From 6395da5437043d0fc253008eeebb7fbd3290bad5 Mon Sep 17 00:00:00 2001
From: Ian Dowse <iedowse@FreeBSD.org>
Date: Tue, 25 Jun 2002 22:14:06 +0000
Subject: [PATCH] Complete the initial set of VM changes required to support
 full 64-bit file sizes. This step simply addresses the remaining overflows,
 and does attempt to optimise performance. The details are:

 o Use a 64-bit type for the vm_object `size' and the size argument
   to vm_object_allocate().
 o Use the correct type for index variables in dev_pager_getpages(),
   vm_object_page_clean() and vm_object_page_remove().
 o Avoid an overflow in the i386 pmap_object_init_pt().
---
 sys/amd64/amd64/pmap.c | 8 ++------
 sys/i386/i386/pmap.c   | 8 ++------
 sys/vm/device_pager.c  | 2 +-
 sys/vm/vm_object.c     | 8 ++++----
 sys/vm/vm_object.h     | 6 +++---
 5 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/sys/amd64/amd64/pmap.c b/sys/amd64/amd64/pmap.c
index d3478d295445..17bcd8080427 100644
--- a/sys/amd64/amd64/pmap.c
+++ b/sys/amd64/amd64/pmap.c
@@ -2493,14 +2493,10 @@ pmap_object_init_pt(pmap_t pmap, vm_offset_t addr,
 		    ((objpgs > 0) && (p != NULL));
 		    p = TAILQ_NEXT(p, listq)) {
 
-			tmpidx = p->pindex;
-			if (tmpidx < pindex) {
-				continue;
-			}
-			tmpidx -= pindex;
-			if (tmpidx >= psize) {
+			if (p->pindex < pindex || p->pindex - pindex > psize) {
 				continue;
 			}
+			tmpidx = p->pindex - pindex;
 			/*
 			 * don't allow an madvise to blow away our really
 			 * free pages allocating pv entries.
diff --git a/sys/i386/i386/pmap.c b/sys/i386/i386/pmap.c
index d3478d295445..17bcd8080427 100644
--- a/sys/i386/i386/pmap.c
+++ b/sys/i386/i386/pmap.c
@@ -2493,14 +2493,10 @@ pmap_object_init_pt(pmap_t pmap, vm_offset_t addr,
 		    ((objpgs > 0) && (p != NULL));
 		    p = TAILQ_NEXT(p, listq)) {
 
-			tmpidx = p->pindex;
-			if (tmpidx < pindex) {
-				continue;
-			}
-			tmpidx -= pindex;
-			if (tmpidx >= psize) {
+			if (p->pindex < pindex || p->pindex - pindex > psize) {
 				continue;
 			}
+			tmpidx = p->pindex - pindex;
 			/*
 			 * don't allow an madvise to blow away our really
 			 * free pages allocating pv entries.
diff --git a/sys/vm/device_pager.c b/sys/vm/device_pager.c
index 4eb4ebd3ff7d..890d06816957 100644
--- a/sys/vm/device_pager.c
+++ b/sys/vm/device_pager.c
@@ -201,7 +201,7 @@ dev_pager_getpages(object, m, count, reqpage)
 	int count;
 	int reqpage;
 {
-	vm_offset_t offset;
+	vm_pindex_t offset;
 	vm_offset_t paddr;
 	vm_page_t page;
 	dev_t dev;
diff --git a/sys/vm/vm_object.c b/sys/vm/vm_object.c
index b07d6b8a40b8..33b597b2fcfa 100644
--- a/sys/vm/vm_object.c
+++ b/sys/vm/vm_object.c
@@ -187,7 +187,7 @@ vm_object_zinit(void *mem, int size)
 }
 
 void
-_vm_object_allocate(objtype_t type, vm_size_t size, vm_object_t object)
+_vm_object_allocate(objtype_t type, vm_pindex_t size, vm_object_t object)
 {
 	static int object_hash_rand;
 	int exp, incr;
@@ -341,7 +341,7 @@ vm_object_pip_wait(vm_object_t object, char *waitid)
  *	Returns a new object with the given size.
  */
 vm_object_t
-vm_object_allocate(objtype_t type, vm_size_t size)
+vm_object_allocate(objtype_t type, vm_pindex_t size)
 {
 	vm_object_t result;
 
@@ -626,7 +626,7 @@ void
 vm_object_page_clean(vm_object_t object, vm_pindex_t start, vm_pindex_t end, int flags)
 {
 	vm_page_t p, np;
-	vm_offset_t tstart, tend;
+	vm_pindex_t tstart, tend;
 	vm_pindex_t pi;
 	struct vnode *vp;
 	int clearobjflags;
@@ -1697,7 +1697,7 @@ void
 vm_object_page_remove(vm_object_t object, vm_pindex_t start, vm_pindex_t end, boolean_t clean_only)
 {
 	vm_page_t p, next;
-	unsigned int size;
+	vm_pindex_t size;
 	int all;
 
 	if (object == NULL)
diff --git a/sys/vm/vm_object.h b/sys/vm/vm_object.h
index 53db3191ae5c..65e32af799af 100644
--- a/sys/vm/vm_object.h
+++ b/sys/vm/vm_object.h
@@ -93,7 +93,7 @@ struct vm_object {
 	TAILQ_ENTRY(vm_object) shadow_list; /* chain of shadow objects */
 	TAILQ_HEAD(, vm_page) memq;	/* list of resident pages */
 	int generation;			/* generation ID */
-	vm_size_t size;			/* Object size */
+	vm_pindex_t size;		/* Object size */
 	int ref_count;			/* How many refs?? */
 	int shadow_count;		/* how many objects that this is a shadow for */
 	int hash_rand;			/* (c) hash table randomizer */
@@ -182,8 +182,8 @@ void vm_object_pip_wakeupn(vm_object_t object, short i);
 void vm_object_pip_sleep(vm_object_t object, char *waitid);
 void vm_object_pip_wait(vm_object_t object, char *waitid);
 
-vm_object_t vm_object_allocate (objtype_t, vm_size_t);
-void _vm_object_allocate (objtype_t, vm_size_t, vm_object_t);
+vm_object_t vm_object_allocate (objtype_t, vm_pindex_t);
+void _vm_object_allocate (objtype_t, vm_pindex_t, vm_object_t);
 boolean_t vm_object_coalesce (vm_object_t, vm_pindex_t, vm_size_t, vm_size_t);
 void vm_object_collapse (vm_object_t);
 void vm_object_deallocate (vm_object_t);