Pass the vm object to vm_object_collapse() with its lock held.

2 files changed, 7 insertions, 10 deletions

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 1af2f1b..53b51b8 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -2143,9 +2143,7 @@ vm_map_delete(vm_map_t map, vm_offset_t start, vm_offset_t end)
 				if (object->ref_count != 1 &&
 				    (object->flags & (OBJ_NOSPLIT|OBJ_ONEMAPPING)) == OBJ_ONEMAPPING &&
 				    (object->type == OBJT_DEFAULT || object->type == OBJT_SWAP)) {
-					VM_OBJECT_UNLOCK(object);
 					vm_object_collapse(object);
-					VM_OBJECT_LOCK(object);
 					vm_object_page_remove(object, offidxstart, offidxend, FALSE);
 					if (object->type == OBJT_SWAP)
 						swap_pager_freespace(object, offidxstart, count);
@@ -2289,7 +2287,9 @@ vm_map_copy_entry(
 			if ((src_object->handle == NULL) &&
 				(src_object->type == OBJT_DEFAULT ||
 				 src_object->type == OBJT_SWAP)) {
+				VM_OBJECT_LOCK(src_object);
 				vm_object_collapse(src_object);
+				VM_OBJECT_UNLOCK(src_object);
 				if ((src_object->flags & (OBJ_NOSPLIT|OBJ_ONEMAPPING)) == OBJ_ONEMAPPING) {
 					vm_object_split(src_entry);
 					src_object = src_entry->object.vm_object;
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
index 972d358..0822462 100644
--- a/sys/vm/vm_object.c
+++ b/sys/vm/vm_object.c
@@ -508,8 +508,8 @@ vm_object_deallocate(vm_object_t object)
 						goto doterm;
 					}
 					object = robject;
-	/* XXX */			VM_OBJECT_UNLOCK(object);
 					vm_object_collapse(object);
+					VM_OBJECT_UNLOCK(object);
 					continue;
 				}
 				VM_OBJECT_UNLOCK(robject);
@@ -1495,7 +1495,7 @@ vm_object_qcollapse(vm_object_t object)
 void
 vm_object_collapse(vm_object_t object)
 {
-	GIANT_REQUIRED;
+	VM_OBJECT_LOCK_ASSERT(object, MA_OWNED);
 	
 	while (TRUE) {
 		vm_object_t backing_object;
@@ -1505,9 +1505,6 @@ vm_object_collapse(vm_object_t object)
 		 *
 		 * The object exists and the backing object exists.
 		 */
-		if (object == NULL)
-			break;
-
 		if ((backing_object = object->backing_object) == NULL)
 			break;
 
@@ -1536,7 +1533,7 @@ vm_object_collapse(vm_object_t object)
 			VM_OBJECT_UNLOCK(backing_object);
 			break;
 		}
-
+/* XXX */	VM_OBJECT_UNLOCK(object);
 		/*
 		 * We know that we can either collapse the backing object (if
 		 * the parent is the only reference to it) or (perhaps) have
@@ -1645,6 +1642,7 @@ vm_object_collapse(vm_object_t object)
 			 */
 			if (vm_object_backing_scan(object, OBSC_TEST_ALL_SHADOWED) == 0) {
 				VM_OBJECT_UNLOCK(backing_object);
+/* XXX */			VM_OBJECT_LOCK(object);
 				break;
 			}
 
@@ -1687,6 +1685,7 @@ vm_object_collapse(vm_object_t object)
 		/*
 		 * Try again with this object's new backing object.
 		 */
+/* XXX */	VM_OBJECT_LOCK(object);
 	}
 }
 
@@ -1801,9 +1800,7 @@ vm_object_coalesce(vm_object_t prev_object, vm_pindex_t prev_pindex,
 	/*
 	 * Try to collapse the object first
 	 */
-	VM_OBJECT_UNLOCK(prev_object);
 	vm_object_collapse(prev_object);
-	VM_OBJECT_LOCK(prev_object);
 
 	/*
 	 * Can't coalesce if: . more than one reference . paged out . shadows