da31ba6cbc749d2f4f613dabb4b7f08112465a5a
[dragonfly.git] / sys / vm / vm_object.c
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1991, 1993
5  *      The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * The Mach Operating System project at Carnegie-Mellon University.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *      This product includes software developed by the University of
21  *      California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      from: @(#)vm_object.c   8.5 (Berkeley) 3/22/94
39  *
40  *
41  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
42  * All rights reserved.
43  *
44  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
45  *
46  * Permission to use, copy, modify and distribute this software and
47  * its documentation is hereby granted, provided that both the copyright
48  * notice and this permission notice appear in all copies of the
49  * software, derivative works or modified versions, and any portions
50  * thereof, and that both notices appear in supporting documentation.
51  *
52  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
53  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
54  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
55  *
56  * Carnegie Mellon requests users of this software to return to
57  *
58  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
59  *  School of Computer Science
60  *  Carnegie Mellon University
61  *  Pittsburgh PA 15213-3890
62  *
63  * any improvements or extensions that they make and grant Carnegie the
64  * rights to redistribute these changes.
65  *
66  * $FreeBSD: src/sys/vm/vm_object.c,v 1.171.2.8 2003/05/26 19:17:56 alc Exp $
67  * $DragonFly: src/sys/vm/vm_object.c,v 1.33 2008/05/09 07:24:48 dillon Exp $
68  */
69
70 /*
71  *      Virtual memory object module.
72  */
73
74 #include <sys/param.h>
75 #include <sys/systm.h>
76 #include <sys/proc.h>           /* for curproc, pageproc */
77 #include <sys/thread.h>
78 #include <sys/vnode.h>
79 #include <sys/vmmeter.h>
80 #include <sys/mman.h>
81 #include <sys/mount.h>
82 #include <sys/kernel.h>
83 #include <sys/sysctl.h>
84
85 #include <vm/vm.h>
86 #include <vm/vm_param.h>
87 #include <vm/pmap.h>
88 #include <vm/vm_map.h>
89 #include <vm/vm_object.h>
90 #include <vm/vm_page.h>
91 #include <vm/vm_pageout.h>
92 #include <vm/vm_pager.h>
93 #include <vm/swap_pager.h>
94 #include <vm/vm_kern.h>
95 #include <vm/vm_extern.h>
96 #include <vm/vm_zone.h>
97
98 #define EASY_SCAN_FACTOR        8
99
100 static void     vm_object_qcollapse(vm_object_t object);
101 static int      vm_object_page_collect_flush(vm_object_t object, vm_page_t p,
102                                              int pagerflags);
103
104 /*
105  *      Virtual memory objects maintain the actual data
106  *      associated with allocated virtual memory.  A given
107  *      page of memory exists within exactly one object.
108  *
109  *      An object is only deallocated when all "references"
110  *      are given up.  Only one "reference" to a given
111  *      region of an object should be writeable.
112  *
113  *      Associated with each object is a list of all resident
114  *      memory pages belonging to that object; this list is
115  *      maintained by the "vm_page" module, and locked by the object's
116  *      lock.
117  *
118  *      Each object also records a "pager" routine which is
119  *      used to retrieve (and store) pages to the proper backing
120  *      storage.  In addition, objects may be backed by other
121  *      objects from which they were virtual-copied.
122  *
123  *      The only items within the object structure which are
124  *      modified after time of creation are:
125  *              reference count         locked by object's lock
126  *              pager routine           locked by object's lock
127  *
128  */
129
130 struct object_q vm_object_list;         /* locked by vmobj_token */
131 struct vm_object kernel_object;
132
133 static long vm_object_count;            /* locked by vmobj_token */
134 extern int vm_pageout_page_count;
135
136 static long object_collapses;
137 static long object_bypasses;
138 static int next_index;
139 static vm_zone_t obj_zone;
140 static struct vm_zone obj_zone_store;
141 static int object_hash_rand;
142 #define VM_OBJECTS_INIT 256
143 static struct vm_object vm_objects_init[VM_OBJECTS_INIT];
144
145 /*
146  * Initialize a freshly allocated object
147  *
148  * Used only by vm_object_allocate() and zinitna().
149  *
150  * No requirements.
151  */
152 void
153 _vm_object_allocate(objtype_t type, vm_pindex_t size, vm_object_t object)
154 {
155         int incr;
156
157         RB_INIT(&object->rb_memq);
158         LIST_INIT(&object->shadow_head);
159
160         object->type = type;
161         object->size = size;
162         object->ref_count = 1;
163         object->flags = 0;
164         if ((object->type == OBJT_DEFAULT) || (object->type == OBJT_SWAP))
165                 vm_object_set_flag(object, OBJ_ONEMAPPING);
166         object->paging_in_progress = 0;
167         object->resident_page_count = 0;
168         object->agg_pv_list_count = 0;
169         object->shadow_count = 0;
170         object->pg_color = next_index;
171         if ( size > (PQ_L2_SIZE / 3 + PQ_PRIME1))
172                 incr = PQ_L2_SIZE / 3 + PQ_PRIME1;
173         else
174                 incr = size;
175         next_index = (next_index + incr) & PQ_L2_MASK;
176         object->handle = NULL;
177         object->backing_object = NULL;
178         object->backing_object_offset = (vm_ooffset_t) 0;
179         /*
180          * Try to generate a number that will spread objects out in the
181          * hash table.  We 'wipe' new objects across the hash in 128 page
182          * increments plus 1 more to offset it a little more by the time
183          * it wraps around.
184          */
185         object->hash_rand = object_hash_rand - 129;
186
187         object->generation++;
188         object->swblock_count = 0;
189         RB_INIT(&object->swblock_root);
190         lwkt_token_init(&object->tok, "vmobjtk");
191
192         lwkt_gettoken(&vmobj_token);
193         TAILQ_INSERT_TAIL(&vm_object_list, object, object_list);
194         vm_object_count++;
195         object_hash_rand = object->hash_rand;
196         lwkt_reltoken(&vmobj_token);
197 }
198
199 /*
200  * Initialize the VM objects module.
201  *
202  * Called from the low level boot code only.
203  */
204 void
205 vm_object_init(void)
206 {
207         TAILQ_INIT(&vm_object_list);
208         
209         _vm_object_allocate(OBJT_DEFAULT, OFF_TO_IDX(KvaEnd),
210                             &kernel_object);
211
212         obj_zone = &obj_zone_store;
213         zbootinit(obj_zone, "VM OBJECT", sizeof (struct vm_object),
214                 vm_objects_init, VM_OBJECTS_INIT);
215 }
216
217 void
218 vm_object_init2(void)
219 {
220         zinitna(obj_zone, NULL, NULL, 0, 0, ZONE_PANICFAIL, 1);
221 }
222
223 /*
224  * Allocate and return a new object of the specified type and size.
225  *
226  * No requirements.
227  */
228 vm_object_t
229 vm_object_allocate(objtype_t type, vm_pindex_t size)
230 {
231         vm_object_t result;
232
233         result = (vm_object_t) zalloc(obj_zone);
234
235         _vm_object_allocate(type, size, result);
236
237         return (result);
238 }
239
240 /*
241  * Add an additional reference to a vm_object.
242  *
243  * Object passed by caller must be stable or caller must already
244  * hold vmobj_token to avoid races.
245  */
246 void
247 vm_object_reference(vm_object_t object)
248 {
249         if (object) {
250                 lwkt_gettoken(&vmobj_token);
251                 object->ref_count++;
252                 if (object->type == OBJT_VNODE) {
253                         vref(object->handle);
254                         /* XXX what if the vnode is being destroyed? */
255                 }
256                 lwkt_reltoken(&vmobj_token);
257         }
258 }
259
260 void
261 vm_object_reference_locked(vm_object_t object)
262 {
263         if (object) {
264                 ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
265                 object->ref_count++;
266                 if (object->type == OBJT_VNODE) {
267                         vref(object->handle);
268                         /* XXX what if the vnode is being destroyed? */
269                 }
270         }
271 }
272
273 /*
274  * Dereference an object and its underlying vnode.
275  *
276  * The caller must hold vmobj_token.
277  */
278 static void
279 vm_object_vndeallocate(vm_object_t object)
280 {
281         struct vnode *vp = (struct vnode *) object->handle;
282
283         KASSERT(object->type == OBJT_VNODE,
284             ("vm_object_vndeallocate: not a vnode object"));
285         KASSERT(vp != NULL, ("vm_object_vndeallocate: missing vp"));
286         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
287 #ifdef INVARIANTS
288         if (object->ref_count == 0) {
289                 vprint("vm_object_vndeallocate", vp);
290                 panic("vm_object_vndeallocate: bad object reference count");
291         }
292 #endif
293
294         object->ref_count--;
295         if (object->ref_count == 0)
296                 vclrflags(vp, VTEXT);
297         vrele(vp);
298 }
299
300 /*
301  * Release a reference to the specified object, gained either through a
302  * vm_object_allocate or a vm_object_reference call.  When all references
303  * are gone, storage associated with this object may be relinquished.
304  */
305 void
306 vm_object_deallocate(vm_object_t object)
307 {
308         lwkt_gettoken(&vmobj_token);
309         vm_object_deallocate_locked(object);
310         lwkt_reltoken(&vmobj_token);
311 }
312
313 void
314 vm_object_deallocate_locked(vm_object_t object)
315 {
316         vm_object_t temp;
317
318         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
319
320         while (object != NULL) {
321                 if (object->type == OBJT_VNODE) {
322                         vm_object_vndeallocate(object);
323                         break;
324                 }
325
326                 if (object->ref_count == 0) {
327                         panic("vm_object_deallocate: object deallocated "
328                               "too many times: %d", object->type);
329                 }
330                 if (object->ref_count > 2) {
331                         object->ref_count--;
332                         break;
333                 }
334
335                 /*
336                  * We currently need the vm_token from this point on, and
337                  * we must recheck ref_count after acquiring it.
338                  */
339                 lwkt_gettoken(&vm_token);
340
341                 if (object->ref_count > 2) {
342                         object->ref_count--;
343                         lwkt_reltoken(&vm_token);
344                         break;
345                 }
346
347                 /*
348                  * Here on ref_count of one or two, which are special cases for
349                  * objects.
350                  */
351                 if ((object->ref_count == 2) && (object->shadow_count == 0)) {
352                         vm_object_set_flag(object, OBJ_ONEMAPPING);
353                         object->ref_count--;
354                         lwkt_reltoken(&vm_token);
355                         break;
356                 }
357                 if ((object->ref_count == 2) && (object->shadow_count == 1)) {
358                         object->ref_count--;
359                         if ((object->handle == NULL) &&
360                             (object->type == OBJT_DEFAULT ||
361                              object->type == OBJT_SWAP)) {
362                                 vm_object_t robject;
363
364                                 robject = LIST_FIRST(&object->shadow_head);
365                                 KASSERT(robject != NULL,
366                                         ("vm_object_deallocate: ref_count: "
367                                         "%d, shadow_count: %d",
368                                         object->ref_count,
369                                         object->shadow_count));
370
371                                 if ((robject->handle == NULL) &&
372                                     (robject->type == OBJT_DEFAULT ||
373                                      robject->type == OBJT_SWAP)) {
374
375                                         robject->ref_count++;
376
377                                         while (
378                                                 robject->paging_in_progress ||
379                                                 object->paging_in_progress
380                                         ) {
381                                                 vm_object_pip_sleep(robject, "objde1");
382                                                 vm_object_pip_sleep(object, "objde2");
383                                         }
384
385                                         if (robject->ref_count == 1) {
386                                                 robject->ref_count--;
387                                                 object = robject;
388                                                 goto doterm;
389                                         }
390
391                                         object = robject;
392                                         vm_object_collapse(object);
393                                         lwkt_reltoken(&vm_token);
394                                         continue;
395                                 }
396                         }
397                         lwkt_reltoken(&vm_token);
398                         break;
399                 }
400
401                 /*
402                  * Normal dereferencing path
403                  */
404                 object->ref_count--;
405                 if (object->ref_count != 0) {
406                         lwkt_reltoken(&vm_token);
407                         break;
408                 }
409
410                 /*
411                  * Termination path
412                  */
413 doterm:
414                 temp = object->backing_object;
415                 if (temp) {
416                         LIST_REMOVE(object, shadow_list);
417                         temp->shadow_count--;
418                         temp->generation++;
419                         object->backing_object = NULL;
420                 }
421                 lwkt_reltoken(&vm_token);
422
423                 /*
424                  * Don't double-terminate, we could be in a termination
425                  * recursion due to the terminate having to sync data
426                  * to disk.
427                  */
428                 if ((object->flags & OBJ_DEAD) == 0)
429                         vm_object_terminate(object);
430                 object = temp;
431         }
432 }
433
434 /*
435  * Destroy the specified object, freeing up related resources.
436  *
437  * The object must have zero references.
438  *
439  * The caller must be holding vmobj_token and properly interlock with
440  * OBJ_DEAD.
441  */
442 static int vm_object_terminate_callback(vm_page_t p, void *data);
443
444 void
445 vm_object_terminate(vm_object_t object)
446 {
447         /*
448          * Make sure no one uses us.  Once we set OBJ_DEAD we should be
449          * able to safely block.
450          */
451         KKASSERT((object->flags & OBJ_DEAD) == 0);
452         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
453         vm_object_set_flag(object, OBJ_DEAD);
454
455         /*
456          * Wait for the pageout daemon to be done with the object
457          */
458         vm_object_pip_wait(object, "objtrm");
459
460         KASSERT(!object->paging_in_progress,
461                 ("vm_object_terminate: pageout in progress"));
462
463         /*
464          * Clean and free the pages, as appropriate. All references to the
465          * object are gone, so we don't need to lock it.
466          */
467         if (object->type == OBJT_VNODE) {
468                 struct vnode *vp;
469
470                 /*
471                  * Clean pages and flush buffers.
472                  */
473                 vm_object_page_clean(object, 0, 0, OBJPC_SYNC);
474
475                 vp = (struct vnode *) object->handle;
476                 vinvalbuf(vp, V_SAVE, 0, 0);
477         }
478
479         /*
480          * Wait for any I/O to complete, after which there had better not
481          * be any references left on the object.
482          */
483         vm_object_pip_wait(object, "objtrm");
484
485         if (object->ref_count != 0) {
486                 panic("vm_object_terminate: object with references, "
487                       "ref_count=%d", object->ref_count);
488         }
489
490         /*
491          * Now free any remaining pages. For internal objects, this also
492          * removes them from paging queues. Don't free wired pages, just
493          * remove them from the object. 
494          */
495         lwkt_gettoken(&vm_token);
496         vm_page_rb_tree_RB_SCAN(&object->rb_memq, NULL,
497                                 vm_object_terminate_callback, NULL);
498         lwkt_reltoken(&vm_token);
499
500         /*
501          * Let the pager know object is dead.
502          */
503         vm_pager_deallocate(object);
504
505         /*
506          * Remove the object from the global object list.
507          *
508          * (we are holding vmobj_token)
509          */
510         TAILQ_REMOVE(&vm_object_list, object, object_list);
511         vm_object_count--;
512         vm_object_dead_wakeup(object);
513
514         if (object->ref_count != 0) {
515                 panic("vm_object_terminate2: object with references, "
516                       "ref_count=%d", object->ref_count);
517         }
518
519         /*
520          * Free the space for the object.
521          */
522         zfree(obj_zone, object);
523 }
524
525 /*
526  * The caller must hold vm_token.
527  */
528 static int
529 vm_object_terminate_callback(vm_page_t p, void *data __unused)
530 {
531         if (p->busy || (p->flags & PG_BUSY))
532                 panic("vm_object_terminate: freeing busy page %p", p);
533         if (p->wire_count == 0) {
534                 vm_page_busy(p);
535                 vm_page_free(p);
536                 mycpu->gd_cnt.v_pfree++;
537         } else {
538                 if (p->queue != PQ_NONE)
539                         kprintf("vm_object_terminate: Warning: Encountered wired page %p on queue %d\n", p, p->queue);
540                 vm_page_busy(p);
541                 vm_page_remove(p);
542                 vm_page_wakeup(p);
543         }
544         return(0);
545 }
546
547 /*
548  * The object is dead but still has an object<->pager association.  Sleep
549  * and return.  The caller typically retests the association in a loop.
550  *
551  * Must be called with the vmobj_token held.
552  */
553 void
554 vm_object_dead_sleep(vm_object_t object, const char *wmesg)
555 {
556         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
557         if (object->handle) {
558                 vm_object_set_flag(object, OBJ_DEADWNT);
559                 tsleep(object, 0, wmesg, 0);
560                 /* object may be invalid after this point */
561         }
562 }
563
564 /*
565  * Wakeup anyone waiting for the object<->pager disassociation on
566  * a dead object.
567  *
568  * Must be called with the vmobj_token held.
569  */
570 void
571 vm_object_dead_wakeup(vm_object_t object)
572 {
573         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
574         if (object->flags & OBJ_DEADWNT) {
575                 vm_object_clear_flag(object, OBJ_DEADWNT);
576                 wakeup(object);
577         }
578 }
579
580 /*
581  * Clean all dirty pages in the specified range of object.  Leaves page
582  * on whatever queue it is currently on.   If NOSYNC is set then do not
583  * write out pages with PG_NOSYNC set (originally comes from MAP_NOSYNC),
584  * leaving the object dirty.
585  *
586  * When stuffing pages asynchronously, allow clustering.  XXX we need a
587  * synchronous clustering mode implementation.
588  *
589  * Odd semantics: if start == end, we clean everything.
590  *
591  * The object must be locked? XXX
592  */
593 static int vm_object_page_clean_pass1(struct vm_page *p, void *data);
594 static int vm_object_page_clean_pass2(struct vm_page *p, void *data);
595
596 void
597 vm_object_page_clean(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
598                      int flags)
599 {
600         struct rb_vm_page_scan_info info;
601         struct vnode *vp;
602         int wholescan;
603         int pagerflags;
604         int curgeneration;
605
606         lwkt_gettoken(&vm_token);
607         if (object->type != OBJT_VNODE ||
608             (object->flags & OBJ_MIGHTBEDIRTY) == 0) {
609                 lwkt_reltoken(&vm_token);
610                 return;
611         }
612
613         pagerflags = (flags & (OBJPC_SYNC | OBJPC_INVAL)) ? 
614                         VM_PAGER_PUT_SYNC : VM_PAGER_CLUSTER_OK;
615         pagerflags |= (flags & OBJPC_INVAL) ? VM_PAGER_PUT_INVAL : 0;
616
617         vp = object->handle;
618
619         /*
620          * Interlock other major object operations.  This allows us to 
621          * temporarily clear OBJ_WRITEABLE and OBJ_MIGHTBEDIRTY.
622          */
623         crit_enter();
624         vm_object_set_flag(object, OBJ_CLEANING);
625
626         /*
627          * Handle 'entire object' case
628          */
629         info.start_pindex = start;
630         if (end == 0) {
631                 info.end_pindex = object->size - 1;
632         } else {
633                 info.end_pindex = end - 1;
634         }
635         wholescan = (start == 0 && info.end_pindex == object->size - 1);
636         info.limit = flags;
637         info.pagerflags = pagerflags;
638         info.object = object;
639
640         /*
641          * If cleaning the entire object do a pass to mark the pages read-only.
642          * If everything worked out ok, clear OBJ_WRITEABLE and
643          * OBJ_MIGHTBEDIRTY.
644          */
645         if (wholescan) {
646                 info.error = 0;
647                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
648                                         vm_object_page_clean_pass1, &info);
649                 if (info.error == 0) {
650                         vm_object_clear_flag(object,
651                                              OBJ_WRITEABLE|OBJ_MIGHTBEDIRTY);
652                         if (object->type == OBJT_VNODE &&
653                             (vp = (struct vnode *)object->handle) != NULL) {
654                                 if (vp->v_flag & VOBJDIRTY) 
655                                         vclrflags(vp, VOBJDIRTY);
656                         }
657                 }
658         }
659
660         /*
661          * Do a pass to clean all the dirty pages we find.
662          */
663         do {
664                 info.error = 0;
665                 curgeneration = object->generation;
666                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
667                                         vm_object_page_clean_pass2, &info);
668         } while (info.error || curgeneration != object->generation);
669
670         vm_object_clear_flag(object, OBJ_CLEANING);
671         crit_exit();
672         lwkt_reltoken(&vm_token);
673 }
674
675 /*
676  * The caller must hold vm_token.
677  */
678 static 
679 int
680 vm_object_page_clean_pass1(struct vm_page *p, void *data)
681 {
682         struct rb_vm_page_scan_info *info = data;
683
684         vm_page_flag_set(p, PG_CLEANCHK);
685         if ((info->limit & OBJPC_NOSYNC) && (p->flags & PG_NOSYNC))
686                 info->error = 1;
687         else
688                 vm_page_protect(p, VM_PROT_READ);       /* must not block */
689         return(0);
690 }
691
692 /*
693  * The caller must hold vm_token.
694  */
695 static 
696 int
697 vm_object_page_clean_pass2(struct vm_page *p, void *data)
698 {
699         struct rb_vm_page_scan_info *info = data;
700         int n;
701
702         /*
703          * Do not mess with pages that were inserted after we started
704          * the cleaning pass.
705          */
706         if ((p->flags & PG_CLEANCHK) == 0)
707                 return(0);
708
709         /*
710          * Before wasting time traversing the pmaps, check for trivial
711          * cases where the page cannot be dirty.
712          */
713         if (p->valid == 0 || (p->queue - p->pc) == PQ_CACHE) {
714                 KKASSERT((p->dirty & p->valid) == 0);
715                 return(0);
716         }
717
718         /*
719          * Check whether the page is dirty or not.  The page has been set
720          * to be read-only so the check will not race a user dirtying the
721          * page.
722          */
723         vm_page_test_dirty(p);
724         if ((p->dirty & p->valid) == 0) {
725                 vm_page_flag_clear(p, PG_CLEANCHK);
726                 return(0);
727         }
728
729         /*
730          * If we have been asked to skip nosync pages and this is a
731          * nosync page, skip it.  Note that the object flags were
732          * not cleared in this case (because pass1 will have returned an
733          * error), so we do not have to set them.
734          */
735         if ((info->limit & OBJPC_NOSYNC) && (p->flags & PG_NOSYNC)) {
736                 vm_page_flag_clear(p, PG_CLEANCHK);
737                 return(0);
738         }
739
740         /*
741          * Flush as many pages as we can.  PG_CLEANCHK will be cleared on
742          * the pages that get successfully flushed.  Set info->error if
743          * we raced an object modification.
744          */
745         n = vm_object_page_collect_flush(info->object, p, info->pagerflags);
746         if (n == 0)
747                 info->error = 1;
748         return(0);
749 }
750
751 /*
752  * Collect the specified page and nearby pages and flush them out.
753  * The number of pages flushed is returned.
754  *
755  * The caller must hold vm_token.
756  */
757 static int
758 vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int pagerflags)
759 {
760         int runlen;
761         int maxf;
762         int chkb;
763         int maxb;
764         int i;
765         int curgeneration;
766         vm_pindex_t pi;
767         vm_page_t maf[vm_pageout_page_count];
768         vm_page_t mab[vm_pageout_page_count];
769         vm_page_t ma[vm_pageout_page_count];
770
771         curgeneration = object->generation;
772
773         pi = p->pindex;
774         while (vm_page_sleep_busy(p, TRUE, "vpcwai")) {
775                 if (object->generation != curgeneration) {
776                         return(0);
777                 }
778         }
779         KKASSERT(p->object == object && p->pindex == pi);
780
781         maxf = 0;
782         for(i = 1; i < vm_pageout_page_count; i++) {
783                 vm_page_t tp;
784
785                 if ((tp = vm_page_lookup(object, pi + i)) != NULL) {
786                         if ((tp->flags & PG_BUSY) ||
787                                 ((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 && 
788                                  (tp->flags & PG_CLEANCHK) == 0) ||
789                                 (tp->busy != 0))
790                                 break;
791                         if((tp->queue - tp->pc) == PQ_CACHE) {
792                                 vm_page_flag_clear(tp, PG_CLEANCHK);
793                                 break;
794                         }
795                         vm_page_test_dirty(tp);
796                         if ((tp->dirty & tp->valid) == 0) {
797                                 vm_page_flag_clear(tp, PG_CLEANCHK);
798                                 break;
799                         }
800                         maf[ i - 1 ] = tp;
801                         maxf++;
802                         continue;
803                 }
804                 break;
805         }
806
807         maxb = 0;
808         chkb = vm_pageout_page_count -  maxf;
809         if (chkb) {
810                 for(i = 1; i < chkb;i++) {
811                         vm_page_t tp;
812
813                         if ((tp = vm_page_lookup(object, pi - i)) != NULL) {
814                                 if ((tp->flags & PG_BUSY) ||
815                                         ((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 && 
816                                          (tp->flags & PG_CLEANCHK) == 0) ||
817                                         (tp->busy != 0))
818                                         break;
819                                 if((tp->queue - tp->pc) == PQ_CACHE) {
820                                         vm_page_flag_clear(tp, PG_CLEANCHK);
821                                         break;
822                                 }
823                                 vm_page_test_dirty(tp);
824                                 if ((tp->dirty & tp->valid) == 0) {
825                                         vm_page_flag_clear(tp, PG_CLEANCHK);
826                                         break;
827                                 }
828                                 mab[ i - 1 ] = tp;
829                                 maxb++;
830                                 continue;
831                         }
832                         break;
833                 }
834         }
835
836         for(i = 0; i < maxb; i++) {
837                 int index = (maxb - i) - 1;
838                 ma[index] = mab[i];
839                 vm_page_flag_clear(ma[index], PG_CLEANCHK);
840         }
841         vm_page_flag_clear(p, PG_CLEANCHK);
842         ma[maxb] = p;
843         for(i = 0; i < maxf; i++) {
844                 int index = (maxb + i) + 1;
845                 ma[index] = maf[i];
846                 vm_page_flag_clear(ma[index], PG_CLEANCHK);
847         }
848         runlen = maxb + maxf + 1;
849
850         vm_pageout_flush(ma, runlen, pagerflags);
851         for (i = 0; i < runlen; i++) {
852                 if (ma[i]->valid & ma[i]->dirty) {
853                         vm_page_protect(ma[i], VM_PROT_READ);
854                         vm_page_flag_set(ma[i], PG_CLEANCHK);
855
856                         /*
857                          * maxf will end up being the actual number of pages
858                          * we wrote out contiguously, non-inclusive of the
859                          * first page.  We do not count look-behind pages.
860                          */
861                         if (i >= maxb + 1 && (maxf > i - maxb - 1))
862                                 maxf = i - maxb - 1;
863                 }
864         }
865         return(maxf + 1);
866 }
867
868 /*
869  * Same as vm_object_pmap_copy, except range checking really
870  * works, and is meant for small sections of an object.
871  *
872  * This code protects resident pages by making them read-only
873  * and is typically called on a fork or split when a page
874  * is converted to copy-on-write.  
875  *
876  * NOTE: If the page is already at VM_PROT_NONE, calling
877  * vm_page_protect will have no effect.
878  */
879 void
880 vm_object_pmap_copy_1(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
881 {
882         vm_pindex_t idx;
883         vm_page_t p;
884
885         if (object == NULL || (object->flags & OBJ_WRITEABLE) == 0)
886                 return;
887
888         /*
889          * spl protection needed to prevent races between the lookup,
890          * an interrupt unbusy/free, and our protect call.
891          */
892         crit_enter();
893         lwkt_gettoken(&vm_token);
894         for (idx = start; idx < end; idx++) {
895                 p = vm_page_lookup(object, idx);
896                 if (p == NULL)
897                         continue;
898                 vm_page_protect(p, VM_PROT_READ);
899         }
900         lwkt_reltoken(&vm_token);
901         crit_exit();
902 }
903
904 /*
905  * Removes all physical pages in the specified object range from all
906  * physical maps.
907  *
908  * The object must *not* be locked.
909  */
910
911 static int vm_object_pmap_remove_callback(vm_page_t p, void *data);
912
913 void
914 vm_object_pmap_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
915 {
916         struct rb_vm_page_scan_info info;
917
918         if (object == NULL)
919                 return;
920         info.start_pindex = start;
921         info.end_pindex = end - 1;
922
923         crit_enter();
924         lwkt_gettoken(&vm_token);
925         vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
926                                 vm_object_pmap_remove_callback, &info);
927         if (start == 0 && end == object->size)
928                 vm_object_clear_flag(object, OBJ_WRITEABLE);
929         lwkt_reltoken(&vm_token);
930         crit_exit();
931 }
932
933 /*
934  * The caller must hold vm_token.
935  */
936 static int
937 vm_object_pmap_remove_callback(vm_page_t p, void *data __unused)
938 {
939         vm_page_protect(p, VM_PROT_NONE);
940         return(0);
941 }
942
943 /*
944  * Implements the madvise function at the object/page level.
945  *
946  * MADV_WILLNEED        (any object)
947  *
948  *      Activate the specified pages if they are resident.
949  *
950  * MADV_DONTNEED        (any object)
951  *
952  *      Deactivate the specified pages if they are resident.
953  *
954  * MADV_FREE    (OBJT_DEFAULT/OBJT_SWAP objects, OBJ_ONEMAPPING only)
955  *
956  *      Deactivate and clean the specified pages if they are
957  *      resident.  This permits the process to reuse the pages
958  *      without faulting or the kernel to reclaim the pages
959  *      without I/O.
960  *
961  * No requirements.
962  */
963 void
964 vm_object_madvise(vm_object_t object, vm_pindex_t pindex, int count, int advise)
965 {
966         vm_pindex_t end, tpindex;
967         vm_object_t tobject;
968         vm_page_t m;
969
970         if (object == NULL)
971                 return;
972
973         end = pindex + count;
974
975         lwkt_gettoken(&vm_token);
976
977         /*
978          * Locate and adjust resident pages
979          */
980         for (; pindex < end; pindex += 1) {
981 relookup:
982                 tobject = object;
983                 tpindex = pindex;
984 shadowlookup:
985                 /*
986                  * MADV_FREE only operates on OBJT_DEFAULT or OBJT_SWAP pages
987                  * and those pages must be OBJ_ONEMAPPING.
988                  */
989                 if (advise == MADV_FREE) {
990                         if ((tobject->type != OBJT_DEFAULT &&
991                              tobject->type != OBJT_SWAP) ||
992                             (tobject->flags & OBJ_ONEMAPPING) == 0) {
993                                 continue;
994                         }
995                 }
996
997                 /*
998                  * spl protection is required to avoid a race between the
999                  * lookup, an interrupt unbusy/free, and our busy check.
1000                  */
1001
1002                 crit_enter();
1003                 m = vm_page_lookup(tobject, tpindex);
1004
1005                 if (m == NULL) {
1006                         /*
1007                          * There may be swap even if there is no backing page
1008                          */
1009                         if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1010                                 swap_pager_freespace(tobject, tpindex, 1);
1011
1012                         /*
1013                          * next object
1014                          */
1015                         crit_exit();
1016                         if (tobject->backing_object == NULL)
1017                                 continue;
1018                         tpindex += OFF_TO_IDX(tobject->backing_object_offset);
1019                         tobject = tobject->backing_object;
1020                         goto shadowlookup;
1021                 }
1022
1023                 /*
1024                  * If the page is busy or not in a normal active state,
1025                  * we skip it.  If the page is not managed there are no
1026                  * page queues to mess with.  Things can break if we mess
1027                  * with pages in any of the below states.
1028                  */
1029                 if (
1030                     m->hold_count ||
1031                     m->wire_count ||
1032                     (m->flags & PG_UNMANAGED) ||
1033                     m->valid != VM_PAGE_BITS_ALL
1034                 ) {
1035                         crit_exit();
1036                         continue;
1037                 }
1038
1039                 if (vm_page_sleep_busy(m, TRUE, "madvpo")) {
1040                         crit_exit();
1041                         goto relookup;
1042                 }
1043                 vm_page_busy(m);
1044                 crit_exit();
1045
1046                 /*
1047                  * Theoretically once a page is known not to be busy, an
1048                  * interrupt cannot come along and rip it out from under us.
1049                  */
1050
1051                 if (advise == MADV_WILLNEED) {
1052                         vm_page_activate(m);
1053                 } else if (advise == MADV_DONTNEED) {
1054                         vm_page_dontneed(m);
1055                 } else if (advise == MADV_FREE) {
1056                         /*
1057                          * Mark the page clean.  This will allow the page
1058                          * to be freed up by the system.  However, such pages
1059                          * are often reused quickly by malloc()/free()
1060                          * so we do not do anything that would cause
1061                          * a page fault if we can help it.
1062                          *
1063                          * Specifically, we do not try to actually free
1064                          * the page now nor do we try to put it in the
1065                          * cache (which would cause a page fault on reuse).
1066                          *
1067                          * But we do make the page is freeable as we
1068                          * can without actually taking the step of unmapping
1069                          * it.
1070                          */
1071                         pmap_clear_modify(m);
1072                         m->dirty = 0;
1073                         m->act_count = 0;
1074                         vm_page_dontneed(m);
1075                         if (tobject->type == OBJT_SWAP)
1076                                 swap_pager_freespace(tobject, tpindex, 1);
1077                 }
1078                 vm_page_wakeup(m);
1079         }       
1080         lwkt_reltoken(&vm_token);
1081 }
1082
1083 /*
1084  * Create a new object which is backed by the specified existing object
1085  * range.  The source object reference is deallocated.
1086  *
1087  * The new object and offset into that object are returned in the source
1088  * parameters.
1089  *
1090  * No other requirements.
1091  */
1092 void
1093 vm_object_shadow(vm_object_t *object, vm_ooffset_t *offset, vm_size_t length)
1094 {
1095         vm_object_t source;
1096         vm_object_t result;
1097
1098         source = *object;
1099
1100         /*
1101          * Don't create the new object if the old object isn't shared.
1102          */
1103         lwkt_gettoken(&vm_token);
1104
1105         if (source != NULL &&
1106             source->ref_count == 1 &&
1107             source->handle == NULL &&
1108             (source->type == OBJT_DEFAULT ||
1109              source->type == OBJT_SWAP)) {
1110                 lwkt_reltoken(&vm_token);
1111                 return;
1112         }
1113
1114         /*
1115          * Allocate a new object with the given length
1116          */
1117
1118         if ((result = vm_object_allocate(OBJT_DEFAULT, length)) == NULL)
1119                 panic("vm_object_shadow: no object for shadowing");
1120
1121         /*
1122          * The new object shadows the source object, adding a reference to it.
1123          * Our caller changes his reference to point to the new object,
1124          * removing a reference to the source object.  Net result: no change
1125          * of reference count.
1126          *
1127          * Try to optimize the result object's page color when shadowing
1128          * in order to maintain page coloring consistency in the combined 
1129          * shadowed object.
1130          */
1131         result->backing_object = source;
1132         if (source) {
1133                 LIST_INSERT_HEAD(&source->shadow_head, result, shadow_list);
1134                 source->shadow_count++;
1135                 source->generation++;
1136                 result->pg_color = (source->pg_color + OFF_TO_IDX(*offset)) & PQ_L2_MASK;
1137         }
1138
1139         /*
1140          * Store the offset into the source object, and fix up the offset into
1141          * the new object.
1142          */
1143         result->backing_object_offset = *offset;
1144         lwkt_reltoken(&vm_token);
1145
1146         /*
1147          * Return the new things
1148          */
1149         *offset = 0;
1150         *object = result;
1151 }
1152
1153 #define OBSC_TEST_ALL_SHADOWED  0x0001
1154 #define OBSC_COLLAPSE_NOWAIT    0x0002
1155 #define OBSC_COLLAPSE_WAIT      0x0004
1156
1157 static int vm_object_backing_scan_callback(vm_page_t p, void *data);
1158
1159 /*
1160  * The caller must hold vm_token.
1161  */
1162 static __inline int
1163 vm_object_backing_scan(vm_object_t object, int op)
1164 {
1165         struct rb_vm_page_scan_info info;
1166         vm_object_t backing_object;
1167
1168         crit_enter();
1169
1170         backing_object = object->backing_object;
1171         info.backing_offset_index = OFF_TO_IDX(object->backing_object_offset);
1172
1173         /*
1174          * Initial conditions
1175          */
1176
1177         if (op & OBSC_TEST_ALL_SHADOWED) {
1178                 /*
1179                  * We do not want to have to test for the existence of
1180                  * swap pages in the backing object.  XXX but with the
1181                  * new swapper this would be pretty easy to do.
1182                  *
1183                  * XXX what about anonymous MAP_SHARED memory that hasn't
1184                  * been ZFOD faulted yet?  If we do not test for this, the
1185                  * shadow test may succeed! XXX
1186                  */
1187                 if (backing_object->type != OBJT_DEFAULT) {
1188                         crit_exit();
1189                         return(0);
1190                 }
1191         }
1192         if (op & OBSC_COLLAPSE_WAIT) {
1193                 KKASSERT((backing_object->flags & OBJ_DEAD) == 0);
1194                 vm_object_set_flag(backing_object, OBJ_DEAD);
1195         }
1196
1197         /*
1198          * Our scan.   We have to retry if a negative error code is returned,
1199          * otherwise 0 or 1 will be returned in info.error.  0 Indicates that
1200          * the scan had to be stopped because the parent does not completely
1201          * shadow the child.
1202          */
1203         info.object = object;
1204         info.backing_object = backing_object;
1205         info.limit = op;
1206         do {
1207                 info.error = 1;
1208                 vm_page_rb_tree_RB_SCAN(&backing_object->rb_memq, NULL,
1209                                         vm_object_backing_scan_callback,
1210                                         &info);
1211         } while (info.error < 0);
1212         crit_exit();
1213         return(info.error);
1214 }
1215
1216 /*
1217  * The caller must hold vm_token.
1218  */
1219 static int
1220 vm_object_backing_scan_callback(vm_page_t p, void *data)
1221 {
1222         struct rb_vm_page_scan_info *info = data;
1223         vm_object_t backing_object;
1224         vm_object_t object;
1225         vm_pindex_t new_pindex;
1226         vm_pindex_t backing_offset_index;
1227         int op;
1228
1229         new_pindex = p->pindex - info->backing_offset_index;
1230         op = info->limit;
1231         object = info->object;
1232         backing_object = info->backing_object;
1233         backing_offset_index = info->backing_offset_index;
1234
1235         if (op & OBSC_TEST_ALL_SHADOWED) {
1236                 vm_page_t pp;
1237
1238                 /*
1239                  * Ignore pages outside the parent object's range
1240                  * and outside the parent object's mapping of the 
1241                  * backing object.
1242                  *
1243                  * note that we do not busy the backing object's
1244                  * page.
1245                  */
1246                 if (
1247                     p->pindex < backing_offset_index ||
1248                     new_pindex >= object->size
1249                 ) {
1250                         return(0);
1251                 }
1252
1253                 /*
1254                  * See if the parent has the page or if the parent's
1255                  * object pager has the page.  If the parent has the
1256                  * page but the page is not valid, the parent's
1257                  * object pager must have the page.
1258                  *
1259                  * If this fails, the parent does not completely shadow
1260                  * the object and we might as well give up now.
1261                  */
1262
1263                 pp = vm_page_lookup(object, new_pindex);
1264                 if ((pp == NULL || pp->valid == 0) &&
1265                     !vm_pager_has_page(object, new_pindex)
1266                 ) {
1267                         info->error = 0;        /* problemo */
1268                         return(-1);             /* stop the scan */
1269                 }
1270         }
1271
1272         /*
1273          * Check for busy page
1274          */
1275
1276         if (op & (OBSC_COLLAPSE_WAIT | OBSC_COLLAPSE_NOWAIT)) {
1277                 vm_page_t pp;
1278
1279                 if (op & OBSC_COLLAPSE_NOWAIT) {
1280                         if (
1281                             (p->flags & PG_BUSY) ||
1282                             !p->valid || 
1283                             p->hold_count || 
1284                             p->wire_count ||
1285                             p->busy
1286                         ) {
1287                                 return(0);
1288                         }
1289                 } else if (op & OBSC_COLLAPSE_WAIT) {
1290                         if (vm_page_sleep_busy(p, TRUE, "vmocol")) {
1291                                 /*
1292                                  * If we slept, anything could have
1293                                  * happened.   Ask that the scan be restarted.
1294                                  *
1295                                  * Since the object is marked dead, the
1296                                  * backing offset should not have changed.  
1297                                  */
1298                                 info->error = -1;
1299                                 return(-1);
1300                         }
1301                 }
1302
1303                 /* 
1304                  * Busy the page
1305                  */
1306                 vm_page_busy(p);
1307
1308                 KASSERT(
1309                     p->object == backing_object,
1310                     ("vm_object_qcollapse(): object mismatch")
1311                 );
1312
1313                 /*
1314                  * Destroy any associated swap
1315                  */
1316                 if (backing_object->type == OBJT_SWAP)
1317                         swap_pager_freespace(backing_object, p->pindex, 1);
1318
1319                 if (
1320                     p->pindex < backing_offset_index ||
1321                     new_pindex >= object->size
1322                 ) {
1323                         /*
1324                          * Page is out of the parent object's range, we 
1325                          * can simply destroy it. 
1326                          */
1327                         vm_page_protect(p, VM_PROT_NONE);
1328                         vm_page_free(p);
1329                         return(0);
1330                 }
1331
1332                 pp = vm_page_lookup(object, new_pindex);
1333                 if (pp != NULL || vm_pager_has_page(object, new_pindex)) {
1334                         /*
1335                          * page already exists in parent OR swap exists
1336                          * for this location in the parent.  Destroy 
1337                          * the original page from the backing object.
1338                          *
1339                          * Leave the parent's page alone
1340                          */
1341                         vm_page_protect(p, VM_PROT_NONE);
1342                         vm_page_free(p);
1343                         return(0);
1344                 }
1345
1346                 /*
1347                  * Page does not exist in parent, rename the
1348                  * page from the backing object to the main object. 
1349                  *
1350                  * If the page was mapped to a process, it can remain 
1351                  * mapped through the rename.
1352                  */
1353                 if ((p->queue - p->pc) == PQ_CACHE)
1354                         vm_page_deactivate(p);
1355
1356                 vm_page_rename(p, object, new_pindex);
1357                 /* page automatically made dirty by rename */
1358         }
1359         return(0);
1360 }
1361
1362 /*
1363  * This version of collapse allows the operation to occur earlier and
1364  * when paging_in_progress is true for an object...  This is not a complete
1365  * operation, but should plug 99.9% of the rest of the leaks.
1366  *
1367  * The caller must hold vm_token and vmobj_token.
1368  * (only called from vm_object_collapse)
1369  */
1370 static void
1371 vm_object_qcollapse(vm_object_t object)
1372 {
1373         vm_object_t backing_object = object->backing_object;
1374
1375         if (backing_object->ref_count != 1)
1376                 return;
1377
1378         backing_object->ref_count += 2;
1379
1380         vm_object_backing_scan(object, OBSC_COLLAPSE_NOWAIT);
1381
1382         backing_object->ref_count -= 2;
1383 }
1384
1385 /*
1386  * Collapse an object with the object backing it.  Pages in the backing
1387  * object are moved into the parent, and the backing object is deallocated.
1388  */
1389 void
1390 vm_object_collapse(vm_object_t object)
1391 {
1392         ASSERT_LWKT_TOKEN_HELD(&vm_token);
1393         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
1394
1395         while (TRUE) {
1396                 vm_object_t backing_object;
1397
1398                 /*
1399                  * Verify that the conditions are right for collapse:
1400                  *
1401                  * The object exists and the backing object exists.
1402                  */
1403                 if (object == NULL)
1404                         break;
1405
1406                 if ((backing_object = object->backing_object) == NULL)
1407                         break;
1408
1409                 /*
1410                  * we check the backing object first, because it is most likely
1411                  * not collapsable.
1412                  */
1413                 if (backing_object->handle != NULL ||
1414                     (backing_object->type != OBJT_DEFAULT &&
1415                      backing_object->type != OBJT_SWAP) ||
1416                     (backing_object->flags & OBJ_DEAD) ||
1417                     object->handle != NULL ||
1418                     (object->type != OBJT_DEFAULT &&
1419                      object->type != OBJT_SWAP) ||
1420                     (object->flags & OBJ_DEAD)) {
1421                         break;
1422                 }
1423
1424                 if (
1425                     object->paging_in_progress != 0 ||
1426                     backing_object->paging_in_progress != 0
1427                 ) {
1428                         vm_object_qcollapse(object);
1429                         break;
1430                 }
1431
1432                 /*
1433                  * We know that we can either collapse the backing object (if
1434                  * the parent is the only reference to it) or (perhaps) have
1435                  * the parent bypass the object if the parent happens to shadow
1436                  * all the resident pages in the entire backing object.
1437                  *
1438                  * This is ignoring pager-backed pages such as swap pages.
1439                  * vm_object_backing_scan fails the shadowing test in this
1440                  * case.
1441                  */
1442
1443                 if (backing_object->ref_count == 1) {
1444                         /*
1445                          * If there is exactly one reference to the backing
1446                          * object, we can collapse it into the parent.  
1447                          */
1448                         vm_object_backing_scan(object, OBSC_COLLAPSE_WAIT);
1449
1450                         /*
1451                          * Move the pager from backing_object to object.
1452                          */
1453
1454                         if (backing_object->type == OBJT_SWAP) {
1455                                 vm_object_pip_add(backing_object, 1);
1456
1457                                 /*
1458                                  * scrap the paging_offset junk and do a 
1459                                  * discrete copy.  This also removes major 
1460                                  * assumptions about how the swap-pager 
1461                                  * works from where it doesn't belong.  The
1462                                  * new swapper is able to optimize the
1463                                  * destroy-source case.
1464                                  */
1465
1466                                 vm_object_pip_add(object, 1);
1467                                 swap_pager_copy(
1468                                     backing_object,
1469                                     object,
1470                                     OFF_TO_IDX(object->backing_object_offset), TRUE);
1471                                 vm_object_pip_wakeup(object);
1472
1473                                 vm_object_pip_wakeup(backing_object);
1474                         }
1475                         /*
1476                          * Object now shadows whatever backing_object did.
1477                          * Note that the reference to 
1478                          * backing_object->backing_object moves from within 
1479                          * backing_object to within object.
1480                          */
1481
1482                         LIST_REMOVE(object, shadow_list);
1483                         object->backing_object->shadow_count--;
1484                         object->backing_object->generation++;
1485                         if (backing_object->backing_object) {
1486                                 LIST_REMOVE(backing_object, shadow_list);
1487                                 backing_object->backing_object->shadow_count--;
1488                                 backing_object->backing_object->generation++;
1489                         }
1490                         object->backing_object = backing_object->backing_object;
1491                         if (object->backing_object) {
1492                                 LIST_INSERT_HEAD(
1493                                     &object->backing_object->shadow_head,
1494                                     object, 
1495                                     shadow_list
1496                                 );
1497                                 object->backing_object->shadow_count++;
1498                                 object->backing_object->generation++;
1499                         }
1500
1501                         object->backing_object_offset +=
1502                             backing_object->backing_object_offset;
1503
1504                         /*
1505                          * Discard backing_object.
1506                          *
1507                          * Since the backing object has no pages, no pager left,
1508                          * and no object references within it, all that is
1509                          * necessary is to dispose of it.
1510                          */
1511
1512                         KASSERT(backing_object->ref_count == 1,
1513                                 ("backing_object %p was somehow "
1514                                  "re-referenced during collapse!",
1515                                  backing_object));
1516                         KASSERT(RB_EMPTY(&backing_object->rb_memq),
1517                                 ("backing_object %p somehow has left "
1518                                  "over pages during collapse!",
1519                                  backing_object));
1520
1521                         /* (we are holding vmobj_token) */
1522                         TAILQ_REMOVE(&vm_object_list, backing_object,
1523                                      object_list);
1524                         vm_object_count--;
1525
1526                         zfree(obj_zone, backing_object);
1527
1528                         object_collapses++;
1529                 } else {
1530                         vm_object_t new_backing_object;
1531
1532                         /*
1533                          * If we do not entirely shadow the backing object,
1534                          * there is nothing we can do so we give up.
1535                          */
1536
1537                         if (vm_object_backing_scan(object, OBSC_TEST_ALL_SHADOWED) == 0) {
1538                                 break;
1539                         }
1540
1541                         /*
1542                          * Make the parent shadow the next object in the
1543                          * chain.  Deallocating backing_object will not remove
1544                          * it, since its reference count is at least 2.
1545                          */
1546
1547                         LIST_REMOVE(object, shadow_list);
1548                         backing_object->shadow_count--;
1549                         backing_object->generation++;
1550
1551                         new_backing_object = backing_object->backing_object;
1552                         if ((object->backing_object = new_backing_object) != NULL) {
1553                                 vm_object_reference(new_backing_object);
1554                                 LIST_INSERT_HEAD(
1555                                     &new_backing_object->shadow_head,
1556                                     object,
1557                                     shadow_list
1558                                 );
1559                                 new_backing_object->shadow_count++;
1560                                 new_backing_object->generation++;
1561                                 object->backing_object_offset +=
1562                                         backing_object->backing_object_offset;
1563                         }
1564
1565                         /*
1566                          * Drop the reference count on backing_object. Since
1567                          * its ref_count was at least 2, it will not vanish;
1568                          * so we don't need to call vm_object_deallocate, but
1569                          * we do anyway.
1570                          */
1571                         vm_object_deallocate_locked(backing_object);
1572                         object_bypasses++;
1573                 }
1574
1575                 /*
1576                  * Try again with this object's new backing object.
1577                  */
1578         }
1579 }
1580
1581 /*
1582  * Removes all physical pages in the specified object range from the
1583  * object's list of pages.
1584  *
1585  * No requirements.
1586  */
1587 static int vm_object_page_remove_callback(vm_page_t p, void *data);
1588
1589 void
1590 vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
1591                       boolean_t clean_only)
1592 {
1593         struct rb_vm_page_scan_info info;
1594         int all;
1595
1596         /*
1597          * Degenerate cases and assertions
1598          */
1599         lwkt_gettoken(&vm_token);
1600         if (object == NULL ||
1601             (object->resident_page_count == 0 && object->swblock_count == 0)) {
1602                 lwkt_reltoken(&vm_token);
1603                 return;
1604         }
1605         KASSERT(object->type != OBJT_PHYS, 
1606                 ("attempt to remove pages from a physical object"));
1607
1608         /*
1609          * Indicate that paging is occuring on the object
1610          */
1611         crit_enter();
1612         vm_object_pip_add(object, 1);
1613
1614         /*
1615          * Figure out the actual removal range and whether we are removing
1616          * the entire contents of the object or not.  If removing the entire
1617          * contents, be sure to get all pages, even those that might be 
1618          * beyond the end of the object.
1619          */
1620         info.start_pindex = start;
1621         if (end == 0)
1622                 info.end_pindex = (vm_pindex_t)-1;
1623         else
1624                 info.end_pindex = end - 1;
1625         info.limit = clean_only;
1626         all = (start == 0 && info.end_pindex >= object->size - 1);
1627
1628         /*
1629          * Loop until we are sure we have gotten them all.
1630          */
1631         do {
1632                 info.error = 0;
1633                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
1634                                         vm_object_page_remove_callback, &info);
1635         } while (info.error);
1636
1637         /*
1638          * Remove any related swap if throwing away pages, or for
1639          * non-swap objects (the swap is a clean copy in that case).
1640          */
1641         if (object->type != OBJT_SWAP || clean_only == FALSE) {
1642                 if (all)
1643                         swap_pager_freespace_all(object);
1644                 else
1645                         swap_pager_freespace(object, info.start_pindex,
1646                              info.end_pindex - info.start_pindex + 1);
1647         }
1648
1649         /*
1650          * Cleanup
1651          */
1652         vm_object_pip_wakeup(object);
1653         crit_exit();
1654         lwkt_reltoken(&vm_token);
1655 }
1656
1657 /*
1658  * The caller must hold vm_token.
1659  */
1660 static int
1661 vm_object_page_remove_callback(vm_page_t p, void *data)
1662 {
1663         struct rb_vm_page_scan_info *info = data;
1664
1665         /*
1666          * Wired pages cannot be destroyed, but they can be invalidated
1667          * and we do so if clean_only (limit) is not set.
1668          *
1669          * WARNING!  The page may be wired due to being part of a buffer
1670          *           cache buffer, and the buffer might be marked B_CACHE.
1671          *           This is fine as part of a truncation but VFSs must be
1672          *           sure to fix the buffer up when re-extending the file.
1673          */
1674         if (p->wire_count != 0) {
1675                 vm_page_protect(p, VM_PROT_NONE);
1676                 if (info->limit == 0)
1677                         p->valid = 0;
1678                 return(0);
1679         }
1680
1681         /*
1682          * The busy flags are only cleared at
1683          * interrupt -- minimize the spl transitions
1684          */
1685
1686         if (vm_page_sleep_busy(p, TRUE, "vmopar")) {
1687                 info->error = 1;
1688                 return(0);
1689         }
1690
1691         /*
1692          * limit is our clean_only flag.  If set and the page is dirty, do
1693          * not free it.  If set and the page is being held by someone, do
1694          * not free it.
1695          */
1696         if (info->limit && p->valid) {
1697                 vm_page_test_dirty(p);
1698                 if (p->valid & p->dirty)
1699                         return(0);
1700                 if (p->hold_count)
1701                         return(0);
1702         }
1703
1704         /*
1705          * Destroy the page
1706          */
1707         vm_page_busy(p);
1708         vm_page_protect(p, VM_PROT_NONE);
1709         vm_page_free(p);
1710         return(0);
1711 }
1712
1713 /*
1714  * Coalesces two objects backing up adjoining regions of memory into a
1715  * single object.
1716  *
1717  * returns TRUE if objects were combined.
1718  *
1719  * NOTE: Only works at the moment if the second object is NULL -
1720  *       if it's not, which object do we lock first?
1721  *
1722  * Parameters:
1723  *      prev_object     First object to coalesce
1724  *      prev_offset     Offset into prev_object
1725  *      next_object     Second object into coalesce
1726  *      next_offset     Offset into next_object
1727  *
1728  *      prev_size       Size of reference to prev_object
1729  *      next_size       Size of reference to next_object
1730  *
1731  * The object must not be locked.
1732  * The caller must hold vm_token and vmobj_token.
1733  */
1734 boolean_t
1735 vm_object_coalesce(vm_object_t prev_object, vm_pindex_t prev_pindex,
1736                    vm_size_t prev_size, vm_size_t next_size)
1737 {
1738         vm_pindex_t next_pindex;
1739
1740         ASSERT_LWKT_TOKEN_HELD(&vm_token);
1741         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
1742
1743         if (prev_object == NULL) {
1744                 return (TRUE);
1745         }
1746
1747         vm_object_lock(prev_object);
1748         if (prev_object->type != OBJT_DEFAULT &&
1749             prev_object->type != OBJT_SWAP) {
1750                 vm_object_unlock(prev_object);
1751                 return (FALSE);
1752         }
1753
1754         /*
1755          * Try to collapse the object first
1756          */
1757         vm_object_collapse(prev_object);
1758
1759         /*
1760          * Can't coalesce if: . more than one reference . paged out . shadows
1761          * another object . has a copy elsewhere (any of which mean that the
1762          * pages not mapped to prev_entry may be in use anyway)
1763          */
1764
1765         if (prev_object->backing_object != NULL) {
1766                 vm_object_unlock(prev_object);
1767                 return (FALSE);
1768         }
1769
1770         prev_size >>= PAGE_SHIFT;
1771         next_size >>= PAGE_SHIFT;
1772         next_pindex = prev_pindex + prev_size;
1773
1774         if ((prev_object->ref_count > 1) &&
1775             (prev_object->size != next_pindex)) {
1776                 vm_object_unlock(prev_object);
1777                 return (FALSE);
1778         }
1779
1780         /*
1781          * Remove any pages that may still be in the object from a previous
1782          * deallocation.
1783          */
1784         if (next_pindex < prev_object->size) {
1785                 vm_object_page_remove(prev_object,
1786                                       next_pindex,
1787                                       next_pindex + next_size, FALSE);
1788                 if (prev_object->type == OBJT_SWAP)
1789                         swap_pager_freespace(prev_object,
1790                                              next_pindex, next_size);
1791         }
1792
1793         /*
1794          * Extend the object if necessary.
1795          */
1796         if (next_pindex + next_size > prev_object->size)
1797                 prev_object->size = next_pindex + next_size;
1798
1799         vm_object_unlock(prev_object);
1800         return (TRUE);
1801 }
1802
1803 /*
1804  * Make the object writable and flag is being possibly dirty.
1805  *
1806  * No requirements.
1807  */
1808 void
1809 vm_object_set_writeable_dirty(vm_object_t object)
1810 {
1811         struct vnode *vp;
1812
1813         lwkt_gettoken(&vm_token);
1814         vm_object_set_flag(object, OBJ_WRITEABLE|OBJ_MIGHTBEDIRTY);
1815         if (object->type == OBJT_VNODE &&
1816             (vp = (struct vnode *)object->handle) != NULL) {
1817                 if ((vp->v_flag & VOBJDIRTY) == 0) {
1818                         vsetflags(vp, VOBJDIRTY);
1819                 }
1820         }
1821         lwkt_reltoken(&vm_token);
1822 }
1823
1824 void
1825 vm_object_lock(vm_object_t object)
1826 {
1827         lwkt_gettoken(&object->tok);
1828 }
1829
1830 void
1831 vm_object_unlock(vm_object_t object)
1832 {
1833         lwkt_reltoken(&object->tok);
1834 }
1835
1836 #include "opt_ddb.h"
1837 #ifdef DDB
1838 #include <sys/kernel.h>
1839
1840 #include <sys/cons.h>
1841
1842 #include <ddb/ddb.h>
1843
1844 static int      _vm_object_in_map (vm_map_t map, vm_object_t object,
1845                                        vm_map_entry_t entry);
1846 static int      vm_object_in_map (vm_object_t object);
1847
1848 /*
1849  * The caller must hold vm_token.
1850  */
1851 static int
1852 _vm_object_in_map(vm_map_t map, vm_object_t object, vm_map_entry_t entry)
1853 {
1854         vm_map_t tmpm;
1855         vm_map_entry_t tmpe;
1856         vm_object_t obj;
1857         int entcount;
1858
1859         if (map == 0)
1860                 return 0;
1861         if (entry == 0) {
1862                 tmpe = map->header.next;
1863                 entcount = map->nentries;
1864                 while (entcount-- && (tmpe != &map->header)) {
1865                         if( _vm_object_in_map(map, object, tmpe)) {
1866                                 return 1;
1867                         }
1868                         tmpe = tmpe->next;
1869                 }
1870                 return (0);
1871         }
1872         switch(entry->maptype) {
1873         case VM_MAPTYPE_SUBMAP:
1874                 tmpm = entry->object.sub_map;
1875                 tmpe = tmpm->header.next;
1876                 entcount = tmpm->nentries;
1877                 while (entcount-- && tmpe != &tmpm->header) {
1878                         if( _vm_object_in_map(tmpm, object, tmpe)) {
1879                                 return 1;
1880                         }
1881                         tmpe = tmpe->next;
1882                 }
1883                 break;
1884         case VM_MAPTYPE_NORMAL:
1885         case VM_MAPTYPE_VPAGETABLE:
1886                 obj = entry->object.vm_object;
1887                 while (obj) {
1888                         if (obj == object)
1889                                 return 1;
1890                         obj = obj->backing_object;
1891                 }
1892                 break;
1893         default:
1894                 break;
1895         }
1896         return 0;
1897 }
1898
1899 static int vm_object_in_map_callback(struct proc *p, void *data);
1900
1901 struct vm_object_in_map_info {
1902         vm_object_t object;
1903         int rv;
1904 };
1905
1906 /*
1907  * Debugging only
1908  */
1909 static int
1910 vm_object_in_map(vm_object_t object)
1911 {
1912         struct vm_object_in_map_info info;
1913
1914         info.rv = 0;
1915         info.object = object;
1916
1917         allproc_scan(vm_object_in_map_callback, &info);
1918         if (info.rv)
1919                 return 1;
1920         if( _vm_object_in_map(&kernel_map, object, 0))
1921                 return 1;
1922         if( _vm_object_in_map(&pager_map, object, 0))
1923                 return 1;
1924         if( _vm_object_in_map(&buffer_map, object, 0))
1925                 return 1;
1926         return 0;
1927 }
1928
1929 /*
1930  * Debugging only
1931  */
1932 static int
1933 vm_object_in_map_callback(struct proc *p, void *data)
1934 {
1935         struct vm_object_in_map_info *info = data;
1936
1937         if (p->p_vmspace) {
1938                 if (_vm_object_in_map(&p->p_vmspace->vm_map, info->object, 0)) {
1939                         info->rv = 1;
1940                         return -1;
1941                 }
1942         }
1943         return (0);
1944 }
1945
1946 DB_SHOW_COMMAND(vmochk, vm_object_check)
1947 {
1948         vm_object_t object;
1949
1950         /*
1951          * make sure that internal objs are in a map somewhere
1952          * and none have zero ref counts.
1953          */
1954         for (object = TAILQ_FIRST(&vm_object_list);
1955                         object != NULL;
1956                         object = TAILQ_NEXT(object, object_list)) {
1957                 if (object->type == OBJT_MARKER)
1958                         continue;
1959                 if (object->handle == NULL &&
1960                     (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
1961                         if (object->ref_count == 0) {
1962                                 db_printf("vmochk: internal obj has zero ref count: %ld\n",
1963                                         (long)object->size);
1964                         }
1965                         if (!vm_object_in_map(object)) {
1966                                 db_printf(
1967                         "vmochk: internal obj is not in a map: "
1968                         "ref: %d, size: %lu: 0x%lx, backing_object: %p\n",
1969                                     object->ref_count, (u_long)object->size, 
1970                                     (u_long)object->size,
1971                                     (void *)object->backing_object);
1972                         }
1973                 }
1974         }
1975 }
1976
1977 /*
1978  * Debugging only
1979  */
1980 DB_SHOW_COMMAND(object, vm_object_print_static)
1981 {
1982         /* XXX convert args. */
1983         vm_object_t object = (vm_object_t)addr;
1984         boolean_t full = have_addr;
1985
1986         vm_page_t p;
1987
1988         /* XXX count is an (unused) arg.  Avoid shadowing it. */
1989 #define count   was_count
1990
1991         int count;
1992
1993         if (object == NULL)
1994                 return;
1995
1996         db_iprintf(
1997             "Object %p: type=%d, size=0x%lx, res=%d, ref=%d, flags=0x%x\n",
1998             object, (int)object->type, (u_long)object->size,
1999             object->resident_page_count, object->ref_count, object->flags);
2000         /*
2001          * XXX no %qd in kernel.  Truncate object->backing_object_offset.
2002          */
2003         db_iprintf(" sref=%d, backing_object(%d)=(%p)+0x%lx\n",
2004             object->shadow_count, 
2005             object->backing_object ? object->backing_object->ref_count : 0,
2006             object->backing_object, (long)object->backing_object_offset);
2007
2008         if (!full)
2009                 return;
2010
2011         db_indent += 2;
2012         count = 0;
2013         RB_FOREACH(p, vm_page_rb_tree, &object->rb_memq) {
2014                 if (count == 0)
2015                         db_iprintf("memory:=");
2016                 else if (count == 6) {
2017                         db_printf("\n");
2018                         db_iprintf(" ...");
2019                         count = 0;
2020                 } else
2021                         db_printf(",");
2022                 count++;
2023
2024                 db_printf("(off=0x%lx,page=0x%lx)",
2025                     (u_long) p->pindex, (u_long) VM_PAGE_TO_PHYS(p));
2026         }
2027         if (count != 0)
2028                 db_printf("\n");
2029         db_indent -= 2;
2030 }
2031
2032 /* XXX. */
2033 #undef count
2034
2035 /*
2036  * XXX need this non-static entry for calling from vm_map_print.
2037  *
2038  * Debugging only
2039  */
2040 void
2041 vm_object_print(/* db_expr_t */ long addr,
2042                 boolean_t have_addr,
2043                 /* db_expr_t */ long count,
2044                 char *modif)
2045 {
2046         vm_object_print_static(addr, have_addr, count, modif);
2047 }
2048
2049 /*
2050  * Debugging only
2051  */
2052 DB_SHOW_COMMAND(vmopag, vm_object_print_pages)
2053 {
2054         vm_object_t object;
2055         int nl = 0;
2056         int c;
2057         for (object = TAILQ_FIRST(&vm_object_list);
2058                         object != NULL;
2059                         object = TAILQ_NEXT(object, object_list)) {
2060                 vm_pindex_t idx, fidx;
2061                 vm_pindex_t osize;
2062                 vm_paddr_t pa = -1, padiff;
2063                 int rcount;
2064                 vm_page_t m;
2065
2066                 if (object->type == OBJT_MARKER)
2067                         continue;
2068                 db_printf("new object: %p\n", (void *)object);
2069                 if ( nl > 18) {
2070                         c = cngetc();
2071                         if (c != ' ')
2072                                 return;
2073                         nl = 0;
2074                 }
2075                 nl++;
2076                 rcount = 0;
2077                 fidx = 0;
2078                 osize = object->size;
2079                 if (osize > 128)
2080                         osize = 128;
2081                 for (idx = 0; idx < osize; idx++) {
2082                         m = vm_page_lookup(object, idx);
2083                         if (m == NULL) {
2084                                 if (rcount) {
2085                                         db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2086                                                 (long)fidx, rcount, (long)pa);
2087                                         if ( nl > 18) {
2088                                                 c = cngetc();
2089                                                 if (c != ' ')
2090                                                         return;
2091                                                 nl = 0;
2092                                         }
2093                                         nl++;
2094                                         rcount = 0;
2095                                 }
2096                                 continue;
2097                         }
2098
2099                                 
2100                         if (rcount &&
2101                                 (VM_PAGE_TO_PHYS(m) == pa + rcount * PAGE_SIZE)) {
2102                                 ++rcount;
2103                                 continue;
2104                         }
2105                         if (rcount) {
2106                                 padiff = pa + rcount * PAGE_SIZE - VM_PAGE_TO_PHYS(m);
2107                                 padiff >>= PAGE_SHIFT;
2108                                 padiff &= PQ_L2_MASK;
2109                                 if (padiff == 0) {
2110                                         pa = VM_PAGE_TO_PHYS(m) - rcount * PAGE_SIZE;
2111                                         ++rcount;
2112                                         continue;
2113                                 }
2114                                 db_printf(" index(%ld)run(%d)pa(0x%lx)",
2115                                         (long)fidx, rcount, (long)pa);
2116                                 db_printf("pd(%ld)\n", (long)padiff);
2117                                 if ( nl > 18) {
2118                                         c = cngetc();
2119                                         if (c != ' ')
2120                                                 return;
2121                                         nl = 0;
2122                                 }
2123                                 nl++;
2124                         }
2125                         fidx = idx;
2126                         pa = VM_PAGE_TO_PHYS(m);
2127                         rcount = 1;
2128                 }
2129                 if (rcount) {
2130                         db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2131                                 (long)fidx, rcount, (long)pa);
2132                         if ( nl > 18) {
2133                                 c = cngetc();
2134                                 if (c != ' ')
2135                                         return;
2136                                 nl = 0;
2137                         }
2138                         nl++;
2139                 }
2140         }
2141 }
2142 #endif /* DDB */