xref: /netbsd-src/sys/uvm/uvm_aobj.c (revision 6a493d6bc668897c91594964a732d38505b70cbb)
1 /*	$NetBSD: uvm_aobj.c,v 1.120 2013/10/25 20:22:55 martin Exp $	*/
2 
3 /*
4  * Copyright (c) 1998 Chuck Silvers, Charles D. Cranor and
5  *                    Washington University.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  *
28  * from: Id: uvm_aobj.c,v 1.1.2.5 1998/02/06 05:14:38 chs Exp
29  */
30 
31 /*
32  * uvm_aobj.c: anonymous memory uvm_object pager
33  *
34  * author: Chuck Silvers <chuq@chuq.com>
35  * started: Jan-1998
36  *
37  * - design mostly from Chuck Cranor
38  */
39 
40 #include <sys/cdefs.h>
41 __KERNEL_RCSID(0, "$NetBSD: uvm_aobj.c,v 1.120 2013/10/25 20:22:55 martin Exp $");
42 
43 #include "opt_uvmhist.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/kernel.h>
48 #include <sys/kmem.h>
49 #include <sys/pool.h>
50 #include <sys/atomic.h>
51 
52 #include <uvm/uvm.h>
53 
54 /*
55  * An anonymous UVM object (aobj) manages anonymous-memory.  In addition to
56  * keeping the list of resident pages, it may also keep a list of allocated
57  * swap blocks.  Depending on the size of the object, this list is either
58  * stored in an array (small objects) or in a hash table (large objects).
59  *
60  * Lock order
61  *
62  *	uao_list_lock ->
63  *		uvm_object::vmobjlock
64  */
65 
66 /*
67  * Note: for hash tables, we break the address space of the aobj into blocks
68  * of UAO_SWHASH_CLUSTER_SIZE pages, which shall be a power of two.
69  */
70 
71 #define	UAO_SWHASH_CLUSTER_SHIFT	4
72 #define	UAO_SWHASH_CLUSTER_SIZE		(1 << UAO_SWHASH_CLUSTER_SHIFT)
73 
74 /* Get the "tag" for this page index. */
75 #define	UAO_SWHASH_ELT_TAG(idx)		((idx) >> UAO_SWHASH_CLUSTER_SHIFT)
76 #define UAO_SWHASH_ELT_PAGESLOT_IDX(idx) \
77     ((idx) & (UAO_SWHASH_CLUSTER_SIZE - 1))
78 
79 /* Given an ELT and a page index, find the swap slot. */
80 #define	UAO_SWHASH_ELT_PAGESLOT(elt, idx) \
81     ((elt)->slots[UAO_SWHASH_ELT_PAGESLOT_IDX(idx)])
82 
83 /* Given an ELT, return its pageidx base. */
84 #define	UAO_SWHASH_ELT_PAGEIDX_BASE(ELT) \
85     ((elt)->tag << UAO_SWHASH_CLUSTER_SHIFT)
86 
87 /* The hash function. */
88 #define	UAO_SWHASH_HASH(aobj, idx) \
89     (&(aobj)->u_swhash[(((idx) >> UAO_SWHASH_CLUSTER_SHIFT) \
90     & (aobj)->u_swhashmask)])
91 
92 /*
93  * The threshold which determines whether we will use an array or a
94  * hash table to store the list of allocated swap blocks.
95  */
96 #define	UAO_SWHASH_THRESHOLD		(UAO_SWHASH_CLUSTER_SIZE * 4)
97 #define	UAO_USES_SWHASH(aobj) \
98     ((aobj)->u_pages > UAO_SWHASH_THRESHOLD)
99 
100 /* The number of buckets in a hash, with an upper bound. */
101 #define	UAO_SWHASH_MAXBUCKETS		256
102 #define	UAO_SWHASH_BUCKETS(aobj) \
103     (MIN((aobj)->u_pages >> UAO_SWHASH_CLUSTER_SHIFT, UAO_SWHASH_MAXBUCKETS))
104 
105 /*
106  * uao_swhash_elt: when a hash table is being used, this structure defines
107  * the format of an entry in the bucket list.
108  */
109 
110 struct uao_swhash_elt {
111 	LIST_ENTRY(uao_swhash_elt) list;	/* the hash list */
112 	voff_t tag;				/* our 'tag' */
113 	int count;				/* our number of active slots */
114 	int slots[UAO_SWHASH_CLUSTER_SIZE];	/* the slots */
115 };
116 
117 /*
118  * uao_swhash: the swap hash table structure
119  */
120 
121 LIST_HEAD(uao_swhash, uao_swhash_elt);
122 
123 /*
124  * uao_swhash_elt_pool: pool of uao_swhash_elt structures.
125  * Note: pages for this pool must not come from a pageable kernel map.
126  */
127 static struct pool	uao_swhash_elt_pool	__cacheline_aligned;
128 
129 /*
130  * uvm_aobj: the actual anon-backed uvm_object
131  *
132  * => the uvm_object is at the top of the structure, this allows
133  *   (struct uvm_aobj *) == (struct uvm_object *)
134  * => only one of u_swslots and u_swhash is used in any given aobj
135  */
136 
137 struct uvm_aobj {
138 	struct uvm_object u_obj; /* has: lock, pgops, memq, #pages, #refs */
139 	pgoff_t u_pages;	 /* number of pages in entire object */
140 	int u_flags;		 /* the flags (see uvm_aobj.h) */
141 	int *u_swslots;		 /* array of offset->swapslot mappings */
142 				 /*
143 				  * hashtable of offset->swapslot mappings
144 				  * (u_swhash is an array of bucket heads)
145 				  */
146 	struct uao_swhash *u_swhash;
147 	u_long u_swhashmask;		/* mask for hashtable */
148 	LIST_ENTRY(uvm_aobj) u_list;	/* global list of aobjs */
149 };
150 
151 static void	uao_free(struct uvm_aobj *);
152 static int	uao_get(struct uvm_object *, voff_t, struct vm_page **,
153 		    int *, int, vm_prot_t, int, int);
154 static int	uao_put(struct uvm_object *, voff_t, voff_t, int);
155 
156 #if defined(VMSWAP)
157 static struct uao_swhash_elt *uao_find_swhash_elt
158     (struct uvm_aobj *, int, bool);
159 
160 static bool uao_pagein(struct uvm_aobj *, int, int);
161 static bool uao_pagein_page(struct uvm_aobj *, int);
162 #endif /* defined(VMSWAP) */
163 
164 /*
165  * aobj_pager
166  *
167  * note that some functions (e.g. put) are handled elsewhere
168  */
169 
170 const struct uvm_pagerops aobj_pager = {
171 	.pgo_reference = uao_reference,
172 	.pgo_detach = uao_detach,
173 	.pgo_get = uao_get,
174 	.pgo_put = uao_put,
175 };
176 
177 /*
178  * uao_list: global list of active aobjs, locked by uao_list_lock
179  */
180 
181 static LIST_HEAD(aobjlist, uvm_aobj) uao_list	__cacheline_aligned;
182 static kmutex_t		uao_list_lock		__cacheline_aligned;
183 
184 /*
185  * hash table/array related functions
186  */
187 
188 #if defined(VMSWAP)
189 
190 /*
191  * uao_find_swhash_elt: find (or create) a hash table entry for a page
192  * offset.
193  *
194  * => the object should be locked by the caller
195  */
196 
197 static struct uao_swhash_elt *
198 uao_find_swhash_elt(struct uvm_aobj *aobj, int pageidx, bool create)
199 {
200 	struct uao_swhash *swhash;
201 	struct uao_swhash_elt *elt;
202 	voff_t page_tag;
203 
204 	swhash = UAO_SWHASH_HASH(aobj, pageidx);
205 	page_tag = UAO_SWHASH_ELT_TAG(pageidx);
206 
207 	/*
208 	 * now search the bucket for the requested tag
209 	 */
210 
211 	LIST_FOREACH(elt, swhash, list) {
212 		if (elt->tag == page_tag) {
213 			return elt;
214 		}
215 	}
216 	if (!create) {
217 		return NULL;
218 	}
219 
220 	/*
221 	 * allocate a new entry for the bucket and init/insert it in
222 	 */
223 
224 	elt = pool_get(&uao_swhash_elt_pool, PR_NOWAIT);
225 	if (elt == NULL) {
226 		return NULL;
227 	}
228 	LIST_INSERT_HEAD(swhash, elt, list);
229 	elt->tag = page_tag;
230 	elt->count = 0;
231 	memset(elt->slots, 0, sizeof(elt->slots));
232 	return elt;
233 }
234 
235 /*
236  * uao_find_swslot: find the swap slot number for an aobj/pageidx
237  *
238  * => object must be locked by caller
239  */
240 
241 int
242 uao_find_swslot(struct uvm_object *uobj, int pageidx)
243 {
244 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
245 	struct uao_swhash_elt *elt;
246 
247 	/*
248 	 * if noswap flag is set, then we never return a slot
249 	 */
250 
251 	if (aobj->u_flags & UAO_FLAG_NOSWAP)
252 		return 0;
253 
254 	/*
255 	 * if hashing, look in hash table.
256 	 */
257 
258 	if (UAO_USES_SWHASH(aobj)) {
259 		elt = uao_find_swhash_elt(aobj, pageidx, false);
260 		return elt ? UAO_SWHASH_ELT_PAGESLOT(elt, pageidx) : 0;
261 	}
262 
263 	/*
264 	 * otherwise, look in the array
265 	 */
266 
267 	return aobj->u_swslots[pageidx];
268 }
269 
270 /*
271  * uao_set_swslot: set the swap slot for a page in an aobj.
272  *
273  * => setting a slot to zero frees the slot
274  * => object must be locked by caller
275  * => we return the old slot number, or -1 if we failed to allocate
276  *    memory to record the new slot number
277  */
278 
279 int
280 uao_set_swslot(struct uvm_object *uobj, int pageidx, int slot)
281 {
282 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
283 	struct uao_swhash_elt *elt;
284 	int oldslot;
285 	UVMHIST_FUNC("uao_set_swslot"); UVMHIST_CALLED(pdhist);
286 	UVMHIST_LOG(pdhist, "aobj %p pageidx %d slot %d",
287 	    aobj, pageidx, slot, 0);
288 
289 	KASSERT(mutex_owned(uobj->vmobjlock) || uobj->uo_refs == 0);
290 
291 	/*
292 	 * if noswap flag is set, then we can't set a non-zero slot.
293 	 */
294 
295 	if (aobj->u_flags & UAO_FLAG_NOSWAP) {
296 		KASSERTMSG(slot == 0, "uao_set_swslot: no swap object");
297 		return 0;
298 	}
299 
300 	/*
301 	 * are we using a hash table?  if so, add it in the hash.
302 	 */
303 
304 	if (UAO_USES_SWHASH(aobj)) {
305 
306 		/*
307 		 * Avoid allocating an entry just to free it again if
308 		 * the page had not swap slot in the first place, and
309 		 * we are freeing.
310 		 */
311 
312 		elt = uao_find_swhash_elt(aobj, pageidx, slot != 0);
313 		if (elt == NULL) {
314 			return slot ? -1 : 0;
315 		}
316 
317 		oldslot = UAO_SWHASH_ELT_PAGESLOT(elt, pageidx);
318 		UAO_SWHASH_ELT_PAGESLOT(elt, pageidx) = slot;
319 
320 		/*
321 		 * now adjust the elt's reference counter and free it if we've
322 		 * dropped it to zero.
323 		 */
324 
325 		if (slot) {
326 			if (oldslot == 0)
327 				elt->count++;
328 		} else {
329 			if (oldslot)
330 				elt->count--;
331 
332 			if (elt->count == 0) {
333 				LIST_REMOVE(elt, list);
334 				pool_put(&uao_swhash_elt_pool, elt);
335 			}
336 		}
337 	} else {
338 		/* we are using an array */
339 		oldslot = aobj->u_swslots[pageidx];
340 		aobj->u_swslots[pageidx] = slot;
341 	}
342 	return oldslot;
343 }
344 
345 #endif /* defined(VMSWAP) */
346 
347 /*
348  * end of hash/array functions
349  */
350 
351 /*
352  * uao_free: free all resources held by an aobj, and then free the aobj
353  *
354  * => the aobj should be dead
355  */
356 
357 static void
358 uao_free(struct uvm_aobj *aobj)
359 {
360 	struct uvm_object *uobj = &aobj->u_obj;
361 
362 	KASSERT(mutex_owned(uobj->vmobjlock));
363 	uao_dropswap_range(uobj, 0, 0);
364 	mutex_exit(uobj->vmobjlock);
365 
366 #if defined(VMSWAP)
367 	if (UAO_USES_SWHASH(aobj)) {
368 
369 		/*
370 		 * free the hash table itself.
371 		 */
372 
373 		hashdone(aobj->u_swhash, HASH_LIST, aobj->u_swhashmask);
374 	} else {
375 
376 		/*
377 		 * free the array itsself.
378 		 */
379 
380 		kmem_free(aobj->u_swslots, aobj->u_pages * sizeof(int));
381 	}
382 #endif /* defined(VMSWAP) */
383 
384 	/*
385 	 * finally free the aobj itself
386 	 */
387 
388 	uvm_obj_destroy(uobj, true);
389 	kmem_free(aobj, sizeof(struct uvm_aobj));
390 }
391 
392 /*
393  * pager functions
394  */
395 
396 /*
397  * uao_create: create an aobj of the given size and return its uvm_object.
398  *
399  * => for normal use, flags are always zero
400  * => for the kernel object, the flags are:
401  *	UAO_FLAG_KERNOBJ - allocate the kernel object (can only happen once)
402  *	UAO_FLAG_KERNSWAP - enable swapping of kernel object ("           ")
403  */
404 
405 struct uvm_object *
406 uao_create(vsize_t size, int flags)
407 {
408 	static struct uvm_aobj kernel_object_store;
409 	static kmutex_t kernel_object_lock;
410 	static int kobj_alloced __diagused = 0;
411 	pgoff_t pages = round_page(size) >> PAGE_SHIFT;
412 	struct uvm_aobj *aobj;
413 	int refs;
414 
415 	/*
416 	 * Allocate a new aobj, unless kernel object is requested.
417 	 */
418 
419 	if (flags & UAO_FLAG_KERNOBJ) {
420 		KASSERT(!kobj_alloced);
421 		aobj = &kernel_object_store;
422 		aobj->u_pages = pages;
423 		aobj->u_flags = UAO_FLAG_NOSWAP;
424 		refs = UVM_OBJ_KERN;
425 		kobj_alloced = UAO_FLAG_KERNOBJ;
426 	} else if (flags & UAO_FLAG_KERNSWAP) {
427 		KASSERT(kobj_alloced == UAO_FLAG_KERNOBJ);
428 		aobj = &kernel_object_store;
429 		kobj_alloced = UAO_FLAG_KERNSWAP;
430 		refs = 0xdeadbeaf; /* XXX: gcc */
431 	} else {
432 		aobj = kmem_alloc(sizeof(struct uvm_aobj), KM_SLEEP);
433 		aobj->u_pages = pages;
434 		aobj->u_flags = 0;
435 		refs = 1;
436 	}
437 
438 	/*
439  	 * allocate hash/array if necessary
440  	 *
441  	 * note: in the KERNSWAP case no need to worry about locking since
442  	 * we are still booting we should be the only thread around.
443  	 */
444 
445 	if (flags == 0 || (flags & UAO_FLAG_KERNSWAP) != 0) {
446 #if defined(VMSWAP)
447 		const int kernswap = (flags & UAO_FLAG_KERNSWAP) != 0;
448 
449 		/* allocate hash table or array depending on object size */
450 		if (UAO_USES_SWHASH(aobj)) {
451 			aobj->u_swhash = hashinit(UAO_SWHASH_BUCKETS(aobj),
452 			    HASH_LIST, kernswap ? false : true,
453 			    &aobj->u_swhashmask);
454 			if (aobj->u_swhash == NULL)
455 				panic("uao_create: hashinit swhash failed");
456 		} else {
457 			aobj->u_swslots = kmem_zalloc(pages * sizeof(int),
458 			    kernswap ? KM_NOSLEEP : KM_SLEEP);
459 			if (aobj->u_swslots == NULL)
460 				panic("uao_create: swslots allocation failed");
461 		}
462 #endif /* defined(VMSWAP) */
463 
464 		if (flags) {
465 			aobj->u_flags &= ~UAO_FLAG_NOSWAP; /* clear noswap */
466 			return &aobj->u_obj;
467 		}
468 	}
469 
470 	/*
471 	 * Initialise UVM object.
472 	 */
473 
474 	const bool kernobj = (flags & UAO_FLAG_KERNOBJ) != 0;
475 	uvm_obj_init(&aobj->u_obj, &aobj_pager, !kernobj, refs);
476 	if (__predict_false(kernobj)) {
477 		/* Initialisation only once, for UAO_FLAG_KERNOBJ. */
478 		mutex_init(&kernel_object_lock, MUTEX_DEFAULT, IPL_NONE);
479 		uvm_obj_setlock(&aobj->u_obj, &kernel_object_lock);
480 	}
481 
482 	/*
483  	 * now that aobj is ready, add it to the global list
484  	 */
485 
486 	mutex_enter(&uao_list_lock);
487 	LIST_INSERT_HEAD(&uao_list, aobj, u_list);
488 	mutex_exit(&uao_list_lock);
489 	return(&aobj->u_obj);
490 }
491 
492 /*
493  * uao_init: set up aobj pager subsystem
494  *
495  * => called at boot time from uvm_pager_init()
496  */
497 
498 void
499 uao_init(void)
500 {
501 	static int uao_initialized;
502 
503 	if (uao_initialized)
504 		return;
505 	uao_initialized = true;
506 	LIST_INIT(&uao_list);
507 	mutex_init(&uao_list_lock, MUTEX_DEFAULT, IPL_NONE);
508 	pool_init(&uao_swhash_elt_pool, sizeof(struct uao_swhash_elt),
509 	    0, 0, 0, "uaoeltpl", NULL, IPL_VM);
510 }
511 
512 /*
513  * uao_reference: hold a reference to an anonymous UVM object.
514  */
515 void
516 uao_reference(struct uvm_object *uobj)
517 {
518 	/* Kernel object is persistent. */
519 	if (UVM_OBJ_IS_KERN_OBJECT(uobj)) {
520 		return;
521 	}
522 	atomic_inc_uint(&uobj->uo_refs);
523 }
524 
525 /*
526  * uao_detach: drop a reference to an anonymous UVM object.
527  */
528 void
529 uao_detach(struct uvm_object *uobj)
530 {
531 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
532 	struct vm_page *pg;
533 
534 	UVMHIST_FUNC("uao_detach"); UVMHIST_CALLED(maphist);
535 
536 	/*
537 	 * Detaching from kernel object is a NOP.
538 	 */
539 
540 	if (UVM_OBJ_IS_KERN_OBJECT(uobj))
541 		return;
542 
543 	/*
544 	 * Drop the reference.  If it was the last one, destroy the object.
545 	 */
546 
547 	UVMHIST_LOG(maphist,"  (uobj=0x%x)  ref=%d", uobj,uobj->uo_refs,0,0);
548 	if (atomic_dec_uint_nv(&uobj->uo_refs) > 0) {
549 		UVMHIST_LOG(maphist, "<- done (rc>0)", 0,0,0,0);
550 		return;
551 	}
552 
553 	/*
554 	 * Remove the aobj from the global list.
555 	 */
556 
557 	mutex_enter(&uao_list_lock);
558 	LIST_REMOVE(aobj, u_list);
559 	mutex_exit(&uao_list_lock);
560 
561 	/*
562 	 * Free all the pages left in the aobj.  For each page, when the
563 	 * page is no longer busy (and thus after any disk I/O that it is
564 	 * involved in is complete), release any swap resources and free
565 	 * the page itself.
566 	 */
567 
568 	mutex_enter(uobj->vmobjlock);
569 	mutex_enter(&uvm_pageqlock);
570 	while ((pg = TAILQ_FIRST(&uobj->memq)) != NULL) {
571 		pmap_page_protect(pg, VM_PROT_NONE);
572 		if (pg->flags & PG_BUSY) {
573 			pg->flags |= PG_WANTED;
574 			mutex_exit(&uvm_pageqlock);
575 			UVM_UNLOCK_AND_WAIT(pg, uobj->vmobjlock, false,
576 			    "uao_det", 0);
577 			mutex_enter(uobj->vmobjlock);
578 			mutex_enter(&uvm_pageqlock);
579 			continue;
580 		}
581 		uao_dropswap(&aobj->u_obj, pg->offset >> PAGE_SHIFT);
582 		uvm_pagefree(pg);
583 	}
584 	mutex_exit(&uvm_pageqlock);
585 
586 	/*
587 	 * Finally, free the anonymous UVM object itself.
588 	 */
589 
590 	uao_free(aobj);
591 }
592 
593 /*
594  * uao_put: flush pages out of a uvm object
595  *
596  * => object should be locked by caller.  we may _unlock_ the object
597  *	if (and only if) we need to clean a page (PGO_CLEANIT).
598  *	XXXJRT Currently, however, we don't.  In the case of cleaning
599  *	XXXJRT a page, we simply just deactivate it.  Should probably
600  *	XXXJRT handle this better, in the future (although "flushing"
601  *	XXXJRT anonymous memory isn't terribly important).
602  * => if PGO_CLEANIT is not set, then we will neither unlock the object
603  *	or block.
604  * => if PGO_ALLPAGE is set, then all pages in the object are valid targets
605  *	for flushing.
606  * => NOTE: we rely on the fact that the object's memq is a TAILQ and
607  *	that new pages are inserted on the tail end of the list.  thus,
608  *	we can make a complete pass through the object in one go by starting
609  *	at the head and working towards the tail (new pages are put in
610  *	front of us).
611  * => NOTE: we are allowed to lock the page queues, so the caller
612  *	must not be holding the lock on them [e.g. pagedaemon had
613  *	better not call us with the queues locked]
614  * => we return 0 unless we encountered some sort of I/O error
615  *	XXXJRT currently never happens, as we never directly initiate
616  *	XXXJRT I/O
617  *
618  * note on page traversal:
619  *	we can traverse the pages in an object either by going down the
620  *	linked list in "uobj->memq", or we can go over the address range
621  *	by page doing hash table lookups for each address.  depending
622  *	on how many pages are in the object it may be cheaper to do one
623  *	or the other.  we set "by_list" to true if we are using memq.
624  *	if the cost of a hash lookup was equal to the cost of the list
625  *	traversal we could compare the number of pages in the start->stop
626  *	range to the total number of pages in the object.  however, it
627  *	seems that a hash table lookup is more expensive than the linked
628  *	list traversal, so we multiply the number of pages in the
629  *	start->stop range by a penalty which we define below.
630  */
631 
632 static int
633 uao_put(struct uvm_object *uobj, voff_t start, voff_t stop, int flags)
634 {
635 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
636 	struct vm_page *pg, *nextpg, curmp, endmp;
637 	bool by_list;
638 	voff_t curoff;
639 	UVMHIST_FUNC("uao_put"); UVMHIST_CALLED(maphist);
640 
641 	KASSERT(mutex_owned(uobj->vmobjlock));
642 
643 	curoff = 0;
644 	if (flags & PGO_ALLPAGES) {
645 		start = 0;
646 		stop = aobj->u_pages << PAGE_SHIFT;
647 		by_list = true;		/* always go by the list */
648 	} else {
649 		start = trunc_page(start);
650 		if (stop == 0) {
651 			stop = aobj->u_pages << PAGE_SHIFT;
652 		} else {
653 			stop = round_page(stop);
654 		}
655 		if (stop > (aobj->u_pages << PAGE_SHIFT)) {
656 			printf("uao_flush: strange, got an out of range "
657 			    "flush (fixed)\n");
658 			stop = aobj->u_pages << PAGE_SHIFT;
659 		}
660 		by_list = (uobj->uo_npages <=
661 		    ((stop - start) >> PAGE_SHIFT) * UVM_PAGE_TREE_PENALTY);
662 	}
663 	UVMHIST_LOG(maphist,
664 	    " flush start=0x%lx, stop=0x%x, by_list=%d, flags=0x%x",
665 	    start, stop, by_list, flags);
666 
667 	/*
668 	 * Don't need to do any work here if we're not freeing
669 	 * or deactivating pages.
670 	 */
671 
672 	if ((flags & (PGO_DEACTIVATE|PGO_FREE)) == 0) {
673 		mutex_exit(uobj->vmobjlock);
674 		return 0;
675 	}
676 
677 	/*
678 	 * Initialize the marker pages.  See the comment in
679 	 * genfs_putpages() also.
680 	 */
681 
682 	curmp.flags = PG_MARKER;
683 	endmp.flags = PG_MARKER;
684 
685 	/*
686 	 * now do it.  note: we must update nextpg in the body of loop or we
687 	 * will get stuck.  we need to use nextpg if we'll traverse the list
688 	 * because we may free "pg" before doing the next loop.
689 	 */
690 
691 	if (by_list) {
692 		TAILQ_INSERT_TAIL(&uobj->memq, &endmp, listq.queue);
693 		nextpg = TAILQ_FIRST(&uobj->memq);
694 	} else {
695 		curoff = start;
696 		nextpg = NULL;	/* Quell compiler warning */
697 	}
698 
699 	/* locked: uobj */
700 	for (;;) {
701 		if (by_list) {
702 			pg = nextpg;
703 			if (pg == &endmp)
704 				break;
705 			nextpg = TAILQ_NEXT(pg, listq.queue);
706 			if (pg->flags & PG_MARKER)
707 				continue;
708 			if (pg->offset < start || pg->offset >= stop)
709 				continue;
710 		} else {
711 			if (curoff < stop) {
712 				pg = uvm_pagelookup(uobj, curoff);
713 				curoff += PAGE_SIZE;
714 			} else
715 				break;
716 			if (pg == NULL)
717 				continue;
718 		}
719 
720 		/*
721 		 * wait and try again if the page is busy.
722 		 */
723 
724 		if (pg->flags & PG_BUSY) {
725 			if (by_list) {
726 				TAILQ_INSERT_BEFORE(pg, &curmp, listq.queue);
727 			}
728 			pg->flags |= PG_WANTED;
729 			UVM_UNLOCK_AND_WAIT(pg, uobj->vmobjlock, 0,
730 			    "uao_put", 0);
731 			mutex_enter(uobj->vmobjlock);
732 			if (by_list) {
733 				nextpg = TAILQ_NEXT(&curmp, listq.queue);
734 				TAILQ_REMOVE(&uobj->memq, &curmp,
735 				    listq.queue);
736 			} else
737 				curoff -= PAGE_SIZE;
738 			continue;
739 		}
740 
741 		switch (flags & (PGO_CLEANIT|PGO_FREE|PGO_DEACTIVATE)) {
742 
743 		/*
744 		 * XXX In these first 3 cases, we always just
745 		 * XXX deactivate the page.  We may want to
746 		 * XXX handle the different cases more specifically
747 		 * XXX in the future.
748 		 */
749 
750 		case PGO_CLEANIT|PGO_FREE:
751 		case PGO_CLEANIT|PGO_DEACTIVATE:
752 		case PGO_DEACTIVATE:
753  deactivate_it:
754 			mutex_enter(&uvm_pageqlock);
755 			/* skip the page if it's wired */
756 			if (pg->wire_count == 0) {
757 				uvm_pagedeactivate(pg);
758 			}
759 			mutex_exit(&uvm_pageqlock);
760 			break;
761 
762 		case PGO_FREE:
763 			/*
764 			 * If there are multiple references to
765 			 * the object, just deactivate the page.
766 			 */
767 
768 			if (uobj->uo_refs > 1)
769 				goto deactivate_it;
770 
771 			/*
772 			 * free the swap slot and the page.
773 			 */
774 
775 			pmap_page_protect(pg, VM_PROT_NONE);
776 
777 			/*
778 			 * freeing swapslot here is not strictly necessary.
779 			 * however, leaving it here doesn't save much
780 			 * because we need to update swap accounting anyway.
781 			 */
782 
783 			uao_dropswap(uobj, pg->offset >> PAGE_SHIFT);
784 			mutex_enter(&uvm_pageqlock);
785 			uvm_pagefree(pg);
786 			mutex_exit(&uvm_pageqlock);
787 			break;
788 
789 		default:
790 			panic("%s: impossible", __func__);
791 		}
792 	}
793 	if (by_list) {
794 		TAILQ_REMOVE(&uobj->memq, &endmp, listq.queue);
795 	}
796 	mutex_exit(uobj->vmobjlock);
797 	return 0;
798 }
799 
800 /*
801  * uao_get: fetch me a page
802  *
803  * we have three cases:
804  * 1: page is resident     -> just return the page.
805  * 2: page is zero-fill    -> allocate a new page and zero it.
806  * 3: page is swapped out  -> fetch the page from swap.
807  *
808  * cases 1 and 2 can be handled with PGO_LOCKED, case 3 cannot.
809  * so, if the "center" page hits case 3 (or any page, with PGO_ALLPAGES),
810  * then we will need to return EBUSY.
811  *
812  * => prefer map unlocked (not required)
813  * => object must be locked!  we will _unlock_ it before starting any I/O.
814  * => flags: PGO_ALLPAGES: get all of the pages
815  *           PGO_LOCKED: fault data structures are locked
816  * => NOTE: offset is the offset of pps[0], _NOT_ pps[centeridx]
817  * => NOTE: caller must check for released pages!!
818  */
819 
820 static int
821 uao_get(struct uvm_object *uobj, voff_t offset, struct vm_page **pps,
822     int *npagesp, int centeridx, vm_prot_t access_type, int advice, int flags)
823 {
824 	voff_t current_offset;
825 	struct vm_page *ptmp = NULL;	/* Quell compiler warning */
826 	int lcv, gotpages, maxpages, swslot, pageidx;
827 	bool done;
828 	UVMHIST_FUNC("uao_get"); UVMHIST_CALLED(pdhist);
829 
830 	UVMHIST_LOG(pdhist, "aobj=%p offset=%d, flags=%d",
831 		    (struct uvm_aobj *)uobj, offset, flags,0);
832 
833 	/*
834  	 * get number of pages
835  	 */
836 
837 	maxpages = *npagesp;
838 
839 	/*
840  	 * step 1: handled the case where fault data structures are locked.
841  	 */
842 
843 	if (flags & PGO_LOCKED) {
844 
845 		/*
846  		 * step 1a: get pages that are already resident.   only do
847 		 * this if the data structures are locked (i.e. the first
848 		 * time through).
849  		 */
850 
851 		done = true;	/* be optimistic */
852 		gotpages = 0;	/* # of pages we got so far */
853 		for (lcv = 0, current_offset = offset ; lcv < maxpages ;
854 		    lcv++, current_offset += PAGE_SIZE) {
855 			/* do we care about this page?  if not, skip it */
856 			if (pps[lcv] == PGO_DONTCARE)
857 				continue;
858 			ptmp = uvm_pagelookup(uobj, current_offset);
859 
860 			/*
861  			 * if page is new, attempt to allocate the page,
862 			 * zero-fill'd.
863  			 */
864 
865 			if (ptmp == NULL && uao_find_swslot(uobj,
866 			    current_offset >> PAGE_SHIFT) == 0) {
867 				ptmp = uvm_pagealloc(uobj, current_offset,
868 				    NULL, UVM_FLAG_COLORMATCH|UVM_PGA_ZERO);
869 				if (ptmp) {
870 					/* new page */
871 					ptmp->flags &= ~(PG_FAKE);
872 					ptmp->pqflags |= PQ_AOBJ;
873 					goto gotpage;
874 				}
875 			}
876 
877 			/*
878 			 * to be useful must get a non-busy page
879 			 */
880 
881 			if (ptmp == NULL || (ptmp->flags & PG_BUSY) != 0) {
882 				if (lcv == centeridx ||
883 				    (flags & PGO_ALLPAGES) != 0)
884 					/* need to do a wait or I/O! */
885 					done = false;
886 					continue;
887 			}
888 
889 			/*
890 			 * useful page: busy/lock it and plug it in our
891 			 * result array
892 			 */
893 
894 			/* caller must un-busy this page */
895 			ptmp->flags |= PG_BUSY;
896 			UVM_PAGE_OWN(ptmp, "uao_get1");
897 gotpage:
898 			pps[lcv] = ptmp;
899 			gotpages++;
900 		}
901 
902 		/*
903  		 * step 1b: now we've either done everything needed or we
904 		 * to unlock and do some waiting or I/O.
905  		 */
906 
907 		UVMHIST_LOG(pdhist, "<- done (done=%d)", done, 0,0,0);
908 		*npagesp = gotpages;
909 		if (done)
910 			return 0;
911 		else
912 			return EBUSY;
913 	}
914 
915 	/*
916  	 * step 2: get non-resident or busy pages.
917  	 * object is locked.   data structures are unlocked.
918  	 */
919 
920 	if ((flags & PGO_SYNCIO) == 0) {
921 		goto done;
922 	}
923 
924 	for (lcv = 0, current_offset = offset ; lcv < maxpages ;
925 	    lcv++, current_offset += PAGE_SIZE) {
926 
927 		/*
928 		 * - skip over pages we've already gotten or don't want
929 		 * - skip over pages we don't _have_ to get
930 		 */
931 
932 		if (pps[lcv] != NULL ||
933 		    (lcv != centeridx && (flags & PGO_ALLPAGES) == 0))
934 			continue;
935 
936 		pageidx = current_offset >> PAGE_SHIFT;
937 
938 		/*
939  		 * we have yet to locate the current page (pps[lcv]).   we
940 		 * first look for a page that is already at the current offset.
941 		 * if we find a page, we check to see if it is busy or
942 		 * released.  if that is the case, then we sleep on the page
943 		 * until it is no longer busy or released and repeat the lookup.
944 		 * if the page we found is neither busy nor released, then we
945 		 * busy it (so we own it) and plug it into pps[lcv].   this
946 		 * 'break's the following while loop and indicates we are
947 		 * ready to move on to the next page in the "lcv" loop above.
948  		 *
949  		 * if we exit the while loop with pps[lcv] still set to NULL,
950 		 * then it means that we allocated a new busy/fake/clean page
951 		 * ptmp in the object and we need to do I/O to fill in the data.
952  		 */
953 
954 		/* top of "pps" while loop */
955 		while (pps[lcv] == NULL) {
956 			/* look for a resident page */
957 			ptmp = uvm_pagelookup(uobj, current_offset);
958 
959 			/* not resident?   allocate one now (if we can) */
960 			if (ptmp == NULL) {
961 
962 				ptmp = uvm_pagealloc(uobj, current_offset,
963 				    NULL, 0);
964 
965 				/* out of RAM? */
966 				if (ptmp == NULL) {
967 					mutex_exit(uobj->vmobjlock);
968 					UVMHIST_LOG(pdhist,
969 					    "sleeping, ptmp == NULL\n",0,0,0,0);
970 					uvm_wait("uao_getpage");
971 					mutex_enter(uobj->vmobjlock);
972 					continue;
973 				}
974 
975 				/*
976 				 * safe with PQ's unlocked: because we just
977 				 * alloc'd the page
978 				 */
979 
980 				ptmp->pqflags |= PQ_AOBJ;
981 
982 				/*
983 				 * got new page ready for I/O.  break pps while
984 				 * loop.  pps[lcv] is still NULL.
985 				 */
986 
987 				break;
988 			}
989 
990 			/* page is there, see if we need to wait on it */
991 			if ((ptmp->flags & PG_BUSY) != 0) {
992 				ptmp->flags |= PG_WANTED;
993 				UVMHIST_LOG(pdhist,
994 				    "sleeping, ptmp->flags 0x%x\n",
995 				    ptmp->flags,0,0,0);
996 				UVM_UNLOCK_AND_WAIT(ptmp, uobj->vmobjlock,
997 				    false, "uao_get", 0);
998 				mutex_enter(uobj->vmobjlock);
999 				continue;
1000 			}
1001 
1002 			/*
1003  			 * if we get here then the page has become resident and
1004 			 * unbusy between steps 1 and 2.  we busy it now (so we
1005 			 * own it) and set pps[lcv] (so that we exit the while
1006 			 * loop).
1007  			 */
1008 
1009 			/* we own it, caller must un-busy */
1010 			ptmp->flags |= PG_BUSY;
1011 			UVM_PAGE_OWN(ptmp, "uao_get2");
1012 			pps[lcv] = ptmp;
1013 		}
1014 
1015 		/*
1016  		 * if we own the valid page at the correct offset, pps[lcv] will
1017  		 * point to it.   nothing more to do except go to the next page.
1018  		 */
1019 
1020 		if (pps[lcv])
1021 			continue;			/* next lcv */
1022 
1023 		/*
1024  		 * we have a "fake/busy/clean" page that we just allocated.
1025  		 * do the needed "i/o", either reading from swap or zeroing.
1026  		 */
1027 
1028 		swslot = uao_find_swslot(uobj, pageidx);
1029 
1030 		/*
1031  		 * just zero the page if there's nothing in swap.
1032  		 */
1033 
1034 		if (swslot == 0) {
1035 
1036 			/*
1037 			 * page hasn't existed before, just zero it.
1038 			 */
1039 
1040 			uvm_pagezero(ptmp);
1041 		} else {
1042 #if defined(VMSWAP)
1043 			int error;
1044 
1045 			UVMHIST_LOG(pdhist, "pagein from swslot %d",
1046 			     swslot, 0,0,0);
1047 
1048 			/*
1049 			 * page in the swapped-out page.
1050 			 * unlock object for i/o, relock when done.
1051 			 */
1052 
1053 			mutex_exit(uobj->vmobjlock);
1054 			error = uvm_swap_get(ptmp, swslot, PGO_SYNCIO);
1055 			mutex_enter(uobj->vmobjlock);
1056 
1057 			/*
1058 			 * I/O done.  check for errors.
1059 			 */
1060 
1061 			if (error != 0) {
1062 				UVMHIST_LOG(pdhist, "<- done (error=%d)",
1063 				    error,0,0,0);
1064 				if (ptmp->flags & PG_WANTED)
1065 					wakeup(ptmp);
1066 
1067 				/*
1068 				 * remove the swap slot from the aobj
1069 				 * and mark the aobj as having no real slot.
1070 				 * don't free the swap slot, thus preventing
1071 				 * it from being used again.
1072 				 */
1073 
1074 				swslot = uao_set_swslot(uobj, pageidx,
1075 				    SWSLOT_BAD);
1076 				if (swslot > 0) {
1077 					uvm_swap_markbad(swslot, 1);
1078 				}
1079 
1080 				mutex_enter(&uvm_pageqlock);
1081 				uvm_pagefree(ptmp);
1082 				mutex_exit(&uvm_pageqlock);
1083 				mutex_exit(uobj->vmobjlock);
1084 				return error;
1085 			}
1086 #else /* defined(VMSWAP) */
1087 			panic("%s: pagein", __func__);
1088 #endif /* defined(VMSWAP) */
1089 		}
1090 
1091 		if ((access_type & VM_PROT_WRITE) == 0) {
1092 			ptmp->flags |= PG_CLEAN;
1093 			pmap_clear_modify(ptmp);
1094 		}
1095 
1096 		/*
1097  		 * we got the page!   clear the fake flag (indicates valid
1098 		 * data now in page) and plug into our result array.   note
1099 		 * that page is still busy.
1100  		 *
1101  		 * it is the callers job to:
1102  		 * => check if the page is released
1103  		 * => unbusy the page
1104  		 * => activate the page
1105  		 */
1106 
1107 		ptmp->flags &= ~PG_FAKE;
1108 		pps[lcv] = ptmp;
1109 	}
1110 
1111 	/*
1112  	 * finally, unlock object and return.
1113  	 */
1114 
1115 done:
1116 	mutex_exit(uobj->vmobjlock);
1117 	UVMHIST_LOG(pdhist, "<- done (OK)",0,0,0,0);
1118 	return 0;
1119 }
1120 
1121 #if defined(VMSWAP)
1122 
1123 /*
1124  * uao_dropswap:  release any swap resources from this aobj page.
1125  *
1126  * => aobj must be locked or have a reference count of 0.
1127  */
1128 
1129 void
1130 uao_dropswap(struct uvm_object *uobj, int pageidx)
1131 {
1132 	int slot;
1133 
1134 	slot = uao_set_swslot(uobj, pageidx, 0);
1135 	if (slot) {
1136 		uvm_swap_free(slot, 1);
1137 	}
1138 }
1139 
1140 /*
1141  * page in every page in every aobj that is paged-out to a range of swslots.
1142  *
1143  * => nothing should be locked.
1144  * => returns true if pagein was aborted due to lack of memory.
1145  */
1146 
1147 bool
1148 uao_swap_off(int startslot, int endslot)
1149 {
1150 	struct uvm_aobj *aobj;
1151 
1152 	/*
1153 	 * Walk the list of all anonymous UVM objects.  Grab the first.
1154 	 */
1155 	mutex_enter(&uao_list_lock);
1156 	if ((aobj = LIST_FIRST(&uao_list)) == NULL) {
1157 		mutex_exit(&uao_list_lock);
1158 		return false;
1159 	}
1160 	uao_reference(&aobj->u_obj);
1161 
1162 	do {
1163 		struct uvm_aobj *nextaobj;
1164 		bool rv;
1165 
1166 		/*
1167 		 * Prefetch the next object and immediately hold a reference
1168 		 * on it, so neither the current nor the next entry could
1169 		 * disappear while we are iterating.
1170 		 */
1171 		if ((nextaobj = LIST_NEXT(aobj, u_list)) != NULL) {
1172 			uao_reference(&nextaobj->u_obj);
1173 		}
1174 		mutex_exit(&uao_list_lock);
1175 
1176 		/*
1177 		 * Page in all pages in the swap slot range.
1178 		 */
1179 		mutex_enter(aobj->u_obj.vmobjlock);
1180 		rv = uao_pagein(aobj, startslot, endslot);
1181 		mutex_exit(aobj->u_obj.vmobjlock);
1182 
1183 		/* Drop the reference of the current object. */
1184 		uao_detach(&aobj->u_obj);
1185 		if (rv) {
1186 			if (nextaobj) {
1187 				uao_detach(&nextaobj->u_obj);
1188 			}
1189 			return rv;
1190 		}
1191 
1192 		aobj = nextaobj;
1193 		mutex_enter(&uao_list_lock);
1194 	} while (aobj);
1195 
1196 	mutex_exit(&uao_list_lock);
1197 	return false;
1198 }
1199 
1200 /*
1201  * page in any pages from aobj in the given range.
1202  *
1203  * => aobj must be locked and is returned locked.
1204  * => returns true if pagein was aborted due to lack of memory.
1205  */
1206 static bool
1207 uao_pagein(struct uvm_aobj *aobj, int startslot, int endslot)
1208 {
1209 	bool rv;
1210 
1211 	if (UAO_USES_SWHASH(aobj)) {
1212 		struct uao_swhash_elt *elt;
1213 		int buck;
1214 
1215 restart:
1216 		for (buck = aobj->u_swhashmask; buck >= 0; buck--) {
1217 			for (elt = LIST_FIRST(&aobj->u_swhash[buck]);
1218 			     elt != NULL;
1219 			     elt = LIST_NEXT(elt, list)) {
1220 				int i;
1221 
1222 				for (i = 0; i < UAO_SWHASH_CLUSTER_SIZE; i++) {
1223 					int slot = elt->slots[i];
1224 
1225 					/*
1226 					 * if the slot isn't in range, skip it.
1227 					 */
1228 
1229 					if (slot < startslot ||
1230 					    slot >= endslot) {
1231 						continue;
1232 					}
1233 
1234 					/*
1235 					 * process the page,
1236 					 * the start over on this object
1237 					 * since the swhash elt
1238 					 * may have been freed.
1239 					 */
1240 
1241 					rv = uao_pagein_page(aobj,
1242 					  UAO_SWHASH_ELT_PAGEIDX_BASE(elt) + i);
1243 					if (rv) {
1244 						return rv;
1245 					}
1246 					goto restart;
1247 				}
1248 			}
1249 		}
1250 	} else {
1251 		int i;
1252 
1253 		for (i = 0; i < aobj->u_pages; i++) {
1254 			int slot = aobj->u_swslots[i];
1255 
1256 			/*
1257 			 * if the slot isn't in range, skip it
1258 			 */
1259 
1260 			if (slot < startslot || slot >= endslot) {
1261 				continue;
1262 			}
1263 
1264 			/*
1265 			 * process the page.
1266 			 */
1267 
1268 			rv = uao_pagein_page(aobj, i);
1269 			if (rv) {
1270 				return rv;
1271 			}
1272 		}
1273 	}
1274 
1275 	return false;
1276 }
1277 
1278 /*
1279  * uao_pagein_page: page in a single page from an anonymous UVM object.
1280  *
1281  * => Returns true if pagein was aborted due to lack of memory.
1282  * => Object must be locked and is returned locked.
1283  */
1284 
1285 static bool
1286 uao_pagein_page(struct uvm_aobj *aobj, int pageidx)
1287 {
1288 	struct uvm_object *uobj = &aobj->u_obj;
1289 	struct vm_page *pg;
1290 	int rv, npages;
1291 
1292 	pg = NULL;
1293 	npages = 1;
1294 
1295 	KASSERT(mutex_owned(uobj->vmobjlock));
1296 	rv = uao_get(uobj, pageidx << PAGE_SHIFT, &pg, &npages,
1297 	    0, VM_PROT_READ | VM_PROT_WRITE, 0, PGO_SYNCIO);
1298 
1299 	/*
1300 	 * relock and finish up.
1301 	 */
1302 
1303 	mutex_enter(uobj->vmobjlock);
1304 	switch (rv) {
1305 	case 0:
1306 		break;
1307 
1308 	case EIO:
1309 	case ERESTART:
1310 
1311 		/*
1312 		 * nothing more to do on errors.
1313 		 * ERESTART can only mean that the anon was freed,
1314 		 * so again there's nothing to do.
1315 		 */
1316 
1317 		return false;
1318 
1319 	default:
1320 		return true;
1321 	}
1322 
1323 	/*
1324 	 * ok, we've got the page now.
1325 	 * mark it as dirty, clear its swslot and un-busy it.
1326 	 */
1327 	uao_dropswap(&aobj->u_obj, pageidx);
1328 
1329 	/*
1330 	 * make sure it's on a page queue.
1331 	 */
1332 	mutex_enter(&uvm_pageqlock);
1333 	if (pg->wire_count == 0)
1334 		uvm_pageenqueue(pg);
1335 	mutex_exit(&uvm_pageqlock);
1336 
1337 	if (pg->flags & PG_WANTED) {
1338 		wakeup(pg);
1339 	}
1340 	pg->flags &= ~(PG_WANTED|PG_BUSY|PG_CLEAN|PG_FAKE);
1341 	UVM_PAGE_OWN(pg, NULL);
1342 
1343 	return false;
1344 }
1345 
1346 /*
1347  * uao_dropswap_range: drop swapslots in the range.
1348  *
1349  * => aobj must be locked and is returned locked.
1350  * => start is inclusive.  end is exclusive.
1351  */
1352 
1353 void
1354 uao_dropswap_range(struct uvm_object *uobj, voff_t start, voff_t end)
1355 {
1356 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
1357 	int swpgonlydelta = 0;
1358 
1359 	KASSERT(mutex_owned(uobj->vmobjlock));
1360 
1361 	if (end == 0) {
1362 		end = INT64_MAX;
1363 	}
1364 
1365 	if (UAO_USES_SWHASH(aobj)) {
1366 		int i, hashbuckets = aobj->u_swhashmask + 1;
1367 		voff_t taghi;
1368 		voff_t taglo;
1369 
1370 		taglo = UAO_SWHASH_ELT_TAG(start);
1371 		taghi = UAO_SWHASH_ELT_TAG(end);
1372 
1373 		for (i = 0; i < hashbuckets; i++) {
1374 			struct uao_swhash_elt *elt, *next;
1375 
1376 			for (elt = LIST_FIRST(&aobj->u_swhash[i]);
1377 			     elt != NULL;
1378 			     elt = next) {
1379 				int startidx, endidx;
1380 				int j;
1381 
1382 				next = LIST_NEXT(elt, list);
1383 
1384 				if (elt->tag < taglo || taghi < elt->tag) {
1385 					continue;
1386 				}
1387 
1388 				if (elt->tag == taglo) {
1389 					startidx =
1390 					    UAO_SWHASH_ELT_PAGESLOT_IDX(start);
1391 				} else {
1392 					startidx = 0;
1393 				}
1394 
1395 				if (elt->tag == taghi) {
1396 					endidx =
1397 					    UAO_SWHASH_ELT_PAGESLOT_IDX(end);
1398 				} else {
1399 					endidx = UAO_SWHASH_CLUSTER_SIZE;
1400 				}
1401 
1402 				for (j = startidx; j < endidx; j++) {
1403 					int slot = elt->slots[j];
1404 
1405 					KASSERT(uvm_pagelookup(&aobj->u_obj,
1406 					    (UAO_SWHASH_ELT_PAGEIDX_BASE(elt)
1407 					    + j) << PAGE_SHIFT) == NULL);
1408 					if (slot > 0) {
1409 						uvm_swap_free(slot, 1);
1410 						swpgonlydelta++;
1411 						KASSERT(elt->count > 0);
1412 						elt->slots[j] = 0;
1413 						elt->count--;
1414 					}
1415 				}
1416 
1417 				if (elt->count == 0) {
1418 					LIST_REMOVE(elt, list);
1419 					pool_put(&uao_swhash_elt_pool, elt);
1420 				}
1421 			}
1422 		}
1423 	} else {
1424 		int i;
1425 
1426 		if (aobj->u_pages < end) {
1427 			end = aobj->u_pages;
1428 		}
1429 		for (i = start; i < end; i++) {
1430 			int slot = aobj->u_swslots[i];
1431 
1432 			if (slot > 0) {
1433 				uvm_swap_free(slot, 1);
1434 				swpgonlydelta++;
1435 			}
1436 		}
1437 	}
1438 
1439 	/*
1440 	 * adjust the counter of pages only in swap for all
1441 	 * the swap slots we've freed.
1442 	 */
1443 
1444 	if (swpgonlydelta > 0) {
1445 		mutex_enter(&uvm_swap_data_lock);
1446 		KASSERT(uvmexp.swpgonly >= swpgonlydelta);
1447 		uvmexp.swpgonly -= swpgonlydelta;
1448 		mutex_exit(&uvm_swap_data_lock);
1449 	}
1450 }
1451 
1452 #endif /* defined(VMSWAP) */
1453