xref: /freebsd/sys/vm/vm_object.c (revision 9f0c02d4255b2036f652c924d3df4fa88c7c721a)
1 /*-
2  * Copyright (c) 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * The Mach Operating System project at Carnegie-Mellon University.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 4. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	from: @(#)vm_object.c	8.5 (Berkeley) 3/22/94
33  *
34  *
35  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
36  * All rights reserved.
37  *
38  * Authors: Avadis Tevanian, Jr., Michael Wayne Young
39  *
40  * Permission to use, copy, modify and distribute this software and
41  * its documentation is hereby granted, provided that both the copyright
42  * notice and this permission notice appear in all copies of the
43  * software, derivative works or modified versions, and any portions
44  * thereof, and that both notices appear in supporting documentation.
45  *
46  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
47  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
48  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
49  *
50  * Carnegie Mellon requests users of this software to return to
51  *
52  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
53  *  School of Computer Science
54  *  Carnegie Mellon University
55  *  Pittsburgh PA 15213-3890
56  *
57  * any improvements or extensions that they make and grant Carnegie the
58  * rights to redistribute these changes.
59  */
60 
61 /*
62  *	Virtual memory object module.
63  */
64 
65 #include <sys/cdefs.h>
66 __FBSDID("$FreeBSD$");
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/lock.h>
71 #include <sys/mman.h>
72 #include <sys/mount.h>
73 #include <sys/kernel.h>
74 #include <sys/sysctl.h>
75 #include <sys/mutex.h>
76 #include <sys/proc.h>		/* for curproc, pageproc */
77 #include <sys/socket.h>
78 #include <sys/vnode.h>
79 #include <sys/vmmeter.h>
80 #include <sys/sx.h>
81 
82 #include <vm/vm.h>
83 #include <vm/vm_param.h>
84 #include <vm/pmap.h>
85 #include <vm/vm_map.h>
86 #include <vm/vm_object.h>
87 #include <vm/vm_page.h>
88 #include <vm/vm_pageout.h>
89 #include <vm/vm_pager.h>
90 #include <vm/swap_pager.h>
91 #include <vm/vm_kern.h>
92 #include <vm/vm_extern.h>
93 #include <vm/uma.h>
94 
95 #define EASY_SCAN_FACTOR       8
96 
97 #define MSYNC_FLUSH_HARDSEQ	0x01
98 #define MSYNC_FLUSH_SOFTSEQ	0x02
99 
100 /*
101  * msync / VM object flushing optimizations
102  */
103 static int msync_flush_flags = MSYNC_FLUSH_HARDSEQ | MSYNC_FLUSH_SOFTSEQ;
104 SYSCTL_INT(_vm, OID_AUTO, msync_flush_flags,
105         CTLFLAG_RW, &msync_flush_flags, 0, "");
106 
107 static int old_msync;
108 SYSCTL_INT(_vm, OID_AUTO, old_msync, CTLFLAG_RW, &old_msync, 0,
109     "Use old (insecure) msync behavior");
110 
111 static void	vm_object_qcollapse(vm_object_t object);
112 static int	vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int curgeneration, int pagerflags);
113 static void	vm_object_vndeallocate(vm_object_t object);
114 
115 /*
116  *	Virtual memory objects maintain the actual data
117  *	associated with allocated virtual memory.  A given
118  *	page of memory exists within exactly one object.
119  *
120  *	An object is only deallocated when all "references"
121  *	are given up.  Only one "reference" to a given
122  *	region of an object should be writeable.
123  *
124  *	Associated with each object is a list of all resident
125  *	memory pages belonging to that object; this list is
126  *	maintained by the "vm_page" module, and locked by the object's
127  *	lock.
128  *
129  *	Each object also records a "pager" routine which is
130  *	used to retrieve (and store) pages to the proper backing
131  *	storage.  In addition, objects may be backed by other
132  *	objects from which they were virtual-copied.
133  *
134  *	The only items within the object structure which are
135  *	modified after time of creation are:
136  *		reference count		locked by object's lock
137  *		pager routine		locked by object's lock
138  *
139  */
140 
141 struct object_q vm_object_list;
142 struct mtx vm_object_list_mtx;	/* lock for object list and count */
143 
144 struct vm_object kernel_object_store;
145 struct vm_object kmem_object_store;
146 
147 SYSCTL_NODE(_vm_stats, OID_AUTO, object, CTLFLAG_RD, 0, "VM object stats");
148 
149 static long object_collapses;
150 SYSCTL_LONG(_vm_stats_object, OID_AUTO, collapses, CTLFLAG_RD,
151     &object_collapses, 0, "VM object collapses");
152 
153 static long object_bypasses;
154 SYSCTL_LONG(_vm_stats_object, OID_AUTO, bypasses, CTLFLAG_RD,
155     &object_bypasses, 0, "VM object bypasses");
156 
157 static uma_zone_t obj_zone;
158 
159 static int vm_object_zinit(void *mem, int size, int flags);
160 
161 #ifdef INVARIANTS
162 static void vm_object_zdtor(void *mem, int size, void *arg);
163 
164 static void
165 vm_object_zdtor(void *mem, int size, void *arg)
166 {
167 	vm_object_t object;
168 
169 	object = (vm_object_t)mem;
170 	KASSERT(TAILQ_EMPTY(&object->memq),
171 	    ("object %p has resident pages",
172 	    object));
173 	KASSERT(object->cache == NULL,
174 	    ("object %p has cached pages",
175 	    object));
176 	KASSERT(object->paging_in_progress == 0,
177 	    ("object %p paging_in_progress = %d",
178 	    object, object->paging_in_progress));
179 	KASSERT(object->resident_page_count == 0,
180 	    ("object %p resident_page_count = %d",
181 	    object, object->resident_page_count));
182 	KASSERT(object->shadow_count == 0,
183 	    ("object %p shadow_count = %d",
184 	    object, object->shadow_count));
185 }
186 #endif
187 
188 static int
189 vm_object_zinit(void *mem, int size, int flags)
190 {
191 	vm_object_t object;
192 
193 	object = (vm_object_t)mem;
194 	bzero(&object->mtx, sizeof(object->mtx));
195 	VM_OBJECT_LOCK_INIT(object, "standard object");
196 
197 	/* These are true for any object that has been freed */
198 	object->paging_in_progress = 0;
199 	object->resident_page_count = 0;
200 	object->shadow_count = 0;
201 	return (0);
202 }
203 
204 void
205 _vm_object_allocate(objtype_t type, vm_pindex_t size, vm_object_t object)
206 {
207 
208 	TAILQ_INIT(&object->memq);
209 	LIST_INIT(&object->shadow_head);
210 
211 	object->root = NULL;
212 	object->type = type;
213 	object->size = size;
214 	object->generation = 1;
215 	object->ref_count = 1;
216 	object->flags = 0;
217 	if ((object->type == OBJT_DEFAULT) || (object->type == OBJT_SWAP))
218 		object->flags = OBJ_ONEMAPPING;
219 	object->pg_color = 0;
220 	object->handle = NULL;
221 	object->backing_object = NULL;
222 	object->backing_object_offset = (vm_ooffset_t) 0;
223 	object->cache = NULL;
224 
225 	mtx_lock(&vm_object_list_mtx);
226 	TAILQ_INSERT_TAIL(&vm_object_list, object, object_list);
227 	mtx_unlock(&vm_object_list_mtx);
228 }
229 
230 /*
231  *	vm_object_init:
232  *
233  *	Initialize the VM objects module.
234  */
235 void
236 vm_object_init(void)
237 {
238 	TAILQ_INIT(&vm_object_list);
239 	mtx_init(&vm_object_list_mtx, "vm object_list", NULL, MTX_DEF);
240 
241 	VM_OBJECT_LOCK_INIT(&kernel_object_store, "kernel object");
242 	_vm_object_allocate(OBJT_PHYS, OFF_TO_IDX(VM_MAX_KERNEL_ADDRESS - VM_MIN_KERNEL_ADDRESS),
243 	    kernel_object);
244 
245 	VM_OBJECT_LOCK_INIT(&kmem_object_store, "kmem object");
246 	_vm_object_allocate(OBJT_PHYS, OFF_TO_IDX(VM_MAX_KERNEL_ADDRESS - VM_MIN_KERNEL_ADDRESS),
247 	    kmem_object);
248 
249 	/*
250 	 * The lock portion of struct vm_object must be type stable due
251 	 * to vm_pageout_fallback_object_lock locking a vm object
252 	 * without holding any references to it.
253 	 */
254 	obj_zone = uma_zcreate("VM OBJECT", sizeof (struct vm_object), NULL,
255 #ifdef INVARIANTS
256 	    vm_object_zdtor,
257 #else
258 	    NULL,
259 #endif
260 	    vm_object_zinit, NULL, UMA_ALIGN_PTR, UMA_ZONE_VM|UMA_ZONE_NOFREE);
261 }
262 
263 void
264 vm_object_clear_flag(vm_object_t object, u_short bits)
265 {
266 
267 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
268 	object->flags &= ~bits;
269 }
270 
271 void
272 vm_object_pip_add(vm_object_t object, short i)
273 {
274 
275 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
276 	object->paging_in_progress += i;
277 }
278 
279 void
280 vm_object_pip_subtract(vm_object_t object, short i)
281 {
282 
283 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
284 	object->paging_in_progress -= i;
285 }
286 
287 void
288 vm_object_pip_wakeup(vm_object_t object)
289 {
290 
291 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
292 	object->paging_in_progress--;
293 	if ((object->flags & OBJ_PIPWNT) && object->paging_in_progress == 0) {
294 		vm_object_clear_flag(object, OBJ_PIPWNT);
295 		wakeup(object);
296 	}
297 }
298 
299 void
300 vm_object_pip_wakeupn(vm_object_t object, short i)
301 {
302 
303 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
304 	if (i)
305 		object->paging_in_progress -= i;
306 	if ((object->flags & OBJ_PIPWNT) && object->paging_in_progress == 0) {
307 		vm_object_clear_flag(object, OBJ_PIPWNT);
308 		wakeup(object);
309 	}
310 }
311 
312 void
313 vm_object_pip_wait(vm_object_t object, char *waitid)
314 {
315 
316 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
317 	while (object->paging_in_progress) {
318 		object->flags |= OBJ_PIPWNT;
319 		msleep(object, VM_OBJECT_MTX(object), PVM, waitid, 0);
320 	}
321 }
322 
323 /*
324  *	vm_object_allocate:
325  *
326  *	Returns a new object with the given size.
327  */
328 vm_object_t
329 vm_object_allocate(objtype_t type, vm_pindex_t size)
330 {
331 	vm_object_t object;
332 
333 	object = (vm_object_t)uma_zalloc(obj_zone, M_WAITOK);
334 	_vm_object_allocate(type, size, object);
335 	return (object);
336 }
337 
338 
339 /*
340  *	vm_object_reference:
341  *
342  *	Gets another reference to the given object.  Note: OBJ_DEAD
343  *	objects can be referenced during final cleaning.
344  */
345 void
346 vm_object_reference(vm_object_t object)
347 {
348 	struct vnode *vp;
349 
350 	if (object == NULL)
351 		return;
352 	VM_OBJECT_LOCK(object);
353 	object->ref_count++;
354 	if (object->type == OBJT_VNODE) {
355 		int vfslocked;
356 
357 		vp = object->handle;
358 		VM_OBJECT_UNLOCK(object);
359 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
360 		vget(vp, LK_RETRY, curthread);
361 		VFS_UNLOCK_GIANT(vfslocked);
362 	} else
363 		VM_OBJECT_UNLOCK(object);
364 }
365 
366 /*
367  *	vm_object_reference_locked:
368  *
369  *	Gets another reference to the given object.
370  *
371  *	The object must be locked.
372  */
373 void
374 vm_object_reference_locked(vm_object_t object)
375 {
376 	struct vnode *vp;
377 
378 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
379 	KASSERT((object->flags & OBJ_DEAD) == 0,
380 	    ("vm_object_reference_locked: dead object referenced"));
381 	object->ref_count++;
382 	if (object->type == OBJT_VNODE) {
383 		vp = object->handle;
384 		vref(vp);
385 	}
386 }
387 
388 /*
389  * Handle deallocating an object of type OBJT_VNODE.
390  */
391 static void
392 vm_object_vndeallocate(vm_object_t object)
393 {
394 	struct vnode *vp = (struct vnode *) object->handle;
395 
396 	VFS_ASSERT_GIANT(vp->v_mount);
397 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
398 	KASSERT(object->type == OBJT_VNODE,
399 	    ("vm_object_vndeallocate: not a vnode object"));
400 	KASSERT(vp != NULL, ("vm_object_vndeallocate: missing vp"));
401 #ifdef INVARIANTS
402 	if (object->ref_count == 0) {
403 		vprint("vm_object_vndeallocate", vp);
404 		panic("vm_object_vndeallocate: bad object reference count");
405 	}
406 #endif
407 
408 	object->ref_count--;
409 	if (object->ref_count == 0) {
410 		mp_fixme("Unlocked vflag access.");
411 		vp->v_vflag &= ~VV_TEXT;
412 	}
413 	VM_OBJECT_UNLOCK(object);
414 	/*
415 	 * vrele may need a vop lock
416 	 */
417 	vrele(vp);
418 }
419 
420 /*
421  *	vm_object_deallocate:
422  *
423  *	Release a reference to the specified object,
424  *	gained either through a vm_object_allocate
425  *	or a vm_object_reference call.  When all references
426  *	are gone, storage associated with this object
427  *	may be relinquished.
428  *
429  *	No object may be locked.
430  */
431 void
432 vm_object_deallocate(vm_object_t object)
433 {
434 	vm_object_t temp;
435 
436 	while (object != NULL) {
437 		int vfslocked;
438 
439 		vfslocked = 0;
440 	restart:
441 		VM_OBJECT_LOCK(object);
442 		if (object->type == OBJT_VNODE) {
443 			struct vnode *vp = (struct vnode *) object->handle;
444 
445 			/*
446 			 * Conditionally acquire Giant for a vnode-backed
447 			 * object.  We have to be careful since the type of
448 			 * a vnode object can change while the object is
449 			 * unlocked.
450 			 */
451 			if (VFS_NEEDSGIANT(vp->v_mount) && !vfslocked) {
452 				vfslocked = 1;
453 				if (!mtx_trylock(&Giant)) {
454 					VM_OBJECT_UNLOCK(object);
455 					mtx_lock(&Giant);
456 					goto restart;
457 				}
458 			}
459 			vm_object_vndeallocate(object);
460 			VFS_UNLOCK_GIANT(vfslocked);
461 			return;
462 		} else
463 			/*
464 			 * This is to handle the case that the object
465 			 * changed type while we dropped its lock to
466 			 * obtain Giant.
467 			 */
468 			VFS_UNLOCK_GIANT(vfslocked);
469 
470 		KASSERT(object->ref_count != 0,
471 			("vm_object_deallocate: object deallocated too many times: %d", object->type));
472 
473 		/*
474 		 * If the reference count goes to 0 we start calling
475 		 * vm_object_terminate() on the object chain.
476 		 * A ref count of 1 may be a special case depending on the
477 		 * shadow count being 0 or 1.
478 		 */
479 		object->ref_count--;
480 		if (object->ref_count > 1) {
481 			VM_OBJECT_UNLOCK(object);
482 			return;
483 		} else if (object->ref_count == 1) {
484 			if (object->shadow_count == 0) {
485 				vm_object_set_flag(object, OBJ_ONEMAPPING);
486 			} else if ((object->shadow_count == 1) &&
487 			    (object->handle == NULL) &&
488 			    (object->type == OBJT_DEFAULT ||
489 			     object->type == OBJT_SWAP)) {
490 				vm_object_t robject;
491 
492 				robject = LIST_FIRST(&object->shadow_head);
493 				KASSERT(robject != NULL,
494 				    ("vm_object_deallocate: ref_count: %d, shadow_count: %d",
495 					 object->ref_count,
496 					 object->shadow_count));
497 				if (!VM_OBJECT_TRYLOCK(robject)) {
498 					/*
499 					 * Avoid a potential deadlock.
500 					 */
501 					object->ref_count++;
502 					VM_OBJECT_UNLOCK(object);
503 					/*
504 					 * More likely than not the thread
505 					 * holding robject's lock has lower
506 					 * priority than the current thread.
507 					 * Let the lower priority thread run.
508 					 */
509 					pause("vmo_de", 1);
510 					continue;
511 				}
512 				/*
513 				 * Collapse object into its shadow unless its
514 				 * shadow is dead.  In that case, object will
515 				 * be deallocated by the thread that is
516 				 * deallocating its shadow.
517 				 */
518 				if ((robject->flags & OBJ_DEAD) == 0 &&
519 				    (robject->handle == NULL) &&
520 				    (robject->type == OBJT_DEFAULT ||
521 				     robject->type == OBJT_SWAP)) {
522 
523 					robject->ref_count++;
524 retry:
525 					if (robject->paging_in_progress) {
526 						VM_OBJECT_UNLOCK(object);
527 						vm_object_pip_wait(robject,
528 						    "objde1");
529 						temp = robject->backing_object;
530 						if (object == temp) {
531 							VM_OBJECT_LOCK(object);
532 							goto retry;
533 						}
534 					} else if (object->paging_in_progress) {
535 						VM_OBJECT_UNLOCK(robject);
536 						object->flags |= OBJ_PIPWNT;
537 						msleep(object,
538 						    VM_OBJECT_MTX(object),
539 						    PDROP | PVM, "objde2", 0);
540 						VM_OBJECT_LOCK(robject);
541 						temp = robject->backing_object;
542 						if (object == temp) {
543 							VM_OBJECT_LOCK(object);
544 							goto retry;
545 						}
546 					} else
547 						VM_OBJECT_UNLOCK(object);
548 
549 					if (robject->ref_count == 1) {
550 						robject->ref_count--;
551 						object = robject;
552 						goto doterm;
553 					}
554 					object = robject;
555 					vm_object_collapse(object);
556 					VM_OBJECT_UNLOCK(object);
557 					continue;
558 				}
559 				VM_OBJECT_UNLOCK(robject);
560 			}
561 			VM_OBJECT_UNLOCK(object);
562 			return;
563 		}
564 doterm:
565 		temp = object->backing_object;
566 		if (temp != NULL) {
567 			VM_OBJECT_LOCK(temp);
568 			LIST_REMOVE(object, shadow_list);
569 			temp->shadow_count--;
570 			temp->generation++;
571 			VM_OBJECT_UNLOCK(temp);
572 			object->backing_object = NULL;
573 		}
574 		/*
575 		 * Don't double-terminate, we could be in a termination
576 		 * recursion due to the terminate having to sync data
577 		 * to disk.
578 		 */
579 		if ((object->flags & OBJ_DEAD) == 0)
580 			vm_object_terminate(object);
581 		else
582 			VM_OBJECT_UNLOCK(object);
583 		object = temp;
584 	}
585 }
586 
587 /*
588  *	vm_object_terminate actually destroys the specified object, freeing
589  *	up all previously used resources.
590  *
591  *	The object must be locked.
592  *	This routine may block.
593  */
594 void
595 vm_object_terminate(vm_object_t object)
596 {
597 	vm_page_t p;
598 
599 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
600 
601 	/*
602 	 * Make sure no one uses us.
603 	 */
604 	vm_object_set_flag(object, OBJ_DEAD);
605 
606 	/*
607 	 * wait for the pageout daemon to be done with the object
608 	 */
609 	vm_object_pip_wait(object, "objtrm");
610 
611 	KASSERT(!object->paging_in_progress,
612 		("vm_object_terminate: pageout in progress"));
613 
614 	/*
615 	 * Clean and free the pages, as appropriate. All references to the
616 	 * object are gone, so we don't need to lock it.
617 	 */
618 	if (object->type == OBJT_VNODE) {
619 		struct vnode *vp = (struct vnode *)object->handle;
620 
621 		/*
622 		 * Clean pages and flush buffers.
623 		 */
624 		vm_object_page_clean(object, 0, 0, OBJPC_SYNC);
625 		VM_OBJECT_UNLOCK(object);
626 
627 		vinvalbuf(vp, V_SAVE, NULL, 0, 0);
628 
629 		VM_OBJECT_LOCK(object);
630 	}
631 
632 	KASSERT(object->ref_count == 0,
633 		("vm_object_terminate: object with references, ref_count=%d",
634 		object->ref_count));
635 
636 	/*
637 	 * Now free any remaining pages. For internal objects, this also
638 	 * removes them from paging queues. Don't free wired pages, just
639 	 * remove them from the object.
640 	 */
641 	vm_page_lock_queues();
642 	while ((p = TAILQ_FIRST(&object->memq)) != NULL) {
643 		KASSERT(!p->busy && (p->oflags & VPO_BUSY) == 0,
644 			("vm_object_terminate: freeing busy page %p "
645 			"p->busy = %d, p->flags %x\n", p, p->busy, p->flags));
646 		if (p->wire_count == 0) {
647 			vm_page_free(p);
648 			cnt.v_pfree++;
649 		} else {
650 			vm_page_remove(p);
651 		}
652 	}
653 	vm_page_unlock_queues();
654 
655 	if (__predict_false(object->cache != NULL))
656 		vm_page_cache_free(object, 0, 0);
657 
658 	/*
659 	 * Let the pager know object is dead.
660 	 */
661 	vm_pager_deallocate(object);
662 	VM_OBJECT_UNLOCK(object);
663 
664 	/*
665 	 * Remove the object from the global object list.
666 	 */
667 	mtx_lock(&vm_object_list_mtx);
668 	TAILQ_REMOVE(&vm_object_list, object, object_list);
669 	mtx_unlock(&vm_object_list_mtx);
670 
671 	/*
672 	 * Free the space for the object.
673 	 */
674 	uma_zfree(obj_zone, object);
675 }
676 
677 /*
678  *	vm_object_page_clean
679  *
680  *	Clean all dirty pages in the specified range of object.  Leaves page
681  * 	on whatever queue it is currently on.   If NOSYNC is set then do not
682  *	write out pages with VPO_NOSYNC set (originally comes from MAP_NOSYNC),
683  *	leaving the object dirty.
684  *
685  *	When stuffing pages asynchronously, allow clustering.  XXX we need a
686  *	synchronous clustering mode implementation.
687  *
688  *	Odd semantics: if start == end, we clean everything.
689  *
690  *	The object must be locked.
691  */
692 void
693 vm_object_page_clean(vm_object_t object, vm_pindex_t start, vm_pindex_t end, int flags)
694 {
695 	vm_page_t p, np;
696 	vm_pindex_t tstart, tend;
697 	vm_pindex_t pi;
698 	int clearobjflags;
699 	int pagerflags;
700 	int curgeneration;
701 
702 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
703 	if (object->type != OBJT_VNODE ||
704 		(object->flags & OBJ_MIGHTBEDIRTY) == 0)
705 		return;
706 
707 	pagerflags = (flags & (OBJPC_SYNC | OBJPC_INVAL)) ? VM_PAGER_PUT_SYNC : VM_PAGER_CLUSTER_OK;
708 	pagerflags |= (flags & OBJPC_INVAL) ? VM_PAGER_PUT_INVAL : 0;
709 
710 	vm_object_set_flag(object, OBJ_CLEANING);
711 
712 	tstart = start;
713 	if (end == 0) {
714 		tend = object->size;
715 	} else {
716 		tend = end;
717 	}
718 
719 	vm_page_lock_queues();
720 	/*
721 	 * If the caller is smart and only msync()s a range he knows is
722 	 * dirty, we may be able to avoid an object scan.  This results in
723 	 * a phenominal improvement in performance.  We cannot do this
724 	 * as a matter of course because the object may be huge - e.g.
725 	 * the size might be in the gigabytes or terrabytes.
726 	 */
727 	if (msync_flush_flags & MSYNC_FLUSH_HARDSEQ) {
728 		vm_pindex_t tscan;
729 		int scanlimit;
730 		int scanreset;
731 
732 		scanreset = object->resident_page_count / EASY_SCAN_FACTOR;
733 		if (scanreset < 16)
734 			scanreset = 16;
735 		pagerflags |= VM_PAGER_IGNORE_CLEANCHK;
736 
737 		scanlimit = scanreset;
738 		tscan = tstart;
739 		while (tscan < tend) {
740 			curgeneration = object->generation;
741 			p = vm_page_lookup(object, tscan);
742 			if (p == NULL || p->valid == 0) {
743 				if (--scanlimit == 0)
744 					break;
745 				++tscan;
746 				continue;
747 			}
748 			vm_page_test_dirty(p);
749 			if ((p->dirty & p->valid) == 0) {
750 				if (--scanlimit == 0)
751 					break;
752 				++tscan;
753 				continue;
754 			}
755 			/*
756 			 * If we have been asked to skip nosync pages and
757 			 * this is a nosync page, we can't continue.
758 			 */
759 			if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC)) {
760 				if (--scanlimit == 0)
761 					break;
762 				++tscan;
763 				continue;
764 			}
765 			scanlimit = scanreset;
766 
767 			/*
768 			 * This returns 0 if it was unable to busy the first
769 			 * page (i.e. had to sleep).
770 			 */
771 			tscan += vm_object_page_collect_flush(object, p, curgeneration, pagerflags);
772 		}
773 
774 		/*
775 		 * If everything was dirty and we flushed it successfully,
776 		 * and the requested range is not the entire object, we
777 		 * don't have to mess with CLEANCHK or MIGHTBEDIRTY and can
778 		 * return immediately.
779 		 */
780 		if (tscan >= tend && (tstart || tend < object->size)) {
781 			vm_page_unlock_queues();
782 			vm_object_clear_flag(object, OBJ_CLEANING);
783 			return;
784 		}
785 		pagerflags &= ~VM_PAGER_IGNORE_CLEANCHK;
786 	}
787 
788 	/*
789 	 * Generally set CLEANCHK interlock and make the page read-only so
790 	 * we can then clear the object flags.
791 	 *
792 	 * However, if this is a nosync mmap then the object is likely to
793 	 * stay dirty so do not mess with the page and do not clear the
794 	 * object flags.
795 	 */
796 	clearobjflags = 1;
797 	TAILQ_FOREACH(p, &object->memq, listq) {
798 		p->oflags |= VPO_CLEANCHK;
799 		if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC))
800 			clearobjflags = 0;
801 		else
802 			pmap_remove_write(p);
803 	}
804 
805 	if (clearobjflags && (tstart == 0) && (tend == object->size)) {
806 		struct vnode *vp;
807 
808 		vm_object_clear_flag(object, OBJ_MIGHTBEDIRTY);
809 		if (object->type == OBJT_VNODE &&
810 		    (vp = (struct vnode *)object->handle) != NULL) {
811 			VI_LOCK(vp);
812 			if (vp->v_iflag & VI_OBJDIRTY)
813 				vp->v_iflag &= ~VI_OBJDIRTY;
814 			VI_UNLOCK(vp);
815 		}
816 	}
817 
818 rescan:
819 	curgeneration = object->generation;
820 
821 	for (p = TAILQ_FIRST(&object->memq); p; p = np) {
822 		int n;
823 
824 		np = TAILQ_NEXT(p, listq);
825 
826 again:
827 		pi = p->pindex;
828 		if ((p->oflags & VPO_CLEANCHK) == 0 ||
829 			(pi < tstart) || (pi >= tend) ||
830 		    p->valid == 0) {
831 			p->oflags &= ~VPO_CLEANCHK;
832 			continue;
833 		}
834 
835 		vm_page_test_dirty(p);
836 		if ((p->dirty & p->valid) == 0) {
837 			p->oflags &= ~VPO_CLEANCHK;
838 			continue;
839 		}
840 
841 		/*
842 		 * If we have been asked to skip nosync pages and this is a
843 		 * nosync page, skip it.  Note that the object flags were
844 		 * not cleared in this case so we do not have to set them.
845 		 */
846 		if ((flags & OBJPC_NOSYNC) && (p->oflags & VPO_NOSYNC)) {
847 			p->oflags &= ~VPO_CLEANCHK;
848 			continue;
849 		}
850 
851 		n = vm_object_page_collect_flush(object, p,
852 			curgeneration, pagerflags);
853 		if (n == 0)
854 			goto rescan;
855 
856 		if (object->generation != curgeneration)
857 			goto rescan;
858 
859 		/*
860 		 * Try to optimize the next page.  If we can't we pick up
861 		 * our (random) scan where we left off.
862 		 */
863 		if (msync_flush_flags & MSYNC_FLUSH_SOFTSEQ) {
864 			if ((p = vm_page_lookup(object, pi + n)) != NULL)
865 				goto again;
866 		}
867 	}
868 	vm_page_unlock_queues();
869 #if 0
870 	VOP_FSYNC(vp, (pagerflags & VM_PAGER_PUT_SYNC)?MNT_WAIT:0, curproc);
871 #endif
872 
873 	vm_object_clear_flag(object, OBJ_CLEANING);
874 	return;
875 }
876 
877 static int
878 vm_object_page_collect_flush(vm_object_t object, vm_page_t p, int curgeneration, int pagerflags)
879 {
880 	int runlen;
881 	int maxf;
882 	int chkb;
883 	int maxb;
884 	int i;
885 	vm_pindex_t pi;
886 	vm_page_t maf[vm_pageout_page_count];
887 	vm_page_t mab[vm_pageout_page_count];
888 	vm_page_t ma[vm_pageout_page_count];
889 
890 	mtx_assert(&vm_page_queue_mtx, MA_OWNED);
891 	pi = p->pindex;
892 	while (vm_page_sleep_if_busy(p, TRUE, "vpcwai")) {
893 		vm_page_lock_queues();
894 		if (object->generation != curgeneration) {
895 			return(0);
896 		}
897 	}
898 	maxf = 0;
899 	for(i = 1; i < vm_pageout_page_count; i++) {
900 		vm_page_t tp;
901 
902 		if ((tp = vm_page_lookup(object, pi + i)) != NULL) {
903 			if ((tp->oflags & VPO_BUSY) ||
904 				((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 &&
905 				 (tp->oflags & VPO_CLEANCHK) == 0) ||
906 				(tp->busy != 0))
907 				break;
908 			vm_page_test_dirty(tp);
909 			if ((tp->dirty & tp->valid) == 0) {
910 				tp->oflags &= ~VPO_CLEANCHK;
911 				break;
912 			}
913 			maf[ i - 1 ] = tp;
914 			maxf++;
915 			continue;
916 		}
917 		break;
918 	}
919 
920 	maxb = 0;
921 	chkb = vm_pageout_page_count -  maxf;
922 	if (chkb) {
923 		for(i = 1; i < chkb;i++) {
924 			vm_page_t tp;
925 
926 			if ((tp = vm_page_lookup(object, pi - i)) != NULL) {
927 				if ((tp->oflags & VPO_BUSY) ||
928 					((pagerflags & VM_PAGER_IGNORE_CLEANCHK) == 0 &&
929 					 (tp->oflags & VPO_CLEANCHK) == 0) ||
930 					(tp->busy != 0))
931 					break;
932 				vm_page_test_dirty(tp);
933 				if ((tp->dirty & tp->valid) == 0) {
934 					tp->oflags &= ~VPO_CLEANCHK;
935 					break;
936 				}
937 				mab[ i - 1 ] = tp;
938 				maxb++;
939 				continue;
940 			}
941 			break;
942 		}
943 	}
944 
945 	for(i = 0; i < maxb; i++) {
946 		int index = (maxb - i) - 1;
947 		ma[index] = mab[i];
948 		ma[index]->oflags &= ~VPO_CLEANCHK;
949 	}
950 	p->oflags &= ~VPO_CLEANCHK;
951 	ma[maxb] = p;
952 	for(i = 0; i < maxf; i++) {
953 		int index = (maxb + i) + 1;
954 		ma[index] = maf[i];
955 		ma[index]->oflags &= ~VPO_CLEANCHK;
956 	}
957 	runlen = maxb + maxf + 1;
958 
959 	vm_pageout_flush(ma, runlen, pagerflags);
960 	for (i = 0; i < runlen; i++) {
961 		if (ma[i]->valid & ma[i]->dirty) {
962 			pmap_remove_write(ma[i]);
963 			ma[i]->oflags |= VPO_CLEANCHK;
964 
965 			/*
966 			 * maxf will end up being the actual number of pages
967 			 * we wrote out contiguously, non-inclusive of the
968 			 * first page.  We do not count look-behind pages.
969 			 */
970 			if (i >= maxb + 1 && (maxf > i - maxb - 1))
971 				maxf = i - maxb - 1;
972 		}
973 	}
974 	return(maxf + 1);
975 }
976 
977 /*
978  * Note that there is absolutely no sense in writing out
979  * anonymous objects, so we track down the vnode object
980  * to write out.
981  * We invalidate (remove) all pages from the address space
982  * for semantic correctness.
983  *
984  * Note: certain anonymous maps, such as MAP_NOSYNC maps,
985  * may start out with a NULL object.
986  */
987 void
988 vm_object_sync(vm_object_t object, vm_ooffset_t offset, vm_size_t size,
989     boolean_t syncio, boolean_t invalidate)
990 {
991 	vm_object_t backing_object;
992 	struct vnode *vp;
993 	struct mount *mp;
994 	int flags;
995 
996 	if (object == NULL)
997 		return;
998 	VM_OBJECT_LOCK(object);
999 	while ((backing_object = object->backing_object) != NULL) {
1000 		VM_OBJECT_LOCK(backing_object);
1001 		offset += object->backing_object_offset;
1002 		VM_OBJECT_UNLOCK(object);
1003 		object = backing_object;
1004 		if (object->size < OFF_TO_IDX(offset + size))
1005 			size = IDX_TO_OFF(object->size) - offset;
1006 	}
1007 	/*
1008 	 * Flush pages if writing is allowed, invalidate them
1009 	 * if invalidation requested.  Pages undergoing I/O
1010 	 * will be ignored by vm_object_page_remove().
1011 	 *
1012 	 * We cannot lock the vnode and then wait for paging
1013 	 * to complete without deadlocking against vm_fault.
1014 	 * Instead we simply call vm_object_page_remove() and
1015 	 * allow it to block internally on a page-by-page
1016 	 * basis when it encounters pages undergoing async
1017 	 * I/O.
1018 	 */
1019 	if (object->type == OBJT_VNODE &&
1020 	    (object->flags & OBJ_MIGHTBEDIRTY) != 0) {
1021 		int vfslocked;
1022 		vp = object->handle;
1023 		VM_OBJECT_UNLOCK(object);
1024 		(void) vn_start_write(vp, &mp, V_WAIT);
1025 		vfslocked = VFS_LOCK_GIANT(vp->v_mount);
1026 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, curthread);
1027 		flags = (syncio || invalidate) ? OBJPC_SYNC : 0;
1028 		flags |= invalidate ? OBJPC_INVAL : 0;
1029 		VM_OBJECT_LOCK(object);
1030 		vm_object_page_clean(object,
1031 		    OFF_TO_IDX(offset),
1032 		    OFF_TO_IDX(offset + size + PAGE_MASK),
1033 		    flags);
1034 		VM_OBJECT_UNLOCK(object);
1035 		VOP_UNLOCK(vp, 0, curthread);
1036 		VFS_UNLOCK_GIANT(vfslocked);
1037 		vn_finished_write(mp);
1038 		VM_OBJECT_LOCK(object);
1039 	}
1040 	if ((object->type == OBJT_VNODE ||
1041 	     object->type == OBJT_DEVICE) && invalidate) {
1042 		boolean_t purge;
1043 		purge = old_msync || (object->type == OBJT_DEVICE);
1044 		vm_object_page_remove(object,
1045 		    OFF_TO_IDX(offset),
1046 		    OFF_TO_IDX(offset + size + PAGE_MASK),
1047 		    purge ? FALSE : TRUE);
1048 	}
1049 	VM_OBJECT_UNLOCK(object);
1050 }
1051 
1052 /*
1053  *	vm_object_madvise:
1054  *
1055  *	Implements the madvise function at the object/page level.
1056  *
1057  *	MADV_WILLNEED	(any object)
1058  *
1059  *	    Activate the specified pages if they are resident.
1060  *
1061  *	MADV_DONTNEED	(any object)
1062  *
1063  *	    Deactivate the specified pages if they are resident.
1064  *
1065  *	MADV_FREE	(OBJT_DEFAULT/OBJT_SWAP objects,
1066  *			 OBJ_ONEMAPPING only)
1067  *
1068  *	    Deactivate and clean the specified pages if they are
1069  *	    resident.  This permits the process to reuse the pages
1070  *	    without faulting or the kernel to reclaim the pages
1071  *	    without I/O.
1072  */
1073 void
1074 vm_object_madvise(vm_object_t object, vm_pindex_t pindex, int count, int advise)
1075 {
1076 	vm_pindex_t end, tpindex;
1077 	vm_object_t backing_object, tobject;
1078 	vm_page_t m;
1079 
1080 	if (object == NULL)
1081 		return;
1082 	VM_OBJECT_LOCK(object);
1083 	end = pindex + count;
1084 	/*
1085 	 * Locate and adjust resident pages
1086 	 */
1087 	for (; pindex < end; pindex += 1) {
1088 relookup:
1089 		tobject = object;
1090 		tpindex = pindex;
1091 shadowlookup:
1092 		/*
1093 		 * MADV_FREE only operates on OBJT_DEFAULT or OBJT_SWAP pages
1094 		 * and those pages must be OBJ_ONEMAPPING.
1095 		 */
1096 		if (advise == MADV_FREE) {
1097 			if ((tobject->type != OBJT_DEFAULT &&
1098 			     tobject->type != OBJT_SWAP) ||
1099 			    (tobject->flags & OBJ_ONEMAPPING) == 0) {
1100 				goto unlock_tobject;
1101 			}
1102 		}
1103 		m = vm_page_lookup(tobject, tpindex);
1104 		if (m == NULL && advise == MADV_WILLNEED) {
1105 			/*
1106 			 * If the page is cached, reactivate it.
1107 			 */
1108 			m = vm_page_alloc(tobject, tpindex, VM_ALLOC_IFCACHED |
1109 			    VM_ALLOC_NOBUSY);
1110 		}
1111 		if (m == NULL) {
1112 			/*
1113 			 * There may be swap even if there is no backing page
1114 			 */
1115 			if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1116 				swap_pager_freespace(tobject, tpindex, 1);
1117 			/*
1118 			 * next object
1119 			 */
1120 			backing_object = tobject->backing_object;
1121 			if (backing_object == NULL)
1122 				goto unlock_tobject;
1123 			VM_OBJECT_LOCK(backing_object);
1124 			tpindex += OFF_TO_IDX(tobject->backing_object_offset);
1125 			if (tobject != object)
1126 				VM_OBJECT_UNLOCK(tobject);
1127 			tobject = backing_object;
1128 			goto shadowlookup;
1129 		}
1130 		/*
1131 		 * If the page is busy or not in a normal active state,
1132 		 * we skip it.  If the page is not managed there are no
1133 		 * page queues to mess with.  Things can break if we mess
1134 		 * with pages in any of the below states.
1135 		 */
1136 		vm_page_lock_queues();
1137 		if (m->hold_count ||
1138 		    m->wire_count ||
1139 		    (m->flags & PG_UNMANAGED) ||
1140 		    m->valid != VM_PAGE_BITS_ALL) {
1141 			vm_page_unlock_queues();
1142 			goto unlock_tobject;
1143 		}
1144 		if ((m->oflags & VPO_BUSY) || m->busy) {
1145 			vm_page_flag_set(m, PG_REFERENCED);
1146 			vm_page_unlock_queues();
1147 			if (object != tobject)
1148 				VM_OBJECT_UNLOCK(object);
1149 			m->oflags |= VPO_WANTED;
1150 			msleep(m, VM_OBJECT_MTX(tobject), PDROP | PVM, "madvpo", 0);
1151 			VM_OBJECT_LOCK(object);
1152   			goto relookup;
1153 		}
1154 		if (advise == MADV_WILLNEED) {
1155 			vm_page_activate(m);
1156 		} else if (advise == MADV_DONTNEED) {
1157 			vm_page_dontneed(m);
1158 		} else if (advise == MADV_FREE) {
1159 			/*
1160 			 * Mark the page clean.  This will allow the page
1161 			 * to be freed up by the system.  However, such pages
1162 			 * are often reused quickly by malloc()/free()
1163 			 * so we do not do anything that would cause
1164 			 * a page fault if we can help it.
1165 			 *
1166 			 * Specifically, we do not try to actually free
1167 			 * the page now nor do we try to put it in the
1168 			 * cache (which would cause a page fault on reuse).
1169 			 *
1170 			 * But we do make the page is freeable as we
1171 			 * can without actually taking the step of unmapping
1172 			 * it.
1173 			 */
1174 			pmap_clear_modify(m);
1175 			m->dirty = 0;
1176 			m->act_count = 0;
1177 			vm_page_dontneed(m);
1178 		}
1179 		vm_page_unlock_queues();
1180 		if (advise == MADV_FREE && tobject->type == OBJT_SWAP)
1181 			swap_pager_freespace(tobject, tpindex, 1);
1182 unlock_tobject:
1183 		if (tobject != object)
1184 			VM_OBJECT_UNLOCK(tobject);
1185 	}
1186 	VM_OBJECT_UNLOCK(object);
1187 }
1188 
1189 /*
1190  *	vm_object_shadow:
1191  *
1192  *	Create a new object which is backed by the
1193  *	specified existing object range.  The source
1194  *	object reference is deallocated.
1195  *
1196  *	The new object and offset into that object
1197  *	are returned in the source parameters.
1198  */
1199 void
1200 vm_object_shadow(
1201 	vm_object_t *object,	/* IN/OUT */
1202 	vm_ooffset_t *offset,	/* IN/OUT */
1203 	vm_size_t length)
1204 {
1205 	vm_object_t source;
1206 	vm_object_t result;
1207 
1208 	source = *object;
1209 
1210 	/*
1211 	 * Don't create the new object if the old object isn't shared.
1212 	 */
1213 	if (source != NULL) {
1214 		VM_OBJECT_LOCK(source);
1215 		if (source->ref_count == 1 &&
1216 		    source->handle == NULL &&
1217 		    (source->type == OBJT_DEFAULT ||
1218 		     source->type == OBJT_SWAP)) {
1219 			VM_OBJECT_UNLOCK(source);
1220 			return;
1221 		}
1222 		VM_OBJECT_UNLOCK(source);
1223 	}
1224 
1225 	/*
1226 	 * Allocate a new object with the given length.
1227 	 */
1228 	result = vm_object_allocate(OBJT_DEFAULT, length);
1229 
1230 	/*
1231 	 * The new object shadows the source object, adding a reference to it.
1232 	 * Our caller changes his reference to point to the new object,
1233 	 * removing a reference to the source object.  Net result: no change
1234 	 * of reference count.
1235 	 *
1236 	 * Try to optimize the result object's page color when shadowing
1237 	 * in order to maintain page coloring consistency in the combined
1238 	 * shadowed object.
1239 	 */
1240 	result->backing_object = source;
1241 	/*
1242 	 * Store the offset into the source object, and fix up the offset into
1243 	 * the new object.
1244 	 */
1245 	result->backing_object_offset = *offset;
1246 	if (source != NULL) {
1247 		VM_OBJECT_LOCK(source);
1248 		LIST_INSERT_HEAD(&source->shadow_head, result, shadow_list);
1249 		source->shadow_count++;
1250 		source->generation++;
1251 		result->flags |= source->flags & OBJ_NEEDGIANT;
1252 		VM_OBJECT_UNLOCK(source);
1253 	}
1254 
1255 
1256 	/*
1257 	 * Return the new things
1258 	 */
1259 	*offset = 0;
1260 	*object = result;
1261 }
1262 
1263 /*
1264  *	vm_object_split:
1265  *
1266  * Split the pages in a map entry into a new object.  This affords
1267  * easier removal of unused pages, and keeps object inheritance from
1268  * being a negative impact on memory usage.
1269  */
1270 void
1271 vm_object_split(vm_map_entry_t entry)
1272 {
1273 	vm_page_t m, m_next;
1274 	vm_object_t orig_object, new_object, source;
1275 	vm_pindex_t idx, offidxstart;
1276 	vm_size_t size;
1277 
1278 	orig_object = entry->object.vm_object;
1279 	if (orig_object->type != OBJT_DEFAULT && orig_object->type != OBJT_SWAP)
1280 		return;
1281 	if (orig_object->ref_count <= 1)
1282 		return;
1283 	VM_OBJECT_UNLOCK(orig_object);
1284 
1285 	offidxstart = OFF_TO_IDX(entry->offset);
1286 	size = atop(entry->end - entry->start);
1287 
1288 	/*
1289 	 * If swap_pager_copy() is later called, it will convert new_object
1290 	 * into a swap object.
1291 	 */
1292 	new_object = vm_object_allocate(OBJT_DEFAULT, size);
1293 
1294 	/*
1295 	 * At this point, the new object is still private, so the order in
1296 	 * which the original and new objects are locked does not matter.
1297 	 */
1298 	VM_OBJECT_LOCK(new_object);
1299 	VM_OBJECT_LOCK(orig_object);
1300 	source = orig_object->backing_object;
1301 	if (source != NULL) {
1302 		VM_OBJECT_LOCK(source);
1303 		if ((source->flags & OBJ_DEAD) != 0) {
1304 			VM_OBJECT_UNLOCK(source);
1305 			VM_OBJECT_UNLOCK(orig_object);
1306 			VM_OBJECT_UNLOCK(new_object);
1307 			vm_object_deallocate(new_object);
1308 			VM_OBJECT_LOCK(orig_object);
1309 			return;
1310 		}
1311 		LIST_INSERT_HEAD(&source->shadow_head,
1312 				  new_object, shadow_list);
1313 		source->shadow_count++;
1314 		source->generation++;
1315 		vm_object_reference_locked(source);	/* for new_object */
1316 		vm_object_clear_flag(source, OBJ_ONEMAPPING);
1317 		VM_OBJECT_UNLOCK(source);
1318 		new_object->backing_object_offset =
1319 			orig_object->backing_object_offset + entry->offset;
1320 		new_object->backing_object = source;
1321 	}
1322 	new_object->flags |= orig_object->flags & OBJ_NEEDGIANT;
1323 retry:
1324 	if ((m = TAILQ_FIRST(&orig_object->memq)) != NULL) {
1325 		if (m->pindex < offidxstart) {
1326 			m = vm_page_splay(offidxstart, orig_object->root);
1327 			if ((orig_object->root = m)->pindex < offidxstart)
1328 				m = TAILQ_NEXT(m, listq);
1329 		}
1330 	}
1331 	vm_page_lock_queues();
1332 	for (; m != NULL && (idx = m->pindex - offidxstart) < size;
1333 	    m = m_next) {
1334 		m_next = TAILQ_NEXT(m, listq);
1335 
1336 		/*
1337 		 * We must wait for pending I/O to complete before we can
1338 		 * rename the page.
1339 		 *
1340 		 * We do not have to VM_PROT_NONE the page as mappings should
1341 		 * not be changed by this operation.
1342 		 */
1343 		if ((m->oflags & VPO_BUSY) || m->busy) {
1344 			vm_page_flag_set(m, PG_REFERENCED);
1345 			vm_page_unlock_queues();
1346 			VM_OBJECT_UNLOCK(new_object);
1347 			m->oflags |= VPO_WANTED;
1348 			msleep(m, VM_OBJECT_MTX(orig_object), PVM, "spltwt", 0);
1349 			VM_OBJECT_LOCK(new_object);
1350 			goto retry;
1351 		}
1352 		vm_page_rename(m, new_object, idx);
1353 		/* page automatically made dirty by rename and cache handled */
1354 		vm_page_busy(m);
1355 	}
1356 	vm_page_unlock_queues();
1357 	if (orig_object->type == OBJT_SWAP) {
1358 		/*
1359 		 * swap_pager_copy() can sleep, in which case the orig_object's
1360 		 * and new_object's locks are released and reacquired.
1361 		 */
1362 		swap_pager_copy(orig_object, new_object, offidxstart, 0);
1363 
1364 		/*
1365 		 * Transfer any cached pages from orig_object to new_object.
1366 		 */
1367 		if (__predict_false(orig_object->cache != NULL))
1368 			vm_page_cache_transfer(orig_object, offidxstart,
1369 			    new_object);
1370 	}
1371 	VM_OBJECT_UNLOCK(orig_object);
1372 	TAILQ_FOREACH(m, &new_object->memq, listq)
1373 		vm_page_wakeup(m);
1374 	VM_OBJECT_UNLOCK(new_object);
1375 	entry->object.vm_object = new_object;
1376 	entry->offset = 0LL;
1377 	vm_object_deallocate(orig_object);
1378 	VM_OBJECT_LOCK(new_object);
1379 }
1380 
1381 #define	OBSC_TEST_ALL_SHADOWED	0x0001
1382 #define	OBSC_COLLAPSE_NOWAIT	0x0002
1383 #define	OBSC_COLLAPSE_WAIT	0x0004
1384 
1385 static int
1386 vm_object_backing_scan(vm_object_t object, int op)
1387 {
1388 	int r = 1;
1389 	vm_page_t p;
1390 	vm_object_t backing_object;
1391 	vm_pindex_t backing_offset_index;
1392 
1393 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1394 	VM_OBJECT_LOCK_ASSERT(object->backing_object, MA_OWNED);
1395 
1396 	backing_object = object->backing_object;
1397 	backing_offset_index = OFF_TO_IDX(object->backing_object_offset);
1398 
1399 	/*
1400 	 * Initial conditions
1401 	 */
1402 	if (op & OBSC_TEST_ALL_SHADOWED) {
1403 		/*
1404 		 * We do not want to have to test for the existence of cache
1405 		 * or swap pages in the backing object.  XXX but with the
1406 		 * new swapper this would be pretty easy to do.
1407 		 *
1408 		 * XXX what about anonymous MAP_SHARED memory that hasn't
1409 		 * been ZFOD faulted yet?  If we do not test for this, the
1410 		 * shadow test may succeed! XXX
1411 		 */
1412 		if (backing_object->type != OBJT_DEFAULT) {
1413 			return (0);
1414 		}
1415 	}
1416 	if (op & OBSC_COLLAPSE_WAIT) {
1417 		vm_object_set_flag(backing_object, OBJ_DEAD);
1418 	}
1419 
1420 	/*
1421 	 * Our scan
1422 	 */
1423 	p = TAILQ_FIRST(&backing_object->memq);
1424 	while (p) {
1425 		vm_page_t next = TAILQ_NEXT(p, listq);
1426 		vm_pindex_t new_pindex = p->pindex - backing_offset_index;
1427 
1428 		if (op & OBSC_TEST_ALL_SHADOWED) {
1429 			vm_page_t pp;
1430 
1431 			/*
1432 			 * Ignore pages outside the parent object's range
1433 			 * and outside the parent object's mapping of the
1434 			 * backing object.
1435 			 *
1436 			 * note that we do not busy the backing object's
1437 			 * page.
1438 			 */
1439 			if (
1440 			    p->pindex < backing_offset_index ||
1441 			    new_pindex >= object->size
1442 			) {
1443 				p = next;
1444 				continue;
1445 			}
1446 
1447 			/*
1448 			 * See if the parent has the page or if the parent's
1449 			 * object pager has the page.  If the parent has the
1450 			 * page but the page is not valid, the parent's
1451 			 * object pager must have the page.
1452 			 *
1453 			 * If this fails, the parent does not completely shadow
1454 			 * the object and we might as well give up now.
1455 			 */
1456 
1457 			pp = vm_page_lookup(object, new_pindex);
1458 			if (
1459 			    (pp == NULL || pp->valid == 0) &&
1460 			    !vm_pager_has_page(object, new_pindex, NULL, NULL)
1461 			) {
1462 				r = 0;
1463 				break;
1464 			}
1465 		}
1466 
1467 		/*
1468 		 * Check for busy page
1469 		 */
1470 		if (op & (OBSC_COLLAPSE_WAIT | OBSC_COLLAPSE_NOWAIT)) {
1471 			vm_page_t pp;
1472 
1473 			if (op & OBSC_COLLAPSE_NOWAIT) {
1474 				if ((p->oflags & VPO_BUSY) ||
1475 				    !p->valid ||
1476 				    p->busy) {
1477 					p = next;
1478 					continue;
1479 				}
1480 			} else if (op & OBSC_COLLAPSE_WAIT) {
1481 				if ((p->oflags & VPO_BUSY) || p->busy) {
1482 					vm_page_lock_queues();
1483 					vm_page_flag_set(p, PG_REFERENCED);
1484 					vm_page_unlock_queues();
1485 					VM_OBJECT_UNLOCK(object);
1486 					p->oflags |= VPO_WANTED;
1487 					msleep(p, VM_OBJECT_MTX(backing_object),
1488 					    PDROP | PVM, "vmocol", 0);
1489 					VM_OBJECT_LOCK(object);
1490 					VM_OBJECT_LOCK(backing_object);
1491 					/*
1492 					 * If we slept, anything could have
1493 					 * happened.  Since the object is
1494 					 * marked dead, the backing offset
1495 					 * should not have changed so we
1496 					 * just restart our scan.
1497 					 */
1498 					p = TAILQ_FIRST(&backing_object->memq);
1499 					continue;
1500 				}
1501 			}
1502 
1503 			KASSERT(
1504 			    p->object == backing_object,
1505 			    ("vm_object_backing_scan: object mismatch")
1506 			);
1507 
1508 			/*
1509 			 * Destroy any associated swap
1510 			 */
1511 			if (backing_object->type == OBJT_SWAP) {
1512 				swap_pager_freespace(
1513 				    backing_object,
1514 				    p->pindex,
1515 				    1
1516 				);
1517 			}
1518 
1519 			if (
1520 			    p->pindex < backing_offset_index ||
1521 			    new_pindex >= object->size
1522 			) {
1523 				/*
1524 				 * Page is out of the parent object's range, we
1525 				 * can simply destroy it.
1526 				 */
1527 				vm_page_lock_queues();
1528 				KASSERT(!pmap_page_is_mapped(p),
1529 				    ("freeing mapped page %p", p));
1530 				if (p->wire_count == 0)
1531 					vm_page_free(p);
1532 				else
1533 					vm_page_remove(p);
1534 				vm_page_unlock_queues();
1535 				p = next;
1536 				continue;
1537 			}
1538 
1539 			pp = vm_page_lookup(object, new_pindex);
1540 			if (
1541 			    pp != NULL ||
1542 			    vm_pager_has_page(object, new_pindex, NULL, NULL)
1543 			) {
1544 				/*
1545 				 * page already exists in parent OR swap exists
1546 				 * for this location in the parent.  Destroy
1547 				 * the original page from the backing object.
1548 				 *
1549 				 * Leave the parent's page alone
1550 				 */
1551 				vm_page_lock_queues();
1552 				KASSERT(!pmap_page_is_mapped(p),
1553 				    ("freeing mapped page %p", p));
1554 				if (p->wire_count == 0)
1555 					vm_page_free(p);
1556 				else
1557 					vm_page_remove(p);
1558 				vm_page_unlock_queues();
1559 				p = next;
1560 				continue;
1561 			}
1562 
1563 			/*
1564 			 * Page does not exist in parent, rename the
1565 			 * page from the backing object to the main object.
1566 			 *
1567 			 * If the page was mapped to a process, it can remain
1568 			 * mapped through the rename.
1569 			 */
1570 			vm_page_lock_queues();
1571 			vm_page_rename(p, object, new_pindex);
1572 			vm_page_unlock_queues();
1573 			/* page automatically made dirty by rename */
1574 		}
1575 		p = next;
1576 	}
1577 	return (r);
1578 }
1579 
1580 
1581 /*
1582  * this version of collapse allows the operation to occur earlier and
1583  * when paging_in_progress is true for an object...  This is not a complete
1584  * operation, but should plug 99.9% of the rest of the leaks.
1585  */
1586 static void
1587 vm_object_qcollapse(vm_object_t object)
1588 {
1589 	vm_object_t backing_object = object->backing_object;
1590 
1591 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1592 	VM_OBJECT_LOCK_ASSERT(backing_object, MA_OWNED);
1593 
1594 	if (backing_object->ref_count != 1)
1595 		return;
1596 
1597 	vm_object_backing_scan(object, OBSC_COLLAPSE_NOWAIT);
1598 }
1599 
1600 /*
1601  *	vm_object_collapse:
1602  *
1603  *	Collapse an object with the object backing it.
1604  *	Pages in the backing object are moved into the
1605  *	parent, and the backing object is deallocated.
1606  */
1607 void
1608 vm_object_collapse(vm_object_t object)
1609 {
1610 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1611 
1612 	while (TRUE) {
1613 		vm_object_t backing_object;
1614 
1615 		/*
1616 		 * Verify that the conditions are right for collapse:
1617 		 *
1618 		 * The object exists and the backing object exists.
1619 		 */
1620 		if ((backing_object = object->backing_object) == NULL)
1621 			break;
1622 
1623 		/*
1624 		 * we check the backing object first, because it is most likely
1625 		 * not collapsable.
1626 		 */
1627 		VM_OBJECT_LOCK(backing_object);
1628 		if (backing_object->handle != NULL ||
1629 		    (backing_object->type != OBJT_DEFAULT &&
1630 		     backing_object->type != OBJT_SWAP) ||
1631 		    (backing_object->flags & OBJ_DEAD) ||
1632 		    object->handle != NULL ||
1633 		    (object->type != OBJT_DEFAULT &&
1634 		     object->type != OBJT_SWAP) ||
1635 		    (object->flags & OBJ_DEAD)) {
1636 			VM_OBJECT_UNLOCK(backing_object);
1637 			break;
1638 		}
1639 
1640 		if (
1641 		    object->paging_in_progress != 0 ||
1642 		    backing_object->paging_in_progress != 0
1643 		) {
1644 			vm_object_qcollapse(object);
1645 			VM_OBJECT_UNLOCK(backing_object);
1646 			break;
1647 		}
1648 		/*
1649 		 * We know that we can either collapse the backing object (if
1650 		 * the parent is the only reference to it) or (perhaps) have
1651 		 * the parent bypass the object if the parent happens to shadow
1652 		 * all the resident pages in the entire backing object.
1653 		 *
1654 		 * This is ignoring pager-backed pages such as swap pages.
1655 		 * vm_object_backing_scan fails the shadowing test in this
1656 		 * case.
1657 		 */
1658 		if (backing_object->ref_count == 1) {
1659 			/*
1660 			 * If there is exactly one reference to the backing
1661 			 * object, we can collapse it into the parent.
1662 			 */
1663 			vm_object_backing_scan(object, OBSC_COLLAPSE_WAIT);
1664 
1665 			/*
1666 			 * Move the pager from backing_object to object.
1667 			 */
1668 			if (backing_object->type == OBJT_SWAP) {
1669 				/*
1670 				 * swap_pager_copy() can sleep, in which case
1671 				 * the backing_object's and object's locks are
1672 				 * released and reacquired.
1673 				 */
1674 				swap_pager_copy(
1675 				    backing_object,
1676 				    object,
1677 				    OFF_TO_IDX(object->backing_object_offset), TRUE);
1678 
1679 				/*
1680 				 * Free any cached pages from backing_object.
1681 				 */
1682 				if (__predict_false(backing_object->cache != NULL))
1683 					vm_page_cache_free(backing_object, 0, 0);
1684 			}
1685 			/*
1686 			 * Object now shadows whatever backing_object did.
1687 			 * Note that the reference to
1688 			 * backing_object->backing_object moves from within
1689 			 * backing_object to within object.
1690 			 */
1691 			LIST_REMOVE(object, shadow_list);
1692 			backing_object->shadow_count--;
1693 			backing_object->generation++;
1694 			if (backing_object->backing_object) {
1695 				VM_OBJECT_LOCK(backing_object->backing_object);
1696 				LIST_REMOVE(backing_object, shadow_list);
1697 				LIST_INSERT_HEAD(
1698 				    &backing_object->backing_object->shadow_head,
1699 				    object, shadow_list);
1700 				/*
1701 				 * The shadow_count has not changed.
1702 				 */
1703 				backing_object->backing_object->generation++;
1704 				VM_OBJECT_UNLOCK(backing_object->backing_object);
1705 			}
1706 			object->backing_object = backing_object->backing_object;
1707 			object->backing_object_offset +=
1708 			    backing_object->backing_object_offset;
1709 
1710 			/*
1711 			 * Discard backing_object.
1712 			 *
1713 			 * Since the backing object has no pages, no pager left,
1714 			 * and no object references within it, all that is
1715 			 * necessary is to dispose of it.
1716 			 */
1717 			KASSERT(backing_object->ref_count == 1, ("backing_object %p was somehow re-referenced during collapse!", backing_object));
1718 			VM_OBJECT_UNLOCK(backing_object);
1719 
1720 			mtx_lock(&vm_object_list_mtx);
1721 			TAILQ_REMOVE(
1722 			    &vm_object_list,
1723 			    backing_object,
1724 			    object_list
1725 			);
1726 			mtx_unlock(&vm_object_list_mtx);
1727 
1728 			uma_zfree(obj_zone, backing_object);
1729 
1730 			object_collapses++;
1731 		} else {
1732 			vm_object_t new_backing_object;
1733 
1734 			/*
1735 			 * If we do not entirely shadow the backing object,
1736 			 * there is nothing we can do so we give up.
1737 			 */
1738 			if (object->resident_page_count != object->size &&
1739 			    vm_object_backing_scan(object,
1740 			    OBSC_TEST_ALL_SHADOWED) == 0) {
1741 				VM_OBJECT_UNLOCK(backing_object);
1742 				break;
1743 			}
1744 
1745 			/*
1746 			 * Make the parent shadow the next object in the
1747 			 * chain.  Deallocating backing_object will not remove
1748 			 * it, since its reference count is at least 2.
1749 			 */
1750 			LIST_REMOVE(object, shadow_list);
1751 			backing_object->shadow_count--;
1752 			backing_object->generation++;
1753 
1754 			new_backing_object = backing_object->backing_object;
1755 			if ((object->backing_object = new_backing_object) != NULL) {
1756 				VM_OBJECT_LOCK(new_backing_object);
1757 				LIST_INSERT_HEAD(
1758 				    &new_backing_object->shadow_head,
1759 				    object,
1760 				    shadow_list
1761 				);
1762 				new_backing_object->shadow_count++;
1763 				new_backing_object->generation++;
1764 				vm_object_reference_locked(new_backing_object);
1765 				VM_OBJECT_UNLOCK(new_backing_object);
1766 				object->backing_object_offset +=
1767 					backing_object->backing_object_offset;
1768 			}
1769 
1770 			/*
1771 			 * Drop the reference count on backing_object. Since
1772 			 * its ref_count was at least 2, it will not vanish.
1773 			 */
1774 			backing_object->ref_count--;
1775 			VM_OBJECT_UNLOCK(backing_object);
1776 			object_bypasses++;
1777 		}
1778 
1779 		/*
1780 		 * Try again with this object's new backing object.
1781 		 */
1782 	}
1783 }
1784 
1785 /*
1786  *	vm_object_page_remove:
1787  *
1788  *	Removes all physical pages in the given range from the
1789  *	object's list of pages.  If the range's end is zero, all
1790  *	physical pages from the range's start to the end of the object
1791  *	are deleted.
1792  *
1793  *	The object must be locked.
1794  */
1795 void
1796 vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end,
1797     boolean_t clean_only)
1798 {
1799 	vm_page_t p, next;
1800 	int wirings;
1801 
1802 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1803 	if (object->resident_page_count == 0)
1804 		goto skipmemq;
1805 
1806 	/*
1807 	 * Since physically-backed objects do not use managed pages, we can't
1808 	 * remove pages from the object (we must instead remove the page
1809 	 * references, and then destroy the object).
1810 	 */
1811 	KASSERT(object->type != OBJT_PHYS || object == kernel_object ||
1812 	    object == kmem_object,
1813 	    ("attempt to remove pages from a physical object"));
1814 
1815 	vm_object_pip_add(object, 1);
1816 again:
1817 	vm_page_lock_queues();
1818 	if ((p = TAILQ_FIRST(&object->memq)) != NULL) {
1819 		if (p->pindex < start) {
1820 			p = vm_page_splay(start, object->root);
1821 			if ((object->root = p)->pindex < start)
1822 				p = TAILQ_NEXT(p, listq);
1823 		}
1824 	}
1825 	/*
1826 	 * Assert: the variable p is either (1) the page with the
1827 	 * least pindex greater than or equal to the parameter pindex
1828 	 * or (2) NULL.
1829 	 */
1830 	for (;
1831 	     p != NULL && (p->pindex < end || end == 0);
1832 	     p = next) {
1833 		next = TAILQ_NEXT(p, listq);
1834 
1835 		/*
1836 		 * If the page is wired for any reason besides the
1837 		 * existence of managed, wired mappings, then it cannot
1838 		 * be freed.
1839 		 */
1840 		if ((wirings = p->wire_count) != 0 &&
1841 		    (wirings = pmap_page_wired_mappings(p)) != p->wire_count) {
1842 			pmap_remove_all(p);
1843 			/* Account for removal of managed, wired mappings. */
1844 			p->wire_count -= wirings;
1845 			if (!clean_only)
1846 				p->valid = 0;
1847 			continue;
1848 		}
1849 		if (vm_page_sleep_if_busy(p, TRUE, "vmopar"))
1850 			goto again;
1851 		if (clean_only && p->valid) {
1852 			pmap_remove_write(p);
1853 			if (p->valid & p->dirty)
1854 				continue;
1855 		}
1856 		pmap_remove_all(p);
1857 		/* Account for removal of managed, wired mappings. */
1858 		if (wirings != 0)
1859 			p->wire_count -= wirings;
1860 		vm_page_free(p);
1861 	}
1862 	vm_page_unlock_queues();
1863 	vm_object_pip_wakeup(object);
1864 skipmemq:
1865 	if (__predict_false(object->cache != NULL))
1866 		vm_page_cache_free(object, start, end);
1867 }
1868 
1869 /*
1870  *	Routine:	vm_object_coalesce
1871  *	Function:	Coalesces two objects backing up adjoining
1872  *			regions of memory into a single object.
1873  *
1874  *	returns TRUE if objects were combined.
1875  *
1876  *	NOTE:	Only works at the moment if the second object is NULL -
1877  *		if it's not, which object do we lock first?
1878  *
1879  *	Parameters:
1880  *		prev_object	First object to coalesce
1881  *		prev_offset	Offset into prev_object
1882  *		prev_size	Size of reference to prev_object
1883  *		next_size	Size of reference to the second object
1884  *
1885  *	Conditions:
1886  *	The object must *not* be locked.
1887  */
1888 boolean_t
1889 vm_object_coalesce(vm_object_t prev_object, vm_ooffset_t prev_offset,
1890 	vm_size_t prev_size, vm_size_t next_size)
1891 {
1892 	vm_pindex_t next_pindex;
1893 
1894 	if (prev_object == NULL)
1895 		return (TRUE);
1896 	VM_OBJECT_LOCK(prev_object);
1897 	if (prev_object->type != OBJT_DEFAULT &&
1898 	    prev_object->type != OBJT_SWAP) {
1899 		VM_OBJECT_UNLOCK(prev_object);
1900 		return (FALSE);
1901 	}
1902 
1903 	/*
1904 	 * Try to collapse the object first
1905 	 */
1906 	vm_object_collapse(prev_object);
1907 
1908 	/*
1909 	 * Can't coalesce if: . more than one reference . paged out . shadows
1910 	 * another object . has a copy elsewhere (any of which mean that the
1911 	 * pages not mapped to prev_entry may be in use anyway)
1912 	 */
1913 	if (prev_object->backing_object != NULL) {
1914 		VM_OBJECT_UNLOCK(prev_object);
1915 		return (FALSE);
1916 	}
1917 
1918 	prev_size >>= PAGE_SHIFT;
1919 	next_size >>= PAGE_SHIFT;
1920 	next_pindex = OFF_TO_IDX(prev_offset) + prev_size;
1921 
1922 	if ((prev_object->ref_count > 1) &&
1923 	    (prev_object->size != next_pindex)) {
1924 		VM_OBJECT_UNLOCK(prev_object);
1925 		return (FALSE);
1926 	}
1927 
1928 	/*
1929 	 * Remove any pages that may still be in the object from a previous
1930 	 * deallocation.
1931 	 */
1932 	if (next_pindex < prev_object->size) {
1933 		vm_object_page_remove(prev_object,
1934 				      next_pindex,
1935 				      next_pindex + next_size, FALSE);
1936 		if (prev_object->type == OBJT_SWAP)
1937 			swap_pager_freespace(prev_object,
1938 					     next_pindex, next_size);
1939 	}
1940 
1941 	/*
1942 	 * Extend the object if necessary.
1943 	 */
1944 	if (next_pindex + next_size > prev_object->size)
1945 		prev_object->size = next_pindex + next_size;
1946 
1947 	VM_OBJECT_UNLOCK(prev_object);
1948 	return (TRUE);
1949 }
1950 
1951 void
1952 vm_object_set_writeable_dirty(vm_object_t object)
1953 {
1954 	struct vnode *vp;
1955 
1956 	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
1957 	if ((object->flags & OBJ_MIGHTBEDIRTY) != 0)
1958 		return;
1959 	vm_object_set_flag(object, OBJ_MIGHTBEDIRTY);
1960 	if (object->type == OBJT_VNODE &&
1961 	    (vp = (struct vnode *)object->handle) != NULL) {
1962 		VI_LOCK(vp);
1963 		vp->v_iflag |= VI_OBJDIRTY;
1964 		VI_UNLOCK(vp);
1965 	}
1966 }
1967 
1968 #include "opt_ddb.h"
1969 #ifdef DDB
1970 #include <sys/kernel.h>
1971 
1972 #include <sys/cons.h>
1973 
1974 #include <ddb/ddb.h>
1975 
1976 static int
1977 _vm_object_in_map(vm_map_t map, vm_object_t object, vm_map_entry_t entry)
1978 {
1979 	vm_map_t tmpm;
1980 	vm_map_entry_t tmpe;
1981 	vm_object_t obj;
1982 	int entcount;
1983 
1984 	if (map == 0)
1985 		return 0;
1986 
1987 	if (entry == 0) {
1988 		tmpe = map->header.next;
1989 		entcount = map->nentries;
1990 		while (entcount-- && (tmpe != &map->header)) {
1991 			if (_vm_object_in_map(map, object, tmpe)) {
1992 				return 1;
1993 			}
1994 			tmpe = tmpe->next;
1995 		}
1996 	} else if (entry->eflags & MAP_ENTRY_IS_SUB_MAP) {
1997 		tmpm = entry->object.sub_map;
1998 		tmpe = tmpm->header.next;
1999 		entcount = tmpm->nentries;
2000 		while (entcount-- && tmpe != &tmpm->header) {
2001 			if (_vm_object_in_map(tmpm, object, tmpe)) {
2002 				return 1;
2003 			}
2004 			tmpe = tmpe->next;
2005 		}
2006 	} else if ((obj = entry->object.vm_object) != NULL) {
2007 		for (; obj; obj = obj->backing_object)
2008 			if (obj == object) {
2009 				return 1;
2010 			}
2011 	}
2012 	return 0;
2013 }
2014 
2015 static int
2016 vm_object_in_map(vm_object_t object)
2017 {
2018 	struct proc *p;
2019 
2020 	/* sx_slock(&allproc_lock); */
2021 	FOREACH_PROC_IN_SYSTEM(p) {
2022 		if (!p->p_vmspace /* || (p->p_flag & (P_SYSTEM|P_WEXIT)) */)
2023 			continue;
2024 		if (_vm_object_in_map(&p->p_vmspace->vm_map, object, 0)) {
2025 			/* sx_sunlock(&allproc_lock); */
2026 			return 1;
2027 		}
2028 	}
2029 	/* sx_sunlock(&allproc_lock); */
2030 	if (_vm_object_in_map(kernel_map, object, 0))
2031 		return 1;
2032 	if (_vm_object_in_map(kmem_map, object, 0))
2033 		return 1;
2034 	if (_vm_object_in_map(pager_map, object, 0))
2035 		return 1;
2036 	if (_vm_object_in_map(buffer_map, object, 0))
2037 		return 1;
2038 	return 0;
2039 }
2040 
2041 DB_SHOW_COMMAND(vmochk, vm_object_check)
2042 {
2043 	vm_object_t object;
2044 
2045 	/*
2046 	 * make sure that internal objs are in a map somewhere
2047 	 * and none have zero ref counts.
2048 	 */
2049 	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2050 		if (object->handle == NULL &&
2051 		    (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
2052 			if (object->ref_count == 0) {
2053 				db_printf("vmochk: internal obj has zero ref count: %ld\n",
2054 					(long)object->size);
2055 			}
2056 			if (!vm_object_in_map(object)) {
2057 				db_printf(
2058 			"vmochk: internal obj is not in a map: "
2059 			"ref: %d, size: %lu: 0x%lx, backing_object: %p\n",
2060 				    object->ref_count, (u_long)object->size,
2061 				    (u_long)object->size,
2062 				    (void *)object->backing_object);
2063 			}
2064 		}
2065 	}
2066 }
2067 
2068 /*
2069  *	vm_object_print:	[ debug ]
2070  */
2071 DB_SHOW_COMMAND(object, vm_object_print_static)
2072 {
2073 	/* XXX convert args. */
2074 	vm_object_t object = (vm_object_t)addr;
2075 	boolean_t full = have_addr;
2076 
2077 	vm_page_t p;
2078 
2079 	/* XXX count is an (unused) arg.  Avoid shadowing it. */
2080 #define	count	was_count
2081 
2082 	int count;
2083 
2084 	if (object == NULL)
2085 		return;
2086 
2087 	db_iprintf(
2088 	    "Object %p: type=%d, size=0x%jx, res=%d, ref=%d, flags=0x%x\n",
2089 	    object, (int)object->type, (uintmax_t)object->size,
2090 	    object->resident_page_count, object->ref_count, object->flags);
2091 	db_iprintf(" sref=%d, backing_object(%d)=(%p)+0x%jx\n",
2092 	    object->shadow_count,
2093 	    object->backing_object ? object->backing_object->ref_count : 0,
2094 	    object->backing_object, (uintmax_t)object->backing_object_offset);
2095 
2096 	if (!full)
2097 		return;
2098 
2099 	db_indent += 2;
2100 	count = 0;
2101 	TAILQ_FOREACH(p, &object->memq, listq) {
2102 		if (count == 0)
2103 			db_iprintf("memory:=");
2104 		else if (count == 6) {
2105 			db_printf("\n");
2106 			db_iprintf(" ...");
2107 			count = 0;
2108 		} else
2109 			db_printf(",");
2110 		count++;
2111 
2112 		db_printf("(off=0x%jx,page=0x%jx)",
2113 		    (uintmax_t)p->pindex, (uintmax_t)VM_PAGE_TO_PHYS(p));
2114 	}
2115 	if (count != 0)
2116 		db_printf("\n");
2117 	db_indent -= 2;
2118 }
2119 
2120 /* XXX. */
2121 #undef count
2122 
2123 /* XXX need this non-static entry for calling from vm_map_print. */
2124 void
2125 vm_object_print(
2126         /* db_expr_t */ long addr,
2127 	boolean_t have_addr,
2128 	/* db_expr_t */ long count,
2129 	char *modif)
2130 {
2131 	vm_object_print_static(addr, have_addr, count, modif);
2132 }
2133 
2134 DB_SHOW_COMMAND(vmopag, vm_object_print_pages)
2135 {
2136 	vm_object_t object;
2137 	int nl = 0;
2138 	int c;
2139 
2140 	TAILQ_FOREACH(object, &vm_object_list, object_list) {
2141 		vm_pindex_t idx, fidx;
2142 		vm_pindex_t osize;
2143 		vm_paddr_t pa = -1;
2144 		int rcount;
2145 		vm_page_t m;
2146 
2147 		db_printf("new object: %p\n", (void *)object);
2148 		if (nl > 18) {
2149 			c = cngetc();
2150 			if (c != ' ')
2151 				return;
2152 			nl = 0;
2153 		}
2154 		nl++;
2155 		rcount = 0;
2156 		fidx = 0;
2157 		osize = object->size;
2158 		if (osize > 128)
2159 			osize = 128;
2160 		for (idx = 0; idx < osize; idx++) {
2161 			m = vm_page_lookup(object, idx);
2162 			if (m == NULL) {
2163 				if (rcount) {
2164 					db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2165 						(long)fidx, rcount, (long)pa);
2166 					if (nl > 18) {
2167 						c = cngetc();
2168 						if (c != ' ')
2169 							return;
2170 						nl = 0;
2171 					}
2172 					nl++;
2173 					rcount = 0;
2174 				}
2175 				continue;
2176 			}
2177 
2178 
2179 			if (rcount &&
2180 				(VM_PAGE_TO_PHYS(m) == pa + rcount * PAGE_SIZE)) {
2181 				++rcount;
2182 				continue;
2183 			}
2184 			if (rcount) {
2185 				db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2186 					(long)fidx, rcount, (long)pa);
2187 				if (nl > 18) {
2188 					c = cngetc();
2189 					if (c != ' ')
2190 						return;
2191 					nl = 0;
2192 				}
2193 				nl++;
2194 			}
2195 			fidx = idx;
2196 			pa = VM_PAGE_TO_PHYS(m);
2197 			rcount = 1;
2198 		}
2199 		if (rcount) {
2200 			db_printf(" index(%ld)run(%d)pa(0x%lx)\n",
2201 				(long)fidx, rcount, (long)pa);
2202 			if (nl > 18) {
2203 				c = cngetc();
2204 				if (c != ' ')
2205 					return;
2206 				nl = 0;
2207 			}
2208 			nl++;
2209 		}
2210 	}
2211 }
2212 #endif /* DDB */
2213