xref: /netbsd-src/sys/uvm/uvm_aobj.c (revision e6c7e151de239c49d2e38720a061ed9d1fa99309)
1 /*	$NetBSD: uvm_aobj.c,v 1.139 2020/03/22 18:32:42 ad Exp $	*/
2 
3 /*
4  * Copyright (c) 1998 Chuck Silvers, Charles D. Cranor and
5  *                    Washington University.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  *
28  * from: Id: uvm_aobj.c,v 1.1.2.5 1998/02/06 05:14:38 chs Exp
29  */
30 
31 /*
32  * uvm_aobj.c: anonymous memory uvm_object pager
33  *
34  * author: Chuck Silvers <chuq@chuq.com>
35  * started: Jan-1998
36  *
37  * - design mostly from Chuck Cranor
38  */
39 
40 #include <sys/cdefs.h>
41 __KERNEL_RCSID(0, "$NetBSD: uvm_aobj.c,v 1.139 2020/03/22 18:32:42 ad Exp $");
42 
43 #ifdef _KERNEL_OPT
44 #include "opt_uvmhist.h"
45 #endif
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/kmem.h>
51 #include <sys/pool.h>
52 #include <sys/atomic.h>
53 
54 #include <uvm/uvm.h>
55 #include <uvm/uvm_page_array.h>
56 
57 /*
58  * An anonymous UVM object (aobj) manages anonymous-memory.  In addition to
59  * keeping the list of resident pages, it may also keep a list of allocated
60  * swap blocks.  Depending on the size of the object, this list is either
61  * stored in an array (small objects) or in a hash table (large objects).
62  *
63  * Lock order
64  *
65  *	uao_list_lock ->
66  *		uvm_object::vmobjlock
67  */
68 
69 /*
70  * Note: for hash tables, we break the address space of the aobj into blocks
71  * of UAO_SWHASH_CLUSTER_SIZE pages, which shall be a power of two.
72  */
73 
74 #define	UAO_SWHASH_CLUSTER_SHIFT	4
75 #define	UAO_SWHASH_CLUSTER_SIZE		(1 << UAO_SWHASH_CLUSTER_SHIFT)
76 
77 /* Get the "tag" for this page index. */
78 #define	UAO_SWHASH_ELT_TAG(idx)		((idx) >> UAO_SWHASH_CLUSTER_SHIFT)
79 #define UAO_SWHASH_ELT_PAGESLOT_IDX(idx) \
80     ((idx) & (UAO_SWHASH_CLUSTER_SIZE - 1))
81 
82 /* Given an ELT and a page index, find the swap slot. */
83 #define	UAO_SWHASH_ELT_PAGESLOT(elt, idx) \
84     ((elt)->slots[UAO_SWHASH_ELT_PAGESLOT_IDX(idx)])
85 
86 /* Given an ELT, return its pageidx base. */
87 #define	UAO_SWHASH_ELT_PAGEIDX_BASE(ELT) \
88     ((elt)->tag << UAO_SWHASH_CLUSTER_SHIFT)
89 
90 /* The hash function. */
91 #define	UAO_SWHASH_HASH(aobj, idx) \
92     (&(aobj)->u_swhash[(((idx) >> UAO_SWHASH_CLUSTER_SHIFT) \
93     & (aobj)->u_swhashmask)])
94 
95 /*
96  * The threshold which determines whether we will use an array or a
97  * hash table to store the list of allocated swap blocks.
98  */
99 #define	UAO_SWHASH_THRESHOLD		(UAO_SWHASH_CLUSTER_SIZE * 4)
100 #define	UAO_USES_SWHASH(aobj) \
101     ((aobj)->u_pages > UAO_SWHASH_THRESHOLD)
102 
103 /* The number of buckets in a hash, with an upper bound. */
104 #define	UAO_SWHASH_MAXBUCKETS		256
105 #define	UAO_SWHASH_BUCKETS(aobj) \
106     (MIN((aobj)->u_pages >> UAO_SWHASH_CLUSTER_SHIFT, UAO_SWHASH_MAXBUCKETS))
107 
108 /*
109  * uao_swhash_elt: when a hash table is being used, this structure defines
110  * the format of an entry in the bucket list.
111  */
112 
113 struct uao_swhash_elt {
114 	LIST_ENTRY(uao_swhash_elt) list;	/* the hash list */
115 	voff_t tag;				/* our 'tag' */
116 	int count;				/* our number of active slots */
117 	int slots[UAO_SWHASH_CLUSTER_SIZE];	/* the slots */
118 };
119 
120 /*
121  * uao_swhash: the swap hash table structure
122  */
123 
124 LIST_HEAD(uao_swhash, uao_swhash_elt);
125 
126 /*
127  * uao_swhash_elt_pool: pool of uao_swhash_elt structures.
128  * Note: pages for this pool must not come from a pageable kernel map.
129  */
130 static struct pool	uao_swhash_elt_pool	__cacheline_aligned;
131 
132 /*
133  * uvm_aobj: the actual anon-backed uvm_object
134  *
135  * => the uvm_object is at the top of the structure, this allows
136  *   (struct uvm_aobj *) == (struct uvm_object *)
137  * => only one of u_swslots and u_swhash is used in any given aobj
138  */
139 
140 struct uvm_aobj {
141 	struct uvm_object u_obj; /* has: lock, pgops, #pages, #refs */
142 	pgoff_t u_pages;	 /* number of pages in entire object */
143 	int u_flags;		 /* the flags (see uvm_aobj.h) */
144 	int *u_swslots;		 /* array of offset->swapslot mappings */
145 				 /*
146 				  * hashtable of offset->swapslot mappings
147 				  * (u_swhash is an array of bucket heads)
148 				  */
149 	struct uao_swhash *u_swhash;
150 	u_long u_swhashmask;		/* mask for hashtable */
151 	LIST_ENTRY(uvm_aobj) u_list;	/* global list of aobjs */
152 	int u_freelist;		  /* freelist to allocate pages from */
153 };
154 
155 static void	uao_free(struct uvm_aobj *);
156 static int	uao_get(struct uvm_object *, voff_t, struct vm_page **,
157 		    int *, int, vm_prot_t, int, int);
158 static int	uao_put(struct uvm_object *, voff_t, voff_t, int);
159 
160 #if defined(VMSWAP)
161 static struct uao_swhash_elt *uao_find_swhash_elt
162     (struct uvm_aobj *, int, bool);
163 
164 static bool uao_pagein(struct uvm_aobj *, int, int);
165 static bool uao_pagein_page(struct uvm_aobj *, int);
166 #endif /* defined(VMSWAP) */
167 
168 static struct vm_page	*uao_pagealloc(struct uvm_object *, voff_t, int);
169 
170 /*
171  * aobj_pager
172  *
173  * note that some functions (e.g. put) are handled elsewhere
174  */
175 
176 const struct uvm_pagerops aobj_pager = {
177 	.pgo_reference = uao_reference,
178 	.pgo_detach = uao_detach,
179 	.pgo_get = uao_get,
180 	.pgo_put = uao_put,
181 };
182 
183 /*
184  * uao_list: global list of active aobjs, locked by uao_list_lock
185  */
186 
187 static LIST_HEAD(aobjlist, uvm_aobj) uao_list	__cacheline_aligned;
188 static kmutex_t		uao_list_lock		__cacheline_aligned;
189 
190 /*
191  * hash table/array related functions
192  */
193 
194 #if defined(VMSWAP)
195 
196 /*
197  * uao_find_swhash_elt: find (or create) a hash table entry for a page
198  * offset.
199  *
200  * => the object should be locked by the caller
201  */
202 
203 static struct uao_swhash_elt *
204 uao_find_swhash_elt(struct uvm_aobj *aobj, int pageidx, bool create)
205 {
206 	struct uao_swhash *swhash;
207 	struct uao_swhash_elt *elt;
208 	voff_t page_tag;
209 
210 	swhash = UAO_SWHASH_HASH(aobj, pageidx);
211 	page_tag = UAO_SWHASH_ELT_TAG(pageidx);
212 
213 	/*
214 	 * now search the bucket for the requested tag
215 	 */
216 
217 	LIST_FOREACH(elt, swhash, list) {
218 		if (elt->tag == page_tag) {
219 			return elt;
220 		}
221 	}
222 	if (!create) {
223 		return NULL;
224 	}
225 
226 	/*
227 	 * allocate a new entry for the bucket and init/insert it in
228 	 */
229 
230 	elt = pool_get(&uao_swhash_elt_pool, PR_NOWAIT);
231 	if (elt == NULL) {
232 		return NULL;
233 	}
234 	LIST_INSERT_HEAD(swhash, elt, list);
235 	elt->tag = page_tag;
236 	elt->count = 0;
237 	memset(elt->slots, 0, sizeof(elt->slots));
238 	return elt;
239 }
240 
241 /*
242  * uao_find_swslot: find the swap slot number for an aobj/pageidx
243  *
244  * => object must be locked by caller
245  */
246 
247 int
248 uao_find_swslot(struct uvm_object *uobj, int pageidx)
249 {
250 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
251 	struct uao_swhash_elt *elt;
252 
253 	/*
254 	 * if noswap flag is set, then we never return a slot
255 	 */
256 
257 	if (aobj->u_flags & UAO_FLAG_NOSWAP)
258 		return 0;
259 
260 	/*
261 	 * if hashing, look in hash table.
262 	 */
263 
264 	if (UAO_USES_SWHASH(aobj)) {
265 		elt = uao_find_swhash_elt(aobj, pageidx, false);
266 		return elt ? UAO_SWHASH_ELT_PAGESLOT(elt, pageidx) : 0;
267 	}
268 
269 	/*
270 	 * otherwise, look in the array
271 	 */
272 
273 	return aobj->u_swslots[pageidx];
274 }
275 
276 /*
277  * uao_set_swslot: set the swap slot for a page in an aobj.
278  *
279  * => setting a slot to zero frees the slot
280  * => object must be locked by caller
281  * => we return the old slot number, or -1 if we failed to allocate
282  *    memory to record the new slot number
283  */
284 
285 int
286 uao_set_swslot(struct uvm_object *uobj, int pageidx, int slot)
287 {
288 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
289 	struct uao_swhash_elt *elt;
290 	int oldslot;
291 	UVMHIST_FUNC("uao_set_swslot"); UVMHIST_CALLED(pdhist);
292 	UVMHIST_LOG(pdhist, "aobj %#jx pageidx %jd slot %jd",
293 	    (uintptr_t)aobj, pageidx, slot, 0);
294 
295 	KASSERT(rw_write_held(uobj->vmobjlock) || uobj->uo_refs == 0);
296 
297 	/*
298 	 * if noswap flag is set, then we can't set a non-zero slot.
299 	 */
300 
301 	if (aobj->u_flags & UAO_FLAG_NOSWAP) {
302 		KASSERTMSG(slot == 0, "uao_set_swslot: no swap object");
303 		return 0;
304 	}
305 
306 	/*
307 	 * are we using a hash table?  if so, add it in the hash.
308 	 */
309 
310 	if (UAO_USES_SWHASH(aobj)) {
311 
312 		/*
313 		 * Avoid allocating an entry just to free it again if
314 		 * the page had not swap slot in the first place, and
315 		 * we are freeing.
316 		 */
317 
318 		elt = uao_find_swhash_elt(aobj, pageidx, slot != 0);
319 		if (elt == NULL) {
320 			return slot ? -1 : 0;
321 		}
322 
323 		oldslot = UAO_SWHASH_ELT_PAGESLOT(elt, pageidx);
324 		UAO_SWHASH_ELT_PAGESLOT(elt, pageidx) = slot;
325 
326 		/*
327 		 * now adjust the elt's reference counter and free it if we've
328 		 * dropped it to zero.
329 		 */
330 
331 		if (slot) {
332 			if (oldslot == 0)
333 				elt->count++;
334 		} else {
335 			if (oldslot)
336 				elt->count--;
337 
338 			if (elt->count == 0) {
339 				LIST_REMOVE(elt, list);
340 				pool_put(&uao_swhash_elt_pool, elt);
341 			}
342 		}
343 	} else {
344 		/* we are using an array */
345 		oldslot = aobj->u_swslots[pageidx];
346 		aobj->u_swslots[pageidx] = slot;
347 	}
348 	return oldslot;
349 }
350 
351 #endif /* defined(VMSWAP) */
352 
353 /*
354  * end of hash/array functions
355  */
356 
357 /*
358  * uao_free: free all resources held by an aobj, and then free the aobj
359  *
360  * => the aobj should be dead
361  */
362 
363 static void
364 uao_free(struct uvm_aobj *aobj)
365 {
366 	struct uvm_object *uobj = &aobj->u_obj;
367 
368 	KASSERT(rw_write_held(uobj->vmobjlock));
369 	uao_dropswap_range(uobj, 0, 0);
370 	rw_exit(uobj->vmobjlock);
371 
372 #if defined(VMSWAP)
373 	if (UAO_USES_SWHASH(aobj)) {
374 
375 		/*
376 		 * free the hash table itself.
377 		 */
378 
379 		hashdone(aobj->u_swhash, HASH_LIST, aobj->u_swhashmask);
380 	} else {
381 
382 		/*
383 		 * free the array itsself.
384 		 */
385 
386 		kmem_free(aobj->u_swslots, aobj->u_pages * sizeof(int));
387 	}
388 #endif /* defined(VMSWAP) */
389 
390 	/*
391 	 * finally free the aobj itself
392 	 */
393 
394 	uvm_obj_destroy(uobj, true);
395 	kmem_free(aobj, sizeof(struct uvm_aobj));
396 }
397 
398 /*
399  * pager functions
400  */
401 
402 /*
403  * uao_create: create an aobj of the given size and return its uvm_object.
404  *
405  * => for normal use, flags are always zero
406  * => for the kernel object, the flags are:
407  *	UAO_FLAG_KERNOBJ - allocate the kernel object (can only happen once)
408  *	UAO_FLAG_KERNSWAP - enable swapping of kernel object ("           ")
409  */
410 
411 struct uvm_object *
412 uao_create(voff_t size, int flags)
413 {
414 	static struct uvm_aobj kernel_object_store;
415 	static krwlock_t kernel_object_lock __cacheline_aligned;
416 	static int kobj_alloced __diagused = 0;
417 	pgoff_t pages = round_page((uint64_t)size) >> PAGE_SHIFT;
418 	struct uvm_aobj *aobj;
419 	int refs;
420 
421 	/*
422 	 * Allocate a new aobj, unless kernel object is requested.
423 	 */
424 
425 	if (flags & UAO_FLAG_KERNOBJ) {
426 		KASSERT(!kobj_alloced);
427 		aobj = &kernel_object_store;
428 		aobj->u_pages = pages;
429 		aobj->u_flags = UAO_FLAG_NOSWAP;
430 		refs = UVM_OBJ_KERN;
431 		kobj_alloced = UAO_FLAG_KERNOBJ;
432 	} else if (flags & UAO_FLAG_KERNSWAP) {
433 		KASSERT(kobj_alloced == UAO_FLAG_KERNOBJ);
434 		aobj = &kernel_object_store;
435 		kobj_alloced = UAO_FLAG_KERNSWAP;
436 		refs = 0xdeadbeaf; /* XXX: gcc */
437 	} else {
438 		aobj = kmem_alloc(sizeof(struct uvm_aobj), KM_SLEEP);
439 		aobj->u_pages = pages;
440 		aobj->u_flags = 0;
441 		refs = 1;
442 	}
443 
444 	/*
445 	 * no freelist by default
446 	 */
447 
448 	aobj->u_freelist = VM_NFREELIST;
449 
450 	/*
451  	 * allocate hash/array if necessary
452  	 *
453  	 * note: in the KERNSWAP case no need to worry about locking since
454  	 * we are still booting we should be the only thread around.
455  	 */
456 
457 	if (flags == 0 || (flags & UAO_FLAG_KERNSWAP) != 0) {
458 #if defined(VMSWAP)
459 		const int kernswap = (flags & UAO_FLAG_KERNSWAP) != 0;
460 
461 		/* allocate hash table or array depending on object size */
462 		if (UAO_USES_SWHASH(aobj)) {
463 			aobj->u_swhash = hashinit(UAO_SWHASH_BUCKETS(aobj),
464 			    HASH_LIST, kernswap ? false : true,
465 			    &aobj->u_swhashmask);
466 			if (aobj->u_swhash == NULL)
467 				panic("uao_create: hashinit swhash failed");
468 		} else {
469 			aobj->u_swslots = kmem_zalloc(pages * sizeof(int),
470 			    kernswap ? KM_NOSLEEP : KM_SLEEP);
471 			if (aobj->u_swslots == NULL)
472 				panic("uao_create: swslots allocation failed");
473 		}
474 #endif /* defined(VMSWAP) */
475 
476 		if (flags) {
477 			aobj->u_flags &= ~UAO_FLAG_NOSWAP; /* clear noswap */
478 			return &aobj->u_obj;
479 		}
480 	}
481 
482 	/*
483 	 * Initialise UVM object.
484 	 */
485 
486 	const bool kernobj = (flags & UAO_FLAG_KERNOBJ) != 0;
487 	uvm_obj_init(&aobj->u_obj, &aobj_pager, !kernobj, refs);
488 	if (__predict_false(kernobj)) {
489 		/* Initialisation only once, for UAO_FLAG_KERNOBJ. */
490 		rw_init(&kernel_object_lock);
491 		uvm_obj_setlock(&aobj->u_obj, &kernel_object_lock);
492 	}
493 
494 	/*
495  	 * now that aobj is ready, add it to the global list
496  	 */
497 
498 	mutex_enter(&uao_list_lock);
499 	LIST_INSERT_HEAD(&uao_list, aobj, u_list);
500 	mutex_exit(&uao_list_lock);
501 	return(&aobj->u_obj);
502 }
503 
504 /*
505  * uao_set_pgfl: allocate pages only from the specified freelist.
506  *
507  * => must be called before any pages are allocated for the object.
508  * => reset by setting it to VM_NFREELIST, meaning any freelist.
509  */
510 
511 void
512 uao_set_pgfl(struct uvm_object *uobj, int freelist)
513 {
514 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
515 
516 	KASSERTMSG((0 <= freelist), "invalid freelist %d", freelist);
517 	KASSERTMSG((freelist <= VM_NFREELIST), "invalid freelist %d",
518 	    freelist);
519 
520 	aobj->u_freelist = freelist;
521 }
522 
523 /*
524  * uao_pagealloc: allocate a page for aobj.
525  */
526 
527 static inline struct vm_page *
528 uao_pagealloc(struct uvm_object *uobj, voff_t offset, int flags)
529 {
530 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
531 
532 	if (__predict_true(aobj->u_freelist == VM_NFREELIST))
533 		return uvm_pagealloc(uobj, offset, NULL, flags);
534 	else
535 		return uvm_pagealloc_strat(uobj, offset, NULL, flags,
536 		    UVM_PGA_STRAT_ONLY, aobj->u_freelist);
537 }
538 
539 /*
540  * uao_init: set up aobj pager subsystem
541  *
542  * => called at boot time from uvm_pager_init()
543  */
544 
545 void
546 uao_init(void)
547 {
548 	static int uao_initialized;
549 
550 	if (uao_initialized)
551 		return;
552 	uao_initialized = true;
553 	LIST_INIT(&uao_list);
554 	mutex_init(&uao_list_lock, MUTEX_DEFAULT, IPL_NONE);
555 	pool_init(&uao_swhash_elt_pool, sizeof(struct uao_swhash_elt),
556 	    0, 0, 0, "uaoeltpl", NULL, IPL_VM);
557 }
558 
559 /*
560  * uao_reference: hold a reference to an anonymous UVM object.
561  */
562 void
563 uao_reference(struct uvm_object *uobj)
564 {
565 	/* Kernel object is persistent. */
566 	if (UVM_OBJ_IS_KERN_OBJECT(uobj)) {
567 		return;
568 	}
569 	atomic_inc_uint(&uobj->uo_refs);
570 }
571 
572 /*
573  * uao_detach: drop a reference to an anonymous UVM object.
574  */
575 void
576 uao_detach(struct uvm_object *uobj)
577 {
578 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
579 	struct uvm_page_array a;
580 	struct vm_page *pg;
581 
582 	UVMHIST_FUNC("uao_detach"); UVMHIST_CALLED(maphist);
583 
584 	/*
585 	 * Detaching from kernel object is a NOP.
586 	 */
587 
588 	if (UVM_OBJ_IS_KERN_OBJECT(uobj))
589 		return;
590 
591 	/*
592 	 * Drop the reference.  If it was the last one, destroy the object.
593 	 */
594 
595 	KASSERT(uobj->uo_refs > 0);
596 	UVMHIST_LOG(maphist,"  (uobj=%#jx)  ref=%jd",
597 	    (uintptr_t)uobj, uobj->uo_refs, 0, 0);
598 	if (atomic_dec_uint_nv(&uobj->uo_refs) > 0) {
599 		UVMHIST_LOG(maphist, "<- done (rc>0)", 0,0,0,0);
600 		return;
601 	}
602 
603 	/*
604 	 * Remove the aobj from the global list.
605 	 */
606 
607 	mutex_enter(&uao_list_lock);
608 	LIST_REMOVE(aobj, u_list);
609 	mutex_exit(&uao_list_lock);
610 
611 	/*
612 	 * Free all the pages left in the aobj.  For each page, when the
613 	 * page is no longer busy (and thus after any disk I/O that it is
614 	 * involved in is complete), release any swap resources and free
615 	 * the page itself.
616 	 */
617 	uvm_page_array_init(&a);
618 	rw_enter(uobj->vmobjlock, RW_WRITER);
619 	while ((pg = uvm_page_array_fill_and_peek(&a, uobj, 0, 0, 0))
620 	    != NULL) {
621 		uvm_page_array_advance(&a);
622 		pmap_page_protect(pg, VM_PROT_NONE);
623 		if (pg->flags & PG_BUSY) {
624 			uvm_pagewait(pg, uobj->vmobjlock, "uao_det");
625 			uvm_page_array_clear(&a);
626 			rw_enter(uobj->vmobjlock, RW_WRITER);
627 			continue;
628 		}
629 		uao_dropswap(&aobj->u_obj, pg->offset >> PAGE_SHIFT);
630 		uvm_pagefree(pg);
631 	}
632 	uvm_page_array_fini(&a);
633 
634 	/*
635 	 * Finally, free the anonymous UVM object itself.
636 	 */
637 
638 	uao_free(aobj);
639 }
640 
641 /*
642  * uao_put: flush pages out of a uvm object
643  *
644  * => object should be locked by caller.  we may _unlock_ the object
645  *	if (and only if) we need to clean a page (PGO_CLEANIT).
646  *	XXXJRT Currently, however, we don't.  In the case of cleaning
647  *	XXXJRT a page, we simply just deactivate it.  Should probably
648  *	XXXJRT handle this better, in the future (although "flushing"
649  *	XXXJRT anonymous memory isn't terribly important).
650  * => if PGO_CLEANIT is not set, then we will neither unlock the object
651  *	or block.
652  * => if PGO_ALLPAGE is set, then all pages in the object are valid targets
653  *	for flushing.
654  * => we return 0 unless we encountered some sort of I/O error
655  *	XXXJRT currently never happens, as we never directly initiate
656  *	XXXJRT I/O
657  */
658 
659 static int
660 uao_put(struct uvm_object *uobj, voff_t start, voff_t stop, int flags)
661 {
662 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
663 	struct uvm_page_array a;
664 	struct vm_page *pg;
665 	voff_t curoff;
666 	UVMHIST_FUNC("uao_put"); UVMHIST_CALLED(maphist);
667 
668 	KASSERT(rw_write_held(uobj->vmobjlock));
669 
670 	if (flags & PGO_ALLPAGES) {
671 		start = 0;
672 		stop = aobj->u_pages << PAGE_SHIFT;
673 	} else {
674 		start = trunc_page(start);
675 		if (stop == 0) {
676 			stop = aobj->u_pages << PAGE_SHIFT;
677 		} else {
678 			stop = round_page(stop);
679 		}
680 		if (stop > (uint64_t)(aobj->u_pages << PAGE_SHIFT)) {
681 			printf("uao_put: strange, got an out of range "
682 			    "flush %#jx > %#jx (fixed)\n",
683 			    (uintmax_t)stop,
684 			    (uintmax_t)(aobj->u_pages << PAGE_SHIFT));
685 			stop = aobj->u_pages << PAGE_SHIFT;
686 		}
687 	}
688 	UVMHIST_LOG(maphist,
689 	    " flush start=%#jx, stop=%#jx, flags=%#jx",
690 	    start, stop, flags, 0);
691 
692 	/*
693 	 * Don't need to do any work here if we're not freeing
694 	 * or deactivating pages.
695 	 */
696 
697 	if ((flags & (PGO_DEACTIVATE|PGO_FREE)) == 0) {
698 		rw_exit(uobj->vmobjlock);
699 		return 0;
700 	}
701 
702 	/* locked: uobj */
703 	uvm_page_array_init(&a);
704 	curoff = start;
705 	while ((pg = uvm_page_array_fill_and_peek(&a, uobj, curoff, 0, 0)) !=
706 	    NULL) {
707 		if (pg->offset >= stop) {
708 			break;
709 		}
710 
711 		/*
712 		 * wait and try again if the page is busy.
713 		 */
714 
715 		if (pg->flags & PG_BUSY) {
716 			uvm_pagewait(pg, uobj->vmobjlock, "uao_put");
717 			uvm_page_array_clear(&a);
718 			rw_enter(uobj->vmobjlock, RW_WRITER);
719 			continue;
720 		}
721 		uvm_page_array_advance(&a);
722 		curoff = pg->offset + PAGE_SIZE;
723 
724 		switch (flags & (PGO_CLEANIT|PGO_FREE|PGO_DEACTIVATE)) {
725 
726 		/*
727 		 * XXX In these first 3 cases, we always just
728 		 * XXX deactivate the page.  We may want to
729 		 * XXX handle the different cases more specifically
730 		 * XXX in the future.
731 		 */
732 
733 		case PGO_CLEANIT|PGO_FREE:
734 		case PGO_CLEANIT|PGO_DEACTIVATE:
735 		case PGO_DEACTIVATE:
736  deactivate_it:
737  			uvm_pagelock(pg);
738 			uvm_pagedeactivate(pg);
739  			uvm_pageunlock(pg);
740 			break;
741 
742 		case PGO_FREE:
743 			/*
744 			 * If there are multiple references to
745 			 * the object, just deactivate the page.
746 			 */
747 
748 			if (uobj->uo_refs > 1)
749 				goto deactivate_it;
750 
751 			/*
752 			 * free the swap slot and the page.
753 			 */
754 
755 			pmap_page_protect(pg, VM_PROT_NONE);
756 
757 			/*
758 			 * freeing swapslot here is not strictly necessary.
759 			 * however, leaving it here doesn't save much
760 			 * because we need to update swap accounting anyway.
761 			 */
762 
763 			uao_dropswap(uobj, pg->offset >> PAGE_SHIFT);
764 			uvm_pagefree(pg);
765 			break;
766 
767 		default:
768 			panic("%s: impossible", __func__);
769 		}
770 	}
771 	rw_exit(uobj->vmobjlock);
772 	uvm_page_array_fini(&a);
773 	return 0;
774 }
775 
776 /*
777  * uao_get: fetch me a page
778  *
779  * we have three cases:
780  * 1: page is resident     -> just return the page.
781  * 2: page is zero-fill    -> allocate a new page and zero it.
782  * 3: page is swapped out  -> fetch the page from swap.
783  *
784  * cases 1 and 2 can be handled with PGO_LOCKED, case 3 cannot.
785  * so, if the "center" page hits case 3 (or any page, with PGO_ALLPAGES),
786  * then we will need to return EBUSY.
787  *
788  * => prefer map unlocked (not required)
789  * => object must be locked!  we will _unlock_ it before starting any I/O.
790  * => flags: PGO_ALLPAGES: get all of the pages
791  *           PGO_LOCKED: fault data structures are locked
792  * => NOTE: offset is the offset of pps[0], _NOT_ pps[centeridx]
793  * => NOTE: caller must check for released pages!!
794  */
795 
796 static int
797 uao_get(struct uvm_object *uobj, voff_t offset, struct vm_page **pps,
798     int *npagesp, int centeridx, vm_prot_t access_type, int advice, int flags)
799 {
800 	voff_t current_offset;
801 	struct vm_page *ptmp = NULL;	/* Quell compiler warning */
802 	int lcv, gotpages, maxpages, swslot, pageidx;
803 	bool done;
804 	UVMHIST_FUNC("uao_get"); UVMHIST_CALLED(pdhist);
805 
806 	UVMHIST_LOG(pdhist, "aobj=%#jx offset=%jd, flags=%jd",
807 		    (uintptr_t)uobj, offset, flags,0);
808 
809 	/*
810 	 * the object must be locked.  it can only be a read lock when
811 	 * processing a read fault with PGO_LOCKED | PGO_NOBUSY.
812 	 */
813 
814 	KASSERT(rw_lock_held(uobj->vmobjlock));
815 	KASSERT(rw_write_held(uobj->vmobjlock) ||
816 	   ((~flags & (PGO_LOCKED | PGO_NOBUSY)) == 0 &&
817 	   (access_type & VM_PROT_WRITE) == 0));
818 
819 	/*
820  	 * get number of pages
821  	 */
822 
823 	maxpages = *npagesp;
824 
825 	/*
826  	 * step 1: handled the case where fault data structures are locked.
827  	 */
828 
829 	if (flags & PGO_LOCKED) {
830 
831 		/*
832  		 * step 1a: get pages that are already resident.   only do
833 		 * this if the data structures are locked (i.e. the first
834 		 * time through).
835  		 */
836 
837 		done = true;	/* be optimistic */
838 		gotpages = 0;	/* # of pages we got so far */
839 		for (lcv = 0, current_offset = offset ; lcv < maxpages ;
840 		    lcv++, current_offset += PAGE_SIZE) {
841 			/* do we care about this page?  if not, skip it */
842 			if (pps[lcv] == PGO_DONTCARE)
843 				continue;
844 			ptmp = uvm_pagelookup(uobj, current_offset);
845 
846 			/*
847  			 * if page is new, attempt to allocate the page,
848 			 * zero-fill'd.  we can only do this if busying
849 			 * pages, as otherwise the object is read locked.
850  			 */
851 
852 			if ((flags & PGO_NOBUSY) == 0 && ptmp == NULL &&
853 			    uao_find_swslot(uobj,
854 			    current_offset >> PAGE_SHIFT) == 0) {
855 				ptmp = uao_pagealloc(uobj, current_offset,
856 				    UVM_FLAG_COLORMATCH|UVM_PGA_ZERO);
857 				if (ptmp) {
858 					/* new page */
859 					ptmp->flags &= ~(PG_FAKE);
860 					uvm_pagemarkdirty(ptmp,
861 					    UVM_PAGE_STATUS_UNKNOWN);
862 					goto gotpage;
863 				}
864 			}
865 
866 			/*
867 			 * to be useful must get a non-busy page
868 			 */
869 
870 			if (ptmp == NULL || (ptmp->flags & PG_BUSY) != 0) {
871 				if (lcv == centeridx ||
872 				    (flags & PGO_ALLPAGES) != 0)
873 					/* need to do a wait or I/O! */
874 					done = false;
875 				continue;
876 			}
877 
878 			/*
879 			 * useful page: busy/lock it and plug it in our
880 			 * result array
881 			 */
882 			KASSERT(uvm_pagegetdirty(ptmp) !=
883 			    UVM_PAGE_STATUS_CLEAN);
884 
885 			if ((flags & PGO_NOBUSY) == 0) {
886 				/* caller must un-busy this page */
887 				ptmp->flags |= PG_BUSY;
888 				UVM_PAGE_OWN(ptmp, "uao_get1");
889 			}
890 gotpage:
891 			pps[lcv] = ptmp;
892 			gotpages++;
893 		}
894 
895 		/*
896  		 * step 1b: now we've either done everything needed or we
897 		 * to unlock and do some waiting or I/O.
898  		 */
899 
900 		UVMHIST_LOG(pdhist, "<- done (done=%jd)", done, 0,0,0);
901 		*npagesp = gotpages;
902 		if (done)
903 			return 0;
904 		else
905 			return EBUSY;
906 	}
907 
908 	/*
909  	 * step 2: get non-resident or busy pages.
910  	 * object is locked.   data structures are unlocked.
911  	 */
912 
913 	if ((flags & PGO_SYNCIO) == 0) {
914 		goto done;
915 	}
916 
917 	for (lcv = 0, current_offset = offset ; lcv < maxpages ;
918 	    lcv++, current_offset += PAGE_SIZE) {
919 
920 		/*
921 		 * - skip over pages we've already gotten or don't want
922 		 * - skip over pages we don't _have_ to get
923 		 */
924 
925 		if (pps[lcv] != NULL ||
926 		    (lcv != centeridx && (flags & PGO_ALLPAGES) == 0))
927 			continue;
928 
929 		pageidx = current_offset >> PAGE_SHIFT;
930 
931 		/*
932  		 * we have yet to locate the current page (pps[lcv]).   we
933 		 * first look for a page that is already at the current offset.
934 		 * if we find a page, we check to see if it is busy or
935 		 * released.  if that is the case, then we sleep on the page
936 		 * until it is no longer busy or released and repeat the lookup.
937 		 * if the page we found is neither busy nor released, then we
938 		 * busy it (so we own it) and plug it into pps[lcv].   this
939 		 * 'break's the following while loop and indicates we are
940 		 * ready to move on to the next page in the "lcv" loop above.
941  		 *
942  		 * if we exit the while loop with pps[lcv] still set to NULL,
943 		 * then it means that we allocated a new busy/fake/clean page
944 		 * ptmp in the object and we need to do I/O to fill in the data.
945  		 */
946 
947 		/* top of "pps" while loop */
948 		while (pps[lcv] == NULL) {
949 			/* look for a resident page */
950 			ptmp = uvm_pagelookup(uobj, current_offset);
951 
952 			/* not resident?   allocate one now (if we can) */
953 			if (ptmp == NULL) {
954 
955 				ptmp = uao_pagealloc(uobj, current_offset, 0);
956 
957 				/* out of RAM? */
958 				if (ptmp == NULL) {
959 					rw_exit(uobj->vmobjlock);
960 					UVMHIST_LOG(pdhist,
961 					    "sleeping, ptmp == NULL\n",0,0,0,0);
962 					uvm_wait("uao_getpage");
963 					rw_enter(uobj->vmobjlock, RW_WRITER);
964 					continue;
965 				}
966 
967 				/*
968 				 * got new page ready for I/O.  break pps while
969 				 * loop.  pps[lcv] is still NULL.
970 				 */
971 
972 				break;
973 			}
974 
975 			/* page is there, see if we need to wait on it */
976 			if ((ptmp->flags & PG_BUSY) != 0) {
977 				UVMHIST_LOG(pdhist,
978 				    "sleeping, ptmp->flags %#jx\n",
979 				    ptmp->flags,0,0,0);
980 				uvm_pagewait(ptmp, uobj->vmobjlock, "uao_get");
981 				rw_enter(uobj->vmobjlock, RW_WRITER);
982 				continue;
983 			}
984 
985 			/*
986  			 * if we get here then the page has become resident and
987 			 * unbusy between steps 1 and 2.  we busy it now (so we
988 			 * own it) and set pps[lcv] (so that we exit the while
989 			 * loop).
990  			 */
991 
992 			KASSERT(uvm_pagegetdirty(ptmp) !=
993 			    UVM_PAGE_STATUS_CLEAN);
994 			/* we own it, caller must un-busy */
995 			ptmp->flags |= PG_BUSY;
996 			UVM_PAGE_OWN(ptmp, "uao_get2");
997 			pps[lcv] = ptmp;
998 		}
999 
1000 		/*
1001  		 * if we own the valid page at the correct offset, pps[lcv] will
1002  		 * point to it.   nothing more to do except go to the next page.
1003  		 */
1004 
1005 		if (pps[lcv])
1006 			continue;			/* next lcv */
1007 
1008 		/*
1009  		 * we have a "fake/busy/clean" page that we just allocated.
1010  		 * do the needed "i/o", either reading from swap or zeroing.
1011  		 */
1012 
1013 		swslot = uao_find_swslot(uobj, pageidx);
1014 
1015 		/*
1016  		 * just zero the page if there's nothing in swap.
1017  		 */
1018 
1019 		if (swslot == 0) {
1020 
1021 			/*
1022 			 * page hasn't existed before, just zero it.
1023 			 */
1024 
1025 			uvm_pagezero(ptmp);
1026 		} else {
1027 #if defined(VMSWAP)
1028 			int error;
1029 
1030 			UVMHIST_LOG(pdhist, "pagein from swslot %jd",
1031 			     swslot, 0,0,0);
1032 
1033 			/*
1034 			 * page in the swapped-out page.
1035 			 * unlock object for i/o, relock when done.
1036 			 */
1037 
1038 			rw_exit(uobj->vmobjlock);
1039 			error = uvm_swap_get(ptmp, swslot, PGO_SYNCIO);
1040 			rw_enter(uobj->vmobjlock, RW_WRITER);
1041 
1042 			/*
1043 			 * I/O done.  check for errors.
1044 			 */
1045 
1046 			if (error != 0) {
1047 				UVMHIST_LOG(pdhist, "<- done (error=%jd)",
1048 				    error,0,0,0);
1049 
1050 				/*
1051 				 * remove the swap slot from the aobj
1052 				 * and mark the aobj as having no real slot.
1053 				 * don't free the swap slot, thus preventing
1054 				 * it from being used again.
1055 				 */
1056 
1057 				swslot = uao_set_swslot(uobj, pageidx,
1058 				    SWSLOT_BAD);
1059 				if (swslot > 0) {
1060 					uvm_swap_markbad(swslot, 1);
1061 				}
1062 
1063 				uvm_pagefree(ptmp);
1064 				rw_exit(uobj->vmobjlock);
1065 				return error;
1066 			}
1067 #else /* defined(VMSWAP) */
1068 			panic("%s: pagein", __func__);
1069 #endif /* defined(VMSWAP) */
1070 		}
1071 
1072 		/*
1073 		 * note that we will allow the page being writably-mapped
1074 		 * (!PG_RDONLY) regardless of access_type.
1075 		 */
1076 		uvm_pagemarkdirty(ptmp, UVM_PAGE_STATUS_UNKNOWN);
1077 
1078 		/*
1079  		 * we got the page!   clear the fake flag (indicates valid
1080 		 * data now in page) and plug into our result array.   note
1081 		 * that page is still busy.
1082  		 *
1083  		 * it is the callers job to:
1084  		 * => check if the page is released
1085  		 * => unbusy the page
1086  		 * => activate the page
1087  		 */
1088 		KASSERT(uvm_pagegetdirty(ptmp) != UVM_PAGE_STATUS_CLEAN);
1089 		KASSERT((ptmp->flags & PG_FAKE) != 0);
1090 		ptmp->flags &= ~PG_FAKE;
1091 		pps[lcv] = ptmp;
1092 	}
1093 
1094 	/*
1095  	 * finally, unlock object and return.
1096  	 */
1097 
1098 done:
1099 	rw_exit(uobj->vmobjlock);
1100 	UVMHIST_LOG(pdhist, "<- done (OK)",0,0,0,0);
1101 	return 0;
1102 }
1103 
1104 #if defined(VMSWAP)
1105 
1106 /*
1107  * uao_dropswap:  release any swap resources from this aobj page.
1108  *
1109  * => aobj must be locked or have a reference count of 0.
1110  */
1111 
1112 void
1113 uao_dropswap(struct uvm_object *uobj, int pageidx)
1114 {
1115 	int slot;
1116 
1117 	slot = uao_set_swslot(uobj, pageidx, 0);
1118 	if (slot) {
1119 		uvm_swap_free(slot, 1);
1120 	}
1121 }
1122 
1123 /*
1124  * page in every page in every aobj that is paged-out to a range of swslots.
1125  *
1126  * => nothing should be locked.
1127  * => returns true if pagein was aborted due to lack of memory.
1128  */
1129 
1130 bool
1131 uao_swap_off(int startslot, int endslot)
1132 {
1133 	struct uvm_aobj *aobj;
1134 
1135 	/*
1136 	 * Walk the list of all anonymous UVM objects.  Grab the first.
1137 	 */
1138 	mutex_enter(&uao_list_lock);
1139 	if ((aobj = LIST_FIRST(&uao_list)) == NULL) {
1140 		mutex_exit(&uao_list_lock);
1141 		return false;
1142 	}
1143 	uao_reference(&aobj->u_obj);
1144 
1145 	do {
1146 		struct uvm_aobj *nextaobj;
1147 		bool rv;
1148 
1149 		/*
1150 		 * Prefetch the next object and immediately hold a reference
1151 		 * on it, so neither the current nor the next entry could
1152 		 * disappear while we are iterating.
1153 		 */
1154 		if ((nextaobj = LIST_NEXT(aobj, u_list)) != NULL) {
1155 			uao_reference(&nextaobj->u_obj);
1156 		}
1157 		mutex_exit(&uao_list_lock);
1158 
1159 		/*
1160 		 * Page in all pages in the swap slot range.
1161 		 */
1162 		rw_enter(aobj->u_obj.vmobjlock, RW_WRITER);
1163 		rv = uao_pagein(aobj, startslot, endslot);
1164 		rw_exit(aobj->u_obj.vmobjlock);
1165 
1166 		/* Drop the reference of the current object. */
1167 		uao_detach(&aobj->u_obj);
1168 		if (rv) {
1169 			if (nextaobj) {
1170 				uao_detach(&nextaobj->u_obj);
1171 			}
1172 			return rv;
1173 		}
1174 
1175 		aobj = nextaobj;
1176 		mutex_enter(&uao_list_lock);
1177 	} while (aobj);
1178 
1179 	mutex_exit(&uao_list_lock);
1180 	return false;
1181 }
1182 
1183 /*
1184  * page in any pages from aobj in the given range.
1185  *
1186  * => aobj must be locked and is returned locked.
1187  * => returns true if pagein was aborted due to lack of memory.
1188  */
1189 static bool
1190 uao_pagein(struct uvm_aobj *aobj, int startslot, int endslot)
1191 {
1192 	bool rv;
1193 
1194 	if (UAO_USES_SWHASH(aobj)) {
1195 		struct uao_swhash_elt *elt;
1196 		int buck;
1197 
1198 restart:
1199 		for (buck = aobj->u_swhashmask; buck >= 0; buck--) {
1200 			for (elt = LIST_FIRST(&aobj->u_swhash[buck]);
1201 			     elt != NULL;
1202 			     elt = LIST_NEXT(elt, list)) {
1203 				int i;
1204 
1205 				for (i = 0; i < UAO_SWHASH_CLUSTER_SIZE; i++) {
1206 					int slot = elt->slots[i];
1207 
1208 					/*
1209 					 * if the slot isn't in range, skip it.
1210 					 */
1211 
1212 					if (slot < startslot ||
1213 					    slot >= endslot) {
1214 						continue;
1215 					}
1216 
1217 					/*
1218 					 * process the page,
1219 					 * the start over on this object
1220 					 * since the swhash elt
1221 					 * may have been freed.
1222 					 */
1223 
1224 					rv = uao_pagein_page(aobj,
1225 					  UAO_SWHASH_ELT_PAGEIDX_BASE(elt) + i);
1226 					if (rv) {
1227 						return rv;
1228 					}
1229 					goto restart;
1230 				}
1231 			}
1232 		}
1233 	} else {
1234 		int i;
1235 
1236 		for (i = 0; i < aobj->u_pages; i++) {
1237 			int slot = aobj->u_swslots[i];
1238 
1239 			/*
1240 			 * if the slot isn't in range, skip it
1241 			 */
1242 
1243 			if (slot < startslot || slot >= endslot) {
1244 				continue;
1245 			}
1246 
1247 			/*
1248 			 * process the page.
1249 			 */
1250 
1251 			rv = uao_pagein_page(aobj, i);
1252 			if (rv) {
1253 				return rv;
1254 			}
1255 		}
1256 	}
1257 
1258 	return false;
1259 }
1260 
1261 /*
1262  * uao_pagein_page: page in a single page from an anonymous UVM object.
1263  *
1264  * => Returns true if pagein was aborted due to lack of memory.
1265  * => Object must be locked and is returned locked.
1266  */
1267 
1268 static bool
1269 uao_pagein_page(struct uvm_aobj *aobj, int pageidx)
1270 {
1271 	struct uvm_object *uobj = &aobj->u_obj;
1272 	struct vm_page *pg;
1273 	int rv, npages;
1274 
1275 	pg = NULL;
1276 	npages = 1;
1277 
1278 	KASSERT(rw_write_held(uobj->vmobjlock));
1279 	rv = uao_get(uobj, (voff_t)pageidx << PAGE_SHIFT, &pg, &npages,
1280 	    0, VM_PROT_READ | VM_PROT_WRITE, 0, PGO_SYNCIO);
1281 
1282 	/*
1283 	 * relock and finish up.
1284 	 */
1285 
1286 	rw_enter(uobj->vmobjlock, RW_WRITER);
1287 	switch (rv) {
1288 	case 0:
1289 		break;
1290 
1291 	case EIO:
1292 	case ERESTART:
1293 
1294 		/*
1295 		 * nothing more to do on errors.
1296 		 * ERESTART can only mean that the anon was freed,
1297 		 * so again there's nothing to do.
1298 		 */
1299 
1300 		return false;
1301 
1302 	default:
1303 		return true;
1304 	}
1305 
1306 	/*
1307 	 * ok, we've got the page now.
1308 	 * mark it as dirty, clear its swslot and un-busy it.
1309 	 */
1310 	uao_dropswap(&aobj->u_obj, pageidx);
1311 
1312 	/*
1313 	 * make sure it's on a page queue.
1314 	 */
1315 	uvm_pagelock(pg);
1316 	uvm_pageenqueue(pg);
1317 	uvm_pagewakeup(pg);
1318 	uvm_pageunlock(pg);
1319 
1320 	pg->flags &= ~(PG_BUSY|PG_FAKE);
1321 	uvm_pagemarkdirty(pg, UVM_PAGE_STATUS_DIRTY);
1322 	UVM_PAGE_OWN(pg, NULL);
1323 
1324 	return false;
1325 }
1326 
1327 /*
1328  * uao_dropswap_range: drop swapslots in the range.
1329  *
1330  * => aobj must be locked and is returned locked.
1331  * => start is inclusive.  end is exclusive.
1332  */
1333 
1334 void
1335 uao_dropswap_range(struct uvm_object *uobj, voff_t start, voff_t end)
1336 {
1337 	struct uvm_aobj *aobj = (struct uvm_aobj *)uobj;
1338 	int swpgonlydelta = 0;
1339 
1340 	KASSERT(rw_write_held(uobj->vmobjlock));
1341 
1342 	if (end == 0) {
1343 		end = INT64_MAX;
1344 	}
1345 
1346 	if (UAO_USES_SWHASH(aobj)) {
1347 		int i, hashbuckets = aobj->u_swhashmask + 1;
1348 		voff_t taghi;
1349 		voff_t taglo;
1350 
1351 		taglo = UAO_SWHASH_ELT_TAG(start);
1352 		taghi = UAO_SWHASH_ELT_TAG(end);
1353 
1354 		for (i = 0; i < hashbuckets; i++) {
1355 			struct uao_swhash_elt *elt, *next;
1356 
1357 			for (elt = LIST_FIRST(&aobj->u_swhash[i]);
1358 			     elt != NULL;
1359 			     elt = next) {
1360 				int startidx, endidx;
1361 				int j;
1362 
1363 				next = LIST_NEXT(elt, list);
1364 
1365 				if (elt->tag < taglo || taghi < elt->tag) {
1366 					continue;
1367 				}
1368 
1369 				if (elt->tag == taglo) {
1370 					startidx =
1371 					    UAO_SWHASH_ELT_PAGESLOT_IDX(start);
1372 				} else {
1373 					startidx = 0;
1374 				}
1375 
1376 				if (elt->tag == taghi) {
1377 					endidx =
1378 					    UAO_SWHASH_ELT_PAGESLOT_IDX(end);
1379 				} else {
1380 					endidx = UAO_SWHASH_CLUSTER_SIZE;
1381 				}
1382 
1383 				for (j = startidx; j < endidx; j++) {
1384 					int slot = elt->slots[j];
1385 
1386 					KASSERT(uvm_pagelookup(&aobj->u_obj,
1387 					    (UAO_SWHASH_ELT_PAGEIDX_BASE(elt)
1388 					    + j) << PAGE_SHIFT) == NULL);
1389 					if (slot > 0) {
1390 						uvm_swap_free(slot, 1);
1391 						swpgonlydelta++;
1392 						KASSERT(elt->count > 0);
1393 						elt->slots[j] = 0;
1394 						elt->count--;
1395 					}
1396 				}
1397 
1398 				if (elt->count == 0) {
1399 					LIST_REMOVE(elt, list);
1400 					pool_put(&uao_swhash_elt_pool, elt);
1401 				}
1402 			}
1403 		}
1404 	} else {
1405 		int i;
1406 
1407 		if (aobj->u_pages < end) {
1408 			end = aobj->u_pages;
1409 		}
1410 		for (i = start; i < end; i++) {
1411 			int slot = aobj->u_swslots[i];
1412 
1413 			if (slot > 0) {
1414 				uvm_swap_free(slot, 1);
1415 				swpgonlydelta++;
1416 			}
1417 		}
1418 	}
1419 
1420 	/*
1421 	 * adjust the counter of pages only in swap for all
1422 	 * the swap slots we've freed.
1423 	 */
1424 
1425 	if (swpgonlydelta > 0) {
1426 		KASSERT(uvmexp.swpgonly >= swpgonlydelta);
1427 		atomic_add_int(&uvmexp.swpgonly, -swpgonlydelta);
1428 	}
1429 }
1430 
1431 #endif /* defined(VMSWAP) */
1432