xref: /netbsd-src/sys/uvm/uvm_glue.c (revision e6d6e05cb173f30287ab619b21120b27baa66ad6)
1 /*	$NetBSD: uvm_glue.c,v 1.118 2008/02/29 12:08:04 yamt Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Charles D. Cranor and Washington University.
5  * Copyright (c) 1991, 1993, The Regents of the University of California.
6  *
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to Berkeley by
10  * The Mach Operating System project at Carnegie-Mellon University.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. All advertising materials mentioning features or use of this software
21  *    must display the following acknowledgement:
22  *	This product includes software developed by Charles D. Cranor,
23  *      Washington University, the University of California, Berkeley and
24  *      its contributors.
25  * 4. Neither the name of the University nor the names of its contributors
26  *    may be used to endorse or promote products derived from this software
27  *    without specific prior written permission.
28  *
29  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
30  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
33  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39  * SUCH DAMAGE.
40  *
41  *	@(#)vm_glue.c	8.6 (Berkeley) 1/5/94
42  * from: Id: uvm_glue.c,v 1.1.2.8 1998/02/07 01:16:54 chs Exp
43  *
44  *
45  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
46  * All rights reserved.
47  *
48  * Permission to use, copy, modify and distribute this software and
49  * its documentation is hereby granted, provided that both the copyright
50  * notice and this permission notice appear in all copies of the
51  * software, derivative works or modified versions, and any portions
52  * thereof, and that both notices appear in supporting documentation.
53  *
54  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
55  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
56  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
57  *
58  * Carnegie Mellon requests users of this software to return to
59  *
60  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
61  *  School of Computer Science
62  *  Carnegie Mellon University
63  *  Pittsburgh PA 15213-3890
64  *
65  * any improvements or extensions that they make and grant Carnegie the
66  * rights to redistribute these changes.
67  */
68 
69 #include <sys/cdefs.h>
70 __KERNEL_RCSID(0, "$NetBSD: uvm_glue.c,v 1.118 2008/02/29 12:08:04 yamt Exp $");
71 
72 #include "opt_coredump.h"
73 #include "opt_kgdb.h"
74 #include "opt_kstack.h"
75 #include "opt_uvmhist.h"
76 
77 /*
78  * uvm_glue.c: glue functions
79  */
80 
81 #include <sys/param.h>
82 #include <sys/systm.h>
83 #include <sys/proc.h>
84 #include <sys/resourcevar.h>
85 #include <sys/buf.h>
86 #include <sys/user.h>
87 #include <sys/syncobj.h>
88 #include <sys/cpu.h>
89 #include <sys/atomic.h>
90 
91 #include <uvm/uvm.h>
92 
93 /*
94  * local prototypes
95  */
96 
97 static void uvm_swapout(struct lwp *);
98 
99 #define UVM_NUAREA_HIWAT	20
100 #define	UVM_NUAREA_LOWAT	16
101 
102 #define	UAREA_NEXTFREE(uarea)	(*(vaddr_t *)(UAREA_TO_USER(uarea)))
103 
104 /*
105  * XXXCDC: do these really belong here?
106  */
107 
108 /*
109  * uvm_kernacc: can the kernel access a region of memory
110  *
111  * - used only by /dev/kmem driver (mem.c)
112  */
113 
114 bool
115 uvm_kernacc(void *addr, size_t len, int rw)
116 {
117 	bool rv;
118 	vaddr_t saddr, eaddr;
119 	vm_prot_t prot = rw == B_READ ? VM_PROT_READ : VM_PROT_WRITE;
120 
121 	saddr = trunc_page((vaddr_t)addr);
122 	eaddr = round_page((vaddr_t)addr + len);
123 	vm_map_lock_read(kernel_map);
124 	rv = uvm_map_checkprot(kernel_map, saddr, eaddr, prot);
125 	vm_map_unlock_read(kernel_map);
126 
127 	return(rv);
128 }
129 
130 #ifdef KGDB
131 /*
132  * Change protections on kernel pages from addr to addr+len
133  * (presumably so debugger can plant a breakpoint).
134  *
135  * We force the protection change at the pmap level.  If we were
136  * to use vm_map_protect a change to allow writing would be lazily-
137  * applied meaning we would still take a protection fault, something
138  * we really don't want to do.  It would also fragment the kernel
139  * map unnecessarily.  We cannot use pmap_protect since it also won't
140  * enforce a write-enable request.  Using pmap_enter is the only way
141  * we can ensure the change takes place properly.
142  */
143 void
144 uvm_chgkprot(void *addr, size_t len, int rw)
145 {
146 	vm_prot_t prot;
147 	paddr_t pa;
148 	vaddr_t sva, eva;
149 
150 	prot = rw == B_READ ? VM_PROT_READ : VM_PROT_READ|VM_PROT_WRITE;
151 	eva = round_page((vaddr_t)addr + len);
152 	for (sva = trunc_page((vaddr_t)addr); sva < eva; sva += PAGE_SIZE) {
153 		/*
154 		 * Extract physical address for the page.
155 		 */
156 		if (pmap_extract(pmap_kernel(), sva, &pa) == false)
157 			panic("chgkprot: invalid page");
158 		pmap_enter(pmap_kernel(), sva, pa, prot, PMAP_WIRED);
159 	}
160 	pmap_update(pmap_kernel());
161 }
162 #endif
163 
164 /*
165  * uvm_vslock: wire user memory for I/O
166  *
167  * - called from physio and sys___sysctl
168  * - XXXCDC: consider nuking this (or making it a macro?)
169  */
170 
171 int
172 uvm_vslock(struct vmspace *vs, void *addr, size_t len, vm_prot_t access_type)
173 {
174 	struct vm_map *map;
175 	vaddr_t start, end;
176 	int error;
177 
178 	map = &vs->vm_map;
179 	start = trunc_page((vaddr_t)addr);
180 	end = round_page((vaddr_t)addr + len);
181 	error = uvm_fault_wire(map, start, end, access_type, 0);
182 	return error;
183 }
184 
185 /*
186  * uvm_vsunlock: unwire user memory wired by uvm_vslock()
187  *
188  * - called from physio and sys___sysctl
189  * - XXXCDC: consider nuking this (or making it a macro?)
190  */
191 
192 void
193 uvm_vsunlock(struct vmspace *vs, void *addr, size_t len)
194 {
195 	uvm_fault_unwire(&vs->vm_map, trunc_page((vaddr_t)addr),
196 		round_page((vaddr_t)addr + len));
197 }
198 
199 /*
200  * uvm_proc_fork: fork a virtual address space
201  *
202  * - the address space is copied as per parent map's inherit values
203  */
204 void
205 uvm_proc_fork(struct proc *p1, struct proc *p2, bool shared)
206 {
207 
208 	if (shared == true) {
209 		p2->p_vmspace = NULL;
210 		uvmspace_share(p1, p2);
211 	} else {
212 		p2->p_vmspace = uvmspace_fork(p1->p_vmspace);
213 	}
214 
215 	cpu_proc_fork(p1, p2);
216 }
217 
218 
219 /*
220  * uvm_lwp_fork: fork a thread
221  *
222  * - a new "user" structure is allocated for the child process
223  *	[filled in by MD layer...]
224  * - if specified, the child gets a new user stack described by
225  *	stack and stacksize
226  * - NOTE: the kernel stack may be at a different location in the child
227  *	process, and thus addresses of automatic variables may be invalid
228  *	after cpu_lwp_fork returns in the child process.  We do nothing here
229  *	after cpu_lwp_fork returns.
230  * - XXXCDC: we need a way for this to return a failure value rather
231  *   than just hang
232  */
233 void
234 uvm_lwp_fork(struct lwp *l1, struct lwp *l2, void *stack, size_t stacksize,
235     void (*func)(void *), void *arg)
236 {
237 	int error;
238 
239 	/*
240 	 * Wire down the U-area for the process, which contains the PCB
241 	 * and the kernel stack.  Wired state is stored in l->l_flag's
242 	 * L_INMEM bit rather than in the vm_map_entry's wired count
243 	 * to prevent kernel_map fragmentation.  If we reused a cached U-area,
244 	 * L_INMEM will already be set and we don't need to do anything.
245 	 *
246 	 * Note the kernel stack gets read/write accesses right off the bat.
247 	 */
248 
249 	if ((l2->l_flag & LW_INMEM) == 0) {
250 		vaddr_t uarea = USER_TO_UAREA(l2->l_addr);
251 
252 		error = uvm_fault_wire(kernel_map, uarea,
253 		    uarea + USPACE, VM_PROT_READ | VM_PROT_WRITE, 0);
254 		if (error)
255 			panic("uvm_lwp_fork: uvm_fault_wire failed: %d", error);
256 #ifdef PMAP_UAREA
257 		/* Tell the pmap this is a u-area mapping */
258 		PMAP_UAREA(uarea);
259 #endif
260 		l2->l_flag |= LW_INMEM;
261 	}
262 
263 #ifdef KSTACK_CHECK_MAGIC
264 	/*
265 	 * fill stack with magic number
266 	 */
267 	kstack_setup_magic(l2);
268 #endif
269 
270 	/*
271 	 * cpu_lwp_fork() copy and update the pcb, and make the child ready
272  	 * to run.  If this is a normal user fork, the child will exit
273 	 * directly to user mode via child_return() on its first time
274 	 * slice and will not return here.  If this is a kernel thread,
275 	 * the specified entry point will be executed.
276 	 */
277 	cpu_lwp_fork(l1, l2, stack, stacksize, func, arg);
278 }
279 
280 /*
281  * uvm_cpu_attach: initialize per-CPU data structures.
282  */
283 
284 void
285 uvm_cpu_attach(struct cpu_info *ci)
286 {
287 
288 }
289 
290 static int
291 uarea_swapin(vaddr_t addr)
292 {
293 
294 	return uvm_fault_wire(kernel_map, addr, addr + USPACE,
295 	    VM_PROT_READ | VM_PROT_WRITE, 0);
296 }
297 
298 static void
299 uarea_swapout(vaddr_t addr)
300 {
301 
302 	uvm_fault_unwire(kernel_map, addr, addr + USPACE);
303 }
304 
305 #ifndef USPACE_ALIGN
306 #define	USPACE_ALIGN	0
307 #endif
308 
309 static pool_cache_t uvm_uarea_cache;
310 
311 static int
312 uarea_ctor(void *arg, void *obj, int flags)
313 {
314 
315 	KASSERT((flags & PR_WAITOK) != 0);
316 	return uarea_swapin((vaddr_t)obj);
317 }
318 
319 static void *
320 uarea_poolpage_alloc(struct pool *pp, int flags)
321 {
322 
323 	return (void *)uvm_km_alloc(kernel_map, pp->pr_alloc->pa_pagesz,
324 	    USPACE_ALIGN, UVM_KMF_PAGEABLE |
325 	    ((flags & PR_WAITOK) != 0 ? UVM_KMF_WAITVA :
326 	    (UVM_KMF_NOWAIT | UVM_KMF_TRYLOCK)));
327 }
328 
329 static void
330 uarea_poolpage_free(struct pool *pp, void *addr)
331 {
332 
333 	uvm_km_free(kernel_map, (vaddr_t)addr, pp->pr_alloc->pa_pagesz,
334 	    UVM_KMF_PAGEABLE);
335 }
336 
337 static struct pool_allocator uvm_uarea_allocator = {
338 	.pa_alloc = uarea_poolpage_alloc,
339 	.pa_free = uarea_poolpage_free,
340 	.pa_pagesz = USPACE,
341 };
342 
343 void
344 uvm_uarea_init(void)
345 {
346 	int flags = PR_NOTOUCH;
347 
348 	/*
349 	 * specify PR_NOALIGN unless the alignment provided by
350 	 * the backend (USPACE_ALIGN) is sufficient to provide
351 	 * pool page size (UPSACE) alignment.
352 	 */
353 
354 	if ((USPACE_ALIGN == 0 && USPACE != PAGE_SIZE) ||
355 	    (USPACE_ALIGN % USPACE) != 0) {
356 		flags |= PR_NOALIGN;
357 	}
358 
359 	uvm_uarea_cache = pool_cache_init(USPACE, USPACE_ALIGN, 0, flags,
360 	    "uarea", &uvm_uarea_allocator, IPL_NONE, uarea_ctor, NULL, NULL);
361 }
362 
363 /*
364  * uvm_uarea_alloc: allocate a u-area
365  */
366 
367 bool
368 uvm_uarea_alloc(vaddr_t *uaddrp)
369 {
370 
371 	*uaddrp = (vaddr_t)pool_cache_get(uvm_uarea_cache, PR_WAITOK);
372 	return true;
373 }
374 
375 /*
376  * uvm_uarea_free: free a u-area
377  */
378 
379 void
380 uvm_uarea_free(vaddr_t uaddr, struct cpu_info *ci)
381 {
382 
383 	pool_cache_put(uvm_uarea_cache, (void *)uaddr);
384 }
385 
386 /*
387  * uvm_proc_exit: exit a virtual address space
388  *
389  * - borrow proc0's address space because freeing the vmspace
390  *   of the dead process may block.
391  */
392 
393 void
394 uvm_proc_exit(struct proc *p)
395 {
396 	struct lwp *l = curlwp; /* XXX */
397 	struct vmspace *ovm;
398 
399 	KASSERT(p == l->l_proc);
400 	ovm = p->p_vmspace;
401 
402 	/*
403 	 * borrow proc0's address space.
404 	 */
405 	pmap_deactivate(l);
406 	p->p_vmspace = proc0.p_vmspace;
407 	pmap_activate(l);
408 
409 	uvmspace_free(ovm);
410 }
411 
412 void
413 uvm_lwp_exit(struct lwp *l)
414 {
415 	vaddr_t va = USER_TO_UAREA(l->l_addr);
416 
417 	l->l_flag &= ~LW_INMEM;
418 	uvm_uarea_free(va, l->l_cpu);
419 	l->l_addr = NULL;
420 }
421 
422 /*
423  * uvm_init_limit: init per-process VM limits
424  *
425  * - called for process 0 and then inherited by all others.
426  */
427 
428 void
429 uvm_init_limits(struct proc *p)
430 {
431 
432 	/*
433 	 * Set up the initial limits on process VM.  Set the maximum
434 	 * resident set size to be all of (reasonably) available memory.
435 	 * This causes any single, large process to start random page
436 	 * replacement once it fills memory.
437 	 */
438 
439 	p->p_rlimit[RLIMIT_STACK].rlim_cur = DFLSSIZ;
440 	p->p_rlimit[RLIMIT_STACK].rlim_max = maxsmap;
441 	p->p_rlimit[RLIMIT_DATA].rlim_cur = DFLDSIZ;
442 	p->p_rlimit[RLIMIT_DATA].rlim_max = maxdmap;
443 	p->p_rlimit[RLIMIT_RSS].rlim_cur = ptoa(uvmexp.free);
444 }
445 
446 #ifdef DEBUG
447 int	enableswap = 1;
448 int	swapdebug = 0;
449 #define	SDB_FOLLOW	1
450 #define SDB_SWAPIN	2
451 #define SDB_SWAPOUT	4
452 #endif
453 
454 /*
455  * uvm_swapin: swap in an lwp's u-area.
456  *
457  * - must be called with the LWP's swap lock held.
458  * - naturally, must not be called with l == curlwp
459  */
460 
461 void
462 uvm_swapin(struct lwp *l)
463 {
464 	int error;
465 
466 	/* XXXSMP notyet KASSERT(mutex_owned(&l->l_swaplock)); */
467 	KASSERT(l != curlwp);
468 
469 	error = uarea_swapin(USER_TO_UAREA(l->l_addr));
470 	if (error) {
471 		panic("uvm_swapin: rewiring stack failed: %d", error);
472 	}
473 
474 	/*
475 	 * Some architectures need to be notified when the user area has
476 	 * moved to new physical page(s) (e.g.  see mips/mips/vm_machdep.c).
477 	 */
478 	cpu_swapin(l);
479 	lwp_lock(l);
480 	if (l->l_stat == LSRUN)
481 		sched_enqueue(l, false);
482 	l->l_flag |= LW_INMEM;
483 	l->l_swtime = 0;
484 	lwp_unlock(l);
485 	++uvmexp.swapins;
486 }
487 
488 /*
489  * uvm_kick_scheduler: kick the scheduler into action if not running.
490  *
491  * - called when swapped out processes have been awoken.
492  */
493 
494 void
495 uvm_kick_scheduler(void)
496 {
497 
498 	if (uvm.swap_running == false)
499 		return;
500 
501 	mutex_enter(&uvm_scheduler_mutex);
502 	uvm.scheduler_kicked = true;
503 	cv_signal(&uvm.scheduler_cv);
504 	mutex_exit(&uvm_scheduler_mutex);
505 }
506 
507 /*
508  * uvm_scheduler: process zero main loop
509  *
510  * - attempt to swapin every swaped-out, runnable process in order of
511  *	priority.
512  * - if not enough memory, wake the pagedaemon and let it clear space.
513  */
514 
515 void
516 uvm_scheduler(void)
517 {
518 	struct lwp *l, *ll;
519 	int pri;
520 	int ppri;
521 
522 	l = curlwp;
523 	lwp_lock(l);
524 	l->l_priority = PRI_VM;
525 	l->l_class = SCHED_FIFO;
526 	lwp_unlock(l);
527 
528 	for (;;) {
529 #ifdef DEBUG
530 		mutex_enter(&uvm_scheduler_mutex);
531 		while (!enableswap)
532 			cv_wait(&uvm.scheduler_cv, &uvm_scheduler_mutex);
533 		mutex_exit(&uvm_scheduler_mutex);
534 #endif
535 		ll = NULL;		/* process to choose */
536 		ppri = INT_MIN;		/* its priority */
537 
538 		mutex_enter(&proclist_lock);
539 		LIST_FOREACH(l, &alllwp, l_list) {
540 			/* is it a runnable swapped out process? */
541 			if (l->l_stat == LSRUN && !(l->l_flag & LW_INMEM)) {
542 				pri = l->l_swtime + l->l_slptime -
543 				    (l->l_proc->p_nice - NZERO) * 8;
544 				if (pri > ppri) {   /* higher priority? */
545 					ll = l;
546 					ppri = pri;
547 				}
548 			}
549 		}
550 #ifdef DEBUG
551 		if (swapdebug & SDB_FOLLOW)
552 			printf("scheduler: running, procp %p pri %d\n", ll,
553 			    ppri);
554 #endif
555 		/*
556 		 * Nothing to do, back to sleep
557 		 */
558 		if ((l = ll) == NULL) {
559 			mutex_exit(&proclist_lock);
560 			mutex_enter(&uvm_scheduler_mutex);
561 			if (uvm.scheduler_kicked == false)
562 				cv_wait(&uvm.scheduler_cv,
563 				    &uvm_scheduler_mutex);
564 			uvm.scheduler_kicked = false;
565 			mutex_exit(&uvm_scheduler_mutex);
566 			continue;
567 		}
568 
569 		/*
570 		 * we have found swapped out process which we would like
571 		 * to bring back in.
572 		 *
573 		 * XXX: this part is really bogus cuz we could deadlock
574 		 * on memory despite our feeble check
575 		 */
576 		if (uvmexp.free > atop(USPACE)) {
577 #ifdef DEBUG
578 			if (swapdebug & SDB_SWAPIN)
579 				printf("swapin: pid %d(%s)@%p, pri %d "
580 				    "free %d\n", l->l_proc->p_pid,
581 				    l->l_proc->p_comm, l->l_addr, ppri,
582 				    uvmexp.free);
583 #endif
584 			mutex_enter(&l->l_swaplock);
585 			mutex_exit(&proclist_lock);
586 			uvm_swapin(l);
587 			mutex_exit(&l->l_swaplock);
588 			continue;
589 		} else {
590 			/*
591 			 * not enough memory, jab the pageout daemon and
592 			 * wait til the coast is clear
593 			 */
594 			mutex_exit(&proclist_lock);
595 #ifdef DEBUG
596 			if (swapdebug & SDB_FOLLOW)
597 				printf("scheduler: no room for pid %d(%s),"
598 				    " free %d\n", l->l_proc->p_pid,
599 				    l->l_proc->p_comm, uvmexp.free);
600 #endif
601 			uvm_wait("schedpwait");
602 #ifdef DEBUG
603 			if (swapdebug & SDB_FOLLOW)
604 				printf("scheduler: room again, free %d\n",
605 				    uvmexp.free);
606 #endif
607 		}
608 	}
609 }
610 
611 /*
612  * swappable: is LWP "l" swappable?
613  */
614 
615 static bool
616 swappable(struct lwp *l)
617 {
618 
619 	if ((l->l_flag & (LW_INMEM|LW_RUNNING|LW_SYSTEM|LW_WEXIT)) != LW_INMEM)
620 		return false;
621 	if (l->l_holdcnt != 0)
622 		return false;
623 	if (l->l_syncobj == &rw_syncobj || l->l_syncobj == &mutex_syncobj)
624 		return false;
625 	return true;
626 }
627 
628 /*
629  * swapout_threads: find threads that can be swapped and unwire their
630  *	u-areas.
631  *
632  * - called by the pagedaemon
633  * - try and swap at least one processs
634  * - processes that are sleeping or stopped for maxslp or more seconds
635  *   are swapped... otherwise the longest-sleeping or stopped process
636  *   is swapped, otherwise the longest resident process...
637  */
638 
639 void
640 uvm_swapout_threads(void)
641 {
642 	struct lwp *l;
643 	struct lwp *outl, *outl2;
644 	int outpri, outpri2;
645 	int didswap = 0;
646 	extern int maxslp;
647 	bool gotit;
648 
649 	/* XXXCDC: should move off to uvmexp. or uvm., also in uvm_meter */
650 
651 #ifdef DEBUG
652 	if (!enableswap)
653 		return;
654 #endif
655 
656 	/*
657 	 * outl/outpri  : stop/sleep thread with largest sleeptime < maxslp
658 	 * outl2/outpri2: the longest resident thread (its swap time)
659 	 */
660 	outl = outl2 = NULL;
661 	outpri = outpri2 = 0;
662 
663  restart:
664 	mutex_enter(&proclist_lock);
665 	LIST_FOREACH(l, &alllwp, l_list) {
666 		KASSERT(l->l_proc != NULL);
667 		if (!mutex_tryenter(&l->l_swaplock))
668 			continue;
669 		if (!swappable(l)) {
670 			mutex_exit(&l->l_swaplock);
671 			continue;
672 		}
673 		switch (l->l_stat) {
674 		case LSONPROC:
675 			break;
676 
677 		case LSRUN:
678 			if (l->l_swtime > outpri2) {
679 				outl2 = l;
680 				outpri2 = l->l_swtime;
681 			}
682 			break;
683 
684 		case LSSLEEP:
685 		case LSSTOP:
686 			if (l->l_slptime >= maxslp) {
687 				mutex_exit(&proclist_lock);
688 				uvm_swapout(l);
689 				/*
690 				 * Locking in the wrong direction -
691 				 * try to prevent the LWP from exiting.
692 				 */
693 				gotit = mutex_tryenter(&proclist_lock);
694 				mutex_exit(&l->l_swaplock);
695 				didswap++;
696 				if (!gotit)
697 					goto restart;
698 				continue;
699 			} else if (l->l_slptime > outpri) {
700 				outl = l;
701 				outpri = l->l_slptime;
702 			}
703 			break;
704 		}
705 		mutex_exit(&l->l_swaplock);
706 	}
707 
708 	/*
709 	 * If we didn't get rid of any real duds, toss out the next most
710 	 * likely sleeping/stopped or running candidate.  We only do this
711 	 * if we are real low on memory since we don't gain much by doing
712 	 * it (USPACE bytes).
713 	 */
714 	if (didswap == 0 && uvmexp.free <= atop(round_page(USPACE))) {
715 		if ((l = outl) == NULL)
716 			l = outl2;
717 #ifdef DEBUG
718 		if (swapdebug & SDB_SWAPOUT)
719 			printf("swapout_threads: no duds, try procp %p\n", l);
720 #endif
721 		if (l) {
722 			mutex_enter(&l->l_swaplock);
723 			mutex_exit(&proclist_lock);
724 			if (swappable(l))
725 				uvm_swapout(l);
726 			mutex_exit(&l->l_swaplock);
727 			return;
728 		}
729 	}
730 
731 	mutex_exit(&proclist_lock);
732 }
733 
734 /*
735  * uvm_swapout: swap out lwp "l"
736  *
737  * - currently "swapout" means "unwire U-area" and "pmap_collect()"
738  *   the pmap.
739  * - must be called with l->l_swaplock held.
740  * - XXXCDC: should deactivate all process' private anonymous memory
741  */
742 
743 static void
744 uvm_swapout(struct lwp *l)
745 {
746 	struct proc *p = l->l_proc;
747 
748 	KASSERT(mutex_owned(&l->l_swaplock));
749 
750 #ifdef DEBUG
751 	if (swapdebug & SDB_SWAPOUT)
752 		printf("swapout: lid %d.%d(%s)@%p, stat %x pri %d free %d\n",
753 	   p->p_pid, l->l_lid, p->p_comm, l->l_addr, l->l_stat,
754 	   l->l_slptime, uvmexp.free);
755 #endif
756 
757 	/*
758 	 * Mark it as (potentially) swapped out.
759 	 */
760 	lwp_lock(l);
761 	if (!swappable(l)) {
762 		KDASSERT(l->l_cpu != curcpu());
763 		lwp_unlock(l);
764 		return;
765 	}
766 	l->l_flag &= ~LW_INMEM;
767 	l->l_swtime = 0;
768 	if (l->l_stat == LSRUN)
769 		sched_dequeue(l);
770 	lwp_unlock(l);
771 	p->p_stats->p_ru.ru_nswap++;	/* XXXSMP */
772 	++uvmexp.swapouts;
773 
774 	/*
775 	 * Do any machine-specific actions necessary before swapout.
776 	 * This can include saving floating point state, etc.
777 	 */
778 	cpu_swapout(l);
779 
780 	/*
781 	 * Unwire the to-be-swapped process's user struct and kernel stack.
782 	 */
783 	uarea_swapout(USER_TO_UAREA(l->l_addr));
784 	pmap_collect(vm_map_pmap(&p->p_vmspace->vm_map));
785 }
786 
787 /*
788  * uvm_lwp_hold: prevent lwp "l" from being swapped out, and bring
789  * back into memory if it is currently swapped.
790  */
791 
792 void
793 uvm_lwp_hold(struct lwp *l)
794 {
795 
796 	if (l == curlwp) {
797 		atomic_inc_uint(&l->l_holdcnt);
798 	} else {
799 		mutex_enter(&l->l_swaplock);
800 		if (atomic_inc_uint_nv(&l->l_holdcnt) == 1 &&
801 		    (l->l_flag & LW_INMEM) == 0)
802 			uvm_swapin(l);
803 		mutex_exit(&l->l_swaplock);
804 	}
805 }
806 
807 /*
808  * uvm_lwp_rele: release a hold on lwp "l".  when the holdcount
809  * drops to zero, it's eligable to be swapped.
810  */
811 
812 void
813 uvm_lwp_rele(struct lwp *l)
814 {
815 
816 	KASSERT(l->l_holdcnt != 0);
817 
818 	atomic_dec_uint(&l->l_holdcnt);
819 }
820 
821 #ifdef COREDUMP
822 /*
823  * uvm_coredump_walkmap: walk a process's map for the purpose of dumping
824  * a core file.
825  */
826 
827 int
828 uvm_coredump_walkmap(struct proc *p, void *iocookie,
829     int (*func)(struct proc *, void *, struct uvm_coredump_state *),
830     void *cookie)
831 {
832 	struct uvm_coredump_state state;
833 	struct vmspace *vm = p->p_vmspace;
834 	struct vm_map *map = &vm->vm_map;
835 	struct vm_map_entry *entry;
836 	int error;
837 
838 	entry = NULL;
839 	vm_map_lock_read(map);
840 	state.end = 0;
841 	for (;;) {
842 		if (entry == NULL)
843 			entry = map->header.next;
844 		else if (!uvm_map_lookup_entry(map, state.end, &entry))
845 			entry = entry->next;
846 		if (entry == &map->header)
847 			break;
848 
849 		state.cookie = cookie;
850 		if (state.end > entry->start) {
851 			state.start = state.end;
852 		} else {
853 			state.start = entry->start;
854 		}
855 		state.realend = entry->end;
856 		state.end = entry->end;
857 		state.prot = entry->protection;
858 		state.flags = 0;
859 
860 		/*
861 		 * Dump the region unless one of the following is true:
862 		 *
863 		 * (1) the region has neither object nor amap behind it
864 		 *     (ie. it has never been accessed).
865 		 *
866 		 * (2) the region has no amap and is read-only
867 		 *     (eg. an executable text section).
868 		 *
869 		 * (3) the region's object is a device.
870 		 *
871 		 * (4) the region is unreadable by the process.
872 		 */
873 
874 		KASSERT(!UVM_ET_ISSUBMAP(entry));
875 		KASSERT(state.start < VM_MAXUSER_ADDRESS);
876 		KASSERT(state.end <= VM_MAXUSER_ADDRESS);
877 		if (entry->object.uvm_obj == NULL &&
878 		    entry->aref.ar_amap == NULL) {
879 			state.realend = state.start;
880 		} else if ((entry->protection & VM_PROT_WRITE) == 0 &&
881 		    entry->aref.ar_amap == NULL) {
882 			state.realend = state.start;
883 		} else if (entry->object.uvm_obj != NULL &&
884 		    UVM_OBJ_IS_DEVICE(entry->object.uvm_obj)) {
885 			state.realend = state.start;
886 		} else if ((entry->protection & VM_PROT_READ) == 0) {
887 			state.realend = state.start;
888 		} else {
889 			if (state.start >= (vaddr_t)vm->vm_maxsaddr)
890 				state.flags |= UVM_COREDUMP_STACK;
891 
892 			/*
893 			 * If this an anonymous entry, only dump instantiated
894 			 * pages.
895 			 */
896 			if (entry->object.uvm_obj == NULL) {
897 				vaddr_t end;
898 
899 				amap_lock(entry->aref.ar_amap);
900 				for (end = state.start;
901 				     end < state.end; end += PAGE_SIZE) {
902 					struct vm_anon *anon;
903 					anon = amap_lookup(&entry->aref,
904 					    end - entry->start);
905 					/*
906 					 * If we have already encountered an
907 					 * uninstantiated page, stop at the
908 					 * first instantied page.
909 					 */
910 					if (anon != NULL &&
911 					    state.realend != state.end) {
912 						state.end = end;
913 						break;
914 					}
915 
916 					/*
917 					 * If this page is the first
918 					 * uninstantiated page, mark this as
919 					 * the real ending point.  Continue to
920 					 * counting uninstantiated pages.
921 					 */
922 					if (anon == NULL &&
923 					    state.realend == state.end) {
924 						state.realend = end;
925 					}
926 				}
927 				amap_unlock(entry->aref.ar_amap);
928 			}
929 		}
930 
931 
932 		vm_map_unlock_read(map);
933 		error = (*func)(p, iocookie, &state);
934 		if (error)
935 			return (error);
936 		vm_map_lock_read(map);
937 	}
938 	vm_map_unlock_read(map);
939 
940 	return (0);
941 }
942 #endif /* COREDUMP */
943