ee49c2dcdda1d9494e26910466f09eca12a82e32
[dragonfly.git] / sys / vm / vm_object.c
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1991, 1993
5  *      The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * The Mach Operating System project at Carnegie-Mellon University.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *      This product includes software developed by the University of
21  *      California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *      from: @(#)vm_object.c   8.5 (Berkeley) 3/22/94
39  *
40  *
41  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
42  * All rights reserved.
43  *
44  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
45  *
46  * Permission to use, copy, modify and distribute this software and
47  * its documentation is hereby granted, provided that both the copyright
48  * notice and this permission notice appear in all copies of the
49  * software, derivative works or modified versions, and any portions
50  * thereof, and that both notices appear in supporting documentation.
51  *
52  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
53  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
54  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
55  *
56  * Carnegie Mellon requests users of this software to return to
57  *
58  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
59  *  School of Computer Science
60  *  Carnegie Mellon University
61  *  Pittsburgh PA 15213-3890
62  *
63  * any improvements or extensions that they make and grant Carnegie the
64  * rights to redistribute these changes.
65  *
66  * $FreeBSD: src/sys/vm/vm_object.c,v 1.171.2.8 2003/05/26 19:17:56 alc Exp $
67  */
68
69 /*
70  *      Virtual memory object module.
71  */
72
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/proc.h>           /* for curproc, pageproc */
76 #include <sys/thread.h>
77 #include <sys/vnode.h>
78 #include <sys/vmmeter.h>
79 #include <sys/mman.h>
80 #include <sys/mount.h>
81 #include <sys/kernel.h>
82 #include <sys/sysctl.h>
83 #include <sys/refcount.h>
84
85 #include <vm/vm.h>
86 #include <vm/vm_param.h>
87 #include <vm/pmap.h>
88 #include <vm/vm_map.h>
89 #include <vm/vm_object.h>
90 #include <vm/vm_page.h>
91 #include <vm/vm_pageout.h>
92 #include <vm/vm_pager.h>
93 #include <vm/swap_pager.h>
94 #include <vm/vm_kern.h>
95 #include <vm/vm_extern.h>
96 #include <vm/vm_zone.h>
97
98 #define EASY_SCAN_FACTOR        8
99
100 static void     vm_object_qcollapse(vm_object_t object);
101 static int      vm_object_page_collect_flush(vm_object_t object, vm_page_t p,
102                                              int pagerflags);
103 static void     vm_object_lock_init(vm_object_t);
104 static void     vm_object_hold_wait(vm_object_t);
105
106
107 /*
108  *      Virtual memory objects maintain the actual data
109  *      associated with allocated virtual memory.  A given
110  *      page of memory exists within exactly one object.
111  *
112  *      An object is only deallocated when all "references"
113  *      are given up.  Only one "reference" to a given
114  *      region of an object should be writeable.
115  *
116  *      Associated with each object is a list of all resident
117  *      memory pages belonging to that object; this list is
118  *      maintained by the "vm_page" module, and locked by the object's
119  *      lock.
120  *
121  *      Each object also records a "pager" routine which is
122  *      used to retrieve (and store) pages to the proper backing
123  *      storage.  In addition, objects may be backed by other
124  *      objects from which they were virtual-copied.
125  *
126  *      The only items within the object structure which are
127  *      modified after time of creation are:
128  *              reference count         locked by object's lock
129  *              pager routine           locked by object's lock
130  *
131  */
132
133 struct object_q vm_object_list;         /* locked by vmobj_token */
134 struct vm_object kernel_object;
135
136 static long vm_object_count;            /* locked by vmobj_token */
137 extern int vm_pageout_page_count;
138
139 static long object_collapses;
140 static long object_bypasses;
141 static int next_index;
142 static vm_zone_t obj_zone;
143 static struct vm_zone obj_zone_store;
144 #define VM_OBJECTS_INIT 256
145 static struct vm_object vm_objects_init[VM_OBJECTS_INIT];
146
147 /*
148  * Misc low level routines
149  */
150 static void
151 vm_object_lock_init(vm_object_t obj)
152 {
153 #if defined(DEBUG_LOCKS)
154         int i;
155
156         obj->debug_hold_bitmap = 0;
157         obj->debug_hold_ovfl = 0;
158         for (i = 0; i < VMOBJ_DEBUG_ARRAY_SIZE; i++) {
159                 obj->debug_hold_thrs[i] = NULL;
160                 obj->debug_hold_file[i] = NULL;
161                 obj->debug_hold_line[i] = 0;
162         }
163 #endif
164 }
165
166 void
167 vm_object_lock_swap(void)
168 {
169         lwkt_token_swap();
170 }
171
172 void
173 vm_object_lock(vm_object_t obj)
174 {
175         lwkt_getpooltoken(obj);
176 }
177
178 void
179 vm_object_unlock(vm_object_t obj)
180 {
181         lwkt_relpooltoken(obj);
182 }
183
184 static __inline void
185 vm_object_assert_held(vm_object_t obj)
186 {
187         ASSERT_LWKT_TOKEN_HELD(lwkt_token_pool_lookup(obj));
188 }
189
190 void
191 #ifndef DEBUG_LOCKS
192 vm_object_hold(vm_object_t obj)
193 #else
194 debugvm_object_hold(vm_object_t obj, char *file, int line)
195 #endif
196 {
197         if (obj == NULL)
198                 return;
199
200         /*
201          * Object must be held (object allocation is stable due to callers
202          * context, typically already holding the token on a parent object)
203          * prior to potentially blocking on the lock, otherwise the object
204          * can get ripped away from us.
205          */
206         refcount_acquire(&obj->hold_count);
207         vm_object_lock(obj);
208
209 #if defined(DEBUG_LOCKS)
210         int i;
211
212         i = ffs(~obj->debug_hold_bitmap) - 1;
213         if (i == -1) {
214                 kprintf("vm_object hold count > VMOBJ_DEBUG_ARRAY_SIZE");
215                 obj->debug_hold_ovfl = 1;
216         }
217
218         obj->debug_hold_bitmap |= (1 << i);
219         obj->debug_hold_thrs[i] = curthread;
220         obj->debug_hold_file[i] = file;
221         obj->debug_hold_line[i] = line;
222 #endif
223 }
224
225 void
226 vm_object_drop(vm_object_t obj)
227 {
228         if (obj == NULL)
229                 return;
230
231 #if defined(DEBUG_LOCKS)
232         int found = 0;
233         int i;
234
235         for (i = 0; i < VMOBJ_DEBUG_ARRAY_SIZE; i++) {
236                 if ((obj->debug_hold_bitmap & (1 << i)) &&
237                     (obj->debug_hold_thrs[i] == curthread)) {
238                         obj->debug_hold_bitmap &= ~(1 << i);
239                         obj->debug_hold_thrs[i] = NULL;
240                         obj->debug_hold_file[i] = NULL;
241                         obj->debug_hold_line[i] = 0;
242                         found = 1;
243                         break;
244                 }
245         }
246
247         if (found == 0 && obj->debug_hold_ovfl == 0)
248                 panic("vm_object: attempt to drop hold on non-self-held obj");
249 #endif
250
251         /*
252          * The lock is a pool token, keep holding it across potential
253          * wakeups to interlock the tsleep/wakeup.
254          */
255         if (refcount_release(&obj->hold_count))
256                 wakeup(obj);
257         vm_object_unlock(obj);
258 }
259
260 /*
261  * This can only be called while the caller holds the object
262  * with the OBJ_DEAD interlock.  Since there are no refs this
263  * is the only thing preventing an object destruction race.
264  */
265 static void
266 vm_object_hold_wait(vm_object_t obj)
267 {
268         vm_object_lock(obj);
269
270 #if defined(DEBUG_LOCKS)
271         int i;
272
273         for (i = 0; i < VMOBJ_DEBUG_ARRAY_SIZE; i++) {
274                 if ((obj->debug_hold_bitmap & (1 << i)) &&
275                     (obj->debug_hold_thrs[i] == curthread))  {
276                         kprintf("vm_object %p: self-hold in at %s:%d\n", obj,
277                                 obj->debug_hold_file[i], obj->debug_hold_line[i]);
278                         panic("vm_object: self-hold in terminate or collapse");
279                 }
280         }
281 #endif
282
283         while (obj->hold_count)
284                 tsleep(obj, 0, "vmobjhld", 0);
285
286         vm_object_unlock(obj);
287 }
288
289
290 /*
291  * Initialize a freshly allocated object
292  *
293  * Used only by vm_object_allocate() and zinitna().
294  *
295  * No requirements.
296  */
297 void
298 _vm_object_allocate(objtype_t type, vm_pindex_t size, vm_object_t object)
299 {
300         int incr;
301
302         RB_INIT(&object->rb_memq);
303         LIST_INIT(&object->shadow_head);
304
305         object->type = type;
306         object->size = size;
307         object->ref_count = 1;
308         object->hold_count = 0;
309         object->flags = 0;
310         if ((object->type == OBJT_DEFAULT) || (object->type == OBJT_SWAP))
311                 vm_object_set_flag(object, OBJ_ONEMAPPING);
312         object->paging_in_progress = 0;
313         object->resident_page_count = 0;
314         object->agg_pv_list_count = 0;
315         object->shadow_count = 0;
316         object->pg_color = next_index;
317         if ( size > (PQ_L2_SIZE / 3 + PQ_PRIME1))
318                 incr = PQ_L2_SIZE / 3 + PQ_PRIME1;
319         else
320                 incr = size;
321         next_index = (next_index + incr) & PQ_L2_MASK;
322         object->handle = NULL;
323         object->backing_object = NULL;
324         object->backing_object_offset = (vm_ooffset_t) 0;
325
326         object->generation++;
327         object->swblock_count = 0;
328         RB_INIT(&object->swblock_root);
329         vm_object_lock_init(object);
330
331         lwkt_gettoken(&vmobj_token);
332         TAILQ_INSERT_TAIL(&vm_object_list, object, object_list);
333         vm_object_count++;
334         lwkt_reltoken(&vmobj_token);
335 }
336
337 /*
338  * Initialize the VM objects module.
339  *
340  * Called from the low level boot code only.
341  */
342 void
343 vm_object_init(void)
344 {
345         TAILQ_INIT(&vm_object_list);
346         
347         _vm_object_allocate(OBJT_DEFAULT, OFF_TO_IDX(KvaEnd),
348                             &kernel_object);
349
350         obj_zone = &obj_zone_store;
351         zbootinit(obj_zone, "VM OBJECT", sizeof (struct vm_object),
352                 vm_objects_init, VM_OBJECTS_INIT);
353 }
354
355 void
356 vm_object_init2(void)
357 {
358         zinitna(obj_zone, NULL, NULL, 0, 0, ZONE_PANICFAIL, 1);
359 }
360
361 /*
362  * Allocate and return a new object of the specified type and size.
363  *
364  * No requirements.
365  */
366 vm_object_t
367 vm_object_allocate(objtype_t type, vm_pindex_t size)
368 {
369         vm_object_t result;
370
371         result = (vm_object_t) zalloc(obj_zone);
372
373         _vm_object_allocate(type, size, result);
374
375         return (result);
376 }
377
378 /*
379  * Add an additional reference to a vm_object.
380  *
381  * Object passed by caller must be stable or caller must already
382  * hold vmobj_token to avoid races.
383  */
384 void
385 vm_object_reference(vm_object_t object)
386 {
387         lwkt_gettoken(&vmobj_token);
388         vm_object_hold(object);
389         vm_object_reference_locked(object);
390         vm_object_drop(object);
391         lwkt_reltoken(&vmobj_token);
392 }
393
394 void
395 vm_object_reference_locked(vm_object_t object)
396 {
397         if (object) {
398                 ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
399                 /*NOTYET*/
400                 /*ASSERT_LWKT_TOKEN_HELD(vm_object_token(object));*/
401                 object->ref_count++;
402                 if (object->type == OBJT_VNODE) {
403                         vref(object->handle);
404                         /* XXX what if the vnode is being destroyed? */
405                 }
406         }
407 }
408
409 /*
410  * Dereference an object and its underlying vnode.
411  *
412  * The caller must hold vmobj_token.
413  * The object must be locked but not held.  This function will eat the lock.
414  */
415 static void
416 vm_object_vndeallocate(vm_object_t object)
417 {
418         struct vnode *vp = (struct vnode *) object->handle;
419
420         KASSERT(object->type == OBJT_VNODE,
421             ("vm_object_vndeallocate: not a vnode object"));
422         KASSERT(vp != NULL, ("vm_object_vndeallocate: missing vp"));
423         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
424 #ifdef INVARIANTS
425         if (object->ref_count == 0) {
426                 vprint("vm_object_vndeallocate", vp);
427                 panic("vm_object_vndeallocate: bad object reference count");
428         }
429 #endif
430
431         object->ref_count--;
432         if (object->ref_count == 0)
433                 vclrflags(vp, VTEXT);
434         vm_object_unlock(object);
435         vrele(vp);
436 }
437
438 /*
439  * Release a reference to the specified object, gained either through a
440  * vm_object_allocate or a vm_object_reference call.  When all references
441  * are gone, storage associated with this object may be relinquished.
442  *
443  * The caller does not have to hold the object locked but must have control
444  * over the reference in question in order to guarantee that the object
445  * does not get ripped out from under us.
446  */
447 void
448 vm_object_deallocate(vm_object_t object)
449 {
450         lwkt_gettoken(&vmobj_token);
451         vm_object_deallocate_locked(object);
452         lwkt_reltoken(&vmobj_token);
453 }
454
455 void
456 vm_object_deallocate_locked(vm_object_t object)
457 {
458         vm_object_t temp;
459
460         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
461
462         if (object)
463                 vm_object_lock(object);
464
465         while (object != NULL) {
466                 if (object->type == OBJT_VNODE) {
467                         vm_object_vndeallocate(object);
468                         /* vndeallocate ate the lock */
469                         break;
470                 }
471
472                 if (object->ref_count == 0) {
473                         panic("vm_object_deallocate: object deallocated "
474                               "too many times: %d", object->type);
475                 }
476                 if (object->ref_count > 2) {
477                         object->ref_count--;
478                         vm_object_unlock(object);
479                         break;
480                 }
481
482                 /*
483                  * We currently need the vm_token from this point on, and
484                  * we must recheck ref_count after acquiring it.
485                  */
486                 lwkt_gettoken(&vm_token);
487
488                 if (object->ref_count > 2) {
489                         object->ref_count--;
490                         lwkt_reltoken(&vm_token);
491                         vm_object_unlock(object);
492                         break;
493                 }
494
495                 /*
496                  * Here on ref_count of one or two, which are special cases for
497                  * objects.
498                  *
499                  * Nominal ref_count > 1 case if the second ref is not from
500                  * a shadow.
501                  */
502                 if (object->ref_count == 2 && object->shadow_count == 0) {
503                         vm_object_set_flag(object, OBJ_ONEMAPPING);
504                         object->ref_count--;
505                         lwkt_reltoken(&vm_token);
506                         vm_object_unlock(object);
507                         break;
508                 }
509
510                 /*
511                  * If the second ref is from a shadow we chain along it
512                  * if object's handle is exhausted.
513                  *
514                  * We have to decrement object->ref_count before potentially
515                  * collapsing the first shadow object or the collapse code
516                  * will not be able to handle the degenerate case.
517                  */
518                 if (object->ref_count == 2 && object->shadow_count == 1) {
519                         object->ref_count--;
520                         if (object->handle == NULL &&
521                             (object->type == OBJT_DEFAULT ||
522                              object->type == OBJT_SWAP)) {
523                                 temp = LIST_FIRST(&object->shadow_head);
524                                 KASSERT(temp != NULL,
525                                         ("vm_object_deallocate: ref_count: "
526                                         "%d, shadow_count: %d",
527                                         object->ref_count,
528                                         object->shadow_count));
529                                 lwkt_reltoken(&vm_token);
530                                 vm_object_lock(temp);
531
532                                 if ((temp->handle == NULL) &&
533                                     (temp->type == OBJT_DEFAULT ||
534                                      temp->type == OBJT_SWAP)) {
535                                         /*
536                                          * Special case, must handle ref_count
537                                          * manually to avoid recursion.
538                                          */
539                                         temp->ref_count++;
540                                         vm_object_lock_swap();
541
542                                         while (
543                                                 temp->paging_in_progress ||
544                                                 object->paging_in_progress
545                                         ) {
546                                                 vm_object_pip_wait(temp,
547                                                                    "objde1");
548                                                 vm_object_pip_wait(object,
549                                                                    "objde2");
550                                         }
551
552                                         if (temp->ref_count == 1) {
553                                                 temp->ref_count--;
554                                                 vm_object_unlock(object);
555                                                 object = temp;
556                                                 goto doterm;
557                                         }
558
559                                         lwkt_gettoken(&vm_token);
560                                         vm_object_collapse(temp);
561                                         lwkt_reltoken(&vm_token);
562                                         vm_object_unlock(object);
563                                         object = temp;
564                                         continue;
565                                 }
566                                 vm_object_unlock(temp);
567                         } else {
568                                 lwkt_reltoken(&vm_token);
569                         }
570                         vm_object_unlock(object);
571                         break;
572                 }
573
574                 /*
575                  * Normal dereferencing path
576                  */
577                 object->ref_count--;
578                 if (object->ref_count != 0) {
579                         lwkt_reltoken(&vm_token);
580                         vm_object_unlock(object);
581                         break;
582                 }
583
584                 /*
585                  * Termination path
586                  *
587                  * We may have to loop to resolve races if we block getting
588                  * temp's lock.  If temp is non NULL we have to swap the
589                  * lock order so the original object lock as at the top
590                  * of the lock heap.
591                  */
592                 lwkt_reltoken(&vm_token);
593 doterm:
594                 while ((temp = object->backing_object) != NULL) {
595                         vm_object_lock(temp);
596                         if (temp == object->backing_object)
597                                 break;
598                         vm_object_unlock(temp);
599                 }
600                 if (temp) {
601                         LIST_REMOVE(object, shadow_list);
602                         temp->shadow_count--;
603                         temp->generation++;
604                         object->backing_object = NULL;
605                         vm_object_lock_swap();
606                 }
607
608                 /*
609                  * Don't double-terminate, we could be in a termination
610                  * recursion due to the terminate having to sync data
611                  * to disk.
612                  */
613                 if ((object->flags & OBJ_DEAD) == 0) {
614                         vm_object_terminate(object);
615                         /* termination ate the object lock */
616                 } else {
617                         vm_object_unlock(object);
618                 }
619                 object = temp;
620         }
621 }
622
623 /*
624  * Destroy the specified object, freeing up related resources.
625  *
626  * The object must have zero references.
627  *
628  * The caller must be holding vmobj_token and properly interlock with
629  * OBJ_DEAD (at the moment).
630  *
631  * The caller must have locked the object only, and not be holding it.
632  * This function will eat the caller's lock on the object.
633  */
634 static int vm_object_terminate_callback(vm_page_t p, void *data);
635
636 void
637 vm_object_terminate(vm_object_t object)
638 {
639         /*
640          * Make sure no one uses us.  Once we set OBJ_DEAD we should be
641          * able to safely block.
642          */
643         KKASSERT((object->flags & OBJ_DEAD) == 0);
644         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
645         vm_object_set_flag(object, OBJ_DEAD);
646
647         /*
648          * Wait for the pageout daemon to be done with the object
649          */
650         vm_object_pip_wait(object, "objtrm1");
651
652         KASSERT(!object->paging_in_progress,
653                 ("vm_object_terminate: pageout in progress"));
654
655         /*
656          * Clean and free the pages, as appropriate. All references to the
657          * object are gone, so we don't need to lock it.
658          */
659         if (object->type == OBJT_VNODE) {
660                 struct vnode *vp;
661
662                 /*
663                  * Clean pages and flush buffers.
664                  */
665                 vm_object_page_clean(object, 0, 0, OBJPC_SYNC);
666
667                 vp = (struct vnode *) object->handle;
668                 vinvalbuf(vp, V_SAVE, 0, 0);
669         }
670
671         /*
672          * Wait for any I/O to complete, after which there had better not
673          * be any references left on the object.
674          */
675         vm_object_pip_wait(object, "objtrm2");
676
677         if (object->ref_count != 0) {
678                 panic("vm_object_terminate: object with references, "
679                       "ref_count=%d", object->ref_count);
680         }
681
682         /*
683          * Now free any remaining pages. For internal objects, this also
684          * removes them from paging queues. Don't free wired pages, just
685          * remove them from the object. 
686          */
687         lwkt_gettoken(&vm_token);
688         vm_page_rb_tree_RB_SCAN(&object->rb_memq, NULL,
689                                 vm_object_terminate_callback, NULL);
690         lwkt_reltoken(&vm_token);
691
692         /*
693          * Let the pager know object is dead.
694          */
695         vm_pager_deallocate(object);
696
697         /*
698          * Wait for the object hold count to hit zero, clean out pages as
699          * we go.
700          */
701         lwkt_gettoken(&vm_token);
702         for (;;) {
703                 vm_object_hold_wait(object);
704                 if (RB_ROOT(&object->rb_memq) == NULL)
705                         break;
706                 kprintf("vm_object_terminate: Warning, object %p "
707                         "still has %d pages\n",
708                         object, object->resident_page_count);
709                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, NULL,
710                                         vm_object_terminate_callback, NULL);
711         }
712         lwkt_reltoken(&vm_token);
713
714         /*
715          * There had better not be any pages left
716          */
717         KKASSERT(object->resident_page_count == 0);
718
719         /*
720          * Remove the object from the global object list.
721          *
722          * (we are holding vmobj_token)
723          */
724         TAILQ_REMOVE(&vm_object_list, object, object_list);
725         vm_object_count--;
726         vm_object_dead_wakeup(object);
727         vm_object_unlock(object);
728
729         if (object->ref_count != 0) {
730                 panic("vm_object_terminate2: object with references, "
731                       "ref_count=%d", object->ref_count);
732         }
733
734         /*
735          * Free the space for the object.
736          */
737         zfree(obj_zone, object);
738 }
739
740 /*
741  * The caller must hold vm_token.
742  */
743 static int
744 vm_object_terminate_callback(vm_page_t p, void *data __unused)
745 {
746         if (p->busy || (p->flags & PG_BUSY))
747                 panic("vm_object_terminate: freeing busy page %p", p);
748         if (p->wire_count == 0) {
749                 vm_page_busy(p);
750                 vm_page_free(p);
751                 mycpu->gd_cnt.v_pfree++;
752         } else {
753                 if (p->queue != PQ_NONE)
754                         kprintf("vm_object_terminate: Warning: Encountered wired page %p on queue %d\n", p, p->queue);
755                 vm_page_busy(p);
756                 vm_page_remove(p);
757                 vm_page_wakeup(p);
758         }
759         return(0);
760 }
761
762 /*
763  * The object is dead but still has an object<->pager association.  Sleep
764  * and return.  The caller typically retests the association in a loop.
765  *
766  * Must be called with the vmobj_token held.
767  */
768 void
769 vm_object_dead_sleep(vm_object_t object, const char *wmesg)
770 {
771         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
772         if (object->handle) {
773                 vm_object_set_flag(object, OBJ_DEADWNT);
774                 tsleep(object, 0, wmesg, 0);
775                 /* object may be invalid after this point */
776         }
777 }
778
779 /*
780  * Wakeup anyone waiting for the object<->pager disassociation on
781  * a dead object.
782  *
783  * Must be called with the vmobj_token held.
784  */
785 void
786 vm_object_dead_wakeup(vm_object_t object)
787 {
788         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
789         if (object->flags & OBJ_DEADWNT) {
790                 vm_object_clear_flag(object, OBJ_DEADWNT);
791                 wakeup(object);
792         }
793 }
794
795 /*
796  * Clean all dirty pages in the specified range of object.  Leaves page
797  * on whatever queue it is currently on.   If NOSYNC is set then do not
798  * write out pages with PG_NOSYNC set (originally comes from MAP_NOSYNC),
799  * leaving the object dirty.
800  *
801  * When stuffing pages asynchronously, allow clustering.  XXX we need a
802  * synchronous clustering mode implementation.
803  *
804  * Odd semantics: if start == end, we clean everything.
805  *
806  * The object must be locked? XXX
807  */
808 static int vm_object_page_clean_pass1(struct vm_page *p, void *data);
809 static int vm_object_page_clean_pass2(struct vm_page *p, void *data);
810
811 void
812 vm_object_page_clean(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
813                      int flags)
814 {
815         struct rb_vm_page_scan_info info;
816         struct vnode *vp;
817         int wholescan;
818         int pagerflags;
819         int curgeneration;
820
821         vm_object_hold(object);
822         if (object->type != OBJT_VNODE ||
823             (object->flags & OBJ_MIGHTBEDIRTY) == 0) {
824                 vm_object_drop(object);
825                 return;
826         }
827
828         pagerflags = (flags & (OBJPC_SYNC | OBJPC_INVAL)) ? 
829                         VM_PAGER_PUT_SYNC : VM_PAGER_CLUSTER_OK;
830         pagerflags |= (flags & OBJPC_INVAL) ? VM_PAGER_PUT_INVAL : 0;
831
832         vp = object->handle;
833
834         /*
835          * Interlock other major object operations.  This allows us to 
836          * temporarily clear OBJ_WRITEABLE and OBJ_MIGHTBEDIRTY.
837          */
838         vm_object_set_flag(object, OBJ_CLEANING);
839
840         /*
841          * Handle 'entire object' case
842          */
843         info.start_pindex = start;
844         if (end == 0) {
845                 info.end_pindex = object->size - 1;
846         } else {
847                 info.end_pindex = end - 1;
848         }
849         wholescan = (start == 0 && info.end_pindex == object->size - 1);
850         info.limit = flags;
851         info.pagerflags = pagerflags;
852         info.object = object;
853
854         /*
855          * If cleaning the entire object do a pass to mark the pages read-only.
856          * If everything worked out ok, clear OBJ_WRITEABLE and
857          * OBJ_MIGHTBEDIRTY.
858          */
859         if (wholescan) {
860                 info.error = 0;
861                 lwkt_gettoken(&vm_token);
862                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
863                                         vm_object_page_clean_pass1, &info);
864                 lwkt_reltoken(&vm_token);
865                 if (info.error == 0) {
866                         vm_object_clear_flag(object,
867                                              OBJ_WRITEABLE|OBJ_MIGHTBEDIRTY);
868                         if (object->type == OBJT_VNODE &&
869                             (vp = (struct vnode *)object->handle) != NULL) {
870                                 if (vp->v_flag & VOBJDIRTY) 
871                                         vclrflags(vp, VOBJDIRTY);
872                         }
873                 }
874         }
875
876         /*
877          * Do a pass to clean all the dirty pages we find.
878          */
879         do {
880                 info.error = 0;
881                 curgeneration = object->generation;
882                 lwkt_gettoken(&vm_token);
883                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
884                                         vm_object_page_clean_pass2, &info);
885                 lwkt_reltoken(&vm_token);
886         } while (info.error || curgeneration != object->generation);
887
888         vm_object_clear_flag(object, OBJ_CLEANING);
889         vm_object_drop(object);
890 }
891
892 /*
893  * The caller must hold vm_token.
894  */
895 static 
896 int
897 vm_object_page_clean_pass1(struct vm_page *p, void *data)
898 {
899         struct rb_vm_page_scan_info *info = data;
900
901         vm_page_flag_set(p, PG_CLEANCHK);
902         if ((info->limit & OBJPC_NOSYNC) && (p->flags & PG_NOSYNC))
903                 info->error = 1;
904         else
905                 vm_page_protect(p, VM_PROT_READ);       /* must not block */
906         return(0);
907 }
908
909 /*
910  * The caller must hold vm_token.
911  */
912 static 
913 int
914 vm_object_page_clean_pass2(struct vm_page *p, void *data)
915 {
916         struct rb_vm_page_scan_info *info = data;
917         int n;
918
919         /*
920          * Do not mess with pages that were inserted after we started
921          * the cleaning pass.
922          */
923         if ((p->flags & PG_CLEANCHK) == 0)
924                 return(0);
925
926         /*
927          * Before wasting time traversing the pmaps, check for trivial
928          * cases where the page cannot be dirty.
929          */
930         if (p->valid == 0 || (p->queue - p->pc) == PQ_CACHE) {
931                 KKASSERT((p->dirty & p->valid) == 0);
932                 return(0);
933         }
934
935         /*
936          * Check whether the page is dirty or not.  The page has been set
937          * to be read-only so the check will not race a user dirtying the
938          * page.
939          */
940         vm_page_test_dirty(p);
941         if ((p->dirty & p->valid) == 0) {
942                 vm_page_flag_clear(p, PG_CLEANCHK);
943                 return(0);
944         }
945
946         /*
947          * If we have been asked to skip nosync pages and this is a
948          * nosync page, skip it.  Note that the object flags were
949          * not cleared in this case (because pass1 will have returned an
950          * error), so we do not have to set them.
951          */
952         if ((info->limit & OBJPC_NOSYNC) && (p->flags & PG_NOSYNC)) {
953                 vm_page_flag_clear(p, PG_CLEANCHK);
954                 return(0);
955         }
956
957         /*
958          * Flush as many pages as we can.  PG_CLEANCHK will be cleared on
959          * the pages that get successfully flushed.  Set info->error if
960          * we raced an object modification.
961          */
962         n = vm_object_page_collect_flush(info->object, p, info->pagerflags);
963         if (n == 0)
964                 info->error = 1;
965         return(0);
966 }
967
968 /*
969  * Collect the specified page and nearby pages and flush them out.
970  * The number of pages flushed is returned.
971  *
972  * The caller must hold vm_token.
973  */
974 static int
975 vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int pagerflags)
976 {
977         int runlen;
978         int maxf;
979         int chkb;
980         int maxb;
981         int i;
982         int curgeneration;
983         vm_pindex_t pi;
984         vm_page_t maf[vm_pageout_page_count];
985         vm_page_t mab[vm_pageout_page_count];
986         vm_page_t ma[vm_pageout_page_count];
987
988         curgeneration = object->generation;
989
990         pi = p->pindex;
991         while (vm_page_sleep_busy(p, TRUE, "vpcwai")) {
992                 if (object->generation != curgeneration) {
993                         return(0);
994                 }
995         }
996         KKASSERT(p->object == object && p->pindex == pi);
997
998         maxf = 0;
999         for(i = 1; i < vm_pageout_page_count; i++) {
1000                 vm_page_t tp;
1001
1002                 if ((tp = vm_page_lookup(object, pi + i)) != NULL) {
1003                         if ((tp->flags & PG_BUSY) ||
1004                                 ((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 && 
1005                                  (tp->flags & PG_CLEANCHK) == 0) ||
1006                                 (tp->busy != 0))
1007                                 break;
1008                         if((tp->queue - tp->pc) == PQ_CACHE) {
1009                                 vm_page_flag_clear(tp, PG_CLEANCHK);
1010                                 break;
1011                         }
1012                         vm_page_test_dirty(tp);
1013                         if ((tp->dirty & tp->valid) == 0) {
1014                                 vm_page_flag_clear(tp, PG_CLEANCHK);
1015                                 break;
1016                         }
1017                         maf[ i - 1 ] = tp;
1018                         maxf++;
1019                         continue;
1020                 }
1021                 break;
1022         }
1023
1024         maxb = 0;
1025         chkb = vm_pageout_page_count -  maxf;
1026         if (chkb) {
1027                 for(i = 1; i < chkb;i++) {
1028                         vm_page_t tp;
1029
1030                         if ((tp = vm_page_lookup(object, pi - i)) != NULL) {
1031                                 if ((tp->flags & PG_BUSY) ||
1032                                         ((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 && 
1033                                          (tp->flags & PG_CLEANCHK) == 0) ||
1034                                         (tp->busy != 0))
1035                                         break;
1036                                 if((tp->queue - tp->pc) == PQ_CACHE) {
1037                                         vm_page_flag_clear(tp, PG_CLEANCHK);
1038                                         break;
1039                                 }
1040                                 vm_page_test_dirty(tp);
1041                                 if ((tp->dirty & tp->valid) == 0) {
1042                                         vm_page_flag_clear(tp, PG_CLEANCHK);
1043                                         break;
1044                                 }
1045                                 mab[ i - 1 ] = tp;
1046                                 maxb++;
1047                                 continue;
1048                         }
1049                         break;
1050                 }
1051         }
1052
1053         for(i = 0; i < maxb; i++) {
1054                 int index = (maxb - i) - 1;
1055                 ma[index] = mab[i];
1056                 vm_page_flag_clear(ma[index], PG_CLEANCHK);
1057         }
1058         vm_page_flag_clear(p, PG_CLEANCHK);
1059         ma[maxb] = p;
1060         for(i = 0; i < maxf; i++) {
1061                 int index = (maxb + i) + 1;
1062                 ma[index] = maf[i];
1063                 vm_page_flag_clear(ma[index], PG_CLEANCHK);
1064         }
1065         runlen = maxb + maxf + 1;
1066
1067         vm_pageout_flush(ma, runlen, pagerflags);
1068         for (i = 0; i < runlen; i++) {
1069                 if (ma[i]->valid & ma[i]->dirty) {
1070                         vm_page_protect(ma[i], VM_PROT_READ);
1071                         vm_page_flag_set(ma[i], PG_CLEANCHK);
1072
1073                         /*
1074                          * maxf will end up being the actual number of pages
1075                          * we wrote out contiguously, non-inclusive of the
1076                          * first page.  We do not count look-behind pages.
1077                          */
1078                         if (i >= maxb + 1 && (maxf > i - maxb - 1))
1079                                 maxf = i - maxb - 1;
1080                 }
1081         }
1082         return(maxf + 1);
1083 }
1084
1085 /*
1086  * Same as vm_object_pmap_copy, except range checking really
1087  * works, and is meant for small sections of an object.
1088  *
1089  * This code protects resident pages by making them read-only
1090  * and is typically called on a fork or split when a page
1091  * is converted to copy-on-write.  
1092  *
1093  * NOTE: If the page is already at VM_PROT_NONE, calling
1094  * vm_page_protect will have no effect.
1095  */
1096 void
1097 vm_object_pmap_copy_1(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
1098 {
1099         vm_pindex_t idx;
1100         vm_page_t p;
1101
1102         if (object == NULL || (object->flags & OBJ_WRITEABLE) == 0)
1103                 return;
1104
1105         /*
1106          * spl protection needed to prevent races between the lookup,
1107          * an interrupt unbusy/free, and our protect call.
1108          */
1109         lwkt_gettoken(&vm_token);
1110         for (idx = start; idx < end; idx++) {
1111                 p = vm_page_lookup(object, idx);
1112                 if (p == NULL)
1113                         continue;
1114                 vm_page_protect(p, VM_PROT_READ);
1115         }
1116         lwkt_reltoken(&vm_token);
1117 }
1118
1119 /*
1120  * Removes all physical pages in the specified object range from all
1121  * physical maps.
1122  *
1123  * The object must *not* be locked.
1124  */
1125
1126 static int vm_object_pmap_remove_callback(vm_page_t p, void *data);
1127
1128 void
1129 vm_object_pmap_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
1130 {
1131         struct rb_vm_page_scan_info info;
1132
1133         if (object == NULL)
1134                 return;
1135         info.start_pindex = start;
1136         info.end_pindex = end - 1;
1137
1138         lwkt_gettoken(&vm_token);
1139         vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
1140                                 vm_object_pmap_remove_callback, &info);
1141         if (start == 0 && end == object->size)
1142                 vm_object_clear_flag(object, OBJ_WRITEABLE);
1143         lwkt_reltoken(&vm_token);
1144 }
1145
1146 /*
1147  * The caller must hold vm_token.
1148  */
1149 static int
1150 vm_object_pmap_remove_callback(vm_page_t p, void *data __unused)
1151 {
1152         vm_page_protect(p, VM_PROT_NONE);
1153         return(0);
1154 }
1155
1156 /*
1157  * Implements the madvise function at the object/page level.
1158  *
1159  * MADV_WILLNEED        (any object)
1160  *
1161  *      Activate the specified pages if they are resident.
1162  *
1163  * MADV_DONTNEED        (any object)
1164  *
1165  *      Deactivate the specified pages if they are resident.
1166  *
1167  * MADV_FREE    (OBJT_DEFAULT/OBJT_SWAP objects, OBJ_ONEMAPPING only)
1168  *
1169  *      Deactivate and clean the specified pages if they are
1170  *      resident.  This permits the process to reuse the pages
1171  *      without faulting or the kernel to reclaim the pages
1172  *      without I/O.
1173  *
1174  * No requirements.
1175  */
1176 void
1177 vm_object_madvise(vm_object_t object, vm_pindex_t pindex, int count, int advise)
1178 {
1179         vm_pindex_t end, tpindex;
1180         vm_object_t tobject;
1181         vm_page_t m;
1182
1183         if (object == NULL)
1184                 return;
1185
1186         end = pindex + count;
1187
1188         lwkt_gettoken(&vm_token);
1189
1190         /*
1191          * Locate and adjust resident pages
1192          */
1193         for (; pindex < end; pindex += 1) {
1194 relookup:
1195                 tobject = object;
1196                 tpindex = pindex;
1197 shadowlookup:
1198                 /*
1199                  * MADV_FREE only operates on OBJT_DEFAULT or OBJT_SWAP pages
1200                  * and those pages must be OBJ_ONEMAPPING.
1201                  */
1202                 if (advise == MADV_FREE) {
1203                         if ((tobject->type != OBJT_DEFAULT &&
1204                              tobject->type != OBJT_SWAP) ||
1205                             (tobject->flags & OBJ_ONEMAPPING) == 0) {
1206                                 continue;
1207                         }
1208                 }
1209
1210                 /*
1211                  * spl protection is required to avoid a race between the
1212                  * lookup, an interrupt unbusy/free, and our busy check.
1213                  */
1214
1215                 m = vm_page_lookup(tobject, tpindex);
1216
1217                 if (m == NULL) {
1218                         /*
1219                          * There may be swap even if there is no backing page
1220                          */
1221                         if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1222                                 swap_pager_freespace(tobject, tpindex, 1);
1223
1224                         /*
1225                          * next object
1226                          */
1227                         if (tobject->backing_object == NULL)
1228                                 continue;
1229                         tpindex += OFF_TO_IDX(tobject->backing_object_offset);
1230                         tobject = tobject->backing_object;
1231                         goto shadowlookup;
1232                 }
1233
1234                 /*
1235                  * If the page is busy or not in a normal active state,
1236                  * we skip it.  If the page is not managed there are no
1237                  * page queues to mess with.  Things can break if we mess
1238                  * with pages in any of the below states.
1239                  */
1240                 if (
1241                     m->hold_count ||
1242                     m->wire_count ||
1243                     (m->flags & PG_UNMANAGED) ||
1244                     m->valid != VM_PAGE_BITS_ALL
1245                 ) {
1246                         continue;
1247                 }
1248
1249                 if (vm_page_sleep_busy(m, TRUE, "madvpo")) {
1250                         goto relookup;
1251                 }
1252                 vm_page_busy(m);
1253
1254                 /*
1255                  * Theoretically once a page is known not to be busy, an
1256                  * interrupt cannot come along and rip it out from under us.
1257                  */
1258
1259                 if (advise == MADV_WILLNEED) {
1260                         vm_page_activate(m);
1261                 } else if (advise == MADV_DONTNEED) {
1262                         vm_page_dontneed(m);
1263                 } else if (advise == MADV_FREE) {
1264                         /*
1265                          * Mark the page clean.  This will allow the page
1266                          * to be freed up by the system.  However, such pages
1267                          * are often reused quickly by malloc()/free()
1268                          * so we do not do anything that would cause
1269                          * a page fault if we can help it.
1270                          *
1271                          * Specifically, we do not try to actually free
1272                          * the page now nor do we try to put it in the
1273                          * cache (which would cause a page fault on reuse).
1274                          *
1275                          * But we do make the page is freeable as we
1276                          * can without actually taking the step of unmapping
1277                          * it.
1278                          */
1279                         pmap_clear_modify(m);
1280                         m->dirty = 0;
1281                         m->act_count = 0;
1282                         vm_page_dontneed(m);
1283                         if (tobject->type == OBJT_SWAP)
1284                                 swap_pager_freespace(tobject, tpindex, 1);
1285                 }
1286                 vm_page_wakeup(m);
1287         }       
1288         lwkt_reltoken(&vm_token);
1289 }
1290
1291 /*
1292  * Create a new object which is backed by the specified existing object
1293  * range.  The source object reference is deallocated.
1294  *
1295  * The new object and offset into that object are returned in the source
1296  * parameters.
1297  *
1298  * No other requirements.
1299  */
1300 void
1301 vm_object_shadow(vm_object_t *object, vm_ooffset_t *offset, vm_size_t length)
1302 {
1303         vm_object_t source;
1304         vm_object_t result;
1305
1306         source = *object;
1307
1308         /*
1309          * Don't create the new object if the old object isn't shared.
1310          */
1311         lwkt_gettoken(&vm_token);
1312
1313         if (source != NULL &&
1314             source->ref_count == 1 &&
1315             source->handle == NULL &&
1316             (source->type == OBJT_DEFAULT ||
1317              source->type == OBJT_SWAP)) {
1318                 lwkt_reltoken(&vm_token);
1319                 return;
1320         }
1321
1322         /*
1323          * Allocate a new object with the given length
1324          */
1325
1326         if ((result = vm_object_allocate(OBJT_DEFAULT, length)) == NULL)
1327                 panic("vm_object_shadow: no object for shadowing");
1328
1329         /*
1330          * The new object shadows the source object, adding a reference to it.
1331          * Our caller changes his reference to point to the new object,
1332          * removing a reference to the source object.  Net result: no change
1333          * of reference count.
1334          *
1335          * Try to optimize the result object's page color when shadowing
1336          * in order to maintain page coloring consistency in the combined 
1337          * shadowed object.
1338          */
1339         result->backing_object = source;
1340         if (source) {
1341                 LIST_INSERT_HEAD(&source->shadow_head, result, shadow_list);
1342                 source->shadow_count++;
1343                 source->generation++;
1344                 result->pg_color = (source->pg_color + OFF_TO_IDX(*offset)) & PQ_L2_MASK;
1345         }
1346
1347         /*
1348          * Store the offset into the source object, and fix up the offset into
1349          * the new object.
1350          */
1351         result->backing_object_offset = *offset;
1352         lwkt_reltoken(&vm_token);
1353
1354         /*
1355          * Return the new things
1356          */
1357         *offset = 0;
1358         *object = result;
1359 }
1360
1361 #define OBSC_TEST_ALL_SHADOWED  0x0001
1362 #define OBSC_COLLAPSE_NOWAIT    0x0002
1363 #define OBSC_COLLAPSE_WAIT      0x0004
1364
1365 static int vm_object_backing_scan_callback(vm_page_t p, void *data);
1366
1367 /*
1368  * The caller must hold vm_token.
1369  */
1370 static __inline int
1371 vm_object_backing_scan(vm_object_t object, int op)
1372 {
1373         struct rb_vm_page_scan_info info;
1374         vm_object_t backing_object;
1375
1376         backing_object = object->backing_object;
1377         info.backing_offset_index = OFF_TO_IDX(object->backing_object_offset);
1378
1379         /*
1380          * Initial conditions
1381          */
1382
1383         if (op & OBSC_TEST_ALL_SHADOWED) {
1384                 /*
1385                  * We do not want to have to test for the existence of
1386                  * swap pages in the backing object.  XXX but with the
1387                  * new swapper this would be pretty easy to do.
1388                  *
1389                  * XXX what about anonymous MAP_SHARED memory that hasn't
1390                  * been ZFOD faulted yet?  If we do not test for this, the
1391                  * shadow test may succeed! XXX
1392                  */
1393                 if (backing_object->type != OBJT_DEFAULT) {
1394                         return(0);
1395                 }
1396         }
1397         if (op & OBSC_COLLAPSE_WAIT) {
1398                 KKASSERT((backing_object->flags & OBJ_DEAD) == 0);
1399                 vm_object_set_flag(backing_object, OBJ_DEAD);
1400         }
1401
1402         /*
1403          * Our scan.   We have to retry if a negative error code is returned,
1404          * otherwise 0 or 1 will be returned in info.error.  0 Indicates that
1405          * the scan had to be stopped because the parent does not completely
1406          * shadow the child.
1407          */
1408         info.object = object;
1409         info.backing_object = backing_object;
1410         info.limit = op;
1411         do {
1412                 info.error = 1;
1413                 vm_page_rb_tree_RB_SCAN(&backing_object->rb_memq, NULL,
1414                                         vm_object_backing_scan_callback,
1415                                         &info);
1416         } while (info.error < 0);
1417
1418         return(info.error);
1419 }
1420
1421 /*
1422  * The caller must hold vm_token.
1423  */
1424 static int
1425 vm_object_backing_scan_callback(vm_page_t p, void *data)
1426 {
1427         struct rb_vm_page_scan_info *info = data;
1428         vm_object_t backing_object;
1429         vm_object_t object;
1430         vm_pindex_t new_pindex;
1431         vm_pindex_t backing_offset_index;
1432         int op;
1433
1434         new_pindex = p->pindex - info->backing_offset_index;
1435         op = info->limit;
1436         object = info->object;
1437         backing_object = info->backing_object;
1438         backing_offset_index = info->backing_offset_index;
1439
1440         if (op & OBSC_TEST_ALL_SHADOWED) {
1441                 vm_page_t pp;
1442
1443                 /*
1444                  * Ignore pages outside the parent object's range
1445                  * and outside the parent object's mapping of the 
1446                  * backing object.
1447                  *
1448                  * note that we do not busy the backing object's
1449                  * page.
1450                  */
1451                 if (
1452                     p->pindex < backing_offset_index ||
1453                     new_pindex >= object->size
1454                 ) {
1455                         return(0);
1456                 }
1457
1458                 /*
1459                  * See if the parent has the page or if the parent's
1460                  * object pager has the page.  If the parent has the
1461                  * page but the page is not valid, the parent's
1462                  * object pager must have the page.
1463                  *
1464                  * If this fails, the parent does not completely shadow
1465                  * the object and we might as well give up now.
1466                  */
1467
1468                 pp = vm_page_lookup(object, new_pindex);
1469                 if ((pp == NULL || pp->valid == 0) &&
1470                     !vm_pager_has_page(object, new_pindex)
1471                 ) {
1472                         info->error = 0;        /* problemo */
1473                         return(-1);             /* stop the scan */
1474                 }
1475         }
1476
1477         /*
1478          * Check for busy page
1479          */
1480
1481         if (op & (OBSC_COLLAPSE_WAIT | OBSC_COLLAPSE_NOWAIT)) {
1482                 vm_page_t pp;
1483
1484                 if (op & OBSC_COLLAPSE_NOWAIT) {
1485                         if (
1486                             (p->flags & PG_BUSY) ||
1487                             !p->valid || 
1488                             p->hold_count || 
1489                             p->wire_count ||
1490                             p->busy
1491                         ) {
1492                                 return(0);
1493                         }
1494                 } else if (op & OBSC_COLLAPSE_WAIT) {
1495                         if (vm_page_sleep_busy(p, TRUE, "vmocol")) {
1496                                 /*
1497                                  * If we slept, anything could have
1498                                  * happened.   Ask that the scan be restarted.
1499                                  *
1500                                  * Since the object is marked dead, the
1501                                  * backing offset should not have changed.  
1502                                  */
1503                                 info->error = -1;
1504                                 return(-1);
1505                         }
1506                 }
1507
1508                 /* 
1509                  * Busy the page
1510                  */
1511                 vm_page_busy(p);
1512
1513                 KASSERT(
1514                     p->object == backing_object,
1515                     ("vm_object_qcollapse(): object mismatch")
1516                 );
1517
1518                 /*
1519                  * Destroy any associated swap
1520                  */
1521                 if (backing_object->type == OBJT_SWAP)
1522                         swap_pager_freespace(backing_object, p->pindex, 1);
1523
1524                 if (
1525                     p->pindex < backing_offset_index ||
1526                     new_pindex >= object->size
1527                 ) {
1528                         /*
1529                          * Page is out of the parent object's range, we 
1530                          * can simply destroy it. 
1531                          */
1532                         vm_page_protect(p, VM_PROT_NONE);
1533                         vm_page_free(p);
1534                         return(0);
1535                 }
1536
1537                 pp = vm_page_lookup(object, new_pindex);
1538                 if (pp != NULL || vm_pager_has_page(object, new_pindex)) {
1539                         /*
1540                          * page already exists in parent OR swap exists
1541                          * for this location in the parent.  Destroy 
1542                          * the original page from the backing object.
1543                          *
1544                          * Leave the parent's page alone
1545                          */
1546                         vm_page_protect(p, VM_PROT_NONE);
1547                         vm_page_free(p);
1548                         return(0);
1549                 }
1550
1551                 /*
1552                  * Page does not exist in parent, rename the
1553                  * page from the backing object to the main object. 
1554                  *
1555                  * If the page was mapped to a process, it can remain 
1556                  * mapped through the rename.
1557                  */
1558                 if ((p->queue - p->pc) == PQ_CACHE)
1559                         vm_page_deactivate(p);
1560
1561                 vm_page_rename(p, object, new_pindex);
1562                 /* page automatically made dirty by rename */
1563         }
1564         return(0);
1565 }
1566
1567 /*
1568  * This version of collapse allows the operation to occur earlier and
1569  * when paging_in_progress is true for an object...  This is not a complete
1570  * operation, but should plug 99.9% of the rest of the leaks.
1571  *
1572  * The caller must hold vm_token and vmobj_token.
1573  * (only called from vm_object_collapse)
1574  */
1575 static void
1576 vm_object_qcollapse(vm_object_t object)
1577 {
1578         vm_object_t backing_object = object->backing_object;
1579
1580         if (backing_object->ref_count != 1)
1581                 return;
1582
1583         backing_object->ref_count += 2;
1584
1585         vm_object_backing_scan(object, OBSC_COLLAPSE_NOWAIT);
1586
1587         backing_object->ref_count -= 2;
1588 }
1589
1590 /*
1591  * Collapse an object with the object backing it.  Pages in the backing
1592  * object are moved into the parent, and the backing object is deallocated.
1593  *
1594  * The caller must hold (object).
1595  */
1596 void
1597 vm_object_collapse(vm_object_t object)
1598 {
1599         ASSERT_LWKT_TOKEN_HELD(&vm_token);
1600         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
1601         vm_object_assert_held(object);
1602
1603         while (TRUE) {
1604                 vm_object_t backing_object;
1605
1606                 /*
1607                  * Verify that the conditions are right for collapse:
1608                  *
1609                  * The object exists and the backing object exists.
1610                  */
1611                 if (object == NULL)
1612                         break;
1613
1614                 if ((backing_object = object->backing_object) == NULL)
1615                         break;
1616
1617                 vm_object_hold(backing_object);
1618                 if (backing_object != object->backing_object) {
1619                         vm_object_drop(backing_object);
1620                         continue;
1621                 }
1622
1623                 /*
1624                  * we check the backing object first, because it is most likely
1625                  * not collapsable.
1626                  */
1627                 if (backing_object->handle != NULL ||
1628                     (backing_object->type != OBJT_DEFAULT &&
1629                      backing_object->type != OBJT_SWAP) ||
1630                     (backing_object->flags & OBJ_DEAD) ||
1631                     object->handle != NULL ||
1632                     (object->type != OBJT_DEFAULT &&
1633                      object->type != OBJT_SWAP) ||
1634                     (object->flags & OBJ_DEAD)) {
1635                         vm_object_drop(backing_object);
1636                         break;
1637                 }
1638
1639                 if (
1640                     object->paging_in_progress != 0 ||
1641                     backing_object->paging_in_progress != 0
1642                 ) {
1643                         vm_object_drop(backing_object);
1644                         vm_object_qcollapse(object);
1645                         break;
1646                 }
1647
1648                 /*
1649                  * We know that we can either collapse the backing object (if
1650                  * the parent is the only reference to it) or (perhaps) have
1651                  * the parent bypass the object if the parent happens to shadow
1652                  * all the resident pages in the entire backing object.
1653                  *
1654                  * This is ignoring pager-backed pages such as swap pages.
1655                  * vm_object_backing_scan fails the shadowing test in this
1656                  * case.
1657                  */
1658
1659                 if (backing_object->ref_count == 1) {
1660                         /*
1661                          * If there is exactly one reference to the backing
1662                          * object, we can collapse it into the parent.  
1663                          */
1664                         vm_object_backing_scan(object, OBSC_COLLAPSE_WAIT);
1665
1666                         /*
1667                          * Move the pager from backing_object to object.
1668                          */
1669                         if (backing_object->type == OBJT_SWAP) {
1670                                 vm_object_pip_add(backing_object, 1);
1671
1672                                 /*
1673                                  * scrap the paging_offset junk and do a 
1674                                  * discrete copy.  This also removes major 
1675                                  * assumptions about how the swap-pager 
1676                                  * works from where it doesn't belong.  The
1677                                  * new swapper is able to optimize the
1678                                  * destroy-source case.
1679                                  */
1680
1681                                 vm_object_pip_add(object, 1);
1682                                 swap_pager_copy(
1683                                     backing_object,
1684                                     object,
1685                                     OFF_TO_IDX(object->backing_object_offset), TRUE);
1686                                 vm_object_pip_wakeup(object);
1687
1688                                 vm_object_pip_wakeup(backing_object);
1689                         }
1690                         /*
1691                          * Object now shadows whatever backing_object did.
1692                          * Note that the reference to 
1693                          * backing_object->backing_object moves from within 
1694                          * backing_object to within object.
1695                          */
1696
1697                         LIST_REMOVE(object, shadow_list);
1698                         object->backing_object->shadow_count--;
1699                         object->backing_object->generation++;
1700                         if (backing_object->backing_object) {
1701                                 LIST_REMOVE(backing_object, shadow_list);
1702                                 backing_object->backing_object->shadow_count--;
1703                                 backing_object->backing_object->generation++;
1704                         }
1705                         object->backing_object = backing_object->backing_object;
1706                         if (object->backing_object) {
1707                                 LIST_INSERT_HEAD(
1708                                     &object->backing_object->shadow_head,
1709                                     object, 
1710                                     shadow_list
1711                                 );
1712                                 object->backing_object->shadow_count++;
1713                                 object->backing_object->generation++;
1714                         }
1715
1716                         object->backing_object_offset +=
1717                             backing_object->backing_object_offset;
1718
1719                         /*
1720                          * Discard backing_object.
1721                          *
1722                          * Since the backing object has no pages, no pager left,
1723                          * and no object references within it, all that is
1724                          * necessary is to dispose of it.
1725                          */
1726
1727                         KASSERT(backing_object->ref_count == 1,
1728                                 ("backing_object %p was somehow "
1729                                  "re-referenced during collapse!",
1730                                  backing_object));
1731                         KASSERT(RB_EMPTY(&backing_object->rb_memq),
1732                                 ("backing_object %p somehow has left "
1733                                  "over pages during collapse!",
1734                                  backing_object));
1735
1736                         /*
1737                          * Wait for hold count to hit zero
1738                          */
1739                         vm_object_drop(backing_object);
1740                         vm_object_hold_wait(backing_object);
1741
1742                         /* (we are holding vmobj_token) */
1743                         TAILQ_REMOVE(&vm_object_list, backing_object,
1744                                      object_list);
1745                         --backing_object->ref_count;    /* safety/debug */
1746                         vm_object_count--;
1747
1748                         zfree(obj_zone, backing_object);
1749
1750                         object_collapses++;
1751                 } else {
1752                         vm_object_t new_backing_object;
1753
1754                         /*
1755                          * If we do not entirely shadow the backing object,
1756                          * there is nothing we can do so we give up.
1757                          */
1758
1759                         if (vm_object_backing_scan(object, OBSC_TEST_ALL_SHADOWED) == 0) {
1760                                 vm_object_drop(backing_object);
1761                                 break;
1762                         }
1763
1764                         /*
1765                          * Make the parent shadow the next object in the
1766                          * chain.  Deallocating backing_object will not remove
1767                          * it, since its reference count is at least 2.
1768                          */
1769
1770                         LIST_REMOVE(object, shadow_list);
1771                         backing_object->shadow_count--;
1772                         backing_object->generation++;
1773
1774                         new_backing_object = backing_object->backing_object;
1775                         if ((object->backing_object = new_backing_object) != NULL) {
1776                                 vm_object_reference(new_backing_object);
1777                                 LIST_INSERT_HEAD(
1778                                     &new_backing_object->shadow_head,
1779                                     object,
1780                                     shadow_list
1781                                 );
1782                                 new_backing_object->shadow_count++;
1783                                 new_backing_object->generation++;
1784                                 object->backing_object_offset +=
1785                                         backing_object->backing_object_offset;
1786                         }
1787
1788                         /*
1789                          * Drop the reference count on backing_object. Since
1790                          * its ref_count was at least 2, it will not vanish;
1791                          * so we don't need to call vm_object_deallocate, but
1792                          * we do anyway.
1793                          */
1794                         vm_object_drop(backing_object);
1795                         vm_object_deallocate_locked(backing_object);
1796                         object_bypasses++;
1797                 }
1798
1799                 /*
1800                  * Try again with this object's new backing object.
1801                  */
1802         }
1803 }
1804
1805 /*
1806  * Removes all physical pages in the specified object range from the
1807  * object's list of pages.
1808  *
1809  * No requirements.
1810  */
1811 static int vm_object_page_remove_callback(vm_page_t p, void *data);
1812
1813 void
1814 vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
1815                       boolean_t clean_only)
1816 {
1817         struct rb_vm_page_scan_info info;
1818         int all;
1819
1820         /*
1821          * Degenerate cases and assertions
1822          */
1823         lwkt_gettoken(&vm_token);
1824         if (object == NULL ||
1825             (object->resident_page_count == 0 && object->swblock_count == 0)) {
1826                 lwkt_reltoken(&vm_token);
1827                 return;
1828         }
1829         KASSERT(object->type != OBJT_PHYS, 
1830                 ("attempt to remove pages from a physical object"));
1831
1832         /*
1833          * Indicate that paging is occuring on the object
1834          */
1835         vm_object_pip_add(object, 1);
1836
1837         /*
1838          * Figure out the actual removal range and whether we are removing
1839          * the entire contents of the object or not.  If removing the entire
1840          * contents, be sure to get all pages, even those that might be 
1841          * beyond the end of the object.
1842          */
1843         info.start_pindex = start;
1844         if (end == 0)
1845                 info.end_pindex = (vm_pindex_t)-1;
1846         else
1847                 info.end_pindex = end - 1;
1848         info.limit = clean_only;
1849         all = (start == 0 && info.end_pindex >= object->size - 1);
1850
1851         /*
1852          * Loop until we are sure we have gotten them all.
1853          */
1854         do {
1855                 info.error = 0;
1856                 vm_page_rb_tree_RB_SCAN(&object->rb_memq, rb_vm_page_scancmp,
1857                                         vm_object_page_remove_callback, &info);
1858         } while (info.error);
1859
1860         /*
1861          * Remove any related swap if throwing away pages, or for
1862          * non-swap objects (the swap is a clean copy in that case).
1863          */
1864         if (object->type != OBJT_SWAP || clean_only == FALSE) {
1865                 if (all)
1866                         swap_pager_freespace_all(object);
1867                 else
1868                         swap_pager_freespace(object, info.start_pindex,
1869                              info.end_pindex - info.start_pindex + 1);
1870         }
1871
1872         /*
1873          * Cleanup
1874          */
1875         vm_object_pip_wakeup(object);
1876         lwkt_reltoken(&vm_token);
1877 }
1878
1879 /*
1880  * The caller must hold vm_token.
1881  */
1882 static int
1883 vm_object_page_remove_callback(vm_page_t p, void *data)
1884 {
1885         struct rb_vm_page_scan_info *info = data;
1886
1887         /*
1888          * Wired pages cannot be destroyed, but they can be invalidated
1889          * and we do so if clean_only (limit) is not set.
1890          *
1891          * WARNING!  The page may be wired due to being part of a buffer
1892          *           cache buffer, and the buffer might be marked B_CACHE.
1893          *           This is fine as part of a truncation but VFSs must be
1894          *           sure to fix the buffer up when re-extending the file.
1895          */
1896         if (p->wire_count != 0) {
1897                 vm_page_protect(p, VM_PROT_NONE);
1898                 if (info->limit == 0)
1899                         p->valid = 0;
1900                 return(0);
1901         }
1902
1903         /*
1904          * The busy flags are only cleared at
1905          * interrupt -- minimize the spl transitions
1906          */
1907
1908         if (vm_page_sleep_busy(p, TRUE, "vmopar")) {
1909                 info->error = 1;
1910                 return(0);
1911         }
1912
1913         /*
1914          * limit is our clean_only flag.  If set and the page is dirty, do
1915          * not free it.  If set and the page is being held by someone, do
1916          * not free it.
1917          */
1918         if (info->limit && p->valid) {
1919                 vm_page_test_dirty(p);
1920                 if (p->valid & p->dirty)
1921                         return(0);
1922                 if (p->hold_count)
1923                         return(0);
1924         }
1925
1926         /*
1927          * Destroy the page
1928          */
1929         vm_page_busy(p);
1930         vm_page_protect(p, VM_PROT_NONE);
1931         vm_page_free(p);
1932         return(0);
1933 }
1934
1935 /*
1936  * Coalesces two objects backing up adjoining regions of memory into a
1937  * single object.
1938  *
1939  * returns TRUE if objects were combined.
1940  *
1941  * NOTE: Only works at the moment if the second object is NULL -
1942  *       if it's not, which object do we lock first?
1943  *
1944  * Parameters:
1945  *      prev_object     First object to coalesce
1946  *      prev_offset     Offset into prev_object
1947  *      next_object     Second object into coalesce
1948  *      next_offset     Offset into next_object
1949  *
1950  *      prev_size       Size of reference to prev_object
1951  *      next_size       Size of reference to next_object
1952  *
1953  * The caller must hold vm_token and vmobj_token.
1954  *
1955  * The caller does not need to hold (prev_object) but must have a stable
1956  * pointer to it (typically by holding the vm_map locked).
1957  */
1958 boolean_t
1959 vm_object_coalesce(vm_object_t prev_object, vm_pindex_t prev_pindex,
1960                    vm_size_t prev_size, vm_size_t next_size)
1961 {
1962         vm_pindex_t next_pindex;
1963
1964         ASSERT_LWKT_TOKEN_HELD(&vm_token);
1965         ASSERT_LWKT_TOKEN_HELD(&vmobj_token);
1966
1967         if (prev_object == NULL) {
1968                 return (TRUE);
1969         }
1970
1971         vm_object_hold(prev_object);
1972
1973         if (prev_object->type != OBJT_DEFAULT &&
1974             prev_object->type != OBJT_SWAP) {
1975                 vm_object_drop(prev_object);
1976                 return (FALSE);
1977         }
1978
1979         /*
1980          * Try to collapse the object first
1981          */
1982         vm_object_collapse(prev_object);
1983
1984         /*
1985          * Can't coalesce if: . more than one reference . paged out . shadows
1986          * another object . has a copy elsewhere (any of which mean that the
1987          * pages not mapped to prev_entry may be in use anyway)
1988          */
1989
1990         if (prev_object->backing_object != NULL) {
1991                 vm_object_drop(prev_object);
1992                 return (FALSE);
1993         }
1994
1995         prev_size >>= PAGE_SHIFT;
1996         next_size >>= PAGE_SHIFT;
1997         next_pindex = prev_pindex + prev_size;
1998
1999         if ((prev_object->ref_count > 1) &&
2000             (prev_object->size != next_pindex)) {
2001                 vm_object_drop(prev_object);
2002                 return (FALSE);
2003         }
2004
2005         /*
2006          * Remove any pages that may still be in the object from a previous
2007          * deallocation.
2008          */
2009         if (next_pindex < prev_object->size) {
2010                 vm_object_page_remove(prev_object,
2011                                       next_pindex,
2012                                       next_pindex + next_size, FALSE);
2013                 if (prev_object->type == OBJT_SWAP)
2014                         swap_pager_freespace(prev_object,
2015                                              next_pindex, next_size);
2016         }
2017
2018         /*
2019          * Extend the object if necessary.
2020          */
2021         if (next_pindex + next_size > prev_object->size)
2022                 prev_object->size = next_pindex + next_size;
2023
2024         vm_object_drop(prev_object);
2025         return (TRUE);
2026 }
2027
2028 /*
2029  * Make the object writable and flag is being possibly dirty.
2030  *
2031  * No requirements.
2032  */
2033 void
2034 vm_object_set_writeable_dirty(vm_object_t object)
2035 {
2036         struct vnode *vp;
2037
2038         lwkt_gettoken(&vm_token);
2039         vm_object_set_flag(object, OBJ_WRITEABLE|OBJ_MIGHTBEDIRTY);
2040         if (object->type == OBJT_VNODE &&
2041             (vp = (struct vnode *)object->handle) != NULL) {
2042                 if ((vp->v_flag & VOBJDIRTY) == 0) {
2043                         vsetflags(vp, VOBJDIRTY);
2044                 }
2045         }
2046         lwkt_reltoken(&vm_token);
2047 }
2048
2049 #include "opt_ddb.h"
2050 #ifdef DDB
2051 #include <sys/kernel.h>
2052
2053 #include <sys/cons.h>
2054
2055 #include <ddb/ddb.h>
2056
2057 static int      _vm_object_in_map (vm_map_t map, vm_object_t object,
2058                                        vm_map_entry_t entry);
2059 static int      vm_object_in_map (vm_object_t object);
2060
2061 /*
2062  * The caller must hold vm_token.
2063  */
2064 static int
2065 _vm_object_in_map(vm_map_t map, vm_object_t object, vm_map_entry_t entry)
2066 {
2067         vm_map_t tmpm;
2068         vm_map_entry_t tmpe;
2069         vm_object_t obj;
2070         int entcount;
2071
2072         if (map == 0)
2073                 return 0;
2074         if (entry == 0) {
2075                 tmpe = map->header.next;
2076                 entcount = map->nentries;
2077                 while (entcount-- && (tmpe != &map->header)) {
2078                         if( _vm_object_in_map(map, object, tmpe)) {
2079                                 return 1;
2080                         }
2081                         tmpe = tmpe->next;
2082                 }
2083                 return (0);
2084         }
2085         switch(entry->maptype) {
2086         case VM_MAPTYPE_SUBMAP:
2087                 tmpm = entry->object.sub_map;
2088                 tmpe = tmpm->header.next;
2089                 entcount = tmpm->nentries;
2090                 while (entcount-- && tmpe != &tmpm->header) {
2091                         if( _vm_object_in_map(tmpm, object, tmpe)) {
2092                                 return 1;
2093                         }
2094                         tmpe = tmpe->next;
2095                 }
2096                 break;
2097         case VM_MAPTYPE_NORMAL:
2098         case VM_MAPTYPE_VPAGETABLE:
2099                 obj = entry->object.vm_object;
2100                 while (obj) {
2101                         if (obj == object)
2102                                 return 1;
2103                         obj = obj->backing_object;
2104                 }
2105                 break;
2106         default:
2107                 break;
2108         }
2109         return 0;
2110 }
2111
2112 static int vm_object_in_map_callback(struct proc *p, void *data);
2113
2114 struct vm_object_in_map_info {
2115         vm_object_t object;
2116         int rv;
2117 };
2118
2119 /*
2120  * Debugging only
2121  */
2122 static int
2123 vm_object_in_map(vm_object_t object)
2124 {
2125         struct vm_object_in_map_info info;
2126
2127         info.rv = 0;
2128         info.object = object;
2129
2130         allproc_scan(vm_object_in_map_callback, &info);
2131         if (info.rv)
2132                 return 1;
2133         if( _vm_object_in_map(&kernel_map, object, 0))
2134                 return 1;
2135         if( _vm_object_in_map(&pager_map, object, 0))
2136                 return 1;
2137         if( _vm_object_in_map(&buffer_map, object, 0))
2138                 return 1;
2139         return 0;
2140 }
2141
2142 /*
2143  * Debugging only
2144  */
2145 static int
2146 vm_object_in_map_callback(struct proc *p, void *data)
2147 {
2148         struct vm_object_in_map_info *info = data;
2149
2150         if (p->p_vmspace) {
2151                 if (_vm_object_in_map(&p->p_vmspace->vm_map, info->object, 0)) {
2152                         info->rv = 1;
2153                         return -1;
2154                 }
2155         }
2156         return (0);
2157 }
2158
2159 DB_SHOW_COMMAND(vmochk, vm_object_check)
2160 {
2161         vm_object_t object;
2162
2163         /*
2164          * make sure that internal objs are in a map somewhere
2165          * and none have zero ref counts.
2166          */
2167         for (object = TAILQ_FIRST(&vm_object_list);
2168                         object != NULL;
2169                         object = TAILQ_NEXT(object, object_list)) {
2170                 if (object->type == OBJT_MARKER)
2171                         continue;
2172                 if (object->handle == NULL &&
2173                     (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
2174                         if (object->ref_count == 0) {
2175                                 db_printf("vmochk: internal obj has zero ref count: %ld\n",
2176                                         (long)object->size);
2177                         }
2178                         if (!vm_object_in_map(object)) {
2179                                 db_printf(
2180                         "vmochk: internal obj is not in a map: "
2181                         "ref: %d, size: %lu: 0x%lx, backing_object: %p\n",
2182                                     object->ref_count, (u_long)object->size, 
2183                                     (u_long)object->size,
2184                                     (void *)object->backing_object);
2185                         }
2186                 }
2187         }
2188 }
2189
2190 /*
2191  * Debugging only
2192  */
2193 DB_SHOW_COMMAND(object, vm_object_print_static)
2194 {
2195         /* XXX convert args. */
2196         vm_object_t object = (vm_object_t)addr;
2197         boolean_t full = have_addr;
2198
2199         vm_page_t p;
2200
2201         /* XXX count is an (unused) arg.  Avoid shadowing it. */
2202 #define count   was_count
2203
2204         int count;
2205
2206         if (object == NULL)
2207                 return;
2208
2209         db_iprintf(
2210             "Object %p: type=%d, size=0x%lx, res=%d, ref=%d, flags=0x%x\n",
2211             object, (int)object->type, (u_long)object->size,
2212             object->resident_page_count, object->ref_count, object->flags);
2213         /*
2214          * XXX no %qd in kernel.  Truncate object->backing_object_offset.
2215          */
2216         db_iprintf(" sref=%d, backing_object(%d)=(%p)+0x%lx\n",
2217             object->shadow_count, 
2218             object->backing_object ? object->backing_object->ref_count : 0,
2219             object->backing_object, (long)object->backing_object_offset);
2220
2221         if (!full)
2222                 return;
2223
2224         db_indent += 2;
2225         count = 0;
2226         RB_FOREACH(p, vm_page_rb_tree, &object->rb_memq) {
2227                 if (count == 0)
2228                         db_iprintf("memory:=");
2229                 else if (count == 6) {
2230                         db_printf("\n");
2231                         db_iprintf(" ...");
2232                         count = 0;
2233                 } else
2234                         db_printf(",");
2235                 count++;
2236
2237                 db_printf("(off=0x%lx,page=0x%lx)",
2238                     (u_long) p->pindex, (u_long) VM_PAGE_TO_PHYS(p));
2239         }
2240         if (count != 0)
2241                 db_printf("\n");
2242         db_indent -= 2;
2243 }
2244
2245 /* XXX. */
2246 #undef count
2247
2248 /*
2249  * XXX need this non-static entry for calling from vm_map_print.
2250  *
2251  * Debugging only
2252  */
2253 void
2254 vm_object_print(/* db_expr_t */ long addr,
2255                 boolean_t have_addr,
2256                 /* db_expr_t */ long count,
2257                 char *modif)
2258 {
2259         vm_object_print_static(addr, have_addr, count, modif);
2260 }
2261
2262 /*
2263  * Debugging only
2264  */
2265 DB_SHOW_COMMAND(vmopag, vm_object_print_pages)
2266 {
2267         vm_object_t object;
2268         int nl = 0;
2269         int c;
2270         for (object = TAILQ_FIRST(&vm_object_list);
2271                         object != NULL;
2272                         object = TAILQ_NEXT(object, object_list)) {
2273                 vm_pindex_t idx, fidx;
2274                 vm_pindex_t osize;
2275                 vm_paddr_t pa = -1, padiff;
2276                 int rcount;
2277                 vm_page_t m;
2278
2279                 if (object->type == OBJT_MARKER)
2280                         continue;
2281                 db_printf("new object: %p\n", (void *)object);
2282                 if ( nl > 18) {
2283                         c = cngetc();
2284                         if (c != ' ')
2285                                 return;
2286                         nl = 0;
2287                 }
2288                 nl++;
2289                 rcount = 0;
2290                 fidx = 0;
2291                 osize = object->size;
2292                 if (osize > 128)
2293                         osize = 128;
2294                 for (idx = 0; idx < osize; idx++) {
2295                         m = vm_page_lookup(object, idx);
2296                         if (m == NULL) {
2297                                 if (rcount) {
2298                                         db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2299                                                 (long)fidx, rcount, (long)pa);
2300                                         if ( nl > 18) {
2301                                                 c = cngetc();
2302                                                 if (c != ' ')
2303                                                         return;
2304                                                 nl = 0;
2305                                         }
2306                                         nl++;
2307                                         rcount = 0;
2308                                 }
2309                                 continue;
2310                         }
2311
2312                                 
2313                         if (rcount &&
2314                                 (VM_PAGE_TO_PHYS(m) == pa + rcount * PAGE_SIZE)) {
2315                                 ++rcount;
2316                                 continue;
2317                         }
2318                         if (rcount) {
2319                                 padiff = pa + rcount * PAGE_SIZE - VM_PAGE_TO_PHYS(m);
2320                                 padiff >>= PAGE_SHIFT;
2321                                 padiff &= PQ_L2_MASK;
2322                                 if (padiff == 0) {
2323                                         pa = VM_PAGE_TO_PHYS(m) - rcount * PAGE_SIZE;
2324                                         ++rcount;
2325                                         continue;
2326                                 }
2327                                 db_printf(" index(%ld)run(%d)pa(0x%lx)",
2328                                         (long)fidx, rcount, (long)pa);
2329                                 db_printf("pd(%ld)\n", (long)padiff);
2330                                 if ( nl > 18) {
2331                                         c = cngetc();
2332                                         if (c != ' ')
2333                                                 return;
2334                                         nl = 0;
2335                                 }
2336                                 nl++;
2337                         }
2338                         fidx = idx;
2339                         pa = VM_PAGE_TO_PHYS(m);
2340                         rcount = 1;
2341                 }
2342                 if (rcount) {
2343                         db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2344                                 (long)fidx, rcount, (long)pa);
2345                         if ( nl > 18) {
2346                                 c = cngetc();
2347                                 if (c != ' ')
2348                                         return;
2349                                 nl = 0;
2350                         }
2351                         nl++;
2352                 }
2353         }
2354 }
2355 #endif /* DDB */