1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1991 Regents of the University of California.
5  * Copyright (c) 1994 John S. Dyson
6  * Copyright (c) 1994 David Greenman
7  * Copyright (c) 2003 Peter Wemm
8  * Copyright (c) 2005-2008 Alan L. Cox <alc@cs.rice.edu>
9  * Copyright (c) 2008, 2009 The DragonFly Project.
10  * Copyright (c) 2008, 2009 Jordan Gordeev.
11  * All rights reserved.
12  *
13  * This code is derived from software contributed to Berkeley by
14  * the Systems Programming Group of the University of Utah Computer
15  * Science Department and William Jolitz of UUNET Technologies Inc.
16  *
17  * Redistribution and use in source and binary forms, with or without
18  * modification, are permitted provided that the following conditions
19  * are met:
20  * 1. Redistributions of source code must retain the above copyright
21  *    notice, this list of conditions and the following disclaimer.
22  * 2. Redistributions in binary form must reproduce the above copyright
23  *    notice, this list of conditions and the following disclaimer in the
24  *    documentation and/or other materials provided with the distribution.
25  * 3. All advertising materials mentioning features or use of this software
26  *    must display the following acknowledgement:
27  *	This product includes software developed by the University of
28  *	California, Berkeley and its contributors.
29  * 4. Neither the name of the University nor the names of its contributors
30  *    may be used to endorse or promote products derived from this software
31  *    without specific prior written permission.
32  *
33  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
34  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
35  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
36  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
37  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
38  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
39  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
40  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
41  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
42  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
43  * SUCH DAMAGE.
44  *
45  *	from:	@(#)pmap.c	7.7 (Berkeley)	5/12/91
46  * $FreeBSD: src/sys/i386/i386/pmap.c,v 1.250.2.18 2002/03/06 22:48:53 silby Exp $
47  */
48 
49 /*
50  * Manages physical address maps.
51  */
52 
53 #if JG
54 #include "opt_pmap.h"
55 #endif
56 #include "opt_msgbuf.h"
57 
58 #include <sys/param.h>
59 #include <sys/systm.h>
60 #include <sys/kernel.h>
61 #include <sys/proc.h>
62 #include <sys/msgbuf.h>
63 #include <sys/vmmeter.h>
64 #include <sys/mman.h>
65 #include <sys/vmspace.h>
66 
67 #include <vm/vm.h>
68 #include <vm/vm_param.h>
69 #include <sys/sysctl.h>
70 #include <sys/lock.h>
71 #include <vm/vm_kern.h>
72 #include <vm/vm_page.h>
73 #include <vm/vm_map.h>
74 #include <vm/vm_object.h>
75 #include <vm/vm_extern.h>
76 #include <vm/vm_pageout.h>
77 #include <vm/vm_pager.h>
78 #include <vm/vm_zone.h>
79 
80 #include <sys/user.h>
81 #include <sys/thread2.h>
82 #include <sys/sysref2.h>
83 #include <sys/spinlock2.h>
84 #include <vm/vm_page2.h>
85 
86 #include <machine/cputypes.h>
87 #include <machine/md_var.h>
88 #include <machine/specialreg.h>
89 #include <machine/smp.h>
90 #include <machine/globaldata.h>
91 #include <machine/pmap.h>
92 #include <machine/pmap_inval.h>
93 
94 #include <ddb/ddb.h>
95 
96 #include <stdio.h>
97 #include <assert.h>
98 #include <stdlib.h>
99 #include <pthread.h>
100 
101 #define PMAP_KEEP_PDIRS
102 #ifndef PMAP_SHPGPERPROC
103 #define PMAP_SHPGPERPROC 1000
104 #endif
105 
106 #if defined(DIAGNOSTIC)
107 #define PMAP_DIAGNOSTIC
108 #endif
109 
110 #define MINPV 2048
111 
112 #if !defined(PMAP_DIAGNOSTIC)
113 #define PMAP_INLINE __inline
114 #else
115 #define PMAP_INLINE
116 #endif
117 
118 /*
119  * Get PDEs and PTEs for user/kernel address space
120  */
121 static pd_entry_t *pmap_pde(pmap_t pmap, vm_offset_t va);
122 #define pdir_pde(m, v) (m[(vm_offset_t)(v) >> PDRSHIFT])
123 
124 #define pmap_pde_v(pte)		((*(pd_entry_t *)pte & VPTE_V) != 0)
125 #define pmap_pte_w(pte)		((*(pt_entry_t *)pte & VPTE_WIRED) != 0)
126 #define pmap_pte_m(pte)		((*(pt_entry_t *)pte & VPTE_M) != 0)
127 #define pmap_pte_u(pte)		((*(pt_entry_t *)pte & VPTE_A) != 0)
128 #define pmap_pte_v(pte)		((*(pt_entry_t *)pte & VPTE_V) != 0)
129 
130 /*
131  * Given a map and a machine independent protection code,
132  * convert to a vax protection code.
133  */
134 #define pte_prot(m, p)		\
135 	(protection_codes[p & (VM_PROT_READ|VM_PROT_WRITE|VM_PROT_EXECUTE)])
136 static int protection_codes[8];
137 
138 struct pmap kernel_pmap;
139 static TAILQ_HEAD(,pmap)	pmap_list = TAILQ_HEAD_INITIALIZER(pmap_list);
140 
141 static boolean_t pmap_initialized = FALSE;	/* Has pmap_init completed? */
142 
143 static vm_object_t kptobj;
144 
145 static int nkpt;
146 
147 static uint64_t	KPDphys;	/* phys addr of kernel level 2 */
148 uint64_t		KPDPphys;	/* phys addr of kernel level 3 */
149 uint64_t		KPML4phys;	/* phys addr of kernel level 4 */
150 
151 extern int vmm_enabled;
152 extern void *vkernel_stack;
153 
154 /*
155  * Data for the pv entry allocation mechanism
156  */
157 static vm_zone_t pvzone;
158 static struct vm_zone pvzone_store;
159 static struct vm_object pvzone_obj;
160 static int pv_entry_count=0, pv_entry_max=0, pv_entry_high_water=0;
161 static int pmap_pagedaemon_waken = 0;
162 static struct pv_entry *pvinit;
163 
164 /*
165  * All those kernel PT submaps that BSD is so fond of
166  */
167 pt_entry_t *CMAP1 = NULL, *ptmmap;
168 caddr_t CADDR1 = NULL;
169 static pt_entry_t *msgbufmap;
170 
171 uint64_t KPTphys;
172 
173 static PMAP_INLINE void	free_pv_entry (pv_entry_t pv);
174 static pv_entry_t get_pv_entry (void);
175 static void	i386_protection_init (void);
176 static __inline void	pmap_clearbit (vm_page_t m, int bit);
177 
178 static void	pmap_remove_all (vm_page_t m);
179 static int pmap_remove_pte (struct pmap *pmap, pt_entry_t *ptq,
180 				vm_offset_t sva);
181 static void pmap_remove_page (struct pmap *pmap, vm_offset_t va);
182 static int pmap_remove_entry (struct pmap *pmap, vm_page_t m,
183 				vm_offset_t va);
184 static boolean_t pmap_testbit (vm_page_t m, int bit);
185 static void pmap_insert_entry (pmap_t pmap, vm_offset_t va,
186 		vm_page_t mpte, vm_page_t m);
187 
188 static vm_page_t pmap_allocpte (pmap_t pmap, vm_offset_t va);
189 
190 static int pmap_release_free_page (pmap_t pmap, vm_page_t p);
191 static vm_page_t _pmap_allocpte (pmap_t pmap, vm_pindex_t ptepindex);
192 #if JGPMAP32
193 static pt_entry_t * pmap_pte_quick (pmap_t pmap, vm_offset_t va);
194 #endif
195 static vm_page_t pmap_page_lookup (vm_object_t object, vm_pindex_t pindex);
196 static int pmap_unuse_pt (pmap_t, vm_offset_t, vm_page_t);
197 
198 /*
199  * pmap_pte_quick:
200  *
201  *	Super fast pmap_pte routine best used when scanning the pv lists.
202  *	This eliminates many course-grained invltlb calls.  Note that many of
203  *	the pv list scans are across different pmaps and it is very wasteful
204  *	to do an entire invltlb when checking a single mapping.
205  *
206  *	Should only be called while in a critical section.
207  */
208 #if JGPMAP32
209 static __inline pt_entry_t *pmap_pte(pmap_t pmap, vm_offset_t va);
210 
211 static pt_entry_t *
212 pmap_pte_quick(pmap_t pmap, vm_offset_t va)
213 {
214 	return pmap_pte(pmap, va);
215 }
216 #endif
217 
218 /* Return a non-clipped PD index for a given VA */
219 static __inline vm_pindex_t
220 pmap_pde_pindex(vm_offset_t va)
221 {
222 	return va >> PDRSHIFT;
223 }
224 
225 /* Return various clipped indexes for a given VA */
226 static __inline vm_pindex_t
227 pmap_pte_index(vm_offset_t va)
228 {
229 	return ((va >> PAGE_SHIFT) & ((1ul << NPTEPGSHIFT) - 1));
230 }
231 
232 static __inline vm_pindex_t
233 pmap_pde_index(vm_offset_t va)
234 {
235 	return ((va >> PDRSHIFT) & ((1ul << NPDEPGSHIFT) - 1));
236 }
237 
238 static __inline vm_pindex_t
239 pmap_pdpe_index(vm_offset_t va)
240 {
241 	return ((va >> PDPSHIFT) & ((1ul << NPDPEPGSHIFT) - 1));
242 }
243 
244 static __inline vm_pindex_t
245 pmap_pml4e_index(vm_offset_t va)
246 {
247 	return ((va >> PML4SHIFT) & ((1ul << NPML4EPGSHIFT) - 1));
248 }
249 
250 /* Return a pointer to the PML4 slot that corresponds to a VA */
251 static __inline pml4_entry_t *
252 pmap_pml4e(pmap_t pmap, vm_offset_t va)
253 {
254 	return (&pmap->pm_pml4[pmap_pml4e_index(va)]);
255 }
256 
257 /* Return a pointer to the PDP slot that corresponds to a VA */
258 static __inline pdp_entry_t *
259 pmap_pml4e_to_pdpe(pml4_entry_t *pml4e, vm_offset_t va)
260 {
261 	pdp_entry_t *pdpe;
262 
263 	pdpe = (pdp_entry_t *)PHYS_TO_DMAP(*pml4e & VPTE_FRAME);
264 	return (&pdpe[pmap_pdpe_index(va)]);
265 }
266 
267 /* Return a pointer to the PDP slot that corresponds to a VA */
268 static __inline pdp_entry_t *
269 pmap_pdpe(pmap_t pmap, vm_offset_t va)
270 {
271 	pml4_entry_t *pml4e;
272 
273 	pml4e = pmap_pml4e(pmap, va);
274 	if ((*pml4e & VPTE_V) == 0)
275 		return NULL;
276 	return (pmap_pml4e_to_pdpe(pml4e, va));
277 }
278 
279 /* Return a pointer to the PD slot that corresponds to a VA */
280 static __inline pd_entry_t *
281 pmap_pdpe_to_pde(pdp_entry_t *pdpe, vm_offset_t va)
282 {
283 	pd_entry_t *pde;
284 
285 	pde = (pd_entry_t *)PHYS_TO_DMAP(*pdpe & VPTE_FRAME);
286 	return (&pde[pmap_pde_index(va)]);
287 }
288 
289 /* Return a pointer to the PD slot that corresponds to a VA */
290 static __inline pd_entry_t *
291 pmap_pde(pmap_t pmap, vm_offset_t va)
292 {
293 	pdp_entry_t *pdpe;
294 
295 	pdpe = pmap_pdpe(pmap, va);
296 	if (pdpe == NULL || (*pdpe & VPTE_V) == 0)
297 		 return NULL;
298 	return (pmap_pdpe_to_pde(pdpe, va));
299 }
300 
301 /* Return a pointer to the PT slot that corresponds to a VA */
302 static __inline pt_entry_t *
303 pmap_pde_to_pte(pd_entry_t *pde, vm_offset_t va)
304 {
305 	pt_entry_t *pte;
306 
307 	pte = (pt_entry_t *)PHYS_TO_DMAP(*pde & VPTE_FRAME);
308 	return (&pte[pmap_pte_index(va)]);
309 }
310 
311 /* Return a pointer to the PT slot that corresponds to a VA */
312 static __inline pt_entry_t *
313 pmap_pte(pmap_t pmap, vm_offset_t va)
314 {
315 	pd_entry_t *pde;
316 
317 	pde = pmap_pde(pmap, va);
318 	if (pde == NULL || (*pde & VPTE_V) == 0)
319 		return NULL;
320 	if ((*pde & VPTE_PS) != 0)	/* compat with i386 pmap_pte() */
321 		return ((pt_entry_t *)pde);
322 	return (pmap_pde_to_pte(pde, va));
323 }
324 
325 
326 #if JGV
327 PMAP_INLINE pt_entry_t *
328 vtopte(vm_offset_t va)
329 {
330 	uint64_t mask = ((1ul << (NPTEPGSHIFT + NPDEPGSHIFT +
331 				  NPDPEPGSHIFT + NPML4EPGSHIFT)) - 1);
332 
333 	return (PTmap + ((va >> PAGE_SHIFT) & mask));
334 }
335 
336 static __inline pd_entry_t *
337 vtopde(vm_offset_t va)
338 {
339 	uint64_t mask = ((1ul << (NPDEPGSHIFT + NPDPEPGSHIFT +
340 				  NPML4EPGSHIFT)) - 1);
341 
342 	return (PDmap + ((va >> PDRSHIFT) & mask));
343 }
344 #else
345 static PMAP_INLINE pt_entry_t *
346 vtopte(vm_offset_t va)
347 {
348 	pt_entry_t *x;
349 	x = pmap_pte(&kernel_pmap, va);
350 	assert(x != NULL);
351 	return x;
352 }
353 
354 static __inline pd_entry_t *
355 vtopde(vm_offset_t va)
356 {
357 	pd_entry_t *x;
358 	x = pmap_pde(&kernel_pmap, va);
359 	assert(x != NULL);
360 	return x;
361 }
362 #endif
363 
364 static uint64_t
365 allocpages(vm_paddr_t *firstaddr, int n)
366 {
367 	uint64_t ret;
368 
369 	ret = *firstaddr;
370 #if JGV
371 	bzero((void *)ret, n * PAGE_SIZE);
372 #endif
373 	*firstaddr += n * PAGE_SIZE;
374 	return (ret);
375 }
376 
377 static void
378 create_dmap_vmm(vm_paddr_t *firstaddr)
379 {
380 	void *stack_addr;
381 	int pml4_stack_index;
382 	int pdp_stack_index;
383 	int pd_stack_index;
384 	long i,j;
385 	int regs[4];
386 	int amd_feature;
387 
388 	uint64_t KPDP_DMAP_phys = allocpages(firstaddr, NDMPML4E);
389 	uint64_t KPDP_VSTACK_phys = allocpages(firstaddr, 1);
390 	uint64_t KPD_VSTACK_phys = allocpages(firstaddr, 1);
391 
392 	pml4_entry_t *KPML4virt = (pml4_entry_t *)PHYS_TO_DMAP(KPML4phys);
393 	pdp_entry_t *KPDP_DMAP_virt = (pdp_entry_t *)PHYS_TO_DMAP(KPDP_DMAP_phys);
394 	pdp_entry_t *KPDP_VSTACK_virt = (pdp_entry_t *)PHYS_TO_DMAP(KPDP_VSTACK_phys);
395 	pd_entry_t *KPD_VSTACK_virt = (pd_entry_t *)PHYS_TO_DMAP(KPD_VSTACK_phys);
396 
397 	bzero(KPDP_DMAP_virt, NDMPML4E * PAGE_SIZE);
398 	bzero(KPDP_VSTACK_virt, 1 * PAGE_SIZE);
399 	bzero(KPD_VSTACK_virt, 1 * PAGE_SIZE);
400 
401 	do_cpuid(0x80000001, regs);
402 	amd_feature = regs[3];
403 
404 	/* Build the mappings for the first 512GB */
405 	if (amd_feature & AMDID_PAGE1GB) {
406 		/* In pages of 1 GB, if supported */
407 		for (i = 0; i < NPDPEPG; i++) {
408 			KPDP_DMAP_virt[i] = ((uint64_t)i << PDPSHIFT);
409 			KPDP_DMAP_virt[i] |= VPTE_RW | VPTE_V | VPTE_PS | VPTE_U;
410 		}
411 	} else {
412 		/* In page of 2MB, otherwise */
413 		for (i = 0; i < NPDPEPG; i++) {
414 			uint64_t KPD_DMAP_phys = allocpages(firstaddr, 1);
415 			pd_entry_t *KPD_DMAP_virt = (pd_entry_t *)PHYS_TO_DMAP(KPD_DMAP_phys);
416 
417 			bzero(KPD_DMAP_virt, PAGE_SIZE);
418 
419 			KPDP_DMAP_virt[i] = KPD_DMAP_phys;
420 			KPDP_DMAP_virt[i] |= VPTE_RW | VPTE_V | VPTE_U;
421 
422 			/* For each PD, we have to allocate NPTEPG PT */
423 			for (j = 0; j < NPTEPG; j++) {
424 				KPD_DMAP_virt[j] = (i << PDPSHIFT) | (j << PDRSHIFT);
425 				KPD_DMAP_virt[j] |= VPTE_RW | VPTE_V | VPTE_PS | VPTE_U;
426 			}
427 		}
428 	}
429 
430 	/* DMAP for the first 512G */
431 	KPML4virt[0] = KPDP_DMAP_phys;
432 	KPML4virt[0] |= VPTE_RW | VPTE_V | VPTE_U;
433 
434 	/* create a 2 MB map of the new stack */
435 	pml4_stack_index = (uint64_t)&stack_addr >> PML4SHIFT;
436 	KPML4virt[pml4_stack_index] = KPDP_VSTACK_phys;
437 	KPML4virt[pml4_stack_index] |= VPTE_RW | VPTE_V | VPTE_U;
438 
439 	pdp_stack_index = ((uint64_t)&stack_addr & PML4MASK) >> PDPSHIFT;
440 	KPDP_VSTACK_virt[pdp_stack_index] = KPD_VSTACK_phys;
441 	KPDP_VSTACK_virt[pdp_stack_index] |= VPTE_RW | VPTE_V | VPTE_U;
442 
443 	pd_stack_index = ((uint64_t)&stack_addr & PDPMASK) >> PDRSHIFT;
444 	KPD_VSTACK_virt[pd_stack_index] = (uint64_t) vkernel_stack;
445 	KPD_VSTACK_virt[pd_stack_index] |= VPTE_RW | VPTE_V | VPTE_U | VPTE_PS;
446 }
447 
448 static void
449 create_pagetables(vm_paddr_t *firstaddr, int64_t ptov_offset)
450 {
451 	int i;
452 	pml4_entry_t *KPML4virt;
453 	pdp_entry_t *KPDPvirt;
454 	pd_entry_t *KPDvirt;
455 	pt_entry_t *KPTvirt;
456 	int kpml4i = pmap_pml4e_index(ptov_offset);
457 	int kpdpi = pmap_pdpe_index(ptov_offset);
458 	int kpdi = pmap_pde_index(ptov_offset);
459 
460 	/*
461          * Calculate NKPT - number of kernel page tables.  We have to
462          * accomodoate prealloction of the vm_page_array, dump bitmap,
463          * MSGBUF_SIZE, and other stuff.  Be generous.
464          *
465          * Maxmem is in pages.
466          */
467         nkpt = (Maxmem * (sizeof(struct vm_page) * 2) + MSGBUF_SIZE) / NBPDR;
468 	/*
469 	 * Allocate pages
470 	 */
471 	KPML4phys = allocpages(firstaddr, 1);
472 	KPDPphys = allocpages(firstaddr, NKPML4E);
473 	KPDphys = allocpages(firstaddr, NKPDPE);
474 	KPTphys = allocpages(firstaddr, nkpt);
475 
476 	KPML4virt = (pml4_entry_t *)PHYS_TO_DMAP(KPML4phys);
477 	KPDPvirt = (pdp_entry_t *)PHYS_TO_DMAP(KPDPphys);
478 	KPDvirt = (pd_entry_t *)PHYS_TO_DMAP(KPDphys);
479 	KPTvirt = (pt_entry_t *)PHYS_TO_DMAP(KPTphys);
480 
481 	bzero(KPML4virt, 1 * PAGE_SIZE);
482 	bzero(KPDPvirt, NKPML4E * PAGE_SIZE);
483 	bzero(KPDvirt, NKPDPE * PAGE_SIZE);
484 	bzero(KPTvirt, nkpt * PAGE_SIZE);
485 
486 	/* Now map the page tables at their location within PTmap */
487 	for (i = 0; i < nkpt; i++) {
488 		KPDvirt[i + kpdi] = KPTphys + (i << PAGE_SHIFT);
489 		KPDvirt[i + kpdi] |= VPTE_RW | VPTE_V | VPTE_U;
490 	}
491 
492 	/* And connect up the PD to the PDP */
493 	for (i = 0; i < NKPDPE; i++) {
494 		KPDPvirt[i + kpdpi] = KPDphys + (i << PAGE_SHIFT);
495 		KPDPvirt[i + kpdpi] |= VPTE_RW | VPTE_V | VPTE_U;
496 	}
497 
498 	/* And recursively map PML4 to itself in order to get PTmap */
499 	KPML4virt[PML4PML4I] = KPML4phys;
500 	KPML4virt[PML4PML4I] |= VPTE_RW | VPTE_V | VPTE_U;
501 
502 	/* Connect the KVA slot up to the PML4 */
503 	KPML4virt[kpml4i] = KPDPphys;
504 	KPML4virt[kpml4i] |= VPTE_RW | VPTE_V | VPTE_U;
505 }
506 
507 /*
508  * Typically used to initialize a fictitious page by vm/device_pager.c
509  */
510 void
511 pmap_page_init(struct vm_page *m)
512 {
513 	vm_page_init(m);
514 	TAILQ_INIT(&m->md.pv_list);
515 }
516 
517 /*
518  *	Bootstrap the system enough to run with virtual memory.
519  *
520  *	On the i386 this is called after mapping has already been enabled
521  *	and just syncs the pmap module with what has already been done.
522  *	[We can't call it easily with mapping off since the kernel is not
523  *	mapped with PA == VA, hence we would have to relocate every address
524  *	from the linked base (virtual) address "KERNBASE" to the actual
525  *	(physical) address starting relative to 0]
526  */
527 void
528 pmap_bootstrap(vm_paddr_t *firstaddr, int64_t ptov_offset)
529 {
530 	vm_offset_t va;
531 	pt_entry_t *pte;
532 
533 	/*
534 	 * Create an initial set of page tables to run the kernel in.
535 	 */
536 	create_pagetables(firstaddr, ptov_offset);
537 
538 	/* Create the DMAP for the VMM */
539 	if (vmm_enabled) {
540 		create_dmap_vmm(firstaddr);
541 	}
542 
543 	virtual_start = KvaStart;
544 	virtual_end = KvaEnd;
545 
546 	/*
547 	 * Initialize protection array.
548 	 */
549 	i386_protection_init();
550 
551 	/*
552 	 * The kernel's pmap is statically allocated so we don't have to use
553 	 * pmap_create, which is unlikely to work correctly at this part of
554 	 * the boot sequence (XXX and which no longer exists).
555 	 *
556 	 * The kernel_pmap's pm_pteobj is used only for locking and not
557 	 * for mmu pages.
558 	 */
559 	kernel_pmap.pm_pml4 = (pml4_entry_t *)PHYS_TO_DMAP(KPML4phys);
560 	kernel_pmap.pm_count = 1;
561 	/* don't allow deactivation */
562 	CPUMASK_ASSALLONES(kernel_pmap.pm_active);
563 	kernel_pmap.pm_pteobj = NULL;	/* see pmap_init */
564 	TAILQ_INIT(&kernel_pmap.pm_pvlist);
565 	TAILQ_INIT(&kernel_pmap.pm_pvlist_free);
566 	lwkt_token_init(&kernel_pmap.pm_token, "kpmap_tok");
567 	spin_init(&kernel_pmap.pm_spin, "pmapbootstrap");
568 
569 	/*
570 	 * Reserve some special page table entries/VA space for temporary
571 	 * mapping of pages.
572 	 */
573 #define	SYSMAP(c, p, v, n)	\
574 	v = (c)va; va += ((n)*PAGE_SIZE); p = pte; pte += (n);
575 
576 	va = virtual_start;
577 	pte = pmap_pte(&kernel_pmap, va);
578 	/*
579 	 * CMAP1/CMAP2 are used for zeroing and copying pages.
580 	 */
581 	SYSMAP(caddr_t, CMAP1, CADDR1, 1)
582 
583 #if JGV
584 	/*
585 	 * Crashdump maps.
586 	 */
587 	SYSMAP(caddr_t, pt_crashdumpmap, crashdumpmap, MAXDUMPPGS);
588 #endif
589 
590 	/*
591 	 * ptvmmap is used for reading arbitrary physical pages via
592 	 * /dev/mem.
593 	 */
594 	SYSMAP(caddr_t, ptmmap, ptvmmap, 1)
595 
596 	/*
597 	 * msgbufp is used to map the system message buffer.
598 	 * XXX msgbufmap is not used.
599 	 */
600 	SYSMAP(struct msgbuf *, msgbufmap, msgbufp,
601 	       atop(round_page(MSGBUF_SIZE)))
602 
603 	virtual_start = va;
604 
605 	*CMAP1 = 0;
606 	/* Not ready to do an invltlb yet for VMM*/
607 	if (!vmm_enabled)
608 		cpu_invltlb();
609 
610 }
611 
612 /*
613  *	Initialize the pmap module.
614  *	Called by vm_init, to initialize any structures that the pmap
615  *	system needs to map virtual memory.
616  *	pmap_init has been enhanced to support in a fairly consistant
617  *	way, discontiguous physical memory.
618  */
619 void
620 pmap_init(void)
621 {
622 	int i;
623 	int initial_pvs;
624 
625 	/*
626 	 * object for kernel page table pages
627 	 */
628 	/* JG I think the number can be arbitrary */
629 	kptobj = vm_object_allocate(OBJT_DEFAULT, 5);
630 	kernel_pmap.pm_pteobj = kptobj;
631 
632 	/*
633 	 * Allocate memory for random pmap data structures.  Includes the
634 	 * pv_head_table.
635 	 */
636 	for(i = 0; i < vm_page_array_size; i++) {
637 		vm_page_t m;
638 
639 		m = &vm_page_array[i];
640 		TAILQ_INIT(&m->md.pv_list);
641 		m->md.pv_list_count = 0;
642 	}
643 
644 	/*
645 	 * init the pv free list
646 	 */
647 	initial_pvs = vm_page_array_size;
648 	if (initial_pvs < MINPV)
649 		initial_pvs = MINPV;
650 	pvzone = &pvzone_store;
651 	pvinit = (struct pv_entry *)
652 		kmem_alloc(&kernel_map,
653 			   initial_pvs * sizeof (struct pv_entry),
654 			   VM_SUBSYS_PVENTRY);
655 	zbootinit(pvzone, "PV ENTRY", sizeof (struct pv_entry), pvinit,
656 		initial_pvs);
657 
658 	/*
659 	 * Now it is safe to enable pv_table recording.
660 	 */
661 	pmap_initialized = TRUE;
662 }
663 
664 /*
665  * Initialize the address space (zone) for the pv_entries.  Set a
666  * high water mark so that the system can recover from excessive
667  * numbers of pv entries.
668  */
669 void
670 pmap_init2(void)
671 {
672 	int shpgperproc = PMAP_SHPGPERPROC;
673 
674 	TUNABLE_INT_FETCH("vm.pmap.shpgperproc", &shpgperproc);
675 	pv_entry_max = shpgperproc * maxproc + vm_page_array_size;
676 	TUNABLE_INT_FETCH("vm.pmap.pv_entries", &pv_entry_max);
677 	pv_entry_high_water = 9 * (pv_entry_max / 10);
678 	zinitna(pvzone, &pvzone_obj, NULL, 0, pv_entry_max, ZONE_INTERRUPT);
679 }
680 
681 
682 /***************************************************
683  * Low level helper routines.....
684  ***************************************************/
685 
686 /*
687  * The modification bit is not tracked for any pages in this range. XXX
688  * such pages in this maps should always use pmap_k*() functions and not
689  * be managed anyhow.
690  *
691  * XXX User and kernel address spaces are independant for virtual kernels,
692  * this function only applies to the kernel pmap.
693  */
694 static int
695 pmap_track_modified(pmap_t pmap, vm_offset_t va)
696 {
697 	if (pmap != &kernel_pmap)
698 		return 1;
699 	if ((va < clean_sva) || (va >= clean_eva))
700 		return 1;
701 	else
702 		return 0;
703 }
704 
705 /*
706  * Extract the physical page address associated with the map/VA pair.
707  *
708  * No requirements.
709  */
710 vm_paddr_t
711 pmap_extract(pmap_t pmap, vm_offset_t va)
712 {
713 	vm_paddr_t rtval;
714 	pt_entry_t *pte;
715 	pd_entry_t pde, *pdep;
716 
717 	lwkt_gettoken(&vm_token);
718 	rtval = 0;
719 	pdep = pmap_pde(pmap, va);
720 	if (pdep != NULL) {
721 		pde = *pdep;
722 		if (pde) {
723 			if ((pde & VPTE_PS) != 0) {
724 				/* JGV */
725 				rtval = (pde & PG_PS_FRAME) | (va & PDRMASK);
726 			} else {
727 				pte = pmap_pde_to_pte(pdep, va);
728 				rtval = (*pte & VPTE_FRAME) | (va & PAGE_MASK);
729 			}
730 		}
731 	}
732 	lwkt_reltoken(&vm_token);
733 	return rtval;
734 }
735 
736 /*
737  * Similar to extract but checks protections, SMP-friendly short-cut for
738  * vm_fault_page[_quick]().
739  */
740 vm_page_t
741 pmap_fault_page_quick(pmap_t pmap __unused, vm_offset_t vaddr __unused,
742 		      vm_prot_t prot __unused)
743 {
744 	return(NULL);
745 }
746 
747 /*
748  *	Routine:	pmap_kextract
749  *	Function:
750  *		Extract the physical page address associated
751  *		kernel virtual address.
752  */
753 vm_paddr_t
754 pmap_kextract(vm_offset_t va)
755 {
756 	pd_entry_t pde;
757 	vm_paddr_t pa;
758 
759 	KKASSERT(va >= KvaStart && va < KvaEnd);
760 
761 	/*
762 	 * The DMAP region is not included in [KvaStart, KvaEnd)
763 	 */
764 #if 0
765 	if (va >= DMAP_MIN_ADDRESS && va < DMAP_MAX_ADDRESS) {
766 		pa = DMAP_TO_PHYS(va);
767 	} else {
768 #endif
769 		pde = *vtopde(va);
770 		if (pde & VPTE_PS) {
771 			/* JGV */
772 			pa = (pde & PG_PS_FRAME) | (va & PDRMASK);
773 		} else {
774 			/*
775 			 * Beware of a concurrent promotion that changes the
776 			 * PDE at this point!  For example, vtopte() must not
777 			 * be used to access the PTE because it would use the
778 			 * new PDE.  It is, however, safe to use the old PDE
779 			 * because the page table page is preserved by the
780 			 * promotion.
781 			 */
782 			pa = *pmap_pde_to_pte(&pde, va);
783 			pa = (pa & VPTE_FRAME) | (va & PAGE_MASK);
784 		}
785 #if 0
786 	}
787 #endif
788 	return pa;
789 }
790 
791 /***************************************************
792  * Low level mapping routines.....
793  ***************************************************/
794 
795 /*
796  * Enter a mapping into kernel_pmap.  Mappings created in this fashion
797  * are not managed.  Mappings must be immediately accessible on all cpus.
798  *
799  * Call pmap_inval_pte() to invalidate the virtual pte and clean out the
800  * real pmap and handle related races before storing the new vpte.  The
801  * new semantics for kenter require use to do an UNCONDITIONAL invalidation,
802  * because the entry may have previously been cleared without an invalidation.
803  */
804 void
805 pmap_kenter(vm_offset_t va, vm_paddr_t pa)
806 {
807 	pt_entry_t *pte;
808 	pt_entry_t npte;
809 
810 	KKASSERT(va >= KvaStart && va < KvaEnd);
811 	npte = pa | VPTE_RW | VPTE_V | VPTE_U;
812 	pte = vtopte(va);
813 
814 #if 1
815 	*pte = 0;
816 	pmap_inval_pte(pte, &kernel_pmap, va);
817 #else
818 	if (*pte & VPTE_V)
819 		pmap_inval_pte(pte, &kernel_pmap, va);
820 #endif
821 	*pte = npte;
822 }
823 
824 /*
825  * Enter an unmanaged KVA mapping for the private use of the current
826  * cpu only.
827  *
828  * It is illegal for the mapping to be accessed by other cpus without
829  * proper invalidation.
830  */
831 int
832 pmap_kenter_quick(vm_offset_t va, vm_paddr_t pa)
833 {
834 	pt_entry_t *ptep;
835 	pt_entry_t npte;
836 	int res;
837 
838 	KKASSERT(va >= KvaStart && va < KvaEnd);
839 
840 	npte = (vpte_t)pa | VPTE_RW | VPTE_V | VPTE_U;
841 	ptep = vtopte(va);
842 #if 1
843 	res = 1;
844 #else
845 	/* FUTURE */
846 	res = (*ptep != 0);
847 #endif
848 
849 	if (*ptep & VPTE_V)
850 		pmap_inval_pte_quick(ptep, &kernel_pmap, va);
851 	*ptep = npte;
852 
853 	return res;
854 }
855 
856 int
857 pmap_kenter_noinval(vm_offset_t va, vm_paddr_t pa)
858 {
859 	pt_entry_t *ptep;
860 	pt_entry_t npte;
861 	int res;
862 
863 	KKASSERT(va >= KvaStart && va < KvaEnd);
864 
865 	npte = (vpte_t)pa | VPTE_RW | VPTE_V | VPTE_U;
866 	ptep = vtopte(va);
867 #if 1
868 	res = 1;
869 #else
870 	/* FUTURE */
871 	res = (*ptep != 0);
872 #endif
873 
874 	*ptep = npte;
875 
876 	return res;
877 }
878 
879 /*
880  * Remove an unmanaged mapping created with pmap_kenter*().
881  */
882 void
883 pmap_kremove(vm_offset_t va)
884 {
885 	pt_entry_t *pte;
886 
887 	KKASSERT(va >= KvaStart && va < KvaEnd);
888 
889 	pte = vtopte(va);
890 	*pte = 0;
891 	pmap_inval_pte(pte, &kernel_pmap, va);
892 }
893 
894 /*
895  * Remove an unmanaged mapping created with pmap_kenter*() but synchronize
896  * only with this cpu.
897  *
898  * Unfortunately because we optimize new entries by testing VPTE_V later
899  * on, we actually still have to synchronize with all the cpus.  XXX maybe
900  * store a junk value and test against 0 in the other places instead?
901  */
902 void
903 pmap_kremove_quick(vm_offset_t va)
904 {
905 	pt_entry_t *pte;
906 
907 	KKASSERT(va >= KvaStart && va < KvaEnd);
908 
909 	pte = vtopte(va);
910 	*pte = 0;
911 	pmap_inval_pte(pte, &kernel_pmap, va); /* NOT _quick */
912 }
913 
914 void
915 pmap_kremove_noinval(vm_offset_t va)
916 {
917 	pt_entry_t *pte;
918 
919 	KKASSERT(va >= KvaStart && va < KvaEnd);
920 
921 	pte = vtopte(va);
922 	*pte = 0;
923 }
924 
925 /*
926  *	Used to map a range of physical addresses into kernel
927  *	virtual address space.
928  *
929  *	For now, VM is already on, we only need to map the
930  *	specified memory.
931  */
932 vm_offset_t
933 pmap_map(vm_offset_t *virtp, vm_paddr_t start, vm_paddr_t end, int prot)
934 {
935 	return PHYS_TO_DMAP(start);
936 }
937 
938 /*
939  * Map a set of unmanaged VM pages into KVM.
940  */
941 void
942 pmap_qenter(vm_offset_t va, vm_page_t *m, int count)
943 {
944 	vm_offset_t end_va;
945 
946 	end_va = va + count * PAGE_SIZE;
947 	KKASSERT(va >= KvaStart && end_va < KvaEnd);
948 
949 	while (va < end_va) {
950 		pt_entry_t *pte;
951 
952 		pte = vtopte(va);
953 		*pte = 0;
954 		pmap_inval_pte(pte, &kernel_pmap, va);
955 		*pte = VM_PAGE_TO_PHYS(*m) | VPTE_RW | VPTE_V | VPTE_U;
956 		va += PAGE_SIZE;
957 		m++;
958 	}
959 }
960 
961 /*
962  * Undo the effects of pmap_qenter*().
963  */
964 void
965 pmap_qremove(vm_offset_t va, int count)
966 {
967 	vm_offset_t end_va;
968 
969 	end_va = va + count * PAGE_SIZE;
970 	KKASSERT(va >= KvaStart && end_va < KvaEnd);
971 
972 	while (va < end_va) {
973 		pt_entry_t *pte;
974 
975 		pte = vtopte(va);
976 		atomic_swap_long(pte, 0);
977 		pmap_inval_pte(pte, &kernel_pmap, va);
978 		va += PAGE_SIZE;
979 	}
980 }
981 
982 void
983 pmap_qremove_quick(vm_offset_t va, int count)
984 {
985 	vm_offset_t end_va;
986 
987 	end_va = va + count * PAGE_SIZE;
988 	KKASSERT(va >= KvaStart && end_va < KvaEnd);
989 
990 	while (va < end_va) {
991 		pt_entry_t *pte;
992 
993 		pte = vtopte(va);
994 		atomic_swap_long(pte, 0);
995 		cpu_invlpg((void *)va);
996 		va += PAGE_SIZE;
997 	}
998 }
999 
1000 void
1001 pmap_qremove_noinval(vm_offset_t va, int count)
1002 {
1003 	vm_offset_t end_va;
1004 
1005 	end_va = va + count * PAGE_SIZE;
1006 	KKASSERT(va >= KvaStart && end_va < KvaEnd);
1007 
1008 	while (va < end_va) {
1009 		pt_entry_t *pte;
1010 
1011 		pte = vtopte(va);
1012 		atomic_swap_long(pte, 0);
1013 		va += PAGE_SIZE;
1014 	}
1015 }
1016 
1017 /*
1018  * This routine works like vm_page_lookup() but also blocks as long as the
1019  * page is busy.  This routine does not busy the page it returns.
1020  *
1021  * Unless the caller is managing objects whos pages are in a known state,
1022  * the call should be made with a critical section held so the page's object
1023  * association remains valid on return.
1024  */
1025 static vm_page_t
1026 pmap_page_lookup(vm_object_t object, vm_pindex_t pindex)
1027 {
1028 	vm_page_t m;
1029 
1030 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(object));
1031 	m = vm_page_lookup_busy_wait(object, pindex, FALSE, "pplookp");
1032 
1033 	return(m);
1034 }
1035 
1036 /*
1037  * Create a new thread and optionally associate it with a (new) process.
1038  * NOTE! the new thread's cpu may not equal the current cpu.
1039  */
1040 void
1041 pmap_init_thread(thread_t td)
1042 {
1043 	/* enforce pcb placement */
1044 	td->td_pcb = (struct pcb *)(td->td_kstack + td->td_kstack_size) - 1;
1045 	td->td_savefpu = &td->td_pcb->pcb_save;
1046 	td->td_sp = (char *)td->td_pcb - 16; /* JG is -16 needed on x86_64? */
1047 }
1048 
1049 /*
1050  * This routine directly affects the fork perf for a process.
1051  */
1052 void
1053 pmap_init_proc(struct proc *p)
1054 {
1055 }
1056 
1057 /***************************************************
1058  * Page table page management routines.....
1059  ***************************************************/
1060 
1061 static __inline int pmap_unwire_pte_hold(pmap_t pmap, vm_offset_t va,
1062 			vm_page_t m);
1063 
1064 /*
1065  * This routine unholds page table pages, and if the hold count
1066  * drops to zero, then it decrements the wire count.
1067  *
1068  * We must recheck that this is the last hold reference after busy-sleeping
1069  * on the page.
1070  */
1071 static int
1072 _pmap_unwire_pte_hold(pmap_t pmap, vm_offset_t va, vm_page_t m)
1073 {
1074 	vm_page_busy_wait(m, FALSE, "pmuwpt");
1075 	KASSERT(m->queue == PQ_NONE,
1076 		("_pmap_unwire_pte_hold: %p->queue != PQ_NONE", m));
1077 
1078 	if (m->hold_count == 1) {
1079 		/*
1080 		 * Unmap the page table page.
1081 		 */
1082 		//abort(); /* JG */
1083 		/* pmap_inval_add(info, pmap, -1); */
1084 
1085 		if (m->pindex >= (NUPDE + NUPDPE)) {
1086 			/* PDP page */
1087 			pml4_entry_t *pml4;
1088 			pml4 = pmap_pml4e(pmap, va);
1089 			*pml4 = 0;
1090 		} else if (m->pindex >= NUPDE) {
1091 			/* PD page */
1092 			pdp_entry_t *pdp;
1093 			pdp = pmap_pdpe(pmap, va);
1094 			*pdp = 0;
1095 		} else {
1096 			/* PT page */
1097 			pd_entry_t *pd;
1098 			pd = pmap_pde(pmap, va);
1099 			*pd = 0;
1100 		}
1101 
1102 		KKASSERT(pmap->pm_stats.resident_count > 0);
1103 		--pmap->pm_stats.resident_count;
1104 
1105 		if (pmap->pm_ptphint == m)
1106 			pmap->pm_ptphint = NULL;
1107 
1108 		if (m->pindex < NUPDE) {
1109 			/* We just released a PT, unhold the matching PD */
1110 			vm_page_t pdpg;
1111 
1112 			pdpg = PHYS_TO_VM_PAGE(*pmap_pdpe(pmap, va) & VPTE_FRAME);
1113 			pmap_unwire_pte_hold(pmap, va, pdpg);
1114 		}
1115 		if (m->pindex >= NUPDE && m->pindex < (NUPDE + NUPDPE)) {
1116 			/* We just released a PD, unhold the matching PDP */
1117 			vm_page_t pdppg;
1118 
1119 			pdppg = PHYS_TO_VM_PAGE(*pmap_pml4e(pmap, va) & VPTE_FRAME);
1120 			pmap_unwire_pte_hold(pmap, va, pdppg);
1121 		}
1122 
1123 		/*
1124 		 * This was our last hold, the page had better be unwired
1125 		 * after we decrement wire_count.
1126 		 *
1127 		 * FUTURE NOTE: shared page directory page could result in
1128 		 * multiple wire counts.
1129 		 */
1130 		vm_page_unhold(m);
1131 		--m->wire_count;
1132 		KKASSERT(m->wire_count == 0);
1133 		atomic_add_int(&vmstats.v_wire_count, -1);
1134 		vm_page_flag_clear(m, PG_MAPPED | PG_WRITEABLE);
1135 		vm_page_flash(m);
1136 		vm_page_free_zero(m);
1137 		return 1;
1138 	} else {
1139 		KKASSERT(m->hold_count > 1);
1140 		vm_page_unhold(m);
1141 		vm_page_wakeup(m);
1142 		return 0;
1143 	}
1144 }
1145 
1146 static __inline int
1147 pmap_unwire_pte_hold(pmap_t pmap, vm_offset_t va, vm_page_t m)
1148 {
1149 	KKASSERT(m->hold_count > 0);
1150 	if (m->hold_count > 1) {
1151 		vm_page_unhold(m);
1152 		return 0;
1153 	} else {
1154 		return _pmap_unwire_pte_hold(pmap, va, m);
1155 	}
1156 }
1157 
1158 /*
1159  * After removing a page table entry, this routine is used to
1160  * conditionally free the page, and manage the hold/wire counts.
1161  */
1162 static int
1163 pmap_unuse_pt(pmap_t pmap, vm_offset_t va, vm_page_t mpte)
1164 {
1165 	/* JG Use FreeBSD/amd64 or FreeBSD/i386 ptepde approaches? */
1166 	vm_pindex_t ptepindex;
1167 
1168 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(pmap->pm_pteobj));
1169 
1170 	if (mpte == NULL) {
1171 		/*
1172 		 * page table pages in the kernel_pmap are not managed.
1173 		 */
1174 		if (pmap == &kernel_pmap)
1175 			return(0);
1176 		ptepindex = pmap_pde_pindex(va);
1177 		if (pmap->pm_ptphint &&
1178 			(pmap->pm_ptphint->pindex == ptepindex)) {
1179 			mpte = pmap->pm_ptphint;
1180 		} else {
1181 			mpte = pmap_page_lookup(pmap->pm_pteobj, ptepindex);
1182 			pmap->pm_ptphint = mpte;
1183 			vm_page_wakeup(mpte);
1184 		}
1185 	}
1186 
1187 	return pmap_unwire_pte_hold(pmap, va, mpte);
1188 }
1189 
1190 /*
1191  * Initialize pmap0/vmspace0 .  Since process 0 never enters user mode we
1192  * just dummy it up so it works well enough for fork().
1193  *
1194  * In DragonFly, process pmaps may only be used to manipulate user address
1195  * space, never kernel address space.
1196  */
1197 void
1198 pmap_pinit0(struct pmap *pmap)
1199 {
1200 	pmap_pinit(pmap);
1201 }
1202 
1203 /*
1204  * Initialize a preallocated and zeroed pmap structure,
1205  * such as one in a vmspace structure.
1206  */
1207 void
1208 pmap_pinit(struct pmap *pmap)
1209 {
1210 	vm_page_t ptdpg;
1211 
1212 	/*
1213 	 * No need to allocate page table space yet but we do need a valid
1214 	 * page directory table.
1215 	 */
1216 	if (pmap->pm_pml4 == NULL) {
1217 		pmap->pm_pml4 = (pml4_entry_t *)
1218 			kmem_alloc_pageable(&kernel_map, PAGE_SIZE,
1219 					    VM_SUBSYS_PML4);
1220 	}
1221 
1222 	/*
1223 	 * Allocate an object for the ptes
1224 	 */
1225 	if (pmap->pm_pteobj == NULL)
1226 		pmap->pm_pteobj = vm_object_allocate(OBJT_DEFAULT, NUPDE + NUPDPE + PML4PML4I + 1);
1227 
1228 	/*
1229 	 * Allocate the page directory page, unless we already have
1230 	 * one cached.  If we used the cached page the wire_count will
1231 	 * already be set appropriately.
1232 	 */
1233 	if ((ptdpg = pmap->pm_pdirm) == NULL) {
1234 		ptdpg = vm_page_grab(pmap->pm_pteobj,
1235 				     NUPDE + NUPDPE + PML4PML4I,
1236 				     VM_ALLOC_NORMAL | VM_ALLOC_RETRY |
1237 				     VM_ALLOC_ZERO);
1238 		pmap->pm_pdirm = ptdpg;
1239 		vm_page_flag_clear(ptdpg, PG_MAPPED);
1240 		vm_page_wire(ptdpg);
1241 		vm_page_wakeup(ptdpg);
1242 		pmap_kenter((vm_offset_t)pmap->pm_pml4, VM_PAGE_TO_PHYS(ptdpg));
1243 	}
1244 	pmap->pm_count = 1;
1245 	CPUMASK_ASSZERO(pmap->pm_active);
1246 	pmap->pm_ptphint = NULL;
1247 	TAILQ_INIT(&pmap->pm_pvlist);
1248 	TAILQ_INIT(&pmap->pm_pvlist_free);
1249 	spin_init(&pmap->pm_spin, "pmapinit");
1250 	lwkt_token_init(&pmap->pm_token, "pmap_tok");
1251 	bzero(&pmap->pm_stats, sizeof pmap->pm_stats);
1252 	pmap->pm_stats.resident_count = 1;
1253 }
1254 
1255 /*
1256  * Clean up a pmap structure so it can be physically freed.  This routine
1257  * is called by the vmspace dtor function.  A great deal of pmap data is
1258  * left passively mapped to improve vmspace management so we have a bit
1259  * of cleanup work to do here.
1260  *
1261  * No requirements.
1262  */
1263 void
1264 pmap_puninit(pmap_t pmap)
1265 {
1266 	vm_page_t p;
1267 
1268 	KKASSERT(CPUMASK_TESTZERO(pmap->pm_active));
1269 	if ((p = pmap->pm_pdirm) != NULL) {
1270 		KKASSERT(pmap->pm_pml4 != NULL);
1271 		pmap_kremove((vm_offset_t)pmap->pm_pml4);
1272 		vm_page_busy_wait(p, FALSE, "pgpun");
1273 		p->wire_count--;
1274 		atomic_add_int(&vmstats.v_wire_count, -1);
1275 		vm_page_free_zero(p);
1276 		pmap->pm_pdirm = NULL;
1277 	}
1278 	if (pmap->pm_pml4) {
1279 		kmem_free(&kernel_map, (vm_offset_t)pmap->pm_pml4, PAGE_SIZE);
1280 		pmap->pm_pml4 = NULL;
1281 	}
1282 	if (pmap->pm_pteobj) {
1283 		vm_object_deallocate(pmap->pm_pteobj);
1284 		pmap->pm_pteobj = NULL;
1285 	}
1286 }
1287 
1288 /*
1289  * Wire in kernel global address entries.  To avoid a race condition
1290  * between pmap initialization and pmap_growkernel, this procedure
1291  * adds the pmap to the master list (which growkernel scans to update),
1292  * then copies the template.
1293  *
1294  * In a virtual kernel there are no kernel global address entries.
1295  *
1296  * No requirements.
1297  */
1298 void
1299 pmap_pinit2(struct pmap *pmap)
1300 {
1301 	spin_lock(&pmap_spin);
1302 	TAILQ_INSERT_TAIL(&pmap_list, pmap, pm_pmnode);
1303 	spin_unlock(&pmap_spin);
1304 }
1305 
1306 /*
1307  * Attempt to release and free a vm_page in a pmap.  Returns 1 on success,
1308  * 0 on failure (if the procedure had to sleep).
1309  *
1310  * When asked to remove the page directory page itself, we actually just
1311  * leave it cached so we do not have to incur the SMP inval overhead of
1312  * removing the kernel mapping.  pmap_puninit() will take care of it.
1313  */
1314 static int
1315 pmap_release_free_page(struct pmap *pmap, vm_page_t p)
1316 {
1317 	/*
1318 	 * This code optimizes the case of freeing non-busy
1319 	 * page-table pages.  Those pages are zero now, and
1320 	 * might as well be placed directly into the zero queue.
1321 	 */
1322 	if (vm_page_busy_try(p, FALSE)) {
1323 		vm_page_sleep_busy(p, FALSE, "pmaprl");
1324 		return 0;
1325 	}
1326 
1327 	/*
1328 	 * Remove the page table page from the processes address space.
1329 	 */
1330 	if (p->pindex == NUPDE + NUPDPE + PML4PML4I) {
1331 		/*
1332 		 * We are the pml4 table itself.
1333 		 */
1334 		/* XXX anything to do here? */
1335 	} else if (p->pindex >= (NUPDE + NUPDPE)) {
1336 		/*
1337 		 * We are a PDP page.
1338 		 * We look for the PML4 entry that points to us.
1339 		 */
1340 		vm_page_t m4 = vm_page_lookup(pmap->pm_pteobj, NUPDE + NUPDPE + PML4PML4I);
1341 		KKASSERT(m4 != NULL);
1342 		pml4_entry_t *pml4 = (pml4_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m4));
1343 		int idx = (p->pindex - (NUPDE + NUPDPE)) % NPML4EPG;
1344 		KKASSERT(pml4[idx] != 0);
1345 		pml4[idx] = 0;
1346 		m4->hold_count--;
1347 		/* JG What about wire_count? */
1348 	} else if (p->pindex >= NUPDE) {
1349 		/*
1350 		 * We are a PD page.
1351 		 * We look for the PDP entry that points to us.
1352 		 */
1353 		vm_page_t m3 = vm_page_lookup(pmap->pm_pteobj, NUPDE + NUPDPE + (p->pindex - NUPDE) / NPDPEPG);
1354 		KKASSERT(m3 != NULL);
1355 		pdp_entry_t *pdp = (pdp_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m3));
1356 		int idx = (p->pindex - NUPDE) % NPDPEPG;
1357 		KKASSERT(pdp[idx] != 0);
1358 		pdp[idx] = 0;
1359 		m3->hold_count--;
1360 		/* JG What about wire_count? */
1361 	} else {
1362 		/* We are a PT page.
1363 		 * We look for the PD entry that points to us.
1364 		 */
1365 		vm_page_t m2 = vm_page_lookup(pmap->pm_pteobj, NUPDE + p->pindex / NPDEPG);
1366 		KKASSERT(m2 != NULL);
1367 		pd_entry_t *pd = (pd_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m2));
1368 		int idx = p->pindex % NPDEPG;
1369 		pd[idx] = 0;
1370 		m2->hold_count--;
1371 		/* JG What about wire_count? */
1372 	}
1373 	KKASSERT(pmap->pm_stats.resident_count > 0);
1374 	--pmap->pm_stats.resident_count;
1375 
1376 	if (p->hold_count)  {
1377 		panic("pmap_release: freeing held pt page "
1378 		      "pmap=%p pg=%p dmap=%p pi=%ld {%ld,%ld,%ld}",
1379 		      pmap, p, (void *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(p)),
1380 		      p->pindex, NUPDE, NUPDPE, PML4PML4I);
1381 	}
1382 	if (pmap->pm_ptphint && (pmap->pm_ptphint->pindex == p->pindex))
1383 		pmap->pm_ptphint = NULL;
1384 
1385 	/*
1386 	 * We leave the top-level page table page cached, wired, and mapped in
1387 	 * the pmap until the dtor function (pmap_puninit()) gets called.
1388 	 * However, still clean it up.
1389 	 */
1390 	if (p->pindex == NUPDE + NUPDPE + PML4PML4I) {
1391 		bzero(pmap->pm_pml4, PAGE_SIZE);
1392 		vm_page_wakeup(p);
1393 	} else {
1394 		abort();
1395 		p->wire_count--;
1396 		atomic_add_int(&vmstats.v_wire_count, -1);
1397 		/* JG eventually revert to using vm_page_free_zero() */
1398 		vm_page_free(p);
1399 	}
1400 	return 1;
1401 }
1402 
1403 /*
1404  * this routine is called if the page table page is not
1405  * mapped correctly.
1406  */
1407 static vm_page_t
1408 _pmap_allocpte(pmap_t pmap, vm_pindex_t ptepindex)
1409 {
1410 	vm_page_t m, pdppg, pdpg;
1411 
1412 	/*
1413 	 * Find or fabricate a new pagetable page.  Handle allocation
1414 	 * races by checking m->valid.
1415 	 */
1416 	m = vm_page_grab(pmap->pm_pteobj, ptepindex,
1417 			 VM_ALLOC_NORMAL | VM_ALLOC_ZERO | VM_ALLOC_RETRY);
1418 
1419 	KASSERT(m->queue == PQ_NONE,
1420 		("_pmap_allocpte: %p->queue != PQ_NONE", m));
1421 
1422 	/*
1423 	 * Increment the hold count for the page we will be returning to
1424 	 * the caller.
1425 	 */
1426 	m->hold_count++;
1427 	vm_page_wire(m);
1428 
1429 	/*
1430 	 * Map the pagetable page into the process address space, if
1431 	 * it isn't already there.
1432 	 */
1433 	++pmap->pm_stats.resident_count;
1434 
1435 	if (ptepindex >= (NUPDE + NUPDPE)) {
1436 		pml4_entry_t *pml4;
1437 		vm_pindex_t pml4index;
1438 
1439 		/* Wire up a new PDP page */
1440 		pml4index = ptepindex - (NUPDE + NUPDPE);
1441 		pml4 = &pmap->pm_pml4[pml4index];
1442 		*pml4 = VM_PAGE_TO_PHYS(m) |
1443 		    VPTE_RW | VPTE_V | VPTE_U |
1444 		    VPTE_A | VPTE_M;
1445 	} else if (ptepindex >= NUPDE) {
1446 		vm_pindex_t pml4index;
1447 		vm_pindex_t pdpindex;
1448 		pml4_entry_t *pml4;
1449 		pdp_entry_t *pdp;
1450 
1451 		/* Wire up a new PD page */
1452 		pdpindex = ptepindex - NUPDE;
1453 		pml4index = pdpindex >> NPML4EPGSHIFT;
1454 
1455 		pml4 = &pmap->pm_pml4[pml4index];
1456 		if ((*pml4 & VPTE_V) == 0) {
1457 			/* Have to allocate a new PDP page, recurse */
1458 			if (_pmap_allocpte(pmap, NUPDE + NUPDPE + pml4index)
1459 			     == NULL) {
1460 				--m->wire_count;
1461 				vm_page_free(m);
1462 				return (NULL);
1463 			}
1464 		} else {
1465 			/* Add reference to the PDP page */
1466 			pdppg = PHYS_TO_VM_PAGE(*pml4 & VPTE_FRAME);
1467 			pdppg->hold_count++;
1468 		}
1469 		pdp = (pdp_entry_t *)PHYS_TO_DMAP(*pml4 & VPTE_FRAME);
1470 
1471 		/* Now find the pdp page */
1472 		pdp = &pdp[pdpindex & ((1ul << NPDPEPGSHIFT) - 1)];
1473 		KKASSERT(*pdp == 0);	/* JG DEBUG64 */
1474 		*pdp = VM_PAGE_TO_PHYS(m) | VPTE_RW | VPTE_V | VPTE_U |
1475 		       VPTE_A | VPTE_M;
1476 	} else {
1477 		vm_pindex_t pml4index;
1478 		vm_pindex_t pdpindex;
1479 		pml4_entry_t *pml4;
1480 		pdp_entry_t *pdp;
1481 		pd_entry_t *pd;
1482 
1483 		/* Wire up a new PT page */
1484 		pdpindex = ptepindex >> NPDPEPGSHIFT;
1485 		pml4index = pdpindex >> NPML4EPGSHIFT;
1486 
1487 		/* First, find the pdp and check that its valid. */
1488 		pml4 = &pmap->pm_pml4[pml4index];
1489 		if ((*pml4 & VPTE_V) == 0) {
1490 			/* We miss a PDP page. We ultimately need a PD page.
1491 			 * Recursively allocating a PD page will allocate
1492 			 * the missing PDP page and will also allocate
1493 			 * the PD page we need.
1494 			 */
1495 			/* Have to allocate a new PD page, recurse */
1496 			if (_pmap_allocpte(pmap, NUPDE + pdpindex)
1497 			     == NULL) {
1498 				--m->wire_count;
1499 				vm_page_free(m);
1500 				return (NULL);
1501 			}
1502 			pdp = (pdp_entry_t *)PHYS_TO_DMAP(*pml4 & VPTE_FRAME);
1503 			pdp = &pdp[pdpindex & ((1ul << NPDPEPGSHIFT) - 1)];
1504 		} else {
1505 			pdp = (pdp_entry_t *)PHYS_TO_DMAP(*pml4 & VPTE_FRAME);
1506 			pdp = &pdp[pdpindex & ((1ul << NPDPEPGSHIFT) - 1)];
1507 			if ((*pdp & VPTE_V) == 0) {
1508 				/* Have to allocate a new PD page, recurse */
1509 				if (_pmap_allocpte(pmap, NUPDE + pdpindex)
1510 				     == NULL) {
1511 					--m->wire_count;
1512 					vm_page_free(m);
1513 					return (NULL);
1514 				}
1515 			} else {
1516 				/* Add reference to the PD page */
1517 				pdpg = PHYS_TO_VM_PAGE(*pdp & VPTE_FRAME);
1518 				pdpg->hold_count++;
1519 			}
1520 		}
1521 		pd = (pd_entry_t *)PHYS_TO_DMAP(*pdp & VPTE_FRAME);
1522 
1523 		/* Now we know where the page directory page is */
1524 		pd = &pd[ptepindex & ((1ul << NPDEPGSHIFT) - 1)];
1525 		KKASSERT(*pd == 0);	/* JG DEBUG64 */
1526 		*pd = VM_PAGE_TO_PHYS(m) | VPTE_RW | VPTE_V | VPTE_U |
1527 		      VPTE_A | VPTE_M;
1528 	}
1529 
1530 	/*
1531 	 * Set the page table hint
1532 	 */
1533 	pmap->pm_ptphint = m;
1534 	vm_page_flag_set(m, PG_MAPPED);
1535 	vm_page_wakeup(m);
1536 
1537 	return m;
1538 }
1539 
1540 /*
1541  * Determine the page table page required to access the VA in the pmap
1542  * and allocate it if necessary.  Return a held vm_page_t for the page.
1543  *
1544  * Only used with user pmaps.
1545  */
1546 static vm_page_t
1547 pmap_allocpte(pmap_t pmap, vm_offset_t va)
1548 {
1549 	vm_pindex_t ptepindex;
1550 	pd_entry_t *pd;
1551 	vm_page_t m;
1552 
1553 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(pmap->pm_pteobj));
1554 
1555 	/*
1556 	 * Calculate pagetable page index
1557 	 */
1558 	ptepindex = pmap_pde_pindex(va);
1559 
1560 	/*
1561 	 * Get the page directory entry
1562 	 */
1563 	pd = pmap_pde(pmap, va);
1564 
1565 	/*
1566 	 * This supports switching from a 2MB page to a
1567 	 * normal 4K page.
1568 	 */
1569 	if (pd != NULL && (*pd & (VPTE_PS | VPTE_V)) == (VPTE_PS | VPTE_V)) {
1570 		panic("no promotion/demotion yet");
1571 		*pd = 0;
1572 		pd = NULL;
1573 		/*cpu_invltlb();*/
1574 		/*smp_invltlb();*/
1575 	}
1576 
1577 	/*
1578 	 * If the page table page is mapped, we just increment the
1579 	 * hold count, and activate it.
1580 	 */
1581 	if (pd != NULL && (*pd & VPTE_V) != 0) {
1582 		/* YYY hint is used here on i386 */
1583 		m = pmap_page_lookup(pmap->pm_pteobj, ptepindex);
1584 		pmap->pm_ptphint = m;
1585 		vm_page_hold(m);
1586 		vm_page_wakeup(m);
1587 		return m;
1588 	}
1589 	/*
1590 	 * Here if the pte page isn't mapped, or if it has been deallocated.
1591 	 */
1592 	return _pmap_allocpte(pmap, ptepindex);
1593 }
1594 
1595 
1596 /***************************************************
1597  * Pmap allocation/deallocation routines.
1598  ***************************************************/
1599 
1600 /*
1601  * Release any resources held by the given physical map.
1602  * Called when a pmap initialized by pmap_pinit is being released.
1603  * Should only be called if the map contains no valid mappings.
1604  *
1605  * Caller must hold pmap->pm_token
1606  */
1607 static int pmap_release_callback(struct vm_page *p, void *data);
1608 
1609 void
1610 pmap_release(struct pmap *pmap)
1611 {
1612 	vm_object_t object = pmap->pm_pteobj;
1613 	struct rb_vm_page_scan_info info;
1614 
1615 	KKASSERT(pmap != &kernel_pmap);
1616 
1617 	lwkt_gettoken(&vm_token);
1618 #if defined(DIAGNOSTIC)
1619 	if (object->ref_count != 1)
1620 		panic("pmap_release: pteobj reference count != 1");
1621 #endif
1622 
1623 	info.pmap = pmap;
1624 	info.object = object;
1625 
1626 	KASSERT(CPUMASK_TESTZERO(pmap->pm_active),
1627 		("pmap %p still active! %016jx",
1628 		pmap,
1629 		(uintmax_t)CPUMASK_LOWMASK(pmap->pm_active)));
1630 
1631 	spin_lock(&pmap_spin);
1632 	TAILQ_REMOVE(&pmap_list, pmap, pm_pmnode);
1633 	spin_unlock(&pmap_spin);
1634 
1635 	vm_object_hold(object);
1636 	do {
1637 		info.error = 0;
1638 		info.mpte = NULL;
1639 		info.limit = object->generation;
1640 
1641 		vm_page_rb_tree_RB_SCAN(&object->rb_memq, NULL,
1642 				        pmap_release_callback, &info);
1643 		if (info.error == 0 && info.mpte) {
1644 			if (!pmap_release_free_page(pmap, info.mpte))
1645 				info.error = 1;
1646 		}
1647 	} while (info.error);
1648 	vm_object_drop(object);
1649 	lwkt_reltoken(&vm_token);
1650 }
1651 
1652 static int
1653 pmap_release_callback(struct vm_page *p, void *data)
1654 {
1655 	struct rb_vm_page_scan_info *info = data;
1656 
1657 	if (p->pindex == NUPDE + NUPDPE + PML4PML4I) {
1658 		info->mpte = p;
1659 		return(0);
1660 	}
1661 	if (!pmap_release_free_page(info->pmap, p)) {
1662 		info->error = 1;
1663 		return(-1);
1664 	}
1665 	if (info->object->generation != info->limit) {
1666 		info->error = 1;
1667 		return(-1);
1668 	}
1669 	return(0);
1670 }
1671 
1672 /*
1673  * Grow the number of kernel page table entries, if needed.
1674  *
1675  * No requirements.
1676  */
1677 void
1678 pmap_growkernel(vm_offset_t kstart, vm_offset_t kend)
1679 {
1680 	vm_offset_t addr;
1681 	vm_paddr_t paddr;
1682 	vm_offset_t ptppaddr;
1683 	vm_page_t nkpg;
1684 	pd_entry_t *pde, newpdir;
1685 	pdp_entry_t newpdp;
1686 
1687 	addr = kend;
1688 
1689 	vm_object_hold(kptobj);
1690 	if (kernel_vm_end == 0) {
1691 		kernel_vm_end = KvaStart;
1692 		nkpt = 0;
1693 		while ((*pmap_pde(&kernel_pmap, kernel_vm_end) & VPTE_V) != 0) {
1694 			kernel_vm_end = (kernel_vm_end + PAGE_SIZE * NPTEPG) & ~(PAGE_SIZE * NPTEPG - 1);
1695 			nkpt++;
1696 			if (kernel_vm_end - 1 >= kernel_map.max_offset) {
1697 				kernel_vm_end = kernel_map.max_offset;
1698 				break;
1699 			}
1700 		}
1701 	}
1702 	addr = roundup2(addr, PAGE_SIZE * NPTEPG);
1703 	if (addr - 1 >= kernel_map.max_offset)
1704 		addr = kernel_map.max_offset;
1705 	while (kernel_vm_end < addr) {
1706 		pde = pmap_pde(&kernel_pmap, kernel_vm_end);
1707 		if (pde == NULL) {
1708 			/* We need a new PDP entry */
1709 			nkpg = vm_page_alloc(kptobj, nkpt,
1710 			                     VM_ALLOC_NORMAL | VM_ALLOC_SYSTEM
1711 					     | VM_ALLOC_INTERRUPT);
1712 			if (nkpg == NULL) {
1713 				panic("pmap_growkernel: no memory to "
1714 				      "grow kernel");
1715 			}
1716 			paddr = VM_PAGE_TO_PHYS(nkpg);
1717 			pmap_zero_page(paddr);
1718 			newpdp = (pdp_entry_t)(paddr |
1719 			    VPTE_V | VPTE_RW | VPTE_U |
1720 			    VPTE_A | VPTE_M);
1721 			*pmap_pdpe(&kernel_pmap, kernel_vm_end) = newpdp;
1722 			nkpt++;
1723 			continue; /* try again */
1724 		}
1725 		if ((*pde & VPTE_V) != 0) {
1726 			kernel_vm_end = (kernel_vm_end + PAGE_SIZE * NPTEPG) &
1727 					~(PAGE_SIZE * NPTEPG - 1);
1728 			if (kernel_vm_end - 1 >= kernel_map.max_offset) {
1729 				kernel_vm_end = kernel_map.max_offset;
1730 				break;
1731 			}
1732 			continue;
1733 		}
1734 
1735 		/*
1736 		 * This index is bogus, but out of the way
1737 		 */
1738 		nkpg = vm_page_alloc(kptobj, nkpt,
1739 				     VM_ALLOC_NORMAL |
1740 				     VM_ALLOC_SYSTEM |
1741 				     VM_ALLOC_INTERRUPT);
1742 		if (nkpg == NULL)
1743 			panic("pmap_growkernel: no memory to grow kernel");
1744 
1745 		vm_page_wire(nkpg);
1746 		ptppaddr = VM_PAGE_TO_PHYS(nkpg);
1747 		pmap_zero_page(ptppaddr);
1748 		newpdir = (pd_entry_t)(ptppaddr |
1749 		    VPTE_V | VPTE_RW | VPTE_U |
1750 		    VPTE_A | VPTE_M);
1751 		*pmap_pde(&kernel_pmap, kernel_vm_end) = newpdir;
1752 		nkpt++;
1753 
1754 		kernel_vm_end = (kernel_vm_end + PAGE_SIZE * NPTEPG) &
1755 				~(PAGE_SIZE * NPTEPG - 1);
1756 		if (kernel_vm_end - 1 >= kernel_map.max_offset) {
1757 			kernel_vm_end = kernel_map.max_offset;
1758 			break;
1759 		}
1760 	}
1761 	vm_object_drop(kptobj);
1762 }
1763 
1764 /*
1765  * Add a reference to the specified pmap.
1766  *
1767  * No requirements.
1768  */
1769 void
1770 pmap_reference(pmap_t pmap)
1771 {
1772 	if (pmap) {
1773 		lwkt_gettoken(&vm_token);
1774 		++pmap->pm_count;
1775 		lwkt_reltoken(&vm_token);
1776 	}
1777 }
1778 
1779 /************************************************************************
1780  *	   		VMSPACE MANAGEMENT				*
1781  ************************************************************************
1782  *
1783  * The VMSPACE management we do in our virtual kernel must be reflected
1784  * in the real kernel.  This is accomplished by making vmspace system
1785  * calls to the real kernel.
1786  */
1787 void
1788 cpu_vmspace_alloc(struct vmspace *vm)
1789 {
1790 	int r;
1791 	void *rp;
1792 	vpte_t vpte;
1793 
1794 	/*
1795 	 * If VMM enable, don't do nothing, we
1796 	 * are able to use real page tables
1797 	 */
1798 	if (vmm_enabled)
1799 		return;
1800 
1801 #define USER_SIZE	(VM_MAX_USER_ADDRESS - VM_MIN_USER_ADDRESS)
1802 
1803 	if (vmspace_create(&vm->vm_pmap, 0, NULL) < 0)
1804 		panic("vmspace_create() failed");
1805 
1806 	rp = vmspace_mmap(&vm->vm_pmap, VM_MIN_USER_ADDRESS, USER_SIZE,
1807 			  PROT_READ|PROT_WRITE,
1808 			  MAP_FILE|MAP_SHARED|MAP_VPAGETABLE|MAP_FIXED,
1809 			  MemImageFd, 0);
1810 	if (rp == MAP_FAILED)
1811 		panic("vmspace_mmap: failed");
1812 	vmspace_mcontrol(&vm->vm_pmap, VM_MIN_USER_ADDRESS, USER_SIZE,
1813 			 MADV_NOSYNC, 0);
1814 	vpte = VM_PAGE_TO_PHYS(vmspace_pmap(vm)->pm_pdirm) | VPTE_RW | VPTE_V | VPTE_U;
1815 	r = vmspace_mcontrol(&vm->vm_pmap, VM_MIN_USER_ADDRESS, USER_SIZE,
1816 			     MADV_SETMAP, vpte);
1817 	if (r < 0)
1818 		panic("vmspace_mcontrol: failed");
1819 }
1820 
1821 void
1822 cpu_vmspace_free(struct vmspace *vm)
1823 {
1824 	/*
1825 	 * If VMM enable, don't do nothing, we
1826 	 * are able to use real page tables
1827 	 */
1828 	if (vmm_enabled)
1829 		return;
1830 
1831 	if (vmspace_destroy(&vm->vm_pmap) < 0)
1832 		panic("vmspace_destroy() failed");
1833 }
1834 
1835 /***************************************************
1836 * page management routines.
1837  ***************************************************/
1838 
1839 /*
1840  * free the pv_entry back to the free list.  This function may be
1841  * called from an interrupt.
1842  */
1843 static __inline void
1844 free_pv_entry(pv_entry_t pv)
1845 {
1846 	pv_entry_count--;
1847 	KKASSERT(pv_entry_count >= 0);
1848 	zfree(pvzone, pv);
1849 }
1850 
1851 /*
1852  * get a new pv_entry, allocating a block from the system
1853  * when needed.  This function may be called from an interrupt.
1854  */
1855 static pv_entry_t
1856 get_pv_entry(void)
1857 {
1858 	pv_entry_count++;
1859 	if (pv_entry_high_water &&
1860 		(pv_entry_count > pv_entry_high_water) &&
1861 		(pmap_pagedaemon_waken == 0)) {
1862 		pmap_pagedaemon_waken = 1;
1863 		wakeup(&vm_pages_needed);
1864 	}
1865 	return zalloc(pvzone);
1866 }
1867 
1868 /*
1869  * This routine is very drastic, but can save the system
1870  * in a pinch.
1871  *
1872  * No requirements.
1873  */
1874 void
1875 pmap_collect(void)
1876 {
1877 	int i;
1878 	vm_page_t m;
1879 	static int warningdone=0;
1880 
1881 	if (pmap_pagedaemon_waken == 0)
1882 		return;
1883 	lwkt_gettoken(&vm_token);
1884 	pmap_pagedaemon_waken = 0;
1885 
1886 	if (warningdone < 5) {
1887 		kprintf("pmap_collect: collecting pv entries -- "
1888 			"suggest increasing PMAP_SHPGPERPROC\n");
1889 		warningdone++;
1890 	}
1891 
1892 	for (i = 0; i < vm_page_array_size; i++) {
1893 		m = &vm_page_array[i];
1894 		if (m->wire_count || m->hold_count)
1895 			continue;
1896 		if (vm_page_busy_try(m, TRUE) == 0) {
1897 			if (m->wire_count == 0 && m->hold_count == 0) {
1898 				pmap_remove_all(m);
1899 			}
1900 			vm_page_wakeup(m);
1901 		}
1902 	}
1903 	lwkt_reltoken(&vm_token);
1904 }
1905 
1906 
1907 /*
1908  * If it is the first entry on the list, it is actually
1909  * in the header and we must copy the following entry up
1910  * to the header.  Otherwise we must search the list for
1911  * the entry.  In either case we free the now unused entry.
1912  *
1913  * caller must hold vm_token.
1914  */
1915 static int
1916 pmap_remove_entry(struct pmap *pmap, vm_page_t m, vm_offset_t va)
1917 {
1918 	pv_entry_t pv;
1919 	int rtval;
1920 
1921 	if (m->md.pv_list_count < pmap->pm_stats.resident_count) {
1922 		TAILQ_FOREACH(pv, &m->md.pv_list, pv_list) {
1923 			if (pmap == pv->pv_pmap && va == pv->pv_va)
1924 				break;
1925 		}
1926 	} else {
1927 		TAILQ_FOREACH(pv, &pmap->pm_pvlist, pv_plist) {
1928 			if (va == pv->pv_va)
1929 				break;
1930 		}
1931 	}
1932 
1933 	/*
1934 	 * Note that pv_ptem is NULL if the page table page itself is not
1935 	 * managed, even if the page being removed IS managed.
1936 	 */
1937 	rtval = 0;
1938 	/* JGXXX When can 'pv' be NULL? */
1939 	if (pv) {
1940 		TAILQ_REMOVE(&m->md.pv_list, pv, pv_list);
1941 		m->md.pv_list_count--;
1942 		atomic_add_int(&m->object->agg_pv_list_count, -1);
1943 		KKASSERT(m->md.pv_list_count >= 0);
1944 		if (TAILQ_EMPTY(&m->md.pv_list))
1945 			vm_page_flag_clear(m, PG_MAPPED | PG_WRITEABLE);
1946 		TAILQ_REMOVE(&pmap->pm_pvlist, pv, pv_plist);
1947 		++pmap->pm_generation;
1948 		KKASSERT(pmap->pm_pteobj != NULL);
1949 		vm_object_hold(pmap->pm_pteobj);
1950 		rtval = pmap_unuse_pt(pmap, va, pv->pv_ptem);
1951 		vm_object_drop(pmap->pm_pteobj);
1952 		free_pv_entry(pv);
1953 	}
1954 	return rtval;
1955 }
1956 
1957 /*
1958  * Create a pv entry for page at pa for (pmap, va).  If the page table page
1959  * holding the VA is managed, mpte will be non-NULL.
1960  */
1961 static void
1962 pmap_insert_entry(pmap_t pmap, vm_offset_t va, vm_page_t mpte, vm_page_t m)
1963 {
1964 	pv_entry_t pv;
1965 
1966 	crit_enter();
1967 	pv = get_pv_entry();
1968 	pv->pv_va = va;
1969 	pv->pv_pmap = pmap;
1970 	pv->pv_ptem = mpte;
1971 
1972 	TAILQ_INSERT_TAIL(&pmap->pm_pvlist, pv, pv_plist);
1973 	TAILQ_INSERT_TAIL(&m->md.pv_list, pv, pv_list);
1974 	m->md.pv_list_count++;
1975 	atomic_add_int(&m->object->agg_pv_list_count, 1);
1976 
1977 	crit_exit();
1978 }
1979 
1980 /*
1981  * pmap_remove_pte: do the things to unmap a page in a process
1982  */
1983 static int
1984 pmap_remove_pte(struct pmap *pmap, pt_entry_t *ptq, vm_offset_t va)
1985 {
1986 	pt_entry_t oldpte;
1987 	vm_page_t m;
1988 
1989 	oldpte = pmap_inval_loadandclear(ptq, pmap, va);
1990 	if (oldpte & VPTE_WIRED)
1991 		--pmap->pm_stats.wired_count;
1992 	KKASSERT(pmap->pm_stats.wired_count >= 0);
1993 
1994 #if 0
1995 	/*
1996 	 * Machines that don't support invlpg, also don't support
1997 	 * PG_G.  XXX PG_G is disabled for SMP so don't worry about
1998 	 * the SMP case.
1999 	 */
2000 	if (oldpte & PG_G)
2001 		cpu_invlpg((void *)va);
2002 #endif
2003 	KKASSERT(pmap->pm_stats.resident_count > 0);
2004 	--pmap->pm_stats.resident_count;
2005 	if (oldpte & VPTE_MANAGED) {
2006 		m = PHYS_TO_VM_PAGE(oldpte);
2007 		if (oldpte & VPTE_M) {
2008 #if defined(PMAP_DIAGNOSTIC)
2009 			if (pmap_nw_modified(oldpte)) {
2010 				kprintf("pmap_remove: modified page not "
2011 					"writable: va: 0x%lx, pte: 0x%lx\n",
2012 					va, oldpte);
2013 			}
2014 #endif
2015 			if (pmap_track_modified(pmap, va))
2016 				vm_page_dirty(m);
2017 		}
2018 		if (oldpte & VPTE_A)
2019 			vm_page_flag_set(m, PG_REFERENCED);
2020 		return pmap_remove_entry(pmap, m, va);
2021 	} else {
2022 		return pmap_unuse_pt(pmap, va, NULL);
2023 	}
2024 
2025 	return 0;
2026 }
2027 
2028 /*
2029  * pmap_remove_page:
2030  *
2031  *	Remove a single page from a process address space.
2032  *
2033  *	This function may not be called from an interrupt if the pmap is
2034  *	not kernel_pmap.
2035  */
2036 static void
2037 pmap_remove_page(struct pmap *pmap, vm_offset_t va)
2038 {
2039 	pt_entry_t *pte;
2040 
2041 	pte = pmap_pte(pmap, va);
2042 	if (pte == NULL)
2043 		return;
2044 	if ((*pte & VPTE_V) == 0)
2045 		return;
2046 	pmap_remove_pte(pmap, pte, va);
2047 }
2048 
2049 /*
2050  * Remove the given range of addresses from the specified map.
2051  *
2052  * It is assumed that the start and end are properly rounded to
2053  * the page size.
2054  *
2055  * This function may not be called from an interrupt if the pmap is
2056  * not kernel_pmap.
2057  *
2058  * No requirements.
2059  */
2060 void
2061 pmap_remove(struct pmap *pmap, vm_offset_t sva, vm_offset_t eva)
2062 {
2063 	vm_offset_t va_next;
2064 	pml4_entry_t *pml4e;
2065 	pdp_entry_t *pdpe;
2066 	pd_entry_t ptpaddr, *pde;
2067 	pt_entry_t *pte;
2068 
2069 	if (pmap == NULL)
2070 		return;
2071 
2072 	vm_object_hold(pmap->pm_pteobj);
2073 	lwkt_gettoken(&vm_token);
2074 	KKASSERT(pmap->pm_stats.resident_count >= 0);
2075 	if (pmap->pm_stats.resident_count == 0) {
2076 		lwkt_reltoken(&vm_token);
2077 		vm_object_drop(pmap->pm_pteobj);
2078 		return;
2079 	}
2080 
2081 	/*
2082 	 * special handling of removing one page.  a very
2083 	 * common operation and easy to short circuit some
2084 	 * code.
2085 	 */
2086 	if (sva + PAGE_SIZE == eva) {
2087 		pde = pmap_pde(pmap, sva);
2088 		if (pde && (*pde & VPTE_PS) == 0) {
2089 			pmap_remove_page(pmap, sva);
2090 			lwkt_reltoken(&vm_token);
2091 			vm_object_drop(pmap->pm_pteobj);
2092 			return;
2093 		}
2094 	}
2095 
2096 	for (; sva < eva; sva = va_next) {
2097 		pml4e = pmap_pml4e(pmap, sva);
2098 		if ((*pml4e & VPTE_V) == 0) {
2099 			va_next = (sva + NBPML4) & ~PML4MASK;
2100 			if (va_next < sva)
2101 				va_next = eva;
2102 			continue;
2103 		}
2104 
2105 		pdpe = pmap_pml4e_to_pdpe(pml4e, sva);
2106 		if ((*pdpe & VPTE_V) == 0) {
2107 			va_next = (sva + NBPDP) & ~PDPMASK;
2108 			if (va_next < sva)
2109 				va_next = eva;
2110 			continue;
2111 		}
2112 
2113 		/*
2114 		 * Calculate index for next page table.
2115 		 */
2116 		va_next = (sva + NBPDR) & ~PDRMASK;
2117 		if (va_next < sva)
2118 			va_next = eva;
2119 
2120 		pde = pmap_pdpe_to_pde(pdpe, sva);
2121 		ptpaddr = *pde;
2122 
2123 		/*
2124 		 * Weed out invalid mappings.
2125 		 */
2126 		if (ptpaddr == 0)
2127 			continue;
2128 
2129 		/*
2130 		 * Check for large page.
2131 		 */
2132 		if ((ptpaddr & VPTE_PS) != 0) {
2133 			/* JG FreeBSD has more complex treatment here */
2134 			KKASSERT(*pde != 0);
2135 			pmap_inval_pde(pde, pmap, sva);
2136 			pmap->pm_stats.resident_count -= NBPDR / PAGE_SIZE;
2137 			continue;
2138 		}
2139 
2140 		/*
2141 		 * Limit our scan to either the end of the va represented
2142 		 * by the current page table page, or to the end of the
2143 		 * range being removed.
2144 		 */
2145 		if (va_next > eva)
2146 			va_next = eva;
2147 
2148 		/*
2149 		 * NOTE: pmap_remove_pte() can block.
2150 		 */
2151 		for (pte = pmap_pde_to_pte(pde, sva); sva != va_next; pte++,
2152 		    sva += PAGE_SIZE) {
2153 			if (*pte == 0)
2154 				continue;
2155 			if (pmap_remove_pte(pmap, pte, sva))
2156 				break;
2157 		}
2158 	}
2159 	lwkt_reltoken(&vm_token);
2160 	vm_object_drop(pmap->pm_pteobj);
2161 }
2162 
2163 /*
2164  * Removes this physical page from all physical maps in which it resides.
2165  * Reflects back modify bits to the pager.
2166  *
2167  * This routine may not be called from an interrupt.
2168  *
2169  * No requirements.
2170  */
2171 static void
2172 pmap_remove_all(vm_page_t m)
2173 {
2174 	pt_entry_t *pte, tpte;
2175 	pv_entry_t pv;
2176 
2177 #if defined(PMAP_DIAGNOSTIC)
2178 	/*
2179 	 * XXX this makes pmap_page_protect(NONE) illegal for non-managed
2180 	 * pages!
2181 	 */
2182 	if (!pmap_initialized || (m->flags & PG_FICTITIOUS)) {
2183 		panic("pmap_page_protect: illegal for unmanaged page, va: 0x%08llx", (long long)VM_PAGE_TO_PHYS(m));
2184 	}
2185 #endif
2186 
2187 	lwkt_gettoken(&vm_token);
2188 	while ((pv = TAILQ_FIRST(&m->md.pv_list)) != NULL) {
2189 		KKASSERT(pv->pv_pmap->pm_stats.resident_count > 0);
2190 		--pv->pv_pmap->pm_stats.resident_count;
2191 
2192 		pte = pmap_pte(pv->pv_pmap, pv->pv_va);
2193 		KKASSERT(pte != NULL);
2194 
2195 		tpte = pmap_inval_loadandclear(pte, pv->pv_pmap, pv->pv_va);
2196 		if (tpte & VPTE_WIRED)
2197 			pv->pv_pmap->pm_stats.wired_count--;
2198 		KKASSERT(pv->pv_pmap->pm_stats.wired_count >= 0);
2199 
2200 		if (tpte & VPTE_A)
2201 			vm_page_flag_set(m, PG_REFERENCED);
2202 
2203 		/*
2204 		 * Update the vm_page_t clean and reference bits.
2205 		 */
2206 		if (tpte & VPTE_M) {
2207 #if defined(PMAP_DIAGNOSTIC)
2208 			if (pmap_nw_modified(tpte)) {
2209 				kprintf(
2210 	"pmap_remove_all: modified page not writable: va: 0x%lx, pte: 0x%lx\n",
2211 				    pv->pv_va, tpte);
2212 			}
2213 #endif
2214 			if (pmap_track_modified(pv->pv_pmap, pv->pv_va))
2215 				vm_page_dirty(m);
2216 		}
2217 		TAILQ_REMOVE(&m->md.pv_list, pv, pv_list);
2218 		TAILQ_REMOVE(&pv->pv_pmap->pm_pvlist, pv, pv_plist);
2219 		++pv->pv_pmap->pm_generation;
2220 		m->md.pv_list_count--;
2221 		atomic_add_int(&m->object->agg_pv_list_count, -1);
2222 		KKASSERT(m->md.pv_list_count >= 0);
2223 		if (TAILQ_EMPTY(&m->md.pv_list))
2224 			vm_page_flag_clear(m, PG_MAPPED | PG_WRITEABLE);
2225 		vm_object_hold(pv->pv_pmap->pm_pteobj);
2226 		pmap_unuse_pt(pv->pv_pmap, pv->pv_va, pv->pv_ptem);
2227 		vm_object_drop(pv->pv_pmap->pm_pteobj);
2228 		free_pv_entry(pv);
2229 	}
2230 	KKASSERT((m->flags & (PG_MAPPED|PG_WRITEABLE)) == 0);
2231 	lwkt_reltoken(&vm_token);
2232 }
2233 
2234 /*
2235  * Set the physical protection on the specified range of this map
2236  * as requested.
2237  *
2238  * This function may not be called from an interrupt if the map is
2239  * not the kernel_pmap.
2240  *
2241  * No requirements.
2242  */
2243 void
2244 pmap_protect(pmap_t pmap, vm_offset_t sva, vm_offset_t eva, vm_prot_t prot)
2245 {
2246 	vm_offset_t va_next;
2247 	pml4_entry_t *pml4e;
2248 	pdp_entry_t *pdpe;
2249 	pd_entry_t ptpaddr, *pde;
2250 	pt_entry_t *pte;
2251 
2252 	/* JG review for NX */
2253 
2254 	if (pmap == NULL)
2255 		return;
2256 
2257 	if ((prot & VM_PROT_READ) == VM_PROT_NONE) {
2258 		pmap_remove(pmap, sva, eva);
2259 		return;
2260 	}
2261 
2262 	if (prot & VM_PROT_WRITE)
2263 		return;
2264 
2265 	lwkt_gettoken(&vm_token);
2266 
2267 	for (; sva < eva; sva = va_next) {
2268 
2269 		pml4e = pmap_pml4e(pmap, sva);
2270 		if ((*pml4e & VPTE_V) == 0) {
2271 			va_next = (sva + NBPML4) & ~PML4MASK;
2272 			if (va_next < sva)
2273 				va_next = eva;
2274 			continue;
2275 		}
2276 
2277 		pdpe = pmap_pml4e_to_pdpe(pml4e, sva);
2278 		if ((*pdpe & VPTE_V) == 0) {
2279 			va_next = (sva + NBPDP) & ~PDPMASK;
2280 			if (va_next < sva)
2281 				va_next = eva;
2282 			continue;
2283 		}
2284 
2285 		va_next = (sva + NBPDR) & ~PDRMASK;
2286 		if (va_next < sva)
2287 			va_next = eva;
2288 
2289 		pde = pmap_pdpe_to_pde(pdpe, sva);
2290 		ptpaddr = *pde;
2291 
2292 		/*
2293 		 * Check for large page.
2294 		 */
2295 		if ((ptpaddr & VPTE_PS) != 0) {
2296 			/* JG correct? */
2297 			pmap_clean_pde(pde, pmap, sva);
2298 			pmap->pm_stats.resident_count -= NBPDR / PAGE_SIZE;
2299 			continue;
2300 		}
2301 
2302 		/*
2303 		 * Weed out invalid mappings. Note: we assume that the page
2304 		 * directory table is always allocated, and in kernel virtual.
2305 		 */
2306 		if (ptpaddr == 0)
2307 			continue;
2308 
2309 		if (va_next > eva)
2310 			va_next = eva;
2311 
2312 		for (pte = pmap_pde_to_pte(pde, sva); sva != va_next; pte++,
2313 		    sva += PAGE_SIZE) {
2314 			pt_entry_t pbits;
2315 			vm_page_t m;
2316 
2317 			/*
2318 			 * Clean managed pages and also check the accessed
2319 			 * bit.  Just remove write perms for unmanaged
2320 			 * pages.  Be careful of races, turning off write
2321 			 * access will force a fault rather then setting
2322 			 * the modified bit at an unexpected time.
2323 			 */
2324 			if (*pte & VPTE_MANAGED) {
2325 				pbits = pmap_clean_pte(pte, pmap, sva);
2326 				m = NULL;
2327 				if (pbits & VPTE_A) {
2328 					m = PHYS_TO_VM_PAGE(pbits & VPTE_FRAME);
2329 					vm_page_flag_set(m, PG_REFERENCED);
2330 					atomic_clear_long(pte, VPTE_A);
2331 				}
2332 				if (pbits & VPTE_M) {
2333 					if (pmap_track_modified(pmap, sva)) {
2334 						if (m == NULL)
2335 							m = PHYS_TO_VM_PAGE(pbits & VPTE_FRAME);
2336 						vm_page_dirty(m);
2337 					}
2338 				}
2339 			} else {
2340 				pbits = pmap_setro_pte(pte, pmap, sva);
2341 			}
2342 		}
2343 	}
2344 	lwkt_reltoken(&vm_token);
2345 }
2346 
2347 /*
2348  * Enter a managed page into a pmap.  If the page is not wired related pmap
2349  * data can be destroyed at any time for later demand-operation.
2350  *
2351  * Insert the vm_page (m) at virtual address (v) in (pmap), with the
2352  * specified protection, and wire the mapping if requested.
2353  *
2354  * NOTE: This routine may not lazy-evaluate or lose information.  The
2355  * page must actually be inserted into the given map NOW.
2356  *
2357  * NOTE: When entering a page at a KVA address, the pmap must be the
2358  * kernel_pmap.
2359  *
2360  * No requirements.
2361  */
2362 void
2363 pmap_enter(pmap_t pmap, vm_offset_t va, vm_page_t m, vm_prot_t prot,
2364 	   boolean_t wired, vm_map_entry_t entry __unused)
2365 {
2366 	vm_paddr_t pa;
2367 	pd_entry_t *pde;
2368 	pt_entry_t *pte;
2369 	vm_paddr_t opa;
2370 	pt_entry_t origpte, newpte;
2371 	vm_page_t mpte;
2372 
2373 	if (pmap == NULL)
2374 		return;
2375 
2376 	va = trunc_page(va);
2377 
2378 	vm_object_hold(pmap->pm_pteobj);
2379 	lwkt_gettoken(&vm_token);
2380 
2381 	/*
2382 	 * Get the page table page.   The kernel_pmap's page table pages
2383 	 * are preallocated and have no associated vm_page_t.
2384 	 */
2385 	if (pmap == &kernel_pmap)
2386 		mpte = NULL;
2387 	else
2388 		mpte = pmap_allocpte(pmap, va);
2389 
2390 	pde = pmap_pde(pmap, va);
2391 	if (pde != NULL && (*pde & VPTE_V) != 0) {
2392 		if ((*pde & VPTE_PS) != 0)
2393 			panic("pmap_enter: attempted pmap_enter on 2MB page");
2394 		pte = pmap_pde_to_pte(pde, va);
2395 	} else {
2396 		panic("pmap_enter: invalid page directory va=%#lx", va);
2397 	}
2398 
2399 	KKASSERT(pte != NULL);
2400 	/*
2401 	 * Deal with races on the original mapping (though don't worry
2402 	 * about VPTE_A races) by cleaning it.  This will force a fault
2403 	 * if an attempt is made to write to the page.
2404 	 */
2405 	pa = VM_PAGE_TO_PHYS(m);
2406 	origpte = pmap_clean_pte(pte, pmap, va);
2407 	opa = origpte & VPTE_FRAME;
2408 
2409 	if (origpte & VPTE_PS)
2410 		panic("pmap_enter: attempted pmap_enter on 2MB page");
2411 
2412 	/*
2413 	 * Mapping has not changed, must be protection or wiring change.
2414 	 */
2415 	if (origpte && (opa == pa)) {
2416 		/*
2417 		 * Wiring change, just update stats. We don't worry about
2418 		 * wiring PT pages as they remain resident as long as there
2419 		 * are valid mappings in them. Hence, if a user page is wired,
2420 		 * the PT page will be also.
2421 		 */
2422 		if (wired && ((origpte & VPTE_WIRED) == 0))
2423 			++pmap->pm_stats.wired_count;
2424 		else if (!wired && (origpte & VPTE_WIRED))
2425 			--pmap->pm_stats.wired_count;
2426 
2427 		/*
2428 		 * Remove the extra pte reference.  Note that we cannot
2429 		 * optimize the RO->RW case because we have adjusted the
2430 		 * wiring count above and may need to adjust the wiring
2431 		 * bits below.
2432 		 */
2433 		if (mpte)
2434 			mpte->hold_count--;
2435 
2436 		/*
2437 		 * We might be turning off write access to the page,
2438 		 * so we go ahead and sense modify status.
2439 		 */
2440 		if (origpte & VPTE_MANAGED) {
2441 			if ((origpte & VPTE_M) &&
2442 			    pmap_track_modified(pmap, va)) {
2443 				vm_page_t om;
2444 				om = PHYS_TO_VM_PAGE(opa);
2445 				vm_page_dirty(om);
2446 			}
2447 			pa |= VPTE_MANAGED;
2448 			KKASSERT(m->flags & PG_MAPPED);
2449 		}
2450 		goto validate;
2451 	}
2452 	/*
2453 	 * Mapping has changed, invalidate old range and fall through to
2454 	 * handle validating new mapping.
2455 	 */
2456 	if (opa) {
2457 		int err;
2458 		err = pmap_remove_pte(pmap, pte, va);
2459 		if (err)
2460 			panic("pmap_enter: pte vanished, va: 0x%lx", va);
2461 	}
2462 
2463 	/*
2464 	 * Enter on the PV list if part of our managed memory. Note that we
2465 	 * raise IPL while manipulating pv_table since pmap_enter can be
2466 	 * called at interrupt time.
2467 	 */
2468 	if (pmap_initialized &&
2469 	    (m->flags & (PG_FICTITIOUS|PG_UNMANAGED)) == 0) {
2470 		pmap_insert_entry(pmap, va, mpte, m);
2471 		pa |= VPTE_MANAGED;
2472 		vm_page_flag_set(m, PG_MAPPED);
2473 	}
2474 
2475 	/*
2476 	 * Increment counters
2477 	 */
2478 	++pmap->pm_stats.resident_count;
2479 	if (wired)
2480 		pmap->pm_stats.wired_count++;
2481 
2482 validate:
2483 	/*
2484 	 * Now validate mapping with desired protection/wiring.
2485 	 */
2486 	newpte = (pt_entry_t) (pa | pte_prot(pmap, prot) | VPTE_V | VPTE_U);
2487 
2488 	if (wired)
2489 		newpte |= VPTE_WIRED;
2490 //	if (pmap != &kernel_pmap)
2491 		newpte |= VPTE_U;
2492 
2493 	/*
2494 	 * If the mapping or permission bits are different from the
2495 	 * (now cleaned) original pte, an update is needed.  We've
2496 	 * already downgraded or invalidated the page so all we have
2497 	 * to do now is update the bits.
2498 	 *
2499 	 * XXX should we synchronize RO->RW changes to avoid another
2500 	 * fault?
2501 	 */
2502 	if ((origpte & ~(VPTE_RW|VPTE_M|VPTE_A)) != newpte) {
2503 		*pte = newpte | VPTE_A;
2504 		if (newpte & VPTE_RW)
2505 			vm_page_flag_set(m, PG_WRITEABLE);
2506 	}
2507 	KKASSERT((newpte & VPTE_MANAGED) == 0 || (m->flags & PG_MAPPED));
2508 	lwkt_reltoken(&vm_token);
2509 	vm_object_drop(pmap->pm_pteobj);
2510 }
2511 
2512 /*
2513  * This code works like pmap_enter() but assumes VM_PROT_READ and not-wired.
2514  *
2515  * Currently this routine may only be used on user pmaps, not kernel_pmap.
2516  *
2517  * No requirements.
2518  */
2519 void
2520 pmap_enter_quick(pmap_t pmap, vm_offset_t va, vm_page_t m)
2521 {
2522 	pt_entry_t *pte;
2523 	vm_paddr_t pa;
2524 	vm_page_t mpte;
2525 	vm_pindex_t ptepindex;
2526 	pd_entry_t *ptepa;
2527 
2528 	KKASSERT(pmap != &kernel_pmap);
2529 
2530 	KKASSERT(va >= VM_MIN_USER_ADDRESS && va < VM_MAX_USER_ADDRESS);
2531 
2532 	/*
2533 	 * Calculate pagetable page index
2534 	 */
2535 	ptepindex = pmap_pde_pindex(va);
2536 
2537 	vm_object_hold(pmap->pm_pteobj);
2538 	lwkt_gettoken(&vm_token);
2539 
2540 	do {
2541 		/*
2542 		 * Get the page directory entry
2543 		 */
2544 		ptepa = pmap_pde(pmap, va);
2545 
2546 		/*
2547 		 * If the page table page is mapped, we just increment
2548 		 * the hold count, and activate it.
2549 		 */
2550 		if (ptepa && (*ptepa & VPTE_V) != 0) {
2551 			if (*ptepa & VPTE_PS)
2552 				panic("pmap_enter_quick: unexpected mapping into 2MB page");
2553 			if (pmap->pm_ptphint &&
2554 			    (pmap->pm_ptphint->pindex == ptepindex)) {
2555 				mpte = pmap->pm_ptphint;
2556 			} else {
2557 				mpte = pmap_page_lookup( pmap->pm_pteobj, ptepindex);
2558 				pmap->pm_ptphint = mpte;
2559 				vm_page_wakeup(mpte);
2560 			}
2561 			if (mpte)
2562 				mpte->hold_count++;
2563 		} else {
2564 			mpte = _pmap_allocpte(pmap, ptepindex);
2565 		}
2566 	} while (mpte == NULL);
2567 
2568 	/*
2569 	 * Ok, now that the page table page has been validated, get the pte.
2570 	 * If the pte is already mapped undo mpte's hold_count and
2571 	 * just return.
2572 	 */
2573 	pte = pmap_pte(pmap, va);
2574 	if (*pte & VPTE_V) {
2575 		KKASSERT(mpte != NULL);
2576 		pmap_unwire_pte_hold(pmap, va, mpte);
2577 		pa = VM_PAGE_TO_PHYS(m);
2578 		KKASSERT(((*pte ^ pa) & VPTE_FRAME) == 0);
2579 		lwkt_reltoken(&vm_token);
2580 		vm_object_drop(pmap->pm_pteobj);
2581 		return;
2582 	}
2583 
2584 	/*
2585 	 * Enter on the PV list if part of our managed memory
2586 	 */
2587 	if ((m->flags & (PG_FICTITIOUS|PG_UNMANAGED)) == 0) {
2588 		pmap_insert_entry(pmap, va, mpte, m);
2589 		vm_page_flag_set(m, PG_MAPPED);
2590 	}
2591 
2592 	/*
2593 	 * Increment counters
2594 	 */
2595 	++pmap->pm_stats.resident_count;
2596 
2597 	pa = VM_PAGE_TO_PHYS(m);
2598 
2599 	/*
2600 	 * Now validate mapping with RO protection
2601 	 */
2602 	if (m->flags & (PG_FICTITIOUS|PG_UNMANAGED))
2603 		*pte = (vpte_t)pa | VPTE_V | VPTE_U;
2604 	else
2605 		*pte = (vpte_t)pa | VPTE_V | VPTE_U | VPTE_MANAGED;
2606 	/*pmap_inval_add(&info, pmap, va); shouldn't be needed 0->valid */
2607 	/*pmap_inval_flush(&info); don't need for vkernel */
2608 	lwkt_reltoken(&vm_token);
2609 	vm_object_drop(pmap->pm_pteobj);
2610 }
2611 
2612 /*
2613  * Make a temporary mapping for a physical address.  This is only intended
2614  * to be used for panic dumps.
2615  *
2616  * The caller is responsible for calling smp_invltlb().
2617  */
2618 void *
2619 pmap_kenter_temporary(vm_paddr_t pa, long i)
2620 {
2621 	pmap_kenter_quick(crashdumpmap + (i * PAGE_SIZE), pa);
2622 	return ((void *)crashdumpmap);
2623 }
2624 
2625 #define MAX_INIT_PT (96)
2626 
2627 /*
2628  * This routine preloads the ptes for a given object into the specified pmap.
2629  * This eliminates the blast of soft faults on process startup and
2630  * immediately after an mmap.
2631  *
2632  * No requirements.
2633  */
2634 static int pmap_object_init_pt_callback(vm_page_t p, void *data);
2635 
2636 void
2637 pmap_object_init_pt(pmap_t pmap, vm_offset_t addr, vm_prot_t prot,
2638 		    vm_object_t object, vm_pindex_t pindex,
2639 		    vm_size_t size, int limit)
2640 {
2641 	struct rb_vm_page_scan_info info;
2642 	struct lwp *lp;
2643 	vm_size_t psize;
2644 
2645 	/*
2646 	 * We can't preinit if read access isn't set or there is no pmap
2647 	 * or object.
2648 	 */
2649 	if ((prot & VM_PROT_READ) == 0 || pmap == NULL || object == NULL)
2650 		return;
2651 
2652 	/*
2653 	 * We can't preinit if the pmap is not the current pmap
2654 	 */
2655 	lp = curthread->td_lwp;
2656 	if (lp == NULL || pmap != vmspace_pmap(lp->lwp_vmspace))
2657 		return;
2658 
2659 	psize = x86_64_btop(size);
2660 
2661 	if ((object->type != OBJT_VNODE) ||
2662 		((limit & MAP_PREFAULT_PARTIAL) && (psize > MAX_INIT_PT) &&
2663 			(object->resident_page_count > MAX_INIT_PT))) {
2664 		return;
2665 	}
2666 
2667 	if (psize + pindex > object->size) {
2668 		if (object->size < pindex)
2669 			return;
2670 		psize = object->size - pindex;
2671 	}
2672 
2673 	if (psize == 0)
2674 		return;
2675 
2676 	/*
2677 	 * Use a red-black scan to traverse the requested range and load
2678 	 * any valid pages found into the pmap.
2679 	 *
2680 	 * We cannot safely scan the object's memq unless we are in a
2681 	 * critical section since interrupts can remove pages from objects.
2682 	 */
2683 	info.start_pindex = pindex;
2684 	info.end_pindex = pindex + psize - 1;
2685 	info.limit = limit;
2686 	info.mpte = NULL;
2687 	info.addr = addr;
2688 	info.pmap = pmap;
2689 
2690 	vm_object_hold_shared(object);
2691 	vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
2692 				pmap_object_init_pt_callback, &info);
2693 	vm_object_drop(object);
2694 }
2695 
2696 static
2697 int
2698 pmap_object_init_pt_callback(vm_page_t p, void *data)
2699 {
2700 	struct rb_vm_page_scan_info *info = data;
2701 	vm_pindex_t rel_index;
2702 	/*
2703 	 * don't allow an madvise to blow away our really
2704 	 * free pages allocating pv entries.
2705 	 */
2706 	if ((info->limit & MAP_PREFAULT_MADVISE) &&
2707 		vmstats.v_free_count < vmstats.v_free_reserved) {
2708 		    return(-1);
2709 	}
2710 
2711 	/*
2712 	 * Ignore list markers and ignore pages we cannot instantly
2713 	 * busy (while holding the object token).
2714 	 */
2715 	if (p->flags & PG_MARKER)
2716 		return 0;
2717 	if (vm_page_busy_try(p, TRUE))
2718 		return 0;
2719 	if (((p->valid & VM_PAGE_BITS_ALL) == VM_PAGE_BITS_ALL) &&
2720 	    (p->flags & PG_FICTITIOUS) == 0) {
2721 		if ((p->queue - p->pc) == PQ_CACHE)
2722 			vm_page_deactivate(p);
2723 		rel_index = p->pindex - info->start_pindex;
2724 		pmap_enter_quick(info->pmap,
2725 				 info->addr + x86_64_ptob(rel_index), p);
2726 	}
2727 	vm_page_wakeup(p);
2728 	return(0);
2729 }
2730 
2731 /*
2732  * Return TRUE if the pmap is in shape to trivially
2733  * pre-fault the specified address.
2734  *
2735  * Returns FALSE if it would be non-trivial or if a
2736  * pte is already loaded into the slot.
2737  *
2738  * No requirements.
2739  */
2740 int
2741 pmap_prefault_ok(pmap_t pmap, vm_offset_t addr)
2742 {
2743 	pt_entry_t *pte;
2744 	pd_entry_t *pde;
2745 	int ret;
2746 
2747 	lwkt_gettoken(&vm_token);
2748 	pde = pmap_pde(pmap, addr);
2749 	if (pde == NULL || *pde == 0) {
2750 		ret = 0;
2751 	} else {
2752 		pte = pmap_pde_to_pte(pde, addr);
2753 		ret = (*pte) ? 0 : 1;
2754 	}
2755 	lwkt_reltoken(&vm_token);
2756 	return (ret);
2757 }
2758 
2759 /*
2760  * Change the wiring attribute for a map/virtual-address pair.
2761  *
2762  * The mapping must already exist in the pmap.
2763  * No other requirements.
2764  */
2765 void
2766 pmap_change_wiring(pmap_t pmap, vm_offset_t va, boolean_t wired,
2767 		   vm_map_entry_t entry __unused)
2768 {
2769 	pt_entry_t *pte;
2770 
2771 	if (pmap == NULL)
2772 		return;
2773 
2774 	lwkt_gettoken(&vm_token);
2775 	pte = pmap_pte(pmap, va);
2776 
2777 	if (wired && !pmap_pte_w(pte))
2778 		pmap->pm_stats.wired_count++;
2779 	else if (!wired && pmap_pte_w(pte))
2780 		pmap->pm_stats.wired_count--;
2781 
2782 	/*
2783 	 * Wiring is not a hardware characteristic so there is no need to
2784 	 * invalidate TLB.  However, in an SMP environment we must use
2785 	 * a locked bus cycle to update the pte (if we are not using
2786 	 * the pmap_inval_*() API that is)... it's ok to do this for simple
2787 	 * wiring changes.
2788 	 */
2789 	if (wired)
2790 		atomic_set_long(pte, VPTE_WIRED);
2791 	else
2792 		atomic_clear_long(pte, VPTE_WIRED);
2793 	lwkt_reltoken(&vm_token);
2794 }
2795 
2796 /*
2797  *	Copy the range specified by src_addr/len
2798  *	from the source map to the range dst_addr/len
2799  *	in the destination map.
2800  *
2801  *	This routine is only advisory and need not do anything.
2802  */
2803 void
2804 pmap_copy(pmap_t dst_pmap, pmap_t src_pmap, vm_offset_t dst_addr,
2805 	vm_size_t len, vm_offset_t src_addr)
2806 {
2807 	/*
2808 	 * XXX BUGGY.  Amoung other things srcmpte is assumed to remain
2809 	 * valid through blocking calls, and that's just not going to
2810 	 * be the case.
2811 	 *
2812 	 * FIXME!
2813 	 */
2814 	return;
2815 }
2816 
2817 /*
2818  * pmap_zero_page:
2819  *
2820  *	Zero the specified physical page.
2821  *
2822  *	This function may be called from an interrupt and no locking is
2823  *	required.
2824  */
2825 void
2826 pmap_zero_page(vm_paddr_t phys)
2827 {
2828 	vm_offset_t va = PHYS_TO_DMAP(phys);
2829 
2830 	bzero((void *)va, PAGE_SIZE);
2831 }
2832 
2833 /*
2834  * pmap_zero_page:
2835  *
2836  *	Zero part of a physical page by mapping it into memory and clearing
2837  *	its contents with bzero.
2838  *
2839  *	off and size may not cover an area beyond a single hardware page.
2840  */
2841 void
2842 pmap_zero_page_area(vm_paddr_t phys, int off, int size)
2843 {
2844 	crit_enter();
2845 	vm_offset_t virt = PHYS_TO_DMAP(phys);
2846 	bzero((char *)virt + off, size);
2847 	crit_exit();
2848 }
2849 
2850 /*
2851  * pmap_copy_page:
2852  *
2853  *	Copy the physical page from the source PA to the target PA.
2854  *	This function may be called from an interrupt.  No locking
2855  *	is required.
2856  */
2857 void
2858 pmap_copy_page(vm_paddr_t src, vm_paddr_t dst)
2859 {
2860 	vm_offset_t src_virt, dst_virt;
2861 
2862 	crit_enter();
2863 	src_virt = PHYS_TO_DMAP(src);
2864 	dst_virt = PHYS_TO_DMAP(dst);
2865 	bcopy((void *)src_virt, (void *)dst_virt, PAGE_SIZE);
2866 	crit_exit();
2867 }
2868 
2869 /*
2870  * pmap_copy_page_frag:
2871  *
2872  *	Copy the physical page from the source PA to the target PA.
2873  *	This function may be called from an interrupt.  No locking
2874  *	is required.
2875  */
2876 void
2877 pmap_copy_page_frag(vm_paddr_t src, vm_paddr_t dst, size_t bytes)
2878 {
2879 	vm_offset_t src_virt, dst_virt;
2880 
2881 	crit_enter();
2882 	src_virt = PHYS_TO_DMAP(src);
2883 	dst_virt = PHYS_TO_DMAP(dst);
2884 	bcopy((char *)src_virt + (src & PAGE_MASK),
2885 	      (char *)dst_virt + (dst & PAGE_MASK),
2886 	      bytes);
2887 	crit_exit();
2888 }
2889 
2890 /*
2891  * Returns true if the pmap's pv is one of the first 16 pvs linked to
2892  * from this page.  This count may be changed upwards or downwards
2893  * in the future; it is only necessary that true be returned for a small
2894  * subset of pmaps for proper page aging.
2895  *
2896  * No other requirements.
2897  */
2898 boolean_t
2899 pmap_page_exists_quick(pmap_t pmap, vm_page_t m)
2900 {
2901 	pv_entry_t pv;
2902 	int loops = 0;
2903 
2904 	if (!pmap_initialized || (m->flags & PG_FICTITIOUS))
2905 		return FALSE;
2906 
2907 	crit_enter();
2908 	lwkt_gettoken(&vm_token);
2909 
2910 	TAILQ_FOREACH(pv, &m->md.pv_list, pv_list) {
2911 		if (pv->pv_pmap == pmap) {
2912 			lwkt_reltoken(&vm_token);
2913 			crit_exit();
2914 			return TRUE;
2915 		}
2916 		loops++;
2917 		if (loops >= 16)
2918 			break;
2919 	}
2920 	lwkt_reltoken(&vm_token);
2921 	crit_exit();
2922 	return (FALSE);
2923 }
2924 
2925 /*
2926  * Remove all pages from specified address space this aids process
2927  * exit speeds.  Also, this code is special cased for current
2928  * process only, but can have the more generic (and slightly slower)
2929  * mode enabled.  This is much faster than pmap_remove in the case
2930  * of running down an entire address space.
2931  *
2932  * No other requirements.
2933  */
2934 void
2935 pmap_remove_pages(pmap_t pmap, vm_offset_t sva, vm_offset_t eva)
2936 {
2937 	pt_entry_t *pte, tpte;
2938 	pv_entry_t pv, npv;
2939 	vm_page_t m;
2940 	int save_generation;
2941 
2942 	if (pmap->pm_pteobj)
2943 		vm_object_hold(pmap->pm_pteobj);
2944 	lwkt_gettoken(&vm_token);
2945 
2946 	for (pv = TAILQ_FIRST(&pmap->pm_pvlist); pv; pv = npv) {
2947 		if (pv->pv_va >= eva || pv->pv_va < sva) {
2948 			npv = TAILQ_NEXT(pv, pv_plist);
2949 			continue;
2950 		}
2951 
2952 		KKASSERT(pmap == pv->pv_pmap);
2953 
2954 		pte = pmap_pte(pmap, pv->pv_va);
2955 
2956 		/*
2957 		 * We cannot remove wired pages from a process' mapping
2958 		 * at this time
2959 		 */
2960 		if (*pte & VPTE_WIRED) {
2961 			npv = TAILQ_NEXT(pv, pv_plist);
2962 			continue;
2963 		}
2964 		tpte = pmap_inval_loadandclear(pte, pmap, pv->pv_va);
2965 
2966 		m = PHYS_TO_VM_PAGE(tpte & VPTE_FRAME);
2967 
2968 		KASSERT(m < &vm_page_array[vm_page_array_size],
2969 			("pmap_remove_pages: bad tpte %lx", tpte));
2970 
2971 		KKASSERT(pmap->pm_stats.resident_count > 0);
2972 		--pmap->pm_stats.resident_count;
2973 
2974 		/*
2975 		 * Update the vm_page_t clean and reference bits.
2976 		 */
2977 		if (tpte & VPTE_M) {
2978 			vm_page_dirty(m);
2979 		}
2980 
2981 		npv = TAILQ_NEXT(pv, pv_plist);
2982 		TAILQ_REMOVE(&pmap->pm_pvlist, pv, pv_plist);
2983 		save_generation = ++pmap->pm_generation;
2984 
2985 		m->md.pv_list_count--;
2986 		atomic_add_int(&m->object->agg_pv_list_count, -1);
2987 		TAILQ_REMOVE(&m->md.pv_list, pv, pv_list);
2988 		if (TAILQ_EMPTY(&m->md.pv_list))
2989 			vm_page_flag_clear(m, PG_MAPPED | PG_WRITEABLE);
2990 
2991 		pmap_unuse_pt(pmap, pv->pv_va, pv->pv_ptem);
2992 		free_pv_entry(pv);
2993 
2994 		/*
2995 		 * Restart the scan if we blocked during the unuse or free
2996 		 * calls and other removals were made.
2997 		 */
2998 		if (save_generation != pmap->pm_generation) {
2999 			kprintf("Warning: pmap_remove_pages race-A avoided\n");
3000 			npv = TAILQ_FIRST(&pmap->pm_pvlist);
3001 		}
3002 	}
3003 	lwkt_reltoken(&vm_token);
3004 	if (pmap->pm_pteobj)
3005 		vm_object_drop(pmap->pm_pteobj);
3006 }
3007 
3008 /*
3009  * pmap_testbit tests bits in active mappings of a VM page.
3010  */
3011 static boolean_t
3012 pmap_testbit(vm_page_t m, int bit)
3013 {
3014 	pv_entry_t pv;
3015 	pt_entry_t *pte;
3016 
3017 	if (!pmap_initialized || (m->flags & PG_FICTITIOUS))
3018 		return FALSE;
3019 
3020 	if (TAILQ_FIRST(&m->md.pv_list) == NULL)
3021 		return FALSE;
3022 
3023 	crit_enter();
3024 
3025 	TAILQ_FOREACH(pv, &m->md.pv_list, pv_list) {
3026 		/*
3027 		 * if the bit being tested is the modified bit, then
3028 		 * mark clean_map and ptes as never
3029 		 * modified.
3030 		 */
3031 		if (bit & (VPTE_A|VPTE_M)) {
3032 			if (!pmap_track_modified(pv->pv_pmap, pv->pv_va))
3033 				continue;
3034 		}
3035 
3036 #if defined(PMAP_DIAGNOSTIC)
3037 		if (pv->pv_pmap == NULL) {
3038 			kprintf("Null pmap (tb) at va: 0x%lx\n", pv->pv_va);
3039 			continue;
3040 		}
3041 #endif
3042 		pte = pmap_pte(pv->pv_pmap, pv->pv_va);
3043 		if (*pte & bit) {
3044 			crit_exit();
3045 			return TRUE;
3046 		}
3047 	}
3048 	crit_exit();
3049 	return (FALSE);
3050 }
3051 
3052 /*
3053  * This routine is used to clear bits in ptes.  Certain bits require special
3054  * handling, in particular (on virtual kernels) the VPTE_M (modify) bit.
3055  *
3056  * This routine is only called with certain VPTE_* bit combinations.
3057  */
3058 static __inline void
3059 pmap_clearbit(vm_page_t m, int bit)
3060 {
3061 	pv_entry_t pv;
3062 	pt_entry_t *pte;
3063 	pt_entry_t pbits;
3064 
3065 	if (!pmap_initialized || (m->flags & PG_FICTITIOUS))
3066 		return;
3067 
3068 	crit_enter();
3069 
3070 	/*
3071 	 * Loop over all current mappings setting/clearing as appropos If
3072 	 * setting RO do we need to clear the VAC?
3073 	 */
3074 	TAILQ_FOREACH(pv, &m->md.pv_list, pv_list) {
3075 		/*
3076 		 * don't write protect pager mappings
3077 		 */
3078 		if (bit == VPTE_RW) {
3079 			if (!pmap_track_modified(pv->pv_pmap, pv->pv_va))
3080 				continue;
3081 		}
3082 
3083 #if defined(PMAP_DIAGNOSTIC)
3084 		if (pv->pv_pmap == NULL) {
3085 			kprintf("Null pmap (cb) at va: 0x%lx\n", pv->pv_va);
3086 			continue;
3087 		}
3088 #endif
3089 
3090 		/*
3091 		 * Careful here.  We can use a locked bus instruction to
3092 		 * clear VPTE_A or VPTE_M safely but we need to synchronize
3093 		 * with the target cpus when we mess with VPTE_RW.
3094 		 *
3095 		 * On virtual kernels we must force a new fault-on-write
3096 		 * in the real kernel if we clear the Modify bit ourselves,
3097 		 * otherwise the real kernel will not get a new fault and
3098 		 * will never set our Modify bit again.
3099 		 */
3100 		pte = pmap_pte(pv->pv_pmap, pv->pv_va);
3101 		if (*pte & bit) {
3102 			if (bit == VPTE_RW) {
3103 				/*
3104 				 * We must also clear VPTE_M when clearing
3105 				 * VPTE_RW
3106 				 */
3107 				pbits = pmap_clean_pte(pte, pv->pv_pmap,
3108 						       pv->pv_va);
3109 				if (pbits & VPTE_M)
3110 					vm_page_dirty(m);
3111 			} else if (bit == VPTE_M) {
3112 				/*
3113 				 * We do not have to make the page read-only
3114 				 * when clearing the Modify bit.  The real
3115 				 * kernel will make the real PTE read-only
3116 				 * or otherwise detect the write and set
3117 				 * our VPTE_M again simply by us invalidating
3118 				 * the real kernel VA for the pmap (as we did
3119 				 * above).  This allows the real kernel to
3120 				 * handle the write fault without forwarding
3121 				 * the fault to us.
3122 				 */
3123 				atomic_clear_long(pte, VPTE_M);
3124 			} else if ((bit & (VPTE_RW|VPTE_M)) == (VPTE_RW|VPTE_M)) {
3125 				/*
3126 				 * We've been asked to clear W & M, I guess
3127 				 * the caller doesn't want us to update
3128 				 * the dirty status of the VM page.
3129 				 */
3130 				pmap_clean_pte(pte, pv->pv_pmap, pv->pv_va);
3131 			} else {
3132 				/*
3133 				 * We've been asked to clear bits that do
3134 				 * not interact with hardware.
3135 				 */
3136 				atomic_clear_long(pte, bit);
3137 			}
3138 		}
3139 	}
3140 	crit_exit();
3141 }
3142 
3143 /*
3144  * Lower the permission for all mappings to a given page.
3145  *
3146  * No other requirements.
3147  */
3148 void
3149 pmap_page_protect(vm_page_t m, vm_prot_t prot)
3150 {
3151 	/* JG NX support? */
3152 	if ((prot & VM_PROT_WRITE) == 0) {
3153 		lwkt_gettoken(&vm_token);
3154 		if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
3155 			pmap_clearbit(m, VPTE_RW);
3156 			vm_page_flag_clear(m, PG_WRITEABLE);
3157 		} else {
3158 			pmap_remove_all(m);
3159 		}
3160 		lwkt_reltoken(&vm_token);
3161 	}
3162 }
3163 
3164 vm_paddr_t
3165 pmap_phys_address(vm_pindex_t ppn)
3166 {
3167 	return (x86_64_ptob(ppn));
3168 }
3169 
3170 /*
3171  * Return a count of reference bits for a page, clearing those bits.
3172  * It is not necessary for every reference bit to be cleared, but it
3173  * is necessary that 0 only be returned when there are truly no
3174  * reference bits set.
3175  *
3176  * XXX: The exact number of bits to check and clear is a matter that
3177  * should be tested and standardized at some point in the future for
3178  * optimal aging of shared pages.
3179  *
3180  * No other requirements.
3181  */
3182 int
3183 pmap_ts_referenced(vm_page_t m)
3184 {
3185 	pv_entry_t pv, pvf, pvn;
3186 	pt_entry_t *pte;
3187 	int rtval = 0;
3188 
3189 	if (!pmap_initialized || (m->flags & PG_FICTITIOUS))
3190 		return (rtval);
3191 
3192 	crit_enter();
3193 	lwkt_gettoken(&vm_token);
3194 
3195 	if ((pv = TAILQ_FIRST(&m->md.pv_list)) != NULL) {
3196 
3197 		pvf = pv;
3198 
3199 		do {
3200 			pvn = TAILQ_NEXT(pv, pv_list);
3201 
3202 			TAILQ_REMOVE(&m->md.pv_list, pv, pv_list);
3203 
3204 			TAILQ_INSERT_TAIL(&m->md.pv_list, pv, pv_list);
3205 
3206 			if (!pmap_track_modified(pv->pv_pmap, pv->pv_va))
3207 				continue;
3208 
3209 			pte = pmap_pte(pv->pv_pmap, pv->pv_va);
3210 
3211 			if (pte && (*pte & VPTE_A)) {
3212 				atomic_clear_long(pte, VPTE_A);
3213 				rtval++;
3214 				if (rtval > 4) {
3215 					break;
3216 				}
3217 			}
3218 		} while ((pv = pvn) != NULL && pv != pvf);
3219 	}
3220 	lwkt_reltoken(&vm_token);
3221 	crit_exit();
3222 
3223 	return (rtval);
3224 }
3225 
3226 /*
3227  * Return whether or not the specified physical page was modified
3228  * in any physical maps.
3229  *
3230  * No other requirements.
3231  */
3232 boolean_t
3233 pmap_is_modified(vm_page_t m)
3234 {
3235 	boolean_t res;
3236 
3237 	lwkt_gettoken(&vm_token);
3238 	res = pmap_testbit(m, VPTE_M);
3239 	lwkt_reltoken(&vm_token);
3240 	return (res);
3241 }
3242 
3243 /*
3244  * Clear the modify bits on the specified physical page.
3245  *
3246  * No other requirements.
3247  */
3248 void
3249 pmap_clear_modify(vm_page_t m)
3250 {
3251 	lwkt_gettoken(&vm_token);
3252 	pmap_clearbit(m, VPTE_M);
3253 	lwkt_reltoken(&vm_token);
3254 }
3255 
3256 /*
3257  * Clear the reference bit on the specified physical page.
3258  *
3259  * No other requirements.
3260  */
3261 void
3262 pmap_clear_reference(vm_page_t m)
3263 {
3264 	lwkt_gettoken(&vm_token);
3265 	pmap_clearbit(m, VPTE_A);
3266 	lwkt_reltoken(&vm_token);
3267 }
3268 
3269 /*
3270  * Miscellaneous support routines follow
3271  */
3272 
3273 static void
3274 i386_protection_init(void)
3275 {
3276 	int *kp, prot;
3277 
3278 	kp = protection_codes;
3279 	for (prot = 0; prot < 8; prot++) {
3280 		if (prot & VM_PROT_READ)
3281 			*kp |= 0; /* if it's VALID is readeable */
3282 		if (prot & VM_PROT_WRITE)
3283 			*kp |= VPTE_RW;
3284 		if (prot & VM_PROT_EXECUTE)
3285 			*kp |= 0; /* if it's VALID is executable */
3286 		++kp;
3287 	}
3288 }
3289 
3290 /*
3291  * Sets the memory attribute for the specified page.
3292  */
3293 void
3294 pmap_page_set_memattr(vm_page_t m, vm_memattr_t ma)
3295 {
3296 	/* This is a vkernel, do nothing */
3297 }
3298 
3299 /*
3300  * Change the PAT attribute on an existing kernel memory map.  Caller
3301  * must ensure that the virtual memory in question is not accessed
3302  * during the adjustment.
3303  */
3304 void
3305 pmap_change_attr(vm_offset_t va, vm_size_t count, int mode)
3306 {
3307 	/* This is a vkernel, do nothing */
3308 }
3309 
3310 /*
3311  * Perform the pmap work for mincore
3312  *
3313  * No other requirements.
3314  */
3315 int
3316 pmap_mincore(pmap_t pmap, vm_offset_t addr)
3317 {
3318 	pt_entry_t *ptep, pte;
3319 	vm_page_t m;
3320 	int val = 0;
3321 
3322 	lwkt_gettoken(&vm_token);
3323 	ptep = pmap_pte(pmap, addr);
3324 
3325 	if (ptep && (pte = *ptep) != 0) {
3326 		vm_paddr_t pa;
3327 
3328 		val = MINCORE_INCORE;
3329 		if ((pte & VPTE_MANAGED) == 0)
3330 			goto done;
3331 
3332 		pa = pte & VPTE_FRAME;
3333 
3334 		m = PHYS_TO_VM_PAGE(pa);
3335 
3336 		/*
3337 		 * Modified by us
3338 		 */
3339 		if (pte & VPTE_M)
3340 			val |= MINCORE_MODIFIED|MINCORE_MODIFIED_OTHER;
3341 		/*
3342 		 * Modified by someone
3343 		 */
3344 		else if (m->dirty || pmap_is_modified(m))
3345 			val |= MINCORE_MODIFIED_OTHER;
3346 		/*
3347 		 * Referenced by us
3348 		 */
3349 		if (pte & VPTE_A)
3350 			val |= MINCORE_REFERENCED|MINCORE_REFERENCED_OTHER;
3351 
3352 		/*
3353 		 * Referenced by someone
3354 		 */
3355 		else if ((m->flags & PG_REFERENCED) || pmap_ts_referenced(m)) {
3356 			val |= MINCORE_REFERENCED_OTHER;
3357 			vm_page_flag_set(m, PG_REFERENCED);
3358 		}
3359 	}
3360 done:
3361 	lwkt_reltoken(&vm_token);
3362 	return val;
3363 }
3364 
3365 /*
3366  * Replace p->p_vmspace with a new one.  If adjrefs is non-zero the new
3367  * vmspace will be ref'd and the old one will be deref'd.
3368  *
3369  * Caller must hold vmspace->vm_map.token for oldvm and newvm
3370  */
3371 void
3372 pmap_replacevm(struct proc *p, struct vmspace *newvm, int adjrefs)
3373 {
3374 	struct vmspace *oldvm;
3375 	struct lwp *lp;
3376 
3377 	crit_enter();
3378 	oldvm = p->p_vmspace;
3379 	if (oldvm != newvm) {
3380 		if (adjrefs)
3381 			vmspace_ref(newvm);
3382 		p->p_vmspace = newvm;
3383 		KKASSERT(p->p_nthreads == 1);
3384 		lp = RB_ROOT(&p->p_lwp_tree);
3385 		pmap_setlwpvm(lp, newvm);
3386 		if (adjrefs)
3387 			vmspace_rel(oldvm);
3388 	}
3389 	crit_exit();
3390 }
3391 
3392 /*
3393  * Set the vmspace for a LWP.  The vmspace is almost universally set the
3394  * same as the process vmspace, but virtual kernels need to swap out contexts
3395  * on a per-lwp basis.
3396  */
3397 void
3398 pmap_setlwpvm(struct lwp *lp, struct vmspace *newvm)
3399 {
3400 	struct vmspace *oldvm;
3401 	struct pmap *pmap;
3402 
3403 	oldvm = lp->lwp_vmspace;
3404 	if (oldvm != newvm) {
3405 		crit_enter();
3406 		lp->lwp_vmspace = newvm;
3407 		if (curthread->td_lwp == lp) {
3408 			pmap = vmspace_pmap(newvm);
3409 			ATOMIC_CPUMASK_ORBIT(pmap->pm_active, mycpu->gd_cpuid);
3410 			if (pmap->pm_active_lock & CPULOCK_EXCL)
3411 				pmap_interlock_wait(newvm);
3412 #if defined(SWTCH_OPTIM_STATS)
3413 			tlb_flush_count++;
3414 #endif
3415 			pmap = vmspace_pmap(oldvm);
3416 			ATOMIC_CPUMASK_NANDBIT(pmap->pm_active,
3417 					       mycpu->gd_cpuid);
3418 		}
3419 		crit_exit();
3420 	}
3421 }
3422 
3423 /*
3424  * The swtch code tried to switch in a heavy weight process whos pmap
3425  * is locked by another cpu.  We have to wait for the lock to clear before
3426  * the pmap can be used.
3427  */
3428 void
3429 pmap_interlock_wait (struct vmspace *vm)
3430 {
3431 	pmap_t pmap = vmspace_pmap(vm);
3432 
3433 	if (pmap->pm_active_lock & CPULOCK_EXCL) {
3434 		crit_enter();
3435 		while (pmap->pm_active_lock & CPULOCK_EXCL) {
3436 			cpu_ccfence();
3437 			pthread_yield();
3438 		}
3439 		crit_exit();
3440 	}
3441 }
3442 
3443 vm_offset_t
3444 pmap_addr_hint(vm_object_t obj, vm_offset_t addr, vm_size_t size)
3445 {
3446 
3447 	if ((obj == NULL) || (size < NBPDR) || (obj->type != OBJT_DEVICE)) {
3448 		return addr;
3449 	}
3450 
3451 	addr = roundup2(addr, NBPDR);
3452 	return addr;
3453 }
3454 
3455 /*
3456  * Used by kmalloc/kfree, page already exists at va
3457  */
3458 vm_page_t
3459 pmap_kvtom(vm_offset_t va)
3460 {
3461 	vpte_t *ptep;
3462 
3463 	KKASSERT(va >= KvaStart && va < KvaEnd);
3464 	ptep = vtopte(va);
3465 	return(PHYS_TO_VM_PAGE(*ptep & PG_FRAME));
3466 }
3467 
3468 void
3469 pmap_object_init(vm_object_t object)
3470 {
3471 	/* empty */
3472 }
3473 
3474 void
3475 pmap_object_free(vm_object_t object)
3476 {
3477 	/* empty */
3478 }
3479