Attachment #169679 for bug #204426

Lines 137-143 release_page(struct faultstate *fs) Link Here

(-)sys/vm/vm_fault.c (-6 / +22 lines)
137		137
138	vm_page_xunbusy(fs->m);	138	vm_page_xunbusy(fs->m);
139	vm_page_lock(fs->m);	139	vm_page_lock(fs->m);
140	vm_page_deactivate(fs->m);	140	if (fs->m->valid == 0) {
		141	if (fs->m->wire_count == 0)
		142	vm_page_free(fs->m);
		143	} else {
		144	vm_page_deactivate(fs->m);
		145	}
141	vm_page_unlock(fs->m);	146	vm_page_unlock(fs->m);
142	fs->m = NULL;	147	fs->m = NULL;
143	}	148	}
Lines 294-300 vm_fault_hold(vm_map_t map, vm_offset_t vaddr, vm_ Link Here
294	struct faultstate fs;	299	struct faultstate fs;
295	struct vnode *vp;	300	struct vnode *vp;
296	vm_page_t m;	301	vm_page_t m;
297	int locked, error;	302	int locked, error, dead;
298		303
299	hardfault = 0;	304	hardfault = 0;
300	growstack = TRUE;	305	growstack = TRUE;
Lines 414-420 fast_failed: Link Here
414		419
415	fs.lookup_still_valid = TRUE;	420	fs.lookup_still_valid = TRUE;
416		421
417	fs.first_m = NULL;	422	fs.m = fs.first_m = NULL;
418		423
419	/*	424	/*
420	* Search for the page at object/offset.	425	* Search for the page at object/offset.
Lines 423-433 fast_failed: Link Here
423	fs.pindex = fs.first_pindex;	428	fs.pindex = fs.first_pindex;
424	while (TRUE) {	429	while (TRUE) {
425	/*	430	/*
426	* If the object is dead, we stop here	431	* If the object is marked for imminent termination,
		432	* we retry here, since the collapse pass has raced
		433	* with us. Otherwise, if we see terminally dead
		434	* object, return fail.
427	*/	435	*/
428	if (fs.object->flags & OBJ_DEAD) {	436	if ((fs.object->flags & OBJ_DEAD) != 0) {
		437	dead = fs.object->type == OBJT_DEAD;
		438	if (fs.m != NULL && fs.m != fs.first_m)
		439	release_page(&fs);
429	unlock_and_deallocate(&fs);	440	unlock_and_deallocate(&fs);
430	return (KERN_PROTECTION_FAILURE);	441	if (dead)
		442	return (KERN_PROTECTION_FAILURE);
		443	pause("vmf_de", 1);
		444	goto RetryFault;
431	}	445	}
432		446
433	/*	447	/*
Lines 843-848 vnode_locked: Link Here
843	*/	857	*/
844	if (vm_page_rename(fs.m, fs.first_object,	858	if (vm_page_rename(fs.m, fs.first_object,
845	fs.first_pindex)) {	859	fs.first_pindex)) {
		860	VM_OBJECT_WUNLOCK(fs.first_object);
		861	release_page(&fs);
846	unlock_and_deallocate(&fs);	862	unlock_and_deallocate(&fs);
847	goto RetryFault;	863	goto RetryFault;
848	}	864	}

Lines 1583-1589 vm_object_backing_scan(vm_object_t object, int op) Link Here

(-)sys/vm/vm_object.c (-10 / +15 lines)
1583	continue;	1583	continue;
1584	}	1584	}
1585		1585
1586	KASSERT(pp == NULL \|\| pp->valid != 0,	1586	KASSERT(pp == NULL \|\| pp->wire_count > 0 \|\| pp->valid != 0,
1587	("unbusy invalid page %p", pp));	1587	("unbusy invalid page %p", pp));
1588		1588
1589	if (pp != NULL \|\| vm_pager_has_page(object,	1589	if (pp != NULL \|\| vm_pager_has_page(object,
Lines 1673-1683 vm_object_qcollapse(vm_object_t object) Link Here
1673	void	1673	void
1674	vm_object_collapse(vm_object_t object)	1674	vm_object_collapse(vm_object_t object)
1675	{	1675	{
		1676	vm_object_t backing_object, new_backing_object;
		1677
1676	VM_OBJECT_ASSERT_WLOCKED(object);	1678	VM_OBJECT_ASSERT_WLOCKED(object);
1677		1679
		1680	if ((object->flags & OBJ_DEAD) != 0)
		1681	return;
		1682	vm_object_pip_add(object, 1);
1678	while (TRUE) {	1683	while (TRUE) {
1679	vm_object_t backing_object;
1680
1681	/*	1684	/*
1682	* Verify that the conditions are right for collapse:	1685	* Verify that the conditions are right for collapse:
1683	*	1686	*
Lines 1703-1716 vm_object_collapse(vm_object_t object) Link Here
1703	break;	1706	break;
1704	}	1707	}
1705		1708
1706	if (	1709	if (object->paging_in_progress > 1 /* one ref is from us */ \|\|
1707	object->paging_in_progress != 0 \|\|	1710	backing_object->paging_in_progress != 0) {
1708	backing_object->paging_in_progress != 0
1709	) {
1710	vm_object_qcollapse(object);	1711	vm_object_qcollapse(object);
1711	VM_OBJECT_WUNLOCK(backing_object);	1712	VM_OBJECT_WUNLOCK(backing_object);
1712	break;	1713	break;
1713	}	1714	}
		1715	vm_object_pip_add(backing_object, 1);
		1716
1714	/*	1717	/*
1715	* We know that we can either collapse the backing object (if	1718	* We know that we can either collapse the backing object (if
1716	* the parent is the only reference to it) or (perhaps) have	1719	* the parent is the only reference to it) or (perhaps) have
Lines 1793-1798 vm_object_collapse(vm_object_t object) Link Here
1793	KASSERT(backing_object->ref_count == 1, (	1796	KASSERT(backing_object->ref_count == 1, (
1794	"backing_object %p was somehow re-referenced during collapse!",	1797	"backing_object %p was somehow re-referenced during collapse!",
1795	backing_object));	1798	backing_object));
		1799	vm_object_pip_wakeup(backing_object);
1796	backing_object->type = OBJT_DEAD;	1800	backing_object->type = OBJT_DEAD;
1797	backing_object->ref_count = 0;	1801	backing_object->ref_count = 0;
1798	VM_OBJECT_WUNLOCK(backing_object);	1802	VM_OBJECT_WUNLOCK(backing_object);
Lines 1800-1807 vm_object_collapse(vm_object_t object) Link Here
1800		1804
1801	object_collapses++;	1805	object_collapses++;
1802	} else {	1806	} else {
1803	vm_object_t new_backing_object;
1804
1805	/*	1807	/*
1806	* If we do not entirely shadow the backing object,	1808	* If we do not entirely shadow the backing object,
1807	* there is nothing we can do so we give up.	1809	* there is nothing we can do so we give up.
Lines 1809-1814 vm_object_collapse(vm_object_t object) Link Here
1809	if (object->resident_page_count != object->size &&	1811	if (object->resident_page_count != object->size &&
1810	!vm_object_backing_scan(object,	1812	!vm_object_backing_scan(object,
1811	OBSC_TEST_ALL_SHADOWED)) {	1813	OBSC_TEST_ALL_SHADOWED)) {
		1814	vm_object_pip_wakeup(backing_object);
1812	VM_OBJECT_WUNLOCK(backing_object);	1815	VM_OBJECT_WUNLOCK(backing_object);
1813	break;	1816	break;
1814	}	1817	}
Lines 1841-1846 vm_object_collapse(vm_object_t object) Link Here
1841	* its ref_count was at least 2, it will not vanish.	1844	* its ref_count was at least 2, it will not vanish.
1842	*/	1845	*/
1843	backing_object->ref_count--;	1846	backing_object->ref_count--;
		1847	vm_object_pip_wakeup(backing_object);
1844	VM_OBJECT_WUNLOCK(backing_object);	1848	VM_OBJECT_WUNLOCK(backing_object);
1845	object_bypasses++;	1849	object_bypasses++;
1846	}	1850	}
Lines 1849-1854 vm_object_collapse(vm_object_t object) Link Here
1849	* Try again with this object's new backing object.	1853	* Try again with this object's new backing object.
1850	*/	1854	*/
1851	}	1855	}
		1856	vm_object_pip_wakeup(object);
1852	}	1857	}
1853		1858
1854	/*	1859	/*

Lines 1838-1845 retry: Link Here

(-)sys/vm/vm_page.c (-2 / +5 lines)
1838	m < &m_ret[npages]; m++) {	1838	m < &m_ret[npages]; m++) {
1839	if ((req & VM_ALLOC_WIRED) != 0)	1839	if ((req & VM_ALLOC_WIRED) != 0)
1840	m->wire_count = 0;	1840	m->wire_count = 0;
1841	if (m >= m_tmp)	1841	if (m >= m_tmp) {
1842	m->object = NULL;	1842	m->object = NULL;
		1843	m->oflags \|= VPO_UNMANAGED;
		1844	}
1843	vm_page_free(m);	1845	vm_page_free(m);
1844	}	1846	}
1845	return (NULL);	1847	return (NULL);
Lines 2580-2586 vm_page_cache(vm_page_t m) Link Here
2580	cache_was_empty = vm_radix_is_empty(&object->cache);	2582	cache_was_empty = vm_radix_is_empty(&object->cache);
2581	if (vm_radix_insert(&object->cache, m)) {	2583	if (vm_radix_insert(&object->cache, m)) {
2582	mtx_unlock(&vm_page_queue_free_mtx);	2584	mtx_unlock(&vm_page_queue_free_mtx);
2583	if (object->resident_page_count == 0)	2585	if (object->type == OBJT_VNODE &&
		2586	object->resident_page_count == 0)
2584	vdrop(object->handle);	2587	vdrop(object->handle);
2585	m->object = NULL;	2588	m->object = NULL;
2586	vm_page_free(m);	2589	vm_page_free(m);

Return to bug 204426