xref: /dflybsd-src/sys/vm/vm_fault.c (revision ff10d9548f6b395b5e9c0485daa45a3b236c1572)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * Copyright (c) 1994 John S. Dyson
7  * All rights reserved.
8  * Copyright (c) 1994 David Greenman
9  * All rights reserved.
10  *
11  *
12  * This code is derived from software contributed to Berkeley by
13  * The Mach Operating System project at Carnegie-Mellon University.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  * 3. All advertising materials mentioning features or use of this software
24  *    must display the following acknowledgement:
25  *	This product includes software developed by the University of
26  *	California, Berkeley and its contributors.
27  * 4. Neither the name of the University nor the names of its contributors
28  *    may be used to endorse or promote products derived from this software
29  *    without specific prior written permission.
30  *
31  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
32  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
33  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
34  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
35  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
37  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
38  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
39  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
40  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
41  * SUCH DAMAGE.
42  *
43  *	from: @(#)vm_fault.c	8.4 (Berkeley) 1/12/94
44  *
45  *
46  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
47  * All rights reserved.
48  *
49  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
50  *
51  * Permission to use, copy, modify and distribute this software and
52  * its documentation is hereby granted, provided that both the copyright
53  * notice and this permission notice appear in all copies of the
54  * software, derivative works or modified versions, and any portions
55  * thereof, and that both notices appear in supporting documentation.
56  *
57  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
58  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
59  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
60  *
61  * Carnegie Mellon requests users of this software to return to
62  *
63  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
64  *  School of Computer Science
65  *  Carnegie Mellon University
66  *  Pittsburgh PA 15213-3890
67  *
68  * any improvements or extensions that they make and grant Carnegie the
69  * rights to redistribute these changes.
70  *
71  * $FreeBSD: src/sys/vm/vm_fault.c,v 1.108.2.8 2002/02/26 05:49:27 silby Exp $
72  * $DragonFly: src/sys/vm/vm_fault.c,v 1.47 2008/07/01 02:02:56 dillon Exp $
73  */
74 
75 /*
76  *	Page fault handling module.
77  */
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/kernel.h>
82 #include <sys/proc.h>
83 #include <sys/vnode.h>
84 #include <sys/resourcevar.h>
85 #include <sys/vmmeter.h>
86 #include <sys/vkernel.h>
87 #include <sys/lock.h>
88 #include <sys/sysctl.h>
89 
90 #include <cpu/lwbuf.h>
91 
92 #include <vm/vm.h>
93 #include <vm/vm_param.h>
94 #include <vm/pmap.h>
95 #include <vm/vm_map.h>
96 #include <vm/vm_object.h>
97 #include <vm/vm_page.h>
98 #include <vm/vm_pageout.h>
99 #include <vm/vm_kern.h>
100 #include <vm/vm_pager.h>
101 #include <vm/vnode_pager.h>
102 #include <vm/vm_extern.h>
103 
104 #include <sys/thread2.h>
105 #include <vm/vm_page2.h>
106 
107 struct faultstate {
108 	vm_page_t m;
109 	vm_object_t object;
110 	vm_pindex_t pindex;
111 	vm_prot_t prot;
112 	vm_page_t first_m;
113 	vm_object_t first_object;
114 	vm_prot_t first_prot;
115 	vm_map_t map;
116 	vm_map_entry_t entry;
117 	int lookup_still_valid;
118 	int hardfault;
119 	int fault_flags;
120 	int map_generation;
121 	boolean_t wired;
122 	struct vnode *vp;
123 };
124 
125 static int debug_cluster = 0;
126 SYSCTL_INT(_vm, OID_AUTO, debug_cluster, CTLFLAG_RW, &debug_cluster, 0, "");
127 
128 static int vm_fault_object(struct faultstate *, vm_pindex_t, vm_prot_t);
129 static int vm_fault_vpagetable(struct faultstate *, vm_pindex_t *, vpte_t, int);
130 #if 0
131 static int vm_fault_additional_pages (vm_page_t, int, int, vm_page_t *, int *);
132 #endif
133 static void vm_set_nosync(vm_page_t m, vm_map_entry_t entry);
134 static void vm_prefault(pmap_t pmap, vm_offset_t addra, vm_map_entry_t entry,
135 			int prot);
136 
137 static __inline void
138 release_page(struct faultstate *fs)
139 {
140 	vm_page_deactivate(fs->m);
141 	vm_page_wakeup(fs->m);
142 	fs->m = NULL;
143 }
144 
145 /*
146  * NOTE: Once unlocked any cached fs->entry becomes invalid, any reuse
147  *	 requires relocking and then checking the timestamp.
148  *
149  * NOTE: vm_map_lock_read() does not bump fs->map->timestamp so we do
150  *	 not have to update fs->map_generation here.
151  *
152  * NOTE: This function can fail due to a deadlock against the caller's
153  *	 holding of a vm_page BUSY.
154  */
155 static __inline int
156 relock_map(struct faultstate *fs)
157 {
158 	int error;
159 
160 	if (fs->lookup_still_valid == FALSE && fs->map) {
161 		error = vm_map_lock_read_to(fs->map);
162 		if (error == 0)
163 			fs->lookup_still_valid = TRUE;
164 	} else {
165 		error = 0;
166 	}
167 	return error;
168 }
169 
170 static __inline void
171 unlock_map(struct faultstate *fs)
172 {
173 	if (fs->lookup_still_valid && fs->map) {
174 		vm_map_lookup_done(fs->map, fs->entry, 0);
175 		fs->lookup_still_valid = FALSE;
176 	}
177 }
178 
179 /*
180  * Clean up after a successful call to vm_fault_object() so another call
181  * to vm_fault_object() can be made.
182  */
183 static void
184 _cleanup_successful_fault(struct faultstate *fs, int relock)
185 {
186 	if (fs->object != fs->first_object) {
187 		vm_page_free(fs->first_m);
188 		vm_object_pip_wakeup(fs->object);
189 		fs->first_m = NULL;
190 	}
191 	fs->object = fs->first_object;
192 	if (relock && fs->lookup_still_valid == FALSE) {
193 		if (fs->map)
194 			vm_map_lock_read(fs->map);
195 		fs->lookup_still_valid = TRUE;
196 	}
197 }
198 
199 static void
200 _unlock_things(struct faultstate *fs, int dealloc)
201 {
202 	_cleanup_successful_fault(fs, 0);
203 	if (dealloc) {
204 		/*vm_object_deallocate(fs->first_object);*/
205 		/*fs->first_object = NULL; drop used later on */
206 	}
207 	unlock_map(fs);
208 	if (fs->vp != NULL) {
209 		vput(fs->vp);
210 		fs->vp = NULL;
211 	}
212 }
213 
214 #define unlock_things(fs) _unlock_things(fs, 0)
215 #define unlock_and_deallocate(fs) _unlock_things(fs, 1)
216 #define cleanup_successful_fault(fs) _cleanup_successful_fault(fs, 1)
217 
218 /*
219  * TRYPAGER
220  *
221  * Determine if the pager for the current object *might* contain the page.
222  *
223  * We only need to try the pager if this is not a default object (default
224  * objects are zero-fill and have no real pager), and if we are not taking
225  * a wiring fault or if the FS entry is wired.
226  */
227 #define TRYPAGER(fs)	\
228 		(fs->object->type != OBJT_DEFAULT && \
229 		(((fs->fault_flags & VM_FAULT_WIRE_MASK) == 0) || fs->wired))
230 
231 /*
232  * vm_fault:
233  *
234  * Handle a page fault occuring at the given address, requiring the given
235  * permissions, in the map specified.  If successful, the page is inserted
236  * into the associated physical map.
237  *
238  * NOTE: The given address should be truncated to the proper page address.
239  *
240  * KERN_SUCCESS is returned if the page fault is handled; otherwise,
241  * a standard error specifying why the fault is fatal is returned.
242  *
243  * The map in question must be referenced, and remains so.
244  * The caller may hold no locks.
245  * No other requirements.
246  */
247 int
248 vm_fault(vm_map_t map, vm_offset_t vaddr, vm_prot_t fault_type, int fault_flags)
249 {
250 	int result;
251 	vm_pindex_t first_pindex;
252 	struct faultstate fs;
253 	int growstack;
254 
255 	mycpu->gd_cnt.v_vm_faults++;
256 
257 	fs.hardfault = 0;
258 	fs.fault_flags = fault_flags;
259 	growstack = 1;
260 
261 	lwkt_gettoken(&map->token);
262 
263 RetryFault:
264 	/*
265 	 * Find the vm_map_entry representing the backing store and resolve
266 	 * the top level object and page index.  This may have the side
267 	 * effect of executing a copy-on-write on the map entry and/or
268 	 * creating a shadow object, but will not COW any actual VM pages.
269 	 *
270 	 * On success fs.map is left read-locked and various other fields
271 	 * are initialized but not otherwise referenced or locked.
272 	 *
273 	 * NOTE!  vm_map_lookup will try to upgrade the fault_type to
274 	 * VM_FAULT_WRITE if the map entry is a virtual page table and also
275 	 * writable, so we can set the 'A'accessed bit in the virtual page
276 	 * table entry.
277 	 */
278 	fs.map = map;
279 	result = vm_map_lookup(&fs.map, vaddr, fault_type,
280 			       &fs.entry, &fs.first_object,
281 			       &first_pindex, &fs.first_prot, &fs.wired);
282 
283 	/*
284 	 * If the lookup failed or the map protections are incompatible,
285 	 * the fault generally fails.  However, if the caller is trying
286 	 * to do a user wiring we have more work to do.
287 	 */
288 	if (result != KERN_SUCCESS) {
289 		if (result != KERN_PROTECTION_FAILURE ||
290 		    (fs.fault_flags & VM_FAULT_WIRE_MASK) != VM_FAULT_USER_WIRE)
291 		{
292 			if (result == KERN_INVALID_ADDRESS && growstack &&
293 			    map != &kernel_map && curproc != NULL) {
294 				result = vm_map_growstack(curproc, vaddr);
295 				if (result == KERN_SUCCESS) {
296 					growstack = 0;
297 					goto RetryFault;
298 				}
299 				result = KERN_FAILURE;
300 			}
301 			goto done;
302 		}
303 
304 		/*
305    		 * If we are user-wiring a r/w segment, and it is COW, then
306    		 * we need to do the COW operation.  Note that we don't
307 		 * currently COW RO sections now, because it is NOT desirable
308    		 * to COW .text.  We simply keep .text from ever being COW'ed
309    		 * and take the heat that one cannot debug wired .text sections.
310    		 */
311 		result = vm_map_lookup(&fs.map, vaddr,
312 				       VM_PROT_READ|VM_PROT_WRITE|
313 				        VM_PROT_OVERRIDE_WRITE,
314 				       &fs.entry, &fs.first_object,
315 				       &first_pindex, &fs.first_prot,
316 				       &fs.wired);
317 		if (result != KERN_SUCCESS) {
318 			result = KERN_FAILURE;
319 			goto done;
320 		}
321 
322 		/*
323 		 * If we don't COW now, on a user wire, the user will never
324 		 * be able to write to the mapping.  If we don't make this
325 		 * restriction, the bookkeeping would be nearly impossible.
326 		 */
327 		if ((fs.entry->protection & VM_PROT_WRITE) == 0)
328 			fs.entry->max_protection &= ~VM_PROT_WRITE;
329 	}
330 
331 	/*
332 	 * fs.map is read-locked
333 	 *
334 	 * Misc checks.  Save the map generation number to detect races.
335 	 */
336 	fs.map_generation = fs.map->timestamp;
337 
338 	if (fs.entry->eflags & (MAP_ENTRY_NOFAULT | MAP_ENTRY_KSTACK)) {
339 		if (fs.entry->eflags & MAP_ENTRY_NOFAULT) {
340 			panic("vm_fault: fault on nofault entry, addr: %p",
341 			      (void *)vaddr);
342 		}
343 		if ((fs.entry->eflags & MAP_ENTRY_KSTACK) &&
344 		    vaddr >= fs.entry->start &&
345 		    vaddr < fs.entry->start + PAGE_SIZE) {
346 			panic("vm_fault: fault on stack guard, addr: %p",
347 			      (void *)vaddr);
348 		}
349 	}
350 
351 	/*
352 	 * A system map entry may return a NULL object.  No object means
353 	 * no pager means an unrecoverable kernel fault.
354 	 */
355 	if (fs.first_object == NULL) {
356 		panic("vm_fault: unrecoverable fault at %p in entry %p",
357 			(void *)vaddr, fs.entry);
358 	}
359 
360 	/*
361 	 * Bump the paging-in-progress count to prevent size changes (e.g.
362 	 * truncation operations) during I/O.  This must be done after
363 	 * obtaining the vnode lock in order to avoid possible deadlocks.
364 	 */
365 	vm_object_hold(fs.first_object);
366 	fs.vp = vnode_pager_lock(fs.first_object);
367 
368 	fs.lookup_still_valid = TRUE;
369 	fs.first_m = NULL;
370 	fs.object = fs.first_object;	/* so unlock_and_deallocate works */
371 
372 	/*
373 	 * If the entry is wired we cannot change the page protection.
374 	 */
375 	if (fs.wired)
376 		fault_type = fs.first_prot;
377 
378 	/*
379 	 * The page we want is at (first_object, first_pindex), but if the
380 	 * vm_map_entry is VM_MAPTYPE_VPAGETABLE we have to traverse the
381 	 * page table to figure out the actual pindex.
382 	 *
383 	 * NOTE!  DEVELOPMENT IN PROGRESS, THIS IS AN INITIAL IMPLEMENTATION
384 	 * ONLY
385 	 */
386 	if (fs.entry->maptype == VM_MAPTYPE_VPAGETABLE) {
387 		result = vm_fault_vpagetable(&fs, &first_pindex,
388 					     fs.entry->aux.master_pde,
389 					     fault_type);
390 		if (result == KERN_TRY_AGAIN) {
391 			vm_object_drop(fs.first_object);
392 			goto RetryFault;
393 		}
394 		if (result != KERN_SUCCESS)
395 			goto done;
396 	}
397 
398 	/*
399 	 * Now we have the actual (object, pindex), fault in the page.  If
400 	 * vm_fault_object() fails it will unlock and deallocate the FS
401 	 * data.   If it succeeds everything remains locked and fs->object
402 	 * will have an additional PIP count if it is not equal to
403 	 * fs->first_object
404 	 *
405 	 * vm_fault_object will set fs->prot for the pmap operation.  It is
406 	 * allowed to set VM_PROT_WRITE if fault_type == VM_PROT_READ if the
407 	 * page can be safely written.  However, it will force a read-only
408 	 * mapping for a read fault if the memory is managed by a virtual
409 	 * page table.
410 	 */
411 	/* BEFORE */
412 	result = vm_fault_object(&fs, first_pindex, fault_type);
413 
414 	if (result == KERN_TRY_AGAIN) {
415 		vm_object_drop(fs.first_object);
416 		goto RetryFault;
417 	}
418 	if (result != KERN_SUCCESS)
419 		goto done;
420 
421 	/*
422 	 * On success vm_fault_object() does not unlock or deallocate, and fs.m
423 	 * will contain a busied page.
424 	 *
425 	 * Enter the page into the pmap and do pmap-related adjustments.
426 	 */
427 	vm_page_flag_set(fs.m, PG_REFERENCED);
428 	pmap_enter(fs.map->pmap, vaddr, fs.m, fs.prot, fs.wired);
429 
430 	/*KKASSERT(fs.m->queue == PQ_NONE); page-in op may deactivate page */
431 	KKASSERT(fs.m->flags & PG_BUSY);
432 
433 	/*
434 	 * If the page is not wired down, then put it where the pageout daemon
435 	 * can find it.
436 	 */
437 	if (fs.fault_flags & VM_FAULT_WIRE_MASK) {
438 		if (fs.wired)
439 			vm_page_wire(fs.m);
440 		else
441 			vm_page_unwire(fs.m, 1);
442 	} else {
443 		vm_page_activate(fs.m);
444 	}
445 	vm_page_wakeup(fs.m);
446 
447 	/*
448 	 * Burst in a few more pages if possible.  The fs.map should still
449 	 * be locked.  To avoid interlocking against a vnode->getblk
450 	 * operation we had to be sure to unbusy our primary vm_page above
451 	 * first.
452 	 */
453 	if (fault_flags & VM_FAULT_BURST) {
454 		if ((fs.fault_flags & VM_FAULT_WIRE_MASK) == 0 &&
455 		    fs.wired == 0) {
456 			vm_prefault(fs.map->pmap, vaddr, fs.entry, fs.prot);
457 		}
458 	}
459 
460 	/*
461 	 * Unlock everything, and return
462 	 */
463 	unlock_things(&fs);
464 
465 	if (curthread->td_lwp) {
466 		if (fs.hardfault) {
467 			curthread->td_lwp->lwp_ru.ru_majflt++;
468 		} else {
469 			curthread->td_lwp->lwp_ru.ru_minflt++;
470 		}
471 	}
472 
473 	/*vm_object_deallocate(fs.first_object);*/
474 	/*fs.m = NULL; */
475 	/*fs.first_object = NULL; must still drop later */
476 
477 	result = KERN_SUCCESS;
478 done:
479 	if (fs.first_object)
480 		vm_object_drop(fs.first_object);
481 	lwkt_reltoken(&map->token);
482 	return (result);
483 }
484 
485 /*
486  * Fault in the specified virtual address in the current process map,
487  * returning a held VM page or NULL.  See vm_fault_page() for more
488  * information.
489  *
490  * No requirements.
491  */
492 vm_page_t
493 vm_fault_page_quick(vm_offset_t va, vm_prot_t fault_type, int *errorp)
494 {
495 	struct lwp *lp = curthread->td_lwp;
496 	vm_page_t m;
497 
498 	m = vm_fault_page(&lp->lwp_vmspace->vm_map, va,
499 			  fault_type, VM_FAULT_NORMAL, errorp);
500 	return(m);
501 }
502 
503 /*
504  * Fault in the specified virtual address in the specified map, doing all
505  * necessary manipulation of the object store and all necessary I/O.  Return
506  * a held VM page or NULL, and set *errorp.  The related pmap is not
507  * updated.
508  *
509  * The returned page will be properly dirtied if VM_PROT_WRITE was specified,
510  * and marked PG_REFERENCED as well.
511  *
512  * If the page cannot be faulted writable and VM_PROT_WRITE was specified, an
513  * error will be returned.
514  *
515  * No requirements.
516  */
517 vm_page_t
518 vm_fault_page(vm_map_t map, vm_offset_t vaddr, vm_prot_t fault_type,
519 	      int fault_flags, int *errorp)
520 {
521 	vm_pindex_t first_pindex;
522 	struct faultstate fs;
523 	int result;
524 	vm_prot_t orig_fault_type = fault_type;
525 
526 	mycpu->gd_cnt.v_vm_faults++;
527 
528 	fs.hardfault = 0;
529 	fs.fault_flags = fault_flags;
530 	KKASSERT((fault_flags & VM_FAULT_WIRE_MASK) == 0);
531 
532 	lwkt_gettoken(&map->token);
533 
534 RetryFault:
535 	/*
536 	 * Find the vm_map_entry representing the backing store and resolve
537 	 * the top level object and page index.  This may have the side
538 	 * effect of executing a copy-on-write on the map entry and/or
539 	 * creating a shadow object, but will not COW any actual VM pages.
540 	 *
541 	 * On success fs.map is left read-locked and various other fields
542 	 * are initialized but not otherwise referenced or locked.
543 	 *
544 	 * NOTE!  vm_map_lookup will upgrade the fault_type to VM_FAULT_WRITE
545 	 * if the map entry is a virtual page table and also writable,
546 	 * so we can set the 'A'accessed bit in the virtual page table entry.
547 	 */
548 	fs.map = map;
549 	result = vm_map_lookup(&fs.map, vaddr, fault_type,
550 			       &fs.entry, &fs.first_object,
551 			       &first_pindex, &fs.first_prot, &fs.wired);
552 
553 	if (result != KERN_SUCCESS) {
554 		*errorp = result;
555 		fs.m = NULL;
556 		goto done;
557 	}
558 
559 	/*
560 	 * fs.map is read-locked
561 	 *
562 	 * Misc checks.  Save the map generation number to detect races.
563 	 */
564 	fs.map_generation = fs.map->timestamp;
565 
566 	if (fs.entry->eflags & MAP_ENTRY_NOFAULT) {
567 		panic("vm_fault: fault on nofault entry, addr: %lx",
568 		    (u_long)vaddr);
569 	}
570 
571 	/*
572 	 * A system map entry may return a NULL object.  No object means
573 	 * no pager means an unrecoverable kernel fault.
574 	 */
575 	if (fs.first_object == NULL) {
576 		panic("vm_fault: unrecoverable fault at %p in entry %p",
577 			(void *)vaddr, fs.entry);
578 	}
579 
580 	/*
581 	 * Make a reference to this object to prevent its disposal while we
582 	 * are messing with it.  Once we have the reference, the map is free
583 	 * to be diddled.  Since objects reference their shadows (and copies),
584 	 * they will stay around as well.
585 	 *
586 	 * The reference should also prevent an unexpected collapse of the
587 	 * parent that might move pages from the current object into the
588 	 * parent unexpectedly, resulting in corruption.
589 	 *
590 	 * Bump the paging-in-progress count to prevent size changes (e.g.
591 	 * truncation operations) during I/O.  This must be done after
592 	 * obtaining the vnode lock in order to avoid possible deadlocks.
593 	 */
594 	vm_object_hold(fs.first_object);
595 	fs.vp = vnode_pager_lock(fs.first_object);
596 
597 	fs.lookup_still_valid = TRUE;
598 	fs.first_m = NULL;
599 	fs.object = fs.first_object;	/* so unlock_and_deallocate works */
600 
601 	/*
602 	 * If the entry is wired we cannot change the page protection.
603 	 */
604 	if (fs.wired)
605 		fault_type = fs.first_prot;
606 
607 	/*
608 	 * The page we want is at (first_object, first_pindex), but if the
609 	 * vm_map_entry is VM_MAPTYPE_VPAGETABLE we have to traverse the
610 	 * page table to figure out the actual pindex.
611 	 *
612 	 * NOTE!  DEVELOPMENT IN PROGRESS, THIS IS AN INITIAL IMPLEMENTATION
613 	 * ONLY
614 	 */
615 	if (fs.entry->maptype == VM_MAPTYPE_VPAGETABLE) {
616 		result = vm_fault_vpagetable(&fs, &first_pindex,
617 					     fs.entry->aux.master_pde,
618 					     fault_type);
619 		if (result == KERN_TRY_AGAIN) {
620 			vm_object_drop(fs.first_object);
621 			goto RetryFault;
622 		}
623 		if (result != KERN_SUCCESS) {
624 			*errorp = result;
625 			fs.m = NULL;
626 			goto done;
627 		}
628 	}
629 
630 	/*
631 	 * Now we have the actual (object, pindex), fault in the page.  If
632 	 * vm_fault_object() fails it will unlock and deallocate the FS
633 	 * data.   If it succeeds everything remains locked and fs->object
634 	 * will have an additinal PIP count if it is not equal to
635 	 * fs->first_object
636 	 */
637 	result = vm_fault_object(&fs, first_pindex, fault_type);
638 
639 	if (result == KERN_TRY_AGAIN) {
640 		vm_object_drop(fs.first_object);
641 		goto RetryFault;
642 	}
643 	if (result != KERN_SUCCESS) {
644 		*errorp = result;
645 		fs.m = NULL;
646 		goto done;
647 	}
648 
649 	if ((orig_fault_type & VM_PROT_WRITE) &&
650 	    (fs.prot & VM_PROT_WRITE) == 0) {
651 		*errorp = KERN_PROTECTION_FAILURE;
652 		unlock_and_deallocate(&fs);
653 		fs.m = NULL;
654 		goto done;
655 	}
656 
657 	/*
658 	 * Update the pmap.  We really only have to do this if a COW
659 	 * occured to replace the read-only page with the new page.  For
660 	 * now just do it unconditionally. XXX
661 	 */
662 	pmap_enter(fs.map->pmap, vaddr, fs.m, fs.prot, fs.wired);
663 	vm_page_flag_set(fs.m, PG_REFERENCED);
664 
665 	/*
666 	 * On success vm_fault_object() does not unlock or deallocate, and fs.m
667 	 * will contain a busied page.  So we must unlock here after having
668 	 * messed with the pmap.
669 	 */
670 	unlock_things(&fs);
671 
672 	/*
673 	 * Return a held page.  We are not doing any pmap manipulation so do
674 	 * not set PG_MAPPED.  However, adjust the page flags according to
675 	 * the fault type because the caller may not use a managed pmapping
676 	 * (so we don't want to lose the fact that the page will be dirtied
677 	 * if a write fault was specified).
678 	 */
679 	vm_page_hold(fs.m);
680 	if (fault_type & VM_PROT_WRITE)
681 		vm_page_dirty(fs.m);
682 
683 	/*
684 	 * Unbusy the page by activating it.  It remains held and will not
685 	 * be reclaimed.
686 	 */
687 	vm_page_activate(fs.m);
688 
689 	if (curthread->td_lwp) {
690 		if (fs.hardfault) {
691 			curthread->td_lwp->lwp_ru.ru_majflt++;
692 		} else {
693 			curthread->td_lwp->lwp_ru.ru_minflt++;
694 		}
695 	}
696 
697 	/*
698 	 * Unlock everything, and return the held page.
699 	 */
700 	vm_page_wakeup(fs.m);
701 	/*vm_object_deallocate(fs.first_object);*/
702 	/*fs.first_object = NULL; */
703 	*errorp = 0;
704 
705 done:
706 	if (fs.first_object)
707 		vm_object_drop(fs.first_object);
708 	lwkt_reltoken(&map->token);
709 	return(fs.m);
710 }
711 
712 /*
713  * Fault in the specified (object,offset), dirty the returned page as
714  * needed.  If the requested fault_type cannot be done NULL and an
715  * error is returned.
716  *
717  * A held (but not busied) page is returned.
718  *
719  * No requirements.
720  */
721 vm_page_t
722 vm_fault_object_page(vm_object_t object, vm_ooffset_t offset,
723 		     vm_prot_t fault_type, int fault_flags, int *errorp)
724 {
725 	int result;
726 	vm_pindex_t first_pindex;
727 	struct faultstate fs;
728 	struct vm_map_entry entry;
729 
730 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(object));
731 	bzero(&entry, sizeof(entry));
732 	entry.object.vm_object = object;
733 	entry.maptype = VM_MAPTYPE_NORMAL;
734 	entry.protection = entry.max_protection = fault_type;
735 
736 	fs.hardfault = 0;
737 	fs.fault_flags = fault_flags;
738 	fs.map = NULL;
739 	KKASSERT((fault_flags & VM_FAULT_WIRE_MASK) == 0);
740 
741 RetryFault:
742 
743 	fs.first_object = object;
744 	first_pindex = OFF_TO_IDX(offset);
745 	fs.entry = &entry;
746 	fs.first_prot = fault_type;
747 	fs.wired = 0;
748 	/*fs.map_generation = 0; unused */
749 
750 	/*
751 	 * Make a reference to this object to prevent its disposal while we
752 	 * are messing with it.  Once we have the reference, the map is free
753 	 * to be diddled.  Since objects reference their shadows (and copies),
754 	 * they will stay around as well.
755 	 *
756 	 * The reference should also prevent an unexpected collapse of the
757 	 * parent that might move pages from the current object into the
758 	 * parent unexpectedly, resulting in corruption.
759 	 *
760 	 * Bump the paging-in-progress count to prevent size changes (e.g.
761 	 * truncation operations) during I/O.  This must be done after
762 	 * obtaining the vnode lock in order to avoid possible deadlocks.
763 	 */
764 	fs.vp = vnode_pager_lock(fs.first_object);
765 
766 	fs.lookup_still_valid = TRUE;
767 	fs.first_m = NULL;
768 	fs.object = fs.first_object;	/* so unlock_and_deallocate works */
769 
770 #if 0
771 	/* XXX future - ability to operate on VM object using vpagetable */
772 	if (fs.entry->maptype == VM_MAPTYPE_VPAGETABLE) {
773 		result = vm_fault_vpagetable(&fs, &first_pindex,
774 					     fs.entry->aux.master_pde,
775 					     fault_type);
776 		if (result == KERN_TRY_AGAIN)
777 			goto RetryFault;
778 		if (result != KERN_SUCCESS) {
779 			*errorp = result;
780 			return (NULL);
781 		}
782 	}
783 #endif
784 
785 	/*
786 	 * Now we have the actual (object, pindex), fault in the page.  If
787 	 * vm_fault_object() fails it will unlock and deallocate the FS
788 	 * data.   If it succeeds everything remains locked and fs->object
789 	 * will have an additinal PIP count if it is not equal to
790 	 * fs->first_object
791 	 */
792 	result = vm_fault_object(&fs, first_pindex, fault_type);
793 
794 	if (result == KERN_TRY_AGAIN)
795 		goto RetryFault;
796 	if (result != KERN_SUCCESS) {
797 		*errorp = result;
798 		return(NULL);
799 	}
800 
801 	if ((fault_type & VM_PROT_WRITE) && (fs.prot & VM_PROT_WRITE) == 0) {
802 		*errorp = KERN_PROTECTION_FAILURE;
803 		unlock_and_deallocate(&fs);
804 		return(NULL);
805 	}
806 
807 	/*
808 	 * On success vm_fault_object() does not unlock or deallocate, so we
809 	 * do it here.  Note that the returned fs.m will be busied.
810 	 */
811 	unlock_things(&fs);
812 
813 	/*
814 	 * Return a held page.  We are not doing any pmap manipulation so do
815 	 * not set PG_MAPPED.  However, adjust the page flags according to
816 	 * the fault type because the caller may not use a managed pmapping
817 	 * (so we don't want to lose the fact that the page will be dirtied
818 	 * if a write fault was specified).
819 	 */
820 	vm_page_hold(fs.m);
821 	if (fault_type & VM_PROT_WRITE)
822 		vm_page_dirty(fs.m);
823 
824 	if (fault_flags & VM_FAULT_DIRTY)
825 		vm_page_dirty(fs.m);
826 	if (fault_flags & VM_FAULT_UNSWAP)
827 		swap_pager_unswapped(fs.m);
828 
829 	/*
830 	 * Indicate that the page was accessed.
831 	 */
832 	vm_page_flag_set(fs.m, PG_REFERENCED);
833 
834 	/*
835 	 * Unbusy the page by activating it.  It remains held and will not
836 	 * be reclaimed.
837 	 */
838 	vm_page_activate(fs.m);
839 
840 	if (curthread->td_lwp) {
841 		if (fs.hardfault) {
842 			mycpu->gd_cnt.v_vm_faults++;
843 			curthread->td_lwp->lwp_ru.ru_majflt++;
844 		} else {
845 			curthread->td_lwp->lwp_ru.ru_minflt++;
846 		}
847 	}
848 
849 	/*
850 	 * Unlock everything, and return the held page.
851 	 */
852 	vm_page_wakeup(fs.m);
853 	/*vm_object_deallocate(fs.first_object);*/
854 	/*fs.first_object = NULL; */
855 
856 	*errorp = 0;
857 	return(fs.m);
858 }
859 
860 /*
861  * Translate the virtual page number (first_pindex) that is relative
862  * to the address space into a logical page number that is relative to the
863  * backing object.  Use the virtual page table pointed to by (vpte).
864  *
865  * This implements an N-level page table.  Any level can terminate the
866  * scan by setting VPTE_PS.   A linear mapping is accomplished by setting
867  * VPTE_PS in the master page directory entry set via mcontrol(MADV_SETMAP).
868  */
869 static
870 int
871 vm_fault_vpagetable(struct faultstate *fs, vm_pindex_t *pindex,
872 		    vpte_t vpte, int fault_type)
873 {
874 	struct lwbuf *lwb;
875 	struct lwbuf lwb_cache;
876 	int vshift = VPTE_FRAME_END - PAGE_SHIFT; /* index bits remaining */
877 	int result = KERN_SUCCESS;
878 	vpte_t *ptep;
879 
880 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(fs->first_object));
881 	for (;;) {
882 		/*
883 		 * We cannot proceed if the vpte is not valid, not readable
884 		 * for a read fault, or not writable for a write fault.
885 		 */
886 		if ((vpte & VPTE_V) == 0) {
887 			unlock_and_deallocate(fs);
888 			return (KERN_FAILURE);
889 		}
890 		if ((fault_type & VM_PROT_READ) && (vpte & VPTE_R) == 0) {
891 			unlock_and_deallocate(fs);
892 			return (KERN_FAILURE);
893 		}
894 		if ((fault_type & VM_PROT_WRITE) && (vpte & VPTE_W) == 0) {
895 			unlock_and_deallocate(fs);
896 			return (KERN_FAILURE);
897 		}
898 		if ((vpte & VPTE_PS) || vshift == 0)
899 			break;
900 		KKASSERT(vshift >= VPTE_PAGE_BITS);
901 
902 		/*
903 		 * Get the page table page.  Nominally we only read the page
904 		 * table, but since we are actively setting VPTE_M and VPTE_A,
905 		 * tell vm_fault_object() that we are writing it.
906 		 *
907 		 * There is currently no real need to optimize this.
908 		 */
909 		result = vm_fault_object(fs, (vpte & VPTE_FRAME) >> PAGE_SHIFT,
910 					 VM_PROT_READ|VM_PROT_WRITE);
911 		if (result != KERN_SUCCESS)
912 			return (result);
913 
914 		/*
915 		 * Process the returned fs.m and look up the page table
916 		 * entry in the page table page.
917 		 */
918 		vshift -= VPTE_PAGE_BITS;
919 		lwb = lwbuf_alloc(fs->m, &lwb_cache);
920 		ptep = ((vpte_t *)lwbuf_kva(lwb) +
921 		        ((*pindex >> vshift) & VPTE_PAGE_MASK));
922 		vpte = *ptep;
923 
924 		/*
925 		 * Page table write-back.  If the vpte is valid for the
926 		 * requested operation, do a write-back to the page table.
927 		 *
928 		 * XXX VPTE_M is not set properly for page directory pages.
929 		 * It doesn't get set in the page directory if the page table
930 		 * is modified during a read access.
931 		 */
932 		if ((fault_type & VM_PROT_WRITE) && (vpte & VPTE_V) &&
933 		    (vpte & VPTE_W)) {
934 			if ((vpte & (VPTE_M|VPTE_A)) != (VPTE_M|VPTE_A)) {
935 				atomic_set_long(ptep, VPTE_M | VPTE_A);
936 				vm_page_dirty(fs->m);
937 			}
938 		}
939 		if ((fault_type & VM_PROT_READ) && (vpte & VPTE_V) &&
940 		    (vpte & VPTE_R)) {
941 			if ((vpte & VPTE_A) == 0) {
942 				atomic_set_long(ptep, VPTE_A);
943 				vm_page_dirty(fs->m);
944 			}
945 		}
946 		lwbuf_free(lwb);
947 		vm_page_flag_set(fs->m, PG_REFERENCED);
948 		vm_page_activate(fs->m);
949 		vm_page_wakeup(fs->m);
950 		fs->m = NULL;
951 		cleanup_successful_fault(fs);
952 	}
953 	/*
954 	 * Combine remaining address bits with the vpte.
955 	 */
956 	/* JG how many bits from each? */
957 	*pindex = ((vpte & VPTE_FRAME) >> PAGE_SHIFT) +
958 		  (*pindex & ((1L << vshift) - 1));
959 	return (KERN_SUCCESS);
960 }
961 
962 
963 /*
964  * This is the core of the vm_fault code.
965  *
966  * Do all operations required to fault-in (fs.first_object, pindex).  Run
967  * through the shadow chain as necessary and do required COW or virtual
968  * copy operations.  The caller has already fully resolved the vm_map_entry
969  * and, if appropriate, has created a copy-on-write layer.  All we need to
970  * do is iterate the object chain.
971  *
972  * On failure (fs) is unlocked and deallocated and the caller may return or
973  * retry depending on the failure code.  On success (fs) is NOT unlocked or
974  * deallocated, fs.m will contained a resolved, busied page, and fs.object
975  * will have an additional PIP count if it is not equal to fs.first_object.
976  *
977  * fs->first_object must be held on call.
978  */
979 static
980 int
981 vm_fault_object(struct faultstate *fs,
982 		vm_pindex_t first_pindex, vm_prot_t fault_type)
983 {
984 	vm_object_t next_object;
985 	vm_pindex_t pindex;
986 	int error;
987 
988 	ASSERT_LWKT_TOKEN_HELD(vm_object_token(fs->first_object));
989 	fs->prot = fs->first_prot;
990 	fs->object = fs->first_object;
991 	pindex = first_pindex;
992 
993 	vm_object_chain_acquire(fs->first_object);
994 	vm_object_pip_add(fs->first_object, 1);
995 
996 	/*
997 	 * If a read fault occurs we try to make the page writable if
998 	 * possible.  There are three cases where we cannot make the
999 	 * page mapping writable:
1000 	 *
1001 	 * (1) The mapping is read-only or the VM object is read-only,
1002 	 *     fs->prot above will simply not have VM_PROT_WRITE set.
1003 	 *
1004 	 * (2) If the mapping is a virtual page table we need to be able
1005 	 *     to detect writes so we can set VPTE_M in the virtual page
1006 	 *     table.
1007 	 *
1008 	 * (3) If the VM page is read-only or copy-on-write, upgrading would
1009 	 *     just result in an unnecessary COW fault.
1010 	 *
1011 	 * VM_PROT_VPAGED is set if faulting via a virtual page table and
1012 	 * causes adjustments to the 'M'odify bit to also turn off write
1013 	 * access to force a re-fault.
1014 	 */
1015 	if (fs->entry->maptype == VM_MAPTYPE_VPAGETABLE) {
1016 		if ((fault_type & VM_PROT_WRITE) == 0)
1017 			fs->prot &= ~VM_PROT_WRITE;
1018 	}
1019 
1020 	/* vm_object_hold(fs->object); implied b/c object == first_object */
1021 
1022 	for (;;) {
1023 		/*
1024 		 * The entire backing chain from first_object to object
1025 		 * inclusive is chainlocked.
1026 		 *
1027 		 * If the object is dead, we stop here
1028 		 */
1029 		if (fs->object->flags & OBJ_DEAD) {
1030 			vm_object_pip_wakeup(fs->first_object);
1031 			vm_object_chain_release_all(fs->first_object,
1032 						    fs->object);
1033 			if (fs->object != fs->first_object)
1034 				vm_object_drop(fs->object);
1035 			unlock_and_deallocate(fs);
1036 			return (KERN_PROTECTION_FAILURE);
1037 		}
1038 
1039 		/*
1040 		 * See if the page is resident.  Wait/Retry if the page is
1041 		 * busy (lots of stuff may have changed so we can't continue
1042 		 * in that case).
1043 		 *
1044 		 * We can theoretically allow the soft-busy case on a read
1045 		 * fault if the page is marked valid, but since such
1046 		 * pages are typically already pmap'd, putting that
1047 		 * special case in might be more effort then it is
1048 		 * worth.  We cannot under any circumstances mess
1049 		 * around with a vm_page_t->busy page except, perhaps,
1050 		 * to pmap it.
1051 		 */
1052 		fs->m = vm_page_lookup_busy_try(fs->object, pindex,
1053 						TRUE, &error);
1054 		if (error) {
1055 			vm_object_pip_wakeup(fs->first_object);
1056 			vm_object_chain_release_all(fs->first_object,
1057 						    fs->object);
1058 			if (fs->object != fs->first_object)
1059 				vm_object_drop(fs->object);
1060 			unlock_things(fs);
1061 			vm_page_sleep_busy(fs->m, TRUE, "vmpfw");
1062 			mycpu->gd_cnt.v_intrans++;
1063 			/*vm_object_deallocate(fs->first_object);*/
1064 			/*fs->first_object = NULL;*/
1065 			fs->m = NULL;
1066 			return (KERN_TRY_AGAIN);
1067 		}
1068 		if (fs->m) {
1069 			/*
1070 			 * The page is busied for us.
1071 			 *
1072 			 * If reactivating a page from PQ_CACHE we may have
1073 			 * to rate-limit.
1074 			 */
1075 			int queue = fs->m->queue;
1076 			vm_page_unqueue_nowakeup(fs->m);
1077 
1078 			if ((queue - fs->m->pc) == PQ_CACHE &&
1079 			    vm_page_count_severe()) {
1080 				vm_page_activate(fs->m);
1081 				vm_page_wakeup(fs->m);
1082 				fs->m = NULL;
1083 				vm_object_pip_wakeup(fs->first_object);
1084 				vm_object_chain_release_all(fs->first_object,
1085 							    fs->object);
1086 				if (fs->object != fs->first_object)
1087 					vm_object_drop(fs->object);
1088 				unlock_and_deallocate(fs);
1089 				vm_waitpfault();
1090 				return (KERN_TRY_AGAIN);
1091 			}
1092 
1093 			/*
1094 			 * If it still isn't completely valid (readable),
1095 			 * or if a read-ahead-mark is set on the VM page,
1096 			 * jump to readrest, else we found the page and
1097 			 * can return.
1098 			 *
1099 			 * We can release the spl once we have marked the
1100 			 * page busy.
1101 			 */
1102 			if (fs->m->object != &kernel_object) {
1103 				if ((fs->m->valid & VM_PAGE_BITS_ALL) !=
1104 				    VM_PAGE_BITS_ALL) {
1105 					goto readrest;
1106 				}
1107 				if (fs->m->flags & PG_RAM) {
1108 					if (debug_cluster)
1109 						kprintf("R");
1110 					vm_page_flag_clear(fs->m, PG_RAM);
1111 					goto readrest;
1112 				}
1113 			}
1114 			break; /* break to PAGE HAS BEEN FOUND */
1115 		}
1116 
1117 		/*
1118 		 * Page is not resident, If this is the search termination
1119 		 * or the pager might contain the page, allocate a new page.
1120 		 */
1121 		if (TRYPAGER(fs) || fs->object == fs->first_object) {
1122 			/*
1123 			 * If the page is beyond the object size we fail
1124 			 */
1125 			if (pindex >= fs->object->size) {
1126 				vm_object_pip_wakeup(fs->first_object);
1127 				vm_object_chain_release_all(fs->first_object,
1128 							    fs->object);
1129 				if (fs->object != fs->first_object)
1130 					vm_object_drop(fs->object);
1131 				unlock_and_deallocate(fs);
1132 				return (KERN_PROTECTION_FAILURE);
1133 			}
1134 
1135 			/*
1136 			 * Allocate a new page for this object/offset pair.
1137 			 *
1138 			 * It is possible for the allocation to race, so
1139 			 * handle the case.
1140 			 */
1141 			fs->m = NULL;
1142 			if (!vm_page_count_severe()) {
1143 				fs->m = vm_page_alloc(fs->object, pindex,
1144 				    ((fs->vp || fs->object->backing_object) ?
1145 					VM_ALLOC_NULL_OK | VM_ALLOC_NORMAL :
1146 					VM_ALLOC_NULL_OK | VM_ALLOC_NORMAL |
1147 					VM_ALLOC_ZERO));
1148 			}
1149 			if (fs->m == NULL) {
1150 				vm_object_pip_wakeup(fs->first_object);
1151 				vm_object_chain_release_all(fs->first_object,
1152 							    fs->object);
1153 				if (fs->object != fs->first_object)
1154 					vm_object_drop(fs->object);
1155 				unlock_and_deallocate(fs);
1156 				vm_waitpfault();
1157 				return (KERN_TRY_AGAIN);
1158 			}
1159 
1160 			/*
1161 			 * Fall through to readrest.  We have a new page which
1162 			 * will have to be paged (since m->valid will be 0).
1163 			 */
1164 		}
1165 
1166 readrest:
1167 		/*
1168 		 * We have found an invalid or partially valid page, a
1169 		 * page with a read-ahead mark which might be partially or
1170 		 * fully valid (and maybe dirty too), or we have allocated
1171 		 * a new page.
1172 		 *
1173 		 * Attempt to fault-in the page if there is a chance that the
1174 		 * pager has it, and potentially fault in additional pages
1175 		 * at the same time.
1176 		 *
1177 		 * If TRYPAGER is true then fs.m will be non-NULL and busied
1178 		 * for us.
1179 		 */
1180 		if (TRYPAGER(fs)) {
1181 			int rv;
1182 			int seqaccess;
1183 			u_char behavior = vm_map_entry_behavior(fs->entry);
1184 
1185 			if (behavior == MAP_ENTRY_BEHAV_RANDOM)
1186 				seqaccess = 0;
1187 			else
1188 				seqaccess = -1;
1189 
1190 			/*
1191 			 * If sequential access is detected then attempt
1192 			 * to deactivate/cache pages behind the scan to
1193 			 * prevent resource hogging.
1194 			 *
1195 			 * Use of PG_RAM to detect sequential access
1196 			 * also simulates multi-zone sequential access
1197 			 * detection for free.
1198 			 *
1199 			 * NOTE: Partially valid dirty pages cannot be
1200 			 *	 deactivated without causing NFS picemeal
1201 			 *	 writes to barf.
1202 			 */
1203 			if ((fs->first_object->type != OBJT_DEVICE) &&
1204 			    (behavior == MAP_ENTRY_BEHAV_SEQUENTIAL ||
1205                                 (behavior != MAP_ENTRY_BEHAV_RANDOM &&
1206 				 (fs->m->flags & PG_RAM)))
1207 			) {
1208 				vm_pindex_t scan_pindex;
1209 				int scan_count = 16;
1210 
1211 				if (first_pindex < 16) {
1212 					scan_pindex = 0;
1213 					scan_count = 0;
1214 				} else {
1215 					scan_pindex = first_pindex - 16;
1216 					if (scan_pindex < 16)
1217 						scan_count = scan_pindex;
1218 					else
1219 						scan_count = 16;
1220 				}
1221 
1222 				while (scan_count) {
1223 					vm_page_t mt;
1224 
1225 					mt = vm_page_lookup(fs->first_object,
1226 							    scan_pindex);
1227 					if (mt == NULL)
1228 						break;
1229 					if (vm_page_busy_try(mt, TRUE))
1230 						goto skip;
1231 
1232 					if (mt->valid != VM_PAGE_BITS_ALL) {
1233 						vm_page_wakeup(mt);
1234 						break;
1235 					}
1236 					if ((mt->flags &
1237 					     (PG_FICTITIOUS | PG_UNMANAGED)) ||
1238 					    mt->hold_count ||
1239 					    mt->wire_count)  {
1240 						vm_page_wakeup(mt);
1241 						goto skip;
1242 					}
1243 					if (mt->dirty == 0)
1244 						vm_page_test_dirty(mt);
1245 					if (mt->dirty) {
1246 						vm_page_protect(mt,
1247 								VM_PROT_NONE);
1248 						vm_page_deactivate(mt);
1249 						vm_page_wakeup(mt);
1250 					} else {
1251 						vm_page_cache(mt);
1252 					}
1253 skip:
1254 					--scan_count;
1255 					--scan_pindex;
1256 				}
1257 
1258 				seqaccess = 1;
1259 			}
1260 
1261 			/*
1262 			 * Avoid deadlocking against the map when doing I/O.
1263 			 * fs.object and the page is PG_BUSY'd.
1264 			 *
1265 			 * NOTE: Once unlocked, fs->entry can become stale
1266 			 *	 so this will NULL it out.
1267 			 *
1268 			 * NOTE: fs->entry is invalid until we relock the
1269 			 *	 map and verify that the timestamp has not
1270 			 *	 changed.
1271 			 */
1272 			unlock_map(fs);
1273 
1274 			/*
1275 			 * Acquire the page data.  We still hold a ref on
1276 			 * fs.object and the page has been PG_BUSY's.
1277 			 *
1278 			 * The pager may replace the page (for example, in
1279 			 * order to enter a fictitious page into the
1280 			 * object).  If it does so it is responsible for
1281 			 * cleaning up the passed page and properly setting
1282 			 * the new page PG_BUSY.
1283 			 *
1284 			 * If we got here through a PG_RAM read-ahead
1285 			 * mark the page may be partially dirty and thus
1286 			 * not freeable.  Don't bother checking to see
1287 			 * if the pager has the page because we can't free
1288 			 * it anyway.  We have to depend on the get_page
1289 			 * operation filling in any gaps whether there is
1290 			 * backing store or not.
1291 			 */
1292 			rv = vm_pager_get_page(fs->object, &fs->m, seqaccess);
1293 
1294 			if (rv == VM_PAGER_OK) {
1295 				/*
1296 				 * Relookup in case pager changed page. Pager
1297 				 * is responsible for disposition of old page
1298 				 * if moved.
1299 				 *
1300 				 * XXX other code segments do relookups too.
1301 				 * It's a bad abstraction that needs to be
1302 				 * fixed/removed.
1303 				 */
1304 				fs->m = vm_page_lookup(fs->object, pindex);
1305 				if (fs->m == NULL) {
1306 					vm_object_pip_wakeup(fs->first_object);
1307 					vm_object_chain_release_all(
1308 						fs->first_object, fs->object);
1309 					if (fs->object != fs->first_object)
1310 						vm_object_drop(fs->object);
1311 					unlock_and_deallocate(fs);
1312 					return (KERN_TRY_AGAIN);
1313 				}
1314 
1315 				++fs->hardfault;
1316 				break; /* break to PAGE HAS BEEN FOUND */
1317 			}
1318 
1319 			/*
1320 			 * Remove the bogus page (which does not exist at this
1321 			 * object/offset); before doing so, we must get back
1322 			 * our object lock to preserve our invariant.
1323 			 *
1324 			 * Also wake up any other process that may want to bring
1325 			 * in this page.
1326 			 *
1327 			 * If this is the top-level object, we must leave the
1328 			 * busy page to prevent another process from rushing
1329 			 * past us, and inserting the page in that object at
1330 			 * the same time that we are.
1331 			 */
1332 			if (rv == VM_PAGER_ERROR) {
1333 				if (curproc) {
1334 					kprintf("vm_fault: pager read error, "
1335 						"pid %d (%s)\n",
1336 						curproc->p_pid,
1337 						curproc->p_comm);
1338 				} else {
1339 					kprintf("vm_fault: pager read error, "
1340 						"thread %p (%s)\n",
1341 						curthread,
1342 						curproc->p_comm);
1343 				}
1344 			}
1345 
1346 			/*
1347 			 * Data outside the range of the pager or an I/O error
1348 			 *
1349 			 * The page may have been wired during the pagein,
1350 			 * e.g. by the buffer cache, and cannot simply be
1351 			 * freed.  Call vnode_pager_freepage() to deal with it.
1352 			 */
1353 			/*
1354 			 * XXX - the check for kernel_map is a kludge to work
1355 			 * around having the machine panic on a kernel space
1356 			 * fault w/ I/O error.
1357 			 */
1358 			if (((fs->map != &kernel_map) &&
1359 			    (rv == VM_PAGER_ERROR)) || (rv == VM_PAGER_BAD)) {
1360 				vnode_pager_freepage(fs->m);
1361 				fs->m = NULL;
1362 				vm_object_pip_wakeup(fs->first_object);
1363 				vm_object_chain_release_all(fs->first_object,
1364 							    fs->object);
1365 				if (fs->object != fs->first_object)
1366 					vm_object_drop(fs->object);
1367 				unlock_and_deallocate(fs);
1368 				if (rv == VM_PAGER_ERROR)
1369 					return (KERN_FAILURE);
1370 				else
1371 					return (KERN_PROTECTION_FAILURE);
1372 				/* NOT REACHED */
1373 			}
1374 			if (fs->object != fs->first_object) {
1375 				vnode_pager_freepage(fs->m);
1376 				fs->m = NULL;
1377 				/*
1378 				 * XXX - we cannot just fall out at this
1379 				 * point, m has been freed and is invalid!
1380 				 */
1381 			}
1382 		}
1383 
1384 		/*
1385 		 * We get here if the object has a default pager (or unwiring)
1386 		 * or the pager doesn't have the page.
1387 		 */
1388 		if (fs->object == fs->first_object)
1389 			fs->first_m = fs->m;
1390 
1391 		/*
1392 		 * Move on to the next object.  The chain lock should prevent
1393 		 * the backing_object from getting ripped out from under us.
1394 		 */
1395 		if ((next_object = fs->object->backing_object) != NULL) {
1396 			vm_object_hold(next_object);
1397 			vm_object_chain_acquire(next_object);
1398 			KKASSERT(next_object == fs->object->backing_object);
1399 			pindex += OFF_TO_IDX(fs->object->backing_object_offset);
1400 		}
1401 
1402 		if (next_object == NULL) {
1403 			/*
1404 			 * If there's no object left, fill the page in the top
1405 			 * object with zeros.
1406 			 */
1407 			if (fs->object != fs->first_object) {
1408 				if (fs->first_object->backing_object !=
1409 				    fs->object) {
1410 					vm_object_hold(fs->first_object->backing_object);
1411 				}
1412 				vm_object_chain_release_all(
1413 					fs->first_object->backing_object,
1414 					fs->object);
1415 				if (fs->first_object->backing_object !=
1416 				    fs->object) {
1417 					vm_object_drop(fs->first_object->backing_object);
1418 				}
1419 				vm_object_pip_wakeup(fs->object);
1420 				vm_object_drop(fs->object);
1421 				fs->object = fs->first_object;
1422 				pindex = first_pindex;
1423 				fs->m = fs->first_m;
1424 			}
1425 			fs->first_m = NULL;
1426 
1427 			/*
1428 			 * Zero the page if necessary and mark it valid.
1429 			 */
1430 			if ((fs->m->flags & PG_ZERO) == 0) {
1431 				vm_page_zero_fill(fs->m);
1432 			} else {
1433 #ifdef PMAP_DEBUG
1434 				pmap_page_assertzero(VM_PAGE_TO_PHYS(fs->m));
1435 #endif
1436 				vm_page_flag_clear(fs->m, PG_ZERO);
1437 				mycpu->gd_cnt.v_ozfod++;
1438 			}
1439 			mycpu->gd_cnt.v_zfod++;
1440 			fs->m->valid = VM_PAGE_BITS_ALL;
1441 			break;	/* break to PAGE HAS BEEN FOUND */
1442 		}
1443 		if (fs->object != fs->first_object) {
1444 			vm_object_pip_wakeup(fs->object);
1445 			vm_object_lock_swap();
1446 			vm_object_drop(fs->object);
1447 		}
1448 		KASSERT(fs->object != next_object,
1449 			("object loop %p", next_object));
1450 		fs->object = next_object;
1451 		vm_object_pip_add(fs->object, 1);
1452 	}
1453 
1454 	/*
1455 	 * PAGE HAS BEEN FOUND. [Loop invariant still holds -- the object lock
1456 	 * is held.]
1457 	 *
1458 	 * object still held.
1459 	 *
1460 	 * If the page is being written, but isn't already owned by the
1461 	 * top-level object, we have to copy it into a new page owned by the
1462 	 * top-level object.
1463 	 */
1464 	KASSERT((fs->m->flags & PG_BUSY) != 0,
1465 		("vm_fault: not busy after main loop"));
1466 
1467 	if (fs->object != fs->first_object) {
1468 		/*
1469 		 * We only really need to copy if we want to write it.
1470 		 */
1471 		if (fault_type & VM_PROT_WRITE) {
1472 			/*
1473 			 * This allows pages to be virtually copied from a
1474 			 * backing_object into the first_object, where the
1475 			 * backing object has no other refs to it, and cannot
1476 			 * gain any more refs.  Instead of a bcopy, we just
1477 			 * move the page from the backing object to the
1478 			 * first object.  Note that we must mark the page
1479 			 * dirty in the first object so that it will go out
1480 			 * to swap when needed.
1481 			 */
1482 			if (
1483 				/*
1484 				 * Map, if present, has not changed
1485 				 */
1486 				(fs->map == NULL ||
1487 				fs->map_generation == fs->map->timestamp) &&
1488 				/*
1489 				 * Only one shadow object
1490 				 */
1491 				(fs->object->shadow_count == 1) &&
1492 				/*
1493 				 * No COW refs, except us
1494 				 */
1495 				(fs->object->ref_count == 1) &&
1496 				/*
1497 				 * No one else can look this object up
1498 				 */
1499 				(fs->object->handle == NULL) &&
1500 				/*
1501 				 * No other ways to look the object up
1502 				 */
1503 				((fs->object->type == OBJT_DEFAULT) ||
1504 				 (fs->object->type == OBJT_SWAP)) &&
1505 				/*
1506 				 * We don't chase down the shadow chain
1507 				 */
1508 				(fs->object == fs->first_object->backing_object) &&
1509 
1510 				/*
1511 				 * grab the lock if we need to
1512 				 */
1513 				(fs->lookup_still_valid ||
1514 				 fs->map == NULL ||
1515 				 lockmgr(&fs->map->lock, LK_EXCLUSIVE|LK_NOWAIT) == 0)
1516 			    ) {
1517 				/*
1518 				 * (first_m) and (m) are both busied.  We have
1519 				 * move (m) into (first_m)'s object/pindex
1520 				 * in an atomic fashion, then free (first_m).
1521 				 *
1522 				 * first_object is held so second remove
1523 				 * followed by the rename should wind
1524 				 * up being atomic.  vm_page_free() might
1525 				 * block so we don't do it until after the
1526 				 * rename.
1527 				 */
1528 				fs->lookup_still_valid = 1;
1529 				vm_page_protect(fs->first_m, VM_PROT_NONE);
1530 				vm_page_remove(fs->first_m);
1531 				vm_page_rename(fs->m, fs->first_object,
1532 					       first_pindex);
1533 				vm_page_free(fs->first_m);
1534 				fs->first_m = fs->m;
1535 				fs->m = NULL;
1536 				mycpu->gd_cnt.v_cow_optim++;
1537 			} else {
1538 				/*
1539 				 * Oh, well, lets copy it.
1540 				 */
1541 				vm_page_copy(fs->m, fs->first_m);
1542 				vm_page_event(fs->m, VMEVENT_COW);
1543 			}
1544 
1545 			if (fs->m) {
1546 				/*
1547 				 * We no longer need the old page or object.
1548 				 */
1549 				release_page(fs);
1550 			}
1551 
1552 			/*
1553 			 * We intend to revert to first_object, undo the
1554 			 * chain lock through to that.
1555 			 */
1556 			if (fs->first_object->backing_object != fs->object)
1557 				vm_object_hold(fs->first_object->backing_object);
1558 			vm_object_chain_release_all(
1559 					fs->first_object->backing_object,
1560 					fs->object);
1561 			if (fs->first_object->backing_object != fs->object)
1562 				vm_object_drop(fs->first_object->backing_object);
1563 
1564 			/*
1565 			 * fs->object != fs->first_object due to above
1566 			 * conditional
1567 			 */
1568 			vm_object_pip_wakeup(fs->object);
1569 			vm_object_drop(fs->object);
1570 
1571 			/*
1572 			 * Only use the new page below...
1573 			 */
1574 
1575 			mycpu->gd_cnt.v_cow_faults++;
1576 			fs->m = fs->first_m;
1577 			fs->object = fs->first_object;
1578 			pindex = first_pindex;
1579 		} else {
1580 			/*
1581 			 * If it wasn't a write fault avoid having to copy
1582 			 * the page by mapping it read-only.
1583 			 */
1584 			fs->prot &= ~VM_PROT_WRITE;
1585 		}
1586 	}
1587 
1588 	/*
1589 	 * Relock the map if necessary, then check the generation count.
1590 	 * relock_map() will update fs->timestamp to account for the
1591 	 * relocking if necessary.
1592 	 *
1593 	 * If the count has changed after relocking then all sorts of
1594 	 * crap may have happened and we have to retry.
1595 	 *
1596 	 * NOTE: The relock_map() can fail due to a deadlock against
1597 	 *	 the vm_page we are holding BUSY.
1598 	 */
1599 	if (fs->lookup_still_valid == FALSE && fs->map) {
1600 		if (relock_map(fs) ||
1601 		    fs->map->timestamp != fs->map_generation) {
1602 			release_page(fs);
1603 			vm_object_pip_wakeup(fs->first_object);
1604 			vm_object_chain_release_all(fs->first_object,
1605 						    fs->object);
1606 			if (fs->object != fs->first_object)
1607 				vm_object_drop(fs->object);
1608 			unlock_and_deallocate(fs);
1609 			return (KERN_TRY_AGAIN);
1610 		}
1611 	}
1612 
1613 	/*
1614 	 * If the fault is a write, we know that this page is being
1615 	 * written NOW so dirty it explicitly to save on pmap_is_modified()
1616 	 * calls later.
1617 	 *
1618 	 * If this is a NOSYNC mmap we do not want to set PG_NOSYNC
1619 	 * if the page is already dirty to prevent data written with
1620 	 * the expectation of being synced from not being synced.
1621 	 * Likewise if this entry does not request NOSYNC then make
1622 	 * sure the page isn't marked NOSYNC.  Applications sharing
1623 	 * data should use the same flags to avoid ping ponging.
1624 	 *
1625 	 * Also tell the backing pager, if any, that it should remove
1626 	 * any swap backing since the page is now dirty.
1627 	 */
1628 	if (fs->prot & VM_PROT_WRITE) {
1629 		vm_object_set_writeable_dirty(fs->m->object);
1630 		vm_set_nosync(fs->m, fs->entry);
1631 		if (fs->fault_flags & VM_FAULT_DIRTY) {
1632 			vm_page_dirty(fs->m);
1633 			swap_pager_unswapped(fs->m);
1634 		}
1635 	}
1636 
1637 	vm_object_pip_wakeup(fs->first_object);
1638 	vm_object_chain_release_all(fs->first_object, fs->object);
1639 	if (fs->object != fs->first_object)
1640 		vm_object_drop(fs->object);
1641 
1642 	/*
1643 	 * Page had better still be busy.  We are still locked up and
1644 	 * fs->object will have another PIP reference if it is not equal
1645 	 * to fs->first_object.
1646 	 */
1647 	KASSERT(fs->m->flags & PG_BUSY,
1648 		("vm_fault: page %p not busy!", fs->m));
1649 
1650 	/*
1651 	 * Sanity check: page must be completely valid or it is not fit to
1652 	 * map into user space.  vm_pager_get_pages() ensures this.
1653 	 */
1654 	if (fs->m->valid != VM_PAGE_BITS_ALL) {
1655 		vm_page_zero_invalid(fs->m, TRUE);
1656 		kprintf("Warning: page %p partially invalid on fault\n", fs->m);
1657 	}
1658 	vm_page_flag_clear(fs->m, PG_ZERO);
1659 
1660 	return (KERN_SUCCESS);
1661 }
1662 
1663 /*
1664  * Wire down a range of virtual addresses in a map.  The entry in question
1665  * should be marked in-transition and the map must be locked.  We must
1666  * release the map temporarily while faulting-in the page to avoid a
1667  * deadlock.  Note that the entry may be clipped while we are blocked but
1668  * will never be freed.
1669  *
1670  * No requirements.
1671  */
1672 int
1673 vm_fault_wire(vm_map_t map, vm_map_entry_t entry, boolean_t user_wire)
1674 {
1675 	boolean_t fictitious;
1676 	vm_offset_t start;
1677 	vm_offset_t end;
1678 	vm_offset_t va;
1679 	vm_paddr_t pa;
1680 	vm_page_t m;
1681 	pmap_t pmap;
1682 	int rv;
1683 
1684 	lwkt_gettoken(&map->token);
1685 
1686 	pmap = vm_map_pmap(map);
1687 	start = entry->start;
1688 	end = entry->end;
1689 	fictitious = entry->object.vm_object &&
1690 			(entry->object.vm_object->type == OBJT_DEVICE);
1691 	if (entry->eflags & MAP_ENTRY_KSTACK)
1692 		start += PAGE_SIZE;
1693 	map->timestamp++;
1694 	vm_map_unlock(map);
1695 
1696 	/*
1697 	 * We simulate a fault to get the page and enter it in the physical
1698 	 * map.
1699 	 */
1700 	for (va = start; va < end; va += PAGE_SIZE) {
1701 		if (user_wire) {
1702 			rv = vm_fault(map, va, VM_PROT_READ,
1703 					VM_FAULT_USER_WIRE);
1704 		} else {
1705 			rv = vm_fault(map, va, VM_PROT_READ|VM_PROT_WRITE,
1706 					VM_FAULT_CHANGE_WIRING);
1707 		}
1708 		if (rv) {
1709 			while (va > start) {
1710 				va -= PAGE_SIZE;
1711 				if ((pa = pmap_extract(pmap, va)) == 0)
1712 					continue;
1713 				pmap_change_wiring(pmap, va, FALSE);
1714 				if (!fictitious) {
1715 					m = PHYS_TO_VM_PAGE(pa);
1716 					vm_page_busy_wait(m, FALSE, "vmwrpg");
1717 					vm_page_unwire(m, 1);
1718 					vm_page_wakeup(m);
1719 				}
1720 			}
1721 			goto done;
1722 		}
1723 	}
1724 	rv = KERN_SUCCESS;
1725 done:
1726 	vm_map_lock(map);
1727 	lwkt_reltoken(&map->token);
1728 	return (rv);
1729 }
1730 
1731 /*
1732  * Unwire a range of virtual addresses in a map.  The map should be
1733  * locked.
1734  */
1735 void
1736 vm_fault_unwire(vm_map_t map, vm_map_entry_t entry)
1737 {
1738 	boolean_t fictitious;
1739 	vm_offset_t start;
1740 	vm_offset_t end;
1741 	vm_offset_t va;
1742 	vm_paddr_t pa;
1743 	vm_page_t m;
1744 	pmap_t pmap;
1745 
1746 	lwkt_gettoken(&map->token);
1747 
1748 	pmap = vm_map_pmap(map);
1749 	start = entry->start;
1750 	end = entry->end;
1751 	fictitious = entry->object.vm_object &&
1752 			(entry->object.vm_object->type == OBJT_DEVICE);
1753 	if (entry->eflags & MAP_ENTRY_KSTACK)
1754 		start += PAGE_SIZE;
1755 
1756 	/*
1757 	 * Since the pages are wired down, we must be able to get their
1758 	 * mappings from the physical map system.
1759 	 */
1760 	for (va = start; va < end; va += PAGE_SIZE) {
1761 		pa = pmap_extract(pmap, va);
1762 		if (pa != 0) {
1763 			pmap_change_wiring(pmap, va, FALSE);
1764 			if (!fictitious) {
1765 				m = PHYS_TO_VM_PAGE(pa);
1766 				vm_page_busy_wait(m, FALSE, "vmwupg");
1767 				vm_page_unwire(m, 1);
1768 				vm_page_wakeup(m);
1769 			}
1770 		}
1771 	}
1772 	lwkt_reltoken(&map->token);
1773 }
1774 
1775 /*
1776  * Copy all of the pages from a wired-down map entry to another.
1777  *
1778  * The source and destination maps must be locked for write.
1779  * The source and destination maps token must be held
1780  * The source map entry must be wired down (or be a sharing map
1781  * entry corresponding to a main map entry that is wired down).
1782  *
1783  * No other requirements.
1784  */
1785 void
1786 vm_fault_copy_entry(vm_map_t dst_map, vm_map_t src_map,
1787 		    vm_map_entry_t dst_entry, vm_map_entry_t src_entry)
1788 {
1789 	vm_object_t dst_object;
1790 	vm_object_t src_object;
1791 	vm_ooffset_t dst_offset;
1792 	vm_ooffset_t src_offset;
1793 	vm_prot_t prot;
1794 	vm_offset_t vaddr;
1795 	vm_page_t dst_m;
1796 	vm_page_t src_m;
1797 
1798 	src_object = src_entry->object.vm_object;
1799 	src_offset = src_entry->offset;
1800 
1801 	/*
1802 	 * Create the top-level object for the destination entry. (Doesn't
1803 	 * actually shadow anything - we copy the pages directly.)
1804 	 */
1805 	vm_map_entry_allocate_object(dst_entry);
1806 	dst_object = dst_entry->object.vm_object;
1807 
1808 	prot = dst_entry->max_protection;
1809 
1810 	/*
1811 	 * Loop through all of the pages in the entry's range, copying each
1812 	 * one from the source object (it should be there) to the destination
1813 	 * object.
1814 	 */
1815 	for (vaddr = dst_entry->start, dst_offset = 0;
1816 	    vaddr < dst_entry->end;
1817 	    vaddr += PAGE_SIZE, dst_offset += PAGE_SIZE) {
1818 
1819 		/*
1820 		 * Allocate a page in the destination object
1821 		 */
1822 		do {
1823 			dst_m = vm_page_alloc(dst_object,
1824 					      OFF_TO_IDX(dst_offset),
1825 					      VM_ALLOC_NORMAL);
1826 			if (dst_m == NULL) {
1827 				vm_wait(0);
1828 			}
1829 		} while (dst_m == NULL);
1830 
1831 		/*
1832 		 * Find the page in the source object, and copy it in.
1833 		 * (Because the source is wired down, the page will be in
1834 		 * memory.)
1835 		 */
1836 		src_m = vm_page_lookup(src_object,
1837 				       OFF_TO_IDX(dst_offset + src_offset));
1838 		if (src_m == NULL)
1839 			panic("vm_fault_copy_wired: page missing");
1840 
1841 		vm_page_copy(src_m, dst_m);
1842 		vm_page_event(src_m, VMEVENT_COW);
1843 
1844 		/*
1845 		 * Enter it in the pmap...
1846 		 */
1847 
1848 		vm_page_flag_clear(dst_m, PG_ZERO);
1849 		pmap_enter(dst_map->pmap, vaddr, dst_m, prot, FALSE);
1850 
1851 		/*
1852 		 * Mark it no longer busy, and put it on the active list.
1853 		 */
1854 		vm_page_activate(dst_m);
1855 		vm_page_wakeup(dst_m);
1856 	}
1857 }
1858 
1859 #if 0
1860 
1861 /*
1862  * This routine checks around the requested page for other pages that
1863  * might be able to be faulted in.  This routine brackets the viable
1864  * pages for the pages to be paged in.
1865  *
1866  * Inputs:
1867  *	m, rbehind, rahead
1868  *
1869  * Outputs:
1870  *  marray (array of vm_page_t), reqpage (index of requested page)
1871  *
1872  * Return value:
1873  *  number of pages in marray
1874  */
1875 static int
1876 vm_fault_additional_pages(vm_page_t m, int rbehind, int rahead,
1877 			  vm_page_t *marray, int *reqpage)
1878 {
1879 	int i,j;
1880 	vm_object_t object;
1881 	vm_pindex_t pindex, startpindex, endpindex, tpindex;
1882 	vm_page_t rtm;
1883 	int cbehind, cahead;
1884 
1885 	object = m->object;
1886 	pindex = m->pindex;
1887 
1888 	/*
1889 	 * we don't fault-ahead for device pager
1890 	 */
1891 	if (object->type == OBJT_DEVICE) {
1892 		*reqpage = 0;
1893 		marray[0] = m;
1894 		return 1;
1895 	}
1896 
1897 	/*
1898 	 * if the requested page is not available, then give up now
1899 	 */
1900 	if (!vm_pager_has_page(object, pindex, &cbehind, &cahead)) {
1901 		*reqpage = 0;	/* not used by caller, fix compiler warn */
1902 		return 0;
1903 	}
1904 
1905 	if ((cbehind == 0) && (cahead == 0)) {
1906 		*reqpage = 0;
1907 		marray[0] = m;
1908 		return 1;
1909 	}
1910 
1911 	if (rahead > cahead) {
1912 		rahead = cahead;
1913 	}
1914 
1915 	if (rbehind > cbehind) {
1916 		rbehind = cbehind;
1917 	}
1918 
1919 	/*
1920 	 * Do not do any readahead if we have insufficient free memory.
1921 	 *
1922 	 * XXX code was broken disabled before and has instability
1923 	 * with this conditonal fixed, so shortcut for now.
1924 	 */
1925 	if (burst_fault == 0 || vm_page_count_severe()) {
1926 		marray[0] = m;
1927 		*reqpage = 0;
1928 		return 1;
1929 	}
1930 
1931 	/*
1932 	 * scan backward for the read behind pages -- in memory
1933 	 *
1934 	 * Assume that if the page is not found an interrupt will not
1935 	 * create it.  Theoretically interrupts can only remove (busy)
1936 	 * pages, not create new associations.
1937 	 */
1938 	if (pindex > 0) {
1939 		if (rbehind > pindex) {
1940 			rbehind = pindex;
1941 			startpindex = 0;
1942 		} else {
1943 			startpindex = pindex - rbehind;
1944 		}
1945 
1946 		vm_object_hold(object);
1947 		for (tpindex = pindex; tpindex > startpindex; --tpindex) {
1948 			if (vm_page_lookup(object, tpindex - 1))
1949 				break;
1950 		}
1951 
1952 		i = 0;
1953 		while (tpindex < pindex) {
1954 			rtm = vm_page_alloc(object, tpindex, VM_ALLOC_SYSTEM |
1955 							     VM_ALLOC_NULL_OK);
1956 			if (rtm == NULL) {
1957 				for (j = 0; j < i; j++) {
1958 					vm_page_free(marray[j]);
1959 				}
1960 				vm_object_drop(object);
1961 				marray[0] = m;
1962 				*reqpage = 0;
1963 				return 1;
1964 			}
1965 			marray[i] = rtm;
1966 			++i;
1967 			++tpindex;
1968 		}
1969 		vm_object_drop(object);
1970 	} else {
1971 		i = 0;
1972 	}
1973 
1974 	/*
1975 	 * Assign requested page
1976 	 */
1977 	marray[i] = m;
1978 	*reqpage = i;
1979 	++i;
1980 
1981 	/*
1982 	 * Scan forwards for read-ahead pages
1983 	 */
1984 	tpindex = pindex + 1;
1985 	endpindex = tpindex + rahead;
1986 	if (endpindex > object->size)
1987 		endpindex = object->size;
1988 
1989 	vm_object_hold(object);
1990 	while (tpindex < endpindex) {
1991 		if (vm_page_lookup(object, tpindex))
1992 			break;
1993 		rtm = vm_page_alloc(object, tpindex, VM_ALLOC_SYSTEM |
1994 						     VM_ALLOC_NULL_OK);
1995 		if (rtm == NULL)
1996 			break;
1997 		marray[i] = rtm;
1998 		++i;
1999 		++tpindex;
2000 	}
2001 	vm_object_drop(object);
2002 
2003 	return (i);
2004 }
2005 
2006 #endif
2007 
2008 /*
2009  * vm_prefault() provides a quick way of clustering pagefaults into a
2010  * processes address space.  It is a "cousin" of pmap_object_init_pt,
2011  * except it runs at page fault time instead of mmap time.
2012  *
2013  * vm.fast_fault	Enables pre-faulting zero-fill pages
2014  *
2015  * vm.prefault_pages	Number of pages (1/2 negative, 1/2 positive) to
2016  *			prefault.  Scan stops in either direction when
2017  *			a page is found to already exist.
2018  *
2019  * This code used to be per-platform pmap_prefault().  It is now
2020  * machine-independent and enhanced to also pre-fault zero-fill pages
2021  * (see vm.fast_fault) as well as make them writable, which greatly
2022  * reduces the number of page faults programs incur.
2023  *
2024  * Application performance when pre-faulting zero-fill pages is heavily
2025  * dependent on the application.  Very tiny applications like /bin/echo
2026  * lose a little performance while applications of any appreciable size
2027  * gain performance.  Prefaulting multiple pages also reduces SMP
2028  * congestion and can improve SMP performance significantly.
2029  *
2030  * NOTE!  prot may allow writing but this only applies to the top level
2031  *	  object.  If we wind up mapping a page extracted from a backing
2032  *	  object we have to make sure it is read-only.
2033  *
2034  * NOTE!  The caller has already handled any COW operations on the
2035  *	  vm_map_entry via the normal fault code.  Do NOT call this
2036  *	  shortcut unless the normal fault code has run on this entry.
2037  *
2038  * The related map must be locked.
2039  * No other requirements.
2040  */
2041 static int vm_prefault_pages = 8;
2042 SYSCTL_INT(_vm, OID_AUTO, prefault_pages, CTLFLAG_RW, &vm_prefault_pages, 0,
2043 	   "Maximum number of pages to pre-fault");
2044 static int vm_fast_fault = 1;
2045 SYSCTL_INT(_vm, OID_AUTO, fast_fault, CTLFLAG_RW, &vm_fast_fault, 0,
2046 	   "Burst fault zero-fill regions");
2047 
2048 /*
2049  * Set PG_NOSYNC if the map entry indicates so, but only if the page
2050  * is not already dirty by other means.  This will prevent passive
2051  * filesystem syncing as well as 'sync' from writing out the page.
2052  */
2053 static void
2054 vm_set_nosync(vm_page_t m, vm_map_entry_t entry)
2055 {
2056 	if (entry->eflags & MAP_ENTRY_NOSYNC) {
2057 		if (m->dirty == 0)
2058 			vm_page_flag_set(m, PG_NOSYNC);
2059 	} else {
2060 		vm_page_flag_clear(m, PG_NOSYNC);
2061 	}
2062 }
2063 
2064 static void
2065 vm_prefault(pmap_t pmap, vm_offset_t addra, vm_map_entry_t entry, int prot)
2066 {
2067 	struct lwp *lp;
2068 	vm_page_t m;
2069 	vm_offset_t addr;
2070 	vm_pindex_t index;
2071 	vm_pindex_t pindex;
2072 	vm_object_t object;
2073 	int pprot;
2074 	int i;
2075 	int noneg;
2076 	int nopos;
2077 	int maxpages;
2078 
2079 	/*
2080 	 * Get stable max count value, disabled if set to 0
2081 	 */
2082 	maxpages = vm_prefault_pages;
2083 	cpu_ccfence();
2084 	if (maxpages <= 0)
2085 		return;
2086 
2087 	/*
2088 	 * We do not currently prefault mappings that use virtual page
2089 	 * tables.  We do not prefault foreign pmaps.
2090 	 */
2091 	if (entry->maptype == VM_MAPTYPE_VPAGETABLE)
2092 		return;
2093 	lp = curthread->td_lwp;
2094 	if (lp == NULL || (pmap != vmspace_pmap(lp->lwp_vmspace)))
2095 		return;
2096 
2097 	/*
2098 	 * Limit pre-fault count to 1024 pages.
2099 	 */
2100 	if (maxpages > 1024)
2101 		maxpages = 1024;
2102 
2103 	object = entry->object.vm_object;
2104 	KKASSERT(object != NULL);
2105 	vm_object_hold(object);
2106 	KKASSERT(object == entry->object.vm_object);
2107 	vm_object_chain_acquire(object);
2108 
2109 	noneg = 0;
2110 	nopos = 0;
2111 	for (i = 0; i < maxpages; ++i) {
2112 		vm_object_t lobject;
2113 		vm_object_t nobject;
2114 		int allocated = 0;
2115 		int error;
2116 
2117 		/*
2118 		 * This can eat a lot of time on a heavily contended
2119 		 * machine so yield on the tick if needed.
2120 		 */
2121 		if ((i & 7) == 7)
2122 			lwkt_yield();
2123 
2124 		/*
2125 		 * Calculate the page to pre-fault, stopping the scan in
2126 		 * each direction separately if the limit is reached.
2127 		 */
2128 		if (i & 1) {
2129 			if (noneg)
2130 				continue;
2131 			addr = addra - ((i + 1) >> 1) * PAGE_SIZE;
2132 		} else {
2133 			if (nopos)
2134 				continue;
2135 			addr = addra + ((i + 2) >> 1) * PAGE_SIZE;
2136 		}
2137 		if (addr < entry->start) {
2138 			noneg = 1;
2139 			if (noneg && nopos)
2140 				break;
2141 			continue;
2142 		}
2143 		if (addr >= entry->end) {
2144 			nopos = 1;
2145 			if (noneg && nopos)
2146 				break;
2147 			continue;
2148 		}
2149 
2150 		/*
2151 		 * Skip pages already mapped, and stop scanning in that
2152 		 * direction.  When the scan terminates in both directions
2153 		 * we are done.
2154 		 */
2155 		if (pmap_prefault_ok(pmap, addr) == 0) {
2156 			if (i & 1)
2157 				noneg = 1;
2158 			else
2159 				nopos = 1;
2160 			if (noneg && nopos)
2161 				break;
2162 			continue;
2163 		}
2164 
2165 		/*
2166 		 * Follow the VM object chain to obtain the page to be mapped
2167 		 * into the pmap.
2168 		 *
2169 		 * If we reach the terminal object without finding a page
2170 		 * and we determine it would be advantageous, then allocate
2171 		 * a zero-fill page for the base object.  The base object
2172 		 * is guaranteed to be OBJT_DEFAULT for this case.
2173 		 *
2174 		 * In order to not have to check the pager via *haspage*()
2175 		 * we stop if any non-default object is encountered.  e.g.
2176 		 * a vnode or swap object would stop the loop.
2177 		 */
2178 		index = ((addr - entry->start) + entry->offset) >> PAGE_SHIFT;
2179 		lobject = object;
2180 		pindex = index;
2181 		pprot = prot;
2182 
2183 		KKASSERT(lobject == entry->object.vm_object);
2184 		/*vm_object_hold(lobject); implied */
2185 
2186 		while ((m = vm_page_lookup_busy_try(lobject, pindex,
2187 						    TRUE, &error)) == NULL) {
2188 			if (lobject->type != OBJT_DEFAULT)
2189 				break;
2190 			if (lobject->backing_object == NULL) {
2191 				if (vm_fast_fault == 0)
2192 					break;
2193 				if ((prot & VM_PROT_WRITE) == 0 ||
2194 				    vm_page_count_min(0)) {
2195 					break;
2196 				}
2197 
2198 				/*
2199 				 * NOTE: Allocated from base object
2200 				 */
2201 				m = vm_page_alloc(object, index,
2202 						  VM_ALLOC_NORMAL |
2203 						  VM_ALLOC_ZERO |
2204 						  VM_ALLOC_NULL_OK);
2205 				if (m == NULL)
2206 					break;
2207 
2208 				if ((m->flags & PG_ZERO) == 0) {
2209 					vm_page_zero_fill(m);
2210 				} else {
2211 #ifdef PMAP_DEBUG
2212 					pmap_page_assertzero(
2213 							VM_PAGE_TO_PHYS(m));
2214 #endif
2215 					vm_page_flag_clear(m, PG_ZERO);
2216 					mycpu->gd_cnt.v_ozfod++;
2217 				}
2218 				mycpu->gd_cnt.v_zfod++;
2219 				m->valid = VM_PAGE_BITS_ALL;
2220 				allocated = 1;
2221 				pprot = prot;
2222 				/* lobject = object .. not needed */
2223 				break;
2224 			}
2225 			if (lobject->backing_object_offset & PAGE_MASK)
2226 				break;
2227 			nobject = lobject->backing_object;
2228 			vm_object_hold(nobject);
2229 			KKASSERT(nobject == lobject->backing_object);
2230 			pindex += lobject->backing_object_offset >> PAGE_SHIFT;
2231 			if (lobject != object) {
2232 				vm_object_lock_swap();
2233 				vm_object_drop(lobject);
2234 			}
2235 			lobject = nobject;
2236 			pprot &= ~VM_PROT_WRITE;
2237 			vm_object_chain_acquire(lobject);
2238 		}
2239 
2240 		/*
2241 		 * NOTE: A non-NULL (m) will be associated with lobject if
2242 		 *	 it was found there, otherwise it is probably a
2243 		 *	 zero-fill page associated with the base object.
2244 		 *
2245 		 * Give-up if no page is available.
2246 		 */
2247 		if (m == NULL) {
2248 			if (lobject != object) {
2249 				if (object->backing_object != lobject)
2250 					vm_object_hold(object->backing_object);
2251 				vm_object_chain_release_all(
2252 					object->backing_object, lobject);
2253 				if (object->backing_object != lobject)
2254 					vm_object_drop(object->backing_object);
2255 				vm_object_drop(lobject);
2256 			}
2257 			break;
2258 		}
2259 
2260 		/*
2261 		 * Do not conditionalize on PG_RAM.  If pages are present in
2262 		 * the VM system we assume optimal caching.  If caching is
2263 		 * not optimal the I/O gravy train will be restarted when we
2264 		 * hit an unavailable page.  We do not want to try to restart
2265 		 * the gravy train now because we really don't know how much
2266 		 * of the object has been cached.  The cost for restarting
2267 		 * the gravy train should be low (since accesses will likely
2268 		 * be I/O bound anyway).
2269 		 *
2270 		 * The object must be marked dirty if we are mapping a
2271 		 * writable page.  m->object is either lobject or object,
2272 		 * both of which are still held.
2273 		 */
2274 		if (pprot & VM_PROT_WRITE)
2275 			vm_object_set_writeable_dirty(m->object);
2276 
2277 		if (lobject != object) {
2278 			if (object->backing_object != lobject)
2279 				vm_object_hold(object->backing_object);
2280 			vm_object_chain_release_all(object->backing_object,
2281 						    lobject);
2282 			if (object->backing_object != lobject)
2283 				vm_object_drop(object->backing_object);
2284 			vm_object_drop(lobject);
2285 		}
2286 
2287 		/*
2288 		 * Enter the page into the pmap if appropriate.  If we had
2289 		 * allocated the page we have to place it on a queue.  If not
2290 		 * we just have to make sure it isn't on the cache queue
2291 		 * (pages on the cache queue are not allowed to be mapped).
2292 		 */
2293 		if (allocated) {
2294 			if (pprot & VM_PROT_WRITE)
2295 				vm_set_nosync(m, entry);
2296 			pmap_enter(pmap, addr, m, pprot, 0);
2297 			vm_page_deactivate(m);
2298 			vm_page_wakeup(m);
2299 		} else if (error) {
2300 			/* couldn't busy page, no wakeup */
2301 		} else if (
2302 		    ((m->valid & VM_PAGE_BITS_ALL) == VM_PAGE_BITS_ALL) &&
2303 		    (m->flags & PG_FICTITIOUS) == 0) {
2304 			/*
2305 			 * A fully valid page not undergoing soft I/O can
2306 			 * be immediately entered into the pmap.
2307 			 */
2308 			if ((m->queue - m->pc) == PQ_CACHE)
2309 				vm_page_deactivate(m);
2310 			if (pprot & VM_PROT_WRITE)
2311 				vm_set_nosync(m, entry);
2312 			pmap_enter(pmap, addr, m, pprot, 0);
2313 			vm_page_wakeup(m);
2314 		} else {
2315 			vm_page_wakeup(m);
2316 		}
2317 	}
2318 	vm_object_chain_release(object);
2319 	vm_object_drop(object);
2320 }
2321