clear_modify(pg);
1916 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1917 	       (void *)(u_long)va, (long)pa,
1918 	       ref, mod);
1919 
1920 	/* Modify page */
1921 #if 0
1922 	pmap_enter(pmap_kernel(), va, pa, VM_PROT_ALL, 0);
1923 	pmap_update(pmap_kernel());
1924 #endif
1925 	*loc = 1;
1926 
1927 	ref = pmap_is_referenced(pg);
1928 	mod = pmap_is_modified(pg);
1929 	printf("Modified page: ref %d, mod %d\n",
1930 	       ref, mod);
1931 
1932 	/* Unmap page */
1933 	pmap_remove(pmap_kernel(), va, va+1);
1934 	pmap_update(pmap_kernel());
1935 	ref = pmap_is_referenced(pg);
1936 	mod = pmap_is_modified(pg);
1937 	printf("Unmapped page: ref %d, mod %d\n", ref, mod);
1938 
1939 	/* Now clear reference and modify */
1940 	ref = pmap_clear_reference(pg);
1941 	mod = pmap_clear_modify(pg);
1942 	printf("Clearing page va %p pa %lx: ref %d, mod %d\n",
1943 	       (void *)(u_long)va, (long)pa, ref, mod);
1944 
1945 	/* Check it's properly cleared */
1946 	ref = pmap_is_referenced(pg);
1947 	mod = pmap_is_modified(pg);
1948 	printf("Checking cleared page: ref %d, mod %d\n",
1949 	       ref, mod);
1950 
1951 	pmap_remove(pmap_kernel(), va, va + PAGE_SIZE);
1952 	pmap_kenter_pa(va, pa, VM_PROT_ALL, 0);
1953 	uvm_km_free(kernel_map, (vaddr_t)va, PAGE_SIZE, UVM_KMF_WIRED);
1954 }
1955 #endif
1956