svn commit: r187364 - in stable/7/sys: . contrib/pf dev/cxgb kern vm

[Konstantin Belousov]

Author: kib
Date: Sat Jan 17 14:45:07 2009
New Revision: 187364
URL: http://svn.freebsd.org/changeset/base/187364

Log:
  MFC r186719:
  Extend the struct vm_page wire_count to u_int to avoid the overflow of
  the counter, that may happen when too many sendfile(2) calls are being
  executed with this vnode.
  
  To keep the size of the struct vm_page and offsets of the fields
  accessed by out-of-tree modules, swap the types and locations of the
  wire_count and cow fields. Add safety checks to detect cow overflow and
  force fallback to the normal copy code for zero-copy sockets.

Modified:
  stable/7/sys/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)
  stable/7/sys/dev/cxgb/   (props changed)
  stable/7/sys/kern/uipc_cow.c
  stable/7/sys/vm/vm_page.c
  stable/7/sys/vm/vm_page.h

Modified: stable/7/sys/kern/uipc_cow.c
==============================================================================
--- stable/7/sys/kern/uipc_cow.c	Sat Jan 17 14:37:54 2009	(r187363)
+++ stable/7/sys/kern/uipc_cow.c	Sat Jan 17 14:45:07 2009	(r187364)
@@ -129,7 +129,11 @@ socow_setup(struct mbuf *m0, struct uio 
 	 * set up COW
 	 */
 	vm_page_lock_queues();
-	vm_page_cowsetup(pp);
+	if (vm_page_cowsetup(pp) != 0) {
+		vm_page_unhold(pp);
+		vm_page_unlock_queues();
+		return (0);
+	}
 
 	/*
 	 * wire the page for I/O

Modified: stable/7/sys/vm/vm_page.c
==============================================================================
--- stable/7/sys/vm/vm_page.c	Sat Jan 17 14:37:54 2009	(r187363)
+++ stable/7/sys/vm/vm_page.c	Sat Jan 17 14:45:07 2009	(r187364)
@@ -103,6 +103,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/lock.h>
 #include <sys/kernel.h>
+#include <sys/limits.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/proc.h>
@@ -2003,13 +2004,16 @@ vm_page_cowclear(vm_page_t m)
 	 */ 
 }
 
-void
+int
 vm_page_cowsetup(vm_page_t m)
 {
 
 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
+	if (m->cow == USHRT_MAX - 1)
+		return (EBUSY);
 	m->cow++;
 	pmap_remove_write(m);
+	return (0);
 }
 
 #include "opt_ddb.h"

Modified: stable/7/sys/vm/vm_page.h
==============================================================================
--- stable/7/sys/vm/vm_page.h	Sat Jan 17 14:37:54 2009	(r187363)
+++ stable/7/sys/vm/vm_page.h	Sat Jan 17 14:45:07 2009	(r187364)
@@ -111,12 +111,12 @@ struct vm_page {
 	vm_paddr_t phys_addr;		/* physical address of page */
 	struct md_page md;		/* machine dependant stuff */
 	uint8_t	queue;			/* page queue index */
-	int8_t segind;  
+	int8_t segind;
 	u_short	flags;			/* see below */
 	uint8_t	order;			/* index of the buddy queue */
 	uint8_t pool;
-	u_short wire_count;		/* wired down maps refs (P) */
-	u_int cow;			/* page cow mapping count */
+	u_short cow;			/* page cow mapping count */
+	u_int wire_count;		/* wired down maps refs (P) */
 	short hold_count;		/* page hold count */
 	u_short oflags;			/* page flags (O) */
 	u_char	act_count;		/* page usage count */
@@ -346,7 +346,7 @@ void vm_page_zero_invalid(vm_page_t m, b
 void vm_page_free_toq(vm_page_t m);
 void vm_page_zero_idle_wakeup(void);
 void vm_page_cowfault (vm_page_t);
-void vm_page_cowsetup (vm_page_t);
+int vm_page_cowsetup(vm_page_t);
 void vm_page_cowclear (vm_page_t);
 
 /*