svn commit: r356822 - head/sys/vm
Jeff Roberson
jeff at FreeBSD.org
Fri Jan 17 03:44:05 UTC 2020
Author: jeff
Date: Fri Jan 17 03:44:04 2020
New Revision: 356822
URL: https://svnweb.freebsd.org/changeset/base/356822
Log:
Fix a long standing bug that was made worse in r355765. When we are cowing a
page that was previously mapped read-only it exists in pmap until pmap_enter()
returns. However, we held no reference to the original page after the copy
was complete. This allowed vm_object_scan_all_shadowed() to collapse an
object that still had pages mapped. To resolve this, add another page pointer
to the faultstate so we can keep the page xbusy until we're done with
pmap_enter(). Handle busy pages in scan_all_shadowed. This is already done
in vm_object_collapse_scan().
Reviewed by: kib, markj
Differential Revision: https://reviews.freebsd.org/D23155
Modified:
head/sys/vm/vm_fault.c
head/sys/vm/vm_object.c
Modified: head/sys/vm/vm_fault.c
==============================================================================
--- head/sys/vm/vm_fault.c Fri Jan 17 01:20:48 2020 (r356821)
+++ head/sys/vm/vm_fault.c Fri Jan 17 03:44:04 2020 (r356822)
@@ -121,6 +121,7 @@ __FBSDID("$FreeBSD$");
struct faultstate {
vm_page_t m;
+ vm_page_t m_cow;
vm_object_t object;
vm_pindex_t pindex;
vm_page_t first_m;
@@ -208,6 +209,7 @@ static void
fault_deallocate(struct faultstate *fs)
{
+ fault_page_release(&fs->m_cow);
fault_page_release(&fs->m);
vm_object_pip_wakeup(fs->object);
if (fs->object != fs->first_object) {
@@ -818,7 +820,7 @@ RetryFault_oom:
fs.lookup_still_valid = true;
- fs.m = fs.first_m = NULL;
+ fs.m_cow = fs.m = fs.first_m = NULL;
/*
* Search for the page at object/offset.
@@ -1254,9 +1256,11 @@ readrest:
vm_page_unwire(fs.m, PQ_INACTIVE);
}
/*
- * We no longer need the old page or object.
+ * Save the cow page to be released after
+ * pmap_enter is complete.
*/
- fault_page_release(&fs.m);
+ fs.m_cow = fs.m;
+ fs.m = NULL;
}
/*
* fs.object != fs.first_object due to above
Modified: head/sys/vm/vm_object.c
==============================================================================
--- head/sys/vm/vm_object.c Fri Jan 17 01:20:48 2020 (r356821)
+++ head/sys/vm/vm_object.c Fri Jan 17 03:44:04 2020 (r356822)
@@ -1605,6 +1605,14 @@ vm_object_scan_all_shadowed(vm_object_t object)
break;
/*
+ * If the backing object page is busy a grandparent or older
+ * page may still be undergoing CoW. It is not safe to
+ * collapse the backing object until it is quiesced.
+ */
+ if (p != NULL && vm_page_busied(p))
+ return (false);
+
+ /*
* See if the parent has the page or if the parent's object
* pager has the page. If the parent has the page but the page
* is not valid, the parent's object pager must have the page.
@@ -1907,8 +1915,7 @@ vm_object_collapse(vm_object_t object)
* If we do not entirely shadow the backing object,
* there is nothing we can do so we give up.
*/
- if (object->resident_page_count != object->size &&
- !vm_object_scan_all_shadowed(object)) {
+ if (!vm_object_scan_all_shadowed(object)) {
VM_OBJECT_WUNLOCK(backing_object);
break;
}
More information about the svn-src-head
mailing list