xref: /trueos/lib/libdispatch/src/voucher.c (revision bf5f91cb28c5878845eb00fbf329c042f6c643c9)

/*
 * Copyright (c) 2013 Apple Inc. All rights reserved.
 *
 * @APPLE_APACHE_LICENSE_HEADER_START@
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * @APPLE_APACHE_LICENSE_HEADER_END@
 */

#include "internal.h"

#if VOUCHER_USE_MACH_VOUCHER

#include <mach/mach_voucher.h>

// <rdar://16363550>
#ifndef VM_MEMORY_GENEALOGY
#define VM_MEMORY_GENEALOGY 78
#endif

#ifndef VOUCHER_ATM_COLLECT_THRESHOLD
#define VOUCHER_ATM_COLLECT_THRESHOLD 1
#endif
#define VATM_COLLECT_THRESHOLD_VALUE(t) (((t) - 1) * 2)
static volatile long _voucher_atm_collect_level;
static long _voucher_atm_collect_threshold =
		VATM_COLLECT_THRESHOLD_VALUE(VOUCHER_ATM_COLLECT_THRESHOLD);
static unsigned long _voucher_atm_subid_bits;

typedef struct _voucher_atm_s *_voucher_atm_t;

static void _voucher_activity_atfork_child(void);
static inline mach_voucher_t _voucher_get_atm_mach_voucher(voucher_t voucher);
static inline mach_voucher_t _voucher_activity_get_atm_mach_voucher(
		_voucher_activity_t act);
static inline _voucher_activity_t _voucher_activity_get(voucher_t voucher);
static _voucher_activity_t _voucher_activity_copy_from_mach_voucher(
		mach_voucher_t kv, voucher_activity_id_t va_id);
static inline _voucher_activity_t _voucher_activity_retain(
		_voucher_activity_t act);
static inline void _voucher_activity_release(_voucher_activity_t act);

#pragma mark -
#pragma mark voucher_t

#if USE_OBJC
OS_OBJECT_OBJC_CLASS_DECL(voucher);
#define VOUCHER_CLASS OS_OBJECT_OBJC_CLASS(voucher)
#else
const _os_object_class_s _voucher_class = {
	._os_obj_xref_dispose = (void(*)(_os_object_t))_voucher_xref_dispose,
	._os_obj_dispose = (void(*)(_os_object_t))_voucher_dispose,
};
#define VOUCHER_CLASS &_voucher_class
#endif // USE_OBJC

static const voucher_activity_trace_id_t _voucher_activity_trace_id_release =
		(voucher_activity_trace_id_t)voucher_activity_tracepoint_type_release <<
		_voucher_activity_trace_id_type_shift;
static const unsigned int _voucher_max_activities = 16;

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_recipes_init(mach_voucher_attr_recipe_data_t *recipes,
		mach_voucher_attr_content_size_t bits_size)
{
	static const mach_voucher_attr_recipe_data_t base_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_ALL,
		.command = MACH_VOUCHER_ATTR_COPY,
	};
	_voucher_recipes_base(recipes) = base_recipe;
	static const mach_voucher_attr_recipe_data_t atm_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_ATM,
		.command = MACH_VOUCHER_ATTR_COPY,
	};
	_voucher_recipes_atm(recipes) = atm_recipe;
	static const mach_voucher_attr_recipe_data_t bits_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_USER_DATA,
		.command = MACH_VOUCHER_ATTR_USER_DATA_STORE,
	};
	_voucher_recipes_bits(recipes) = bits_recipe;
	if (!bits_size) return;
	_voucher_recipes_bits(recipes).content_size = bits_size;
	*_voucher_recipes_magic(recipes) = _voucher_magic_v1;
}

static inline voucher_t
_voucher_alloc(unsigned int activities, pthread_priority_t priority,
		mach_voucher_attr_recipe_size_t extra)
{
	if (activities > _voucher_max_activities) {
		activities = _voucher_max_activities;
	}
	voucher_t voucher;
	size_t voucher_size, recipes_size;
	mach_voucher_attr_content_size_t bits_size;
	recipes_size = (priority||activities||extra) ? _voucher_recipes_size() : 0;
	bits_size = recipes_size ? _voucher_bits_size(activities) : 0;
	voucher_size = sizeof(voucher_s) + recipes_size + bits_size + extra;
	voucher = (voucher_t)_os_object_alloc_realized(VOUCHER_CLASS, voucher_size);
#if VOUCHER_ENABLE_RECIPE_OBJECTS
	voucher->v_recipe_extra_size = extra;
	voucher->v_recipe_extra_offset = voucher_size - extra;
#else
	dispatch_assert(!extra);
#endif
	voucher->v_has_priority = priority ? 1 : 0;
	voucher->v_activities = activities;
	if (!recipes_size) return voucher;
	_voucher_recipes_init(voucher->v_recipes, bits_size);
	*_voucher_priority(voucher) = (_voucher_priority_t)priority;
	_dispatch_voucher_debug("alloc", voucher);
	return voucher;
}

#if VOUCHER_ENABLE_RECIPE_OBJECTS
voucher_t
voucher_create(voucher_recipe_t recipe)
{
	// TODO: capture current activities or current kvoucher ?
	mach_voucher_attr_recipe_size_t extra = recipe ? recipe->vr_size : 0;
	voucher_t voucher = _voucher_alloc(0, 0, extra);
	if (extra) {
		memcpy(_voucher_extra_recipes(voucher), recipe->vr_data, extra);
	}
	return voucher;
}
#endif

voucher_t
voucher_adopt(voucher_t voucher)
{
	return _voucher_adopt(voucher);
}

voucher_t
voucher_copy(void)
{
	return _voucher_copy();
}

voucher_t
voucher_copy_without_importance(void)
{
	return _voucher_copy_without_importance();
}

void
_voucher_thread_cleanup(void *voucher)
{
	_voucher_swap(voucher, NULL);
}

DISPATCH_CACHELINE_ALIGN
static TAILQ_HEAD(, voucher_s) _vouchers[VL_HASH_SIZE];
#define _vouchers(kv) (&_vouchers[VL_HASH((kv))])
static os_lock_handoff_s _vouchers_lock = OS_LOCK_HANDOFF_INIT;
#define _vouchers_lock_lock() os_lock_lock(&_vouchers_lock)
#define _vouchers_lock_unlock() os_lock_unlock(&_vouchers_lock)

static voucher_t
_voucher_find_and_retain(mach_voucher_t kv)
{
	voucher_t v;
	if (!kv) return NULL;
	_vouchers_lock_lock();
	TAILQ_FOREACH(v, _vouchers(kv), v_list) {
		if (v->v_ipc_kvoucher == kv) {
			int xref_cnt = dispatch_atomic_inc2o(v, os_obj_xref_cnt, relaxed);
			_dispatch_voucher_debug("retain  -> %d", v, xref_cnt + 1);
			if (slowpath(xref_cnt < 0)) {
				_dispatch_voucher_debug("overrelease", v);
				DISPATCH_CRASH("Voucher overrelease");
			}
			if (xref_cnt == 0) {
				// resurrection: raced with _voucher_remove
				(void)dispatch_atomic_inc2o(v, os_obj_ref_cnt, relaxed);
			}
			break;
		}
	}
	_vouchers_lock_unlock();
	return v;
}

static void
_voucher_insert(voucher_t v)
{
	mach_voucher_t kv = v->v_ipc_kvoucher;
	if (!kv) return;
	_vouchers_lock_lock();
	if (slowpath(_TAILQ_IS_ENQUEUED(v, v_list))) {
		_dispatch_voucher_debug("corruption", v);
		DISPATCH_CRASH("Voucher corruption");
	}
	TAILQ_INSERT_TAIL(_vouchers(kv), v, v_list);
	_vouchers_lock_unlock();
}

static void
_voucher_remove(voucher_t v)
{
	mach_voucher_t kv = v->v_ipc_kvoucher;
	if (!_TAILQ_IS_ENQUEUED(v, v_list)) return;
	_vouchers_lock_lock();
	if (slowpath(!kv)) {
		_dispatch_voucher_debug("corruption", v);
		DISPATCH_CRASH("Voucher corruption");
	}
	// check for resurrection race with _voucher_find_and_retain
	if (dispatch_atomic_load2o(v, os_obj_xref_cnt, seq_cst) < 0 &&
			_TAILQ_IS_ENQUEUED(v, v_list)) {
		TAILQ_REMOVE(_vouchers(kv), v, v_list);
		_TAILQ_MARK_NOT_ENQUEUED(v, v_list);
		v->v_list.tqe_next = (void*)~0ull;
	}
	_vouchers_lock_unlock();
}

void
_voucher_dealloc_mach_voucher(mach_voucher_t kv)
{
	_dispatch_kvoucher_debug("dealloc", kv);
	_dispatch_voucher_debug_machport(kv);
	kern_return_t kr = mach_voucher_deallocate(kv);
	DISPATCH_VERIFY_MIG(kr);
	(void)dispatch_assume_zero(kr);
}

static inline kern_return_t
_voucher_create_mach_voucher(const mach_voucher_attr_recipe_data_t *recipes,
		size_t recipes_size, mach_voucher_t *kvp)
{
	kern_return_t kr;
	mach_port_t mhp = _dispatch_get_mach_host_port();
	mach_voucher_t kv = MACH_VOUCHER_NULL;
	mach_voucher_attr_raw_recipe_array_t kvr;
	mach_voucher_attr_recipe_size_t kvr_size;
	kvr = (mach_voucher_attr_raw_recipe_array_t)recipes;
	kvr_size = (mach_voucher_attr_recipe_size_t)recipes_size;
	kr = host_create_mach_voucher(mhp, kvr, kvr_size, &kv);
	DISPATCH_VERIFY_MIG(kr);
	if (!kr) {
		_dispatch_kvoucher_debug("create", kv);
		_dispatch_voucher_debug_machport(kv);
	}
	*kvp = kv;
	return kr;
}

#if __has_include(<bank/bank_types.h>) && !defined(VOUCHER_USE_ATTR_BANK)
#include <bank/bank_types.h>
#define VOUCHER_USE_ATTR_BANK 1
mach_voucher_t _voucher_default_task_mach_voucher;
#endif

void
_voucher_task_mach_voucher_init(void* ctxt DISPATCH_UNUSED)
{
#if VOUCHER_USE_ATTR_BANK
	kern_return_t kr;
	mach_voucher_t kv;
	static const mach_voucher_attr_recipe_data_t task_create_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_BANK,
		.command = MACH_VOUCHER_ATTR_BANK_CREATE,
	};
	kr = _voucher_create_mach_voucher(&task_create_recipe,
			sizeof(task_create_recipe), &kv);
	if (dispatch_assume_zero(kr)) {
		DISPATCH_CLIENT_CRASH("Could not create task mach voucher");
	}
	_voucher_default_task_mach_voucher = kv;
	_voucher_task_mach_voucher = kv;
#endif
}

void
voucher_replace_default_voucher(void)
{
#if VOUCHER_USE_ATTR_BANK
	(void)_voucher_get_task_mach_voucher(); // initalize task mach voucher
	mach_voucher_t kv, tkv = MACH_VOUCHER_NULL;
	voucher_t v = _voucher_get();
	if (v && v->v_kvoucher) {
		kern_return_t kr;
		kv = v->v_ipc_kvoucher ? v->v_ipc_kvoucher : v->v_kvoucher;
		const mach_voucher_attr_recipe_data_t task_copy_recipe = {
			.key = MACH_VOUCHER_ATTR_KEY_BANK,
			.command = MACH_VOUCHER_ATTR_COPY,
			.previous_voucher = kv,
		};
		kr = _voucher_create_mach_voucher(&task_copy_recipe,
				sizeof(task_copy_recipe), &tkv);
		if (dispatch_assume_zero(kr)) {
			tkv = MACH_VOUCHER_NULL;
		}
	}
	if (!tkv) tkv = _voucher_default_task_mach_voucher;
	kv = dispatch_atomic_xchg(&_voucher_task_mach_voucher, tkv, relaxed);
	if (kv && kv != _voucher_default_task_mach_voucher) {
		_voucher_dealloc_mach_voucher(kv);
	}
	_dispatch_voucher_debug("kvoucher[0x%08x] replace default voucher", v, tkv);
#endif
}

static inline mach_voucher_t
_voucher_get_atm_mach_voucher(voucher_t voucher)
{
	_voucher_activity_t act = _voucher_activity_get(voucher);
	return _voucher_activity_get_atm_mach_voucher(act);
}

mach_voucher_t
_voucher_get_mach_voucher(voucher_t voucher)
{
	if (!voucher) return MACH_VOUCHER_NULL;
	if (voucher->v_ipc_kvoucher) return voucher->v_ipc_kvoucher;
	mach_voucher_t kvb = voucher->v_kvoucher;
	if (!kvb) kvb = _voucher_get_task_mach_voucher();
	if (!voucher->v_has_priority && !voucher->v_activities &&
			!_voucher_extra_size(voucher)) {
		return kvb;
	}
	kern_return_t kr;
	mach_voucher_t kv, kvo;
	_voucher_base_recipe(voucher).previous_voucher = kvb;
	_voucher_atm_recipe(voucher).previous_voucher =
			_voucher_get_atm_mach_voucher(voucher);
	kr = _voucher_create_mach_voucher(voucher->v_recipes,
			_voucher_recipes_size() + _voucher_extra_size(voucher) +
			_voucher_bits_recipe(voucher).content_size, &kv);
	if (dispatch_assume_zero(kr) || !kv){
		return MACH_VOUCHER_NULL;
	}
	if (!dispatch_atomic_cmpxchgv2o(voucher, v_ipc_kvoucher, MACH_VOUCHER_NULL,
			kv, &kvo, relaxed)) {
		_voucher_dealloc_mach_voucher(kv);
		kv = kvo;
	} else {
		if (kv == voucher->v_kvoucher) {
			// if v_kvoucher == v_ipc_kvoucher we keep only one reference
			_voucher_dealloc_mach_voucher(kv);
		}
		_voucher_insert(voucher);
		_dispatch_voucher_debug("kvoucher[0x%08x] create", voucher, kv);
	}
	return kv;
}

mach_voucher_t
_voucher_create_mach_voucher_with_priority(voucher_t voucher,
		pthread_priority_t priority)
{
	if (priority == _voucher_get_priority(voucher)) {
		return MACH_VOUCHER_NULL; // caller will use _voucher_get_mach_voucher
	}
	kern_return_t kr;
	mach_voucher_t kv, kvb = voucher ? voucher->v_kvoucher : MACH_VOUCHER_NULL;
	if (!kvb) kvb = _voucher_get_task_mach_voucher();
	mach_voucher_attr_recipe_data_t *recipes;
	size_t recipes_size = _voucher_recipes_size();
	if (voucher && (voucher->v_has_priority || voucher->v_activities ||
			_voucher_extra_size(voucher))) {
		recipes_size += _voucher_bits_recipe(voucher).content_size +
				_voucher_extra_size(voucher);
		recipes = alloca(recipes_size);
		memcpy(recipes, voucher->v_recipes, recipes_size);
		_voucher_recipes_atm(recipes).previous_voucher =
				_voucher_get_atm_mach_voucher(voucher);
	} else {
		mach_voucher_attr_content_size_t bits_size = _voucher_bits_size(0);
		recipes_size += bits_size;
		recipes = alloca(recipes_size);
		_voucher_recipes_init(recipes, bits_size);
	}
	_voucher_recipes_base(recipes).previous_voucher = kvb;
	*_voucher_recipes_priority(recipes) = (_voucher_priority_t)priority;
	kr = _voucher_create_mach_voucher(recipes, recipes_size, &kv);
	if (dispatch_assume_zero(kr) || !kv){
		return MACH_VOUCHER_NULL;
	}
	_dispatch_kvoucher_debug("create with priority from voucher[%p]", kv,
			voucher);
	return kv;
}

static voucher_t
_voucher_create_with_mach_voucher(mach_voucher_t kv)
{
	if (!kv) return NULL;
	kern_return_t kr;
	mach_voucher_t rkv;
	mach_voucher_attr_recipe_t vr;
	size_t vr_size;
	mach_voucher_attr_recipe_size_t kvr_size = 0;
	const mach_voucher_attr_recipe_data_t redeem_recipe[] = {
		[0] = {
			.key = MACH_VOUCHER_ATTR_KEY_ALL,
			.command = MACH_VOUCHER_ATTR_COPY,
			.previous_voucher = kv,
		},
#if VOUCHER_USE_ATTR_BANK
		[1] = {
			.key = MACH_VOUCHER_ATTR_KEY_BANK,
			.command = MACH_VOUCHER_ATTR_REDEEM,
		},
#endif
	};
	kr = _voucher_create_mach_voucher(redeem_recipe, sizeof(redeem_recipe),
			&rkv);
	if (!dispatch_assume_zero(kr)) {
		_voucher_dealloc_mach_voucher(kv);
	} else {
		_dispatch_voucher_debug_machport(kv);
		rkv = kv;
	}
	voucher_t v = _voucher_find_and_retain(rkv);
	if (v) {
		_dispatch_voucher_debug("kvoucher[0x%08x] find with 0x%08x", v, rkv,kv);
		_voucher_dealloc_mach_voucher(rkv);
		return v;
	}
	vr_size = sizeof(*vr) + _voucher_bits_size(_voucher_max_activities);
	vr = alloca(vr_size);
	if (rkv) {
		kvr_size = (mach_voucher_attr_recipe_size_t)vr_size;
		kr = mach_voucher_extract_attr_recipe(rkv,
				MACH_VOUCHER_ATTR_KEY_USER_DATA, (void*)vr, &kvr_size);
		DISPATCH_VERIFY_MIG(kr);
		if (dispatch_assume_zero(kr)) kvr_size = 0;
	}
	mach_voucher_attr_content_size_t content_size = vr->content_size;
	uint8_t *content = vr->content;
	bool valid = false, has_priority = false;
	unsigned int activities = 0;
	if (kvr_size >= sizeof(*vr) + sizeof(_voucher_magic_t)) {
		valid = (*(_voucher_magic_t*)content == _voucher_magic_v1);
		content += sizeof(_voucher_magic_t);
		content_size -= sizeof(_voucher_magic_t);
	}
	if (valid) {
		has_priority = (content_size >= sizeof(_voucher_priority_t));
		activities = has_priority ? (content_size - sizeof(_voucher_priority_t))
				/ sizeof(voucher_activity_id_t) : 0;
	}
	pthread_priority_t priority = 0;
	if (has_priority) {
		priority = (pthread_priority_t)*(_voucher_priority_t*)content;
		content += sizeof(_voucher_priority_t);
		content_size -= sizeof(_voucher_priority_t);
	}
	voucher_activity_id_t va_id = 0, va_base_id = 0;
	_voucher_activity_t act = NULL;
	if (activities) {
		va_id = *(voucher_activity_id_t*)content;
		act = _voucher_activity_copy_from_mach_voucher(rkv, va_id);
		if (!act && _voucher_activity_default) {
			activities++;
			// default to _voucher_activity_default base activity
			va_base_id = _voucher_activity_default->va_id;
		} else if (act && act->va_id != va_id) {
			activities++;
			va_base_id = act->va_id;
		}
	}
	v = _voucher_alloc(activities, priority, 0);
	v->v_activity = act;
	voucher_activity_id_t *activity_ids = _voucher_activity_ids(v);
	if (activities && va_base_id) {
		*activity_ids++ = va_base_id;
		activities--;
	}
	if (activities) {
		memcpy(activity_ids, content, content_size);
	}
	v->v_ipc_kvoucher = v->v_kvoucher = rkv;
	_voucher_insert(v);
	_dispatch_voucher_debug("kvoucher[0x%08x] create with 0x%08x", v, rkv, kv);
	return v;
}

voucher_t
_voucher_create_with_priority_and_mach_voucher(voucher_t ov,
		pthread_priority_t priority, mach_voucher_t kv)
{
	if (priority == _voucher_get_priority(ov)) {
		if (kv) _voucher_dealloc_mach_voucher(kv);
		return ov ? _voucher_retain(ov) : NULL;
	}
	voucher_t v = _voucher_find_and_retain(kv);
	if (v) {
		_dispatch_voucher_debug("kvoucher[0x%08x] find", v, kv);
		_voucher_dealloc_mach_voucher(kv);
		return v;
	}
	unsigned int activities = ov ? ov->v_activities : 0;
	mach_voucher_attr_recipe_size_t extra = ov ? _voucher_extra_size(ov) : 0;
	v = _voucher_alloc(activities, priority, extra);
	if (extra) {
		memcpy(_voucher_extra_recipes(v), _voucher_extra_recipes(ov), extra);
	}
	if (activities) {
		if (ov->v_activity) {
			v->v_activity = _voucher_activity_retain(ov->v_activity);
		}
		memcpy(_voucher_activity_ids(v), _voucher_activity_ids(ov),
				activities * sizeof(voucher_activity_id_t));
	}
	if (kv) {
		v->v_ipc_kvoucher = v->v_kvoucher = kv;
		_voucher_insert(v);
		_dispatch_voucher_debug("kvoucher[0x%08x] create with priority from "
				"voucher[%p]", v, kv, ov);
		_dispatch_voucher_debug_machport(kv);
	} else if (ov && ov->v_kvoucher) {
		voucher_t kvb = ov->v_kvbase ? ov->v_kvbase : ov;
		v->v_kvbase = _voucher_retain(kvb);
		v->v_kvoucher = kvb->v_kvoucher;
	}
	return v;
}

voucher_t
_voucher_create_without_importance(voucher_t ov)
{
	// Nothing to do unless the old voucher has a kernel voucher. If it
	// doesn't, it can't have any importance, now or in the future.
	if (!ov) return NULL;
	// TODO: 17487167: track presence of importance attribute
	if (!ov->v_kvoucher) return _voucher_retain(ov);
	kern_return_t kr;
	mach_voucher_t kv, okv;
	// Copy kernel voucher, removing importance.
	okv = ov->v_ipc_kvoucher ? ov->v_ipc_kvoucher : ov->v_kvoucher;
	const mach_voucher_attr_recipe_data_t importance_remove_recipe[] = {
		[0] = {
			.key = MACH_VOUCHER_ATTR_KEY_ALL,
			.command = MACH_VOUCHER_ATTR_COPY,
			.previous_voucher = okv,
		},
		[1] = {
			.key = MACH_VOUCHER_ATTR_KEY_IMPORTANCE,
			.command = MACH_VOUCHER_ATTR_REMOVE,
		},
	};
	kr = _voucher_create_mach_voucher(importance_remove_recipe,
			sizeof(importance_remove_recipe), &kv);
	if (dispatch_assume_zero(kr) || !kv){
		if (ov->v_ipc_kvoucher) return NULL;
		kv = MACH_VOUCHER_NULL;
	}
	if (kv == okv) {
		_voucher_dealloc_mach_voucher(kv);
		return _voucher_retain(ov);
	}
	voucher_t v = _voucher_find_and_retain(kv);
	if (v && ov->v_ipc_kvoucher) {
		_dispatch_voucher_debug("kvoucher[0x%08x] find without importance "
				"from voucher[%p]", v, kv, ov);
		_voucher_dealloc_mach_voucher(kv);
		return v;
	}
	voucher_t kvbase = v;
	// Copy userspace contents
	unsigned int activities = ov->v_activities;
	pthread_priority_t priority = _voucher_get_priority(ov);
	mach_voucher_attr_recipe_size_t extra = _voucher_extra_size(ov);
	v = _voucher_alloc(activities, priority, extra);
	if (extra) {
		memcpy(_voucher_extra_recipes(v), _voucher_extra_recipes(ov), extra);
	}
	if (activities) {
		if (ov->v_activity) {
			v->v_activity = _voucher_activity_retain(ov->v_activity);
		}
		memcpy(_voucher_activity_ids(v), _voucher_activity_ids(ov),
				activities * sizeof(voucher_activity_id_t));
	}
	v->v_kvoucher = kv;
	if (ov->v_ipc_kvoucher) {
		v->v_ipc_kvoucher = kv;
		_voucher_insert(v);
	} else if (kvbase) {
		v->v_kvbase = kvbase;
		_voucher_dealloc_mach_voucher(kv); // borrow base reference
	}
	if (!kvbase) {
		_dispatch_voucher_debug("kvoucher[0x%08x] create without importance "
				"from voucher[%p]", v, kv, ov);
	}
	return v;
}

voucher_t
voucher_create_with_mach_msg(mach_msg_header_t *msg)
{
	voucher_t v = _voucher_create_with_mach_voucher(_voucher_mach_msg_get(msg));
	_voucher_activity_trace_msg(v, msg, receive);
	return v;
}

#ifndef MACH_VOUCHER_IMPORTANCE_ATTR_DROP_EXTERNAL
#define MACH_VOUCHER_IMPORTANCE_ATTR_DROP_EXTERNAL 2
#endif

void
voucher_decrement_importance_count4CF(voucher_t v)
{
	if (!v || !v->v_kvoucher) return;
	// TODO: 17487167: track presence of importance attribute
	kern_return_t kr;
	mach_voucher_t kv = v->v_ipc_kvoucher ? v->v_ipc_kvoucher : v->v_kvoucher;
	uint32_t dec = 1;
	mach_voucher_attr_content_t kvc_in = (mach_voucher_attr_content_t)&dec;
	mach_voucher_attr_content_size_t kvc_in_size = sizeof(dec);
	mach_voucher_attr_content_t kvc_out = NULL;
	mach_voucher_attr_content_size_t kvc_out_size = 0;
#if DISPATCH_DEBUG
	uint32_t count = UINT32_MAX;
	kvc_out = (mach_voucher_attr_content_t)&count;
	kvc_out_size = sizeof(count);
#endif
	kr = mach_voucher_attr_command(kv, MACH_VOUCHER_ATTR_KEY_IMPORTANCE,
			MACH_VOUCHER_IMPORTANCE_ATTR_DROP_EXTERNAL, kvc_in, kvc_in_size,
			kvc_out, &kvc_out_size);
	DISPATCH_VERIFY_MIG(kr);
#if DISPATCH_DEBUG
	_dispatch_voucher_debug("kvoucher[0x%08x] decrement importance count to %u:"
			" %s - 0x%x", v, kv, count, mach_error_string(kr), kr);
#endif
	if (kr != KERN_INVALID_ARGUMENT &&
			dispatch_assume_zero(kr) == KERN_FAILURE) {
		// TODO: 17487167: skip KERN_INVALID_ARGUMENT check
		DISPATCH_CLIENT_CRASH("Voucher importance count underflow");
	}
}

#if VOUCHER_ENABLE_GET_MACH_VOUCHER
mach_voucher_t
voucher_get_mach_voucher(voucher_t voucher)
{
	return _voucher_get_mach_voucher(voucher);
}
#endif

void
_voucher_xref_dispose(voucher_t voucher)
{
	_dispatch_voucher_debug("xref_dispose", voucher);
	_voucher_remove(voucher);
	return _os_object_release_internal_inline((_os_object_t)voucher);
}

void
_voucher_dispose(voucher_t voucher)
{
	_dispatch_voucher_debug("dispose", voucher);
	if (slowpath(_TAILQ_IS_ENQUEUED(voucher, v_list))) {
		_dispatch_voucher_debug("corruption", voucher);
		DISPATCH_CRASH("Voucher corruption");
	}
	voucher->v_list.tqe_next = DISPATCH_OBJECT_LISTLESS;
	if (voucher->v_ipc_kvoucher) {
		if (voucher->v_ipc_kvoucher != voucher->v_kvoucher) {
			_voucher_dealloc_mach_voucher(voucher->v_ipc_kvoucher);
		}
		voucher->v_ipc_kvoucher = MACH_VOUCHER_NULL;
	}
	if (voucher->v_kvoucher) {
		if (!voucher->v_kvbase) {
			_voucher_dealloc_mach_voucher(voucher->v_kvoucher);
		}
		voucher->v_kvoucher = MACH_VOUCHER_NULL;
	}
	if (voucher->v_kvbase) {
		_voucher_release(voucher->v_kvbase);
		voucher->v_kvbase = NULL;
	}
	if (voucher->v_activity) {
		_voucher_activity_release(voucher->v_activity);
		voucher->v_activity = NULL;
	}
	voucher->v_has_priority= 0;
	voucher->v_activities = 0;
#if VOUCHER_ENABLE_RECIPE_OBJECTS
	voucher->v_recipe_extra_size = 0;
	voucher->v_recipe_extra_offset = 0;
#endif
	return _os_object_dealloc((_os_object_t)voucher);
}

void
_voucher_atfork_child(void)
{
	_voucher_activity_atfork_child();
	_dispatch_thread_setspecific(dispatch_voucher_key, NULL);
	_voucher_task_mach_voucher_pred = 0;
	_voucher_task_mach_voucher = MACH_VOUCHER_NULL;

	// TODO: voucher/activity inheritance on fork ?
}

#pragma mark -
#pragma mark _voucher_init

boolean_t
voucher_mach_msg_set(mach_msg_header_t *msg)
{
	voucher_t v = _voucher_get();
	bool clear_voucher = _voucher_mach_msg_set(msg, v);
	if (clear_voucher) _voucher_activity_trace_msg(v, msg, send);
	return clear_voucher;
}

void
voucher_mach_msg_clear(mach_msg_header_t *msg)
{
	(void)_voucher_mach_msg_clear(msg, false);
}

voucher_mach_msg_state_t
voucher_mach_msg_adopt(mach_msg_header_t *msg)
{
	mach_voucher_t kv = _voucher_mach_msg_get(msg);
	if (!kv) return VOUCHER_MACH_MSG_STATE_UNCHANGED;
	voucher_t v = _voucher_create_with_mach_voucher(kv);
	_voucher_activity_trace_msg(v, msg, receive);
	return (voucher_mach_msg_state_t)_voucher_adopt(v);
}

void
voucher_mach_msg_revert(voucher_mach_msg_state_t state)
{
	if (state == VOUCHER_MACH_MSG_STATE_UNCHANGED) return;
	_voucher_replace((voucher_t)state);
}

#if DISPATCH_USE_LIBKERNEL_VOUCHER_INIT
#include <_libkernel_init.h>

static const struct _libkernel_voucher_functions _voucher_libkernel_functions =
{
	.version = 1,
	.voucher_mach_msg_set = voucher_mach_msg_set,
	.voucher_mach_msg_clear = voucher_mach_msg_clear,
	.voucher_mach_msg_adopt = voucher_mach_msg_adopt,
	.voucher_mach_msg_revert = voucher_mach_msg_revert,
};

static void
_voucher_libkernel_init(void)
{
	kern_return_t kr = __libkernel_voucher_init(&_voucher_libkernel_functions);
	dispatch_assert(!kr);
}
#else
#define _voucher_libkernel_init()
#endif

void
_voucher_init(void)
{
	_voucher_libkernel_init();
	char *e, *end;
	unsigned int i;
	for (i = 0; i < VL_HASH_SIZE; i++) {
		TAILQ_INIT(&_vouchers[i]);
	}
	voucher_activity_mode_t mode;
	mode = DISPATCH_DEBUG ? voucher_activity_mode_debug
			: voucher_activity_mode_release;
	e = getenv("OS_ACTIVITY_MODE");
	if (e) {
		if (strcmp(e, "release") == 0) {
			mode = voucher_activity_mode_release;
		} else if (strcmp(e, "debug") == 0) {
			mode = voucher_activity_mode_debug;
		} else if (strcmp(e, "stream") == 0) {
			mode = voucher_activity_mode_stream;
		} else if (strcmp(e, "disable") == 0) {
			mode = voucher_activity_mode_disable;
		}
	}
	_voucher_activity_mode = mode;
	if (_voucher_activity_disabled()) return;

	e = getenv("LIBDISPATCH_ACTIVITY_ATM_SUBID_BITS");
	if (e) {
		unsigned long v = strtoul(e, &end, 0);
		if (v && !*end) {
			_voucher_atm_subid_bits = v;
		}
	}
	e = getenv("LIBDISPATCH_ACTIVITY_ATM_COLLECT_THRESHOLD");
	if (e) {
		unsigned long v = strtoul(e, &end, 0);
		if (v && v < LONG_MAX/2 && !*end) {
			_voucher_atm_collect_threshold =
					VATM_COLLECT_THRESHOLD_VALUE((long)v);
		}
	}
	// default task activity
	bool default_task_activity = DISPATCH_DEBUG;
	e = getenv("LIBDISPATCH_DEFAULT_TASK_ACTIVITY");
	if (e) default_task_activity = atoi(e);
	if (default_task_activity) {
		(void)voucher_activity_start(_voucher_activity_trace_id_release, 0);
	}
}

#pragma mark -
#pragma mark _voucher_activity_lock_s

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_lock_init(_voucher_activity_lock_s *lock) {
    static const os_lock_handoff_s _os_lock_handoff_init = OS_LOCK_HANDOFF_INIT;
    *lock = _os_lock_handoff_init;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_lock_lock(_voucher_activity_lock_s *lock) {
    return os_lock_lock(lock);
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_lock_unlock(_voucher_activity_lock_s *lock) {
    return os_lock_unlock(lock);
}

#pragma mark -
#pragma mark _voucher_activity_heap

#if __has_extension(c_static_assert)
_Static_assert(sizeof(struct _voucher_activity_tracepoint_s) == 64,
		"Tracepoint too large");
_Static_assert(sizeof(struct _voucher_activity_buffer_header_s) <=
		sizeof(struct _voucher_activity_tracepoint_s),
		"Buffer header too large");
_Static_assert(offsetof(struct _voucher_activity_s, va_flags2) ==
		sizeof(struct _voucher_activity_tracepoint_s),
		"Extended activity object misaligned");
#if __LP64__
_Static_assert(sizeof(struct _voucher_activity_s) ==
		3 * sizeof(struct _voucher_activity_tracepoint_s),
		"Activity object too large");
_Static_assert(offsetof(struct _voucher_activity_s, va_flags3) ==
		2 * sizeof(struct _voucher_activity_tracepoint_s),
		"Extended activity object misaligned");
_Static_assert(offsetof(struct _voucher_atm_s, vatm_activities_lock) % 64 == 0,
		"Bad ATM padding");
_Static_assert(sizeof(struct _voucher_atm_s) <= 128,
		"ATM too large");
#else
_Static_assert(sizeof(struct _voucher_activity_s) ==
		2 * sizeof(struct _voucher_activity_tracepoint_s),
		"Activity object too large");
_Static_assert(sizeof(struct _voucher_atm_s) <= 64,
		"ATM too large");
#endif
_Static_assert(sizeof(_voucher_activity_buffer_t) ==
		sizeof(struct {char x[_voucher_activity_buffer_size];}),
		"Buffer too large");
_Static_assert(sizeof(struct _voucher_activity_metadata_s) <=
		sizeof(struct _voucher_activity_metadata_opaque_s),
		"Metadata too large");
_Static_assert(sizeof(_voucher_activity_bitmap_t) % 64 == 0,
		"Bad metadata bitmap size");
_Static_assert(offsetof(struct _voucher_activity_metadata_s,
		vam_atm_mbox_bitmap) % 64 == 0,
		"Bad metadata padding");
_Static_assert(offsetof(struct _voucher_activity_metadata_s,
		vam_base_atm_subid) % 64 == 0,
		"Bad metadata padding");
_Static_assert(offsetof(struct _voucher_activity_metadata_s, vam_base_atm_lock)
		% 32 == 0,
		"Bad metadata padding");
_Static_assert(offsetof(struct _voucher_activity_metadata_s, vam_atms) % 64 ==0,
		"Bad metadata padding");
_Static_assert(sizeof(_voucher_activity_bitmap_t) * 8 *
		sizeof(atm_mailbox_offset_t) <=
		sizeof(((_voucher_activity_metadata_t)NULL)->vam_kernel_metadata),
		"Bad kernel metadata bitmap");
_Static_assert(sizeof(atm_mailbox_offset_t) == 2 * sizeof(atm_subaid32_t),
		"Bad kernel ATM mailbox sizes");
#endif

static const size_t _voucher_atm_mailboxes =
		sizeof(((_voucher_activity_metadata_t)NULL)->vam_kernel_metadata) /
		sizeof(atm_mailbox_offset_t);

#define va_buffers_lock(va) (&(va)->va_buffers_lock)
#define vatm_activities_lock(vatm) (&(vatm)->vatm_activities_lock)
#define vatm_activities(vatm) (&(vatm)->vatm_activities)
#define vatm_used_activities(vatm) (&(vatm)->vatm_used_activities)
#define vam_base_atm_lock() (&_voucher_activity_heap->vam_base_atm_lock)
#define vam_nested_atm_lock() (&_voucher_activity_heap->vam_nested_atm_lock)
#define vam_atms_lock() (&_voucher_activity_heap->vam_atms_lock)
#define vam_activities_lock() (&_voucher_activity_heap->vam_activities_lock)
#define vam_atms(hash) (&_voucher_activity_heap->vam_atms[hash])
#define vam_activities(hash) (&_voucher_activity_heap->vam_activities[hash])
#define vam_buffer_bitmap() (_voucher_activity_heap->vam_buffer_bitmap)
#define vam_atm_mbox_bitmap() (_voucher_activity_heap->vam_atm_mbox_bitmap)
#define vam_pressure_locked_bitmap() \
		(_voucher_activity_heap->vam_pressure_locked_bitmap)
#define vam_buffer(i) ((void*)((char*)_voucher_activity_heap + \
		(i) * _voucher_activity_buffer_size))

static _voucher_activity_t _voucher_activity_create_with_atm(
		_voucher_atm_t vatm, voucher_activity_id_t va_id,
		voucher_activity_trace_id_t trace_id, uint64_t location,
		_voucher_activity_buffer_header_t buffer);
static _voucher_atm_t _voucher_atm_create(mach_voucher_t kv, atm_aid_t atm_id);
static voucher_activity_id_t _voucher_atm_nested_atm_id_make(void);

DISPATCH_ALWAYS_INLINE
static inline uint32_t
_voucher_default_activity_buffer_limit()
{
	switch (_voucher_activity_mode) {
	case voucher_activity_mode_debug:
	case voucher_activity_mode_stream:
		// High-profile modes: Default activity can use 1/32nd of the heap
		// (twice as much as non-default activities)
		return MAX(_voucher_activity_buffers_per_heap / 32, 3) - 1;
	}
#if TARGET_OS_EMBEDDED
	// Low-profile modes: Default activity can use a total of 3 buffers.
	return 2;
#else
	// Low-profile modes: Default activity can use a total of 8 buffers.
	return 7;
#endif
}

DISPATCH_ALWAYS_INLINE
static inline uint32_t
_voucher_activity_buffer_limit()
{
	switch (_voucher_activity_mode) {
	case voucher_activity_mode_debug:
	case voucher_activity_mode_stream:
		// High-profile modes: 64 activities, each of which can use 1/64th
		// of the entire heap.
		return MAX(_voucher_activity_buffers_per_heap / 64, 2) - 1;
	}
#if TARGET_OS_EMBEDDED
	// Low-profile modes: Each activity can use a total of 2 buffers.
	return 1;
#else
	// Low-profile modes: Each activity can use a total of 4 buffers.
	return 3;
#endif
}

// The two functions above return the number of *additional* buffers activities
// may allocate, hence the gymnastics with - 1.

DISPATCH_ALWAYS_INLINE
static inline uint32_t
_voucher_heap_buffer_limit()
{
	switch (_voucher_activity_mode) {
	case voucher_activity_mode_debug:
	case voucher_activity_mode_stream:
		// High-profile modes: Use it all.
		return _voucher_activity_buffers_per_heap;
	}
#if TARGET_OS_EMBEDDED
	// Low-profile modes: 3 activities, each of which can use 2 buffers;
	// plus the default activity, which can use 3; plus 3 buffers of overhead.
	return 12;
#else
	// Low-profile modes: 13 activities, each of which can use 4 buffers;
	// plus the default activity, which can use 8; plus 3 buffers of overhead.
	return 64;
#endif
}

#define NO_BITS_WERE_UNSET (UINT_MAX)

DISPATCH_ALWAYS_INLINE
static inline size_t
_voucher_activity_bitmap_set_first_unset_bit_upto(
		_voucher_activity_bitmap_t volatile bitmap,
		unsigned int max_index)
{
	dispatch_assert(max_index != 0);
	unsigned int index = NO_BITS_WERE_UNSET, max_map, max_bit, i;
	max_map = max_index / _voucher_activity_bits_per_bitmap_base_t;
	max_map = MIN(max_map, _voucher_activity_bitmaps_per_heap - 1);
	max_bit = max_index % _voucher_activity_bits_per_bitmap_base_t;
	for (i = 0; i < max_map; i++) {
		index = dispatch_atomic_set_first_bit(&bitmap[i], UINT_MAX);
		if (fastpath(index < NO_BITS_WERE_UNSET)) {
			return index + i * _voucher_activity_bits_per_bitmap_base_t;
		}
	}
	index = dispatch_atomic_set_first_bit(&bitmap[i], max_bit);
	if (fastpath(index < NO_BITS_WERE_UNSET)) {
		return index + i * _voucher_activity_bits_per_bitmap_base_t;
	}
	return index;
}

DISPATCH_ALWAYS_INLINE
static inline size_t
_voucher_activity_bitmap_set_first_unset_bit(
		_voucher_activity_bitmap_t volatile bitmap)
{
	return _voucher_activity_bitmap_set_first_unset_bit_upto(bitmap, UINT_MAX);
}


DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_bitmap_clear_bit(
		_voucher_activity_bitmap_t volatile bitmap, size_t index)
{
	size_t i = index / _voucher_activity_bits_per_bitmap_base_t;
	_voucher_activity_bitmap_base_t mask = ((typeof(mask))1) <<
			(index % _voucher_activity_bits_per_bitmap_base_t);
	if (slowpath((bitmap[i] & mask) == 0)) {
		DISPATCH_CRASH("Corruption: failed to clear bit exclusively");
	}
	(void)dispatch_atomic_and(&bitmap[i], ~mask, release);
}

_voucher_activity_metadata_t _voucher_activity_heap;
static dispatch_once_t _voucher_activity_heap_pred;

static void
_voucher_activity_heap_init(void *ctxt DISPATCH_UNUSED)
{
	if (_voucher_activity_disabled()) return;
	kern_return_t kr;
	mach_vm_size_t vm_size = _voucher_activity_buffer_size *
			_voucher_activity_buffers_per_heap;
	mach_vm_address_t vm_addr = vm_page_size;
	while (slowpath(kr = mach_vm_map(mach_task_self(), &vm_addr, vm_size,
			0, VM_FLAGS_ANYWHERE | VM_MAKE_TAG(VM_MEMORY_GENEALOGY),
			MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_ALL,
			VM_INHERIT_NONE))) {
		if (kr != KERN_NO_SPACE) {
			(void)dispatch_assume_zero(kr);
			_voucher_activity_mode = voucher_activity_mode_disable;
			return;
		}
		_dispatch_temporary_resource_shortage();
		vm_addr = vm_page_size;
	}
	_voucher_activity_metadata_t heap;
	task_trace_memory_info_data_t trace_memory_info = {
		.user_memory_address = vm_addr,
		.buffer_size = vm_size,
		.mailbox_array_size = sizeof(heap->vam_kernel_metadata),
	};
	kr = task_set_info(mach_task_self(), TASK_TRACE_MEMORY_INFO,
			(task_info_t)&trace_memory_info, TASK_TRACE_MEMORY_INFO_COUNT);
	DISPATCH_VERIFY_MIG(kr);
	if (kr) {
		if (kr != KERN_NOT_SUPPORTED) (void)dispatch_assume_zero(kr);
		kr = mach_vm_deallocate(mach_task_self(), vm_addr, vm_size);
		(void)dispatch_assume_zero(kr);
		_voucher_activity_mode = voucher_activity_mode_disable;
		return;
	}
	heap = (void*)vm_addr;
	heap->vam_self_metadata.vasm_baseaddr = (void*)vm_addr;
	heap->vam_buffer_bitmap[0] = 0xf; // first four buffers are reserved
	uint32_t i;
	for (i = 0; i < _voucher_activity_hash_size; i++) {
		TAILQ_INIT(&heap->vam_activities[i]);
		TAILQ_INIT(&heap->vam_atms[i]);
	}
	uint32_t subid_max = VATM_SUBID_MAX;
	if (_voucher_atm_subid_bits &&
			_voucher_atm_subid_bits < VATM_SUBID_MAXBITS) {
		subid_max = MIN(VATM_SUBID_BITS2MAX(_voucher_atm_subid_bits),
				VATM_SUBID_MAX);
	}
	heap->vam_base_atm_subid_max = subid_max;
	_voucher_activity_lock_init(&heap->vam_base_atm_lock);
	_voucher_activity_lock_init(&heap->vam_nested_atm_lock);
	_voucher_activity_lock_init(&heap->vam_atms_lock);
	_voucher_activity_lock_init(&heap->vam_activities_lock);
	_voucher_activity_heap = heap;

	_voucher_atm_t vatm = _voucher_atm_create(0, 0);
	dispatch_assert(vatm->vatm_kvoucher);
	heap->vam_default_activity_atm = vatm;
	_voucher_activity_buffer_header_t buffer = vam_buffer(3); // reserved index
	// consumes vatm reference:
	_voucher_activity_t va = _voucher_activity_create_with_atm(vatm,
			VATM_ACTID(vatm, _voucher_default_activity_subid), 0, 0, buffer);
	dispatch_assert(va);
	va->va_buffer_limit = _voucher_default_activity_buffer_limit();
	_voucher_activity_default = va;
	heap->vam_base_atm = _voucher_atm_create(0, 0);
	heap->vam_nested_atm_id = _voucher_atm_nested_atm_id_make();
}

static void
_voucher_activity_atfork_child(void)
{
	_voucher_activity_heap_pred = 0;
	_voucher_activity_heap = NULL; // activity heap is VM_INHERIT_NONE
	_voucher_activity_default = NULL;
}

void*
voucher_activity_get_metadata_buffer(size_t *length)
{
	dispatch_once_f(&_voucher_activity_heap_pred, NULL,
			_voucher_activity_heap_init);
	if (_voucher_activity_disabled()) {
		*length = 0;
		return NULL;
	}
	*length = sizeof(_voucher_activity_heap->vam_client_metadata);
	return _voucher_activity_heap->vam_client_metadata;
}

DISPATCH_ALWAYS_INLINE
static inline _voucher_activity_buffer_header_t
_voucher_activity_heap_buffer_alloc(void)
{
	_voucher_activity_buffer_header_t buffer = NULL;
	size_t index;
	index = _voucher_activity_bitmap_set_first_unset_bit_upto(
			vam_buffer_bitmap(), _voucher_heap_buffer_limit() - 1);
	if (index < NO_BITS_WERE_UNSET) {
		buffer = vam_buffer(index);
	}
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("activity heap alloc %zd (%p)", index, buffer);
#endif
	return buffer;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_heap_buffer_free(_voucher_activity_buffer_header_t buffer)
{
	buffer->vabh_flags = _voucher_activity_trace_flag_buffer_empty;
	size_t index = (size_t)((char*)buffer - (char*)_voucher_activity_heap) /
			_voucher_activity_buffer_size;
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("activity heap free %zd (%p)", index, buffer);
#endif
	_voucher_activity_bitmap_clear_bit(vam_buffer_bitmap(), index);
}

#define _voucher_activity_heap_can_madvise() \
		(PAGE_SIZE == _voucher_activity_buffer_size) // <rdar://17445544>

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_heap_madvise(size_t bitmap_num, unsigned int start,
		unsigned int len)
{
	size_t base = bitmap_num * _voucher_activity_bits_per_bitmap_base_t;
#if DISPATCH_DEBUG
#if DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("activity heap madvise %zd (%p) -> %zd (%p)", base + start,
			vam_buffer(base + start), base + start + len,
			vam_buffer(base + start + len));
#endif
	dispatch_assert(!(len * _voucher_activity_buffer_size % vm_page_size));
	const uint64_t pattern = 0xFACEFACEFACEFACE;
	_voucher_activity_buffer_header_t buffer = vam_buffer(base + start);
	for (unsigned int i = 0; i < len; i++, buffer++) {
		memset_pattern8((char*)buffer + sizeof(buffer->vabh_flags), &pattern,
				_voucher_activity_buffer_size - sizeof(buffer->vabh_flags));
	}
#endif
	(void)dispatch_assume_zero(madvise(vam_buffer(base + start),
			len * _voucher_activity_buffer_size, MADV_FREE));
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_heap_madvise_contiguous(size_t bitmap_num,
		_voucher_activity_bitmap_base_t bits)
{
	// TODO: x86 has fast ctz; arm has fast clz; haswell has fast ctz
	dispatch_assert(_voucher_activity_heap_can_madvise());
	if (bits == 0) {
		return;
	} else if (~bits == 0) {
		_voucher_activity_heap_madvise(bitmap_num, 0,
				_voucher_activity_bits_per_bitmap_base_t);
	} else while (bits != 0) {
		unsigned int start = (typeof(start))__builtin_ctzl(bits), len;
		typeof(bits) inverse = ~bits >> start;
		if (inverse) {
			len = (typeof(len))__builtin_ctzl(inverse);
		} else {
			len = _voucher_activity_bits_per_bitmap_base_t - start;
		}
		typeof(bits) mask = ((((typeof(bits))1) << len) - 1) << start;
		bits &= ~mask;
		_voucher_activity_heap_madvise(bitmap_num, start, len);
	}
}

void
_voucher_activity_heap_pressure_warn(void)
{
	if (!_voucher_activity_heap_can_madvise() || !_voucher_activity_heap) {
		return;
	}
	volatile _voucher_activity_bitmap_base_t *bitmap, *pressure_locked_bitmap;
	bitmap = vam_buffer_bitmap();
	pressure_locked_bitmap = vam_pressure_locked_bitmap();

	// number of bitmaps needed to map the current buffer limit =
	// ceil(buffer limit / bits per bitmap)
	size_t nbuffers = _voucher_heap_buffer_limit();
	size_t nbitmaps_quot = nbuffers / _voucher_activity_bits_per_bitmap_base_t;
	size_t nbitmaps_rem = nbuffers % _voucher_activity_bits_per_bitmap_base_t;
	size_t nbitmaps = nbitmaps_quot + ((nbitmaps_rem == 0) ? 0 : 1);

	for (size_t i = 0; i < nbitmaps; i++) {
		_voucher_activity_bitmap_base_t got_bits;
		got_bits = dispatch_atomic_or_orig(&bitmap[i], ~((typeof(bitmap[i]))0),
				relaxed);
		got_bits = ~got_bits; // Now 1 means 'acquired this one, madvise it'
		_voucher_activity_heap_madvise_contiguous(i, got_bits);
		pressure_locked_bitmap[i] |= got_bits;
	}
}

void
_voucher_activity_heap_pressure_normal(void)
{
	if (!_voucher_activity_heap_can_madvise() || !_voucher_activity_heap) {
		return;
	}
	volatile _voucher_activity_bitmap_base_t *bitmap, *pressure_locked_bitmap;
	bitmap = vam_buffer_bitmap();
	pressure_locked_bitmap = vam_pressure_locked_bitmap();
	for (size_t i = 0; i < _voucher_activity_bitmaps_per_heap; i++) {
		_voucher_activity_bitmap_base_t free_bits = pressure_locked_bitmap[i];
		pressure_locked_bitmap[i] = 0;
		if (free_bits != 0) {
			(void)dispatch_atomic_and(&bitmap[i], ~free_bits, release);
		}
	}
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_buffer_init(_voucher_activity_t act,
		_voucher_activity_buffer_header_t buffer, bool reuse)
{
	if (!reuse) {
		buffer->vabh_flags = _voucher_activity_trace_flag_buffer_header;
		buffer->vabh_activity_id = act->va_id;
	}
	buffer->vabh_timestamp = _voucher_activity_timestamp();
	buffer->vabh_next_tracepoint_idx = 1;
	buffer->vabh_sequence_no = dispatch_atomic_inc2o(act, va_max_sequence_no,
			relaxed);
}

static _voucher_activity_buffer_header_t
_voucher_activity_buffer_alloc_slow(_voucher_activity_t act,
		_voucher_activity_buffer_header_t current)
{
	_voucher_activity_buffer_header_t buffer;
	_voucher_activity_lock_lock(va_buffers_lock(act)); // TODO: revisit locking
	buffer = act->va_current_buffer;
	if (buffer != current) goto out;
	buffer = TAILQ_FIRST(&act->va_buffers);
	if (buffer) {
		_voucher_activity_buffer_init(act, buffer, true);
		if (buffer != TAILQ_LAST(&act->va_buffers,
				_voucher_activity_buffer_list_s)) {
			TAILQ_REMOVE(&act->va_buffers, buffer, vabh_list);
			TAILQ_INSERT_TAIL(&act->va_buffers, buffer, vabh_list);
		}
	}
	if (!dispatch_atomic_cmpxchgv2o(act, va_current_buffer, current, buffer,
			&current, release)) {
		if (buffer) {
			TAILQ_REMOVE(&act->va_buffers, buffer, vabh_list);
			_voucher_activity_heap_buffer_free(buffer);
		}
		buffer = current;
	}
out:
	_voucher_activity_lock_unlock(va_buffers_lock(act));
	_dispatch_voucher_activity_debug("buffer reuse %p", act, buffer);
	return buffer;
}

static _voucher_activity_buffer_header_t
_voucher_activity_buffer_alloc(_voucher_activity_t act,
		_voucher_activity_buffer_header_t current)
{
	_voucher_activity_buffer_header_t buffer = NULL;
	if (act->va_max_sequence_no < act->va_buffer_limit) {
		buffer = _voucher_activity_heap_buffer_alloc();
	}
	if (!buffer) return _voucher_activity_buffer_alloc_slow(act, current);
	_voucher_activity_buffer_init(act, buffer, false);
	if (dispatch_atomic_cmpxchgv2o(act, va_current_buffer, current, buffer,
			&current, release)) {
		_voucher_activity_lock_lock(va_buffers_lock(act));
		TAILQ_INSERT_TAIL(&act->va_buffers, buffer, vabh_list);
		_voucher_activity_lock_unlock(va_buffers_lock(act));
	} else {
		_voucher_activity_heap_buffer_free(buffer);
		buffer = current;
	}
	_dispatch_voucher_activity_debug("buffer alloc %p", act, buffer);
	return buffer;
}

#pragma mark -
#pragma mark _voucher_activity_t

#define _voucher_activity_ordered_insert(_act, head, field) do { \
		typeof(_act) _vai; \
		TAILQ_FOREACH(_vai, (head), field) { \
			if (_act->va_id < _vai->va_id) break; \
		} \
		if (_vai) { \
			TAILQ_INSERT_BEFORE(_vai, _act, field); \
		} else { \
			TAILQ_INSERT_TAIL((head), _act, field); \
		} } while (0);

static void _voucher_activity_dispose(_voucher_activity_t act);
static _voucher_activity_t _voucher_atm_activity_mark_used(
		_voucher_activity_t act);
static void _voucher_atm_activity_mark_unused(_voucher_activity_t act);
static _voucher_atm_t _voucher_atm_copy(atm_aid_t atm_id);
static inline void _voucher_atm_release(_voucher_atm_t vatm);
static void _voucher_atm_activity_insert(_voucher_atm_t vatm,
		_voucher_activity_t act);
static void _voucher_atm_activity_remove(_voucher_activity_t act);
static atm_aid_t _voucher_mach_voucher_get_atm_id(mach_voucher_t kv);

DISPATCH_ALWAYS_INLINE
static inline bool
_voucher_activity_copy(_voucher_activity_t act)
{
	int use_cnt = dispatch_atomic_inc2o(act, va_use_count, relaxed);
	_dispatch_voucher_activity_debug("retain  -> %d", act, use_cnt + 1);
	if (slowpath(use_cnt < 0)) {
		_dispatch_voucher_activity_debug("overrelease", act);
		DISPATCH_CRASH("Activity overrelease");
	}
	return (use_cnt == 0);
}

DISPATCH_ALWAYS_INLINE
static inline _voucher_activity_t
_voucher_activity_retain(_voucher_activity_t act)
{
	if (_voucher_activity_copy(act)) {
		_dispatch_voucher_activity_debug("invalid resurrection", act);
		DISPATCH_CRASH("Invalid activity resurrection");
	}
	return act;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_release(_voucher_activity_t act)
{
	int use_cnt = dispatch_atomic_dec2o(act, va_use_count, relaxed);
	_dispatch_voucher_activity_debug("release -> %d", act, use_cnt + 1);
	if (fastpath(use_cnt >= 0)) {
		return;
	}
	if (slowpath(use_cnt < -1)) {
		_dispatch_voucher_activity_debug("overrelease", act);
		DISPATCH_CRASH("Activity overrelease");
	}
	return _voucher_atm_activity_mark_unused(act);
}

DISPATCH_ALWAYS_INLINE
static inline _voucher_activity_t
_voucher_activity_atm_retain(_voucher_activity_t act)
{
	int refcnt = dispatch_atomic_inc2o(act, va_refcnt, relaxed);
	_dispatch_voucher_activity_debug("atm retain  -> %d", act, refcnt + 1);
	if (slowpath(refcnt <= 0)) {
		_dispatch_voucher_activity_debug("atm resurrection", act);
		DISPATCH_CRASH("Activity ATM resurrection");
	}
	return act;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_activity_atm_release(_voucher_activity_t act)
{
	int refcnt = dispatch_atomic_dec2o(act, va_refcnt, relaxed);
	_dispatch_voucher_activity_debug("atm release -> %d", act, refcnt + 1);
	if (fastpath(refcnt >= 0)) {
		return;
	}
	if (slowpath(refcnt < -1)) {
		_dispatch_voucher_activity_debug("atm overrelease", act);
		DISPATCH_CRASH("Activity ATM overrelease");
	}
	return _voucher_activity_dispose(act);
}

static inline _voucher_activity_t
_voucher_activity_get(voucher_t v)
{
	_voucher_activity_t act;
	act = v && v->v_activity ? v->v_activity : _voucher_activity_default;
	return act;
}

static _voucher_activity_t
_voucher_activity_find(voucher_activity_id_t va_id, uint32_t hash)
{
	// assumes vam_activities_lock held
	_voucher_activity_t act;
	TAILQ_FOREACH(act, vam_activities(hash), va_list){
		if (act->va_id == va_id) break;
	}
	return act;
}

static _voucher_activity_t
_voucher_activity_copy_from_id(voucher_activity_id_t va_id)
{
	bool resurrect = false;
	uint32_t hash = VACTID_HASH(va_id);
	_voucher_activity_lock_lock(vam_activities_lock());
	_voucher_activity_t act = _voucher_activity_find(va_id, hash);
	if (act) {
		resurrect = _voucher_activity_copy(act);
		_dispatch_voucher_activity_debug("copy from id 0x%llx", act, va_id);
	}
	_voucher_activity_lock_unlock(vam_activities_lock());
	if (resurrect) return _voucher_atm_activity_mark_used(act);
	return act;
}

static _voucher_activity_t
_voucher_activity_try_insert(_voucher_activity_t act_new)
{
	bool resurrect = false;
	voucher_activity_id_t va_id = act_new->va_id;
	uint32_t hash = VACTID_HASH(va_id);
	_voucher_activity_lock_lock(vam_activities_lock());
	_voucher_activity_t act = _voucher_activity_find(va_id, hash);
	if (act) {
		resurrect = _voucher_activity_copy(act);
		_dispatch_voucher_activity_debug("try insert: failed (%p)", act,act_new);
	} else {
		if (slowpath(_TAILQ_IS_ENQUEUED(act_new, va_list))) {
			_dispatch_voucher_activity_debug("corruption", act_new);
			DISPATCH_CRASH("Activity corruption");
		}
		TAILQ_INSERT_TAIL(vam_activities(hash), act_new, va_list);
		_dispatch_voucher_activity_debug("try insert: succeeded", act_new);
	}
	_voucher_activity_lock_unlock(vam_activities_lock());
	if (resurrect) return _voucher_atm_activity_mark_used(act);
	return act;
}

static bool
_voucher_activity_try_remove(_voucher_activity_t act)
{
	bool r;
	voucher_activity_id_t va_id = act->va_id;
	uint32_t hash = VACTID_HASH(va_id);
	_voucher_activity_lock_lock(vam_activities_lock());
	if (slowpath(!va_id)) {
		_dispatch_voucher_activity_debug("corruption", act);
		DISPATCH_CRASH("Activity corruption");
	}
	if ((r = (dispatch_atomic_load2o(act, va_use_count, seq_cst) < 0 &&
			_TAILQ_IS_ENQUEUED(act, va_list)))) {
		TAILQ_REMOVE(vam_activities(hash), act, va_list);
		_TAILQ_MARK_NOT_ENQUEUED(act, va_list);
		act->va_list.tqe_next = (void*)~0ull;
	}
	_dispatch_voucher_activity_debug("try remove: %s", act, r ? "succeeded" :
			"failed");
	_voucher_activity_lock_unlock(vam_activities_lock());
	return r;
}

static _voucher_activity_t
_voucher_activity_create_with_atm(_voucher_atm_t vatm,
		voucher_activity_id_t va_id, voucher_activity_trace_id_t trace_id,
		uint64_t location, _voucher_activity_buffer_header_t buffer)
{
	if (!buffer) buffer = _voucher_activity_heap_buffer_alloc();
	if (!buffer) {
		_dispatch_voucher_atm_debug("no buffer", vatm);
		_voucher_atm_release(vatm); // consume vatm reference
		return NULL;
	}
	if (!trace_id) trace_id = _voucher_activity_trace_id_release;
	_voucher_activity_tracepoint_t vat = (_voucher_activity_tracepoint_t)buffer;
	_voucher_activity_tracepoint_init_with_id(vat, trace_id, ~1ull);
	_voucher_activity_t act = (_voucher_activity_t)buffer;
	act->va_flags = _voucher_activity_trace_flag_buffer_header |
			_voucher_activity_trace_flag_activity |
			_voucher_activity_trace_flag_start |
			_voucher_activity_trace_flag_wide_first;
	act->vabh_next_tracepoint_idx = sizeof(*act)/sizeof(*vat);
	act->va_max_sequence_no = 0;
	act->va_id = va_id ? va_id : VATM_ACTID(vatm, 0);
	act->va_use_count = 0;
	act->va_buffer_limit = _voucher_activity_buffer_limit();
	TAILQ_INIT(&act->va_buffers);
	act->va_flags2 = _voucher_activity_trace_flag_activity |
			_voucher_activity_trace_flag_wide_second;
#if __LP64__
	act->va_flags3 = act->va_flags2;
#endif
	act->va_refcnt = 0;
	act->va_location = location;
	act->va_current_buffer = buffer;
	act->va_atm = vatm; // transfer vatm reference
	_voucher_activity_lock_init(va_buffers_lock(act));
	_TAILQ_MARK_NOT_ENQUEUED(act, va_list);
	_TAILQ_MARK_NOT_ENQUEUED(act, va_atm_list);
	_TAILQ_MARK_NOT_ENQUEUED(act, va_atm_used_list);
	_voucher_activity_t actx = _voucher_activity_try_insert(act);
	if (actx) {
		_voucher_activity_dispose(act);
		act = actx;
	} else {
		_voucher_atm_activity_insert(vatm, act);
	}
	_dispatch_voucher_activity_debug("create", act);
	return act;
}

static void
_voucher_activity_dispose(_voucher_activity_t act)
{
	_dispatch_voucher_activity_debug("dispose", act);
	_voucher_atm_release(act->va_atm);
	if (slowpath(_TAILQ_IS_ENQUEUED(act, va_list))) {
		_dispatch_voucher_activity_debug("corruption", act);
		DISPATCH_CRASH("Activity corruption");
	}
	act->va_list.tqe_next = DISPATCH_OBJECT_LISTLESS;
	dispatch_assert(!_TAILQ_IS_ENQUEUED(act, va_atm_list));
	dispatch_assert(!_TAILQ_IS_ENQUEUED(act, va_atm_used_list));
	_voucher_activity_buffer_header_t buffer, tmp;
	TAILQ_FOREACH_SAFE(buffer, &act->va_buffers, vabh_list, tmp) {
		_dispatch_voucher_activity_debug("buffer free %p", act, buffer);
		TAILQ_REMOVE(&act->va_buffers, buffer, vabh_list);
		_voucher_activity_heap_buffer_free(buffer);
	}
	buffer = (_voucher_activity_buffer_header_t)act;
	_voucher_activity_heap_buffer_free(buffer);
}

static void
_voucher_activity_collect(_voucher_activity_t act)
{
	_dispatch_voucher_activity_debug("collect", act);
	if (_voucher_activity_try_remove(act)) {
		_voucher_atm_activity_remove(act);
	}
}

static _voucher_activity_t
_voucher_activity_copy_from_mach_voucher(mach_voucher_t kv,
		voucher_activity_id_t va_id)
{
	dispatch_once_f(&_voucher_activity_heap_pred, NULL,
			_voucher_activity_heap_init);
	if (_voucher_activity_disabled()) return NULL;
	_voucher_activity_t act = NULL;
	if (dispatch_assume(va_id)) {
		if ((act = _voucher_activity_copy_from_id(va_id))) return act;
	}
	atm_aid_t atm_id = _voucher_mach_voucher_get_atm_id(kv);
	if (!dispatch_assume(atm_id)) return NULL;
	_voucher_activity_buffer_header_t buffer;
	buffer = _voucher_activity_heap_buffer_alloc();
	if (!buffer) return NULL;
	_dispatch_kvoucher_debug("atm copy/create from <%lld>", kv, atm_id);
	_voucher_atm_t vatm = _voucher_atm_copy(atm_id);
	if (!vatm) vatm = _voucher_atm_create(kv, atm_id);
	if (!vatm) {
		_voucher_activity_heap_buffer_free(buffer);
		return NULL;
	}
	if (VACTID_BASEID(va_id) != VATMID2ACTID(atm_id)) va_id = 0;
	// consumes vatm reference:
	act = _voucher_activity_create_with_atm(vatm, va_id, 0, 0, buffer);
	_dispatch_voucher_activity_debug("copy from kvoucher[0x%08x]", act, kv);
	return act;
}

#pragma mark -
#pragma mark _voucher_atm_mailbox

DISPATCH_ALWAYS_INLINE
static inline atm_mailbox_offset_t
_voucher_atm_mailbox_alloc(void)
{
	atm_mailbox_offset_t mailbox_offset = MAILBOX_OFFSET_UNSET;
	size_t index;
	index = _voucher_activity_bitmap_set_first_unset_bit(vam_atm_mbox_bitmap());
	if (index < NO_BITS_WERE_UNSET) {
		mailbox_offset = index * sizeof(atm_mailbox_offset_t);
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
		_dispatch_debug("mailbox alloc %zd (%lld)", index, mailbox_offset);
#endif
	}
	return mailbox_offset;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_atm_mailbox_free(atm_mailbox_offset_t mailbox_offset)
{
	if (mailbox_offset == MAILBOX_OFFSET_UNSET) return;
	size_t index = (size_t)mailbox_offset / sizeof(atm_mailbox_offset_t);
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("mailbox free %zd (%lld)", index, mailbox_offset);
#endif
	_voucher_activity_bitmap_clear_bit(vam_atm_mbox_bitmap(), index);
}

DISPATCH_ALWAYS_INLINE
static inline bool
_voucher_atm_mailbox_set(atm_mailbox_offset_t mailbox_offset,
		atm_subaid32_t subaid, bool max_present)
{
	if (mailbox_offset == MAILBOX_OFFSET_UNSET) return false;
	char *mailbox_base = (char*)_voucher_activity_heap->vam_kernel_metadata;
	atm_subaid32_t *mailbox = (atm_subaid32_t*)(mailbox_base + mailbox_offset);
	if (max_present) mailbox++; // second atm_subaid32_t in atm_mailbox_offset_t
	if (*mailbox == subaid) return false;
	*mailbox = subaid;
	return true;
}

#pragma mark -
#pragma mark _voucher_atm_t

static bool _voucher_atm_try_remove(_voucher_atm_t vatm);
static void _voucher_atm_dispose(_voucher_atm_t vatm, bool unregister);
static inline void _voucher_atm_collect_if_needed(bool updated);

DISPATCH_ALWAYS_INLINE
static inline _voucher_atm_t
_voucher_atm_retain(_voucher_atm_t vatm)
{
	// assumes vam_atms_lock or vam_base_atm_lock held
	int refcnt = dispatch_atomic_inc2o(vatm, vatm_refcnt, relaxed);
	_dispatch_voucher_atm_debug("retain  -> %d", vatm, refcnt + 1);
	if (slowpath(refcnt < 0)) {
		_dispatch_voucher_atm_debug("overrelease", vatm);
		DISPATCH_CRASH("ATM overrelease");
	}
	return vatm;
}

DISPATCH_ALWAYS_INLINE
static inline void
_voucher_atm_release(_voucher_atm_t vatm)
{
	int refcnt = dispatch_atomic_dec2o(vatm, vatm_refcnt, relaxed);
	_dispatch_voucher_atm_debug("release -> %d", vatm, refcnt + 1);
	if (fastpath(refcnt >= 0)) {
		return;
	}
	if (slowpath(refcnt < -1)) {
		_dispatch_voucher_atm_debug("overrelease", vatm);
		DISPATCH_CRASH("ATM overrelease");
	}
	if (_voucher_atm_try_remove(vatm)) {
		_voucher_atm_dispose(vatm, true);
	}
}

static _voucher_atm_t
_voucher_atm_find(atm_aid_t atm_id, uint32_t hash)
{
	// assumes vam_atms_lock held
	_voucher_atm_t vatm;
	TAILQ_FOREACH(vatm, vam_atms(hash), vatm_list){
		if (vatm->vatm_id == atm_id) break;
	}
	return vatm;
}

static _voucher_atm_t
_voucher_atm_copy(atm_aid_t atm_id)
{
	uint32_t hash = VATMID_HASH(atm_id);
	_voucher_activity_lock_lock(vam_atms_lock());
	_voucher_atm_t vatm = _voucher_atm_find(atm_id, hash);
	if (vatm) {
		_voucher_atm_retain(vatm);
		_dispatch_voucher_atm_debug("copy", vatm);
	}
	_voucher_activity_lock_unlock(vam_atms_lock());
	return vatm;
}

static _voucher_atm_t
_voucher_atm_try_insert(_voucher_atm_t vatm_new)
{
	atm_aid_t atm_id = vatm_new->vatm_id;
	uint32_t hash = VATMID_HASH(atm_id);
	_voucher_activity_lock_lock(vam_atms_lock());
	_voucher_atm_t vatm = _voucher_atm_find(atm_id, hash);
	if (vatm) {
		_voucher_atm_retain(vatm);
		_dispatch_voucher_atm_debug("try insert: failed (%p)", vatm, vatm_new);
	} else {
		if (slowpath(_TAILQ_IS_ENQUEUED(vatm_new, vatm_list))) {
			_dispatch_voucher_atm_debug("corruption", vatm_new);
			DISPATCH_CRASH("ATM corruption");
		}
		TAILQ_INSERT_TAIL(vam_atms(hash), vatm_new, vatm_list);
		_dispatch_voucher_atm_debug("try insert: succeeded", vatm_new);
	}
	_voucher_activity_lock_unlock(vam_atms_lock());
	return vatm;
}

static bool
_voucher_atm_try_remove(_voucher_atm_t vatm)
{
	bool r;
	atm_aid_t atm_id = vatm->vatm_id;
	uint32_t hash = VATMID_HASH(atm_id);
	_voucher_activity_lock_lock(vam_atms_lock());
	if (slowpath(!atm_id)) {
		_dispatch_voucher_atm_debug("corruption", vatm);
		DISPATCH_CRASH("ATM corruption");
	}
	if ((r = (dispatch_atomic_load2o(vatm, vatm_refcnt, seq_cst) < 0 &&
			_TAILQ_IS_ENQUEUED(vatm, vatm_list)))) {
		TAILQ_REMOVE(vam_atms(hash), vatm, vatm_list);
		_TAILQ_MARK_NOT_ENQUEUED(vatm, vatm_list);
		vatm->vatm_list.tqe_next = (void*)~0ull;
	}
	_dispatch_voucher_atm_debug("try remove: %s", vatm, r ? "succeeded" :
			"failed");
	_voucher_activity_lock_unlock(vam_atms_lock());
	return r;
}

static bool
_voucher_atm_update_mailbox(_voucher_atm_t vatm)
{
	// Update kernel mailbox with largest allocated subaid for this atm_id
	// assumes atm_activities_lock held
	_voucher_activity_t act = TAILQ_LAST(vatm_activities(vatm),
			_voucher_atm_activities_s);
	atm_subaid32_t subaid = act ? VACTID_SUBID(act->va_id) : 0;
	bool r = _voucher_atm_mailbox_set(vatm->vatm_mailbox_offset, subaid, true);
	if (r) {
		_dispatch_voucher_atm_debug("update max-present subaid 0x%x", vatm,
				subaid);
	}
	return r;
}

static bool
_voucher_atm_update_used_mailbox(_voucher_atm_t vatm)
{
	// Update kernel mailbox with smallest in-use subaid for this atm_id
	// assumes atm_activities_lock held
	_voucher_activity_t act = TAILQ_FIRST(vatm_used_activities(vatm));
	atm_subaid32_t subaid = act ? VACTID_SUBID(act->va_id) : ATM_SUBAID32_MAX;
	bool r = _voucher_atm_mailbox_set(vatm->vatm_mailbox_offset, subaid, false);
	if (r) {
		_dispatch_voucher_atm_debug("update min-used subaid 0x%x", vatm,
				subaid);
	}
	return r;
}

static void
_voucher_atm_activity_insert(_voucher_atm_t vatm, _voucher_activity_t act)
{
	_voucher_activity_lock_lock(vatm_activities_lock(vatm));
	if (!_TAILQ_IS_ENQUEUED(act, va_atm_list)) {
		_voucher_activity_ordered_insert(act, vatm_activities(vatm),
				va_atm_list);
		_voucher_atm_update_mailbox(vatm);
	}
	if (!_TAILQ_IS_ENQUEUED(act, va_atm_used_list)) {
		_voucher_activity_ordered_insert(act, vatm_used_activities(vatm),
				va_atm_used_list);
		_voucher_atm_update_used_mailbox(vatm);
	}
	_dispatch_voucher_activity_debug("atm insert", act);
	_voucher_activity_lock_unlock(vatm_activities_lock(vatm));
}

static void
_voucher_atm_activity_remove(_voucher_activity_t act)
{
	_voucher_atm_t vatm = act->va_atm;
	_voucher_activity_lock_lock(vatm_activities_lock(vatm));
	_dispatch_voucher_activity_debug("atm remove", act);
	if (_TAILQ_IS_ENQUEUED(act, va_atm_used_list)) {
		TAILQ_REMOVE(vatm_activities(vatm), act, va_atm_used_list);
		_TAILQ_MARK_NOT_ENQUEUED(act, va_atm_used_list);
		_voucher_atm_update_used_mailbox(vatm);
	}
	if (_TAILQ_IS_ENQUEUED(act, va_atm_list)) {
		TAILQ_REMOVE(vatm_activities(vatm), act, va_atm_list);
		_TAILQ_MARK_NOT_ENQUEUED(act, va_atm_list);
		_voucher_atm_update_mailbox(vatm);
		// Balance initial creation refcnt. Caller must hold additional
		// reference to ensure this does not release vatm before the unlock,
		// see _voucher_atm_activity_collect
		_voucher_activity_atm_release(act);
	}
	_voucher_activity_lock_unlock(vatm_activities_lock(vatm));
}

static _voucher_activity_t
_voucher_atm_activity_mark_used(_voucher_activity_t act)
{
	_voucher_atm_t vatm = act->va_atm;
	_voucher_activity_lock_lock(vatm_activities_lock(vatm));
	if (!_TAILQ_IS_ENQUEUED(act, va_atm_used_list)) {
		_voucher_activity_ordered_insert(act, vatm_used_activities(vatm),
				va_atm_used_list);
		_voucher_atm_update_used_mailbox(vatm);
		_dispatch_voucher_activity_debug("mark used", act);
	}
	_voucher_activity_lock_unlock(vatm_activities_lock(vatm));
	return act;
}

static void
_voucher_atm_activity_mark_unused(_voucher_activity_t act)
{
	bool atm_collect = false, updated = false;
	_voucher_atm_t vatm = act->va_atm;
	_voucher_activity_lock_lock(vatm_activities_lock(vatm));
	if (_TAILQ_IS_ENQUEUED(act, va_atm_used_list)) {
		_dispatch_voucher_activity_debug("mark unused", act);
		TAILQ_REMOVE(&vatm->vatm_used_activities, act, va_atm_used_list);
		_TAILQ_MARK_NOT_ENQUEUED(act, va_atm_used_list);
		atm_collect = true;
		_voucher_atm_retain(vatm);
		updated = _voucher_atm_update_used_mailbox(vatm);
	}
	_voucher_activity_lock_unlock(vatm_activities_lock(vatm));
	if (atm_collect) {
		_voucher_atm_release(vatm);
		_voucher_atm_collect_if_needed(updated);
	}
}

static void
_voucher_atm_activity_collect(_voucher_atm_t vatm, atm_subaid32_t min_subaid)
{
	_dispatch_voucher_atm_debug("collect min subaid 0x%x", vatm, min_subaid);
	voucher_activity_id_t min_va_id = VATM_ACTID(vatm, min_subaid);
	_voucher_activity_t act;
	do {
		_voucher_activity_lock_lock(vatm_activities_lock(vatm));
		TAILQ_FOREACH(act, vatm_activities(vatm), va_atm_list) {
			if (act->va_id >= min_va_id) {
				act = NULL;
				break;
			}
			if (!_TAILQ_IS_ENQUEUED(act, va_atm_used_list)) {
				_voucher_activity_atm_retain(act);
				break;
			}
		}
		_voucher_activity_lock_unlock(vatm_activities_lock(vatm));
		if (act) {
			_voucher_activity_collect(act);
			_voucher_activity_atm_release(act);
		}
	} while (act);
}

DISPATCH_NOINLINE
static void
_voucher_atm_collect(void)
{
	_voucher_atm_t vatms[_voucher_atm_mailboxes], vatm;
	atm_aid_t aids[_voucher_atm_mailboxes];
	mach_atm_subaid_t subaids[_voucher_atm_mailboxes];
	uint32_t i, a = 0, s;

	_voucher_activity_lock_lock(vam_atms_lock());
	for (i = 0; i < _voucher_activity_hash_size; i++) {
		TAILQ_FOREACH(vatm, vam_atms(i), vatm_list){
			if (vatm == _voucher_activity_heap->vam_default_activity_atm ||
					vatm->vatm_mailbox_offset == MAILBOX_OFFSET_UNSET) continue;
			_dispatch_voucher_atm_debug("find min subaid", vatm);
			vatms[a] = _voucher_atm_retain(vatm);
			aids[a] = vatm->vatm_id;
			if (++a == _voucher_atm_mailboxes) goto out;
		}
	}
out:
	_voucher_activity_lock_unlock(vam_atms_lock());
	if (!a) return;
	kern_return_t kr;
	mach_voucher_t kv = vatms[0]->vatm_kvoucher;
	mach_voucher_attr_content_t kvc_in = (mach_voucher_attr_content_t)&aids;
	mach_voucher_attr_content_size_t kvc_in_size = sizeof(atm_aid_t) * a;
	mach_voucher_attr_content_t kvc_out = (mach_voucher_attr_content_t)&subaids;
	mach_voucher_attr_content_size_t kvc_out_size = sizeof(mach_atm_subaid_t)*a;
	kr = mach_voucher_attr_command(kv, MACH_VOUCHER_ATTR_KEY_ATM,
			ATM_FIND_MIN_SUB_AID, kvc_in, kvc_in_size, kvc_out, &kvc_out_size);
	DISPATCH_VERIFY_MIG(kr);
	(void)dispatch_assume_zero(kr);
	s = kvc_out_size / sizeof(mach_atm_subaid_t);
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("found min subaids (%u out of %u)", s, a);
#endif
	for (i = 0; i < a; i++) {
		if (i < s) _voucher_atm_activity_collect(vatms[i],
				(atm_subaid32_t)subaids[i]);
		_voucher_atm_release(vatms[i]);
	}
}

static inline void
_voucher_atm_collect_if_needed(bool updated)
{
	long level;
	if (updated) {
		level = dispatch_atomic_add(&_voucher_atm_collect_level, 2ul, relaxed);
	} else {
		level = _voucher_atm_collect_level;
		if (!level) return;
	}
	if (level & 1 || level <= _voucher_atm_collect_threshold) return;
	if (!dispatch_atomic_cmpxchg(&_voucher_atm_collect_level, level, level + 1,
			acquire)) return;
#if DISPATCH_DEBUG && DISPATCH_VOUCHER_ACTIVITY_DEBUG
	_dispatch_debug("atm collect: reached level %ld", level/2);
#endif
	if (slowpath(level < 0)) {
		DISPATCH_CRASH("ATM collection level corruption");
	}
	_voucher_atm_collect();
	dispatch_atomic_sub(&_voucher_atm_collect_level, level + 1, release);
}

DISPATCH_NOINLINE
static void
_voucher_atm_fault(mach_voucher_attr_command_t kvc_cmd)
{
	_voucher_activity_t act = _voucher_activity_get(_voucher_get());
	mach_voucher_t kv = _voucher_activity_get_atm_mach_voucher(act);
	if (!kv) return;

	kern_return_t kr;
	mach_atm_subaid_t subaid = VACTID_SUBID(act->va_id);
	mach_voucher_attr_content_t kvc_in = (mach_voucher_attr_content_t)&subaid;
	mach_voucher_attr_content_size_t kvc_in_size = sizeof(mach_atm_subaid_t);
	mach_voucher_attr_content_t kvc_out = (mach_voucher_attr_content_t)&subaid;
	mach_voucher_attr_content_size_t kvc_out_size = sizeof(mach_atm_subaid_t);
	kr = mach_voucher_attr_command(kv, MACH_VOUCHER_ATTR_KEY_ATM,
			kvc_cmd, kvc_in, kvc_in_size, kvc_out, &kvc_out_size);
	DISPATCH_VERIFY_MIG(kr);
	(void)dispatch_assume_zero(kr);
}

static atm_aid_t
_voucher_mach_voucher_get_atm_id(mach_voucher_t kv)
{
	kern_return_t kr;
	atm_aid_t atm_id = 0;
	mach_voucher_attr_content_t kvc = (mach_voucher_attr_content_t)&atm_id;
    mach_voucher_attr_content_size_t kvc_size = sizeof(atm_id);
	kr = mach_voucher_extract_attr_content(kv, MACH_VOUCHER_ATTR_KEY_ATM, kvc,
			&kvc_size);
	DISPATCH_VERIFY_MIG(kr);
	(void)dispatch_assume_zero(kr);
    return atm_id;
}

static mach_voucher_t
_voucher_atm_mach_voucher_create(atm_aid_t *atm_id_ptr)
{
	kern_return_t kr;
	mach_voucher_t kv;
	static const mach_voucher_attr_recipe_data_t atm_create_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_ATM,
		.command = MACH_VOUCHER_ATTR_ATM_CREATE,
	};
	kr = _voucher_create_mach_voucher(&atm_create_recipe,
			sizeof(atm_create_recipe), &kv);
	if (dispatch_assume_zero(kr)) {
		DISPATCH_CLIENT_CRASH("Could not create ATM mach voucher");
	}
	atm_aid_t atm_id = _voucher_mach_voucher_get_atm_id(kv);
	if (!dispatch_assume(atm_id)) {
		DISPATCH_CLIENT_CRASH("Could not extract ATM ID");
	}
	_dispatch_kvoucher_debug("atm create <%lld>", kv, atm_id);
	*atm_id_ptr = atm_id;
	return kv;
}

static void
_voucher_atm_mailbox_mach_voucher_register(_voucher_atm_t vatm,
		mach_voucher_t kv)
{
	_dispatch_voucher_atm_debug("mailbox register %lld with kvoucher[0x%08x]",
			vatm, vatm->vatm_mailbox_offset, kv);
	kern_return_t kr;
	mach_voucher_t akv;
	atm_mailbox_offset_t offset = vatm->vatm_mailbox_offset;
	mach_voucher_attr_recipe_t vr;
	size_t vr_size;
	static const mach_voucher_attr_recipe_data_t atm_register_recipe = {
		.key = MACH_VOUCHER_ATTR_KEY_ATM,
		.command = MACH_VOUCHER_ATTR_ATM_REGISTER,
		.content_size = sizeof(offset),
	};
	vr_size = sizeof(atm_register_recipe) + atm_register_recipe.content_size;
	vr = alloca(vr_size);
	*vr = atm_register_recipe;
	vr->previous_voucher = kv;
	memcpy(&vr->content, &offset, sizeof(offset));
	kr = _voucher_create_mach_voucher(vr, vr_size, &akv);
	if (dispatch_assume_zero(kr)) {
		DISPATCH_CLIENT_CRASH("Could not register ATM ID");
	}
	if (!vatm->vatm_kvoucher) {
		vatm->vatm_kvoucher = akv;
	} else {
#if !RDAR_17510224
		if (akv != vatm->vatm_kvoucher) {
			DISPATCH_CRASH("Unexpected mach voucher returned by ATM ID "
					"registration");
		}
		_voucher_dealloc_mach_voucher(akv);
#else
		DISPATCH_CRASH("Registered invalid ATM object");
#endif
	}
	_dispatch_voucher_atm_debug("mailbox registered %lld", vatm,
			vatm->vatm_mailbox_offset);
}

static void
_voucher_atm_mailbox_register(_voucher_atm_t vatm)
{
	mach_voucher_t kv = vatm->vatm_kvoucher;
	if (!kv) return;
#if !RDAR_17510224
	_voucher_atm_mailbox_mach_voucher_register(vatm, kv);
#else // RDAR_17510224
	_dispatch_voucher_atm_debug("mailbox register %lld", vatm,
			vatm->vatm_mailbox_offset);
	kern_return_t kr;
	atm_mailbox_offset_t offset = vatm->vatm_mailbox_offset;
	mach_voucher_attr_content_t kvc_in = (mach_voucher_attr_content_t)&offset;
	mach_voucher_attr_content_size_t kvc_in_size = sizeof(offset);
	mach_voucher_attr_content_t kvc_out = NULL;
	mach_voucher_attr_content_size_t kvc_out_size = 0;
	kr = mach_voucher_attr_command(kv, MACH_VOUCHER_ATTR_KEY_ATM,
			ATM_ACTION_REGISTER, kvc_in, kvc_in_size, kvc_out,
			&kvc_out_size);
	DISPATCH_VERIFY_MIG(kr);
	if (dispatch_assume_zero(kr)) {
		DISPATCH_CLIENT_CRASH("Could not register ATM ID");
	}
	_dispatch_voucher_atm_debug("mailbox registered %lld", vatm,
			vatm->vatm_mailbox_offset);
#endif // RDAR_17510224
}

static bool
_voucher_atm_mailbox_unregister(_voucher_atm_t vatm)
{
	if (vatm->vatm_mailbox_offset == MAILBOX_OFFSET_UNSET) return false;
	_dispatch_voucher_atm_debug("mailbox unregister %lld", vatm,
			vatm->vatm_mailbox_offset);
	mach_voucher_t kv = vatm->vatm_kvoucher;
	dispatch_assert(kv);
	kern_return_t kr;
	atm_mailbox_offset_t offset = vatm->vatm_mailbox_offset;
	mach_voucher_attr_content_t kvc_in = (mach_voucher_attr_content_t)&offset;
	mach_voucher_attr_content_size_t kvc_in_size = sizeof(offset);
	mach_voucher_attr_content_t kvc_out = NULL;
	mach_voucher_attr_content_size_t kvc_out_size = 0;
	kr = mach_voucher_attr_command(kv, MACH_VOUCHER_ATTR_KEY_ATM,
			ATM_ACTION_UNREGISTER, kvc_in, kvc_in_size, kvc_out, &kvc_out_size);
	DISPATCH_VERIFY_MIG(kr);
	if (kr && kr != KERN_INVALID_VALUE) {
		(void)dispatch_assume_zero(kr);
		DISPATCH_CLIENT_CRASH("Could not unregister ATM ID");
	}
	_dispatch_voucher_atm_debug("mailbox unregistered %lld", vatm,
			vatm->vatm_mailbox_offset);
	return true;
}

static _voucher_atm_t
_voucher_atm_create(mach_voucher_t kv, atm_aid_t atm_id)
{
	atm_mailbox_offset_t mailbox_offset = _voucher_atm_mailbox_alloc();
	if (kv && mailbox_offset == MAILBOX_OFFSET_UNSET) return NULL;
	_voucher_atm_t vatm = _dispatch_calloc(1ul, sizeof(struct _voucher_atm_s));
	if (!kv) {
		kv = _voucher_atm_mach_voucher_create(&atm_id);
		if (mailbox_offset == MAILBOX_OFFSET_UNSET) {
			_voucher_dealloc_mach_voucher(kv);
		} else {
			vatm->vatm_kvoucher = kv;
		}
		kv = MACH_VOUCHER_NULL;
	}
	vatm->vatm_id = atm_id;
	vatm->vatm_mailbox_offset = mailbox_offset;
	_voucher_activity_lock_init(vatm_activities_lock(vatm));
	TAILQ_INIT(&vatm->vatm_activities);
	TAILQ_INIT(&vatm->vatm_used_activities);
	_voucher_atm_mailbox_set(mailbox_offset, 0, true);
	_voucher_atm_mailbox_set(mailbox_offset, ATM_SUBAID32_MAX, false);
	_voucher_atm_t vatmx = _voucher_atm_try_insert(vatm);
	if (vatmx) {
		_voucher_atm_dispose(vatm, false);
		vatm = vatmx;
	} else if (kv) {
		_voucher_atm_mailbox_mach_voucher_register(vatm, kv);
	} else {
		_voucher_atm_mailbox_register(vatm);
	}
	_dispatch_voucher_atm_debug("create with kvoucher[0x%08x]", vatm, kv);
	return vatm;
}

static void
_voucher_atm_dispose(_voucher_atm_t vatm, bool unregister)
{
	_dispatch_voucher_atm_debug("dispose", vatm);
	dispatch_assert(TAILQ_EMPTY(&vatm->vatm_activities));
	dispatch_assert(TAILQ_EMPTY(&vatm->vatm_used_activities));
	if (slowpath(_TAILQ_IS_ENQUEUED(vatm, vatm_list))) {
		_dispatch_voucher_atm_debug("corruption", vatm);
		DISPATCH_CRASH("ATM corruption");
	}
	vatm->vatm_list.tqe_next = DISPATCH_OBJECT_LISTLESS;
	bool free_mailbox = (vatm->vatm_mailbox_offset != MAILBOX_OFFSET_UNSET);
	if (vatm->vatm_kvoucher) {
		if (unregister) free_mailbox = _voucher_atm_mailbox_unregister(vatm);
		_voucher_dealloc_mach_voucher(vatm->vatm_kvoucher);
		vatm->vatm_kvoucher = MACH_VOUCHER_NULL;
	}
	if (free_mailbox) {
		_voucher_atm_mailbox_free(vatm->vatm_mailbox_offset);
		vatm->vatm_mailbox_offset = MAILBOX_OFFSET_UNSET;
	}
	free(vatm);
}

static inline mach_voucher_t
_voucher_activity_get_atm_mach_voucher(_voucher_activity_t act)
{
	mach_voucher_t kv;
	kv = act && act->va_atm ? act->va_atm->vatm_kvoucher : MACH_VOUCHER_NULL;
	return kv;
}

DISPATCH_NOINLINE
static _voucher_atm_t
_voucher_atm_base_copy_and_activity_id_make(voucher_activity_id_t *va_id_ptr)
{
	_voucher_atm_subid_t subid;
	_voucher_atm_t vatm, vatm_old = NULL, vatm_new = NULL;
	if (_voucher_activity_heap->vam_base_atm_subid_max == 1) {
		vatm = _voucher_atm_create(0, 0);
		subid = 1;
		goto out;
	}
	_voucher_activity_lock_lock(vam_base_atm_lock());
	vatm = _voucher_activity_heap->vam_base_atm;
retry:
	_voucher_atm_retain(vatm);
	subid = _voucher_activity_heap->vam_base_atm_subid;
	if (subid++ >= _voucher_activity_heap->vam_base_atm_subid_max) {
		_voucher_activity_lock_unlock(vam_base_atm_lock());
		if (!vatm_new) vatm_new = _voucher_atm_create(0, 0);
		_voucher_activity_lock_lock(vam_base_atm_lock());
		_voucher_atm_release(vatm);
		vatm_old = vatm;
		vatm = _voucher_activity_heap->vam_base_atm;
		if (vatm != vatm_old) {
			vatm_old = NULL;
			goto retry;
		}
		_voucher_activity_heap->vam_base_atm = vatm = vatm_new;
		_voucher_activity_heap->vam_base_atm_subid = subid = 1;
		vatm_new = NULL;
		_voucher_atm_retain(vatm);
		_dispatch_voucher_atm_debug("base replace", vatm);
	} else {
		_voucher_activity_heap->vam_base_atm_subid = subid;
		_dispatch_voucher_atm_debug("base copy", vatm);
	}
	_voucher_activity_lock_unlock(vam_base_atm_lock());
	if (vatm_old) _voucher_atm_release(vatm_old);
	if (vatm_new) _voucher_atm_release(vatm_new);
out:
	*va_id_ptr = VATM_ACTID(vatm, subid);
	return vatm;
}

static voucher_activity_id_t
_voucher_atm_nested_atm_id_make(void)
{
	atm_aid_t atm_id;
	mach_voucher_t kv = _voucher_atm_mach_voucher_create(&atm_id);
	_voucher_dealloc_mach_voucher(kv); // just need the unique ID
	return VATMID2ACTID(atm_id);
}

static voucher_activity_id_t
_voucher_atm_nested_activity_id_make(void)
{
	voucher_activity_id_t va_id, va_id_old, va_id_new;
	_voucher_atm_subid_t subid;
	_voucher_activity_lock_lock(vam_nested_atm_lock());
	va_id = _voucher_activity_heap->vam_nested_atm_id;
retry:
	subid = _voucher_activity_heap->vam_nested_atm_subid;
	if (subid++ >= VATM_SUBID_MAX) {
		_voucher_activity_lock_unlock(vam_nested_atm_lock());
		va_id_new = _voucher_atm_nested_atm_id_make();
		va_id_old = va_id;
		_voucher_activity_lock_lock(vam_nested_atm_lock());
		va_id = _voucher_activity_heap->vam_nested_atm_id;
		if (va_id != va_id_old) goto retry;
		_voucher_activity_heap->vam_nested_atm_id = va_id = va_id_new;
		subid = 1;
	}
	_voucher_activity_heap->vam_nested_atm_subid = subid;
	_voucher_activity_lock_unlock(vam_nested_atm_lock());
	return va_id + subid;
}

#pragma mark -
#pragma mark voucher_activity_id_t

voucher_activity_id_t
voucher_activity_start_with_location(voucher_activity_trace_id_t trace_id,
		uint64_t location, voucher_activity_flag_t flags)
{
	dispatch_once_f(&_voucher_activity_heap_pred, NULL,
			_voucher_activity_heap_init);
	if (!_voucher_activity_trace_id_enabled(trace_id)) return 0;
	voucher_activity_id_t va_id = 0, va_base_id = 0;
	_voucher_atm_t vatm = NULL;
	_voucher_activity_t act = NULL;
	_voucher_activity_tracepoint_t vat = NULL;
	unsigned int activities = 1, oactivities = 0;
	voucher_t ov = _voucher_get();
	if (!(flags & voucher_activity_flag_force) && ov && ov->v_activities) {
		oactivities = ov->v_activities;
		activities += oactivities;
		if (activities > _voucher_max_activities) {
			va_id = _voucher_atm_nested_activity_id_make();
			goto out;
		}
	}
	if (activities == 1) {
		vatm = _voucher_atm_base_copy_and_activity_id_make(&va_id);
		if (vatm->vatm_kvoucher) {
			// consumes vatm reference:
			act = _voucher_activity_create_with_atm(vatm, va_id, trace_id,
					location, NULL);
			vat = (_voucher_activity_tracepoint_t)act;
		} else {
			_voucher_atm_release(vatm);
		}
		if (!act) {
			activities++;
			// default to _voucher_activity_default base activity
			va_base_id = _voucher_activity_default->va_id;
		}
	}
	pthread_priority_t priority = _voucher_get_priority(ov);
	mach_voucher_attr_recipe_size_t extra = ov ? _voucher_extra_size(ov) : 0;
	voucher_t v = _voucher_alloc(activities, priority, extra);
	if (extra) {
		memcpy(_voucher_extra_recipes(v), _voucher_extra_recipes(ov), extra);
	}
	if (ov && ov->v_kvoucher) {
		voucher_t kvb = ov->v_kvbase ? ov->v_kvbase : ov;
		v->v_kvbase = _voucher_retain(kvb);
		v->v_kvoucher = kvb->v_kvoucher;
	}
	voucher_activity_id_t *activity_ids = _voucher_activity_ids(v);
	if (oactivities) {
		memcpy(activity_ids, _voucher_activity_ids(ov),
				oactivities * sizeof(voucher_activity_id_t));
	}
	if (!va_id) {
		va_id = _voucher_atm_nested_activity_id_make();
		if (ov && ov->v_activity) {
			act = _voucher_activity_retain(ov->v_activity);
		}
	}
	if (va_base_id) activity_ids[0] = va_base_id;
	activity_ids[activities-1] = va_id;
	v->v_activity = act;
	_voucher_swap(ov, v);
	if (vat) return va_id; // new _voucher_activity_s contains trace info
out:
	vat = _voucher_activity_trace_with_id(trace_id);
	if (vat) {
		vat->vat_flags |= _voucher_activity_trace_flag_activity |
				_voucher_activity_trace_flag_start;
		vat->vat_data[0] = va_id;
	}
	return va_id;
}

voucher_activity_id_t
voucher_activity_start(voucher_activity_trace_id_t trace_id,
		voucher_activity_flag_t flags)
{
	return voucher_activity_start_with_location(trace_id, 0, flags);
}

void
voucher_activity_end(voucher_activity_id_t va_id)
{
	if (!va_id) return;
	_voucher_activity_tracepoint_t vat;
	vat = _voucher_activity_trace_with_id(_voucher_activity_trace_id_release);
	if (vat) {
		vat->vat_flags |= _voucher_activity_trace_flag_activity |
				_voucher_activity_trace_flag_end;
		vat->vat_data[0] = va_id;
	}
	voucher_t v = _voucher_get();
	if (!v) return;
	unsigned int activities =  v->v_activities, act_idx = activities;
	voucher_activity_id_t *activity_ids = _voucher_activity_ids(v);
	while (act_idx) {
		if (activity_ids[act_idx-1] == va_id) break;
		act_idx--;
	}
	if (!act_idx) return; // activity_id not found
	pthread_priority_t priority = _voucher_get_priority(v);
	mach_voucher_attr_recipe_size_t extra = _voucher_extra_size(v);
	voucher_t nv = NULL;
	if (act_idx > 1 || activities == 1) --activities;
	if (priority || activities || extra || v->v_kvoucher) {
		nv = _voucher_alloc(activities, priority, extra);
		if (extra) {
			memcpy(_voucher_extra_recipes(nv), _voucher_extra_recipes(v),extra);
		}
	}
	if (v->v_kvoucher) {
		voucher_t kvb = v->v_kvbase ? v->v_kvbase : v;
		nv->v_kvbase = _voucher_retain(kvb);
		nv->v_kvoucher = kvb->v_kvoucher;
	}
	bool atm_collect = !activities;
	if (activities) {
		voucher_activity_id_t *new_activity_ids = _voucher_activity_ids(nv);
		if (act_idx == 1 && _voucher_activity_default) {
			atm_collect = true;
			// default to _voucher_activity_default base activity
			new_activity_ids[0] = _voucher_activity_default->va_id;
			memcpy(&new_activity_ids[1], &activity_ids[1],
					(activities - 1) * sizeof(voucher_activity_id_t));
		} else {
			if (v->v_activity) {
				nv->v_activity = _voucher_activity_retain(v->v_activity);
			}
			memcpy(new_activity_ids, activity_ids,
					--act_idx * sizeof(voucher_activity_id_t));
			if (act_idx < activities) {
				memcpy(&new_activity_ids[act_idx], &activity_ids[act_idx+1],
						(activities - act_idx) * sizeof(voucher_activity_id_t));
			}
		}
	}
	_voucher_swap(v, nv);
}

unsigned int
voucher_get_activities(voucher_activity_id_t *entries, unsigned int *count)
{
	voucher_t v = _voucher_get();
	if (!v || !count) return 0;
	unsigned int activities = v->v_activities;
	if (*count < activities) activities = *count;
	*count = v->v_activities;
	voucher_activity_id_t *activity_ids = _voucher_activity_ids(v);
	if (activities && entries) {
		memcpy(entries, activity_ids, activities *
				sizeof(voucher_activity_id_t));
	}
	return activities;
}

uint8_t
voucher_activity_get_namespace(void)
{
	voucher_t v = _voucher_get();
	if (!v || !v->v_activity) return 0;
	return v->v_activity->va_namespace;
}

DISPATCH_NOINLINE
_voucher_activity_tracepoint_t
_voucher_activity_tracepoint_get_slow(unsigned int slots)
{
	_voucher_activity_t act;
	_voucher_activity_buffer_header_t vab;
	_voucher_activity_tracepoint_t vat = NULL;
	voucher_t v = _voucher_get();
	if (v && v->v_activity) {
		act = v->v_activity;
	} else {
		dispatch_once_f(&_voucher_activity_heap_pred, NULL,
				_voucher_activity_heap_init);
		if (_voucher_activity_disabled()) return NULL;
		act = _voucher_activity_default;
	}
	vab = act->va_current_buffer;
	if (vab && vab->vabh_next_tracepoint_idx <=
			_voucher_activity_tracepoints_per_buffer) {
		goto retry; // another slowpath raced us
	}
	do {
		vab = _voucher_activity_buffer_alloc(act, vab);
		if (!vab) break;
retry:
		vat = _voucher_activity_buffer_tracepoint_get(vab, slots);
	} while (!vat);
	return vat;
}

static inline void
_voucher_activity_trace_fault(voucher_activity_trace_id_t trace_id)
{
	if (!slowpath(_voucher_activity_trace_id_is_subtype(trace_id, error))) {
		return;
	}
	mach_voucher_attr_command_t atm_cmd = ATM_ACTION_COLLECT;
	if (_voucher_activity_trace_id_is_subtype(trace_id, fault)) {
		atm_cmd = ATM_ACTION_LOGFAIL;
	}
	return _voucher_atm_fault(atm_cmd);
}

uint64_t
voucher_activity_trace(voucher_activity_trace_id_t trace_id, uint64_t location,
		void *buffer, size_t length)
{
	if (!_voucher_activity_trace_id_enabled(trace_id)) return 0;
	_voucher_activity_tracepoint_t vat;
	const unsigned int slots = length <= sizeof(vat->vat_data) ? 1 : 2;
	vat = _voucher_activity_tracepoint_get(slots);
	if (!vat) vat = _voucher_activity_tracepoint_get_slow(slots);
	if (!vat) return 0;
	uint64_t timestamp = _voucher_activity_tracepoint_init_with_id(vat,
			trace_id, location);
	void *tbuf = vat->vat_data;
	size_t tlen = sizeof(vat->vat_data);
	if (length < tlen) {
		memcpy(tbuf, buffer, length);
	} else {
		memcpy(tbuf, buffer, tlen);
	}
	if (length > tlen) {
		vat->vat_flags |= _voucher_activity_trace_flag_wide_first;
		buffer += tlen;
		length -= tlen;
		(++vat)->vat_flags = _voucher_activity_trace_flag_tracepoint |
				_voucher_activity_trace_flag_wide_second;
		vat->vat_type = 0; vat->vat_namespace = 0;
		tbuf = (void*)vat + offsetof(typeof(*vat), vat_code);
		tlen = sizeof(*vat) - offsetof(typeof(*vat), vat_code);
		if (length < tlen) {
			memcpy(tbuf, buffer, length);
		} else {
			memcpy(tbuf, buffer, tlen);
		}
	}
	_voucher_activity_trace_fault(trace_id);
	return timestamp;
}

uint64_t
voucher_activity_trace_args(voucher_activity_trace_id_t trace_id,
		uint64_t location, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
		uintptr_t arg4)
{
	if (!_voucher_activity_trace_id_enabled(trace_id)) return 0;
	_voucher_activity_tracepoint_t vat;
	vat = _voucher_activity_tracepoint_get(1);
	if (!vat) vat = _voucher_activity_tracepoint_get_slow(1);
	if (!vat) return 0;
	uint64_t timestamp = _voucher_activity_tracepoint_init_with_id(vat,
			trace_id, location);
	vat->vat_flags |= _voucher_activity_trace_flag_tracepoint_args;
	vat->vat_data[0] = arg1;
	vat->vat_data[1] = arg2;
	vat->vat_data[2] = arg3;
	vat->vat_data[3] = arg4;
	_voucher_activity_trace_fault(trace_id);
	return timestamp;
}

#pragma mark -
#pragma mark _voucher_debug

size_t
_voucher_debug(voucher_t v, char* buf, size_t bufsiz)
{
	size_t offset = 0;
	#define bufprintf(...) \
			offset += dsnprintf(&buf[offset], bufsiz - offset, ##__VA_ARGS__)
	bufprintf("voucher[%p] = { xrefcnt = 0x%x, refcnt = 0x%x, ", v,
			v->os_obj_xref_cnt + 1, v->os_obj_ref_cnt + 1);

	if (v->v_kvbase) {
		bufprintf("base voucher %p, ", v->v_kvbase);
	}
	if (v->v_kvoucher) {
		bufprintf("kvoucher%s 0x%x, ", v->v_kvoucher == v->v_ipc_kvoucher ?
				" & ipc kvoucher" : "", v->v_kvoucher);
	}
	if (v->v_ipc_kvoucher && v->v_ipc_kvoucher != v->v_kvoucher) {
		bufprintf("ipc kvoucher 0x%x, ", v->v_ipc_kvoucher);
	}
	if (v->v_has_priority) {
		bufprintf("QOS 0x%x, ", *_voucher_priority(v));
	}
	if (v->v_activities) {
		voucher_activity_id_t *activity_ids = _voucher_activity_ids(v);
		bufprintf("activity IDs = { ");
		unsigned int i;
		for (i = 0; i < v->v_activities; i++) {
			bufprintf("0x%llx, ", *activity_ids++);
		}
		bufprintf("}, ");
	}
	if (v->v_activity) {
		_voucher_activity_t va = v->v_activity;
		_voucher_atm_t vatm = va->va_atm;
		bufprintf("activity[%p] = { ID 0x%llx, use %d, atm[%p] = { "
				"AID 0x%llx, ref %d, kvoucher 0x%x } }, ", va, va->va_id,
				va->va_use_count + 1, va->va_atm, vatm->vatm_id,
				vatm->vatm_refcnt + 1, vatm->vatm_kvoucher);
	}
	bufprintf("}");
	return offset;
}

#else // VOUCHER_USE_MACH_VOUCHER

#pragma mark -
#pragma mark Simulator / vouchers disabled

#if VOUCHER_ENABLE_RECIPE_OBJECTS
voucher_t
voucher_create(voucher_recipe_t recipe)
{
	(void)recipe;
	return NULL;
}
#endif

voucher_t
voucher_adopt(voucher_t voucher)
{
	return voucher;
}

voucher_t
voucher_copy(void)
{
	return NULL;
}

voucher_t
voucher_copy_without_importance(void)
{
	return NULL;
}

void
voucher_replace_default_voucher(void)
{
}

void
voucher_decrement_importance_count4CF(voucher_t v)
{
	(void)v;
}

void
_voucher_thread_cleanup(void *voucher)
{
	(void)voucher;
}

void
_voucher_dealloc_mach_voucher(mach_voucher_t kv)
{
	(void)kv;
}

mach_voucher_t
_voucher_create_mach_voucher_with_priority(voucher_t voucher,
		pthread_priority_t priority)
{
	(void)voucher; (void)priority;
	return MACH_VOUCHER_NULL;
}

voucher_t
_voucher_create_with_priority_and_mach_voucher(voucher_t voucher,
		pthread_priority_t priority, mach_voucher_t kv)
{
	(void)voucher; (void)priority; (void)kv;
	return NULL;
}

voucher_t
voucher_create_with_mach_msg(mach_msg_header_t *msg)
{
	(void)msg;
	return NULL;
}

#if VOUCHER_ENABLE_GET_MACH_VOUCHER
mach_voucher_t
voucher_get_mach_voucher(voucher_t voucher)
{
	(void)voucher;
	return 0;
}
#endif

void
_voucher_xref_dispose(voucher_t voucher)
{
	(void)voucher;
}

void
_voucher_dispose(voucher_t voucher)
{
	(void)voucher;
}

void
_voucher_atfork_child(void)
{
}

void
_voucher_init(void)
{
}

void*
voucher_activity_get_metadata_buffer(size_t *length)
{
	*length = 0;
	return NULL;
}

void
_voucher_activity_heap_pressure_normal(void)
{
}

void
_voucher_activity_heap_pressure_warn(void)
{
}

voucher_activity_id_t
voucher_activity_start_with_location(voucher_activity_trace_id_t trace_id,
		uint64_t location, voucher_activity_flag_t flags)
{
	(void)trace_id; (void)location; (void)flags;
	return 0;
}

voucher_activity_id_t
voucher_activity_start(voucher_activity_trace_id_t trace_id,
		voucher_activity_flag_t flags)
{
	(void)trace_id; (void)flags;
	return 0;
}

void
voucher_activity_end(voucher_activity_id_t activity_id)
{
	(void)activity_id;
}

unsigned int
voucher_get_activities(voucher_activity_id_t *entries, unsigned int *count)
{
	(void)entries; (void)count;
	return 0;
}

uint8_t
voucher_activity_get_namespace(void)
{
	return 0;
}

uint64_t
voucher_activity_trace(voucher_activity_trace_id_t trace_id, uint64_t location,
		void *buffer, size_t length)
{
	(void)trace_id; (void)location; (void)buffer; (void)length;
	return 0;
}

uint64_t
voucher_activity_trace_args(voucher_activity_trace_id_t trace_id,
		uint64_t location, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3,
		uintptr_t arg4)
{
	(void)trace_id; (void)location;
	(void)arg1; (void)arg2; (void)arg3; (void)arg4;
	return 0;
}

size_t
_voucher_debug(voucher_t v, char* buf, size_t bufsiz)
{
	(void)v; (void)buf; (void)bufsiz;
	return 0;
}

#endif // VOUCHER_USE_MACH_VOUCHER