xref: /freebsd/sys/vm/vm_kern.c (revision a3c858005cae175e277f6f6735ca9eaea7eaf3c3)
1 /*-
2  * SPDX-License-Identifier: (BSD-3-Clause AND MIT-CMU)
3  *
4  * Copyright (c) 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * The Mach Operating System project at Carnegie-Mellon University.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *
35  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
36  * All rights reserved.
37  *
38  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
39  *
40  * Permission to use, copy, modify and distribute this software and
41  * its documentation is hereby granted, provided that both the copyright
42  * notice and this permission notice appear in all copies of the
43  * software, derivative works or modified versions, and any portions
44  * thereof, and that both notices appear in supporting documentation.
45  *
46  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
47  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
48  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
49  *
50  * Carnegie Mellon requests users of this software to return to
51  *
52  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
53  *  School of Computer Science
54  *  Carnegie Mellon University
55  *  Pittsburgh PA 15213-3890
56  *
57  * any improvements or extensions that they make and grant Carnegie the
58  * rights to redistribute these changes.
59  */
60 
61 /*
62  *	Kernel memory management.
63  */
64 
65 #include <sys/cdefs.h>
66 #include "opt_vm.h"
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/asan.h>
71 #include <sys/domainset.h>
72 #include <sys/eventhandler.h>
73 #include <sys/kernel.h>
74 #include <sys/lock.h>
75 #include <sys/malloc.h>
76 #include <sys/msan.h>
77 #include <sys/proc.h>
78 #include <sys/rwlock.h>
79 #include <sys/smp.h>
80 #include <sys/sysctl.h>
81 #include <sys/vmem.h>
82 #include <sys/vmmeter.h>
83 
84 #include <vm/vm.h>
85 #include <vm/vm_param.h>
86 #include <vm/vm_domainset.h>
87 #include <vm/vm_kern.h>
88 #include <vm/pmap.h>
89 #include <vm/vm_map.h>
90 #include <vm/vm_object.h>
91 #include <vm/vm_page.h>
92 #include <vm/vm_pageout.h>
93 #include <vm/vm_pagequeue.h>
94 #include <vm/vm_phys.h>
95 #include <vm/vm_radix.h>
96 #include <vm/vm_extern.h>
97 #include <vm/uma.h>
98 
99 struct vm_map kernel_map_store;
100 struct vm_map exec_map_store;
101 struct vm_map pipe_map_store;
102 
103 const void *zero_region;
104 CTASSERT((ZERO_REGION_SIZE & PAGE_MASK) == 0);
105 
106 /* NB: Used by kernel debuggers. */
107 const u_long vm_maxuser_address = VM_MAXUSER_ADDRESS;
108 
109 u_int exec_map_entry_size;
110 u_int exec_map_entries;
111 
112 SYSCTL_ULONG(_vm, OID_AUTO, min_kernel_address, CTLFLAG_RD,
113     SYSCTL_NULL_ULONG_PTR, VM_MIN_KERNEL_ADDRESS, "Min kernel address");
114 
115 SYSCTL_ULONG(_vm, OID_AUTO, max_kernel_address, CTLFLAG_RD,
116 #if defined(__arm__)
117     &vm_max_kernel_address, 0,
118 #else
119     SYSCTL_NULL_ULONG_PTR, VM_MAX_KERNEL_ADDRESS,
120 #endif
121     "Max kernel address");
122 
123 #if VM_NRESERVLEVEL > 0
124 #define	KVA_QUANTUM_SHIFT	(VM_LEVEL_0_ORDER + PAGE_SHIFT)
125 #else
126 /* On non-superpage architectures we want large import sizes. */
127 #define	KVA_QUANTUM_SHIFT	(8 + PAGE_SHIFT)
128 #endif
129 #define	KVA_QUANTUM		(1ul << KVA_QUANTUM_SHIFT)
130 #define	KVA_NUMA_IMPORT_QUANTUM	(KVA_QUANTUM * 128)
131 
132 extern void     uma_startup2(void);
133 
134 /*
135  *	kva_alloc:
136  *
137  *	Allocate a virtual address range with no underlying object and
138  *	no initial mapping to physical memory.  Any mapping from this
139  *	range to physical memory must be explicitly created prior to
140  *	its use, typically with pmap_qenter().  Any attempt to create
141  *	a mapping on demand through vm_fault() will result in a panic.
142  */
143 vm_offset_t
144 kva_alloc(vm_size_t size)
145 {
146 	vm_offset_t addr;
147 
148 	TSENTER();
149 	size = round_page(size);
150 	if (vmem_alloc(kernel_arena, size, M_BESTFIT | M_NOWAIT, &addr))
151 		return (0);
152 	TSEXIT();
153 
154 	return (addr);
155 }
156 
157 /*
158  *	kva_free:
159  *
160  *	Release a region of kernel virtual memory allocated
161  *	with kva_alloc, and return the physical pages
162  *	associated with that region.
163  *
164  *	This routine may not block on kernel maps.
165  */
166 void
167 kva_free(vm_offset_t addr, vm_size_t size)
168 {
169 
170 	size = round_page(size);
171 	vmem_free(kernel_arena, addr, size);
172 }
173 
174 /*
175  * Update sanitizer shadow state to reflect a new allocation.  Force inlining to
176  * help make KMSAN origin tracking more precise.
177  */
178 static __always_inline void
179 kmem_alloc_san(vm_offset_t addr, vm_size_t size, vm_size_t asize, int flags)
180 {
181 	if ((flags & M_ZERO) == 0) {
182 		kmsan_mark((void *)addr, asize, KMSAN_STATE_UNINIT);
183 		kmsan_orig((void *)addr, asize, KMSAN_TYPE_KMEM,
184 		    KMSAN_RET_ADDR);
185 	} else {
186 		kmsan_mark((void *)addr, asize, KMSAN_STATE_INITED);
187 	}
188 	kasan_mark((void *)addr, size, asize, KASAN_KMEM_REDZONE);
189 }
190 
191 static vm_page_t
192 kmem_alloc_contig_pages(vm_object_t object, vm_pindex_t pindex, int domain,
193     int pflags, u_long npages, vm_paddr_t low, vm_paddr_t high,
194     u_long alignment, vm_paddr_t boundary, vm_memattr_t memattr)
195 {
196 	vm_page_t m;
197 	int tries;
198 	bool wait, reclaim;
199 
200 	VM_OBJECT_ASSERT_WLOCKED(object);
201 
202 	wait = (pflags & VM_ALLOC_WAITOK) != 0;
203 	reclaim = (pflags & VM_ALLOC_NORECLAIM) == 0;
204 	pflags &= ~(VM_ALLOC_NOWAIT | VM_ALLOC_WAITOK | VM_ALLOC_WAITFAIL);
205 	pflags |= VM_ALLOC_NOWAIT;
206 	for (tries = wait ? 3 : 1;; tries--) {
207 		m = vm_page_alloc_contig_domain(object, pindex, domain, pflags,
208 		    npages, low, high, alignment, boundary, memattr);
209 		if (m != NULL || tries == 0 || !reclaim)
210 			break;
211 
212 		VM_OBJECT_WUNLOCK(object);
213 		if (!vm_page_reclaim_contig_domain(domain, pflags, npages,
214 		    low, high, alignment, boundary) && wait)
215 			vm_wait_domain(domain);
216 		VM_OBJECT_WLOCK(object);
217 	}
218 	return (m);
219 }
220 
221 /*
222  *	Allocates a region from the kernel address map and physical pages
223  *	within the specified address range to the kernel object.  Creates a
224  *	wired mapping from this region to these pages, and returns the
225  *	region's starting virtual address.  The allocated pages are not
226  *	necessarily physically contiguous.  If M_ZERO is specified through the
227  *	given flags, then the pages are zeroed before they are mapped.
228  */
229 static void *
230 kmem_alloc_attr_domain(int domain, vm_size_t size, int flags, vm_paddr_t low,
231     vm_paddr_t high, vm_memattr_t memattr)
232 {
233 	vmem_t *vmem;
234 	vm_object_t object;
235 	vm_offset_t addr, i, offset;
236 	vm_page_t m;
237 	vm_size_t asize;
238 	int pflags;
239 	vm_prot_t prot;
240 
241 	object = kernel_object;
242 	asize = round_page(size);
243 	vmem = vm_dom[domain].vmd_kernel_arena;
244 	if (vmem_alloc(vmem, asize, M_BESTFIT | flags, &addr))
245 		return (0);
246 	offset = addr - VM_MIN_KERNEL_ADDRESS;
247 	pflags = malloc2vm_flags(flags) | VM_ALLOC_WIRED;
248 	prot = (flags & M_EXEC) != 0 ? VM_PROT_ALL : VM_PROT_RW;
249 	VM_OBJECT_WLOCK(object);
250 	for (i = 0; i < asize; i += PAGE_SIZE) {
251 		m = kmem_alloc_contig_pages(object, atop(offset + i),
252 		    domain, pflags, 1, low, high, PAGE_SIZE, 0, memattr);
253 		if (m == NULL) {
254 			VM_OBJECT_WUNLOCK(object);
255 			kmem_unback(object, addr, i);
256 			vmem_free(vmem, addr, asize);
257 			return (0);
258 		}
259 		KASSERT(vm_page_domain(m) == domain,
260 		    ("kmem_alloc_attr_domain: Domain mismatch %d != %d",
261 		    vm_page_domain(m), domain));
262 		if ((flags & M_ZERO) && (m->flags & PG_ZERO) == 0)
263 			pmap_zero_page(m);
264 		vm_page_valid(m);
265 		pmap_enter(kernel_pmap, addr + i, m, prot,
266 		    prot | PMAP_ENTER_WIRED, 0);
267 	}
268 	VM_OBJECT_WUNLOCK(object);
269 	kmem_alloc_san(addr, size, asize, flags);
270 	return ((void *)addr);
271 }
272 
273 void *
274 kmem_alloc_attr(vm_size_t size, int flags, vm_paddr_t low, vm_paddr_t high,
275     vm_memattr_t memattr)
276 {
277 
278 	return (kmem_alloc_attr_domainset(DOMAINSET_RR(), size, flags, low,
279 	    high, memattr));
280 }
281 
282 void *
283 kmem_alloc_attr_domainset(struct domainset *ds, vm_size_t size, int flags,
284     vm_paddr_t low, vm_paddr_t high, vm_memattr_t memattr)
285 {
286 	struct vm_domainset_iter di;
287 	void *addr;
288 	int domain;
289 
290 	vm_domainset_iter_policy_init(&di, ds, &domain, &flags);
291 	do {
292 		addr = kmem_alloc_attr_domain(domain, size, flags, low, high,
293 		    memattr);
294 		if (addr != NULL)
295 			break;
296 	} while (vm_domainset_iter_policy(&di, &domain) == 0);
297 
298 	return (addr);
299 }
300 
301 /*
302  *	Allocates a region from the kernel address map and physically
303  *	contiguous pages within the specified address range to the kernel
304  *	object.  Creates a wired mapping from this region to these pages, and
305  *	returns the region's starting virtual address.  If M_ZERO is specified
306  *	through the given flags, then the pages are zeroed before they are
307  *	mapped.
308  */
309 static void *
310 kmem_alloc_contig_domain(int domain, vm_size_t size, int flags, vm_paddr_t low,
311     vm_paddr_t high, u_long alignment, vm_paddr_t boundary,
312     vm_memattr_t memattr)
313 {
314 	vmem_t *vmem;
315 	vm_object_t object;
316 	vm_offset_t addr, offset, tmp;
317 	vm_page_t end_m, m;
318 	vm_size_t asize;
319 	u_long npages;
320 	int pflags;
321 
322 	object = kernel_object;
323 	asize = round_page(size);
324 	vmem = vm_dom[domain].vmd_kernel_arena;
325 	if (vmem_alloc(vmem, asize, flags | M_BESTFIT, &addr))
326 		return (NULL);
327 	offset = addr - VM_MIN_KERNEL_ADDRESS;
328 	pflags = malloc2vm_flags(flags) | VM_ALLOC_WIRED;
329 	npages = atop(asize);
330 	VM_OBJECT_WLOCK(object);
331 	m = kmem_alloc_contig_pages(object, atop(offset), domain,
332 	    pflags, npages, low, high, alignment, boundary, memattr);
333 	if (m == NULL) {
334 		VM_OBJECT_WUNLOCK(object);
335 		vmem_free(vmem, addr, asize);
336 		return (NULL);
337 	}
338 	KASSERT(vm_page_domain(m) == domain,
339 	    ("kmem_alloc_contig_domain: Domain mismatch %d != %d",
340 	    vm_page_domain(m), domain));
341 	end_m = m + npages;
342 	tmp = addr;
343 	for (; m < end_m; m++) {
344 		if ((flags & M_ZERO) && (m->flags & PG_ZERO) == 0)
345 			pmap_zero_page(m);
346 		vm_page_valid(m);
347 		pmap_enter(kernel_pmap, tmp, m, VM_PROT_RW,
348 		    VM_PROT_RW | PMAP_ENTER_WIRED, 0);
349 		tmp += PAGE_SIZE;
350 	}
351 	VM_OBJECT_WUNLOCK(object);
352 	kmem_alloc_san(addr, size, asize, flags);
353 	return ((void *)addr);
354 }
355 
356 void *
357 kmem_alloc_contig(vm_size_t size, int flags, vm_paddr_t low, vm_paddr_t high,
358     u_long alignment, vm_paddr_t boundary, vm_memattr_t memattr)
359 {
360 
361 	return (kmem_alloc_contig_domainset(DOMAINSET_RR(), size, flags, low,
362 	    high, alignment, boundary, memattr));
363 }
364 
365 void *
366 kmem_alloc_contig_domainset(struct domainset *ds, vm_size_t size, int flags,
367     vm_paddr_t low, vm_paddr_t high, u_long alignment, vm_paddr_t boundary,
368     vm_memattr_t memattr)
369 {
370 	struct vm_domainset_iter di;
371 	void *addr;
372 	int domain;
373 
374 	vm_domainset_iter_policy_init(&di, ds, &domain, &flags);
375 	do {
376 		addr = kmem_alloc_contig_domain(domain, size, flags, low, high,
377 		    alignment, boundary, memattr);
378 		if (addr != NULL)
379 			break;
380 	} while (vm_domainset_iter_policy(&di, &domain) == 0);
381 
382 	return (addr);
383 }
384 
385 /*
386  *	kmem_subinit:
387  *
388  *	Initializes a map to manage a subrange
389  *	of the kernel virtual address space.
390  *
391  *	Arguments are as follows:
392  *
393  *	parent		Map to take range from
394  *	min, max	Returned endpoints of map
395  *	size		Size of range to find
396  *	superpage_align	Request that min is superpage aligned
397  */
398 void
399 kmem_subinit(vm_map_t map, vm_map_t parent, vm_offset_t *min, vm_offset_t *max,
400     vm_size_t size, bool superpage_align)
401 {
402 	int ret;
403 
404 	size = round_page(size);
405 
406 	*min = vm_map_min(parent);
407 	ret = vm_map_find(parent, NULL, 0, min, size, 0, superpage_align ?
408 	    VMFS_SUPER_SPACE : VMFS_ANY_SPACE, VM_PROT_ALL, VM_PROT_ALL,
409 	    MAP_ACC_NO_CHARGE);
410 	if (ret != KERN_SUCCESS)
411 		panic("kmem_subinit: bad status return of %d", ret);
412 	*max = *min + size;
413 	vm_map_init(map, vm_map_pmap(parent), *min, *max);
414 	if (vm_map_submap(parent, *min, *max, map) != KERN_SUCCESS)
415 		panic("kmem_subinit: unable to change range to submap");
416 }
417 
418 /*
419  *	kmem_malloc_domain:
420  *
421  *	Allocate wired-down pages in the kernel's address space.
422  */
423 static void *
424 kmem_malloc_domain(int domain, vm_size_t size, int flags)
425 {
426 	vmem_t *arena;
427 	vm_offset_t addr;
428 	vm_size_t asize;
429 	int rv;
430 
431 	if (__predict_true((flags & M_EXEC) == 0))
432 		arena = vm_dom[domain].vmd_kernel_arena;
433 	else
434 		arena = vm_dom[domain].vmd_kernel_rwx_arena;
435 	asize = round_page(size);
436 	if (vmem_alloc(arena, asize, flags | M_BESTFIT, &addr))
437 		return (0);
438 
439 	rv = kmem_back_domain(domain, kernel_object, addr, asize, flags);
440 	if (rv != KERN_SUCCESS) {
441 		vmem_free(arena, addr, asize);
442 		return (0);
443 	}
444 	kasan_mark((void *)addr, size, asize, KASAN_KMEM_REDZONE);
445 	return ((void *)addr);
446 }
447 
448 void *
449 kmem_malloc(vm_size_t size, int flags)
450 {
451 	void * p;
452 
453 	TSENTER();
454 	p = kmem_malloc_domainset(DOMAINSET_RR(), size, flags);
455 	TSEXIT();
456 	return (p);
457 }
458 
459 void *
460 kmem_malloc_domainset(struct domainset *ds, vm_size_t size, int flags)
461 {
462 	struct vm_domainset_iter di;
463 	void *addr;
464 	int domain;
465 
466 	vm_domainset_iter_policy_init(&di, ds, &domain, &flags);
467 	do {
468 		addr = kmem_malloc_domain(domain, size, flags);
469 		if (addr != NULL)
470 			break;
471 	} while (vm_domainset_iter_policy(&di, &domain) == 0);
472 
473 	return (addr);
474 }
475 
476 /*
477  *	kmem_back_domain:
478  *
479  *	Allocate physical pages from the specified domain for the specified
480  *	virtual address range.
481  */
482 int
483 kmem_back_domain(int domain, vm_object_t object, vm_offset_t addr,
484     vm_size_t size, int flags)
485 {
486 	vm_offset_t offset, i;
487 	vm_page_t m, mpred;
488 	vm_prot_t prot;
489 	int pflags;
490 
491 	KASSERT(object == kernel_object,
492 	    ("kmem_back_domain: only supports kernel object."));
493 
494 	offset = addr - VM_MIN_KERNEL_ADDRESS;
495 	pflags = malloc2vm_flags(flags) | VM_ALLOC_WIRED;
496 	pflags &= ~(VM_ALLOC_NOWAIT | VM_ALLOC_WAITOK | VM_ALLOC_WAITFAIL);
497 	if (flags & M_WAITOK)
498 		pflags |= VM_ALLOC_WAITFAIL;
499 	prot = (flags & M_EXEC) != 0 ? VM_PROT_ALL : VM_PROT_RW;
500 
501 	i = 0;
502 	VM_OBJECT_WLOCK(object);
503 retry:
504 	mpred = vm_radix_lookup_le(&object->rtree, atop(offset + i));
505 	for (; i < size; i += PAGE_SIZE, mpred = m) {
506 		m = vm_page_alloc_domain_after(object, atop(offset + i),
507 		    domain, pflags, mpred);
508 
509 		/*
510 		 * Ran out of space, free everything up and return. Don't need
511 		 * to lock page queues here as we know that the pages we got
512 		 * aren't on any queues.
513 		 */
514 		if (m == NULL) {
515 			if ((flags & M_NOWAIT) == 0)
516 				goto retry;
517 			VM_OBJECT_WUNLOCK(object);
518 			kmem_unback(object, addr, i);
519 			return (KERN_NO_SPACE);
520 		}
521 		KASSERT(vm_page_domain(m) == domain,
522 		    ("kmem_back_domain: Domain mismatch %d != %d",
523 		    vm_page_domain(m), domain));
524 		if (flags & M_ZERO && (m->flags & PG_ZERO) == 0)
525 			pmap_zero_page(m);
526 		KASSERT((m->oflags & VPO_UNMANAGED) != 0,
527 		    ("kmem_malloc: page %p is managed", m));
528 		vm_page_valid(m);
529 		pmap_enter(kernel_pmap, addr + i, m, prot,
530 		    prot | PMAP_ENTER_WIRED, 0);
531 		if (__predict_false((prot & VM_PROT_EXECUTE) != 0))
532 			m->oflags |= VPO_KMEM_EXEC;
533 	}
534 	VM_OBJECT_WUNLOCK(object);
535 	kmem_alloc_san(addr, size, size, flags);
536 	return (KERN_SUCCESS);
537 }
538 
539 /*
540  *	kmem_back:
541  *
542  *	Allocate physical pages for the specified virtual address range.
543  */
544 int
545 kmem_back(vm_object_t object, vm_offset_t addr, vm_size_t size, int flags)
546 {
547 	vm_offset_t end, next, start;
548 	int domain, rv;
549 
550 	KASSERT(object == kernel_object,
551 	    ("kmem_back: only supports kernel object."));
552 
553 	for (start = addr, end = addr + size; addr < end; addr = next) {
554 		/*
555 		 * We must ensure that pages backing a given large virtual page
556 		 * all come from the same physical domain.
557 		 */
558 		if (vm_ndomains > 1) {
559 			domain = (addr >> KVA_QUANTUM_SHIFT) % vm_ndomains;
560 			while (VM_DOMAIN_EMPTY(domain))
561 				domain++;
562 			next = roundup2(addr + 1, KVA_QUANTUM);
563 			if (next > end || next < start)
564 				next = end;
565 		} else {
566 			domain = 0;
567 			next = end;
568 		}
569 		rv = kmem_back_domain(domain, object, addr, next - addr, flags);
570 		if (rv != KERN_SUCCESS) {
571 			kmem_unback(object, start, addr - start);
572 			break;
573 		}
574 	}
575 	return (rv);
576 }
577 
578 /*
579  *	kmem_unback:
580  *
581  *	Unmap and free the physical pages underlying the specified virtual
582  *	address range.
583  *
584  *	A physical page must exist within the specified object at each index
585  *	that is being unmapped.
586  */
587 static struct vmem *
588 _kmem_unback(vm_object_t object, vm_offset_t addr, vm_size_t size)
589 {
590 	struct vmem *arena;
591 	vm_page_t m, next;
592 	vm_offset_t end, offset;
593 	int domain;
594 
595 	KASSERT(object == kernel_object,
596 	    ("kmem_unback: only supports kernel object."));
597 
598 	if (size == 0)
599 		return (NULL);
600 	pmap_remove(kernel_pmap, addr, addr + size);
601 	offset = addr - VM_MIN_KERNEL_ADDRESS;
602 	end = offset + size;
603 	VM_OBJECT_WLOCK(object);
604 	m = vm_page_lookup(object, atop(offset));
605 	domain = vm_page_domain(m);
606 	if (__predict_true((m->oflags & VPO_KMEM_EXEC) == 0))
607 		arena = vm_dom[domain].vmd_kernel_arena;
608 	else
609 		arena = vm_dom[domain].vmd_kernel_rwx_arena;
610 	for (; offset < end; offset += PAGE_SIZE, m = next) {
611 		next = vm_page_next(m);
612 		vm_page_xbusy_claim(m);
613 		vm_page_unwire_noq(m);
614 		vm_page_free(m);
615 	}
616 	VM_OBJECT_WUNLOCK(object);
617 
618 	return (arena);
619 }
620 
621 void
622 kmem_unback(vm_object_t object, vm_offset_t addr, vm_size_t size)
623 {
624 
625 	(void)_kmem_unback(object, addr, size);
626 }
627 
628 /*
629  *	kmem_free:
630  *
631  *	Free memory allocated with kmem_malloc.  The size must match the
632  *	original allocation.
633  */
634 void
635 kmem_free(void *addr, vm_size_t size)
636 {
637 	struct vmem *arena;
638 
639 	size = round_page(size);
640 	kasan_mark(addr, size, size, 0);
641 	arena = _kmem_unback(kernel_object, (uintptr_t)addr, size);
642 	if (arena != NULL)
643 		vmem_free(arena, (uintptr_t)addr, size);
644 }
645 
646 /*
647  *	kmap_alloc_wait:
648  *
649  *	Allocates pageable memory from a sub-map of the kernel.  If the submap
650  *	has no room, the caller sleeps waiting for more memory in the submap.
651  *
652  *	This routine may block.
653  */
654 vm_offset_t
655 kmap_alloc_wait(vm_map_t map, vm_size_t size)
656 {
657 	vm_offset_t addr;
658 
659 	size = round_page(size);
660 	if (!swap_reserve(size))
661 		return (0);
662 
663 	for (;;) {
664 		/*
665 		 * To make this work for more than one map, use the map's lock
666 		 * to lock out sleepers/wakers.
667 		 */
668 		vm_map_lock(map);
669 		addr = vm_map_findspace(map, vm_map_min(map), size);
670 		if (addr + size <= vm_map_max(map))
671 			break;
672 		/* no space now; see if we can ever get space */
673 		if (vm_map_max(map) - vm_map_min(map) < size) {
674 			vm_map_unlock(map);
675 			swap_release(size);
676 			return (0);
677 		}
678 		map->needs_wakeup = TRUE;
679 		vm_map_unlock_and_wait(map, 0);
680 	}
681 	vm_map_insert(map, NULL, 0, addr, addr + size, VM_PROT_RW, VM_PROT_RW,
682 	    MAP_ACC_CHARGED);
683 	vm_map_unlock(map);
684 	return (addr);
685 }
686 
687 /*
688  *	kmap_free_wakeup:
689  *
690  *	Returns memory to a submap of the kernel, and wakes up any processes
691  *	waiting for memory in that map.
692  */
693 void
694 kmap_free_wakeup(vm_map_t map, vm_offset_t addr, vm_size_t size)
695 {
696 
697 	vm_map_lock(map);
698 	(void) vm_map_delete(map, trunc_page(addr), round_page(addr + size));
699 	if (map->needs_wakeup) {
700 		map->needs_wakeup = FALSE;
701 		vm_map_wakeup(map);
702 	}
703 	vm_map_unlock(map);
704 }
705 
706 void
707 kmem_init_zero_region(void)
708 {
709 	vm_offset_t addr, i;
710 	vm_page_t m;
711 
712 	/*
713 	 * Map a single physical page of zeros to a larger virtual range.
714 	 * This requires less looping in places that want large amounts of
715 	 * zeros, while not using much more physical resources.
716 	 */
717 	addr = kva_alloc(ZERO_REGION_SIZE);
718 	m = vm_page_alloc_noobj(VM_ALLOC_WIRED | VM_ALLOC_ZERO);
719 	for (i = 0; i < ZERO_REGION_SIZE; i += PAGE_SIZE)
720 		pmap_qenter(addr + i, &m, 1);
721 	pmap_protect(kernel_pmap, addr, addr + ZERO_REGION_SIZE, VM_PROT_READ);
722 
723 	zero_region = (const void *)addr;
724 }
725 
726 /*
727  * Import KVA from the kernel map into the kernel arena.
728  */
729 static int
730 kva_import(void *unused, vmem_size_t size, int flags, vmem_addr_t *addrp)
731 {
732 	vm_offset_t addr;
733 	int result;
734 
735 	TSENTER();
736 	KASSERT((size % KVA_QUANTUM) == 0,
737 	    ("kva_import: Size %jd is not a multiple of %d",
738 	    (intmax_t)size, (int)KVA_QUANTUM));
739 	addr = vm_map_min(kernel_map);
740 	result = vm_map_find(kernel_map, NULL, 0, &addr, size, 0,
741 	    VMFS_SUPER_SPACE, VM_PROT_ALL, VM_PROT_ALL, MAP_NOFAULT);
742 	if (result != KERN_SUCCESS) {
743 		TSEXIT();
744                 return (ENOMEM);
745 	}
746 
747 	*addrp = addr;
748 
749 	TSEXIT();
750 	return (0);
751 }
752 
753 /*
754  * Import KVA from a parent arena into a per-domain arena.  Imports must be
755  * KVA_QUANTUM-aligned and a multiple of KVA_QUANTUM in size.
756  */
757 static int
758 kva_import_domain(void *arena, vmem_size_t size, int flags, vmem_addr_t *addrp)
759 {
760 
761 	KASSERT((size % KVA_QUANTUM) == 0,
762 	    ("kva_import_domain: Size %jd is not a multiple of %d",
763 	    (intmax_t)size, (int)KVA_QUANTUM));
764 	return (vmem_xalloc(arena, size, KVA_QUANTUM, 0, 0, VMEM_ADDR_MIN,
765 	    VMEM_ADDR_MAX, flags, addrp));
766 }
767 
768 /*
769  * 	kmem_init:
770  *
771  *	Create the kernel map; insert a mapping covering kernel text,
772  *	data, bss, and all space allocated thus far (`boostrap' data).  The
773  *	new map will thus map the range between VM_MIN_KERNEL_ADDRESS and
774  *	`start' as allocated, and the range between `start' and `end' as free.
775  *	Create the kernel vmem arena and its per-domain children.
776  */
777 void
778 kmem_init(vm_offset_t start, vm_offset_t end)
779 {
780 	vm_size_t quantum;
781 	int domain;
782 
783 	vm_map_init(kernel_map, kernel_pmap, VM_MIN_KERNEL_ADDRESS, end);
784 	kernel_map->system_map = 1;
785 	vm_map_lock(kernel_map);
786 	/* N.B.: cannot use kgdb to debug, starting with this assignment ... */
787 	(void)vm_map_insert(kernel_map, NULL, 0,
788 #ifdef __amd64__
789 	    KERNBASE,
790 #else
791 	    VM_MIN_KERNEL_ADDRESS,
792 #endif
793 	    start, VM_PROT_ALL, VM_PROT_ALL, MAP_NOFAULT);
794 	/* ... and ending with the completion of the above `insert' */
795 
796 #ifdef __amd64__
797 	/*
798 	 * Mark KVA used for the page array as allocated.  Other platforms
799 	 * that handle vm_page_array allocation can simply adjust virtual_avail
800 	 * instead.
801 	 */
802 	(void)vm_map_insert(kernel_map, NULL, 0, (vm_offset_t)vm_page_array,
803 	    (vm_offset_t)vm_page_array + round_2mpage(vm_page_array_size *
804 	    sizeof(struct vm_page)),
805 	    VM_PROT_RW, VM_PROT_RW, MAP_NOFAULT);
806 #endif
807 	vm_map_unlock(kernel_map);
808 
809 	/*
810 	 * Use a large import quantum on NUMA systems.  This helps minimize
811 	 * interleaving of superpages, reducing internal fragmentation within
812 	 * the per-domain arenas.
813 	 */
814 	if (vm_ndomains > 1 && PMAP_HAS_DMAP)
815 		quantum = KVA_NUMA_IMPORT_QUANTUM;
816 	else
817 		quantum = KVA_QUANTUM;
818 
819 	/*
820 	 * Initialize the kernel_arena.  This can grow on demand.
821 	 */
822 	vmem_init(kernel_arena, "kernel arena", 0, 0, PAGE_SIZE, 0, 0);
823 	vmem_set_import(kernel_arena, kva_import, NULL, NULL, quantum);
824 
825 	for (domain = 0; domain < vm_ndomains; domain++) {
826 		/*
827 		 * Initialize the per-domain arenas.  These are used to color
828 		 * the KVA space in a way that ensures that virtual large pages
829 		 * are backed by memory from the same physical domain,
830 		 * maximizing the potential for superpage promotion.
831 		 */
832 		vm_dom[domain].vmd_kernel_arena = vmem_create(
833 		    "kernel arena domain", 0, 0, PAGE_SIZE, 0, M_WAITOK);
834 		vmem_set_import(vm_dom[domain].vmd_kernel_arena,
835 		    kva_import_domain, NULL, kernel_arena, quantum);
836 
837 		/*
838 		 * In architectures with superpages, maintain separate arenas
839 		 * for allocations with permissions that differ from the
840 		 * "standard" read/write permissions used for kernel memory,
841 		 * so as not to inhibit superpage promotion.
842 		 *
843 		 * Use the base import quantum since this arena is rarely used.
844 		 */
845 #if VM_NRESERVLEVEL > 0
846 		vm_dom[domain].vmd_kernel_rwx_arena = vmem_create(
847 		    "kernel rwx arena domain", 0, 0, PAGE_SIZE, 0, M_WAITOK);
848 		vmem_set_import(vm_dom[domain].vmd_kernel_rwx_arena,
849 		    kva_import_domain, (vmem_release_t *)vmem_xfree,
850 		    kernel_arena, KVA_QUANTUM);
851 #else
852 		vm_dom[domain].vmd_kernel_rwx_arena =
853 		    vm_dom[domain].vmd_kernel_arena;
854 #endif
855 	}
856 
857 	/*
858 	 * This must be the very first call so that the virtual address
859 	 * space used for early allocations is properly marked used in
860 	 * the map.
861 	 */
862 	uma_startup2();
863 }
864 
865 /*
866  *	kmem_bootstrap_free:
867  *
868  *	Free pages backing preloaded data (e.g., kernel modules) to the
869  *	system.  Currently only supported on platforms that create a
870  *	vm_phys segment for preloaded data.
871  */
872 void
873 kmem_bootstrap_free(vm_offset_t start, vm_size_t size)
874 {
875 #if defined(__i386__) || defined(__amd64__)
876 	struct vm_domain *vmd;
877 	vm_offset_t end, va;
878 	vm_paddr_t pa;
879 	vm_page_t m;
880 
881 	end = trunc_page(start + size);
882 	start = round_page(start);
883 
884 #ifdef __amd64__
885 	/*
886 	 * Preloaded files do not have execute permissions by default on amd64.
887 	 * Restore the default permissions to ensure that the direct map alias
888 	 * is updated.
889 	 */
890 	pmap_change_prot(start, end - start, VM_PROT_RW);
891 #endif
892 	for (va = start; va < end; va += PAGE_SIZE) {
893 		pa = pmap_kextract(va);
894 		m = PHYS_TO_VM_PAGE(pa);
895 
896 		vmd = vm_pagequeue_domain(m);
897 		vm_domain_free_lock(vmd);
898 		vm_phys_free_pages(m, 0);
899 		vm_domain_free_unlock(vmd);
900 
901 		vm_domain_freecnt_inc(vmd, 1);
902 		vm_cnt.v_page_count++;
903 	}
904 	pmap_remove(kernel_pmap, start, end);
905 	(void)vmem_add(kernel_arena, start, end - start, M_WAITOK);
906 #endif
907 }
908 
909 #ifdef PMAP_WANT_ACTIVE_CPUS_NAIVE
910 void
911 pmap_active_cpus(pmap_t pmap, cpuset_t *res)
912 {
913 	struct thread *td;
914 	struct proc *p;
915 	struct vmspace *vm;
916 	int c;
917 
918 	CPU_ZERO(res);
919 	CPU_FOREACH(c) {
920 		td = cpuid_to_pcpu[c]->pc_curthread;
921 		p = td->td_proc;
922 		if (p == NULL)
923 			continue;
924 		vm = vmspace_acquire_ref(p);
925 		if (vm == NULL)
926 			continue;
927 		if (pmap == vmspace_pmap(vm))
928 			CPU_SET(c, res);
929 		vmspace_free(vm);
930 	}
931 }
932 #endif
933 
934 /*
935  * Allow userspace to directly trigger the VM drain routine for testing
936  * purposes.
937  */
938 static int
939 debug_vm_lowmem(SYSCTL_HANDLER_ARGS)
940 {
941 	int error, i;
942 
943 	i = 0;
944 	error = sysctl_handle_int(oidp, &i, 0, req);
945 	if (error != 0)
946 		return (error);
947 	if ((i & ~(VM_LOW_KMEM | VM_LOW_PAGES)) != 0)
948 		return (EINVAL);
949 	if (i != 0)
950 		EVENTHANDLER_INVOKE(vm_lowmem, i);
951 	return (0);
952 }
953 SYSCTL_PROC(_debug, OID_AUTO, vm_lowmem,
954     CTLTYPE_INT | CTLFLAG_MPSAFE | CTLFLAG_RW, 0, 0, debug_vm_lowmem, "I",
955     "set to trigger vm_lowmem event with given flags");
956 
957 static int
958 debug_uma_reclaim(SYSCTL_HANDLER_ARGS)
959 {
960 	int error, i;
961 
962 	i = 0;
963 	error = sysctl_handle_int(oidp, &i, 0, req);
964 	if (error != 0 || req->newptr == NULL)
965 		return (error);
966 	if (i != UMA_RECLAIM_TRIM && i != UMA_RECLAIM_DRAIN &&
967 	    i != UMA_RECLAIM_DRAIN_CPU)
968 		return (EINVAL);
969 	uma_reclaim(i);
970 	return (0);
971 }
972 SYSCTL_PROC(_debug, OID_AUTO, uma_reclaim,
973     CTLTYPE_INT | CTLFLAG_MPSAFE | CTLFLAG_RW, 0, 0, debug_uma_reclaim, "I",
974     "set to generate request to reclaim uma caches");
975 
976 static int
977 debug_uma_reclaim_domain(SYSCTL_HANDLER_ARGS)
978 {
979 	int domain, error, request;
980 
981 	request = 0;
982 	error = sysctl_handle_int(oidp, &request, 0, req);
983 	if (error != 0 || req->newptr == NULL)
984 		return (error);
985 
986 	domain = request >> 4;
987 	request &= 0xf;
988 	if (request != UMA_RECLAIM_TRIM && request != UMA_RECLAIM_DRAIN &&
989 	    request != UMA_RECLAIM_DRAIN_CPU)
990 		return (EINVAL);
991 	if (domain < 0 || domain >= vm_ndomains)
992 		return (EINVAL);
993 	uma_reclaim_domain(request, domain);
994 	return (0);
995 }
996 SYSCTL_PROC(_debug, OID_AUTO, uma_reclaim_domain,
997     CTLTYPE_INT | CTLFLAG_MPSAFE | CTLFLAG_RW, 0, 0,
998     debug_uma_reclaim_domain, "I",
999     "");
1000