xref: /freebsd/sys/vm/vm_object.c (revision 4b656ded9248840ebc7afb8aba2384c8b0a2afb3)
1 /*-
2  * SPDX-License-Identifier: (BSD-3-Clause AND MIT-CMU)
3  *
4  * Copyright (c) 1991, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * The Mach Operating System project at Carnegie-Mellon University.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *
35  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
36  * All rights reserved.
37  *
38  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
39  *
40  * Permission to use, copy, modify and distribute this software and
41  * its documentation is hereby granted, provided that both the copyright
42  * notice and this permission notice appear in all copies of the
43  * software, derivative works or modified versions, and any portions
44  * thereof, and that both notices appear in supporting documentation.
45  *
46  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
47  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
48  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
49  *
50  * Carnegie Mellon requests users of this software to return to
51  *
52  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
53  *  School of Computer Science
54  *  Carnegie Mellon University
55  *  Pittsburgh PA 15213-3890
56  *
57  * any improvements or extensions that they make and grant Carnegie the
58  * rights to redistribute these changes.
59  */
60 
61 /*
62  *	Virtual memory object module.
63  */
64 
65 #include "opt_vm.h"
66 
67 #include <sys/systm.h>
68 #include <sys/blockcount.h>
69 #include <sys/conf.h>
70 #include <sys/cpuset.h>
71 #include <sys/ipc.h>
72 #include <sys/jail.h>
73 #include <sys/limits.h>
74 #include <sys/lock.h>
75 #include <sys/mman.h>
76 #include <sys/mount.h>
77 #include <sys/kernel.h>
78 #include <sys/mutex.h>
79 #include <sys/pctrie.h>
80 #include <sys/proc.h>
81 #include <sys/refcount.h>
82 #include <sys/shm.h>
83 #include <sys/sx.h>
84 #include <sys/sysctl.h>
85 #include <sys/resourcevar.h>
86 #include <sys/refcount.h>
87 #include <sys/rwlock.h>
88 #include <sys/user.h>
89 #include <sys/vnode.h>
90 #include <sys/vmmeter.h>
91 
92 #include <vm/vm.h>
93 #include <vm/vm_param.h>
94 #include <vm/pmap.h>
95 #include <vm/vm_map.h>
96 #include <vm/vm_object.h>
97 #include <vm/vm_page.h>
98 #include <vm/vm_pageout.h>
99 #include <vm/vm_pager.h>
100 #include <vm/vm_phys.h>
101 #include <vm/vm_pagequeue.h>
102 #include <vm/swap_pager.h>
103 #include <vm/vm_kern.h>
104 #include <vm/vm_extern.h>
105 #include <vm/vm_radix.h>
106 #include <vm/vm_reserv.h>
107 #include <vm/uma.h>
108 
109 static int old_msync;
110 SYSCTL_INT(_vm, OID_AUTO, old_msync, CTLFLAG_RW, &old_msync, 0,
111     "Use old (insecure) msync behavior");
112 
113 static int	vm_object_page_collect_flush(struct pctrie_iter *pages,
114 		    vm_page_t p, int pagerflags, int flags, boolean_t *allclean,
115 		    boolean_t *eio);
116 static boolean_t vm_object_page_remove_write(vm_page_t p, int flags,
117 		    boolean_t *allclean);
118 static void	vm_object_backing_remove(vm_object_t object);
119 
120 /*
121  *	Virtual memory objects maintain the actual data
122  *	associated with allocated virtual memory.  A given
123  *	page of memory exists within exactly one object.
124  *
125  *	An object is only deallocated when all "references"
126  *	are given up.  Only one "reference" to a given
127  *	region of an object should be writeable.
128  *
129  *	Associated with each object is a list of all resident
130  *	memory pages belonging to that object; this list is
131  *	maintained by the "vm_page" module, and locked by the object's
132  *	lock.
133  *
134  *	Each object also records a "pager" routine which is
135  *	used to retrieve (and store) pages to the proper backing
136  *	storage.  In addition, objects may be backed by other
137  *	objects from which they were virtual-copied.
138  *
139  *	The only items within the object structure which are
140  *	modified after time of creation are:
141  *		reference count		locked by object's lock
142  *		pager routine		locked by object's lock
143  *
144  */
145 
146 struct object_q vm_object_list;
147 struct mtx vm_object_list_mtx;	/* lock for object list and count */
148 
149 struct vm_object kernel_object_store;
150 
151 static SYSCTL_NODE(_vm_stats, OID_AUTO, object, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
152     "VM object stats");
153 
154 static COUNTER_U64_DEFINE_EARLY(object_collapses);
155 SYSCTL_COUNTER_U64(_vm_stats_object, OID_AUTO, collapses, CTLFLAG_RD,
156     &object_collapses,
157     "VM object collapses");
158 
159 static COUNTER_U64_DEFINE_EARLY(object_bypasses);
160 SYSCTL_COUNTER_U64(_vm_stats_object, OID_AUTO, bypasses, CTLFLAG_RD,
161     &object_bypasses,
162     "VM object bypasses");
163 
164 static COUNTER_U64_DEFINE_EARLY(object_collapse_waits);
165 SYSCTL_COUNTER_U64(_vm_stats_object, OID_AUTO, collapse_waits, CTLFLAG_RD,
166     &object_collapse_waits,
167     "Number of sleeps for collapse");
168 
169 static uma_zone_t obj_zone;
170 
171 static int vm_object_zinit(void *mem, int size, int flags);
172 
173 #ifdef INVARIANTS
174 static void vm_object_zdtor(void *mem, int size, void *arg);
175 
176 static void
177 vm_object_zdtor(void *mem, int size, void *arg)
178 {
179 	vm_object_t object;
180 
181 	object = (vm_object_t)mem;
182 	KASSERT(object->ref_count == 0,
183 	    ("object %p ref_count = %d", object, object->ref_count));
184 	KASSERT(vm_radix_is_empty(&object->rtree),
185 	    ("object %p has resident pages in its trie", object));
186 #if VM_NRESERVLEVEL > 0
187 	KASSERT(LIST_EMPTY(&object->rvq),
188 	    ("object %p has reservations",
189 	    object));
190 #endif
191 	KASSERT(!vm_object_busied(object),
192 	    ("object %p busy = %d", object, blockcount_read(&object->busy)));
193 	KASSERT(object->resident_page_count == 0,
194 	    ("object %p resident_page_count = %d",
195 	    object, object->resident_page_count));
196 	KASSERT(atomic_load_int(&object->shadow_count) == 0,
197 	    ("object %p shadow_count = %d",
198 	    object, atomic_load_int(&object->shadow_count)));
199 	KASSERT(object->type == OBJT_DEAD,
200 	    ("object %p has non-dead type %d",
201 	    object, object->type));
202 	KASSERT(object->charge == 0 && object->cred == NULL,
203 	    ("object %p has non-zero charge %ju (%p)",
204 	    object, (uintmax_t)object->charge, object->cred));
205 }
206 #endif
207 
208 static int
209 vm_object_zinit(void *mem, int size, int flags)
210 {
211 	vm_object_t object;
212 
213 	object = (vm_object_t)mem;
214 	rw_init_flags(&object->lock, "vmobject", RW_DUPOK | RW_NEW);
215 
216 	/* These are true for any object that has been freed */
217 	object->type = OBJT_DEAD;
218 	vm_radix_init(&object->rtree);
219 	refcount_init(&object->ref_count, 0);
220 	blockcount_init(&object->paging_in_progress);
221 	blockcount_init(&object->busy);
222 	object->resident_page_count = 0;
223 	atomic_store_int(&object->shadow_count, 0);
224 	object->flags = OBJ_DEAD;
225 
226 	mtx_lock(&vm_object_list_mtx);
227 	TAILQ_INSERT_TAIL(&vm_object_list, object, object_list);
228 	mtx_unlock(&vm_object_list_mtx);
229 	return (0);
230 }
231 
232 static void
233 _vm_object_allocate(objtype_t type, vm_pindex_t size, u_short flags,
234     vm_object_t object, void *handle)
235 {
236 
237 	LIST_INIT(&object->shadow_head);
238 
239 	object->type = type;
240 	object->flags = flags;
241 	if ((flags & OBJ_SWAP) != 0) {
242 		pctrie_init(&object->un_pager.swp.swp_blks);
243 		object->un_pager.swp.writemappings = 0;
244 	}
245 
246 	/*
247 	 * Ensure that swap_pager_swapoff() iteration over object_list
248 	 * sees up to date type and pctrie head if it observed
249 	 * non-dead object.
250 	 */
251 	atomic_thread_fence_rel();
252 
253 	object->pg_color = 0;
254 	object->size = size;
255 	object->domain.dr_policy = NULL;
256 	object->generation = 1;
257 	object->cleangeneration = 1;
258 	refcount_init(&object->ref_count, 1);
259 	object->memattr = VM_MEMATTR_DEFAULT;
260 	object->cred = NULL;
261 	object->charge = 0;
262 	object->handle = handle;
263 	object->backing_object = NULL;
264 	object->backing_object_offset = (vm_ooffset_t) 0;
265 #if VM_NRESERVLEVEL > 0
266 	LIST_INIT(&object->rvq);
267 #endif
268 	umtx_shm_object_init(object);
269 }
270 
271 /*
272  *	vm_object_init:
273  *
274  *	Initialize the VM objects module.
275  */
276 void
277 vm_object_init(void)
278 {
279 	TAILQ_INIT(&vm_object_list);
280 	mtx_init(&vm_object_list_mtx, "vm object_list", NULL, MTX_DEF);
281 
282 	rw_init(&kernel_object->lock, "kernel vm object");
283 	vm_radix_init(&kernel_object->rtree);
284 	_vm_object_allocate(OBJT_PHYS, atop(VM_MAX_KERNEL_ADDRESS -
285 	    VM_MIN_KERNEL_ADDRESS), OBJ_UNMANAGED, kernel_object, NULL);
286 #if VM_NRESERVLEVEL > 0
287 	kernel_object->flags |= OBJ_COLORED;
288 	kernel_object->pg_color = (u_short)atop(VM_MIN_KERNEL_ADDRESS);
289 #endif
290 	kernel_object->un_pager.phys.ops = &default_phys_pg_ops;
291 
292 	/*
293 	 * The lock portion of struct vm_object must be type stable due
294 	 * to vm_pageout_fallback_object_lock locking a vm object
295 	 * without holding any references to it.
296 	 *
297 	 * paging_in_progress is valid always.  Lockless references to
298 	 * the objects may acquire pip and then check OBJ_DEAD.
299 	 */
300 	obj_zone = uma_zcreate("VM OBJECT", sizeof (struct vm_object), NULL,
301 #ifdef INVARIANTS
302 	    vm_object_zdtor,
303 #else
304 	    NULL,
305 #endif
306 	    vm_object_zinit, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
307 
308 	vm_radix_zinit();
309 }
310 
311 void
312 vm_object_clear_flag(vm_object_t object, u_short bits)
313 {
314 
315 	VM_OBJECT_ASSERT_WLOCKED(object);
316 	object->flags &= ~bits;
317 }
318 
319 /*
320  *	Sets the default memory attribute for the specified object.  Pages
321  *	that are allocated to this object are by default assigned this memory
322  *	attribute.
323  *
324  *	Presently, this function must be called before any pages are allocated
325  *	to the object.  In the future, this requirement may be relaxed for
326  *	"default" and "swap" objects.
327  */
328 int
329 vm_object_set_memattr(vm_object_t object, vm_memattr_t memattr)
330 {
331 
332 	VM_OBJECT_ASSERT_WLOCKED(object);
333 
334 	if (object->type == OBJT_DEAD)
335 		return (KERN_INVALID_ARGUMENT);
336 	if (!vm_radix_is_empty(&object->rtree))
337 		return (KERN_FAILURE);
338 
339 	object->memattr = memattr;
340 	return (KERN_SUCCESS);
341 }
342 
343 void
344 vm_object_pip_add(vm_object_t object, short i)
345 {
346 
347 	if (i > 0)
348 		blockcount_acquire(&object->paging_in_progress, i);
349 }
350 
351 void
352 vm_object_pip_wakeup(vm_object_t object)
353 {
354 
355 	vm_object_pip_wakeupn(object, 1);
356 }
357 
358 void
359 vm_object_pip_wakeupn(vm_object_t object, short i)
360 {
361 
362 	if (i > 0)
363 		blockcount_release(&object->paging_in_progress, i);
364 }
365 
366 /*
367  * Atomically drop the object lock and wait for pip to drain.  This protects
368  * from sleep/wakeup races due to identity changes.  The lock is not re-acquired
369  * on return.
370  */
371 static void
372 vm_object_pip_sleep(vm_object_t object, const char *waitid)
373 {
374 
375 	(void)blockcount_sleep(&object->paging_in_progress, &object->lock,
376 	    waitid, PVM | PDROP);
377 }
378 
379 void
380 vm_object_pip_wait(vm_object_t object, const char *waitid)
381 {
382 
383 	VM_OBJECT_ASSERT_WLOCKED(object);
384 
385 	blockcount_wait(&object->paging_in_progress, &object->lock, waitid,
386 	    PVM);
387 }
388 
389 void
390 vm_object_pip_wait_unlocked(vm_object_t object, const char *waitid)
391 {
392 
393 	VM_OBJECT_ASSERT_UNLOCKED(object);
394 
395 	blockcount_wait(&object->paging_in_progress, NULL, waitid, PVM);
396 }
397 
398 /*
399  *	vm_object_allocate:
400  *
401  *	Returns a new object with the given size.
402  */
403 vm_object_t
404 vm_object_allocate(objtype_t type, vm_pindex_t size)
405 {
406 	vm_object_t object;
407 	u_short flags;
408 
409 	switch (type) {
410 	case OBJT_DEAD:
411 		panic("vm_object_allocate: can't create OBJT_DEAD");
412 	case OBJT_SWAP:
413 		flags = OBJ_COLORED | OBJ_SWAP;
414 		break;
415 	case OBJT_DEVICE:
416 	case OBJT_SG:
417 		flags = OBJ_FICTITIOUS | OBJ_UNMANAGED;
418 		break;
419 	case OBJT_MGTDEVICE:
420 		flags = OBJ_FICTITIOUS;
421 		break;
422 	case OBJT_PHYS:
423 		flags = OBJ_UNMANAGED;
424 		break;
425 	case OBJT_VNODE:
426 		flags = 0;
427 		break;
428 	default:
429 		panic("vm_object_allocate: type %d is undefined or dynamic",
430 		    type);
431 	}
432 	object = (vm_object_t)uma_zalloc(obj_zone, M_WAITOK);
433 	_vm_object_allocate(type, size, flags, object, NULL);
434 
435 	return (object);
436 }
437 
438 vm_object_t
439 vm_object_allocate_dyn(objtype_t dyntype, vm_pindex_t size, u_short flags)
440 {
441 	vm_object_t object;
442 
443 	MPASS(dyntype >= OBJT_FIRST_DYN /* && dyntype < nitems(pagertab) */);
444 	object = (vm_object_t)uma_zalloc(obj_zone, M_WAITOK);
445 	_vm_object_allocate(dyntype, size, flags, object, NULL);
446 
447 	return (object);
448 }
449 
450 /*
451  *	vm_object_allocate_anon:
452  *
453  *	Returns a new default object of the given size and marked as
454  *	anonymous memory for special split/collapse handling.  Color
455  *	to be initialized by the caller.
456  */
457 vm_object_t
458 vm_object_allocate_anon(vm_pindex_t size, vm_object_t backing_object,
459     struct ucred *cred, vm_size_t charge)
460 {
461 	vm_object_t handle, object;
462 
463 	if (backing_object == NULL)
464 		handle = NULL;
465 	else if ((backing_object->flags & OBJ_ANON) != 0)
466 		handle = backing_object->handle;
467 	else
468 		handle = backing_object;
469 	object = uma_zalloc(obj_zone, M_WAITOK);
470 	_vm_object_allocate(OBJT_SWAP, size,
471 	    OBJ_ANON | OBJ_ONEMAPPING | OBJ_SWAP, object, handle);
472 	object->cred = cred;
473 	object->charge = cred != NULL ? charge : 0;
474 	return (object);
475 }
476 
477 static void
478 vm_object_reference_vnode(vm_object_t object)
479 {
480 	u_int old;
481 
482 	/*
483 	 * vnode objects need the lock for the first reference
484 	 * to serialize with vnode_object_deallocate().
485 	 */
486 	if (!refcount_acquire_if_gt(&object->ref_count, 0)) {
487 		VM_OBJECT_RLOCK(object);
488 		old = refcount_acquire(&object->ref_count);
489 		if (object->type == OBJT_VNODE && old == 0)
490 			vref(object->handle);
491 		VM_OBJECT_RUNLOCK(object);
492 	}
493 }
494 
495 /*
496  *	vm_object_reference:
497  *
498  *	Acquires a reference to the given object.
499  */
500 void
501 vm_object_reference(vm_object_t object)
502 {
503 
504 	if (object == NULL)
505 		return;
506 
507 	if (object->type == OBJT_VNODE)
508 		vm_object_reference_vnode(object);
509 	else
510 		refcount_acquire(&object->ref_count);
511 	KASSERT((object->flags & OBJ_DEAD) == 0,
512 	    ("vm_object_reference: Referenced dead object."));
513 }
514 
515 /*
516  *	vm_object_reference_locked:
517  *
518  *	Gets another reference to the given object.
519  *
520  *	The object must be locked.
521  */
522 void
523 vm_object_reference_locked(vm_object_t object)
524 {
525 	u_int old;
526 
527 	VM_OBJECT_ASSERT_LOCKED(object);
528 	old = refcount_acquire(&object->ref_count);
529 	if (object->type == OBJT_VNODE && old == 0)
530 		vref(object->handle);
531 	KASSERT((object->flags & OBJ_DEAD) == 0,
532 	    ("vm_object_reference: Referenced dead object."));
533 }
534 
535 /*
536  * Handle deallocating an object of type OBJT_VNODE.
537  */
538 static void
539 vm_object_deallocate_vnode(vm_object_t object)
540 {
541 	struct vnode *vp = (struct vnode *) object->handle;
542 	bool last;
543 
544 	KASSERT(object->type == OBJT_VNODE,
545 	    ("vm_object_deallocate_vnode: not a vnode object"));
546 	KASSERT(vp != NULL, ("vm_object_deallocate_vnode: missing vp"));
547 
548 	/* Object lock to protect handle lookup. */
549 	last = refcount_release(&object->ref_count);
550 	VM_OBJECT_RUNLOCK(object);
551 
552 	if (!last)
553 		return;
554 
555 	if (!umtx_shm_vnobj_persistent)
556 		umtx_shm_object_terminated(object);
557 
558 	/* vrele may need the vnode lock. */
559 	vrele(vp);
560 }
561 
562 /*
563  * We dropped a reference on an object and discovered that it had a
564  * single remaining shadow.  This is a sibling of the reference we
565  * dropped.  Attempt to collapse the sibling and backing object.
566  */
567 static vm_object_t
568 vm_object_deallocate_anon(vm_object_t backing_object)
569 {
570 	vm_object_t object;
571 
572 	/* Fetch the final shadow.  */
573 	object = LIST_FIRST(&backing_object->shadow_head);
574 	KASSERT(object != NULL &&
575 	    atomic_load_int(&backing_object->shadow_count) == 1,
576 	    ("vm_object_anon_deallocate: ref_count: %d, shadow_count: %d",
577 	    backing_object->ref_count,
578 	    atomic_load_int(&backing_object->shadow_count)));
579 	KASSERT((object->flags & OBJ_ANON) != 0,
580 	    ("invalid shadow object %p", object));
581 
582 	if (!VM_OBJECT_TRYWLOCK(object)) {
583 		/*
584 		 * Prevent object from disappearing since we do not have a
585 		 * reference.
586 		 */
587 		vm_object_pip_add(object, 1);
588 		VM_OBJECT_WUNLOCK(backing_object);
589 		VM_OBJECT_WLOCK(object);
590 		vm_object_pip_wakeup(object);
591 	} else
592 		VM_OBJECT_WUNLOCK(backing_object);
593 
594 	/*
595 	 * Check for a collapse/terminate race with the last reference holder.
596 	 */
597 	if ((object->flags & (OBJ_DEAD | OBJ_COLLAPSING)) != 0 ||
598 	    !refcount_acquire_if_not_zero(&object->ref_count)) {
599 		VM_OBJECT_WUNLOCK(object);
600 		return (NULL);
601 	}
602 	backing_object = object->backing_object;
603 	if (backing_object != NULL && (backing_object->flags & OBJ_ANON) != 0)
604 		vm_object_collapse(object);
605 	VM_OBJECT_WUNLOCK(object);
606 
607 	return (object);
608 }
609 
610 /*
611  *	vm_object_deallocate:
612  *
613  *	Release a reference to the specified object,
614  *	gained either through a vm_object_allocate
615  *	or a vm_object_reference call.  When all references
616  *	are gone, storage associated with this object
617  *	may be relinquished.
618  *
619  *	No object may be locked.
620  */
621 void
622 vm_object_deallocate(vm_object_t object)
623 {
624 	vm_object_t temp;
625 	bool released;
626 
627 	while (object != NULL) {
628 		/*
629 		 * If the reference count goes to 0 we start calling
630 		 * vm_object_terminate() on the object chain.  A ref count
631 		 * of 1 may be a special case depending on the shadow count
632 		 * being 0 or 1.  These cases require a write lock on the
633 		 * object.
634 		 */
635 		if ((object->flags & OBJ_ANON) == 0)
636 			released = refcount_release_if_gt(&object->ref_count, 1);
637 		else
638 			released = refcount_release_if_gt(&object->ref_count, 2);
639 		if (released)
640 			return;
641 
642 		if (object->type == OBJT_VNODE) {
643 			VM_OBJECT_RLOCK(object);
644 			if (object->type == OBJT_VNODE) {
645 				vm_object_deallocate_vnode(object);
646 				return;
647 			}
648 			VM_OBJECT_RUNLOCK(object);
649 		}
650 
651 		VM_OBJECT_WLOCK(object);
652 		KASSERT(object->ref_count > 0,
653 		    ("vm_object_deallocate: object deallocated too many times: %d",
654 		    object->type));
655 
656 		/*
657 		 * If this is not the final reference to an anonymous
658 		 * object we may need to collapse the shadow chain.
659 		 */
660 		if (!refcount_release(&object->ref_count)) {
661 			if (object->ref_count > 1 ||
662 			    atomic_load_int(&object->shadow_count) == 0) {
663 				if ((object->flags & OBJ_ANON) != 0 &&
664 				    object->ref_count == 1)
665 					vm_object_set_flag(object,
666 					    OBJ_ONEMAPPING);
667 				VM_OBJECT_WUNLOCK(object);
668 				return;
669 			}
670 
671 			/* Handle collapsing last ref on anonymous objects. */
672 			object = vm_object_deallocate_anon(object);
673 			continue;
674 		}
675 
676 		/*
677 		 * Handle the final reference to an object.  We restart
678 		 * the loop with the backing object to avoid recursion.
679 		 */
680 		umtx_shm_object_terminated(object);
681 		temp = object->backing_object;
682 		if (temp != NULL) {
683 			KASSERT(object->type == OBJT_SWAP,
684 			    ("shadowed tmpfs v_object 2 %p", object));
685 			vm_object_backing_remove(object);
686 		}
687 
688 		KASSERT((object->flags & OBJ_DEAD) == 0,
689 		    ("vm_object_deallocate: Terminating dead object."));
690 		vm_object_set_flag(object, OBJ_DEAD);
691 		vm_object_terminate(object);
692 		object = temp;
693 	}
694 }
695 
696 void
697 vm_object_destroy(vm_object_t object)
698 {
699 	uma_zfree(obj_zone, object);
700 }
701 
702 static void
703 vm_object_sub_shadow(vm_object_t object)
704 {
705 	KASSERT(object->shadow_count >= 1,
706 	    ("object %p sub_shadow count zero", object));
707 	atomic_subtract_int(&object->shadow_count, 1);
708 }
709 
710 static void
711 vm_object_backing_remove_locked(vm_object_t object)
712 {
713 	vm_object_t backing_object;
714 
715 	backing_object = object->backing_object;
716 	VM_OBJECT_ASSERT_WLOCKED(object);
717 	VM_OBJECT_ASSERT_WLOCKED(backing_object);
718 
719 	KASSERT((object->flags & OBJ_COLLAPSING) == 0,
720 	    ("vm_object_backing_remove: Removing collapsing object."));
721 
722 	vm_object_sub_shadow(backing_object);
723 	if ((object->flags & OBJ_SHADOWLIST) != 0) {
724 		LIST_REMOVE(object, shadow_list);
725 		vm_object_clear_flag(object, OBJ_SHADOWLIST);
726 	}
727 	object->backing_object = NULL;
728 }
729 
730 static void
731 vm_object_backing_remove(vm_object_t object)
732 {
733 	vm_object_t backing_object;
734 
735 	VM_OBJECT_ASSERT_WLOCKED(object);
736 
737 	backing_object = object->backing_object;
738 	if ((object->flags & OBJ_SHADOWLIST) != 0) {
739 		VM_OBJECT_WLOCK(backing_object);
740 		vm_object_backing_remove_locked(object);
741 		VM_OBJECT_WUNLOCK(backing_object);
742 	} else {
743 		object->backing_object = NULL;
744 		vm_object_sub_shadow(backing_object);
745 	}
746 }
747 
748 static void
749 vm_object_backing_insert_locked(vm_object_t object, vm_object_t backing_object)
750 {
751 
752 	VM_OBJECT_ASSERT_WLOCKED(object);
753 
754 	atomic_add_int(&backing_object->shadow_count, 1);
755 	if ((backing_object->flags & OBJ_ANON) != 0) {
756 		VM_OBJECT_ASSERT_WLOCKED(backing_object);
757 		LIST_INSERT_HEAD(&backing_object->shadow_head, object,
758 		    shadow_list);
759 		vm_object_set_flag(object, OBJ_SHADOWLIST);
760 	}
761 	object->backing_object = backing_object;
762 }
763 
764 static void
765 vm_object_backing_insert(vm_object_t object, vm_object_t backing_object)
766 {
767 
768 	VM_OBJECT_ASSERT_WLOCKED(object);
769 
770 	if ((backing_object->flags & OBJ_ANON) != 0) {
771 		VM_OBJECT_WLOCK(backing_object);
772 		vm_object_backing_insert_locked(object, backing_object);
773 		VM_OBJECT_WUNLOCK(backing_object);
774 	} else {
775 		object->backing_object = backing_object;
776 		atomic_add_int(&backing_object->shadow_count, 1);
777 	}
778 }
779 
780 /*
781  * Insert an object into a backing_object's shadow list with an additional
782  * reference to the backing_object added.
783  */
784 static void
785 vm_object_backing_insert_ref(vm_object_t object, vm_object_t backing_object)
786 {
787 
788 	VM_OBJECT_ASSERT_WLOCKED(object);
789 
790 	if ((backing_object->flags & OBJ_ANON) != 0) {
791 		VM_OBJECT_WLOCK(backing_object);
792 		KASSERT((backing_object->flags & OBJ_DEAD) == 0,
793 		    ("shadowing dead anonymous object"));
794 		vm_object_reference_locked(backing_object);
795 		vm_object_backing_insert_locked(object, backing_object);
796 		vm_object_clear_flag(backing_object, OBJ_ONEMAPPING);
797 		VM_OBJECT_WUNLOCK(backing_object);
798 	} else {
799 		vm_object_reference(backing_object);
800 		atomic_add_int(&backing_object->shadow_count, 1);
801 		object->backing_object = backing_object;
802 	}
803 }
804 
805 /*
806  * Transfer a backing reference from backing_object to object.
807  */
808 static void
809 vm_object_backing_transfer(vm_object_t object, vm_object_t backing_object)
810 {
811 	vm_object_t new_backing_object;
812 
813 	/*
814 	 * Note that the reference to backing_object->backing_object
815 	 * moves from within backing_object to within object.
816 	 */
817 	vm_object_backing_remove_locked(object);
818 	new_backing_object = backing_object->backing_object;
819 	if (new_backing_object == NULL)
820 		return;
821 	if ((new_backing_object->flags & OBJ_ANON) != 0) {
822 		VM_OBJECT_WLOCK(new_backing_object);
823 		vm_object_backing_remove_locked(backing_object);
824 		vm_object_backing_insert_locked(object, new_backing_object);
825 		VM_OBJECT_WUNLOCK(new_backing_object);
826 	} else {
827 		/*
828 		 * shadow_count for new_backing_object is left
829 		 * unchanged, its reference provided by backing_object
830 		 * is replaced by object.
831 		 */
832 		object->backing_object = new_backing_object;
833 		backing_object->backing_object = NULL;
834 	}
835 }
836 
837 /*
838  * Wait for a concurrent collapse to settle.
839  */
840 static void
841 vm_object_collapse_wait(vm_object_t object)
842 {
843 
844 	VM_OBJECT_ASSERT_WLOCKED(object);
845 
846 	while ((object->flags & OBJ_COLLAPSING) != 0) {
847 		vm_object_pip_wait(object, "vmcolwait");
848 		counter_u64_add(object_collapse_waits, 1);
849 	}
850 }
851 
852 /*
853  * Waits for a backing object to clear a pending collapse and returns
854  * it locked if it is an ANON object.
855  */
856 static vm_object_t
857 vm_object_backing_collapse_wait(vm_object_t object)
858 {
859 	vm_object_t backing_object;
860 
861 	VM_OBJECT_ASSERT_WLOCKED(object);
862 
863 	for (;;) {
864 		backing_object = object->backing_object;
865 		if (backing_object == NULL ||
866 		    (backing_object->flags & OBJ_ANON) == 0)
867 			return (NULL);
868 		VM_OBJECT_WLOCK(backing_object);
869 		if ((backing_object->flags & (OBJ_DEAD | OBJ_COLLAPSING)) == 0)
870 			break;
871 		VM_OBJECT_WUNLOCK(object);
872 		vm_object_pip_sleep(backing_object, "vmbckwait");
873 		counter_u64_add(object_collapse_waits, 1);
874 		VM_OBJECT_WLOCK(object);
875 	}
876 	return (backing_object);
877 }
878 
879 /*
880  *	vm_object_terminate_single_page removes a pageable page from the object,
881  *	and removes it from the paging queues and frees it, if it is not wired.
882  *	It is invoked via callback from vm_object_terminate_pages.
883  */
884 static void
885 vm_object_terminate_single_page(vm_page_t p, void *objectv)
886 {
887 	vm_object_t object __diagused = objectv;
888 
889 	vm_page_assert_unbusied(p);
890 	KASSERT(p->object == object &&
891 	    (p->ref_count & VPRC_OBJREF) != 0,
892 	    ("%s: page %p is inconsistent", __func__, p));
893 	p->object = NULL;
894 	if (vm_page_drop(p, VPRC_OBJREF) == VPRC_OBJREF) {
895 		KASSERT((object->flags & OBJ_UNMANAGED) != 0 ||
896 		    vm_page_astate_load(p).queue != PQ_NONE,
897 		    ("%s: page %p does not belong to a queue", __func__, p));
898 		VM_CNT_INC(v_pfree);
899 		vm_page_free(p);
900 	}
901 }
902 
903 /*
904  *	vm_object_terminate_pages removes any remaining pageable pages
905  *	from the object and resets the object to an empty state.
906  */
907 static void
908 vm_object_terminate_pages(vm_object_t object)
909 {
910 	VM_OBJECT_ASSERT_WLOCKED(object);
911 
912 	/*
913 	 * If the object contained any pages, then reset it to an empty state.
914 	 * Rather than incrementally removing each page from the object, the
915 	 * page and object are reset to any empty state.
916 	 */
917 	if (object->resident_page_count == 0)
918 		return;
919 
920 	vm_radix_reclaim_callback(&object->rtree,
921 	    vm_object_terminate_single_page, object);
922 	object->resident_page_count = 0;
923 	if (object->type == OBJT_VNODE)
924 		vdrop(object->handle);
925 }
926 
927 /*
928  *	vm_object_terminate actually destroys the specified object, freeing
929  *	up all previously used resources.
930  *
931  *	The object must be locked.
932  *	This routine may block.
933  */
934 void
935 vm_object_terminate(vm_object_t object)
936 {
937 
938 	VM_OBJECT_ASSERT_WLOCKED(object);
939 	KASSERT((object->flags & OBJ_DEAD) != 0,
940 	    ("terminating non-dead obj %p", object));
941 	KASSERT((object->flags & OBJ_COLLAPSING) == 0,
942 	    ("terminating collapsing obj %p", object));
943 	KASSERT(object->backing_object == NULL,
944 	    ("terminating shadow obj %p", object));
945 
946 	/*
947 	 * Wait for the pageout daemon and other current users to be
948 	 * done with the object.  Note that new paging_in_progress
949 	 * users can come after this wait, but they must check
950 	 * OBJ_DEAD flag set (without unlocking the object), and avoid
951 	 * the object being terminated.
952 	 */
953 	vm_object_pip_wait(object, "objtrm");
954 
955 	KASSERT(object->ref_count == 0,
956 	    ("vm_object_terminate: object with references, ref_count=%d",
957 	    object->ref_count));
958 
959 	if ((object->flags & OBJ_PG_DTOR) == 0)
960 		vm_object_terminate_pages(object);
961 
962 #if VM_NRESERVLEVEL > 0
963 	if (__predict_false(!LIST_EMPTY(&object->rvq)))
964 		vm_reserv_break_all(object);
965 #endif
966 
967 	KASSERT(object->cred == NULL || (object->flags & OBJ_SWAP) != 0,
968 	    ("%s: non-swap obj %p has cred", __func__, object));
969 
970 	/*
971 	 * Let the pager know object is dead.
972 	 */
973 	vm_pager_deallocate(object);
974 	VM_OBJECT_WUNLOCK(object);
975 
976 	vm_object_destroy(object);
977 }
978 
979 /*
980  * Make the page read-only so that we can clear the object flags.  However, if
981  * this is a nosync mmap then the object is likely to stay dirty so do not
982  * mess with the page and do not clear the object flags.  Returns TRUE if the
983  * page should be flushed, and FALSE otherwise.
984  */
985 static boolean_t
986 vm_object_page_remove_write(vm_page_t p, int flags, boolean_t *allclean)
987 {
988 
989 	vm_page_assert_busied(p);
990 
991 	/*
992 	 * If we have been asked to skip nosync pages and this is a
993 	 * nosync page, skip it.  Note that the object flags were not
994 	 * cleared in this case so we do not have to set them.
995 	 */
996 	if ((flags & OBJPC_NOSYNC) != 0 && (p->a.flags & PGA_NOSYNC) != 0) {
997 		*allclean = FALSE;
998 		return (FALSE);
999 	} else {
1000 		pmap_remove_write(p);
1001 		return (p->dirty != 0);
1002 	}
1003 }
1004 
1005 /*
1006  *	vm_object_page_clean
1007  *
1008  *	Clean all dirty pages in the specified range of object.  Leaves page
1009  * 	on whatever queue it is currently on.   If NOSYNC is set then do not
1010  *	write out pages with PGA_NOSYNC set (originally comes from MAP_NOSYNC),
1011  *	leaving the object dirty.
1012  *
1013  *	For swap objects backing tmpfs regular files, do not flush anything,
1014  *	but remove write protection on the mapped pages to update mtime through
1015  *	mmaped writes.
1016  *
1017  *	When stuffing pages asynchronously, allow clustering.  XXX we need a
1018  *	synchronous clustering mode implementation.
1019  *
1020  *	Odd semantics: if start == end, we clean everything.
1021  *
1022  *	The object must be locked.
1023  *
1024  *	Returns FALSE if some page from the range was not written, as
1025  *	reported by the pager, and TRUE otherwise.
1026  */
1027 boolean_t
1028 vm_object_page_clean(vm_object_t object, vm_ooffset_t start, vm_ooffset_t end,
1029     int flags)
1030 {
1031 	struct pctrie_iter pages;
1032 	vm_page_t np, p;
1033 	vm_pindex_t pi, tend, tstart;
1034 	int curgeneration, n, pagerflags;
1035 	boolean_t eio, res, allclean;
1036 
1037 	VM_OBJECT_ASSERT_WLOCKED(object);
1038 
1039 	if (!vm_object_mightbedirty(object) || object->resident_page_count == 0)
1040 		return (TRUE);
1041 
1042 	pagerflags = (flags & (OBJPC_SYNC | OBJPC_INVAL)) != 0 ?
1043 	    VM_PAGER_PUT_SYNC : VM_PAGER_CLUSTER_OK;
1044 	pagerflags |= (flags & OBJPC_INVAL) != 0 ? VM_PAGER_PUT_INVAL : 0;
1045 
1046 	tstart = OFF_TO_IDX(start);
1047 	tend = (end == 0) ? object->size : OFF_TO_IDX(end + PAGE_MASK);
1048 	allclean = tstart == 0 && tend >= object->size;
1049 	res = TRUE;
1050 	vm_page_iter_init(&pages, object);
1051 
1052 rescan:
1053 	curgeneration = object->generation;
1054 
1055 	for (p = vm_radix_iter_lookup_ge(&pages, tstart); p != NULL; p = np) {
1056 		pi = p->pindex;
1057 		if (pi >= tend)
1058 			break;
1059 		if (vm_page_none_valid(p)) {
1060 			np = vm_radix_iter_step(&pages);
1061 			continue;
1062 		}
1063 		if (!vm_page_busy_acquire(p, VM_ALLOC_WAITFAIL)) {
1064 			pctrie_iter_reset(&pages);
1065 			if (object->generation != curgeneration &&
1066 			    (flags & OBJPC_SYNC) != 0)
1067 				goto rescan;
1068 			np = vm_radix_iter_lookup_ge(&pages, pi);
1069 			continue;
1070 		}
1071 		if (!vm_object_page_remove_write(p, flags, &allclean)) {
1072 			np = vm_radix_iter_step(&pages);
1073 			vm_page_xunbusy(p);
1074 			continue;
1075 		}
1076 		if (object->type == OBJT_VNODE) {
1077 			n = vm_object_page_collect_flush(&pages, p, pagerflags,
1078 			    flags, &allclean, &eio);
1079 			pctrie_iter_reset(&pages);
1080 			if (eio) {
1081 				res = FALSE;
1082 				allclean = FALSE;
1083 			}
1084 			if (object->generation != curgeneration &&
1085 			    (flags & OBJPC_SYNC) != 0)
1086 				goto rescan;
1087 
1088 			/*
1089 			 * If the VOP_PUTPAGES() did a truncated write, so
1090 			 * that even the first page of the run is not fully
1091 			 * written, vm_pageout_flush() returns 0 as the run
1092 			 * length.  Since the condition that caused truncated
1093 			 * write may be permanent, e.g. exhausted free space,
1094 			 * accepting n == 0 would cause an infinite loop.
1095 			 *
1096 			 * Forwarding the iterator leaves the unwritten page
1097 			 * behind, but there is not much we can do there if
1098 			 * filesystem refuses to write it.
1099 			 */
1100 			if (n == 0) {
1101 				n = 1;
1102 				allclean = FALSE;
1103 			}
1104 		} else {
1105 			n = 1;
1106 			vm_page_xunbusy(p);
1107 		}
1108 		np = vm_radix_iter_lookup_ge(&pages, pi + n);
1109 	}
1110 #if 0
1111 	VOP_FSYNC(vp, (pagerflags & VM_PAGER_PUT_SYNC) ? MNT_WAIT : 0);
1112 #endif
1113 
1114 	/*
1115 	 * Leave updating cleangeneration for tmpfs objects to tmpfs
1116 	 * scan.  It needs to update mtime, which happens for other
1117 	 * filesystems during page writeouts.
1118 	 */
1119 	if (allclean && object->type == OBJT_VNODE)
1120 		object->cleangeneration = curgeneration;
1121 	return (res);
1122 }
1123 
1124 static int
1125 vm_object_page_collect_flush(struct pctrie_iter *pages, vm_page_t p,
1126     int pagerflags, int flags, boolean_t *allclean, boolean_t *eio)
1127 {
1128 	vm_page_t ma[2 * vm_pageout_page_count - 1];
1129 	int base, count, runlen;
1130 
1131 	vm_page_lock_assert(p, MA_NOTOWNED);
1132 	vm_page_assert_xbusied(p);
1133 	base = nitems(ma) / 2;
1134 	ma[base] = p;
1135 	for (count = 1; count < vm_pageout_page_count; count++) {
1136 		p = vm_radix_iter_next(pages);
1137 		if (p == NULL || vm_page_tryxbusy(p) == 0)
1138 			break;
1139 		if (!vm_object_page_remove_write(p, flags, allclean)) {
1140 			vm_page_xunbusy(p);
1141 			break;
1142 		}
1143 		ma[base + count] = p;
1144 	}
1145 
1146 	pages->index = ma[base]->pindex;
1147 	for (; count < vm_pageout_page_count; count++) {
1148 		p = vm_radix_iter_prev(pages);
1149 		if (p == NULL || vm_page_tryxbusy(p) == 0)
1150 			break;
1151 		if (!vm_object_page_remove_write(p, flags, allclean)) {
1152 			vm_page_xunbusy(p);
1153 			break;
1154 		}
1155 		ma[--base] = p;
1156 	}
1157 
1158 	vm_pageout_flush(&ma[base], count, pagerflags, nitems(ma) / 2 - base,
1159 	    &runlen, eio);
1160 	return (runlen);
1161 }
1162 
1163 /*
1164  * Note that there is absolutely no sense in writing out
1165  * anonymous objects, so we track down the vnode object
1166  * to write out.
1167  * We invalidate (remove) all pages from the address space
1168  * for semantic correctness.
1169  *
1170  * If the backing object is a device object with unmanaged pages, then any
1171  * mappings to the specified range of pages must be removed before this
1172  * function is called.
1173  *
1174  * Note: certain anonymous maps, such as MAP_NOSYNC maps,
1175  * may start out with a NULL object.
1176  */
1177 boolean_t
1178 vm_object_sync(vm_object_t object, vm_ooffset_t offset, vm_size_t size,
1179     boolean_t syncio, boolean_t invalidate)
1180 {
1181 	vm_object_t backing_object;
1182 	struct vnode *vp;
1183 	struct mount *mp;
1184 	int error, flags, fsync_after;
1185 	boolean_t res;
1186 
1187 	if (object == NULL)
1188 		return (TRUE);
1189 	res = TRUE;
1190 	error = 0;
1191 	VM_OBJECT_WLOCK(object);
1192 	while ((backing_object = object->backing_object) != NULL) {
1193 		VM_OBJECT_WLOCK(backing_object);
1194 		offset += object->backing_object_offset;
1195 		VM_OBJECT_WUNLOCK(object);
1196 		object = backing_object;
1197 		if (object->size < OFF_TO_IDX(offset + size))
1198 			size = IDX_TO_OFF(object->size) - offset;
1199 	}
1200 	/*
1201 	 * Flush pages if writing is allowed, invalidate them
1202 	 * if invalidation requested.  Pages undergoing I/O
1203 	 * will be ignored by vm_object_page_remove().
1204 	 *
1205 	 * We cannot lock the vnode and then wait for paging
1206 	 * to complete without deadlocking against vm_fault.
1207 	 * Instead we simply call vm_object_page_remove() and
1208 	 * allow it to block internally on a page-by-page
1209 	 * basis when it encounters pages undergoing async
1210 	 * I/O.
1211 	 */
1212 	if (object->type == OBJT_VNODE &&
1213 	    vm_object_mightbedirty(object) != 0 &&
1214 	    ((vp = object->handle)->v_vflag & VV_NOSYNC) == 0) {
1215 		VM_OBJECT_WUNLOCK(object);
1216 		(void)vn_start_write(vp, &mp, V_WAIT);
1217 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1218 		if (syncio && !invalidate && offset == 0 &&
1219 		    atop(size) == object->size) {
1220 			/*
1221 			 * If syncing the whole mapping of the file,
1222 			 * it is faster to schedule all the writes in
1223 			 * async mode, also allowing the clustering,
1224 			 * and then wait for i/o to complete.
1225 			 */
1226 			flags = 0;
1227 			fsync_after = TRUE;
1228 		} else {
1229 			flags = (syncio || invalidate) ? OBJPC_SYNC : 0;
1230 			flags |= invalidate ? (OBJPC_SYNC | OBJPC_INVAL) : 0;
1231 			fsync_after = FALSE;
1232 		}
1233 		VM_OBJECT_WLOCK(object);
1234 		res = vm_object_page_clean(object, offset, offset + size,
1235 		    flags);
1236 		VM_OBJECT_WUNLOCK(object);
1237 		if (fsync_after) {
1238 			for (;;) {
1239 				error = VOP_FSYNC(vp, MNT_WAIT, curthread);
1240 				if (error != ERELOOKUP)
1241 					break;
1242 
1243 				/*
1244 				 * Allow SU/bufdaemon to handle more
1245 				 * dependencies in the meantime.
1246 				 */
1247 				VOP_UNLOCK(vp);
1248 				vn_finished_write(mp);
1249 
1250 				(void)vn_start_write(vp, &mp, V_WAIT);
1251 				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1252 			}
1253 		}
1254 		VOP_UNLOCK(vp);
1255 		vn_finished_write(mp);
1256 		if (error != 0)
1257 			res = FALSE;
1258 		VM_OBJECT_WLOCK(object);
1259 	}
1260 	if ((object->type == OBJT_VNODE ||
1261 	     object->type == OBJT_DEVICE) && invalidate) {
1262 		if (object->type == OBJT_DEVICE)
1263 			/*
1264 			 * The option OBJPR_NOTMAPPED must be passed here
1265 			 * because vm_object_page_remove() cannot remove
1266 			 * unmanaged mappings.
1267 			 */
1268 			flags = OBJPR_NOTMAPPED;
1269 		else if (old_msync)
1270 			flags = 0;
1271 		else
1272 			flags = OBJPR_CLEANONLY;
1273 		vm_object_page_remove(object, OFF_TO_IDX(offset),
1274 		    OFF_TO_IDX(offset + size + PAGE_MASK), flags);
1275 	}
1276 	VM_OBJECT_WUNLOCK(object);
1277 	return (res);
1278 }
1279 
1280 /*
1281  * Determine whether the given advice can be applied to the object.  Advice is
1282  * not applied to unmanaged pages since they never belong to page queues, and
1283  * since MADV_FREE is destructive, it can apply only to anonymous pages that
1284  * have been mapped at most once.
1285  */
1286 static bool
1287 vm_object_advice_applies(vm_object_t object, int advice)
1288 {
1289 
1290 	if ((object->flags & OBJ_UNMANAGED) != 0)
1291 		return (false);
1292 	if (advice != MADV_FREE)
1293 		return (true);
1294 	return ((object->flags & (OBJ_ONEMAPPING | OBJ_ANON)) ==
1295 	    (OBJ_ONEMAPPING | OBJ_ANON));
1296 }
1297 
1298 static void
1299 vm_object_madvise_freespace(vm_object_t object, int advice, vm_pindex_t pindex,
1300     vm_size_t size)
1301 {
1302 
1303 	if (advice == MADV_FREE)
1304 		vm_pager_freespace(object, pindex, size);
1305 }
1306 
1307 /*
1308  *	vm_object_madvise:
1309  *
1310  *	Implements the madvise function at the object/page level.
1311  *
1312  *	MADV_WILLNEED	(any object)
1313  *
1314  *	    Activate the specified pages if they are resident.
1315  *
1316  *	MADV_DONTNEED	(any object)
1317  *
1318  *	    Deactivate the specified pages if they are resident.
1319  *
1320  *	MADV_FREE	(OBJT_SWAP objects, OBJ_ONEMAPPING only)
1321  *
1322  *	    Deactivate and clean the specified pages if they are
1323  *	    resident.  This permits the process to reuse the pages
1324  *	    without faulting or the kernel to reclaim the pages
1325  *	    without I/O.
1326  */
1327 void
1328 vm_object_madvise(vm_object_t object, vm_pindex_t pindex, vm_pindex_t end,
1329     int advice)
1330 {
1331 	struct pctrie_iter pages;
1332 	vm_pindex_t tpindex;
1333 	vm_object_t backing_object, tobject;
1334 	vm_page_t m, tm;
1335 
1336 	if (object == NULL)
1337 		return;
1338 
1339 	vm_page_iter_init(&pages, object);
1340 relookup:
1341 	VM_OBJECT_WLOCK(object);
1342 	if (!vm_object_advice_applies(object, advice)) {
1343 		VM_OBJECT_WUNLOCK(object);
1344 		return;
1345 	}
1346 	for (m = vm_radix_iter_lookup_ge(&pages, pindex); pindex < end;
1347 	    pindex++) {
1348 		tobject = object;
1349 
1350 		/*
1351 		 * If the next page isn't resident in the top-level object, we
1352 		 * need to search the shadow chain.  When applying MADV_FREE, we
1353 		 * take care to release any swap space used to store
1354 		 * non-resident pages.
1355 		 */
1356 		if (m == NULL || pindex < m->pindex) {
1357 			/*
1358 			 * Optimize a common case: if the top-level object has
1359 			 * no backing object, we can skip over the non-resident
1360 			 * range in constant time.
1361 			 */
1362 			if (object->backing_object == NULL) {
1363 				tpindex = (m != NULL && m->pindex < end) ?
1364 				    m->pindex : end;
1365 				vm_object_madvise_freespace(object, advice,
1366 				    pindex, tpindex - pindex);
1367 				if ((pindex = tpindex) == end)
1368 					break;
1369 				goto next_page;
1370 			}
1371 
1372 			tpindex = pindex;
1373 			do {
1374 				vm_object_madvise_freespace(tobject, advice,
1375 				    tpindex, 1);
1376 				/*
1377 				 * Prepare to search the next object in the
1378 				 * chain.
1379 				 */
1380 				backing_object = tobject->backing_object;
1381 				if (backing_object == NULL)
1382 					goto next_pindex;
1383 				VM_OBJECT_WLOCK(backing_object);
1384 				tpindex +=
1385 				    OFF_TO_IDX(tobject->backing_object_offset);
1386 				if (tobject != object)
1387 					VM_OBJECT_WUNLOCK(tobject);
1388 				tobject = backing_object;
1389 				if (!vm_object_advice_applies(tobject, advice))
1390 					goto next_pindex;
1391 			} while ((tm = vm_page_lookup(tobject, tpindex)) ==
1392 			    NULL);
1393 		} else {
1394 next_page:
1395 			tm = m;
1396 			m = vm_radix_iter_step(&pages);
1397 		}
1398 
1399 		/*
1400 		 * If the page is not in a normal state, skip it.  The page
1401 		 * can not be invalidated while the object lock is held.
1402 		 */
1403 		if (!vm_page_all_valid(tm) || vm_page_wired(tm))
1404 			goto next_pindex;
1405 		KASSERT((tm->flags & PG_FICTITIOUS) == 0,
1406 		    ("vm_object_madvise: page %p is fictitious", tm));
1407 		KASSERT((tm->oflags & VPO_UNMANAGED) == 0,
1408 		    ("vm_object_madvise: page %p is not managed", tm));
1409 		if (vm_page_tryxbusy(tm) == 0) {
1410 			if (object != tobject)
1411 				VM_OBJECT_WUNLOCK(object);
1412 			if (advice == MADV_WILLNEED) {
1413 				/*
1414 				 * Reference the page before unlocking and
1415 				 * sleeping so that the page daemon is less
1416 				 * likely to reclaim it.
1417 				 */
1418 				vm_page_aflag_set(tm, PGA_REFERENCED);
1419 			}
1420 			if (!vm_page_busy_sleep(tm, "madvpo", 0))
1421 				VM_OBJECT_WUNLOCK(tobject);
1422 			pctrie_iter_reset(&pages);
1423   			goto relookup;
1424 		}
1425 		vm_page_advise(tm, advice);
1426 		vm_page_xunbusy(tm);
1427 		vm_object_madvise_freespace(tobject, advice, tm->pindex, 1);
1428 next_pindex:
1429 		if (tobject != object)
1430 			VM_OBJECT_WUNLOCK(tobject);
1431 	}
1432 	VM_OBJECT_WUNLOCK(object);
1433 }
1434 
1435 /*
1436  *	vm_object_shadow:
1437  *
1438  *	Create a new object which is backed by the
1439  *	specified existing object range.  The source
1440  *	object reference is deallocated.
1441  *
1442  *	The new object and offset into that object
1443  *	are returned in the source parameters.
1444  */
1445 void
1446 vm_object_shadow(vm_object_t *object, vm_ooffset_t *offset, vm_size_t length,
1447     struct ucred *cred, bool shared)
1448 {
1449 	vm_object_t source;
1450 	vm_object_t result;
1451 
1452 	source = *object;
1453 
1454 	/*
1455 	 * Don't create the new object if the old object isn't shared.
1456 	 *
1457 	 * If we hold the only reference we can guarantee that it won't
1458 	 * increase while we have the map locked.  Otherwise the race is
1459 	 * harmless and we will end up with an extra shadow object that
1460 	 * will be collapsed later.
1461 	 */
1462 	if (source != NULL && source->ref_count == 1 &&
1463 	    (source->flags & OBJ_ANON) != 0)
1464 		return;
1465 
1466 	/*
1467 	 * Allocate a new object with the given length.
1468 	 */
1469 	result = vm_object_allocate_anon(atop(length), source, cred, length);
1470 
1471 	/*
1472 	 * Store the offset into the source object, and fix up the offset into
1473 	 * the new object.
1474 	 */
1475 	result->backing_object_offset = *offset;
1476 
1477 	if (shared || source != NULL) {
1478 		VM_OBJECT_WLOCK(result);
1479 
1480 		/*
1481 		 * The new object shadows the source object, adding a
1482 		 * reference to it.  Our caller changes his reference
1483 		 * to point to the new object, removing a reference to
1484 		 * the source object.  Net result: no change of
1485 		 * reference count, unless the caller needs to add one
1486 		 * more reference due to forking a shared map entry.
1487 		 */
1488 		if (shared) {
1489 			vm_object_reference_locked(result);
1490 			vm_object_clear_flag(result, OBJ_ONEMAPPING);
1491 		}
1492 
1493 		/*
1494 		 * Try to optimize the result object's page color when
1495 		 * shadowing in order to maintain page coloring
1496 		 * consistency in the combined shadowed object.
1497 		 */
1498 		if (source != NULL) {
1499 			vm_object_backing_insert(result, source);
1500 			result->domain = source->domain;
1501 #if VM_NRESERVLEVEL > 0
1502 			vm_object_set_flag(result,
1503 			    (source->flags & OBJ_COLORED));
1504 			result->pg_color = (source->pg_color +
1505 			    OFF_TO_IDX(*offset)) & ((1 << (VM_NFREEORDER -
1506 			    1)) - 1);
1507 #endif
1508 		}
1509 		VM_OBJECT_WUNLOCK(result);
1510 	}
1511 
1512 	/*
1513 	 * Return the new things
1514 	 */
1515 	*offset = 0;
1516 	*object = result;
1517 }
1518 
1519 /*
1520  *	vm_object_split:
1521  *
1522  * Split the pages in a map entry into a new object.  This affords
1523  * easier removal of unused pages, and keeps object inheritance from
1524  * being a negative impact on memory usage.
1525  */
1526 void
1527 vm_object_split(vm_map_entry_t entry)
1528 {
1529 	struct pctrie_iter pages;
1530 	vm_page_t m;
1531 	vm_object_t orig_object, new_object, backing_object;
1532 	vm_pindex_t offidxstart;
1533 	vm_size_t size;
1534 
1535 	orig_object = entry->object.vm_object;
1536 	KASSERT((orig_object->flags & OBJ_ONEMAPPING) != 0,
1537 	    ("vm_object_split:  Splitting object with multiple mappings."));
1538 	if ((orig_object->flags & OBJ_ANON) == 0)
1539 		return;
1540 	if (orig_object->ref_count <= 1)
1541 		return;
1542 	VM_OBJECT_WUNLOCK(orig_object);
1543 
1544 	offidxstart = OFF_TO_IDX(entry->offset);
1545 	size = atop(entry->end - entry->start);
1546 
1547 	new_object = vm_object_allocate_anon(size, orig_object,
1548 	    orig_object->cred, ptoa(size));
1549 
1550 	/*
1551 	 * We must wait for the orig_object to complete any in-progress
1552 	 * collapse so that the swap blocks are stable below.  The
1553 	 * additional reference on backing_object by new object will
1554 	 * prevent further collapse operations until split completes.
1555 	 */
1556 	VM_OBJECT_WLOCK(orig_object);
1557 	vm_object_collapse_wait(orig_object);
1558 
1559 	/*
1560 	 * At this point, the new object is still private, so the order in
1561 	 * which the original and new objects are locked does not matter.
1562 	 */
1563 	VM_OBJECT_WLOCK(new_object);
1564 	new_object->domain = orig_object->domain;
1565 	backing_object = orig_object->backing_object;
1566 	if (backing_object != NULL) {
1567 		vm_object_backing_insert_ref(new_object, backing_object);
1568 		new_object->backing_object_offset =
1569 		    orig_object->backing_object_offset + entry->offset;
1570 	}
1571 	if (orig_object->cred != NULL) {
1572 		crhold(orig_object->cred);
1573 		KASSERT(orig_object->charge >= ptoa(size),
1574 		    ("orig_object->charge < 0"));
1575 		orig_object->charge -= ptoa(size);
1576 	}
1577 
1578 	/*
1579 	 * Mark the split operation so that swap_pager_getpages() knows
1580 	 * that the object is in transition.
1581 	 */
1582 	vm_object_set_flag(orig_object, OBJ_SPLIT);
1583 	vm_page_iter_limit_init(&pages, orig_object, offidxstart + size);
1584 retry:
1585 	KASSERT(pctrie_iter_is_reset(&pages),
1586 	    ("%s: pctrie_iter not reset for retry", __func__));
1587 	for (m = vm_radix_iter_lookup_ge(&pages, offidxstart); m != NULL;
1588 	    m = vm_radix_iter_step(&pages)) {
1589 		/*
1590 		 * We must wait for pending I/O to complete before we can
1591 		 * rename the page.
1592 		 *
1593 		 * We do not have to VM_PROT_NONE the page as mappings should
1594 		 * not be changed by this operation.
1595 		 */
1596 		if (vm_page_tryxbusy(m) == 0) {
1597 			VM_OBJECT_WUNLOCK(new_object);
1598 			if (vm_page_busy_sleep(m, "spltwt", 0))
1599 				VM_OBJECT_WLOCK(orig_object);
1600 			pctrie_iter_reset(&pages);
1601 			VM_OBJECT_WLOCK(new_object);
1602 			goto retry;
1603 		}
1604 
1605 		/*
1606 		 * If the page was left invalid, it was likely placed there by
1607 		 * an incomplete fault.  Just remove and ignore.
1608 		 *
1609 		 * One other possibility is that the map entry is wired, in
1610 		 * which case we must hang on to the page to avoid leaking it,
1611 		 * as the map entry owns the wiring.  This case can arise if the
1612 		 * backing object is truncated by the pager.
1613 		 */
1614 		if (vm_page_none_valid(m) && entry->wired_count == 0) {
1615 			if (vm_page_iter_remove(&pages, m))
1616 				vm_page_free(m);
1617 			continue;
1618 		}
1619 
1620 		/* vm_page_iter_rename() will dirty the page if it is valid. */
1621 		if (!vm_page_iter_rename(&pages, m, new_object, m->pindex -
1622 		    offidxstart)) {
1623 			vm_page_xunbusy(m);
1624 			VM_OBJECT_WUNLOCK(new_object);
1625 			VM_OBJECT_WUNLOCK(orig_object);
1626 			vm_radix_wait();
1627 			pctrie_iter_reset(&pages);
1628 			VM_OBJECT_WLOCK(orig_object);
1629 			VM_OBJECT_WLOCK(new_object);
1630 			goto retry;
1631 		}
1632 
1633 #if VM_NRESERVLEVEL > 0
1634 		/*
1635 		 * If some of the reservation's allocated pages remain with
1636 		 * the original object, then transferring the reservation to
1637 		 * the new object is neither particularly beneficial nor
1638 		 * particularly harmful as compared to leaving the reservation
1639 		 * with the original object.  If, however, all of the
1640 		 * reservation's allocated pages are transferred to the new
1641 		 * object, then transferring the reservation is typically
1642 		 * beneficial.  Determining which of these two cases applies
1643 		 * would be more costly than unconditionally renaming the
1644 		 * reservation.
1645 		 */
1646 		vm_reserv_rename(m, new_object, orig_object, offidxstart);
1647 #endif
1648 	}
1649 
1650 	/*
1651 	 * swap_pager_copy() can sleep, in which case the orig_object's
1652 	 * and new_object's locks are released and reacquired.
1653 	 */
1654 	swap_pager_copy(orig_object, new_object, offidxstart, 0);
1655 	vm_page_iter_init(&pages, new_object);
1656 	VM_RADIX_FOREACH(m, &pages)
1657 		vm_page_xunbusy(m);
1658 
1659 	vm_object_clear_flag(orig_object, OBJ_SPLIT);
1660 	VM_OBJECT_WUNLOCK(orig_object);
1661 	VM_OBJECT_WUNLOCK(new_object);
1662 	entry->object.vm_object = new_object;
1663 	entry->offset = 0LL;
1664 	vm_object_deallocate(orig_object);
1665 	VM_OBJECT_WLOCK(new_object);
1666 }
1667 
1668 static vm_page_t
1669 vm_object_collapse_scan_wait(struct pctrie_iter *pages, vm_object_t object,
1670     vm_page_t p)
1671 {
1672 	vm_object_t backing_object;
1673 
1674 	VM_OBJECT_ASSERT_WLOCKED(object);
1675 	backing_object = object->backing_object;
1676 	VM_OBJECT_ASSERT_WLOCKED(backing_object);
1677 
1678 	KASSERT(p == NULL || p->object == object || p->object == backing_object,
1679 	    ("invalid ownership %p %p %p", p, object, backing_object));
1680 	/* The page is only NULL when rename fails. */
1681 	if (p == NULL) {
1682 		VM_OBJECT_WUNLOCK(object);
1683 		VM_OBJECT_WUNLOCK(backing_object);
1684 		vm_radix_wait();
1685 		VM_OBJECT_WLOCK(object);
1686 	} else if (p->object == object) {
1687 		VM_OBJECT_WUNLOCK(backing_object);
1688 		if (vm_page_busy_sleep(p, "vmocol", 0))
1689 			VM_OBJECT_WLOCK(object);
1690 	} else {
1691 		VM_OBJECT_WUNLOCK(object);
1692 		if (!vm_page_busy_sleep(p, "vmocol", 0))
1693 			VM_OBJECT_WUNLOCK(backing_object);
1694 		VM_OBJECT_WLOCK(object);
1695 	}
1696 	VM_OBJECT_WLOCK(backing_object);
1697 	vm_page_iter_init(pages, backing_object);
1698 	return (vm_radix_iter_lookup_ge(pages, 0));
1699 }
1700 
1701 static void
1702 vm_object_collapse_scan(vm_object_t object)
1703 {
1704 	struct pctrie_iter pages;
1705 	vm_object_t backing_object;
1706 	vm_page_t next, p, pp;
1707 	vm_pindex_t backing_offset_index, new_pindex;
1708 
1709 	VM_OBJECT_ASSERT_WLOCKED(object);
1710 	VM_OBJECT_ASSERT_WLOCKED(object->backing_object);
1711 
1712 	backing_object = object->backing_object;
1713 	backing_offset_index = OFF_TO_IDX(object->backing_object_offset);
1714 
1715 	/*
1716 	 * Our scan
1717 	 */
1718 	vm_page_iter_init(&pages, backing_object);
1719 	for (p = vm_radix_iter_lookup_ge(&pages, 0); p != NULL; p = next) {
1720 		/*
1721 		 * Check for busy page
1722 		 */
1723 		if (vm_page_tryxbusy(p) == 0) {
1724 			next = vm_object_collapse_scan_wait(&pages, object, p);
1725 			continue;
1726 		}
1727 
1728 		KASSERT(object->backing_object == backing_object,
1729 		    ("vm_object_collapse_scan: backing object mismatch %p != %p",
1730 		    object->backing_object, backing_object));
1731 		KASSERT(p->object == backing_object,
1732 		    ("vm_object_collapse_scan: object mismatch %p != %p",
1733 		    p->object, backing_object));
1734 
1735 		if (p->pindex < backing_offset_index || object->size <=
1736 		    (new_pindex = p->pindex - backing_offset_index)) {
1737 			vm_pager_freespace(backing_object, p->pindex, 1);
1738 
1739 			KASSERT(!pmap_page_is_mapped(p),
1740 			    ("freeing mapped page %p", p));
1741 			if (vm_page_iter_remove(&pages, p))
1742 				vm_page_free(p);
1743 			next = vm_radix_iter_step(&pages);
1744 			continue;
1745 		}
1746 
1747 		if (!vm_page_all_valid(p)) {
1748 			KASSERT(!pmap_page_is_mapped(p),
1749 			    ("freeing mapped page %p", p));
1750 			if (vm_page_iter_remove(&pages, p))
1751 				vm_page_free(p);
1752 			next = vm_radix_iter_step(&pages);
1753 			continue;
1754 		}
1755 
1756 		pp = vm_page_lookup(object, new_pindex);
1757 		if (pp != NULL && vm_page_tryxbusy(pp) == 0) {
1758 			vm_page_xunbusy(p);
1759 			/*
1760 			 * The page in the parent is busy and possibly not
1761 			 * (yet) valid.  Until its state is finalized by the
1762 			 * busy bit owner, we can't tell whether it shadows the
1763 			 * original page.
1764 			 */
1765 			next = vm_object_collapse_scan_wait(&pages, object, pp);
1766 			continue;
1767 		}
1768 
1769 		if (pp != NULL && vm_page_none_valid(pp)) {
1770 			/*
1771 			 * The page was invalid in the parent.  Likely placed
1772 			 * there by an incomplete fault.  Just remove and
1773 			 * ignore.  p can replace it.
1774 			 */
1775 			if (vm_page_remove(pp))
1776 				vm_page_free(pp);
1777 			pp = NULL;
1778 		}
1779 
1780 		if (pp != NULL || vm_pager_has_page(object, new_pindex, NULL,
1781 			NULL)) {
1782 			/*
1783 			 * The page already exists in the parent OR swap exists
1784 			 * for this location in the parent.  Leave the parent's
1785 			 * page alone.  Destroy the original page from the
1786 			 * backing object.
1787 			 */
1788 			vm_pager_freespace(backing_object, p->pindex, 1);
1789 			KASSERT(!pmap_page_is_mapped(p),
1790 			    ("freeing mapped page %p", p));
1791 			if (pp != NULL)
1792 				vm_page_xunbusy(pp);
1793 			if (vm_page_iter_remove(&pages, p))
1794 				vm_page_free(p);
1795 			next = vm_radix_iter_step(&pages);
1796 			continue;
1797 		}
1798 
1799 		/*
1800 		 * Page does not exist in parent, rename the page from the
1801 		 * backing object to the main object.
1802 		 *
1803 		 * If the page was mapped to a process, it can remain mapped
1804 		 * through the rename.  vm_page_iter_rename() will dirty the
1805 		 * page.
1806 		 */
1807 		if (!vm_page_iter_rename(&pages, p, object, new_pindex)) {
1808 			vm_page_xunbusy(p);
1809 			next = vm_object_collapse_scan_wait(&pages, object,
1810 			    NULL);
1811 			continue;
1812 		}
1813 
1814 		/* Use the old pindex to free the right page. */
1815 		vm_pager_freespace(backing_object, new_pindex +
1816 		    backing_offset_index, 1);
1817 
1818 #if VM_NRESERVLEVEL > 0
1819 		/*
1820 		 * Rename the reservation.
1821 		 */
1822 		vm_reserv_rename(p, object, backing_object,
1823 		    backing_offset_index);
1824 #endif
1825 		vm_page_xunbusy(p);
1826 		next = vm_radix_iter_step(&pages);
1827 	}
1828 	return;
1829 }
1830 
1831 /*
1832  *	vm_object_collapse:
1833  *
1834  *	Collapse an object with the object backing it.
1835  *	Pages in the backing object are moved into the
1836  *	parent, and the backing object is deallocated.
1837  */
1838 void
1839 vm_object_collapse(vm_object_t object)
1840 {
1841 	vm_object_t backing_object, new_backing_object;
1842 
1843 	VM_OBJECT_ASSERT_WLOCKED(object);
1844 
1845 	while (TRUE) {
1846 		KASSERT((object->flags & (OBJ_DEAD | OBJ_ANON)) == OBJ_ANON,
1847 		    ("collapsing invalid object"));
1848 
1849 		/*
1850 		 * Wait for the backing_object to finish any pending
1851 		 * collapse so that the caller sees the shortest possible
1852 		 * shadow chain.
1853 		 */
1854 		backing_object = vm_object_backing_collapse_wait(object);
1855 		if (backing_object == NULL)
1856 			return;
1857 
1858 		KASSERT(object->ref_count > 0 &&
1859 		    object->ref_count > atomic_load_int(&object->shadow_count),
1860 		    ("collapse with invalid ref %d or shadow %d count.",
1861 		    object->ref_count, atomic_load_int(&object->shadow_count)));
1862 		KASSERT((backing_object->flags &
1863 		    (OBJ_COLLAPSING | OBJ_DEAD)) == 0,
1864 		    ("vm_object_collapse: Backing object already collapsing."));
1865 		KASSERT((object->flags & (OBJ_COLLAPSING | OBJ_DEAD)) == 0,
1866 		    ("vm_object_collapse: object is already collapsing."));
1867 
1868 		/*
1869 		 * We know that we can either collapse the backing object if
1870 		 * the parent is the only reference to it, or (perhaps) have
1871 		 * the parent bypass the object if the parent happens to shadow
1872 		 * all the resident pages in the entire backing object.
1873 		 */
1874 		if (backing_object->ref_count == 1) {
1875 			KASSERT(atomic_load_int(&backing_object->shadow_count)
1876 			    == 1,
1877 			    ("vm_object_collapse: shadow_count: %d",
1878 			    atomic_load_int(&backing_object->shadow_count)));
1879 			vm_object_pip_add(object, 1);
1880 			vm_object_set_flag(object, OBJ_COLLAPSING);
1881 			vm_object_pip_add(backing_object, 1);
1882 			vm_object_set_flag(backing_object, OBJ_DEAD);
1883 
1884 			/*
1885 			 * If there is exactly one reference to the backing
1886 			 * object, we can collapse it into the parent.
1887 			 */
1888 			vm_object_collapse_scan(object);
1889 
1890 			/*
1891 			 * Move the pager from backing_object to object.
1892 			 *
1893 			 * swap_pager_copy() can sleep, in which case the
1894 			 * backing_object's and object's locks are released and
1895 			 * reacquired.
1896 			 */
1897 			swap_pager_copy(backing_object, object,
1898 			    OFF_TO_IDX(object->backing_object_offset), TRUE);
1899 
1900 			/*
1901 			 * Object now shadows whatever backing_object did.
1902 			 */
1903 			vm_object_clear_flag(object, OBJ_COLLAPSING);
1904 			vm_object_backing_transfer(object, backing_object);
1905 			object->backing_object_offset +=
1906 			    backing_object->backing_object_offset;
1907 			VM_OBJECT_WUNLOCK(object);
1908 			vm_object_pip_wakeup(object);
1909 
1910 			/*
1911 			 * Discard backing_object.
1912 			 *
1913 			 * Since the backing object has no pages, no pager left,
1914 			 * and no object references within it, all that is
1915 			 * necessary is to dispose of it.
1916 			 */
1917 			KASSERT(backing_object->ref_count == 1, (
1918 "backing_object %p was somehow re-referenced during collapse!",
1919 			    backing_object));
1920 			vm_object_pip_wakeup(backing_object);
1921 			(void)refcount_release(&backing_object->ref_count);
1922 			umtx_shm_object_terminated(backing_object);
1923 			vm_object_terminate(backing_object);
1924 			counter_u64_add(object_collapses, 1);
1925 			VM_OBJECT_WLOCK(object);
1926 		} else {
1927 			/*
1928 			 * If we do not entirely shadow the backing object,
1929 			 * there is nothing we can do so we give up.
1930 			 *
1931 			 * The object lock and backing_object lock must not
1932 			 * be dropped during this sequence.
1933 			 */
1934 			if (!swap_pager_scan_all_shadowed(object)) {
1935 				VM_OBJECT_WUNLOCK(backing_object);
1936 				break;
1937 			}
1938 
1939 			/*
1940 			 * Make the parent shadow the next object in the
1941 			 * chain.  Deallocating backing_object will not remove
1942 			 * it, since its reference count is at least 2.
1943 			 */
1944 			vm_object_backing_remove_locked(object);
1945 			new_backing_object = backing_object->backing_object;
1946 			if (new_backing_object != NULL) {
1947 				vm_object_backing_insert_ref(object,
1948 				    new_backing_object);
1949 				object->backing_object_offset +=
1950 				    backing_object->backing_object_offset;
1951 			}
1952 
1953 			/*
1954 			 * Drop the reference count on backing_object. Since
1955 			 * its ref_count was at least 2, it will not vanish.
1956 			 */
1957 			(void)refcount_release(&backing_object->ref_count);
1958 			KASSERT(backing_object->ref_count >= 1, (
1959 "backing_object %p was somehow dereferenced during collapse!",
1960 			    backing_object));
1961 			VM_OBJECT_WUNLOCK(backing_object);
1962 			counter_u64_add(object_bypasses, 1);
1963 		}
1964 
1965 		/*
1966 		 * Try again with this object's new backing object.
1967 		 */
1968 	}
1969 }
1970 
1971 /*
1972  *	vm_object_page_remove:
1973  *
1974  *	For the given object, either frees or invalidates each of the
1975  *	specified pages.  In general, a page is freed.  However, if a page is
1976  *	wired for any reason other than the existence of a managed, wired
1977  *	mapping, then it may be invalidated but not removed from the object.
1978  *	Pages are specified by the given range ["start", "end") and the option
1979  *	OBJPR_CLEANONLY.  As a special case, if "end" is zero, then the range
1980  *	extends from "start" to the end of the object.  If the option
1981  *	OBJPR_CLEANONLY is specified, then only the non-dirty pages within the
1982  *	specified range are affected.  If the option OBJPR_NOTMAPPED is
1983  *	specified, then the pages within the specified range must have no
1984  *	mappings.  Otherwise, if this option is not specified, any mappings to
1985  *	the specified pages are removed before the pages are freed or
1986  *	invalidated.
1987  *
1988  *	In general, this operation should only be performed on objects that
1989  *	contain managed pages.  There are, however, two exceptions.  First, it
1990  *	is performed on the kernel and kmem objects by vm_map_entry_delete().
1991  *	Second, it is used by msync(..., MS_INVALIDATE) to invalidate device-
1992  *	backed pages.  In both of these cases, the option OBJPR_CLEANONLY must
1993  *	not be specified and the option OBJPR_NOTMAPPED must be specified.
1994  *
1995  *	The object must be locked.
1996  */
1997 void
1998 vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
1999     int options)
2000 {
2001 	struct pctrie_iter pages;
2002 	vm_page_t p;
2003 
2004 	VM_OBJECT_ASSERT_WLOCKED(object);
2005 	KASSERT((object->flags & OBJ_UNMANAGED) == 0 ||
2006 	    (options & (OBJPR_CLEANONLY | OBJPR_NOTMAPPED)) == OBJPR_NOTMAPPED,
2007 	    ("vm_object_page_remove: illegal options for object %p", object));
2008 	if (object->resident_page_count == 0)
2009 		return;
2010 	vm_object_pip_add(object, 1);
2011 	vm_page_iter_limit_init(&pages, object, end);
2012 again:
2013 	KASSERT(pctrie_iter_is_reset(&pages),
2014 	    ("%s: pctrie_iter not reset for retry", __func__));
2015 	for (p = vm_radix_iter_lookup_ge(&pages, start); p != NULL;
2016 	     p = vm_radix_iter_step(&pages)) {
2017 		/*
2018 		 * Skip invalid pages if asked to do so.  Try to avoid acquiring
2019 		 * the busy lock, as some consumers rely on this to avoid
2020 		 * deadlocks.
2021 		 *
2022 		 * A thread may concurrently transition the page from invalid to
2023 		 * valid using only the busy lock, so the result of this check
2024 		 * is immediately stale.  It is up to consumers to handle this,
2025 		 * for instance by ensuring that all invalid->valid transitions
2026 		 * happen with a mutex held, as may be possible for a
2027 		 * filesystem.
2028 		 */
2029 		if ((options & OBJPR_VALIDONLY) != 0 && vm_page_none_valid(p))
2030 			continue;
2031 
2032 		/*
2033 		 * If the page is wired for any reason besides the existence
2034 		 * of managed, wired mappings, then it cannot be freed.  For
2035 		 * example, fictitious pages, which represent device memory,
2036 		 * are inherently wired and cannot be freed.  They can,
2037 		 * however, be invalidated if the option OBJPR_CLEANONLY is
2038 		 * not specified.
2039 		 */
2040 		if (vm_page_tryxbusy(p) == 0) {
2041 			if (vm_page_busy_sleep(p, "vmopar", 0))
2042 				VM_OBJECT_WLOCK(object);
2043 			pctrie_iter_reset(&pages);
2044 			goto again;
2045 		}
2046 		if ((options & OBJPR_VALIDONLY) != 0 && vm_page_none_valid(p)) {
2047 			vm_page_xunbusy(p);
2048 			continue;
2049 		}
2050 		if (vm_page_wired(p)) {
2051 wired:
2052 			if ((options & OBJPR_NOTMAPPED) == 0 &&
2053 			    object->ref_count != 0)
2054 				pmap_remove_all(p);
2055 			if ((options & OBJPR_CLEANONLY) == 0) {
2056 				vm_page_invalid(p);
2057 				vm_page_undirty(p);
2058 			}
2059 			vm_page_xunbusy(p);
2060 			continue;
2061 		}
2062 		KASSERT((p->flags & PG_FICTITIOUS) == 0,
2063 		    ("vm_object_page_remove: page %p is fictitious", p));
2064 		if ((options & OBJPR_CLEANONLY) != 0 &&
2065 		    !vm_page_none_valid(p)) {
2066 			if ((options & OBJPR_NOTMAPPED) == 0 &&
2067 			    object->ref_count != 0 &&
2068 			    !vm_page_try_remove_write(p))
2069 				goto wired;
2070 			if (p->dirty != 0) {
2071 				vm_page_xunbusy(p);
2072 				continue;
2073 			}
2074 		}
2075 		if ((options & OBJPR_NOTMAPPED) == 0 &&
2076 		    object->ref_count != 0 && !vm_page_try_remove_all(p))
2077 			goto wired;
2078 		vm_page_iter_free(&pages, p);
2079 	}
2080 	vm_object_pip_wakeup(object);
2081 
2082 	vm_pager_freespace(object, start, (end == 0 ? object->size : end) -
2083 	    start);
2084 }
2085 
2086 /*
2087  *	vm_object_page_noreuse:
2088  *
2089  *	For the given object, attempt to move the specified pages to
2090  *	the head of the inactive queue.  This bypasses regular LRU
2091  *	operation and allows the pages to be reused quickly under memory
2092  *	pressure.  If a page is wired for any reason, then it will not
2093  *	be queued.  Pages are specified by the range ["start", "end").
2094  *	As a special case, if "end" is zero, then the range extends from
2095  *	"start" to the end of the object.
2096  *
2097  *	This operation should only be performed on objects that
2098  *	contain non-fictitious, managed pages.
2099  *
2100  *	The object must be locked.
2101  */
2102 void
2103 vm_object_page_noreuse(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
2104 {
2105 	struct pctrie_iter pages;
2106 	vm_page_t p;
2107 
2108 	VM_OBJECT_ASSERT_LOCKED(object);
2109 	KASSERT((object->flags & (OBJ_FICTITIOUS | OBJ_UNMANAGED)) == 0,
2110 	    ("vm_object_page_noreuse: illegal object %p", object));
2111 	if (object->resident_page_count == 0)
2112 		return;
2113 
2114 	vm_page_iter_limit_init(&pages, object, end);
2115 	VM_RADIX_FOREACH_FROM(p, &pages, start)
2116 		vm_page_deactivate_noreuse(p);
2117 }
2118 
2119 /*
2120  *	Populate the specified range of the object with valid pages.  Returns
2121  *	TRUE if the range is successfully populated and FALSE otherwise.
2122  *
2123  *	Note: This function should be optimized to pass a larger array of
2124  *	pages to vm_pager_get_pages() before it is applied to a non-
2125  *	OBJT_DEVICE object.
2126  *
2127  *	The object must be locked.
2128  */
2129 boolean_t
2130 vm_object_populate(vm_object_t object, vm_pindex_t start, vm_pindex_t end)
2131 {
2132 	struct pctrie_iter pages;
2133 	vm_page_t m;
2134 	vm_pindex_t pindex;
2135 	int rv;
2136 
2137 	vm_page_iter_init(&pages, object);
2138 	VM_OBJECT_ASSERT_WLOCKED(object);
2139 	for (pindex = start; pindex < end; pindex++) {
2140 		rv = vm_page_grab_valid_iter(&m, object, &pages, pindex,
2141 		    VM_ALLOC_NORMAL);
2142 		if (rv != VM_PAGER_OK)
2143 			break;
2144 
2145 		/*
2146 		 * Keep "m" busy because a subsequent iteration may unlock
2147 		 * the object.
2148 		 */
2149 	}
2150 	if (pindex > start) {
2151 		pages.limit = pindex;
2152 		VM_RADIX_FORALL_FROM(m, &pages, start)
2153 			vm_page_xunbusy(m);
2154 	}
2155 	return (pindex == end);
2156 }
2157 
2158 /*
2159  *	Routine:	vm_object_coalesce
2160  *	Function:	Coalesces two objects backing up adjoining
2161  *			regions of memory into a single object.
2162  *
2163  *	returns TRUE if objects were combined.
2164  *
2165  *	NOTE:	Only works at the moment if the second object is NULL -
2166  *		if it's not, which object do we lock first?
2167  *
2168  *	Parameters:
2169  *		prev_object	First object to coalesce
2170  *		prev_offset	Offset into prev_object
2171  *		prev_size	Size of reference to prev_object
2172  *		next_size	Size of reference to the second object
2173  *		reserved	Indicator that extension region has
2174  *				swap accounted for
2175  *
2176  *	Conditions:
2177  *	The object must *not* be locked.
2178  */
2179 boolean_t
2180 vm_object_coalesce(vm_object_t prev_object, vm_ooffset_t prev_offset,
2181     vm_size_t prev_size, vm_size_t next_size, boolean_t reserved)
2182 {
2183 	vm_pindex_t next_pindex;
2184 
2185 	if (prev_object == NULL)
2186 		return (TRUE);
2187 	if ((prev_object->flags & OBJ_ANON) == 0)
2188 		return (FALSE);
2189 
2190 	VM_OBJECT_WLOCK(prev_object);
2191 	/*
2192 	 * Try to collapse the object first.
2193 	 */
2194 	vm_object_collapse(prev_object);
2195 
2196 	/*
2197 	 * Can't coalesce if: . more than one reference . paged out . shadows
2198 	 * another object . has a copy elsewhere (any of which mean that the
2199 	 * pages not mapped to prev_entry may be in use anyway)
2200 	 */
2201 	if (prev_object->backing_object != NULL) {
2202 		VM_OBJECT_WUNLOCK(prev_object);
2203 		return (FALSE);
2204 	}
2205 
2206 	prev_size >>= PAGE_SHIFT;
2207 	next_size >>= PAGE_SHIFT;
2208 	next_pindex = OFF_TO_IDX(prev_offset) + prev_size;
2209 
2210 	if (prev_object->ref_count > 1 &&
2211 	    prev_object->size != next_pindex &&
2212 	    (prev_object->flags & OBJ_ONEMAPPING) == 0) {
2213 		VM_OBJECT_WUNLOCK(prev_object);
2214 		return (FALSE);
2215 	}
2216 
2217 	/*
2218 	 * Account for the charge.
2219 	 */
2220 	if (prev_object->cred != NULL) {
2221 		/*
2222 		 * If prev_object was charged, then this mapping,
2223 		 * although not charged now, may become writable
2224 		 * later. Non-NULL cred in the object would prevent
2225 		 * swap reservation during enabling of the write
2226 		 * access, so reserve swap now. Failed reservation
2227 		 * cause allocation of the separate object for the map
2228 		 * entry, and swap reservation for this entry is
2229 		 * managed in appropriate time.
2230 		 */
2231 		if (!reserved && !swap_reserve_by_cred(ptoa(next_size),
2232 		    prev_object->cred)) {
2233 			VM_OBJECT_WUNLOCK(prev_object);
2234 			return (FALSE);
2235 		}
2236 		prev_object->charge += ptoa(next_size);
2237 	}
2238 
2239 	/*
2240 	 * Remove any pages that may still be in the object from a previous
2241 	 * deallocation.
2242 	 */
2243 	if (next_pindex < prev_object->size) {
2244 		vm_object_page_remove(prev_object, next_pindex, next_pindex +
2245 		    next_size, 0);
2246 #if 0
2247 		if (prev_object->cred != NULL) {
2248 			KASSERT(prev_object->charge >=
2249 			    ptoa(prev_object->size - next_pindex),
2250 			    ("object %p overcharged 1 %jx %jx", prev_object,
2251 				(uintmax_t)next_pindex, (uintmax_t)next_size));
2252 			prev_object->charge -= ptoa(prev_object->size -
2253 			    next_pindex);
2254 		}
2255 #endif
2256 	}
2257 
2258 	/*
2259 	 * Extend the object if necessary.
2260 	 */
2261 	if (next_pindex + next_size > prev_object->size)
2262 		prev_object->size = next_pindex + next_size;
2263 
2264 	VM_OBJECT_WUNLOCK(prev_object);
2265 	return (TRUE);
2266 }
2267 
2268 /*
2269  * Fill in the m_dst array with up to *rbehind optional pages before m_src[0]
2270  * and up to *rahead optional pages after m_src[count - 1].  In both cases, stop
2271  * the filling-in short on encountering a cached page, an object boundary limit,
2272  * or an allocation error.  Update *rbehind and *rahead to indicate the number
2273  * of pages allocated.  Copy elements of m_src into array elements from
2274  * m_dst[*rbehind] to m_dst[*rbehind + count -1].
2275  */
2276 void
2277 vm_object_prepare_buf_pages(vm_object_t object, vm_page_t *ma_dst, int count,
2278     int *rbehind, int *rahead, vm_page_t *ma_src)
2279 {
2280 	struct pctrie_iter pages;
2281 	vm_pindex_t pindex;
2282 	vm_page_t m, mpred, msucc;
2283 
2284 	vm_page_iter_init(&pages, object);
2285 	VM_OBJECT_ASSERT_LOCKED(object);
2286 	if (*rbehind != 0) {
2287 		m = ma_src[0];
2288 		pindex = m->pindex;
2289 		mpred = vm_radix_iter_lookup_lt(&pages, pindex);
2290 		*rbehind = MIN(*rbehind,
2291 		    pindex - (mpred != NULL ? mpred->pindex + 1 : 0));
2292 		/* Stepping backward from pindex, mpred doesn't change. */
2293 		for (int i = 0; i < *rbehind; i++) {
2294 			m = vm_page_alloc_after(object, &pages, pindex - i - 1,
2295 			    VM_ALLOC_NORMAL, mpred);
2296 			if (m == NULL) {
2297 				/* Shift the array. */
2298 				for (int j = 0; j < i; j++)
2299 					ma_dst[j] = ma_dst[j + *rbehind - i];
2300 				*rbehind = i;
2301 				*rahead = 0;
2302 				break;
2303 			}
2304 			ma_dst[*rbehind - i - 1] = m;
2305 		}
2306 	}
2307 	for (int i = 0; i < count; i++)
2308 		ma_dst[*rbehind + i] = ma_src[i];
2309 	if (*rahead != 0) {
2310 		m = ma_src[count - 1];
2311 		pindex = m->pindex + 1;
2312 		msucc = vm_radix_iter_lookup_ge(&pages, pindex);
2313 		*rahead = MIN(*rahead,
2314 		    (msucc != NULL ? msucc->pindex : object->size) - pindex);
2315 		mpred = m;
2316 		for (int i = 0; i < *rahead; i++) {
2317 			m = vm_page_alloc_after(object, &pages, pindex + i,
2318 			    VM_ALLOC_NORMAL, mpred);
2319 			if (m == NULL) {
2320 				*rahead = i;
2321 				break;
2322 			}
2323 			ma_dst[*rbehind + count + i] = mpred = m;
2324 		}
2325 	}
2326 }
2327 
2328 void
2329 vm_object_set_writeable_dirty_(vm_object_t object)
2330 {
2331 	atomic_add_int(&object->generation, 1);
2332 }
2333 
2334 bool
2335 vm_object_mightbedirty_(vm_object_t object)
2336 {
2337 	return (object->generation != object->cleangeneration);
2338 }
2339 
2340 /*
2341  *	vm_object_unwire:
2342  *
2343  *	For each page offset within the specified range of the given object,
2344  *	find the highest-level page in the shadow chain and unwire it.  A page
2345  *	must exist at every page offset, and the highest-level page must be
2346  *	wired.
2347  */
2348 void
2349 vm_object_unwire(vm_object_t object, vm_ooffset_t offset, vm_size_t length,
2350     uint8_t queue)
2351 {
2352 	struct pctrie_iter pages;
2353 	vm_object_t tobject, t1object;
2354 	vm_page_t m, tm;
2355 	vm_pindex_t end_pindex, pindex, tpindex;
2356 	int depth, locked_depth;
2357 
2358 	KASSERT((offset & PAGE_MASK) == 0,
2359 	    ("vm_object_unwire: offset is not page aligned"));
2360 	KASSERT((length & PAGE_MASK) == 0,
2361 	    ("vm_object_unwire: length is not a multiple of PAGE_SIZE"));
2362 	/* The wired count of a fictitious page never changes. */
2363 	if ((object->flags & OBJ_FICTITIOUS) != 0)
2364 		return;
2365 	pindex = OFF_TO_IDX(offset);
2366 	end_pindex = pindex + atop(length);
2367 	vm_page_iter_init(&pages, object);
2368 again:
2369 	locked_depth = 1;
2370 	VM_OBJECT_RLOCK(object);
2371 	m = vm_radix_iter_lookup_ge(&pages, pindex);
2372 	while (pindex < end_pindex) {
2373 		if (m == NULL || pindex < m->pindex) {
2374 			/*
2375 			 * The first object in the shadow chain doesn't
2376 			 * contain a page at the current index.  Therefore,
2377 			 * the page must exist in a backing object.
2378 			 */
2379 			tobject = object;
2380 			tpindex = pindex;
2381 			depth = 0;
2382 			do {
2383 				tpindex +=
2384 				    OFF_TO_IDX(tobject->backing_object_offset);
2385 				tobject = tobject->backing_object;
2386 				KASSERT(tobject != NULL,
2387 				    ("vm_object_unwire: missing page"));
2388 				if ((tobject->flags & OBJ_FICTITIOUS) != 0)
2389 					goto next_page;
2390 				depth++;
2391 				if (depth == locked_depth) {
2392 					locked_depth++;
2393 					VM_OBJECT_RLOCK(tobject);
2394 				}
2395 			} while ((tm = vm_page_lookup(tobject, tpindex)) ==
2396 			    NULL);
2397 		} else {
2398 			tm = m;
2399 			m = vm_radix_iter_step(&pages);
2400 		}
2401 		if (vm_page_trysbusy(tm) == 0) {
2402 			for (tobject = object; locked_depth >= 1;
2403 			    locked_depth--) {
2404 				t1object = tobject->backing_object;
2405 				if (tm->object != tobject)
2406 					VM_OBJECT_RUNLOCK(tobject);
2407 				tobject = t1object;
2408 			}
2409 			tobject = tm->object;
2410 			if (!vm_page_busy_sleep(tm, "unwbo",
2411 			    VM_ALLOC_IGN_SBUSY))
2412 				VM_OBJECT_RUNLOCK(tobject);
2413 			pctrie_iter_reset(&pages);
2414 			goto again;
2415 		}
2416 		vm_page_unwire(tm, queue);
2417 		vm_page_sunbusy(tm);
2418 next_page:
2419 		pindex++;
2420 	}
2421 	/* Release the accumulated object locks. */
2422 	for (tobject = object; locked_depth >= 1; locked_depth--) {
2423 		t1object = tobject->backing_object;
2424 		VM_OBJECT_RUNLOCK(tobject);
2425 		tobject = t1object;
2426 	}
2427 }
2428 
2429 /*
2430  * Return the vnode for the given object, or NULL if none exists.
2431  * For tmpfs objects, the function may return NULL if there is
2432  * no vnode allocated at the time of the call.
2433  */
2434 struct vnode *
2435 vm_object_vnode(vm_object_t object)
2436 {
2437 	struct vnode *vp;
2438 
2439 	VM_OBJECT_ASSERT_LOCKED(object);
2440 	vm_pager_getvp(object, &vp, NULL);
2441 	return (vp);
2442 }
2443 
2444 /*
2445  * Busy the vm object.  This prevents new pages belonging to the object from
2446  * becoming busy.  Existing pages persist as busy.  Callers are responsible
2447  * for checking page state before proceeding.
2448  */
2449 void
2450 vm_object_busy(vm_object_t obj)
2451 {
2452 
2453 	VM_OBJECT_ASSERT_LOCKED(obj);
2454 
2455 	blockcount_acquire(&obj->busy, 1);
2456 	/* The fence is required to order loads of page busy. */
2457 	atomic_thread_fence_acq_rel();
2458 }
2459 
2460 void
2461 vm_object_unbusy(vm_object_t obj)
2462 {
2463 
2464 	blockcount_release(&obj->busy, 1);
2465 }
2466 
2467 void
2468 vm_object_busy_wait(vm_object_t obj, const char *wmesg)
2469 {
2470 
2471 	VM_OBJECT_ASSERT_UNLOCKED(obj);
2472 
2473 	(void)blockcount_sleep(&obj->busy, NULL, wmesg, PVM);
2474 }
2475 
2476 /*
2477  * This function aims to determine if the object is mapped,
2478  * specifically, if it is referenced by a vm_map_entry.  Because
2479  * objects occasionally acquire transient references that do not
2480  * represent a mapping, the method used here is inexact.  However, it
2481  * has very low overhead and is good enough for the advisory
2482  * vm.vmtotal sysctl.
2483  */
2484 bool
2485 vm_object_is_active(vm_object_t obj)
2486 {
2487 
2488 	return (obj->ref_count > atomic_load_int(&obj->shadow_count));
2489 }
2490 
2491 static int
2492 vm_object_list_handler(struct sysctl_req *req, bool swap_only)
2493 {
2494 	struct pctrie_iter pages;
2495 	struct kinfo_vmobject *kvo;
2496 	char *fullpath, *freepath;
2497 	struct vnode *vp;
2498 	struct vattr va;
2499 	vm_object_t obj;
2500 	vm_page_t m;
2501 	u_long sp;
2502 	int count, error;
2503 	key_t key;
2504 	unsigned short seq;
2505 	bool want_path;
2506 
2507 	if (req->oldptr == NULL) {
2508 		/*
2509 		 * If an old buffer has not been provided, generate an
2510 		 * estimate of the space needed for a subsequent call.
2511 		 */
2512 		mtx_lock(&vm_object_list_mtx);
2513 		count = 0;
2514 		TAILQ_FOREACH(obj, &vm_object_list, object_list) {
2515 			if (obj->type == OBJT_DEAD)
2516 				continue;
2517 			count++;
2518 		}
2519 		mtx_unlock(&vm_object_list_mtx);
2520 		return (SYSCTL_OUT(req, NULL, sizeof(struct kinfo_vmobject) *
2521 		    count * 11 / 10));
2522 	}
2523 
2524 	want_path = !(swap_only || jailed(curthread->td_ucred));
2525 	kvo = malloc(sizeof(*kvo), M_TEMP, M_WAITOK | M_ZERO);
2526 	error = 0;
2527 
2528 	/*
2529 	 * VM objects are type stable and are never removed from the
2530 	 * list once added.  This allows us to safely read obj->object_list
2531 	 * after reacquiring the VM object lock.
2532 	 */
2533 	mtx_lock(&vm_object_list_mtx);
2534 	TAILQ_FOREACH(obj, &vm_object_list, object_list) {
2535 		if (obj->type == OBJT_DEAD ||
2536 		    (swap_only && (obj->flags & (OBJ_ANON | OBJ_SWAP)) == 0))
2537 			continue;
2538 		VM_OBJECT_RLOCK(obj);
2539 		if (obj->type == OBJT_DEAD ||
2540 		    (swap_only && (obj->flags & (OBJ_ANON | OBJ_SWAP)) == 0)) {
2541 			VM_OBJECT_RUNLOCK(obj);
2542 			continue;
2543 		}
2544 		mtx_unlock(&vm_object_list_mtx);
2545 		kvo->kvo_size = ptoa(obj->size);
2546 		kvo->kvo_resident = obj->resident_page_count;
2547 		kvo->kvo_ref_count = obj->ref_count;
2548 		kvo->kvo_shadow_count = atomic_load_int(&obj->shadow_count);
2549 		kvo->kvo_memattr = obj->memattr;
2550 		kvo->kvo_active = 0;
2551 		kvo->kvo_inactive = 0;
2552 		kvo->kvo_flags = 0;
2553 		if (!swap_only) {
2554 			vm_page_iter_init(&pages, obj);
2555 			VM_RADIX_FOREACH(m, &pages) {
2556 				/*
2557 				 * A page may belong to the object but be
2558 				 * dequeued and set to PQ_NONE while the
2559 				 * object lock is not held.  This makes the
2560 				 * reads of m->queue below racy, and we do not
2561 				 * count pages set to PQ_NONE.  However, this
2562 				 * sysctl is only meant to give an
2563 				 * approximation of the system anyway.
2564 				 */
2565 				if (vm_page_active(m))
2566 					kvo->kvo_active++;
2567 				else if (vm_page_inactive(m))
2568 					kvo->kvo_inactive++;
2569 				else if (vm_page_in_laundry(m))
2570 					kvo->kvo_laundry++;
2571 			}
2572 		}
2573 
2574 		kvo->kvo_vn_fileid = 0;
2575 		kvo->kvo_vn_fsid = 0;
2576 		kvo->kvo_vn_fsid_freebsd11 = 0;
2577 		freepath = NULL;
2578 		fullpath = "";
2579 		vp = NULL;
2580 		kvo->kvo_type = vm_object_kvme_type(obj, want_path ? &vp :
2581 		    NULL);
2582 		if (vp != NULL) {
2583 			vref(vp);
2584 		} else if ((obj->flags & OBJ_ANON) != 0) {
2585 			MPASS(kvo->kvo_type == KVME_TYPE_SWAP);
2586 			kvo->kvo_me = (uintptr_t)obj;
2587 			/* tmpfs objs are reported as vnodes */
2588 			kvo->kvo_backing_obj = (uintptr_t)obj->backing_object;
2589 			sp = swap_pager_swapped_pages(obj);
2590 			kvo->kvo_swapped = sp > UINT32_MAX ? UINT32_MAX : sp;
2591 		}
2592 		if (obj->type == OBJT_DEVICE || obj->type == OBJT_MGTDEVICE) {
2593 			cdev_pager_get_path(obj, kvo->kvo_path,
2594 			    sizeof(kvo->kvo_path));
2595 		}
2596 		VM_OBJECT_RUNLOCK(obj);
2597 		if ((obj->flags & OBJ_SYSVSHM) != 0) {
2598 			kvo->kvo_flags |= KVMO_FLAG_SYSVSHM;
2599 			shmobjinfo(obj, &key, &seq);
2600 			kvo->kvo_vn_fileid = key;
2601 			kvo->kvo_vn_fsid_freebsd11 = seq;
2602 		}
2603 		if ((obj->flags & OBJ_POSIXSHM) != 0) {
2604 			kvo->kvo_flags |= KVMO_FLAG_POSIXSHM;
2605 			shm_get_path(obj, kvo->kvo_path,
2606 			    sizeof(kvo->kvo_path));
2607 		}
2608 		if (vp != NULL) {
2609 			vn_fullpath(vp, &fullpath, &freepath);
2610 			vn_lock(vp, LK_SHARED | LK_RETRY);
2611 			if (VOP_GETATTR(vp, &va, curthread->td_ucred) == 0) {
2612 				kvo->kvo_vn_fileid = va.va_fileid;
2613 				kvo->kvo_vn_fsid = va.va_fsid;
2614 				kvo->kvo_vn_fsid_freebsd11 = va.va_fsid;
2615 								/* truncate */
2616 			}
2617 			vput(vp);
2618 			strlcpy(kvo->kvo_path, fullpath, sizeof(kvo->kvo_path));
2619 			free(freepath, M_TEMP);
2620 		}
2621 
2622 		/* Pack record size down */
2623 		kvo->kvo_structsize = offsetof(struct kinfo_vmobject, kvo_path)
2624 		    + strlen(kvo->kvo_path) + 1;
2625 		kvo->kvo_structsize = roundup(kvo->kvo_structsize,
2626 		    sizeof(uint64_t));
2627 		error = SYSCTL_OUT(req, kvo, kvo->kvo_structsize);
2628 		maybe_yield();
2629 		mtx_lock(&vm_object_list_mtx);
2630 		if (error)
2631 			break;
2632 	}
2633 	mtx_unlock(&vm_object_list_mtx);
2634 	free(kvo, M_TEMP);
2635 	return (error);
2636 }
2637 
2638 static int
2639 sysctl_vm_object_list(SYSCTL_HANDLER_ARGS)
2640 {
2641 	return (vm_object_list_handler(req, false));
2642 }
2643 
2644 SYSCTL_PROC(_vm, OID_AUTO, objects, CTLTYPE_STRUCT | CTLFLAG_RW | CTLFLAG_SKIP |
2645     CTLFLAG_MPSAFE, NULL, 0, sysctl_vm_object_list, "S,kinfo_vmobject",
2646     "List of VM objects");
2647 
2648 static int
2649 sysctl_vm_object_list_swap(SYSCTL_HANDLER_ARGS)
2650 {
2651 	return (vm_object_list_handler(req, true));
2652 }
2653 
2654 /*
2655  * This sysctl returns list of the anonymous or swap objects. Intent
2656  * is to provide stripped optimized list useful to analyze swap use.
2657  * Since technically non-swap (default) objects participate in the
2658  * shadow chains, and are converted to swap type as needed by swap
2659  * pager, we must report them.
2660  */
2661 SYSCTL_PROC(_vm, OID_AUTO, swap_objects,
2662     CTLTYPE_STRUCT | CTLFLAG_RW | CTLFLAG_SKIP | CTLFLAG_MPSAFE, NULL, 0,
2663     sysctl_vm_object_list_swap, "S,kinfo_vmobject",
2664     "List of swap VM objects");
2665 
2666 #include "opt_ddb.h"
2667 #ifdef DDB
2668 #include <sys/kernel.h>
2669 
2670 #include <sys/cons.h>
2671 
2672 #include <ddb/ddb.h>
2673 
2674 static int
2675 _vm_object_in_map(vm_map_t map, vm_object_t object, vm_map_entry_t entry)
2676 {
2677 	vm_map_t tmpm;
2678 	vm_map_entry_t tmpe;
2679 	vm_object_t obj;
2680 
2681 	if (map == 0)
2682 		return 0;
2683 
2684 	if (entry == 0) {
2685 		VM_MAP_ENTRY_FOREACH(tmpe, map) {
2686 			if (_vm_object_in_map(map, object, tmpe)) {
2687 				return 1;
2688 			}
2689 		}
2690 	} else if (entry->eflags & MAP_ENTRY_IS_SUB_MAP) {
2691 		tmpm = entry->object.sub_map;
2692 		VM_MAP_ENTRY_FOREACH(tmpe, tmpm) {
2693 			if (_vm_object_in_map(tmpm, object, tmpe)) {
2694 				return 1;
2695 			}
2696 		}
2697 	} else if ((obj = entry->object.vm_object) != NULL) {
2698 		for (; obj; obj = obj->backing_object)
2699 			if (obj == object) {
2700 				return 1;
2701 			}
2702 	}
2703 	return 0;
2704 }
2705 
2706 static int
2707 vm_object_in_map(vm_object_t object)
2708 {
2709 	struct proc *p;
2710 
2711 	/* sx_slock(&allproc_lock); */
2712 	FOREACH_PROC_IN_SYSTEM(p) {
2713 		if (!p->p_vmspace /* || (p->p_flag & (P_SYSTEM|P_WEXIT)) */)
2714 			continue;
2715 		if (_vm_object_in_map(&p->p_vmspace->vm_map, object, 0)) {
2716 			/* sx_sunlock(&allproc_lock); */
2717 			return 1;
2718 		}
2719 	}
2720 	/* sx_sunlock(&allproc_lock); */
2721 	if (_vm_object_in_map(kernel_map, object, 0))
2722 		return 1;
2723 	return 0;
2724 }
2725 
2726 DB_SHOW_COMMAND_FLAGS(vmochk, vm_object_check, DB_CMD_MEMSAFE)
2727 {
2728 	vm_object_t object;
2729 
2730 	/*
2731 	 * make sure that internal objs are in a map somewhere
2732 	 * and none have zero ref counts.
2733 	 */
2734 	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2735 		if ((object->flags & OBJ_ANON) != 0) {
2736 			if (object->ref_count == 0) {
2737 				db_printf(
2738 			"vmochk: internal obj has zero ref count: %lu\n",
2739 				    (u_long)object->size);
2740 			}
2741 			if (!vm_object_in_map(object)) {
2742 				db_printf(
2743 			"vmochk: internal obj is not in a map: "
2744 			"ref: %d, size: %lu: 0x%lx, backing_object: %p\n",
2745 				    object->ref_count, (u_long)object->size,
2746 				    (u_long)object->size,
2747 				    (void *)object->backing_object);
2748 			}
2749 		}
2750 		if (db_pager_quit)
2751 			return;
2752 	}
2753 }
2754 
2755 /*
2756  *	vm_object_print:	[ debug ]
2757  */
2758 DB_SHOW_COMMAND(object, vm_object_print_static)
2759 {
2760 	struct pctrie_iter pages;
2761 	/* XXX convert args. */
2762 	vm_object_t object = (vm_object_t)addr;
2763 	boolean_t full = have_addr;
2764 
2765 	vm_page_t p;
2766 
2767 	/* XXX count is an (unused) arg.  Avoid shadowing it. */
2768 #define	count	was_count
2769 
2770 	int count;
2771 
2772 	if (object == NULL)
2773 		return;
2774 
2775 	db_iprintf("Object %p: type=%d, size=0x%jx, res=%d, ref=%d, flags=0x%x",
2776 	    object, (int)object->type, (uintmax_t)object->size,
2777 	    object->resident_page_count, object->ref_count, object->flags);
2778 	db_iprintf(" ruid %d charge %jx\n",
2779 	    object->cred ? object->cred->cr_ruid : -1,
2780 	    (uintmax_t)object->charge);
2781 	db_iprintf(" sref=%d, backing_object(%d)=(%p)+0x%jx\n",
2782 	    atomic_load_int(&object->shadow_count),
2783 	    object->backing_object ? object->backing_object->ref_count : 0,
2784 	    object->backing_object, (uintmax_t)object->backing_object_offset);
2785 
2786 	if (!full)
2787 		return;
2788 
2789 	db_indent += 2;
2790 	count = 0;
2791 	vm_page_iter_init(&pages, object);
2792 	VM_RADIX_FOREACH(p, &pages) {
2793 		if (count == 0)
2794 			db_iprintf("memory:=");
2795 		else if (count == 6) {
2796 			db_printf("\n");
2797 			db_iprintf(" ...");
2798 			count = 0;
2799 		} else
2800 			db_printf(",");
2801 		count++;
2802 
2803 		db_printf("(off=0x%jx,page=0x%jx)",
2804 		    (uintmax_t)p->pindex, (uintmax_t)VM_PAGE_TO_PHYS(p));
2805 
2806 		if (db_pager_quit)
2807 			break;
2808 	}
2809 	if (count != 0)
2810 		db_printf("\n");
2811 	db_indent -= 2;
2812 }
2813 
2814 /* XXX. */
2815 #undef count
2816 
2817 /* XXX need this non-static entry for calling from vm_map_print. */
2818 void
2819 vm_object_print(
2820         /* db_expr_t */ long addr,
2821 	boolean_t have_addr,
2822 	/* db_expr_t */ long count,
2823 	char *modif)
2824 {
2825 	vm_object_print_static(addr, have_addr, count, modif);
2826 }
2827 
2828 DB_SHOW_COMMAND_FLAGS(vmopag, vm_object_print_pages, DB_CMD_MEMSAFE)
2829 {
2830 	struct pctrie_iter pages;
2831 	vm_object_t object;
2832 	vm_page_t m, start_m;
2833 	int rcount;
2834 
2835 	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2836 		db_printf("new object: %p\n", (void *)object);
2837 		if (db_pager_quit)
2838 			return;
2839 		start_m = NULL;
2840 		vm_page_iter_init(&pages, object);
2841 		VM_RADIX_FOREACH(m, &pages) {
2842 			if (start_m == NULL) {
2843 				start_m = m;
2844 				rcount = 0;
2845 			} else if (start_m->pindex + rcount != m->pindex ||
2846 			    VM_PAGE_TO_PHYS(start_m)  + ptoa(rcount) !=
2847 			    VM_PAGE_TO_PHYS(m)) {
2848 				db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2849 				    (long)start_m->pindex, rcount,
2850 				    (long)VM_PAGE_TO_PHYS(start_m));
2851 				if (db_pager_quit)
2852 					return;
2853 				start_m = m;
2854 				rcount = 0;
2855 			}
2856 			rcount++;
2857 		}
2858 		if (start_m != NULL) {
2859 			db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2860 			    (long)start_m->pindex, rcount,
2861 			    (long)VM_PAGE_TO_PHYS(start_m));
2862 			if (db_pager_quit)
2863 				return;
2864 		}
2865 	}
2866 }
2867 #endif /* DDB */
2868