xref: /freebsd/sys/vm/vm_page.c (revision 774f94f14c92bf94afc21d8c8d7a1e8f2fdf5a48)
1 /*-
2  * Copyright (c) 1991 Regents of the University of California.
3  * All rights reserved.
4  * Copyright (c) 1998 Matthew Dillon.  All Rights Reserved.
5  *
6  * This code is derived from software contributed to Berkeley by
7  * The Mach Operating System project at Carnegie-Mellon University.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	from: @(#)vm_page.c	7.4 (Berkeley) 5/7/91
34  */
35 
36 /*-
37  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
38  * All rights reserved.
39  *
40  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
41  *
42  * Permission to use, copy, modify and distribute this software and
43  * its documentation is hereby granted, provided that both the copyright
44  * notice and this permission notice appear in all copies of the
45  * software, derivative works or modified versions, and any portions
46  * thereof, and that both notices appear in supporting documentation.
47  *
48  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
49  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
50  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
51  *
52  * Carnegie Mellon requests users of this software to return to
53  *
54  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
55  *  School of Computer Science
56  *  Carnegie Mellon University
57  *  Pittsburgh PA 15213-3890
58  *
59  * any improvements or extensions that they make and grant Carnegie the
60  * rights to redistribute these changes.
61  */
62 
63 /*
64  *			GENERAL RULES ON VM_PAGE MANIPULATION
65  *
66  *	- a pageq mutex is required when adding or removing a page from a
67  *	  page queue (vm_page_queue[]), regardless of other mutexes or the
68  *	  busy state of a page.
69  *
70  *	- a hash chain mutex is required when associating or disassociating
71  *	  a page from the VM PAGE CACHE hash table (vm_page_buckets),
72  *	  regardless of other mutexes or the busy state of a page.
73  *
74  *	- either a hash chain mutex OR a busied page is required in order
75  *	  to modify the page flags.  A hash chain mutex must be obtained in
76  *	  order to busy a page.  A page's flags cannot be modified by a
77  *	  hash chain mutex if the page is marked busy.
78  *
79  *	- The object memq mutex is held when inserting or removing
80  *	  pages from an object (vm_page_insert() or vm_page_remove()).  This
81  *	  is different from the object's main mutex.
82  *
83  *	Generally speaking, you have to be aware of side effects when running
84  *	vm_page ops.  A vm_page_lookup() will return with the hash chain
85  *	locked, whether it was able to lookup the page or not.  vm_page_free(),
86  *	vm_page_cache(), vm_page_activate(), and a number of other routines
87  *	will release the hash chain mutex for you.  Intermediate manipulation
88  *	routines such as vm_page_flag_set() expect the hash chain to be held
89  *	on entry and the hash chain will remain held on return.
90  *
91  *	pageq scanning can only occur with the pageq in question locked.
92  *	We have a known bottleneck with the active queue, but the cache
93  *	and free queues are actually arrays already.
94  */
95 
96 /*
97  *	Resident memory management module.
98  */
99 
100 #include <sys/cdefs.h>
101 __FBSDID("$FreeBSD$");
102 
103 #include "opt_vm.h"
104 
105 #include <sys/param.h>
106 #include <sys/systm.h>
107 #include <sys/lock.h>
108 #include <sys/kernel.h>
109 #include <sys/limits.h>
110 #include <sys/malloc.h>
111 #include <sys/msgbuf.h>
112 #include <sys/mutex.h>
113 #include <sys/proc.h>
114 #include <sys/sysctl.h>
115 #include <sys/vmmeter.h>
116 #include <sys/vnode.h>
117 
118 #include <vm/vm.h>
119 #include <vm/pmap.h>
120 #include <vm/vm_param.h>
121 #include <vm/vm_kern.h>
122 #include <vm/vm_object.h>
123 #include <vm/vm_page.h>
124 #include <vm/vm_pageout.h>
125 #include <vm/vm_pager.h>
126 #include <vm/vm_phys.h>
127 #include <vm/vm_reserv.h>
128 #include <vm/vm_extern.h>
129 #include <vm/uma.h>
130 #include <vm/uma_int.h>
131 
132 #include <machine/md_var.h>
133 
134 #if defined(__amd64__) || defined (__i386__)
135 extern struct sysctl_oid_list sysctl__vm_pmap_children;
136 #else
137 SYSCTL_NODE(_vm, OID_AUTO, pmap, CTLFLAG_RD, 0, "VM/pmap parameters");
138 #endif
139 
140 static uint64_t pmap_tryrelock_calls;
141 SYSCTL_QUAD(_vm_pmap, OID_AUTO, tryrelock_calls, CTLFLAG_RD,
142     &pmap_tryrelock_calls, 0, "Number of tryrelock calls");
143 
144 static int pmap_tryrelock_restart;
145 SYSCTL_INT(_vm_pmap, OID_AUTO, tryrelock_restart, CTLFLAG_RD,
146     &pmap_tryrelock_restart, 0, "Number of tryrelock restarts");
147 
148 static int pmap_tryrelock_race;
149 SYSCTL_INT(_vm_pmap, OID_AUTO, tryrelock_race, CTLFLAG_RD,
150     &pmap_tryrelock_race, 0, "Number of tryrelock pmap race cases");
151 
152 /*
153  *	Associated with page of user-allocatable memory is a
154  *	page structure.
155  */
156 
157 struct vpgqueues vm_page_queues[PQ_COUNT];
158 struct vpglocks vm_page_queue_lock;
159 struct vpglocks vm_page_queue_free_lock;
160 
161 struct vpglocks	pa_lock[PA_LOCK_COUNT] __aligned(CACHE_LINE_SIZE);
162 
163 vm_page_t vm_page_array = 0;
164 int vm_page_array_size = 0;
165 long first_page = 0;
166 int vm_page_zero_count = 0;
167 
168 static int boot_pages = UMA_BOOT_PAGES;
169 TUNABLE_INT("vm.boot_pages", &boot_pages);
170 SYSCTL_INT(_vm, OID_AUTO, boot_pages, CTLFLAG_RD, &boot_pages, 0,
171 	"number of pages allocated for bootstrapping the VM system");
172 
173 static void vm_page_clear_dirty_mask(vm_page_t m, int pagebits);
174 static void vm_page_queue_remove(int queue, vm_page_t m);
175 static void vm_page_enqueue(int queue, vm_page_t m);
176 
177 /* Make sure that u_long is at least 64 bits when PAGE_SIZE is 32K. */
178 #if PAGE_SIZE == 32768
179 #ifdef CTASSERT
180 CTASSERT(sizeof(u_long) >= 8);
181 #endif
182 #endif
183 
184 /*
185  * Try to acquire a physical address lock while a pmap is locked.  If we
186  * fail to trylock we unlock and lock the pmap directly and cache the
187  * locked pa in *locked.  The caller should then restart their loop in case
188  * the virtual to physical mapping has changed.
189  */
190 int
191 vm_page_pa_tryrelock(pmap_t pmap, vm_paddr_t pa, vm_paddr_t *locked)
192 {
193 	vm_paddr_t lockpa;
194 	uint32_t gen_count;
195 
196 	gen_count = pmap->pm_gen_count;
197 	atomic_add_long((volatile long *)&pmap_tryrelock_calls, 1);
198 	lockpa = *locked;
199 	*locked = pa;
200 	if (lockpa) {
201 		PA_LOCK_ASSERT(lockpa, MA_OWNED);
202 		if (PA_LOCKPTR(pa) == PA_LOCKPTR(lockpa))
203 			return (0);
204 		PA_UNLOCK(lockpa);
205 	}
206 	if (PA_TRYLOCK(pa))
207 		return (0);
208 	PMAP_UNLOCK(pmap);
209 	atomic_add_int((volatile int *)&pmap_tryrelock_restart, 1);
210 	PA_LOCK(pa);
211 	PMAP_LOCK(pmap);
212 
213 	if (pmap->pm_gen_count != gen_count + 1) {
214 		pmap->pm_retries++;
215 		atomic_add_int((volatile int *)&pmap_tryrelock_race, 1);
216 		return (EAGAIN);
217 	}
218 	return (0);
219 }
220 
221 /*
222  *	vm_set_page_size:
223  *
224  *	Sets the page size, perhaps based upon the memory
225  *	size.  Must be called before any use of page-size
226  *	dependent functions.
227  */
228 void
229 vm_set_page_size(void)
230 {
231 	if (cnt.v_page_size == 0)
232 		cnt.v_page_size = PAGE_SIZE;
233 	if (((cnt.v_page_size - 1) & cnt.v_page_size) != 0)
234 		panic("vm_set_page_size: page size not a power of two");
235 }
236 
237 /*
238  *	vm_page_blacklist_lookup:
239  *
240  *	See if a physical address in this page has been listed
241  *	in the blacklist tunable.  Entries in the tunable are
242  *	separated by spaces or commas.  If an invalid integer is
243  *	encountered then the rest of the string is skipped.
244  */
245 static int
246 vm_page_blacklist_lookup(char *list, vm_paddr_t pa)
247 {
248 	vm_paddr_t bad;
249 	char *cp, *pos;
250 
251 	for (pos = list; *pos != '\0'; pos = cp) {
252 		bad = strtoq(pos, &cp, 0);
253 		if (*cp != '\0') {
254 			if (*cp == ' ' || *cp == ',') {
255 				cp++;
256 				if (cp == pos)
257 					continue;
258 			} else
259 				break;
260 		}
261 		if (pa == trunc_page(bad))
262 			return (1);
263 	}
264 	return (0);
265 }
266 
267 /*
268  *	vm_page_startup:
269  *
270  *	Initializes the resident memory module.
271  *
272  *	Allocates memory for the page cells, and
273  *	for the object/offset-to-page hash table headers.
274  *	Each page cell is initialized and placed on the free list.
275  */
276 vm_offset_t
277 vm_page_startup(vm_offset_t vaddr)
278 {
279 	vm_offset_t mapped;
280 	vm_paddr_t page_range;
281 	vm_paddr_t new_end;
282 	int i;
283 	vm_paddr_t pa;
284 	int nblocks;
285 	vm_paddr_t last_pa;
286 	char *list;
287 
288 	/* the biggest memory array is the second group of pages */
289 	vm_paddr_t end;
290 	vm_paddr_t biggestsize;
291 	vm_paddr_t low_water, high_water;
292 	int biggestone;
293 
294 	biggestsize = 0;
295 	biggestone = 0;
296 	nblocks = 0;
297 	vaddr = round_page(vaddr);
298 
299 	for (i = 0; phys_avail[i + 1]; i += 2) {
300 		phys_avail[i] = round_page(phys_avail[i]);
301 		phys_avail[i + 1] = trunc_page(phys_avail[i + 1]);
302 	}
303 
304 	low_water = phys_avail[0];
305 	high_water = phys_avail[1];
306 
307 	for (i = 0; phys_avail[i + 1]; i += 2) {
308 		vm_paddr_t size = phys_avail[i + 1] - phys_avail[i];
309 
310 		if (size > biggestsize) {
311 			biggestone = i;
312 			biggestsize = size;
313 		}
314 		if (phys_avail[i] < low_water)
315 			low_water = phys_avail[i];
316 		if (phys_avail[i + 1] > high_water)
317 			high_water = phys_avail[i + 1];
318 		++nblocks;
319 	}
320 
321 #ifdef XEN
322 	low_water = 0;
323 #endif
324 
325 	end = phys_avail[biggestone+1];
326 
327 	/*
328 	 * Initialize the locks.
329 	 */
330 	mtx_init(&vm_page_queue_mtx, "vm page queue mutex", NULL, MTX_DEF |
331 	    MTX_RECURSE);
332 	mtx_init(&vm_page_queue_free_mtx, "vm page queue free mutex", NULL,
333 	    MTX_DEF);
334 
335 	/* Setup page locks. */
336 	for (i = 0; i < PA_LOCK_COUNT; i++)
337 		mtx_init(&pa_lock[i].data, "page lock", NULL,
338 		    MTX_DEF | MTX_RECURSE | MTX_DUPOK);
339 
340 	/*
341 	 * Initialize the queue headers for the hold queue, the active queue,
342 	 * and the inactive queue.
343 	 */
344 	for (i = 0; i < PQ_COUNT; i++)
345 		TAILQ_INIT(&vm_page_queues[i].pl);
346 	vm_page_queues[PQ_INACTIVE].cnt = &cnt.v_inactive_count;
347 	vm_page_queues[PQ_ACTIVE].cnt = &cnt.v_active_count;
348 	vm_page_queues[PQ_HOLD].cnt = &cnt.v_active_count;
349 
350 	/*
351 	 * Allocate memory for use when boot strapping the kernel memory
352 	 * allocator.
353 	 */
354 	new_end = end - (boot_pages * UMA_SLAB_SIZE);
355 	new_end = trunc_page(new_end);
356 	mapped = pmap_map(&vaddr, new_end, end,
357 	    VM_PROT_READ | VM_PROT_WRITE);
358 	bzero((void *)mapped, end - new_end);
359 	uma_startup((void *)mapped, boot_pages);
360 
361 #if defined(__amd64__) || defined(__i386__) || defined(__arm__)
362 	/*
363 	 * Allocate a bitmap to indicate that a random physical page
364 	 * needs to be included in a minidump.
365 	 *
366 	 * The amd64 port needs this to indicate which direct map pages
367 	 * need to be dumped, via calls to dump_add_page()/dump_drop_page().
368 	 *
369 	 * However, i386 still needs this workspace internally within the
370 	 * minidump code.  In theory, they are not needed on i386, but are
371 	 * included should the sf_buf code decide to use them.
372 	 */
373 	page_range = phys_avail[(nblocks - 1) * 2 + 1] / PAGE_SIZE;
374 	vm_page_dump_size = round_page(roundup2(page_range, NBBY) / NBBY);
375 	new_end -= vm_page_dump_size;
376 	vm_page_dump = (void *)(uintptr_t)pmap_map(&vaddr, new_end,
377 	    new_end + vm_page_dump_size, VM_PROT_READ | VM_PROT_WRITE);
378 	bzero((void *)vm_page_dump, vm_page_dump_size);
379 #endif
380 #ifdef __amd64__
381 	/*
382 	 * Request that the physical pages underlying the message buffer be
383 	 * included in a crash dump.  Since the message buffer is accessed
384 	 * through the direct map, they are not automatically included.
385 	 */
386 	pa = DMAP_TO_PHYS((vm_offset_t)msgbufp->msg_ptr);
387 	last_pa = pa + round_page(MSGBUF_SIZE);
388 	while (pa < last_pa) {
389 		dump_add_page(pa);
390 		pa += PAGE_SIZE;
391 	}
392 #endif
393 	/*
394 	 * Compute the number of pages of memory that will be available for
395 	 * use (taking into account the overhead of a page structure per
396 	 * page).
397 	 */
398 	first_page = low_water / PAGE_SIZE;
399 #ifdef VM_PHYSSEG_SPARSE
400 	page_range = 0;
401 	for (i = 0; phys_avail[i + 1] != 0; i += 2)
402 		page_range += atop(phys_avail[i + 1] - phys_avail[i]);
403 #elif defined(VM_PHYSSEG_DENSE)
404 	page_range = high_water / PAGE_SIZE - first_page;
405 #else
406 #error "Either VM_PHYSSEG_DENSE or VM_PHYSSEG_SPARSE must be defined."
407 #endif
408 	end = new_end;
409 
410 	/*
411 	 * Reserve an unmapped guard page to trap access to vm_page_array[-1].
412 	 */
413 	vaddr += PAGE_SIZE;
414 
415 	/*
416 	 * Initialize the mem entry structures now, and put them in the free
417 	 * queue.
418 	 */
419 	new_end = trunc_page(end - page_range * sizeof(struct vm_page));
420 	mapped = pmap_map(&vaddr, new_end, end,
421 	    VM_PROT_READ | VM_PROT_WRITE);
422 	vm_page_array = (vm_page_t) mapped;
423 #if VM_NRESERVLEVEL > 0
424 	/*
425 	 * Allocate memory for the reservation management system's data
426 	 * structures.
427 	 */
428 	new_end = vm_reserv_startup(&vaddr, new_end, high_water);
429 #endif
430 #ifdef __amd64__
431 	/*
432 	 * pmap_map on amd64 comes out of the direct-map, not kvm like i386,
433 	 * so the pages must be tracked for a crashdump to include this data.
434 	 * This includes the vm_page_array and the early UMA bootstrap pages.
435 	 */
436 	for (pa = new_end; pa < phys_avail[biggestone + 1]; pa += PAGE_SIZE)
437 		dump_add_page(pa);
438 #endif
439 	phys_avail[biggestone + 1] = new_end;
440 
441 	/*
442 	 * Clear all of the page structures
443 	 */
444 	bzero((caddr_t) vm_page_array, page_range * sizeof(struct vm_page));
445 	for (i = 0; i < page_range; i++)
446 		vm_page_array[i].order = VM_NFREEORDER;
447 	vm_page_array_size = page_range;
448 
449 	/*
450 	 * Initialize the physical memory allocator.
451 	 */
452 	vm_phys_init();
453 
454 	/*
455 	 * Add every available physical page that is not blacklisted to
456 	 * the free lists.
457 	 */
458 	cnt.v_page_count = 0;
459 	cnt.v_free_count = 0;
460 	list = getenv("vm.blacklist");
461 	for (i = 0; phys_avail[i + 1] != 0; i += 2) {
462 		pa = phys_avail[i];
463 		last_pa = phys_avail[i + 1];
464 		while (pa < last_pa) {
465 			if (list != NULL &&
466 			    vm_page_blacklist_lookup(list, pa))
467 				printf("Skipping page with pa 0x%jx\n",
468 				    (uintmax_t)pa);
469 			else
470 				vm_phys_add_page(pa);
471 			pa += PAGE_SIZE;
472 		}
473 	}
474 	freeenv(list);
475 #if VM_NRESERVLEVEL > 0
476 	/*
477 	 * Initialize the reservation management system.
478 	 */
479 	vm_reserv_init();
480 #endif
481 	return (vaddr);
482 }
483 
484 void
485 vm_page_flag_set(vm_page_t m, unsigned short bits)
486 {
487 
488 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
489 	/*
490 	 * The PG_WRITEABLE flag can only be set if the page is managed and
491 	 * VPO_BUSY.  Currently, this flag is only set by pmap_enter().
492 	 */
493 	KASSERT((bits & PG_WRITEABLE) == 0 ||
494 	    ((m->flags & (PG_UNMANAGED | PG_FICTITIOUS)) == 0 &&
495 	    (m->oflags & VPO_BUSY) != 0), ("PG_WRITEABLE and !VPO_BUSY"));
496 	m->flags |= bits;
497 }
498 
499 void
500 vm_page_flag_clear(vm_page_t m, unsigned short bits)
501 {
502 
503 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
504 	/*
505 	 * The PG_REFERENCED flag can only be cleared if the object
506 	 * containing the page is locked.
507 	 */
508 	KASSERT((bits & PG_REFERENCED) == 0 || VM_OBJECT_LOCKED(m->object),
509 	    ("PG_REFERENCED and !VM_OBJECT_LOCKED"));
510 	m->flags &= ~bits;
511 }
512 
513 void
514 vm_page_busy(vm_page_t m)
515 {
516 
517 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
518 	KASSERT((m->oflags & VPO_BUSY) == 0,
519 	    ("vm_page_busy: page already busy!!!"));
520 	m->oflags |= VPO_BUSY;
521 }
522 
523 /*
524  *      vm_page_flash:
525  *
526  *      wakeup anyone waiting for the page.
527  */
528 void
529 vm_page_flash(vm_page_t m)
530 {
531 
532 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
533 	if (m->oflags & VPO_WANTED) {
534 		m->oflags &= ~VPO_WANTED;
535 		wakeup(m);
536 	}
537 }
538 
539 /*
540  *      vm_page_wakeup:
541  *
542  *      clear the VPO_BUSY flag and wakeup anyone waiting for the
543  *      page.
544  *
545  */
546 void
547 vm_page_wakeup(vm_page_t m)
548 {
549 
550 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
551 	KASSERT(m->oflags & VPO_BUSY, ("vm_page_wakeup: page not busy!!!"));
552 	m->oflags &= ~VPO_BUSY;
553 	vm_page_flash(m);
554 }
555 
556 void
557 vm_page_io_start(vm_page_t m)
558 {
559 
560 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
561 	m->busy++;
562 }
563 
564 void
565 vm_page_io_finish(vm_page_t m)
566 {
567 
568 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
569 	m->busy--;
570 	if (m->busy == 0)
571 		vm_page_flash(m);
572 }
573 
574 /*
575  * Keep page from being freed by the page daemon
576  * much of the same effect as wiring, except much lower
577  * overhead and should be used only for *very* temporary
578  * holding ("wiring").
579  */
580 void
581 vm_page_hold(vm_page_t mem)
582 {
583 
584 	vm_page_lock_assert(mem, MA_OWNED);
585         mem->hold_count++;
586 }
587 
588 void
589 vm_page_unhold(vm_page_t mem)
590 {
591 
592 	vm_page_lock_assert(mem, MA_OWNED);
593 	--mem->hold_count;
594 	KASSERT(mem->hold_count >= 0, ("vm_page_unhold: hold count < 0!!!"));
595 	if (mem->hold_count == 0 && mem->queue == PQ_HOLD)
596 		vm_page_free_toq(mem);
597 }
598 
599 /*
600  *	vm_page_free:
601  *
602  *	Free a page.
603  */
604 void
605 vm_page_free(vm_page_t m)
606 {
607 
608 	m->flags &= ~PG_ZERO;
609 	vm_page_free_toq(m);
610 }
611 
612 /*
613  *	vm_page_free_zero:
614  *
615  *	Free a page to the zerod-pages queue
616  */
617 void
618 vm_page_free_zero(vm_page_t m)
619 {
620 
621 	m->flags |= PG_ZERO;
622 	vm_page_free_toq(m);
623 }
624 
625 /*
626  *	vm_page_sleep:
627  *
628  *	Sleep and release the page and page queues locks.
629  *
630  *	The object containing the given page must be locked.
631  */
632 void
633 vm_page_sleep(vm_page_t m, const char *msg)
634 {
635 
636 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
637 	if (mtx_owned(&vm_page_queue_mtx))
638 		vm_page_unlock_queues();
639 	if (mtx_owned(vm_page_lockptr(m)))
640 		vm_page_unlock(m);
641 
642 	/*
643 	 * It's possible that while we sleep, the page will get
644 	 * unbusied and freed.  If we are holding the object
645 	 * lock, we will assume we hold a reference to the object
646 	 * such that even if m->object changes, we can re-lock
647 	 * it.
648 	 */
649 	m->oflags |= VPO_WANTED;
650 	msleep(m, VM_OBJECT_MTX(m->object), PVM, msg, 0);
651 }
652 
653 /*
654  *	vm_page_dirty:
655  *
656  *	make page all dirty
657  */
658 void
659 vm_page_dirty(vm_page_t m)
660 {
661 
662 	KASSERT((m->flags & PG_CACHED) == 0,
663 	    ("vm_page_dirty: page in cache!"));
664 	KASSERT(!VM_PAGE_IS_FREE(m),
665 	    ("vm_page_dirty: page is free!"));
666 	KASSERT(m->valid == VM_PAGE_BITS_ALL,
667 	    ("vm_page_dirty: page is invalid!"));
668 	m->dirty = VM_PAGE_BITS_ALL;
669 }
670 
671 /*
672  *	vm_page_splay:
673  *
674  *	Implements Sleator and Tarjan's top-down splay algorithm.  Returns
675  *	the vm_page containing the given pindex.  If, however, that
676  *	pindex is not found in the vm_object, returns a vm_page that is
677  *	adjacent to the pindex, coming before or after it.
678  */
679 vm_page_t
680 vm_page_splay(vm_pindex_t pindex, vm_page_t root)
681 {
682 	struct vm_page dummy;
683 	vm_page_t lefttreemax, righttreemin, y;
684 
685 	if (root == NULL)
686 		return (root);
687 	lefttreemax = righttreemin = &dummy;
688 	for (;; root = y) {
689 		if (pindex < root->pindex) {
690 			if ((y = root->left) == NULL)
691 				break;
692 			if (pindex < y->pindex) {
693 				/* Rotate right. */
694 				root->left = y->right;
695 				y->right = root;
696 				root = y;
697 				if ((y = root->left) == NULL)
698 					break;
699 			}
700 			/* Link into the new root's right tree. */
701 			righttreemin->left = root;
702 			righttreemin = root;
703 		} else if (pindex > root->pindex) {
704 			if ((y = root->right) == NULL)
705 				break;
706 			if (pindex > y->pindex) {
707 				/* Rotate left. */
708 				root->right = y->left;
709 				y->left = root;
710 				root = y;
711 				if ((y = root->right) == NULL)
712 					break;
713 			}
714 			/* Link into the new root's left tree. */
715 			lefttreemax->right = root;
716 			lefttreemax = root;
717 		} else
718 			break;
719 	}
720 	/* Assemble the new root. */
721 	lefttreemax->right = root->left;
722 	righttreemin->left = root->right;
723 	root->left = dummy.right;
724 	root->right = dummy.left;
725 	return (root);
726 }
727 
728 /*
729  *	vm_page_insert:		[ internal use only ]
730  *
731  *	Inserts the given mem entry into the object and object list.
732  *
733  *	The pagetables are not updated but will presumably fault the page
734  *	in if necessary, or if a kernel page the caller will at some point
735  *	enter the page into the kernel's pmap.  We are not allowed to block
736  *	here so we *can't* do this anyway.
737  *
738  *	The object and page must be locked.
739  *	This routine may not block.
740  */
741 void
742 vm_page_insert(vm_page_t m, vm_object_t object, vm_pindex_t pindex)
743 {
744 	vm_page_t root;
745 
746 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
747 	if (m->object != NULL)
748 		panic("vm_page_insert: page already inserted");
749 
750 	/*
751 	 * Record the object/offset pair in this page
752 	 */
753 	m->object = object;
754 	m->pindex = pindex;
755 
756 	/*
757 	 * Now link into the object's ordered list of backed pages.
758 	 */
759 	root = object->root;
760 	if (root == NULL) {
761 		m->left = NULL;
762 		m->right = NULL;
763 		TAILQ_INSERT_TAIL(&object->memq, m, listq);
764 	} else {
765 		root = vm_page_splay(pindex, root);
766 		if (pindex < root->pindex) {
767 			m->left = root->left;
768 			m->right = root;
769 			root->left = NULL;
770 			TAILQ_INSERT_BEFORE(root, m, listq);
771 		} else if (pindex == root->pindex)
772 			panic("vm_page_insert: offset already allocated");
773 		else {
774 			m->right = root->right;
775 			m->left = root;
776 			root->right = NULL;
777 			TAILQ_INSERT_AFTER(&object->memq, root, m, listq);
778 		}
779 	}
780 	object->root = m;
781 	object->generation++;
782 
783 	/*
784 	 * show that the object has one more resident page.
785 	 */
786 	object->resident_page_count++;
787 	/*
788 	 * Hold the vnode until the last page is released.
789 	 */
790 	if (object->resident_page_count == 1 && object->type == OBJT_VNODE)
791 		vhold((struct vnode *)object->handle);
792 
793 	/*
794 	 * Since we are inserting a new and possibly dirty page,
795 	 * update the object's OBJ_MIGHTBEDIRTY flag.
796 	 */
797 	if (m->flags & PG_WRITEABLE)
798 		vm_object_set_writeable_dirty(object);
799 }
800 
801 /*
802  *	vm_page_remove:
803  *				NOTE: used by device pager as well -wfj
804  *
805  *	Removes the given mem entry from the object/offset-page
806  *	table and the object page list, but do not invalidate/terminate
807  *	the backing store.
808  *
809  *	The object and page must be locked.
810  *	The underlying pmap entry (if any) is NOT removed here.
811  *	This routine may not block.
812  */
813 void
814 vm_page_remove(vm_page_t m)
815 {
816 	vm_object_t object;
817 	vm_page_t root;
818 
819 	if ((m->flags & PG_UNMANAGED) == 0)
820 		vm_page_lock_assert(m, MA_OWNED);
821 	if ((object = m->object) == NULL)
822 		return;
823 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
824 	if (m->oflags & VPO_BUSY) {
825 		m->oflags &= ~VPO_BUSY;
826 		vm_page_flash(m);
827 	}
828 
829 	/*
830 	 * Now remove from the object's list of backed pages.
831 	 */
832 	if (m != object->root)
833 		vm_page_splay(m->pindex, object->root);
834 	if (m->left == NULL)
835 		root = m->right;
836 	else {
837 		root = vm_page_splay(m->pindex, m->left);
838 		root->right = m->right;
839 	}
840 	object->root = root;
841 	TAILQ_REMOVE(&object->memq, m, listq);
842 
843 	/*
844 	 * And show that the object has one fewer resident page.
845 	 */
846 	object->resident_page_count--;
847 	object->generation++;
848 	/*
849 	 * The vnode may now be recycled.
850 	 */
851 	if (object->resident_page_count == 0 && object->type == OBJT_VNODE)
852 		vdrop((struct vnode *)object->handle);
853 
854 	m->object = NULL;
855 }
856 
857 /*
858  *	vm_page_lookup:
859  *
860  *	Returns the page associated with the object/offset
861  *	pair specified; if none is found, NULL is returned.
862  *
863  *	The object must be locked.
864  *	This routine may not block.
865  *	This is a critical path routine
866  */
867 vm_page_t
868 vm_page_lookup(vm_object_t object, vm_pindex_t pindex)
869 {
870 	vm_page_t m;
871 
872 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
873 	if ((m = object->root) != NULL && m->pindex != pindex) {
874 		m = vm_page_splay(pindex, m);
875 		if ((object->root = m)->pindex != pindex)
876 			m = NULL;
877 	}
878 	return (m);
879 }
880 
881 /*
882  *	vm_page_find_least:
883  *
884  *	Returns the page associated with the object with least pindex
885  *	greater than or equal to the parameter pindex, or NULL.
886  *
887  *	The object must be locked.
888  *	The routine may not block.
889  */
890 vm_page_t
891 vm_page_find_least(vm_object_t object, vm_pindex_t pindex)
892 {
893 	vm_page_t m;
894 
895 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
896 	if ((m = TAILQ_FIRST(&object->memq)) != NULL) {
897 		if (m->pindex < pindex) {
898 			m = vm_page_splay(pindex, object->root);
899 			if ((object->root = m)->pindex < pindex)
900 				m = TAILQ_NEXT(m, listq);
901 		}
902 	}
903 	return (m);
904 }
905 
906 /*
907  * Returns the given page's successor (by pindex) within the object if it is
908  * resident; if none is found, NULL is returned.
909  *
910  * The object must be locked.
911  */
912 vm_page_t
913 vm_page_next(vm_page_t m)
914 {
915 	vm_page_t next;
916 
917 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
918 	if ((next = TAILQ_NEXT(m, listq)) != NULL &&
919 	    next->pindex != m->pindex + 1)
920 		next = NULL;
921 	return (next);
922 }
923 
924 /*
925  * Returns the given page's predecessor (by pindex) within the object if it is
926  * resident; if none is found, NULL is returned.
927  *
928  * The object must be locked.
929  */
930 vm_page_t
931 vm_page_prev(vm_page_t m)
932 {
933 	vm_page_t prev;
934 
935 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
936 	if ((prev = TAILQ_PREV(m, pglist, listq)) != NULL &&
937 	    prev->pindex != m->pindex - 1)
938 		prev = NULL;
939 	return (prev);
940 }
941 
942 /*
943  *	vm_page_rename:
944  *
945  *	Move the given memory entry from its
946  *	current object to the specified target object/offset.
947  *
948  *	The object must be locked.
949  *	This routine may not block.
950  *
951  *	Note: swap associated with the page must be invalidated by the move.  We
952  *	      have to do this for several reasons:  (1) we aren't freeing the
953  *	      page, (2) we are dirtying the page, (3) the VM system is probably
954  *	      moving the page from object A to B, and will then later move
955  *	      the backing store from A to B and we can't have a conflict.
956  *
957  *	Note: we *always* dirty the page.  It is necessary both for the
958  *	      fact that we moved it, and because we may be invalidating
959  *	      swap.  If the page is on the cache, we have to deactivate it
960  *	      or vm_page_dirty() will panic.  Dirty pages are not allowed
961  *	      on the cache.
962  */
963 void
964 vm_page_rename(vm_page_t m, vm_object_t new_object, vm_pindex_t new_pindex)
965 {
966 
967 	vm_page_remove(m);
968 	vm_page_insert(m, new_object, new_pindex);
969 	vm_page_dirty(m);
970 }
971 
972 /*
973  *	Convert all of the given object's cached pages that have a
974  *	pindex within the given range into free pages.  If the value
975  *	zero is given for "end", then the range's upper bound is
976  *	infinity.  If the given object is backed by a vnode and it
977  *	transitions from having one or more cached pages to none, the
978  *	vnode's hold count is reduced.
979  */
980 void
981 vm_page_cache_free(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
982 {
983 	vm_page_t m, m_next;
984 	boolean_t empty;
985 
986 	mtx_lock(&vm_page_queue_free_mtx);
987 	if (__predict_false(object->cache == NULL)) {
988 		mtx_unlock(&vm_page_queue_free_mtx);
989 		return;
990 	}
991 	m = object->cache = vm_page_splay(start, object->cache);
992 	if (m->pindex < start) {
993 		if (m->right == NULL)
994 			m = NULL;
995 		else {
996 			m_next = vm_page_splay(start, m->right);
997 			m_next->left = m;
998 			m->right = NULL;
999 			m = object->cache = m_next;
1000 		}
1001 	}
1002 
1003 	/*
1004 	 * At this point, "m" is either (1) a reference to the page
1005 	 * with the least pindex that is greater than or equal to
1006 	 * "start" or (2) NULL.
1007 	 */
1008 	for (; m != NULL && (m->pindex < end || end == 0); m = m_next) {
1009 		/*
1010 		 * Find "m"'s successor and remove "m" from the
1011 		 * object's cache.
1012 		 */
1013 		if (m->right == NULL) {
1014 			object->cache = m->left;
1015 			m_next = NULL;
1016 		} else {
1017 			m_next = vm_page_splay(start, m->right);
1018 			m_next->left = m->left;
1019 			object->cache = m_next;
1020 		}
1021 		/* Convert "m" to a free page. */
1022 		m->object = NULL;
1023 		m->valid = 0;
1024 		/* Clear PG_CACHED and set PG_FREE. */
1025 		m->flags ^= PG_CACHED | PG_FREE;
1026 		KASSERT((m->flags & (PG_CACHED | PG_FREE)) == PG_FREE,
1027 		    ("vm_page_cache_free: page %p has inconsistent flags", m));
1028 		cnt.v_cache_count--;
1029 		cnt.v_free_count++;
1030 	}
1031 	empty = object->cache == NULL;
1032 	mtx_unlock(&vm_page_queue_free_mtx);
1033 	if (object->type == OBJT_VNODE && empty)
1034 		vdrop(object->handle);
1035 }
1036 
1037 /*
1038  *	Returns the cached page that is associated with the given
1039  *	object and offset.  If, however, none exists, returns NULL.
1040  *
1041  *	The free page queue must be locked.
1042  */
1043 static inline vm_page_t
1044 vm_page_cache_lookup(vm_object_t object, vm_pindex_t pindex)
1045 {
1046 	vm_page_t m;
1047 
1048 	mtx_assert(&vm_page_queue_free_mtx, MA_OWNED);
1049 	if ((m = object->cache) != NULL && m->pindex != pindex) {
1050 		m = vm_page_splay(pindex, m);
1051 		if ((object->cache = m)->pindex != pindex)
1052 			m = NULL;
1053 	}
1054 	return (m);
1055 }
1056 
1057 /*
1058  *	Remove the given cached page from its containing object's
1059  *	collection of cached pages.
1060  *
1061  *	The free page queue must be locked.
1062  */
1063 void
1064 vm_page_cache_remove(vm_page_t m)
1065 {
1066 	vm_object_t object;
1067 	vm_page_t root;
1068 
1069 	mtx_assert(&vm_page_queue_free_mtx, MA_OWNED);
1070 	KASSERT((m->flags & PG_CACHED) != 0,
1071 	    ("vm_page_cache_remove: page %p is not cached", m));
1072 	object = m->object;
1073 	if (m != object->cache) {
1074 		root = vm_page_splay(m->pindex, object->cache);
1075 		KASSERT(root == m,
1076 		    ("vm_page_cache_remove: page %p is not cached in object %p",
1077 		    m, object));
1078 	}
1079 	if (m->left == NULL)
1080 		root = m->right;
1081 	else if (m->right == NULL)
1082 		root = m->left;
1083 	else {
1084 		root = vm_page_splay(m->pindex, m->left);
1085 		root->right = m->right;
1086 	}
1087 	object->cache = root;
1088 	m->object = NULL;
1089 	cnt.v_cache_count--;
1090 }
1091 
1092 /*
1093  *	Transfer all of the cached pages with offset greater than or
1094  *	equal to 'offidxstart' from the original object's cache to the
1095  *	new object's cache.  However, any cached pages with offset
1096  *	greater than or equal to the new object's size are kept in the
1097  *	original object.  Initially, the new object's cache must be
1098  *	empty.  Offset 'offidxstart' in the original object must
1099  *	correspond to offset zero in the new object.
1100  *
1101  *	The new object must be locked.
1102  */
1103 void
1104 vm_page_cache_transfer(vm_object_t orig_object, vm_pindex_t offidxstart,
1105     vm_object_t new_object)
1106 {
1107 	vm_page_t m, m_next;
1108 
1109 	/*
1110 	 * Insertion into an object's collection of cached pages
1111 	 * requires the object to be locked.  In contrast, removal does
1112 	 * not.
1113 	 */
1114 	VM_OBJECT_LOCK_ASSERT(new_object, MA_OWNED);
1115 	KASSERT(new_object->cache == NULL,
1116 	    ("vm_page_cache_transfer: object %p has cached pages",
1117 	    new_object));
1118 	mtx_lock(&vm_page_queue_free_mtx);
1119 	if ((m = orig_object->cache) != NULL) {
1120 		/*
1121 		 * Transfer all of the pages with offset greater than or
1122 		 * equal to 'offidxstart' from the original object's
1123 		 * cache to the new object's cache.
1124 		 */
1125 		m = vm_page_splay(offidxstart, m);
1126 		if (m->pindex < offidxstart) {
1127 			orig_object->cache = m;
1128 			new_object->cache = m->right;
1129 			m->right = NULL;
1130 		} else {
1131 			orig_object->cache = m->left;
1132 			new_object->cache = m;
1133 			m->left = NULL;
1134 		}
1135 		while ((m = new_object->cache) != NULL) {
1136 			if ((m->pindex - offidxstart) >= new_object->size) {
1137 				/*
1138 				 * Return all of the cached pages with
1139 				 * offset greater than or equal to the
1140 				 * new object's size to the original
1141 				 * object's cache.
1142 				 */
1143 				new_object->cache = m->left;
1144 				m->left = orig_object->cache;
1145 				orig_object->cache = m;
1146 				break;
1147 			}
1148 			m_next = vm_page_splay(m->pindex, m->right);
1149 			/* Update the page's object and offset. */
1150 			m->object = new_object;
1151 			m->pindex -= offidxstart;
1152 			if (m_next == NULL)
1153 				break;
1154 			m->right = NULL;
1155 			m_next->left = m;
1156 			new_object->cache = m_next;
1157 		}
1158 		KASSERT(new_object->cache == NULL ||
1159 		    new_object->type == OBJT_SWAP,
1160 		    ("vm_page_cache_transfer: object %p's type is incompatible"
1161 		    " with cached pages", new_object));
1162 	}
1163 	mtx_unlock(&vm_page_queue_free_mtx);
1164 }
1165 
1166 /*
1167  *	vm_page_alloc:
1168  *
1169  *	Allocate and return a memory cell associated
1170  *	with this VM object/offset pair.
1171  *
1172  *	The caller must always specify an allocation class.
1173  *
1174  *	allocation classes:
1175  *	VM_ALLOC_NORMAL		normal process request
1176  *	VM_ALLOC_SYSTEM		system *really* needs a page
1177  *	VM_ALLOC_INTERRUPT	interrupt time request
1178  *
1179  *	optional allocation flags:
1180  *	VM_ALLOC_ZERO		prefer a zeroed page
1181  *	VM_ALLOC_WIRED		wire the allocated page
1182  *	VM_ALLOC_NOOBJ		page is not associated with a vm object
1183  *	VM_ALLOC_NOBUSY		do not set the page busy
1184  *	VM_ALLOC_IFCACHED	return page only if it is cached
1185  *	VM_ALLOC_IFNOTCACHED	return NULL, do not reactivate if the page
1186  *				is cached
1187  *
1188  *	This routine may not sleep.
1189  */
1190 vm_page_t
1191 vm_page_alloc(vm_object_t object, vm_pindex_t pindex, int req)
1192 {
1193 	struct vnode *vp = NULL;
1194 	vm_object_t m_object;
1195 	vm_page_t m;
1196 	int flags, page_req;
1197 
1198 	page_req = req & VM_ALLOC_CLASS_MASK;
1199 	KASSERT(curthread->td_intr_nesting_level == 0 ||
1200 	    page_req == VM_ALLOC_INTERRUPT,
1201 	    ("vm_page_alloc(NORMAL|SYSTEM) in interrupt context"));
1202 
1203 	if ((req & VM_ALLOC_NOOBJ) == 0) {
1204 		KASSERT(object != NULL,
1205 		    ("vm_page_alloc: NULL object."));
1206 		VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1207 	}
1208 
1209 	/*
1210 	 * The pager is allowed to eat deeper into the free page list.
1211 	 */
1212 	if ((curproc == pageproc) && (page_req != VM_ALLOC_INTERRUPT)) {
1213 		page_req = VM_ALLOC_SYSTEM;
1214 	};
1215 
1216 	mtx_lock(&vm_page_queue_free_mtx);
1217 	if (cnt.v_free_count + cnt.v_cache_count > cnt.v_free_reserved ||
1218 	    (page_req == VM_ALLOC_SYSTEM &&
1219 	    cnt.v_free_count + cnt.v_cache_count > cnt.v_interrupt_free_min) ||
1220 	    (page_req == VM_ALLOC_INTERRUPT &&
1221 	    cnt.v_free_count + cnt.v_cache_count > 0)) {
1222 		/*
1223 		 * Allocate from the free queue if the number of free pages
1224 		 * exceeds the minimum for the request class.
1225 		 */
1226 		if (object != NULL &&
1227 		    (m = vm_page_cache_lookup(object, pindex)) != NULL) {
1228 			if ((req & VM_ALLOC_IFNOTCACHED) != 0) {
1229 				mtx_unlock(&vm_page_queue_free_mtx);
1230 				return (NULL);
1231 			}
1232 			if (vm_phys_unfree_page(m))
1233 				vm_phys_set_pool(VM_FREEPOOL_DEFAULT, m, 0);
1234 #if VM_NRESERVLEVEL > 0
1235 			else if (!vm_reserv_reactivate_page(m))
1236 #else
1237 			else
1238 #endif
1239 				panic("vm_page_alloc: cache page %p is missing"
1240 				    " from the free queue", m);
1241 		} else if ((req & VM_ALLOC_IFCACHED) != 0) {
1242 			mtx_unlock(&vm_page_queue_free_mtx);
1243 			return (NULL);
1244 #if VM_NRESERVLEVEL > 0
1245 		} else if (object == NULL || object->type == OBJT_DEVICE ||
1246 		    object->type == OBJT_SG ||
1247 		    (object->flags & OBJ_COLORED) == 0 ||
1248 		    (m = vm_reserv_alloc_page(object, pindex)) == NULL) {
1249 #else
1250 		} else {
1251 #endif
1252 			m = vm_phys_alloc_pages(object != NULL ?
1253 			    VM_FREEPOOL_DEFAULT : VM_FREEPOOL_DIRECT, 0);
1254 #if VM_NRESERVLEVEL > 0
1255 			if (m == NULL && vm_reserv_reclaim_inactive()) {
1256 				m = vm_phys_alloc_pages(object != NULL ?
1257 				    VM_FREEPOOL_DEFAULT : VM_FREEPOOL_DIRECT,
1258 				    0);
1259 			}
1260 #endif
1261 		}
1262 	} else {
1263 		/*
1264 		 * Not allocatable, give up.
1265 		 */
1266 		mtx_unlock(&vm_page_queue_free_mtx);
1267 		atomic_add_int(&vm_pageout_deficit,
1268 		    MAX((u_int)req >> VM_ALLOC_COUNT_SHIFT, 1));
1269 		pagedaemon_wakeup();
1270 		return (NULL);
1271 	}
1272 
1273 	/*
1274 	 *  At this point we had better have found a good page.
1275 	 */
1276 
1277 	KASSERT(m != NULL, ("vm_page_alloc: missing page"));
1278 	KASSERT(m->queue == PQ_NONE,
1279 	    ("vm_page_alloc: page %p has unexpected queue %d", m, m->queue));
1280 	KASSERT(m->wire_count == 0, ("vm_page_alloc: page %p is wired", m));
1281 	KASSERT(m->hold_count == 0, ("vm_page_alloc: page %p is held", m));
1282 	KASSERT(m->busy == 0, ("vm_page_alloc: page %p is busy", m));
1283 	KASSERT(m->dirty == 0, ("vm_page_alloc: page %p is dirty", m));
1284 	KASSERT(pmap_page_get_memattr(m) == VM_MEMATTR_DEFAULT,
1285 	    ("vm_page_alloc: page %p has unexpected memattr %d", m,
1286 	    pmap_page_get_memattr(m)));
1287 	if ((m->flags & PG_CACHED) != 0) {
1288 		KASSERT(m->valid != 0,
1289 		    ("vm_page_alloc: cached page %p is invalid", m));
1290 		if (m->object == object && m->pindex == pindex)
1291 	  		cnt.v_reactivated++;
1292 		else
1293 			m->valid = 0;
1294 		m_object = m->object;
1295 		vm_page_cache_remove(m);
1296 		if (m_object->type == OBJT_VNODE && m_object->cache == NULL)
1297 			vp = m_object->handle;
1298 	} else {
1299 		KASSERT(VM_PAGE_IS_FREE(m),
1300 		    ("vm_page_alloc: page %p is not free", m));
1301 		KASSERT(m->valid == 0,
1302 		    ("vm_page_alloc: free page %p is valid", m));
1303 		cnt.v_free_count--;
1304 	}
1305 
1306 	/*
1307 	 * Initialize structure.  Only the PG_ZERO flag is inherited.
1308 	 */
1309 	flags = 0;
1310 	if (m->flags & PG_ZERO) {
1311 		vm_page_zero_count--;
1312 		if (req & VM_ALLOC_ZERO)
1313 			flags = PG_ZERO;
1314 	}
1315 	if (object == NULL || object->type == OBJT_PHYS)
1316 		flags |= PG_UNMANAGED;
1317 	m->flags = flags;
1318 	if (req & (VM_ALLOC_NOBUSY | VM_ALLOC_NOOBJ))
1319 		m->oflags = 0;
1320 	else
1321 		m->oflags = VPO_BUSY;
1322 	if (req & VM_ALLOC_WIRED) {
1323 		atomic_add_int(&cnt.v_wire_count, 1);
1324 		m->wire_count = 1;
1325 	}
1326 	m->act_count = 0;
1327 	mtx_unlock(&vm_page_queue_free_mtx);
1328 
1329 	if (object != NULL) {
1330 		/* Ignore device objects; the pager sets "memattr" for them. */
1331 		if (object->memattr != VM_MEMATTR_DEFAULT &&
1332 		    object->type != OBJT_DEVICE && object->type != OBJT_SG)
1333 			pmap_page_set_memattr(m, object->memattr);
1334 		vm_page_insert(m, object, pindex);
1335 	} else
1336 		m->pindex = pindex;
1337 
1338 	/*
1339 	 * The following call to vdrop() must come after the above call
1340 	 * to vm_page_insert() in case both affect the same object and
1341 	 * vnode.  Otherwise, the affected vnode's hold count could
1342 	 * temporarily become zero.
1343 	 */
1344 	if (vp != NULL)
1345 		vdrop(vp);
1346 
1347 	/*
1348 	 * Don't wakeup too often - wakeup the pageout daemon when
1349 	 * we would be nearly out of memory.
1350 	 */
1351 	if (vm_paging_needed())
1352 		pagedaemon_wakeup();
1353 
1354 	return (m);
1355 }
1356 
1357 /*
1358  *	vm_wait:	(also see VM_WAIT macro)
1359  *
1360  *	Block until free pages are available for allocation
1361  *	- Called in various places before memory allocations.
1362  */
1363 void
1364 vm_wait(void)
1365 {
1366 
1367 	mtx_lock(&vm_page_queue_free_mtx);
1368 	if (curproc == pageproc) {
1369 		vm_pageout_pages_needed = 1;
1370 		msleep(&vm_pageout_pages_needed, &vm_page_queue_free_mtx,
1371 		    PDROP | PSWP, "VMWait", 0);
1372 	} else {
1373 		if (!vm_pages_needed) {
1374 			vm_pages_needed = 1;
1375 			wakeup(&vm_pages_needed);
1376 		}
1377 		msleep(&cnt.v_free_count, &vm_page_queue_free_mtx, PDROP | PVM,
1378 		    "vmwait", 0);
1379 	}
1380 }
1381 
1382 /*
1383  *	vm_waitpfault:	(also see VM_WAITPFAULT macro)
1384  *
1385  *	Block until free pages are available for allocation
1386  *	- Called only in vm_fault so that processes page faulting
1387  *	  can be easily tracked.
1388  *	- Sleeps at a lower priority than vm_wait() so that vm_wait()ing
1389  *	  processes will be able to grab memory first.  Do not change
1390  *	  this balance without careful testing first.
1391  */
1392 void
1393 vm_waitpfault(void)
1394 {
1395 
1396 	mtx_lock(&vm_page_queue_free_mtx);
1397 	if (!vm_pages_needed) {
1398 		vm_pages_needed = 1;
1399 		wakeup(&vm_pages_needed);
1400 	}
1401 	msleep(&cnt.v_free_count, &vm_page_queue_free_mtx, PDROP | PUSER,
1402 	    "pfault", 0);
1403 }
1404 
1405 /*
1406  *	vm_page_requeue:
1407  *
1408  *	Move the given page to the tail of its present page queue.
1409  *
1410  *	The page queues must be locked.
1411  */
1412 void
1413 vm_page_requeue(vm_page_t m)
1414 {
1415 	struct vpgqueues *vpq;
1416 	int queue;
1417 
1418 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
1419 	queue = m->queue;
1420 	KASSERT(queue != PQ_NONE,
1421 	    ("vm_page_requeue: page %p is not queued", m));
1422 	vpq = &vm_page_queues[queue];
1423 	TAILQ_REMOVE(&vpq->pl, m, pageq);
1424 	TAILQ_INSERT_TAIL(&vpq->pl, m, pageq);
1425 }
1426 
1427 /*
1428  *	vm_page_queue_remove:
1429  *
1430  *	Remove the given page from the specified queue.
1431  *
1432  *	The page and page queues must be locked.
1433  */
1434 static __inline void
1435 vm_page_queue_remove(int queue, vm_page_t m)
1436 {
1437 	struct vpgqueues *pq;
1438 
1439 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
1440 	vm_page_lock_assert(m, MA_OWNED);
1441 	pq = &vm_page_queues[queue];
1442 	TAILQ_REMOVE(&pq->pl, m, pageq);
1443 	(*pq->cnt)--;
1444 }
1445 
1446 /*
1447  *	vm_pageq_remove:
1448  *
1449  *	Remove a page from its queue.
1450  *
1451  *	The given page must be locked.
1452  *	This routine may not block.
1453  */
1454 void
1455 vm_pageq_remove(vm_page_t m)
1456 {
1457 	int queue;
1458 
1459 	vm_page_lock_assert(m, MA_OWNED);
1460 	if ((queue = m->queue) != PQ_NONE) {
1461 		vm_page_lock_queues();
1462 		m->queue = PQ_NONE;
1463 		vm_page_queue_remove(queue, m);
1464 		vm_page_unlock_queues();
1465 	}
1466 }
1467 
1468 /*
1469  *	vm_page_enqueue:
1470  *
1471  *	Add the given page to the specified queue.
1472  *
1473  *	The page queues must be locked.
1474  */
1475 static void
1476 vm_page_enqueue(int queue, vm_page_t m)
1477 {
1478 	struct vpgqueues *vpq;
1479 
1480 	vpq = &vm_page_queues[queue];
1481 	m->queue = queue;
1482 	TAILQ_INSERT_TAIL(&vpq->pl, m, pageq);
1483 	++*vpq->cnt;
1484 }
1485 
1486 /*
1487  *	vm_page_activate:
1488  *
1489  *	Put the specified page on the active list (if appropriate).
1490  *	Ensure that act_count is at least ACT_INIT but do not otherwise
1491  *	mess with it.
1492  *
1493  *	The page must be locked.
1494  *	This routine may not block.
1495  */
1496 void
1497 vm_page_activate(vm_page_t m)
1498 {
1499 	int queue;
1500 
1501 	vm_page_lock_assert(m, MA_OWNED);
1502 	if ((queue = m->queue) != PQ_ACTIVE) {
1503 		if (m->wire_count == 0 && (m->flags & PG_UNMANAGED) == 0) {
1504 			if (m->act_count < ACT_INIT)
1505 				m->act_count = ACT_INIT;
1506 			vm_page_lock_queues();
1507 			if (queue != PQ_NONE)
1508 				vm_page_queue_remove(queue, m);
1509 			vm_page_enqueue(PQ_ACTIVE, m);
1510 			vm_page_unlock_queues();
1511 		} else
1512 			KASSERT(queue == PQ_NONE,
1513 			    ("vm_page_activate: wired page %p is queued", m));
1514 	} else {
1515 		if (m->act_count < ACT_INIT)
1516 			m->act_count = ACT_INIT;
1517 	}
1518 }
1519 
1520 /*
1521  *	vm_page_free_wakeup:
1522  *
1523  *	Helper routine for vm_page_free_toq() and vm_page_cache().  This
1524  *	routine is called when a page has been added to the cache or free
1525  *	queues.
1526  *
1527  *	The page queues must be locked.
1528  *	This routine may not block.
1529  */
1530 static inline void
1531 vm_page_free_wakeup(void)
1532 {
1533 
1534 	mtx_assert(&vm_page_queue_free_mtx, MA_OWNED);
1535 	/*
1536 	 * if pageout daemon needs pages, then tell it that there are
1537 	 * some free.
1538 	 */
1539 	if (vm_pageout_pages_needed &&
1540 	    cnt.v_cache_count + cnt.v_free_count >= cnt.v_pageout_free_min) {
1541 		wakeup(&vm_pageout_pages_needed);
1542 		vm_pageout_pages_needed = 0;
1543 	}
1544 	/*
1545 	 * wakeup processes that are waiting on memory if we hit a
1546 	 * high water mark. And wakeup scheduler process if we have
1547 	 * lots of memory. this process will swapin processes.
1548 	 */
1549 	if (vm_pages_needed && !vm_page_count_min()) {
1550 		vm_pages_needed = 0;
1551 		wakeup(&cnt.v_free_count);
1552 	}
1553 }
1554 
1555 /*
1556  *	vm_page_free_toq:
1557  *
1558  *	Returns the given page to the free list,
1559  *	disassociating it with any VM object.
1560  *
1561  *	Object and page must be locked prior to entry.
1562  *	This routine may not block.
1563  */
1564 
1565 void
1566 vm_page_free_toq(vm_page_t m)
1567 {
1568 
1569 	if ((m->flags & PG_UNMANAGED) == 0) {
1570 		vm_page_lock_assert(m, MA_OWNED);
1571 		KASSERT(!pmap_page_is_mapped(m),
1572 		    ("vm_page_free_toq: freeing mapped page %p", m));
1573 	}
1574 	PCPU_INC(cnt.v_tfree);
1575 
1576 	if (m->busy || VM_PAGE_IS_FREE(m)) {
1577 		printf(
1578 		"vm_page_free: pindex(%lu), busy(%d), VPO_BUSY(%d), hold(%d)\n",
1579 		    (u_long)m->pindex, m->busy, (m->oflags & VPO_BUSY) ? 1 : 0,
1580 		    m->hold_count);
1581 		if (VM_PAGE_IS_FREE(m))
1582 			panic("vm_page_free: freeing free page");
1583 		else
1584 			panic("vm_page_free: freeing busy page");
1585 	}
1586 
1587 	/*
1588 	 * unqueue, then remove page.  Note that we cannot destroy
1589 	 * the page here because we do not want to call the pager's
1590 	 * callback routine until after we've put the page on the
1591 	 * appropriate free queue.
1592 	 */
1593 	if ((m->flags & PG_UNMANAGED) == 0)
1594 		vm_pageq_remove(m);
1595 	vm_page_remove(m);
1596 
1597 	/*
1598 	 * If fictitious remove object association and
1599 	 * return, otherwise delay object association removal.
1600 	 */
1601 	if ((m->flags & PG_FICTITIOUS) != 0) {
1602 		return;
1603 	}
1604 
1605 	m->valid = 0;
1606 	vm_page_undirty(m);
1607 
1608 	if (m->wire_count != 0) {
1609 		if (m->wire_count > 1) {
1610 			panic("vm_page_free: invalid wire count (%d), pindex: 0x%lx",
1611 				m->wire_count, (long)m->pindex);
1612 		}
1613 		panic("vm_page_free: freeing wired page");
1614 	}
1615 	if (m->hold_count != 0) {
1616 		m->flags &= ~PG_ZERO;
1617 		vm_page_lock_queues();
1618 		vm_page_enqueue(PQ_HOLD, m);
1619 		vm_page_unlock_queues();
1620 	} else {
1621 		/*
1622 		 * Restore the default memory attribute to the page.
1623 		 */
1624 		if (pmap_page_get_memattr(m) != VM_MEMATTR_DEFAULT)
1625 			pmap_page_set_memattr(m, VM_MEMATTR_DEFAULT);
1626 
1627 		/*
1628 		 * Insert the page into the physical memory allocator's
1629 		 * cache/free page queues.
1630 		 */
1631 		mtx_lock(&vm_page_queue_free_mtx);
1632 		m->flags |= PG_FREE;
1633 		cnt.v_free_count++;
1634 #if VM_NRESERVLEVEL > 0
1635 		if (!vm_reserv_free_page(m))
1636 #else
1637 		if (TRUE)
1638 #endif
1639 			vm_phys_free_pages(m, 0);
1640 		if ((m->flags & PG_ZERO) != 0)
1641 			++vm_page_zero_count;
1642 		else
1643 			vm_page_zero_idle_wakeup();
1644 		vm_page_free_wakeup();
1645 		mtx_unlock(&vm_page_queue_free_mtx);
1646 	}
1647 }
1648 
1649 /*
1650  *	vm_page_wire:
1651  *
1652  *	Mark this page as wired down by yet
1653  *	another map, removing it from paging queues
1654  *	as necessary.
1655  *
1656  *	If the page is fictitious, then its wire count must remain one.
1657  *
1658  *	The page must be locked.
1659  *	This routine may not block.
1660  */
1661 void
1662 vm_page_wire(vm_page_t m)
1663 {
1664 
1665 	/*
1666 	 * Only bump the wire statistics if the page is not already wired,
1667 	 * and only unqueue the page if it is on some queue (if it is unmanaged
1668 	 * it is already off the queues).
1669 	 */
1670 	vm_page_lock_assert(m, MA_OWNED);
1671 	if ((m->flags & PG_FICTITIOUS) != 0) {
1672 		KASSERT(m->wire_count == 1,
1673 		    ("vm_page_wire: fictitious page %p's wire count isn't one",
1674 		    m));
1675 		return;
1676 	}
1677 	if (m->wire_count == 0) {
1678 		if ((m->flags & PG_UNMANAGED) == 0)
1679 			vm_pageq_remove(m);
1680 		atomic_add_int(&cnt.v_wire_count, 1);
1681 	}
1682 	m->wire_count++;
1683 	KASSERT(m->wire_count != 0, ("vm_page_wire: wire_count overflow m=%p", m));
1684 }
1685 
1686 /*
1687  * vm_page_unwire:
1688  *
1689  * Release one wiring of the specified page, potentially enabling it to be
1690  * paged again.  If paging is enabled, then the value of the parameter
1691  * "activate" determines to which queue the page is added.  If "activate" is
1692  * non-zero, then the page is added to the active queue.  Otherwise, it is
1693  * added to the inactive queue.
1694  *
1695  * However, unless the page belongs to an object, it is not enqueued because
1696  * it cannot be paged out.
1697  *
1698  * If a page is fictitious, then its wire count must alway be one.
1699  *
1700  * A managed page must be locked.
1701  */
1702 void
1703 vm_page_unwire(vm_page_t m, int activate)
1704 {
1705 
1706 	if ((m->flags & PG_UNMANAGED) == 0)
1707 		vm_page_lock_assert(m, MA_OWNED);
1708 	if ((m->flags & PG_FICTITIOUS) != 0) {
1709 		KASSERT(m->wire_count == 1,
1710 	    ("vm_page_unwire: fictitious page %p's wire count isn't one", m));
1711 		return;
1712 	}
1713 	if (m->wire_count > 0) {
1714 		m->wire_count--;
1715 		if (m->wire_count == 0) {
1716 			atomic_subtract_int(&cnt.v_wire_count, 1);
1717 			if ((m->flags & PG_UNMANAGED) != 0 ||
1718 			    m->object == NULL)
1719 				return;
1720 			vm_page_lock_queues();
1721 			if (activate)
1722 				vm_page_enqueue(PQ_ACTIVE, m);
1723 			else {
1724 				vm_page_flag_clear(m, PG_WINATCFLS);
1725 				vm_page_enqueue(PQ_INACTIVE, m);
1726 			}
1727 			vm_page_unlock_queues();
1728 		}
1729 	} else
1730 		panic("vm_page_unwire: page %p's wire count is zero", m);
1731 }
1732 
1733 /*
1734  * Move the specified page to the inactive queue.
1735  *
1736  * Many pages placed on the inactive queue should actually go
1737  * into the cache, but it is difficult to figure out which.  What
1738  * we do instead, if the inactive target is well met, is to put
1739  * clean pages at the head of the inactive queue instead of the tail.
1740  * This will cause them to be moved to the cache more quickly and
1741  * if not actively re-referenced, reclaimed more quickly.  If we just
1742  * stick these pages at the end of the inactive queue, heavy filesystem
1743  * meta-data accesses can cause an unnecessary paging load on memory bound
1744  * processes.  This optimization causes one-time-use metadata to be
1745  * reused more quickly.
1746  *
1747  * Normally athead is 0 resulting in LRU operation.  athead is set
1748  * to 1 if we want this page to be 'as if it were placed in the cache',
1749  * except without unmapping it from the process address space.
1750  *
1751  * This routine may not block.
1752  */
1753 static inline void
1754 _vm_page_deactivate(vm_page_t m, int athead)
1755 {
1756 	int queue;
1757 
1758 	vm_page_lock_assert(m, MA_OWNED);
1759 
1760 	/*
1761 	 * Ignore if already inactive.
1762 	 */
1763 	if ((queue = m->queue) == PQ_INACTIVE)
1764 		return;
1765 	if (m->wire_count == 0 && (m->flags & PG_UNMANAGED) == 0) {
1766 		vm_page_lock_queues();
1767 		vm_page_flag_clear(m, PG_WINATCFLS);
1768 		if (queue != PQ_NONE)
1769 			vm_page_queue_remove(queue, m);
1770 		if (athead)
1771 			TAILQ_INSERT_HEAD(&vm_page_queues[PQ_INACTIVE].pl, m,
1772 			    pageq);
1773 		else
1774 			TAILQ_INSERT_TAIL(&vm_page_queues[PQ_INACTIVE].pl, m,
1775 			    pageq);
1776 		m->queue = PQ_INACTIVE;
1777 		cnt.v_inactive_count++;
1778 		vm_page_unlock_queues();
1779 	}
1780 }
1781 
1782 /*
1783  * Move the specified page to the inactive queue.
1784  *
1785  * The page must be locked.
1786  */
1787 void
1788 vm_page_deactivate(vm_page_t m)
1789 {
1790 
1791 	_vm_page_deactivate(m, 0);
1792 }
1793 
1794 /*
1795  * vm_page_try_to_cache:
1796  *
1797  * Returns 0 on failure, 1 on success
1798  */
1799 int
1800 vm_page_try_to_cache(vm_page_t m)
1801 {
1802 
1803 	vm_page_lock_assert(m, MA_OWNED);
1804 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
1805 	if (m->dirty || m->hold_count || m->busy || m->wire_count ||
1806 	    (m->oflags & VPO_BUSY) || (m->flags & PG_UNMANAGED))
1807 		return (0);
1808 	pmap_remove_all(m);
1809 	if (m->dirty)
1810 		return (0);
1811 	vm_page_cache(m);
1812 	return (1);
1813 }
1814 
1815 /*
1816  * vm_page_try_to_free()
1817  *
1818  *	Attempt to free the page.  If we cannot free it, we do nothing.
1819  *	1 is returned on success, 0 on failure.
1820  */
1821 int
1822 vm_page_try_to_free(vm_page_t m)
1823 {
1824 
1825 	vm_page_lock_assert(m, MA_OWNED);
1826 	if (m->object != NULL)
1827 		VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
1828 	if (m->dirty || m->hold_count || m->busy || m->wire_count ||
1829 	    (m->oflags & VPO_BUSY) || (m->flags & PG_UNMANAGED))
1830 		return (0);
1831 	pmap_remove_all(m);
1832 	if (m->dirty)
1833 		return (0);
1834 	vm_page_free(m);
1835 	return (1);
1836 }
1837 
1838 /*
1839  * vm_page_cache
1840  *
1841  * Put the specified page onto the page cache queue (if appropriate).
1842  *
1843  * This routine may not block.
1844  */
1845 void
1846 vm_page_cache(vm_page_t m)
1847 {
1848 	vm_object_t object;
1849 	vm_page_t root;
1850 
1851 	vm_page_lock_assert(m, MA_OWNED);
1852 	object = m->object;
1853 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1854 	if ((m->flags & PG_UNMANAGED) || (m->oflags & VPO_BUSY) || m->busy ||
1855 	    m->hold_count || m->wire_count)
1856 		panic("vm_page_cache: attempting to cache busy page");
1857 	pmap_remove_all(m);
1858 	if (m->dirty != 0)
1859 		panic("vm_page_cache: page %p is dirty", m);
1860 	if (m->valid == 0 || object->type == OBJT_DEFAULT ||
1861 	    (object->type == OBJT_SWAP &&
1862 	    !vm_pager_has_page(object, m->pindex, NULL, NULL))) {
1863 		/*
1864 		 * Hypothesis: A cache-elgible page belonging to a
1865 		 * default object or swap object but without a backing
1866 		 * store must be zero filled.
1867 		 */
1868 		vm_page_free(m);
1869 		return;
1870 	}
1871 	KASSERT((m->flags & PG_CACHED) == 0,
1872 	    ("vm_page_cache: page %p is already cached", m));
1873 	PCPU_INC(cnt.v_tcached);
1874 
1875 	/*
1876 	 * Remove the page from the paging queues.
1877 	 */
1878 	vm_pageq_remove(m);
1879 
1880 	/*
1881 	 * Remove the page from the object's collection of resident
1882 	 * pages.
1883 	 */
1884 	if (m != object->root)
1885 		vm_page_splay(m->pindex, object->root);
1886 	if (m->left == NULL)
1887 		root = m->right;
1888 	else {
1889 		root = vm_page_splay(m->pindex, m->left);
1890 		root->right = m->right;
1891 	}
1892 	object->root = root;
1893 	TAILQ_REMOVE(&object->memq, m, listq);
1894 	object->resident_page_count--;
1895 	object->generation++;
1896 
1897 	/*
1898 	 * Restore the default memory attribute to the page.
1899 	 */
1900 	if (pmap_page_get_memattr(m) != VM_MEMATTR_DEFAULT)
1901 		pmap_page_set_memattr(m, VM_MEMATTR_DEFAULT);
1902 
1903 	/*
1904 	 * Insert the page into the object's collection of cached pages
1905 	 * and the physical memory allocator's cache/free page queues.
1906 	 */
1907 	m->flags &= ~PG_ZERO;
1908 	mtx_lock(&vm_page_queue_free_mtx);
1909 	m->flags |= PG_CACHED;
1910 	cnt.v_cache_count++;
1911 	root = object->cache;
1912 	if (root == NULL) {
1913 		m->left = NULL;
1914 		m->right = NULL;
1915 	} else {
1916 		root = vm_page_splay(m->pindex, root);
1917 		if (m->pindex < root->pindex) {
1918 			m->left = root->left;
1919 			m->right = root;
1920 			root->left = NULL;
1921 		} else if (__predict_false(m->pindex == root->pindex))
1922 			panic("vm_page_cache: offset already cached");
1923 		else {
1924 			m->right = root->right;
1925 			m->left = root;
1926 			root->right = NULL;
1927 		}
1928 	}
1929 	object->cache = m;
1930 #if VM_NRESERVLEVEL > 0
1931 	if (!vm_reserv_free_page(m)) {
1932 #else
1933 	if (TRUE) {
1934 #endif
1935 		vm_phys_set_pool(VM_FREEPOOL_CACHE, m, 0);
1936 		vm_phys_free_pages(m, 0);
1937 	}
1938 	vm_page_free_wakeup();
1939 	mtx_unlock(&vm_page_queue_free_mtx);
1940 
1941 	/*
1942 	 * Increment the vnode's hold count if this is the object's only
1943 	 * cached page.  Decrement the vnode's hold count if this was
1944 	 * the object's only resident page.
1945 	 */
1946 	if (object->type == OBJT_VNODE) {
1947 		if (root == NULL && object->resident_page_count != 0)
1948 			vhold(object->handle);
1949 		else if (root != NULL && object->resident_page_count == 0)
1950 			vdrop(object->handle);
1951 	}
1952 }
1953 
1954 /*
1955  * vm_page_dontneed
1956  *
1957  *	Cache, deactivate, or do nothing as appropriate.  This routine
1958  *	is typically used by madvise() MADV_DONTNEED.
1959  *
1960  *	Generally speaking we want to move the page into the cache so
1961  *	it gets reused quickly.  However, this can result in a silly syndrome
1962  *	due to the page recycling too quickly.  Small objects will not be
1963  *	fully cached.  On the otherhand, if we move the page to the inactive
1964  *	queue we wind up with a problem whereby very large objects
1965  *	unnecessarily blow away our inactive and cache queues.
1966  *
1967  *	The solution is to move the pages based on a fixed weighting.  We
1968  *	either leave them alone, deactivate them, or move them to the cache,
1969  *	where moving them to the cache has the highest weighting.
1970  *	By forcing some pages into other queues we eventually force the
1971  *	system to balance the queues, potentially recovering other unrelated
1972  *	space from active.  The idea is to not force this to happen too
1973  *	often.
1974  */
1975 void
1976 vm_page_dontneed(vm_page_t m)
1977 {
1978 	int dnw;
1979 	int head;
1980 
1981 	vm_page_lock_assert(m, MA_OWNED);
1982 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
1983 	dnw = PCPU_GET(dnweight);
1984 	PCPU_INC(dnweight);
1985 
1986 	/*
1987 	 * Occasionally leave the page alone.
1988 	 */
1989 	if ((dnw & 0x01F0) == 0 || m->queue == PQ_INACTIVE) {
1990 		if (m->act_count >= ACT_INIT)
1991 			--m->act_count;
1992 		return;
1993 	}
1994 
1995 	/*
1996 	 * Clear any references to the page.  Otherwise, the page daemon will
1997 	 * immediately reactivate the page.
1998 	 *
1999 	 * Perform the pmap_clear_reference() first.  Otherwise, a concurrent
2000 	 * pmap operation, such as pmap_remove(), could clear a reference in
2001 	 * the pmap and set PG_REFERENCED on the page before the
2002 	 * pmap_clear_reference() had completed.  Consequently, the page would
2003 	 * appear referenced based upon an old reference that occurred before
2004 	 * this function ran.
2005 	 */
2006 	pmap_clear_reference(m);
2007 	vm_page_lock_queues();
2008 	vm_page_flag_clear(m, PG_REFERENCED);
2009 	vm_page_unlock_queues();
2010 
2011 	if (m->dirty == 0 && pmap_is_modified(m))
2012 		vm_page_dirty(m);
2013 
2014 	if (m->dirty || (dnw & 0x0070) == 0) {
2015 		/*
2016 		 * Deactivate the page 3 times out of 32.
2017 		 */
2018 		head = 0;
2019 	} else {
2020 		/*
2021 		 * Cache the page 28 times out of every 32.  Note that
2022 		 * the page is deactivated instead of cached, but placed
2023 		 * at the head of the queue instead of the tail.
2024 		 */
2025 		head = 1;
2026 	}
2027 	_vm_page_deactivate(m, head);
2028 }
2029 
2030 /*
2031  * Grab a page, waiting until we are waken up due to the page
2032  * changing state.  We keep on waiting, if the page continues
2033  * to be in the object.  If the page doesn't exist, first allocate it
2034  * and then conditionally zero it.
2035  *
2036  * The caller must always specify the VM_ALLOC_RETRY flag.  This is intended
2037  * to facilitate its eventual removal.
2038  *
2039  * This routine may block.
2040  */
2041 vm_page_t
2042 vm_page_grab(vm_object_t object, vm_pindex_t pindex, int allocflags)
2043 {
2044 	vm_page_t m;
2045 
2046 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
2047 	KASSERT((allocflags & VM_ALLOC_RETRY) != 0,
2048 	    ("vm_page_grab: VM_ALLOC_RETRY is required"));
2049 retrylookup:
2050 	if ((m = vm_page_lookup(object, pindex)) != NULL) {
2051 		if ((m->oflags & VPO_BUSY) != 0 ||
2052 		    ((allocflags & VM_ALLOC_IGN_SBUSY) == 0 && m->busy != 0)) {
2053 			/*
2054 			 * Reference the page before unlocking and
2055 			 * sleeping so that the page daemon is less
2056 			 * likely to reclaim it.
2057 			 */
2058 			vm_page_lock_queues();
2059 			vm_page_flag_set(m, PG_REFERENCED);
2060 			vm_page_sleep(m, "pgrbwt");
2061 			goto retrylookup;
2062 		} else {
2063 			if ((allocflags & VM_ALLOC_WIRED) != 0) {
2064 				vm_page_lock(m);
2065 				vm_page_wire(m);
2066 				vm_page_unlock(m);
2067 			}
2068 			if ((allocflags & VM_ALLOC_NOBUSY) == 0)
2069 				vm_page_busy(m);
2070 			return (m);
2071 		}
2072 	}
2073 	m = vm_page_alloc(object, pindex, allocflags & ~(VM_ALLOC_RETRY |
2074 	    VM_ALLOC_IGN_SBUSY));
2075 	if (m == NULL) {
2076 		VM_OBJECT_UNLOCK(object);
2077 		VM_WAIT;
2078 		VM_OBJECT_LOCK(object);
2079 		goto retrylookup;
2080 	} else if (m->valid != 0)
2081 		return (m);
2082 	if (allocflags & VM_ALLOC_ZERO && (m->flags & PG_ZERO) == 0)
2083 		pmap_zero_page(m);
2084 	return (m);
2085 }
2086 
2087 /*
2088  * Mapping function for valid bits or for dirty bits in
2089  * a page.  May not block.
2090  *
2091  * Inputs are required to range within a page.
2092  */
2093 int
2094 vm_page_bits(int base, int size)
2095 {
2096 	int first_bit;
2097 	int last_bit;
2098 
2099 	KASSERT(
2100 	    base + size <= PAGE_SIZE,
2101 	    ("vm_page_bits: illegal base/size %d/%d", base, size)
2102 	);
2103 
2104 	if (size == 0)		/* handle degenerate case */
2105 		return (0);
2106 
2107 	first_bit = base >> DEV_BSHIFT;
2108 	last_bit = (base + size - 1) >> DEV_BSHIFT;
2109 
2110 	return ((2 << last_bit) - (1 << first_bit));
2111 }
2112 
2113 /*
2114  *	vm_page_set_valid:
2115  *
2116  *	Sets portions of a page valid.  The arguments are expected
2117  *	to be DEV_BSIZE aligned but if they aren't the bitmap is inclusive
2118  *	of any partial chunks touched by the range.  The invalid portion of
2119  *	such chunks will be zeroed.
2120  *
2121  *	(base + size) must be less then or equal to PAGE_SIZE.
2122  */
2123 void
2124 vm_page_set_valid(vm_page_t m, int base, int size)
2125 {
2126 	int endoff, frag;
2127 
2128 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2129 	if (size == 0)	/* handle degenerate case */
2130 		return;
2131 
2132 	/*
2133 	 * If the base is not DEV_BSIZE aligned and the valid
2134 	 * bit is clear, we have to zero out a portion of the
2135 	 * first block.
2136 	 */
2137 	if ((frag = base & ~(DEV_BSIZE - 1)) != base &&
2138 	    (m->valid & (1 << (base >> DEV_BSHIFT))) == 0)
2139 		pmap_zero_page_area(m, frag, base - frag);
2140 
2141 	/*
2142 	 * If the ending offset is not DEV_BSIZE aligned and the
2143 	 * valid bit is clear, we have to zero out a portion of
2144 	 * the last block.
2145 	 */
2146 	endoff = base + size;
2147 	if ((frag = endoff & ~(DEV_BSIZE - 1)) != endoff &&
2148 	    (m->valid & (1 << (endoff >> DEV_BSHIFT))) == 0)
2149 		pmap_zero_page_area(m, endoff,
2150 		    DEV_BSIZE - (endoff & (DEV_BSIZE - 1)));
2151 
2152 	/*
2153 	 * Assert that no previously invalid block that is now being validated
2154 	 * is already dirty.
2155 	 */
2156 	KASSERT((~m->valid & vm_page_bits(base, size) & m->dirty) == 0,
2157 	    ("vm_page_set_valid: page %p is dirty", m));
2158 
2159 	/*
2160 	 * Set valid bits inclusive of any overlap.
2161 	 */
2162 	m->valid |= vm_page_bits(base, size);
2163 }
2164 
2165 /*
2166  * Clear the given bits from the specified page's dirty field.
2167  */
2168 static __inline void
2169 vm_page_clear_dirty_mask(vm_page_t m, int pagebits)
2170 {
2171 
2172 	/*
2173 	 * If the object is locked and the page is neither VPO_BUSY nor
2174 	 * PG_WRITEABLE, then the page's dirty field cannot possibly be
2175 	 * modified by a concurrent pmap operation.
2176 	 */
2177 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2178 	if ((m->oflags & VPO_BUSY) == 0 && (m->flags & PG_WRITEABLE) == 0)
2179 		m->dirty &= ~pagebits;
2180 	else {
2181 		vm_page_lock_queues();
2182 		m->dirty &= ~pagebits;
2183 		vm_page_unlock_queues();
2184 	}
2185 }
2186 
2187 /*
2188  *	vm_page_set_validclean:
2189  *
2190  *	Sets portions of a page valid and clean.  The arguments are expected
2191  *	to be DEV_BSIZE aligned but if they aren't the bitmap is inclusive
2192  *	of any partial chunks touched by the range.  The invalid portion of
2193  *	such chunks will be zero'd.
2194  *
2195  *	This routine may not block.
2196  *
2197  *	(base + size) must be less then or equal to PAGE_SIZE.
2198  */
2199 void
2200 vm_page_set_validclean(vm_page_t m, int base, int size)
2201 {
2202 	u_long oldvalid;
2203 	int endoff, frag, pagebits;
2204 
2205 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2206 	if (size == 0)	/* handle degenerate case */
2207 		return;
2208 
2209 	/*
2210 	 * If the base is not DEV_BSIZE aligned and the valid
2211 	 * bit is clear, we have to zero out a portion of the
2212 	 * first block.
2213 	 */
2214 	if ((frag = base & ~(DEV_BSIZE - 1)) != base &&
2215 	    (m->valid & (1 << (base >> DEV_BSHIFT))) == 0)
2216 		pmap_zero_page_area(m, frag, base - frag);
2217 
2218 	/*
2219 	 * If the ending offset is not DEV_BSIZE aligned and the
2220 	 * valid bit is clear, we have to zero out a portion of
2221 	 * the last block.
2222 	 */
2223 	endoff = base + size;
2224 	if ((frag = endoff & ~(DEV_BSIZE - 1)) != endoff &&
2225 	    (m->valid & (1 << (endoff >> DEV_BSHIFT))) == 0)
2226 		pmap_zero_page_area(m, endoff,
2227 		    DEV_BSIZE - (endoff & (DEV_BSIZE - 1)));
2228 
2229 	/*
2230 	 * Set valid, clear dirty bits.  If validating the entire
2231 	 * page we can safely clear the pmap modify bit.  We also
2232 	 * use this opportunity to clear the VPO_NOSYNC flag.  If a process
2233 	 * takes a write fault on a MAP_NOSYNC memory area the flag will
2234 	 * be set again.
2235 	 *
2236 	 * We set valid bits inclusive of any overlap, but we can only
2237 	 * clear dirty bits for DEV_BSIZE chunks that are fully within
2238 	 * the range.
2239 	 */
2240 	oldvalid = m->valid;
2241 	pagebits = vm_page_bits(base, size);
2242 	m->valid |= pagebits;
2243 #if 0	/* NOT YET */
2244 	if ((frag = base & (DEV_BSIZE - 1)) != 0) {
2245 		frag = DEV_BSIZE - frag;
2246 		base += frag;
2247 		size -= frag;
2248 		if (size < 0)
2249 			size = 0;
2250 	}
2251 	pagebits = vm_page_bits(base, size & (DEV_BSIZE - 1));
2252 #endif
2253 	if (base == 0 && size == PAGE_SIZE) {
2254 		/*
2255 		 * The page can only be modified within the pmap if it is
2256 		 * mapped, and it can only be mapped if it was previously
2257 		 * fully valid.
2258 		 */
2259 		if (oldvalid == VM_PAGE_BITS_ALL)
2260 			/*
2261 			 * Perform the pmap_clear_modify() first.  Otherwise,
2262 			 * a concurrent pmap operation, such as
2263 			 * pmap_protect(), could clear a modification in the
2264 			 * pmap and set the dirty field on the page before
2265 			 * pmap_clear_modify() had begun and after the dirty
2266 			 * field was cleared here.
2267 			 */
2268 			pmap_clear_modify(m);
2269 		m->dirty = 0;
2270 		m->oflags &= ~VPO_NOSYNC;
2271 	} else if (oldvalid != VM_PAGE_BITS_ALL)
2272 		m->dirty &= ~pagebits;
2273 	else
2274 		vm_page_clear_dirty_mask(m, pagebits);
2275 }
2276 
2277 void
2278 vm_page_clear_dirty(vm_page_t m, int base, int size)
2279 {
2280 
2281 	vm_page_clear_dirty_mask(m, vm_page_bits(base, size));
2282 }
2283 
2284 /*
2285  *	vm_page_set_invalid:
2286  *
2287  *	Invalidates DEV_BSIZE'd chunks within a page.  Both the
2288  *	valid and dirty bits for the effected areas are cleared.
2289  *
2290  *	May not block.
2291  */
2292 void
2293 vm_page_set_invalid(vm_page_t m, int base, int size)
2294 {
2295 	int bits;
2296 
2297 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2298 	KASSERT((m->oflags & VPO_BUSY) == 0,
2299 	    ("vm_page_set_invalid: page %p is busy", m));
2300 	bits = vm_page_bits(base, size);
2301 	if (m->valid == VM_PAGE_BITS_ALL && bits != 0)
2302 		pmap_remove_all(m);
2303 	KASSERT(!pmap_page_is_mapped(m),
2304 	    ("vm_page_set_invalid: page %p is mapped", m));
2305 	m->valid &= ~bits;
2306 	m->dirty &= ~bits;
2307 	m->object->generation++;
2308 }
2309 
2310 /*
2311  * vm_page_zero_invalid()
2312  *
2313  *	The kernel assumes that the invalid portions of a page contain
2314  *	garbage, but such pages can be mapped into memory by user code.
2315  *	When this occurs, we must zero out the non-valid portions of the
2316  *	page so user code sees what it expects.
2317  *
2318  *	Pages are most often semi-valid when the end of a file is mapped
2319  *	into memory and the file's size is not page aligned.
2320  */
2321 void
2322 vm_page_zero_invalid(vm_page_t m, boolean_t setvalid)
2323 {
2324 	int b;
2325 	int i;
2326 
2327 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2328 	/*
2329 	 * Scan the valid bits looking for invalid sections that
2330 	 * must be zerod.  Invalid sub-DEV_BSIZE'd areas ( where the
2331 	 * valid bit may be set ) have already been zerod by
2332 	 * vm_page_set_validclean().
2333 	 */
2334 	for (b = i = 0; i <= PAGE_SIZE / DEV_BSIZE; ++i) {
2335 		if (i == (PAGE_SIZE / DEV_BSIZE) ||
2336 		    (m->valid & (1 << i))
2337 		) {
2338 			if (i > b) {
2339 				pmap_zero_page_area(m,
2340 				    b << DEV_BSHIFT, (i - b) << DEV_BSHIFT);
2341 			}
2342 			b = i + 1;
2343 		}
2344 	}
2345 
2346 	/*
2347 	 * setvalid is TRUE when we can safely set the zero'd areas
2348 	 * as being valid.  We can do this if there are no cache consistancy
2349 	 * issues.  e.g. it is ok to do with UFS, but not ok to do with NFS.
2350 	 */
2351 	if (setvalid)
2352 		m->valid = VM_PAGE_BITS_ALL;
2353 }
2354 
2355 /*
2356  *	vm_page_is_valid:
2357  *
2358  *	Is (partial) page valid?  Note that the case where size == 0
2359  *	will return FALSE in the degenerate case where the page is
2360  *	entirely invalid, and TRUE otherwise.
2361  *
2362  *	May not block.
2363  */
2364 int
2365 vm_page_is_valid(vm_page_t m, int base, int size)
2366 {
2367 	int bits = vm_page_bits(base, size);
2368 
2369 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2370 	if (m->valid && ((m->valid & bits) == bits))
2371 		return 1;
2372 	else
2373 		return 0;
2374 }
2375 
2376 /*
2377  * update dirty bits from pmap/mmu.  May not block.
2378  */
2379 void
2380 vm_page_test_dirty(vm_page_t m)
2381 {
2382 
2383 	VM_OBJECT_LOCK_ASSERT(m->object, MA_OWNED);
2384 	if (m->dirty != VM_PAGE_BITS_ALL && pmap_is_modified(m))
2385 		vm_page_dirty(m);
2386 }
2387 
2388 int so_zerocp_fullpage = 0;
2389 
2390 /*
2391  *	Replace the given page with a copy.  The copied page assumes
2392  *	the portion of the given page's "wire_count" that is not the
2393  *	responsibility of this copy-on-write mechanism.
2394  *
2395  *	The object containing the given page must have a non-zero
2396  *	paging-in-progress count and be locked.
2397  */
2398 void
2399 vm_page_cowfault(vm_page_t m)
2400 {
2401 	vm_page_t mnew;
2402 	vm_object_t object;
2403 	vm_pindex_t pindex;
2404 
2405 	mtx_assert(&vm_page_queue_mtx, MA_NOTOWNED);
2406 	vm_page_lock_assert(m, MA_OWNED);
2407 	object = m->object;
2408 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
2409 	KASSERT(object->paging_in_progress != 0,
2410 	    ("vm_page_cowfault: object %p's paging-in-progress count is zero.",
2411 	    object));
2412 	pindex = m->pindex;
2413 
2414  retry_alloc:
2415 	pmap_remove_all(m);
2416 	vm_page_remove(m);
2417 	mnew = vm_page_alloc(object, pindex, VM_ALLOC_NORMAL | VM_ALLOC_NOBUSY);
2418 	if (mnew == NULL) {
2419 		vm_page_insert(m, object, pindex);
2420 		vm_page_unlock(m);
2421 		VM_OBJECT_UNLOCK(object);
2422 		VM_WAIT;
2423 		VM_OBJECT_LOCK(object);
2424 		if (m == vm_page_lookup(object, pindex)) {
2425 			vm_page_lock(m);
2426 			goto retry_alloc;
2427 		} else {
2428 			/*
2429 			 * Page disappeared during the wait.
2430 			 */
2431 			return;
2432 		}
2433 	}
2434 
2435 	if (m->cow == 0) {
2436 		/*
2437 		 * check to see if we raced with an xmit complete when
2438 		 * waiting to allocate a page.  If so, put things back
2439 		 * the way they were
2440 		 */
2441 		vm_page_unlock(m);
2442 		vm_page_lock(mnew);
2443 		vm_page_free(mnew);
2444 		vm_page_unlock(mnew);
2445 		vm_page_insert(m, object, pindex);
2446 	} else { /* clear COW & copy page */
2447 		if (!so_zerocp_fullpage)
2448 			pmap_copy_page(m, mnew);
2449 		mnew->valid = VM_PAGE_BITS_ALL;
2450 		vm_page_dirty(mnew);
2451 		mnew->wire_count = m->wire_count - m->cow;
2452 		m->wire_count = m->cow;
2453 		vm_page_unlock(m);
2454 	}
2455 }
2456 
2457 void
2458 vm_page_cowclear(vm_page_t m)
2459 {
2460 
2461 	vm_page_lock_assert(m, MA_OWNED);
2462 	if (m->cow) {
2463 		m->cow--;
2464 		/*
2465 		 * let vm_fault add back write permission  lazily
2466 		 */
2467 	}
2468 	/*
2469 	 *  sf_buf_free() will free the page, so we needn't do it here
2470 	 */
2471 }
2472 
2473 int
2474 vm_page_cowsetup(vm_page_t m)
2475 {
2476 
2477 	vm_page_lock_assert(m, MA_OWNED);
2478 	if ((m->flags & (PG_FICTITIOUS | PG_UNMANAGED)) != 0 ||
2479 	    m->cow == USHRT_MAX - 1 || !VM_OBJECT_TRYLOCK(m->object))
2480 		return (EBUSY);
2481 	m->cow++;
2482 	pmap_remove_write(m);
2483 	VM_OBJECT_UNLOCK(m->object);
2484 	return (0);
2485 }
2486 
2487 #include "opt_ddb.h"
2488 #ifdef DDB
2489 #include <sys/kernel.h>
2490 
2491 #include <ddb/ddb.h>
2492 
2493 DB_SHOW_COMMAND(page, vm_page_print_page_info)
2494 {
2495 	db_printf("cnt.v_free_count: %d\n", cnt.v_free_count);
2496 	db_printf("cnt.v_cache_count: %d\n", cnt.v_cache_count);
2497 	db_printf("cnt.v_inactive_count: %d\n", cnt.v_inactive_count);
2498 	db_printf("cnt.v_active_count: %d\n", cnt.v_active_count);
2499 	db_printf("cnt.v_wire_count: %d\n", cnt.v_wire_count);
2500 	db_printf("cnt.v_free_reserved: %d\n", cnt.v_free_reserved);
2501 	db_printf("cnt.v_free_min: %d\n", cnt.v_free_min);
2502 	db_printf("cnt.v_free_target: %d\n", cnt.v_free_target);
2503 	db_printf("cnt.v_cache_min: %d\n", cnt.v_cache_min);
2504 	db_printf("cnt.v_inactive_target: %d\n", cnt.v_inactive_target);
2505 }
2506 
2507 DB_SHOW_COMMAND(pageq, vm_page_print_pageq_info)
2508 {
2509 
2510 	db_printf("PQ_FREE:");
2511 	db_printf(" %d", cnt.v_free_count);
2512 	db_printf("\n");
2513 
2514 	db_printf("PQ_CACHE:");
2515 	db_printf(" %d", cnt.v_cache_count);
2516 	db_printf("\n");
2517 
2518 	db_printf("PQ_ACTIVE: %d, PQ_INACTIVE: %d\n",
2519 		*vm_page_queues[PQ_ACTIVE].cnt,
2520 		*vm_page_queues[PQ_INACTIVE].cnt);
2521 }
2522 #endif /* DDB */
2523