vm_object.c revision 207452
1/*-
2 * Copyright (c) 1991, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * This code is derived from software contributed to Berkeley by
6 * The Mach Operating System project at Carnegie-Mellon University.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 4. Neither the name of the University nor the names of its contributors
17 *    may be used to endorse or promote products derived from this software
18 *    without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 *	from: @(#)vm_object.c	8.5 (Berkeley) 3/22/94
33 *
34 *
35 * Copyright (c) 1987, 1990 Carnegie-Mellon University.
36 * All rights reserved.
37 *
38 * Authors: Avadis Tevanian, Jr., Michael Wayne Young
39 *
40 * Permission to use, copy, modify and distribute this software and
41 * its documentation is hereby granted, provided that both the copyright
42 * notice and this permission notice appear in all copies of the
43 * software, derivative works or modified versions, and any portions
44 * thereof, and that both notices appear in supporting documentation.
45 *
46 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
47 * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
48 * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
49 *
50 * Carnegie Mellon requests users of this software to return to
51 *
52 *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
53 *  School of Computer Science
54 *  Carnegie Mellon University
55 *  Pittsburgh PA 15213-3890
56 *
57 * any improvements or extensions that they make and grant Carnegie the
58 * rights to redistribute these changes.
59 */
60
61/*
62 *	Virtual memory object module.
63 */
64
65#include <sys/cdefs.h>
66__FBSDID("$FreeBSD: head/sys/vm/vm_object.c 207452 2010-04-30 22:31:37Z kmacy $");
67
68#include "opt_vm.h"
69
70#include <sys/param.h>
71#include <sys/systm.h>
72#include <sys/lock.h>
73#include <sys/mman.h>
74#include <sys/mount.h>
75#include <sys/kernel.h>
76#include <sys/sysctl.h>
77#include <sys/mutex.h>
78#include <sys/proc.h>		/* for curproc, pageproc */
79#include <sys/socket.h>
80#include <sys/resourcevar.h>
81#include <sys/vnode.h>
82#include <sys/vmmeter.h>
83#include <sys/sx.h>
84
85#include <vm/vm.h>
86#include <vm/vm_param.h>
87#include <vm/pmap.h>
88#include <vm/vm_map.h>
89#include <vm/vm_object.h>
90#include <vm/vm_page.h>
91#include <vm/vm_pageout.h>
92#include <vm/vm_pager.h>
93#include <vm/swap_pager.h>
94#include <vm/vm_kern.h>
95#include <vm/vm_extern.h>
96#include <vm/vm_reserv.h>
97#include <vm/uma.h>
98
99#define EASY_SCAN_FACTOR       8
100
101#define MSYNC_FLUSH_HARDSEQ	0x01
102#define MSYNC_FLUSH_SOFTSEQ	0x02
103
104/*
105 * msync / VM object flushing optimizations
106 */
107static int msync_flush_flags = MSYNC_FLUSH_HARDSEQ | MSYNC_FLUSH_SOFTSEQ;
108SYSCTL_INT(_vm, OID_AUTO, msync_flush_flags, CTLFLAG_RW, &msync_flush_flags, 0,
109    "Enable sequential iteration optimization");
110
111static int old_msync;
112SYSCTL_INT(_vm, OID_AUTO, old_msync, CTLFLAG_RW, &old_msync, 0,
113    "Use old (insecure) msync behavior");
114
115static void	vm_object_qcollapse(vm_object_t object);
116static int	vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int curgeneration, int pagerflags);
117static void	vm_object_vndeallocate(vm_object_t object);
118
119/*
120 *	Virtual memory objects maintain the actual data
121 *	associated with allocated virtual memory.  A given
122 *	page of memory exists within exactly one object.
123 *
124 *	An object is only deallocated when all "references"
125 *	are given up.  Only one "reference" to a given
126 *	region of an object should be writeable.
127 *
128 *	Associated with each object is a list of all resident
129 *	memory pages belonging to that object; this list is
130 *	maintained by the "vm_page" module, and locked by the object's
131 *	lock.
132 *
133 *	Each object also records a "pager" routine which is
134 *	used to retrieve (and store) pages to the proper backing
135 *	storage.  In addition, objects may be backed by other
136 *	objects from which they were virtual-copied.
137 *
138 *	The only items within the object structure which are
139 *	modified after time of creation are:
140 *		reference count		locked by object's lock
141 *		pager routine		locked by object's lock
142 *
143 */
144
145struct object_q vm_object_list;
146struct mtx vm_object_list_mtx;	/* lock for object list and count */
147
148struct vm_object kernel_object_store;
149struct vm_object kmem_object_store;
150
151SYSCTL_NODE(_vm_stats, OID_AUTO, object, CTLFLAG_RD, 0, "VM object stats");
152
153static long object_collapses;
154SYSCTL_LONG(_vm_stats_object, OID_AUTO, collapses, CTLFLAG_RD,
155    &object_collapses, 0, "VM object collapses");
156
157static long object_bypasses;
158SYSCTL_LONG(_vm_stats_object, OID_AUTO, bypasses, CTLFLAG_RD,
159    &object_bypasses, 0, "VM object bypasses");
160
161static uma_zone_t obj_zone;
162
163static int vm_object_zinit(void *mem, int size, int flags);
164
165#ifdef INVARIANTS
166static void vm_object_zdtor(void *mem, int size, void *arg);
167
168static void
169vm_object_zdtor(void *mem, int size, void *arg)
170{
171	vm_object_t object;
172
173	object = (vm_object_t)mem;
174	KASSERT(TAILQ_EMPTY(&object->memq),
175	    ("object %p has resident pages",
176	    object));
177#if VM_NRESERVLEVEL > 0
178	KASSERT(LIST_EMPTY(&object->rvq),
179	    ("object %p has reservations",
180	    object));
181#endif
182	KASSERT(object->cache == NULL,
183	    ("object %p has cached pages",
184	    object));
185	KASSERT(object->paging_in_progress == 0,
186	    ("object %p paging_in_progress = %d",
187	    object, object->paging_in_progress));
188	KASSERT(object->resident_page_count == 0,
189	    ("object %p resident_page_count = %d",
190	    object, object->resident_page_count));
191	KASSERT(object->shadow_count == 0,
192	    ("object %p shadow_count = %d",
193	    object, object->shadow_count));
194}
195#endif
196
197static int
198vm_object_zinit(void *mem, int size, int flags)
199{
200	vm_object_t object;
201
202	object = (vm_object_t)mem;
203	bzero(&object->mtx, sizeof(object->mtx));
204	VM_OBJECT_LOCK_INIT(object, "standard object");
205
206	/* These are true for any object that has been freed */
207	object->paging_in_progress = 0;
208	object->resident_page_count = 0;
209	object->shadow_count = 0;
210	return (0);
211}
212
213void
214_vm_object_allocate(objtype_t type, vm_pindex_t size, vm_object_t object)
215{
216
217	TAILQ_INIT(&object->memq);
218	LIST_INIT(&object->shadow_head);
219
220	object->root = NULL;
221	object->type = type;
222	object->size = size;
223	object->generation = 1;
224	object->ref_count = 1;
225	object->memattr = VM_MEMATTR_DEFAULT;
226	object->flags = 0;
227	object->uip = NULL;
228	object->charge = 0;
229	if ((object->type == OBJT_DEFAULT) || (object->type == OBJT_SWAP))
230		object->flags = OBJ_ONEMAPPING;
231	object->pg_color = 0;
232	object->handle = NULL;
233	object->backing_object = NULL;
234	object->backing_object_offset = (vm_ooffset_t) 0;
235#if VM_NRESERVLEVEL > 0
236	LIST_INIT(&object->rvq);
237#endif
238	object->cache = NULL;
239
240	mtx_lock(&vm_object_list_mtx);
241	TAILQ_INSERT_TAIL(&vm_object_list, object, object_list);
242	mtx_unlock(&vm_object_list_mtx);
243}
244
245/*
246 *	vm_object_init:
247 *
248 *	Initialize the VM objects module.
249 */
250void
251vm_object_init(void)
252{
253	TAILQ_INIT(&vm_object_list);
254	mtx_init(&vm_object_list_mtx, "vm object_list", NULL, MTX_DEF);
255
256	VM_OBJECT_LOCK_INIT(&kernel_object_store, "kernel object");
257	_vm_object_allocate(OBJT_PHYS, OFF_TO_IDX(VM_MAX_KERNEL_ADDRESS - VM_MIN_KERNEL_ADDRESS),
258	    kernel_object);
259#if VM_NRESERVLEVEL > 0
260	kernel_object->flags |= OBJ_COLORED;
261	kernel_object->pg_color = (u_short)atop(VM_MIN_KERNEL_ADDRESS);
262#endif
263
264	VM_OBJECT_LOCK_INIT(&kmem_object_store, "kmem object");
265	_vm_object_allocate(OBJT_PHYS, OFF_TO_IDX(VM_MAX_KERNEL_ADDRESS - VM_MIN_KERNEL_ADDRESS),
266	    kmem_object);
267#if VM_NRESERVLEVEL > 0
268	kmem_object->flags |= OBJ_COLORED;
269	kmem_object->pg_color = (u_short)atop(VM_MIN_KERNEL_ADDRESS);
270#endif
271
272	/*
273	 * The lock portion of struct vm_object must be type stable due
274	 * to vm_pageout_fallback_object_lock locking a vm object
275	 * without holding any references to it.
276	 */
277	obj_zone = uma_zcreate("VM OBJECT", sizeof (struct vm_object), NULL,
278#ifdef INVARIANTS
279	    vm_object_zdtor,
280#else
281	    NULL,
282#endif
283	    vm_object_zinit, NULL, UMA_ALIGN_PTR, UMA_ZONE_VM|UMA_ZONE_NOFREE);
284}
285
286void
287vm_object_clear_flag(vm_object_t object, u_short bits)
288{
289
290	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
291	object->flags &= ~bits;
292}
293
294/*
295 *	Sets the default memory attribute for the specified object.  Pages
296 *	that are allocated to this object are by default assigned this memory
297 *	attribute.
298 *
299 *	Presently, this function must be called before any pages are allocated
300 *	to the object.  In the future, this requirement may be relaxed for
301 *	"default" and "swap" objects.
302 */
303int
304vm_object_set_memattr(vm_object_t object, vm_memattr_t memattr)
305{
306
307	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
308	switch (object->type) {
309	case OBJT_DEFAULT:
310	case OBJT_DEVICE:
311	case OBJT_PHYS:
312	case OBJT_SG:
313	case OBJT_SWAP:
314	case OBJT_VNODE:
315		if (!TAILQ_EMPTY(&object->memq))
316			return (KERN_FAILURE);
317		break;
318	case OBJT_DEAD:
319		return (KERN_INVALID_ARGUMENT);
320	}
321	object->memattr = memattr;
322	return (KERN_SUCCESS);
323}
324
325void
326vm_object_pip_add(vm_object_t object, short i)
327{
328
329	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
330	object->paging_in_progress += i;
331}
332
333void
334vm_object_pip_subtract(vm_object_t object, short i)
335{
336
337	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
338	object->paging_in_progress -= i;
339}
340
341void
342vm_object_pip_wakeup(vm_object_t object)
343{
344
345	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
346	object->paging_in_progress--;
347	if ((object->flags & OBJ_PIPWNT) && object->paging_in_progress == 0) {
348		vm_object_clear_flag(object, OBJ_PIPWNT);
349		wakeup(object);
350	}
351}
352
353void
354vm_object_pip_wakeupn(vm_object_t object, short i)
355{
356
357	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
358	if (i)
359		object->paging_in_progress -= i;
360	if ((object->flags & OBJ_PIPWNT) && object->paging_in_progress == 0) {
361		vm_object_clear_flag(object, OBJ_PIPWNT);
362		wakeup(object);
363	}
364}
365
366void
367vm_object_pip_wait(vm_object_t object, char *waitid)
368{
369
370	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
371	while (object->paging_in_progress) {
372		object->flags |= OBJ_PIPWNT;
373		msleep(object, VM_OBJECT_MTX(object), PVM, waitid, 0);
374	}
375}
376
377/*
378 *	vm_object_allocate:
379 *
380 *	Returns a new object with the given size.
381 */
382vm_object_t
383vm_object_allocate(objtype_t type, vm_pindex_t size)
384{
385	vm_object_t object;
386
387	object = (vm_object_t)uma_zalloc(obj_zone, M_WAITOK);
388	_vm_object_allocate(type, size, object);
389	return (object);
390}
391
392
393/*
394 *	vm_object_reference:
395 *
396 *	Gets another reference to the given object.  Note: OBJ_DEAD
397 *	objects can be referenced during final cleaning.
398 */
399void
400vm_object_reference(vm_object_t object)
401{
402	if (object == NULL)
403		return;
404	VM_OBJECT_LOCK(object);
405	vm_object_reference_locked(object);
406	VM_OBJECT_UNLOCK(object);
407}
408
409/*
410 *	vm_object_reference_locked:
411 *
412 *	Gets another reference to the given object.
413 *
414 *	The object must be locked.
415 */
416void
417vm_object_reference_locked(vm_object_t object)
418{
419	struct vnode *vp;
420
421	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
422	object->ref_count++;
423	if (object->type == OBJT_VNODE) {
424		vp = object->handle;
425		vref(vp);
426	}
427}
428
429/*
430 * Handle deallocating an object of type OBJT_VNODE.
431 */
432static void
433vm_object_vndeallocate(vm_object_t object)
434{
435	struct vnode *vp = (struct vnode *) object->handle;
436
437	VFS_ASSERT_GIANT(vp->v_mount);
438	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
439	KASSERT(object->type == OBJT_VNODE,
440	    ("vm_object_vndeallocate: not a vnode object"));
441	KASSERT(vp != NULL, ("vm_object_vndeallocate: missing vp"));
442#ifdef INVARIANTS
443	if (object->ref_count == 0) {
444		vprint("vm_object_vndeallocate", vp);
445		panic("vm_object_vndeallocate: bad object reference count");
446	}
447#endif
448
449	object->ref_count--;
450	if (object->ref_count == 0) {
451		mp_fixme("Unlocked vflag access.");
452		vp->v_vflag &= ~VV_TEXT;
453	}
454	VM_OBJECT_UNLOCK(object);
455	/*
456	 * vrele may need a vop lock
457	 */
458	vrele(vp);
459}
460
461/*
462 *	vm_object_deallocate:
463 *
464 *	Release a reference to the specified object,
465 *	gained either through a vm_object_allocate
466 *	or a vm_object_reference call.  When all references
467 *	are gone, storage associated with this object
468 *	may be relinquished.
469 *
470 *	No object may be locked.
471 */
472void
473vm_object_deallocate(vm_object_t object)
474{
475	vm_object_t temp;
476
477	while (object != NULL) {
478		int vfslocked;
479
480		vfslocked = 0;
481	restart:
482		VM_OBJECT_LOCK(object);
483		if (object->type == OBJT_VNODE) {
484			struct vnode *vp = (struct vnode *) object->handle;
485
486			/*
487			 * Conditionally acquire Giant for a vnode-backed
488			 * object.  We have to be careful since the type of
489			 * a vnode object can change while the object is
490			 * unlocked.
491			 */
492			if (VFS_NEEDSGIANT(vp->v_mount) && !vfslocked) {
493				vfslocked = 1;
494				if (!mtx_trylock(&Giant)) {
495					VM_OBJECT_UNLOCK(object);
496					mtx_lock(&Giant);
497					goto restart;
498				}
499			}
500			vm_object_vndeallocate(object);
501			VFS_UNLOCK_GIANT(vfslocked);
502			return;
503		} else
504			/*
505			 * This is to handle the case that the object
506			 * changed type while we dropped its lock to
507			 * obtain Giant.
508			 */
509			VFS_UNLOCK_GIANT(vfslocked);
510
511		KASSERT(object->ref_count != 0,
512			("vm_object_deallocate: object deallocated too many times: %d", object->type));
513
514		/*
515		 * If the reference count goes to 0 we start calling
516		 * vm_object_terminate() on the object chain.
517		 * A ref count of 1 may be a special case depending on the
518		 * shadow count being 0 or 1.
519		 */
520		object->ref_count--;
521		if (object->ref_count > 1) {
522			VM_OBJECT_UNLOCK(object);
523			return;
524		} else if (object->ref_count == 1) {
525			if (object->shadow_count == 0 &&
526			    object->handle == NULL &&
527			    (object->type == OBJT_DEFAULT ||
528			     object->type == OBJT_SWAP)) {
529				vm_object_set_flag(object, OBJ_ONEMAPPING);
530			} else if ((object->shadow_count == 1) &&
531			    (object->handle == NULL) &&
532			    (object->type == OBJT_DEFAULT ||
533			     object->type == OBJT_SWAP)) {
534				vm_object_t robject;
535
536				robject = LIST_FIRST(&object->shadow_head);
537				KASSERT(robject != NULL,
538				    ("vm_object_deallocate: ref_count: %d, shadow_count: %d",
539					 object->ref_count,
540					 object->shadow_count));
541				if (!VM_OBJECT_TRYLOCK(robject)) {
542					/*
543					 * Avoid a potential deadlock.
544					 */
545					object->ref_count++;
546					VM_OBJECT_UNLOCK(object);
547					/*
548					 * More likely than not the thread
549					 * holding robject's lock has lower
550					 * priority than the current thread.
551					 * Let the lower priority thread run.
552					 */
553					pause("vmo_de", 1);
554					continue;
555				}
556				/*
557				 * Collapse object into its shadow unless its
558				 * shadow is dead.  In that case, object will
559				 * be deallocated by the thread that is
560				 * deallocating its shadow.
561				 */
562				if ((robject->flags & OBJ_DEAD) == 0 &&
563				    (robject->handle == NULL) &&
564				    (robject->type == OBJT_DEFAULT ||
565				     robject->type == OBJT_SWAP)) {
566
567					robject->ref_count++;
568retry:
569					if (robject->paging_in_progress) {
570						VM_OBJECT_UNLOCK(object);
571						vm_object_pip_wait(robject,
572						    "objde1");
573						temp = robject->backing_object;
574						if (object == temp) {
575							VM_OBJECT_LOCK(object);
576							goto retry;
577						}
578					} else if (object->paging_in_progress) {
579						VM_OBJECT_UNLOCK(robject);
580						object->flags |= OBJ_PIPWNT;
581						msleep(object,
582						    VM_OBJECT_MTX(object),
583						    PDROP | PVM, "objde2", 0);
584						VM_OBJECT_LOCK(robject);
585						temp = robject->backing_object;
586						if (object == temp) {
587							VM_OBJECT_LOCK(object);
588							goto retry;
589						}
590					} else
591						VM_OBJECT_UNLOCK(object);
592
593					if (robject->ref_count == 1) {
594						robject->ref_count--;
595						object = robject;
596						goto doterm;
597					}
598					object = robject;
599					vm_object_collapse(object);
600					VM_OBJECT_UNLOCK(object);
601					continue;
602				}
603				VM_OBJECT_UNLOCK(robject);
604			}
605			VM_OBJECT_UNLOCK(object);
606			return;
607		}
608doterm:
609		temp = object->backing_object;
610		if (temp != NULL) {
611			VM_OBJECT_LOCK(temp);
612			LIST_REMOVE(object, shadow_list);
613			temp->shadow_count--;
614			temp->generation++;
615			VM_OBJECT_UNLOCK(temp);
616			object->backing_object = NULL;
617		}
618		/*
619		 * Don't double-terminate, we could be in a termination
620		 * recursion due to the terminate having to sync data
621		 * to disk.
622		 */
623		if ((object->flags & OBJ_DEAD) == 0)
624			vm_object_terminate(object);
625		else
626			VM_OBJECT_UNLOCK(object);
627		object = temp;
628	}
629}
630
631/*
632 *	vm_object_destroy removes the object from the global object list
633 *      and frees the space for the object.
634 */
635void
636vm_object_destroy(vm_object_t object)
637{
638
639	/*
640	 * Remove the object from the global object list.
641	 */
642	mtx_lock(&vm_object_list_mtx);
643	TAILQ_REMOVE(&vm_object_list, object, object_list);
644	mtx_unlock(&vm_object_list_mtx);
645
646	/*
647	 * Release the allocation charge.
648	 */
649	if (object->uip != NULL) {
650		KASSERT(object->type == OBJT_DEFAULT ||
651		    object->type == OBJT_SWAP,
652		    ("vm_object_terminate: non-swap obj %p has uip",
653		     object));
654		swap_release_by_uid(object->charge, object->uip);
655		object->charge = 0;
656		uifree(object->uip);
657		object->uip = NULL;
658	}
659
660	/*
661	 * Free the space for the object.
662	 */
663	uma_zfree(obj_zone, object);
664}
665
666/*
667 *	vm_object_terminate actually destroys the specified object, freeing
668 *	up all previously used resources.
669 *
670 *	The object must be locked.
671 *	This routine may block.
672 */
673void
674vm_object_terminate(vm_object_t object)
675{
676	vm_page_t p;
677
678	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
679
680	/*
681	 * Make sure no one uses us.
682	 */
683	vm_object_set_flag(object, OBJ_DEAD);
684
685	/*
686	 * wait for the pageout daemon to be done with the object
687	 */
688	vm_object_pip_wait(object, "objtrm");
689
690	KASSERT(!object->paging_in_progress,
691		("vm_object_terminate: pageout in progress"));
692
693	/*
694	 * Clean and free the pages, as appropriate. All references to the
695	 * object are gone, so we don't need to lock it.
696	 */
697	if (object->type == OBJT_VNODE) {
698		struct vnode *vp = (struct vnode *)object->handle;
699
700		/*
701		 * Clean pages and flush buffers.
702		 */
703		vm_object_page_clean(object, 0, 0, OBJPC_SYNC);
704		VM_OBJECT_UNLOCK(object);
705
706		vinvalbuf(vp, V_SAVE, 0, 0);
707
708		VM_OBJECT_LOCK(object);
709	}
710
711	KASSERT(object->ref_count == 0,
712		("vm_object_terminate: object with references, ref_count=%d",
713		object->ref_count));
714
715	/*
716	 * Now free any remaining pages. For internal objects, this also
717	 * removes them from paging queues. Don't free wired pages, just
718	 * remove them from the object.
719	 */
720	while ((p = TAILQ_FIRST(&object->memq)) != NULL) {
721		KASSERT(!p->busy && (p->oflags & VPO_BUSY) == 0,
722			("vm_object_terminate: freeing busy page %p "
723			"p->busy = %d, p->oflags %x\n", p, p->busy, p->oflags));
724		vm_page_lock(p);
725		vm_page_lock_queues();
726		if (p->wire_count == 0) {
727			vm_page_free(p);
728			cnt.v_pfree++;
729		} else {
730			vm_page_remove(p);
731		}
732		vm_page_unlock_queues();
733		vm_page_unlock(p);
734	}
735
736#if VM_NRESERVLEVEL > 0
737	if (__predict_false(!LIST_EMPTY(&object->rvq)))
738		vm_reserv_break_all(object);
739#endif
740	if (__predict_false(object->cache != NULL))
741		vm_page_cache_free(object, 0, 0);
742
743	/*
744	 * Let the pager know object is dead.
745	 */
746	vm_pager_deallocate(object);
747	VM_OBJECT_UNLOCK(object);
748
749	vm_object_destroy(object);
750}
751
752/*
753 *	vm_object_page_clean
754 *
755 *	Clean all dirty pages in the specified range of object.  Leaves page
756 * 	on whatever queue it is currently on.   If NOSYNC is set then do not
757 *	write out pages with VPO_NOSYNC set (originally comes from MAP_NOSYNC),
758 *	leaving the object dirty.
759 *
760 *	When stuffing pages asynchronously, allow clustering.  XXX we need a
761 *	synchronous clustering mode implementation.
762 *
763 *	Odd semantics: if start == end, we clean everything.
764 *
765 *	The object must be locked.
766 */
767void
768vm_object_page_clean(vm_object_t object, vm_pindex_t start, vm_pindex_t end, int flags)
769{
770	vm_page_t p, np;
771	vm_pindex_t tstart, tend;
772	vm_pindex_t pi;
773	int clearobjflags;
774	int pagerflags;
775	int curgeneration;
776
777	mtx_assert(&vm_page_queue_mtx, MA_NOTOWNED);
778	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
779	if ((object->flags & OBJ_MIGHTBEDIRTY) == 0)
780		return;
781	KASSERT(object->type == OBJT_VNODE, ("Not a vnode object"));
782
783	pagerflags = (flags & (OBJPC_SYNC | OBJPC_INVAL)) ? VM_PAGER_PUT_SYNC : VM_PAGER_CLUSTER_OK;
784	pagerflags |= (flags & OBJPC_INVAL) ? VM_PAGER_PUT_INVAL : 0;
785
786	vm_object_set_flag(object, OBJ_CLEANING);
787
788	tstart = start;
789	if (end == 0) {
790		tend = object->size;
791	} else {
792		tend = end;
793	}
794
795	/*
796	 * If the caller is smart and only msync()s a range he knows is
797	 * dirty, we may be able to avoid an object scan.  This results in
798	 * a phenominal improvement in performance.  We cannot do this
799	 * as a matter of course because the object may be huge - e.g.
800	 * the size might be in the gigabytes or terrabytes.
801	 */
802	if (msync_flush_flags & MSYNC_FLUSH_HARDSEQ) {
803		vm_pindex_t tscan;
804		int scanlimit;
805		int scanreset;
806
807		scanreset = object->resident_page_count / EASY_SCAN_FACTOR;
808		if (scanreset < 16)
809			scanreset = 16;
810		pagerflags |= VM_PAGER_IGNORE_CLEANCHK;
811
812		scanlimit = scanreset;
813		tscan = tstart;
814		while (tscan < tend) {
815			curgeneration = object->generation;
816			p = vm_page_lookup(object, tscan);
817			if (p == NULL || p->valid == 0) {
818				if (--scanlimit == 0)
819					break;
820				++tscan;
821				continue;
822			}
823			vm_page_lock(p);
824			vm_page_lock_queues();
825			vm_page_test_dirty(p);
826			if (p->dirty == 0) {
827				vm_page_unlock_queues();
828				vm_page_unlock(p);
829				if (--scanlimit == 0)
830					break;
831				++tscan;
832				continue;
833			}
834			vm_page_unlock_queues();
835			vm_page_unlock(p);
836			/*
837			 * If we have been asked to skip nosync pages and
838			 * this is a nosync page, we can't continue.
839			 */
840			if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC)) {
841				if (--scanlimit == 0)
842					break;
843				++tscan;
844				continue;
845			}
846			scanlimit = scanreset;
847
848			/*
849			 * This returns 0 if it was unable to busy the first
850			 * page (i.e. had to sleep).
851			 */
852			tscan += vm_object_page_collect_flush(object, p, curgeneration, pagerflags);
853
854		}
855
856		/*
857		 * If everything was dirty and we flushed it successfully,
858		 * and the requested range is not the entire object, we
859		 * don't have to mess with CLEANCHK or MIGHTBEDIRTY and can
860		 * return immediately.
861		 */
862		if (tscan >= tend && (tstart || tend < object->size)) {
863			vm_object_clear_flag(object, OBJ_CLEANING);
864			return;
865		}
866		pagerflags &= ~VM_PAGER_IGNORE_CLEANCHK;
867	}
868
869	/*
870	 * Generally set CLEANCHK interlock and make the page read-only so
871	 * we can then clear the object flags.
872	 *
873	 * However, if this is a nosync mmap then the object is likely to
874	 * stay dirty so do not mess with the page and do not clear the
875	 * object flags.
876	 */
877	clearobjflags = 1;
878	TAILQ_FOREACH(p, &object->memq, listq) {
879		p->oflags |= VPO_CLEANCHK;
880		if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC))
881			clearobjflags = 0;
882		else {
883			vm_page_lock(p);
884			vm_page_lock_queues();
885			pmap_remove_write(p);
886			vm_page_unlock_queues();
887			vm_page_unlock(p);
888		}
889	}
890
891	if (clearobjflags && (tstart == 0) && (tend == object->size))
892		vm_object_clear_flag(object, OBJ_MIGHTBEDIRTY);
893
894rescan:
895	curgeneration = object->generation;
896
897	for (p = TAILQ_FIRST(&object->memq); p; p = np) {
898		int n;
899
900		np = TAILQ_NEXT(p, listq);
901
902again:
903		pi = p->pindex;
904		if ((p->oflags & VPO_CLEANCHK) == 0 ||
905			(pi < tstart) || (pi >= tend) ||
906		    p->valid == 0) {
907			p->oflags &= ~VPO_CLEANCHK;
908			continue;
909		}
910
911		vm_page_lock(p);
912		vm_page_lock_queues();
913		vm_page_test_dirty(p);
914		if (p->dirty == 0) {
915			vm_page_unlock_queues();
916			vm_page_unlock(p);
917			p->oflags &= ~VPO_CLEANCHK;
918			continue;
919		}
920		vm_page_unlock_queues();
921		vm_page_unlock(p);
922		/*
923		 * If we have been asked to skip nosync pages and this is a
924		 * nosync page, skip it.  Note that the object flags were
925		 * not cleared in this case so we do not have to set them.
926		 */
927		if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC)) {
928			p->oflags &= ~VPO_CLEANCHK;
929			continue;
930		}
931
932		n = vm_object_page_collect_flush(object, p,
933			curgeneration, pagerflags);
934		if (n == 0)
935			goto rescan;
936
937		if (object->generation != curgeneration)
938			goto rescan;
939
940		/*
941		 * Try to optimize the next page.  If we can't we pick up
942		 * our (random) scan where we left off.
943		 */
944		if (msync_flush_flags & MSYNC_FLUSH_SOFTSEQ)
945			if ((p = vm_page_lookup(object, pi + n)) != NULL)
946				goto again;
947	}
948#if 0
949	VOP_FSYNC(vp, (pagerflags & VM_PAGER_PUT_SYNC)?MNT_WAIT:0, curproc);
950#endif
951
952	vm_object_clear_flag(object, OBJ_CLEANING);
953	return;
954}
955
956static int
957vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int curgeneration, int pagerflags)
958{
959	int runlen;
960	int maxf;
961	int chkb;
962	int maxb;
963	int i;
964	vm_pindex_t pi;
965	vm_page_t maf[vm_pageout_page_count];
966	vm_page_t mab[vm_pageout_page_count];
967	vm_page_t ma[vm_pageout_page_count];
968
969	mtx_assert(&vm_page_queue_mtx, MA_NOTOWNED);
970	vm_page_lock_assert(p, MA_NOTOWNED);
971	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
972	pi = p->pindex;
973	while (vm_page_sleep_if_busy(p, TRUE, "vpcwai")) {
974		if (object->generation != curgeneration) {
975			return(0);
976		}
977	}
978	maxf = 0;
979	for(i = 1; i < vm_pageout_page_count; i++) {
980		vm_page_t tp;
981
982		if ((tp = vm_page_lookup(object, pi + i)) != NULL) {
983			if ((tp->oflags & VPO_BUSY) ||
984				((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 &&
985				 (tp->oflags & VPO_CLEANCHK) == 0) ||
986				(tp->busy != 0))
987				break;
988			vm_page_lock(tp);
989			vm_page_lock_queues();
990			vm_page_test_dirty(tp);
991			if (tp->dirty == 0) {
992				vm_page_unlock(tp);
993				vm_page_unlock_queues();
994				tp->oflags &= ~VPO_CLEANCHK;
995				break;
996			}
997			vm_page_unlock(tp);
998			vm_page_unlock_queues();
999			maf[ i - 1 ] = tp;
1000			maxf++;
1001			continue;
1002		}
1003		break;
1004	}
1005
1006	maxb = 0;
1007	chkb = vm_pageout_page_count -  maxf;
1008	if (chkb) {
1009		for(i = 1; i < chkb;i++) {
1010			vm_page_t tp;
1011
1012			if ((tp = vm_page_lookup(object, pi - i)) != NULL) {
1013				if ((tp->oflags & VPO_BUSY) ||
1014					((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 &&
1015					 (tp->oflags & VPO_CLEANCHK) == 0) ||
1016					(tp->busy != 0))
1017					break;
1018				vm_page_lock(tp);
1019				vm_page_lock_queues();
1020				vm_page_test_dirty(tp);
1021				if (tp->dirty == 0) {
1022					vm_page_unlock_queues();
1023					vm_page_unlock(tp);
1024					tp->oflags &= ~VPO_CLEANCHK;
1025					break;
1026				}
1027				vm_page_unlock_queues();
1028				vm_page_unlock(tp);
1029				mab[ i - 1 ] = tp;
1030				maxb++;
1031				continue;
1032			}
1033			break;
1034		}
1035	}
1036
1037	for(i = 0; i < maxb; i++) {
1038		int index = (maxb - i) - 1;
1039		ma[index] = mab[i];
1040		ma[index]->oflags &= ~VPO_CLEANCHK;
1041	}
1042	p->oflags &= ~VPO_CLEANCHK;
1043	ma[maxb] = p;
1044	for(i = 0; i < maxf; i++) {
1045		int index = (maxb + i) + 1;
1046		ma[index] = maf[i];
1047		ma[index]->oflags &= ~VPO_CLEANCHK;
1048	}
1049	runlen = maxb + maxf + 1;
1050
1051	vm_pageout_flush(ma, runlen, pagerflags);
1052	for (i = 0; i < runlen; i++) {
1053		if (ma[i]->dirty) {
1054			vm_page_lock(ma[i]);
1055			vm_page_lock_queues();
1056			pmap_remove_write(ma[i]);
1057			vm_page_unlock_queues();
1058			vm_page_unlock(ma[i]);
1059			ma[i]->oflags |= VPO_CLEANCHK;
1060
1061			/*
1062			 * maxf will end up being the actual number of pages
1063			 * we wrote out contiguously, non-inclusive of the
1064			 * first page.  We do not count look-behind pages.
1065			 */
1066			if (i >= maxb + 1 && (maxf > i - maxb - 1))
1067				maxf = i - maxb - 1;
1068		}
1069	}
1070	return(maxf + 1);
1071}
1072
1073/*
1074 * Note that there is absolutely no sense in writing out
1075 * anonymous objects, so we track down the vnode object
1076 * to write out.
1077 * We invalidate (remove) all pages from the address space
1078 * for semantic correctness.
1079 *
1080 * Note: certain anonymous maps, such as MAP_NOSYNC maps,
1081 * may start out with a NULL object.
1082 */
1083void
1084vm_object_sync(vm_object_t object, vm_ooffset_t offset, vm_size_t size,
1085    boolean_t syncio, boolean_t invalidate)
1086{
1087	vm_object_t backing_object;
1088	struct vnode *vp;
1089	struct mount *mp;
1090	int flags;
1091
1092	if (object == NULL)
1093		return;
1094	VM_OBJECT_LOCK(object);
1095	while ((backing_object = object->backing_object) != NULL) {
1096		VM_OBJECT_LOCK(backing_object);
1097		offset += object->backing_object_offset;
1098		VM_OBJECT_UNLOCK(object);
1099		object = backing_object;
1100		if (object->size < OFF_TO_IDX(offset + size))
1101			size = IDX_TO_OFF(object->size) - offset;
1102	}
1103	/*
1104	 * Flush pages if writing is allowed, invalidate them
1105	 * if invalidation requested.  Pages undergoing I/O
1106	 * will be ignored by vm_object_page_remove().
1107	 *
1108	 * We cannot lock the vnode and then wait for paging
1109	 * to complete without deadlocking against vm_fault.
1110	 * Instead we simply call vm_object_page_remove() and
1111	 * allow it to block internally on a page-by-page
1112	 * basis when it encounters pages undergoing async
1113	 * I/O.
1114	 */
1115	if (object->type == OBJT_VNODE &&
1116	    (object->flags & OBJ_MIGHTBEDIRTY) != 0) {
1117		int vfslocked;
1118		vp = object->handle;
1119		VM_OBJECT_UNLOCK(object);
1120		(void) vn_start_write(vp, &mp, V_WAIT);
1121		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
1122		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1123		flags = (syncio || invalidate) ? OBJPC_SYNC : 0;
1124		flags |= invalidate ? OBJPC_INVAL : 0;
1125		VM_OBJECT_LOCK(object);
1126		vm_object_page_clean(object,
1127		    OFF_TO_IDX(offset),
1128		    OFF_TO_IDX(offset + size + PAGE_MASK),
1129		    flags);
1130		VM_OBJECT_UNLOCK(object);
1131		VOP_UNLOCK(vp, 0);
1132		VFS_UNLOCK_GIANT(vfslocked);
1133		vn_finished_write(mp);
1134		VM_OBJECT_LOCK(object);
1135	}
1136	if ((object->type == OBJT_VNODE ||
1137	     object->type == OBJT_DEVICE) && invalidate) {
1138		boolean_t purge;
1139		purge = old_msync || (object->type == OBJT_DEVICE);
1140		vm_object_page_remove(object,
1141		    OFF_TO_IDX(offset),
1142		    OFF_TO_IDX(offset + size + PAGE_MASK),
1143		    purge ? FALSE : TRUE);
1144	}
1145	VM_OBJECT_UNLOCK(object);
1146}
1147
1148/*
1149 *	vm_object_madvise:
1150 *
1151 *	Implements the madvise function at the object/page level.
1152 *
1153 *	MADV_WILLNEED	(any object)
1154 *
1155 *	    Activate the specified pages if they are resident.
1156 *
1157 *	MADV_DONTNEED	(any object)
1158 *
1159 *	    Deactivate the specified pages if they are resident.
1160 *
1161 *	MADV_FREE	(OBJT_DEFAULT/OBJT_SWAP objects,
1162 *			 OBJ_ONEMAPPING only)
1163 *
1164 *	    Deactivate and clean the specified pages if they are
1165 *	    resident.  This permits the process to reuse the pages
1166 *	    without faulting or the kernel to reclaim the pages
1167 *	    without I/O.
1168 */
1169void
1170vm_object_madvise(vm_object_t object, vm_pindex_t pindex, int count, int advise)
1171{
1172	vm_pindex_t end, tpindex;
1173	vm_object_t backing_object, tobject;
1174	vm_page_t m;
1175
1176	if (object == NULL)
1177		return;
1178	VM_OBJECT_LOCK(object);
1179	end = pindex + count;
1180	/*
1181	 * Locate and adjust resident pages
1182	 */
1183	for (; pindex < end; pindex += 1) {
1184relookup:
1185		tobject = object;
1186		tpindex = pindex;
1187shadowlookup:
1188		/*
1189		 * MADV_FREE only operates on OBJT_DEFAULT or OBJT_SWAP pages
1190		 * and those pages must be OBJ_ONEMAPPING.
1191		 */
1192		if (advise == MADV_FREE) {
1193			if ((tobject->type != OBJT_DEFAULT &&
1194			     tobject->type != OBJT_SWAP) ||
1195			    (tobject->flags & OBJ_ONEMAPPING) == 0) {
1196				goto unlock_tobject;
1197			}
1198		} else if (tobject->type == OBJT_PHYS)
1199			goto unlock_tobject;
1200		m = vm_page_lookup(tobject, tpindex);
1201		if (m == NULL && advise == MADV_WILLNEED) {
1202			/*
1203			 * If the page is cached, reactivate it.
1204			 */
1205			m = vm_page_alloc(tobject, tpindex, VM_ALLOC_IFCACHED |
1206			    VM_ALLOC_NOBUSY);
1207		}
1208		if (m == NULL) {
1209			/*
1210			 * There may be swap even if there is no backing page
1211			 */
1212			if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1213				swap_pager_freespace(tobject, tpindex, 1);
1214			/*
1215			 * next object
1216			 */
1217			backing_object = tobject->backing_object;
1218			if (backing_object == NULL)
1219				goto unlock_tobject;
1220			VM_OBJECT_LOCK(backing_object);
1221			tpindex += OFF_TO_IDX(tobject->backing_object_offset);
1222			if (tobject != object)
1223				VM_OBJECT_UNLOCK(tobject);
1224			tobject = backing_object;
1225			goto shadowlookup;
1226		} else if (m->valid != VM_PAGE_BITS_ALL)
1227			goto unlock_tobject;
1228		/*
1229		 * If the page is not in a normal state, skip it.
1230		 */
1231		vm_page_lock(m);
1232		vm_page_lock_queues();
1233		if (m->hold_count != 0 || m->wire_count != 0) {
1234			vm_page_unlock_queues();
1235			vm_page_unlock(m);
1236			goto unlock_tobject;
1237		}
1238		if ((m->oflags & VPO_BUSY) || m->busy) {
1239			if (advise == MADV_WILLNEED)
1240				/*
1241				 * Reference the page before unlocking and
1242				 * sleeping so that the page daemon is less
1243				 * likely to reclaim it.
1244				 */
1245				vm_page_flag_set(m, PG_REFERENCED);
1246			vm_page_unlock_queues();
1247			vm_page_unlock(m);
1248			if (object != tobject)
1249				VM_OBJECT_UNLOCK(object);
1250			m->oflags |= VPO_WANTED;
1251			msleep(m, VM_OBJECT_MTX(tobject), PDROP | PVM, "madvpo",
1252			    0);
1253			VM_OBJECT_LOCK(object);
1254  			goto relookup;
1255		}
1256		if (advise == MADV_WILLNEED) {
1257			vm_page_activate(m);
1258		} else if (advise == MADV_DONTNEED) {
1259			vm_page_dontneed(m);
1260		} else if (advise == MADV_FREE) {
1261			/*
1262			 * Mark the page clean.  This will allow the page
1263			 * to be freed up by the system.  However, such pages
1264			 * are often reused quickly by malloc()/free()
1265			 * so we do not do anything that would cause
1266			 * a page fault if we can help it.
1267			 *
1268			 * Specifically, we do not try to actually free
1269			 * the page now nor do we try to put it in the
1270			 * cache (which would cause a page fault on reuse).
1271			 *
1272			 * But we do make the page is freeable as we
1273			 * can without actually taking the step of unmapping
1274			 * it.
1275			 */
1276			pmap_clear_modify(m);
1277			m->dirty = 0;
1278			m->act_count = 0;
1279			vm_page_dontneed(m);
1280		}
1281		vm_page_unlock_queues();
1282		vm_page_unlock(m);
1283		if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1284			swap_pager_freespace(tobject, tpindex, 1);
1285unlock_tobject:
1286		if (tobject != object)
1287			VM_OBJECT_UNLOCK(tobject);
1288	}
1289	VM_OBJECT_UNLOCK(object);
1290}
1291
1292/*
1293 *	vm_object_shadow:
1294 *
1295 *	Create a new object which is backed by the
1296 *	specified existing object range.  The source
1297 *	object reference is deallocated.
1298 *
1299 *	The new object and offset into that object
1300 *	are returned in the source parameters.
1301 */
1302void
1303vm_object_shadow(
1304	vm_object_t *object,	/* IN/OUT */
1305	vm_ooffset_t *offset,	/* IN/OUT */
1306	vm_size_t length)
1307{
1308	vm_object_t source;
1309	vm_object_t result;
1310
1311	source = *object;
1312
1313	/*
1314	 * Don't create the new object if the old object isn't shared.
1315	 */
1316	if (source != NULL) {
1317		VM_OBJECT_LOCK(source);
1318		if (source->ref_count == 1 &&
1319		    source->handle == NULL &&
1320		    (source->type == OBJT_DEFAULT ||
1321		     source->type == OBJT_SWAP)) {
1322			VM_OBJECT_UNLOCK(source);
1323			return;
1324		}
1325		VM_OBJECT_UNLOCK(source);
1326	}
1327
1328	/*
1329	 * Allocate a new object with the given length.
1330	 */
1331	result = vm_object_allocate(OBJT_DEFAULT, length);
1332
1333	/*
1334	 * The new object shadows the source object, adding a reference to it.
1335	 * Our caller changes his reference to point to the new object,
1336	 * removing a reference to the source object.  Net result: no change
1337	 * of reference count.
1338	 *
1339	 * Try to optimize the result object's page color when shadowing
1340	 * in order to maintain page coloring consistency in the combined
1341	 * shadowed object.
1342	 */
1343	result->backing_object = source;
1344	/*
1345	 * Store the offset into the source object, and fix up the offset into
1346	 * the new object.
1347	 */
1348	result->backing_object_offset = *offset;
1349	if (source != NULL) {
1350		VM_OBJECT_LOCK(source);
1351		LIST_INSERT_HEAD(&source->shadow_head, result, shadow_list);
1352		source->shadow_count++;
1353		source->generation++;
1354#if VM_NRESERVLEVEL > 0
1355		result->flags |= source->flags & OBJ_COLORED;
1356		result->pg_color = (source->pg_color + OFF_TO_IDX(*offset)) &
1357		    ((1 << (VM_NFREEORDER - 1)) - 1);
1358#endif
1359		VM_OBJECT_UNLOCK(source);
1360	}
1361
1362
1363	/*
1364	 * Return the new things
1365	 */
1366	*offset = 0;
1367	*object = result;
1368}
1369
1370/*
1371 *	vm_object_split:
1372 *
1373 * Split the pages in a map entry into a new object.  This affords
1374 * easier removal of unused pages, and keeps object inheritance from
1375 * being a negative impact on memory usage.
1376 */
1377void
1378vm_object_split(vm_map_entry_t entry)
1379{
1380	vm_page_t m, m_next;
1381	vm_object_t orig_object, new_object, source;
1382	vm_pindex_t idx, offidxstart;
1383	vm_size_t size;
1384
1385	orig_object = entry->object.vm_object;
1386	if (orig_object->type != OBJT_DEFAULT && orig_object->type != OBJT_SWAP)
1387		return;
1388	if (orig_object->ref_count <= 1)
1389		return;
1390	VM_OBJECT_UNLOCK(orig_object);
1391
1392	offidxstart = OFF_TO_IDX(entry->offset);
1393	size = atop(entry->end - entry->start);
1394
1395	/*
1396	 * If swap_pager_copy() is later called, it will convert new_object
1397	 * into a swap object.
1398	 */
1399	new_object = vm_object_allocate(OBJT_DEFAULT, size);
1400
1401	/*
1402	 * At this point, the new object is still private, so the order in
1403	 * which the original and new objects are locked does not matter.
1404	 */
1405	VM_OBJECT_LOCK(new_object);
1406	VM_OBJECT_LOCK(orig_object);
1407	source = orig_object->backing_object;
1408	if (source != NULL) {
1409		VM_OBJECT_LOCK(source);
1410		if ((source->flags & OBJ_DEAD) != 0) {
1411			VM_OBJECT_UNLOCK(source);
1412			VM_OBJECT_UNLOCK(orig_object);
1413			VM_OBJECT_UNLOCK(new_object);
1414			vm_object_deallocate(new_object);
1415			VM_OBJECT_LOCK(orig_object);
1416			return;
1417		}
1418		LIST_INSERT_HEAD(&source->shadow_head,
1419				  new_object, shadow_list);
1420		source->shadow_count++;
1421		source->generation++;
1422		vm_object_reference_locked(source);	/* for new_object */
1423		vm_object_clear_flag(source, OBJ_ONEMAPPING);
1424		VM_OBJECT_UNLOCK(source);
1425		new_object->backing_object_offset =
1426			orig_object->backing_object_offset + entry->offset;
1427		new_object->backing_object = source;
1428	}
1429	if (orig_object->uip != NULL) {
1430		new_object->uip = orig_object->uip;
1431		uihold(orig_object->uip);
1432		new_object->charge = ptoa(size);
1433		KASSERT(orig_object->charge >= ptoa(size),
1434		    ("orig_object->charge < 0"));
1435		orig_object->charge -= ptoa(size);
1436	}
1437retry:
1438	if ((m = TAILQ_FIRST(&orig_object->memq)) != NULL) {
1439		if (m->pindex < offidxstart) {
1440			m = vm_page_splay(offidxstart, orig_object->root);
1441			if ((orig_object->root = m)->pindex < offidxstart)
1442				m = TAILQ_NEXT(m, listq);
1443		}
1444	}
1445	for (; m != NULL && (idx = m->pindex - offidxstart) < size;
1446	    m = m_next) {
1447		m_next = TAILQ_NEXT(m, listq);
1448
1449		/*
1450		 * We must wait for pending I/O to complete before we can
1451		 * rename the page.
1452		 *
1453		 * We do not have to VM_PROT_NONE the page as mappings should
1454		 * not be changed by this operation.
1455		 */
1456		if ((m->oflags & VPO_BUSY) || m->busy) {
1457			vm_page_unlock_queues();
1458			VM_OBJECT_UNLOCK(new_object);
1459			m->oflags |= VPO_WANTED;
1460			msleep(m, VM_OBJECT_MTX(orig_object), PVM, "spltwt", 0);
1461			VM_OBJECT_LOCK(new_object);
1462			goto retry;
1463		}
1464		vm_page_lock(m);
1465		vm_page_lock_queues();
1466		vm_page_rename(m, new_object, idx);
1467		vm_page_unlock_queues();
1468		vm_page_unlock(m);
1469		/* page automatically made dirty by rename and cache handled */
1470		vm_page_busy(m);
1471	}
1472	if (orig_object->type == OBJT_SWAP) {
1473		/*
1474		 * swap_pager_copy() can sleep, in which case the orig_object's
1475		 * and new_object's locks are released and reacquired.
1476		 */
1477		swap_pager_copy(orig_object, new_object, offidxstart, 0);
1478
1479		/*
1480		 * Transfer any cached pages from orig_object to new_object.
1481		 */
1482		if (__predict_false(orig_object->cache != NULL))
1483			vm_page_cache_transfer(orig_object, offidxstart,
1484			    new_object);
1485	}
1486	VM_OBJECT_UNLOCK(orig_object);
1487	TAILQ_FOREACH(m, &new_object->memq, listq)
1488		vm_page_wakeup(m);
1489	VM_OBJECT_UNLOCK(new_object);
1490	entry->object.vm_object = new_object;
1491	entry->offset = 0LL;
1492	vm_object_deallocate(orig_object);
1493	VM_OBJECT_LOCK(new_object);
1494}
1495
1496#define	OBSC_TEST_ALL_SHADOWED	0x0001
1497#define	OBSC_COLLAPSE_NOWAIT	0x0002
1498#define	OBSC_COLLAPSE_WAIT	0x0004
1499
1500static int
1501vm_object_backing_scan(vm_object_t object, int op)
1502{
1503	int r = 1;
1504	vm_page_t p;
1505	vm_object_t backing_object;
1506	vm_pindex_t backing_offset_index;
1507
1508	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1509	VM_OBJECT_LOCK_ASSERT(object->backing_object, MA_OWNED);
1510
1511	backing_object = object->backing_object;
1512	backing_offset_index = OFF_TO_IDX(object->backing_object_offset);
1513
1514	/*
1515	 * Initial conditions
1516	 */
1517	if (op & OBSC_TEST_ALL_SHADOWED) {
1518		/*
1519		 * We do not want to have to test for the existence of cache
1520		 * or swap pages in the backing object.  XXX but with the
1521		 * new swapper this would be pretty easy to do.
1522		 *
1523		 * XXX what about anonymous MAP_SHARED memory that hasn't
1524		 * been ZFOD faulted yet?  If we do not test for this, the
1525		 * shadow test may succeed! XXX
1526		 */
1527		if (backing_object->type != OBJT_DEFAULT) {
1528			return (0);
1529		}
1530	}
1531	if (op & OBSC_COLLAPSE_WAIT) {
1532		vm_object_set_flag(backing_object, OBJ_DEAD);
1533	}
1534
1535	/*
1536	 * Our scan
1537	 */
1538	p = TAILQ_FIRST(&backing_object->memq);
1539	while (p) {
1540		vm_page_t next = TAILQ_NEXT(p, listq);
1541		vm_pindex_t new_pindex = p->pindex - backing_offset_index;
1542
1543		if (op & OBSC_TEST_ALL_SHADOWED) {
1544			vm_page_t pp;
1545
1546			/*
1547			 * Ignore pages outside the parent object's range
1548			 * and outside the parent object's mapping of the
1549			 * backing object.
1550			 *
1551			 * note that we do not busy the backing object's
1552			 * page.
1553			 */
1554			if (
1555			    p->pindex < backing_offset_index ||
1556			    new_pindex >= object->size
1557			) {
1558				p = next;
1559				continue;
1560			}
1561
1562			/*
1563			 * See if the parent has the page or if the parent's
1564			 * object pager has the page.  If the parent has the
1565			 * page but the page is not valid, the parent's
1566			 * object pager must have the page.
1567			 *
1568			 * If this fails, the parent does not completely shadow
1569			 * the object and we might as well give up now.
1570			 */
1571
1572			pp = vm_page_lookup(object, new_pindex);
1573			if (
1574			    (pp == NULL || pp->valid == 0) &&
1575			    !vm_pager_has_page(object, new_pindex, NULL, NULL)
1576			) {
1577				r = 0;
1578				break;
1579			}
1580		}
1581
1582		/*
1583		 * Check for busy page
1584		 */
1585		if (op & (OBSC_COLLAPSE_WAIT | OBSC_COLLAPSE_NOWAIT)) {
1586			vm_page_t pp;
1587
1588			if (op & OBSC_COLLAPSE_NOWAIT) {
1589				if ((p->oflags & VPO_BUSY) ||
1590				    !p->valid ||
1591				    p->busy) {
1592					p = next;
1593					continue;
1594				}
1595			} else if (op & OBSC_COLLAPSE_WAIT) {
1596				if ((p->oflags & VPO_BUSY) || p->busy) {
1597					VM_OBJECT_UNLOCK(object);
1598					p->oflags |= VPO_WANTED;
1599					msleep(p, VM_OBJECT_MTX(backing_object),
1600					    PDROP | PVM, "vmocol", 0);
1601					VM_OBJECT_LOCK(object);
1602					VM_OBJECT_LOCK(backing_object);
1603					/*
1604					 * If we slept, anything could have
1605					 * happened.  Since the object is
1606					 * marked dead, the backing offset
1607					 * should not have changed so we
1608					 * just restart our scan.
1609					 */
1610					p = TAILQ_FIRST(&backing_object->memq);
1611					continue;
1612				}
1613			}
1614
1615			KASSERT(
1616			    p->object == backing_object,
1617			    ("vm_object_backing_scan: object mismatch")
1618			);
1619
1620			/*
1621			 * Destroy any associated swap
1622			 */
1623			if (backing_object->type == OBJT_SWAP) {
1624				swap_pager_freespace(
1625				    backing_object,
1626				    p->pindex,
1627				    1
1628				);
1629			}
1630
1631			if (
1632			    p->pindex < backing_offset_index ||
1633			    new_pindex >= object->size
1634			) {
1635				/*
1636				 * Page is out of the parent object's range, we
1637				 * can simply destroy it.
1638				 */
1639				vm_page_lock(p);
1640				vm_page_lock_queues();
1641				KASSERT(!pmap_page_is_mapped(p),
1642				    ("freeing mapped page %p", p));
1643				if (p->wire_count == 0)
1644					vm_page_free(p);
1645				else
1646					vm_page_remove(p);
1647				vm_page_unlock_queues();
1648				vm_page_unlock(p);
1649				p = next;
1650				continue;
1651			}
1652
1653			pp = vm_page_lookup(object, new_pindex);
1654			if (
1655			    pp != NULL ||
1656			    vm_pager_has_page(object, new_pindex, NULL, NULL)
1657			) {
1658				/*
1659				 * page already exists in parent OR swap exists
1660				 * for this location in the parent.  Destroy
1661				 * the original page from the backing object.
1662				 *
1663				 * Leave the parent's page alone
1664				 */
1665				vm_page_lock(p);
1666				vm_page_lock_queues();
1667				KASSERT(!pmap_page_is_mapped(p),
1668				    ("freeing mapped page %p", p));
1669				if (p->wire_count == 0)
1670					vm_page_free(p);
1671				else
1672					vm_page_remove(p);
1673				vm_page_unlock_queues();
1674				vm_page_unlock(p);
1675				p = next;
1676				continue;
1677			}
1678
1679#if VM_NRESERVLEVEL > 0
1680			/*
1681			 * Rename the reservation.
1682			 */
1683			vm_reserv_rename(p, object, backing_object,
1684			    backing_offset_index);
1685#endif
1686
1687			/*
1688			 * Page does not exist in parent, rename the
1689			 * page from the backing object to the main object.
1690			 *
1691			 * If the page was mapped to a process, it can remain
1692			 * mapped through the rename.
1693			 */
1694			vm_page_lock(p);
1695			vm_page_lock_queues();
1696			vm_page_rename(p, object, new_pindex);
1697			vm_page_unlock_queues();
1698			vm_page_unlock(p);
1699			/* page automatically made dirty by rename */
1700		}
1701		p = next;
1702	}
1703	return (r);
1704}
1705
1706
1707/*
1708 * this version of collapse allows the operation to occur earlier and
1709 * when paging_in_progress is true for an object...  This is not a complete
1710 * operation, but should plug 99.9% of the rest of the leaks.
1711 */
1712static void
1713vm_object_qcollapse(vm_object_t object)
1714{
1715	vm_object_t backing_object = object->backing_object;
1716
1717	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1718	VM_OBJECT_LOCK_ASSERT(backing_object, MA_OWNED);
1719
1720	if (backing_object->ref_count != 1)
1721		return;
1722
1723	vm_object_backing_scan(object, OBSC_COLLAPSE_NOWAIT);
1724}
1725
1726/*
1727 *	vm_object_collapse:
1728 *
1729 *	Collapse an object with the object backing it.
1730 *	Pages in the backing object are moved into the
1731 *	parent, and the backing object is deallocated.
1732 */
1733void
1734vm_object_collapse(vm_object_t object)
1735{
1736	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1737
1738	while (TRUE) {
1739		vm_object_t backing_object;
1740
1741		/*
1742		 * Verify that the conditions are right for collapse:
1743		 *
1744		 * The object exists and the backing object exists.
1745		 */
1746		if ((backing_object = object->backing_object) == NULL)
1747			break;
1748
1749		/*
1750		 * we check the backing object first, because it is most likely
1751		 * not collapsable.
1752		 */
1753		VM_OBJECT_LOCK(backing_object);
1754		if (backing_object->handle != NULL ||
1755		    (backing_object->type != OBJT_DEFAULT &&
1756		     backing_object->type != OBJT_SWAP) ||
1757		    (backing_object->flags & OBJ_DEAD) ||
1758		    object->handle != NULL ||
1759		    (object->type != OBJT_DEFAULT &&
1760		     object->type != OBJT_SWAP) ||
1761		    (object->flags & OBJ_DEAD)) {
1762			VM_OBJECT_UNLOCK(backing_object);
1763			break;
1764		}
1765
1766		if (
1767		    object->paging_in_progress != 0 ||
1768		    backing_object->paging_in_progress != 0
1769		) {
1770			vm_object_qcollapse(object);
1771			VM_OBJECT_UNLOCK(backing_object);
1772			break;
1773		}
1774		/*
1775		 * We know that we can either collapse the backing object (if
1776		 * the parent is the only reference to it) or (perhaps) have
1777		 * the parent bypass the object if the parent happens to shadow
1778		 * all the resident pages in the entire backing object.
1779		 *
1780		 * This is ignoring pager-backed pages such as swap pages.
1781		 * vm_object_backing_scan fails the shadowing test in this
1782		 * case.
1783		 */
1784		if (backing_object->ref_count == 1) {
1785			/*
1786			 * If there is exactly one reference to the backing
1787			 * object, we can collapse it into the parent.
1788			 */
1789			vm_object_backing_scan(object, OBSC_COLLAPSE_WAIT);
1790
1791#if VM_NRESERVLEVEL > 0
1792			/*
1793			 * Break any reservations from backing_object.
1794			 */
1795			if (__predict_false(!LIST_EMPTY(&backing_object->rvq)))
1796				vm_reserv_break_all(backing_object);
1797#endif
1798
1799			/*
1800			 * Move the pager from backing_object to object.
1801			 */
1802			if (backing_object->type == OBJT_SWAP) {
1803				/*
1804				 * swap_pager_copy() can sleep, in which case
1805				 * the backing_object's and object's locks are
1806				 * released and reacquired.
1807				 */
1808				swap_pager_copy(
1809				    backing_object,
1810				    object,
1811				    OFF_TO_IDX(object->backing_object_offset), TRUE);
1812
1813				/*
1814				 * Free any cached pages from backing_object.
1815				 */
1816				if (__predict_false(backing_object->cache != NULL))
1817					vm_page_cache_free(backing_object, 0, 0);
1818			}
1819			/*
1820			 * Object now shadows whatever backing_object did.
1821			 * Note that the reference to
1822			 * backing_object->backing_object moves from within
1823			 * backing_object to within object.
1824			 */
1825			LIST_REMOVE(object, shadow_list);
1826			backing_object->shadow_count--;
1827			backing_object->generation++;
1828			if (backing_object->backing_object) {
1829				VM_OBJECT_LOCK(backing_object->backing_object);
1830				LIST_REMOVE(backing_object, shadow_list);
1831				LIST_INSERT_HEAD(
1832				    &backing_object->backing_object->shadow_head,
1833				    object, shadow_list);
1834				/*
1835				 * The shadow_count has not changed.
1836				 */
1837				backing_object->backing_object->generation++;
1838				VM_OBJECT_UNLOCK(backing_object->backing_object);
1839			}
1840			object->backing_object = backing_object->backing_object;
1841			object->backing_object_offset +=
1842			    backing_object->backing_object_offset;
1843
1844			/*
1845			 * Discard backing_object.
1846			 *
1847			 * Since the backing object has no pages, no pager left,
1848			 * and no object references within it, all that is
1849			 * necessary is to dispose of it.
1850			 */
1851			KASSERT(backing_object->ref_count == 1, (
1852"backing_object %p was somehow re-referenced during collapse!",
1853			    backing_object));
1854			VM_OBJECT_UNLOCK(backing_object);
1855			vm_object_destroy(backing_object);
1856
1857			object_collapses++;
1858		} else {
1859			vm_object_t new_backing_object;
1860
1861			/*
1862			 * If we do not entirely shadow the backing object,
1863			 * there is nothing we can do so we give up.
1864			 */
1865			if (object->resident_page_count != object->size &&
1866			    vm_object_backing_scan(object,
1867			    OBSC_TEST_ALL_SHADOWED) == 0) {
1868				VM_OBJECT_UNLOCK(backing_object);
1869				break;
1870			}
1871
1872			/*
1873			 * Make the parent shadow the next object in the
1874			 * chain.  Deallocating backing_object will not remove
1875			 * it, since its reference count is at least 2.
1876			 */
1877			LIST_REMOVE(object, shadow_list);
1878			backing_object->shadow_count--;
1879			backing_object->generation++;
1880
1881			new_backing_object = backing_object->backing_object;
1882			if ((object->backing_object = new_backing_object) != NULL) {
1883				VM_OBJECT_LOCK(new_backing_object);
1884				LIST_INSERT_HEAD(
1885				    &new_backing_object->shadow_head,
1886				    object,
1887				    shadow_list
1888				);
1889				new_backing_object->shadow_count++;
1890				new_backing_object->generation++;
1891				vm_object_reference_locked(new_backing_object);
1892				VM_OBJECT_UNLOCK(new_backing_object);
1893				object->backing_object_offset +=
1894					backing_object->backing_object_offset;
1895			}
1896
1897			/*
1898			 * Drop the reference count on backing_object. Since
1899			 * its ref_count was at least 2, it will not vanish.
1900			 */
1901			backing_object->ref_count--;
1902			VM_OBJECT_UNLOCK(backing_object);
1903			object_bypasses++;
1904		}
1905
1906		/*
1907		 * Try again with this object's new backing object.
1908		 */
1909	}
1910}
1911
1912/*
1913 *	vm_object_page_remove:
1914 *
1915 *	For the given object, either frees or invalidates each of the
1916 *	specified pages.  In general, a page is freed.  However, if a
1917 *	page is wired for any reason other than the existence of a
1918 *	managed, wired mapping, then it may be invalidated but not
1919 *	removed from the object.  Pages are specified by the given
1920 *	range ["start", "end") and Boolean "clean_only".  As a
1921 *	special case, if "end" is zero, then the range extends from
1922 *	"start" to the end of the object.  If "clean_only" is TRUE,
1923 *	then only the non-dirty pages within the specified range are
1924 *	affected.
1925 *
1926 *	In general, this operation should only be performed on objects
1927 *	that contain managed pages.  There are two exceptions.  First,
1928 *	it may be performed on the kernel and kmem objects.  Second,
1929 *	it may be used by msync(..., MS_INVALIDATE) to invalidate
1930 *	device-backed pages.
1931 *
1932 *	The object must be locked.
1933 */
1934void
1935vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
1936    boolean_t clean_only)
1937{
1938	vm_page_t p, next;
1939	int wirings;
1940
1941	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1942	if (object->resident_page_count == 0)
1943		goto skipmemq;
1944
1945	/*
1946	 * Since physically-backed objects do not use managed pages, we can't
1947	 * remove pages from the object (we must instead remove the page
1948	 * references, and then destroy the object).
1949	 */
1950	KASSERT(object->type != OBJT_PHYS || object == kernel_object ||
1951	    object == kmem_object,
1952	    ("attempt to remove pages from a physical object"));
1953
1954	vm_object_pip_add(object, 1);
1955again:
1956	if ((p = TAILQ_FIRST(&object->memq)) != NULL) {
1957		if (p->pindex < start) {
1958			p = vm_page_splay(start, object->root);
1959			if ((object->root = p)->pindex < start)
1960				p = TAILQ_NEXT(p, listq);
1961		}
1962	}
1963
1964	/*
1965	 * Assert: the variable p is either (1) the page with the
1966	 * least pindex greater than or equal to the parameter pindex
1967	 * or (2) NULL.
1968	 */
1969	for (;
1970	     p != NULL && (p->pindex < end || end == 0);
1971	     p = next) {
1972		next = TAILQ_NEXT(p, listq);
1973
1974		/*
1975		 * If the page is wired for any reason besides the
1976		 * existence of managed, wired mappings, then it cannot
1977		 * be freed.  For example, fictitious pages, which
1978		 * represent device memory, are inherently wired and
1979		 * cannot be freed.  They can, however, be invalidated
1980		 * if "clean_only" is FALSE.
1981		 */
1982		vm_page_lock(p);
1983		vm_page_lock_queues();
1984		if ((wirings = p->wire_count) != 0 &&
1985		    (wirings = pmap_page_wired_mappings(p)) != p->wire_count) {
1986			/* Fictitious pages do not have managed mappings. */
1987			if ((p->flags & PG_FICTITIOUS) == 0)
1988				pmap_remove_all(p);
1989			/* Account for removal of managed, wired mappings. */
1990			p->wire_count -= wirings;
1991			if (!clean_only) {
1992				p->valid = 0;
1993				vm_page_undirty(p);
1994			}
1995			vm_page_unlock_queues();
1996			vm_page_unlock(p);
1997			continue;
1998		}
1999		if (vm_page_sleep_if_busy(p, TRUE, "vmopar"))
2000			goto again;
2001		KASSERT((p->flags & PG_FICTITIOUS) == 0,
2002		    ("vm_object_page_remove: page %p is fictitious", p));
2003		if (clean_only && p->valid) {
2004			pmap_remove_write(p);
2005			if (p->dirty) {
2006				vm_page_unlock_queues();
2007				vm_page_unlock(p);
2008				continue;
2009			}
2010		}
2011		pmap_remove_all(p);
2012		/* Account for removal of managed, wired mappings. */
2013		if (wirings != 0)
2014			p->wire_count -= wirings;
2015		vm_page_free(p);
2016		vm_page_unlock_queues();
2017		vm_page_unlock(p);
2018	}
2019	vm_object_pip_wakeup(object);
2020skipmemq:
2021	if (__predict_false(object->cache != NULL))
2022		vm_page_cache_free(object, start, end);
2023}
2024
2025/*
2026 *	Populate the specified range of the object with valid pages.  Returns
2027 *	TRUE if the range is successfully populated and FALSE otherwise.
2028 *
2029 *	Note: This function should be optimized to pass a larger array of
2030 *	pages to vm_pager_get_pages() before it is applied to a non-
2031 *	OBJT_DEVICE object.
2032 *
2033 *	The object must be locked.
2034 */
2035boolean_t
2036vm_object_populate(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
2037{
2038	vm_page_t m, ma[1];
2039	vm_pindex_t pindex;
2040	int rv;
2041
2042	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
2043	for (pindex = start; pindex < end; pindex++) {
2044		m = vm_page_grab(object, pindex, VM_ALLOC_NORMAL |
2045		    VM_ALLOC_RETRY);
2046		if (m->valid != VM_PAGE_BITS_ALL) {
2047			ma[0] = m;
2048			rv = vm_pager_get_pages(object, ma, 1, 0);
2049			m = vm_page_lookup(object, pindex);
2050			if (m == NULL)
2051				break;
2052			if (rv != VM_PAGER_OK) {
2053				vm_page_lock(m);
2054				vm_page_lock_queues();
2055				vm_page_free(m);
2056				vm_page_unlock_queues();
2057				vm_page_unlock(m);
2058				break;
2059			}
2060		}
2061		/*
2062		 * Keep "m" busy because a subsequent iteration may unlock
2063		 * the object.
2064		 */
2065	}
2066	if (pindex > start) {
2067		m = vm_page_lookup(object, start);
2068		while (m != NULL && m->pindex < pindex) {
2069			vm_page_wakeup(m);
2070			m = TAILQ_NEXT(m, listq);
2071		}
2072	}
2073	return (pindex == end);
2074}
2075
2076/*
2077 *	Routine:	vm_object_coalesce
2078 *	Function:	Coalesces two objects backing up adjoining
2079 *			regions of memory into a single object.
2080 *
2081 *	returns TRUE if objects were combined.
2082 *
2083 *	NOTE:	Only works at the moment if the second object is NULL -
2084 *		if it's not, which object do we lock first?
2085 *
2086 *	Parameters:
2087 *		prev_object	First object to coalesce
2088 *		prev_offset	Offset into prev_object
2089 *		prev_size	Size of reference to prev_object
2090 *		next_size	Size of reference to the second object
2091 *		reserved	Indicator that extension region has
2092 *				swap accounted for
2093 *
2094 *	Conditions:
2095 *	The object must *not* be locked.
2096 */
2097boolean_t
2098vm_object_coalesce(vm_object_t prev_object, vm_ooffset_t prev_offset,
2099    vm_size_t prev_size, vm_size_t next_size, boolean_t reserved)
2100{
2101	vm_pindex_t next_pindex;
2102
2103	if (prev_object == NULL)
2104		return (TRUE);
2105	VM_OBJECT_LOCK(prev_object);
2106	if (prev_object->type != OBJT_DEFAULT &&
2107	    prev_object->type != OBJT_SWAP) {
2108		VM_OBJECT_UNLOCK(prev_object);
2109		return (FALSE);
2110	}
2111
2112	/*
2113	 * Try to collapse the object first
2114	 */
2115	vm_object_collapse(prev_object);
2116
2117	/*
2118	 * Can't coalesce if: . more than one reference . paged out . shadows
2119	 * another object . has a copy elsewhere (any of which mean that the
2120	 * pages not mapped to prev_entry may be in use anyway)
2121	 */
2122	if (prev_object->backing_object != NULL) {
2123		VM_OBJECT_UNLOCK(prev_object);
2124		return (FALSE);
2125	}
2126
2127	prev_size >>= PAGE_SHIFT;
2128	next_size >>= PAGE_SHIFT;
2129	next_pindex = OFF_TO_IDX(prev_offset) + prev_size;
2130
2131	if ((prev_object->ref_count > 1) &&
2132	    (prev_object->size != next_pindex)) {
2133		VM_OBJECT_UNLOCK(prev_object);
2134		return (FALSE);
2135	}
2136
2137	/*
2138	 * Account for the charge.
2139	 */
2140	if (prev_object->uip != NULL) {
2141
2142		/*
2143		 * If prev_object was charged, then this mapping,
2144		 * althought not charged now, may become writable
2145		 * later. Non-NULL uip in the object would prevent
2146		 * swap reservation during enabling of the write
2147		 * access, so reserve swap now. Failed reservation
2148		 * cause allocation of the separate object for the map
2149		 * entry, and swap reservation for this entry is
2150		 * managed in appropriate time.
2151		 */
2152		if (!reserved && !swap_reserve_by_uid(ptoa(next_size),
2153		    prev_object->uip)) {
2154			return (FALSE);
2155		}
2156		prev_object->charge += ptoa(next_size);
2157	}
2158
2159	/*
2160	 * Remove any pages that may still be in the object from a previous
2161	 * deallocation.
2162	 */
2163	if (next_pindex < prev_object->size) {
2164		vm_object_page_remove(prev_object,
2165				      next_pindex,
2166				      next_pindex + next_size, FALSE);
2167		if (prev_object->type == OBJT_SWAP)
2168			swap_pager_freespace(prev_object,
2169					     next_pindex, next_size);
2170#if 0
2171		if (prev_object->uip != NULL) {
2172			KASSERT(prev_object->charge >=
2173			    ptoa(prev_object->size - next_pindex),
2174			    ("object %p overcharged 1 %jx %jx", prev_object,
2175				(uintmax_t)next_pindex, (uintmax_t)next_size));
2176			prev_object->charge -= ptoa(prev_object->size -
2177			    next_pindex);
2178		}
2179#endif
2180	}
2181
2182	/*
2183	 * Extend the object if necessary.
2184	 */
2185	if (next_pindex + next_size > prev_object->size)
2186		prev_object->size = next_pindex + next_size;
2187
2188	VM_OBJECT_UNLOCK(prev_object);
2189	return (TRUE);
2190}
2191
2192void
2193vm_object_set_writeable_dirty(vm_object_t object)
2194{
2195
2196	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
2197	if (object->type != OBJT_VNODE ||
2198	    (object->flags & OBJ_MIGHTBEDIRTY) != 0)
2199		return;
2200	vm_object_set_flag(object, OBJ_MIGHTBEDIRTY);
2201}
2202
2203#include "opt_ddb.h"
2204#ifdef DDB
2205#include <sys/kernel.h>
2206
2207#include <sys/cons.h>
2208
2209#include <ddb/ddb.h>
2210
2211static int
2212_vm_object_in_map(vm_map_t map, vm_object_t object, vm_map_entry_t entry)
2213{
2214	vm_map_t tmpm;
2215	vm_map_entry_t tmpe;
2216	vm_object_t obj;
2217	int entcount;
2218
2219	if (map == 0)
2220		return 0;
2221
2222	if (entry == 0) {
2223		tmpe = map->header.next;
2224		entcount = map->nentries;
2225		while (entcount-- && (tmpe != &map->header)) {
2226			if (_vm_object_in_map(map, object, tmpe)) {
2227				return 1;
2228			}
2229			tmpe = tmpe->next;
2230		}
2231	} else if (entry->eflags & MAP_ENTRY_IS_SUB_MAP) {
2232		tmpm = entry->object.sub_map;
2233		tmpe = tmpm->header.next;
2234		entcount = tmpm->nentries;
2235		while (entcount-- && tmpe != &tmpm->header) {
2236			if (_vm_object_in_map(tmpm, object, tmpe)) {
2237				return 1;
2238			}
2239			tmpe = tmpe->next;
2240		}
2241	} else if ((obj = entry->object.vm_object) != NULL) {
2242		for (; obj; obj = obj->backing_object)
2243			if (obj == object) {
2244				return 1;
2245			}
2246	}
2247	return 0;
2248}
2249
2250static int
2251vm_object_in_map(vm_object_t object)
2252{
2253	struct proc *p;
2254
2255	/* sx_slock(&allproc_lock); */
2256	FOREACH_PROC_IN_SYSTEM(p) {
2257		if (!p->p_vmspace /* || (p->p_flag & (P_SYSTEM|P_WEXIT)) */)
2258			continue;
2259		if (_vm_object_in_map(&p->p_vmspace->vm_map, object, 0)) {
2260			/* sx_sunlock(&allproc_lock); */
2261			return 1;
2262		}
2263	}
2264	/* sx_sunlock(&allproc_lock); */
2265	if (_vm_object_in_map(kernel_map, object, 0))
2266		return 1;
2267	if (_vm_object_in_map(kmem_map, object, 0))
2268		return 1;
2269	if (_vm_object_in_map(pager_map, object, 0))
2270		return 1;
2271	if (_vm_object_in_map(buffer_map, object, 0))
2272		return 1;
2273	return 0;
2274}
2275
2276DB_SHOW_COMMAND(vmochk, vm_object_check)
2277{
2278	vm_object_t object;
2279
2280	/*
2281	 * make sure that internal objs are in a map somewhere
2282	 * and none have zero ref counts.
2283	 */
2284	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2285		if (object->handle == NULL &&
2286		    (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
2287			if (object->ref_count == 0) {
2288				db_printf("vmochk: internal obj has zero ref count: %ld\n",
2289					(long)object->size);
2290			}
2291			if (!vm_object_in_map(object)) {
2292				db_printf(
2293			"vmochk: internal obj is not in a map: "
2294			"ref: %d, size: %lu: 0x%lx, backing_object: %p\n",
2295				    object->ref_count, (u_long)object->size,
2296				    (u_long)object->size,
2297				    (void *)object->backing_object);
2298			}
2299		}
2300	}
2301}
2302
2303/*
2304 *	vm_object_print:	[ debug ]
2305 */
2306DB_SHOW_COMMAND(object, vm_object_print_static)
2307{
2308	/* XXX convert args. */
2309	vm_object_t object = (vm_object_t)addr;
2310	boolean_t full = have_addr;
2311
2312	vm_page_t p;
2313
2314	/* XXX count is an (unused) arg.  Avoid shadowing it. */
2315#define	count	was_count
2316
2317	int count;
2318
2319	if (object == NULL)
2320		return;
2321
2322	db_iprintf(
2323	    "Object %p: type=%d, size=0x%jx, res=%d, ref=%d, flags=0x%x uip %d charge %jx\n",
2324	    object, (int)object->type, (uintmax_t)object->size,
2325	    object->resident_page_count, object->ref_count, object->flags,
2326	    object->uip ? object->uip->ui_uid : -1, (uintmax_t)object->charge);
2327	db_iprintf(" sref=%d, backing_object(%d)=(%p)+0x%jx\n",
2328	    object->shadow_count,
2329	    object->backing_object ? object->backing_object->ref_count : 0,
2330	    object->backing_object, (uintmax_t)object->backing_object_offset);
2331
2332	if (!full)
2333		return;
2334
2335	db_indent += 2;
2336	count = 0;
2337	TAILQ_FOREACH(p, &object->memq, listq) {
2338		if (count == 0)
2339			db_iprintf("memory:=");
2340		else if (count == 6) {
2341			db_printf("\n");
2342			db_iprintf(" ...");
2343			count = 0;
2344		} else
2345			db_printf(",");
2346		count++;
2347
2348		db_printf("(off=0x%jx,page=0x%jx)",
2349		    (uintmax_t)p->pindex, (uintmax_t)VM_PAGE_TO_PHYS(p));
2350	}
2351	if (count != 0)
2352		db_printf("\n");
2353	db_indent -= 2;
2354}
2355
2356/* XXX. */
2357#undef count
2358
2359/* XXX need this non-static entry for calling from vm_map_print. */
2360void
2361vm_object_print(
2362        /* db_expr_t */ long addr,
2363	boolean_t have_addr,
2364	/* db_expr_t */ long count,
2365	char *modif)
2366{
2367	vm_object_print_static(addr, have_addr, count, modif);
2368}
2369
2370DB_SHOW_COMMAND(vmopag, vm_object_print_pages)
2371{
2372	vm_object_t object;
2373	vm_pindex_t fidx;
2374	vm_paddr_t pa;
2375	vm_page_t m, prev_m;
2376	int rcount, nl, c;
2377
2378	nl = 0;
2379	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2380		db_printf("new object: %p\n", (void *)object);
2381		if (nl > 18) {
2382			c = cngetc();
2383			if (c != ' ')
2384				return;
2385			nl = 0;
2386		}
2387		nl++;
2388		rcount = 0;
2389		fidx = 0;
2390		pa = -1;
2391		TAILQ_FOREACH(m, &object->memq, listq) {
2392			if (m->pindex > 128)
2393				break;
2394			if ((prev_m = TAILQ_PREV(m, pglist, listq)) != NULL &&
2395			    prev_m->pindex + 1 != m->pindex) {
2396				if (rcount) {
2397					db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2398						(long)fidx, rcount, (long)pa);
2399					if (nl > 18) {
2400						c = cngetc();
2401						if (c != ' ')
2402							return;
2403						nl = 0;
2404					}
2405					nl++;
2406					rcount = 0;
2407				}
2408			}
2409			if (rcount &&
2410				(VM_PAGE_TO_PHYS(m) == pa + rcount * PAGE_SIZE)) {
2411				++rcount;
2412				continue;
2413			}
2414			if (rcount) {
2415				db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2416					(long)fidx, rcount, (long)pa);
2417				if (nl > 18) {
2418					c = cngetc();
2419					if (c != ' ')
2420						return;
2421					nl = 0;
2422				}
2423				nl++;
2424			}
2425			fidx = m->pindex;
2426			pa = VM_PAGE_TO_PHYS(m);
2427			rcount = 1;
2428		}
2429		if (rcount) {
2430			db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2431				(long)fidx, rcount, (long)pa);
2432			if (nl > 18) {
2433				c = cngetc();
2434				if (c != ' ')
2435					return;
2436				nl = 0;
2437			}
2438			nl++;
2439		}
2440	}
2441}
2442#endif /* DDB */
2443