xref: /netbsd-src/sys/uvm/uvm_map.c (revision 82d56013d7b633d116a93943de88e08335357a7c)
1 /*	$NetBSD: uvm_map.c,v 1.388 2021/04/17 21:37:21 mrg Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Charles D. Cranor and Washington University.
5  * Copyright (c) 1991, 1993, The Regents of the University of California.
6  *
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to Berkeley by
10  * The Mach Operating System project at Carnegie-Mellon University.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)vm_map.c    8.3 (Berkeley) 1/12/94
37  * from: Id: uvm_map.c,v 1.1.2.27 1998/02/07 01:16:54 chs Exp
38  *
39  *
40  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
41  * All rights reserved.
42  *
43  * Permission to use, copy, modify and distribute this software and
44  * its documentation is hereby granted, provided that both the copyright
45  * notice and this permission notice appear in all copies of the
46  * software, derivative works or modified versions, and any portions
47  * thereof, and that both notices appear in supporting documentation.
48  *
49  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
50  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
51  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
52  *
53  * Carnegie Mellon requests users of this software to return to
54  *
55  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
56  *  School of Computer Science
57  *  Carnegie Mellon University
58  *  Pittsburgh PA 15213-3890
59  *
60  * any improvements or extensions that they make and grant Carnegie the
61  * rights to redistribute these changes.
62  */
63 
64 /*
65  * uvm_map.c: uvm map operations
66  */
67 
68 #include <sys/cdefs.h>
69 __KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.388 2021/04/17 21:37:21 mrg Exp $");
70 
71 #include "opt_ddb.h"
72 #include "opt_pax.h"
73 #include "opt_uvmhist.h"
74 #include "opt_uvm.h"
75 #include "opt_sysv.h"
76 
77 #include <sys/param.h>
78 #include <sys/systm.h>
79 #include <sys/mman.h>
80 #include <sys/proc.h>
81 #include <sys/pool.h>
82 #include <sys/kernel.h>
83 #include <sys/mount.h>
84 #include <sys/pax.h>
85 #include <sys/vnode.h>
86 #include <sys/filedesc.h>
87 #include <sys/lockdebug.h>
88 #include <sys/atomic.h>
89 #include <sys/sysctl.h>
90 #ifndef __USER_VA0_IS_SAFE
91 #include <sys/kauth.h>
92 #include "opt_user_va0_disable_default.h"
93 #endif
94 
95 #include <sys/shm.h>
96 
97 #include <uvm/uvm.h>
98 #include <uvm/uvm_readahead.h>
99 
100 #if defined(DDB) || defined(DEBUGPRINT)
101 #include <uvm/uvm_ddb.h>
102 #endif
103 
104 #ifdef UVMHIST
105 #ifndef UVMHIST_MAPHIST_SIZE
106 #define UVMHIST_MAPHIST_SIZE 100
107 #endif
108 static struct kern_history_ent maphistbuf[UVMHIST_MAPHIST_SIZE];
109 UVMHIST_DEFINE(maphist) = UVMHIST_INITIALIZER(maphist, maphistbuf);
110 #endif
111 
112 #if !defined(UVMMAP_COUNTERS)
113 
114 #define	UVMMAP_EVCNT_DEFINE(name)	/* nothing */
115 #define UVMMAP_EVCNT_INCR(ev)		/* nothing */
116 #define UVMMAP_EVCNT_DECR(ev)		/* nothing */
117 
118 #else /* defined(UVMMAP_NOCOUNTERS) */
119 
120 #include <sys/evcnt.h>
121 #define	UVMMAP_EVCNT_DEFINE(name) \
122 struct evcnt uvmmap_evcnt_##name = EVCNT_INITIALIZER(EVCNT_TYPE_MISC, NULL, \
123     "uvmmap", #name); \
124 EVCNT_ATTACH_STATIC(uvmmap_evcnt_##name);
125 #define	UVMMAP_EVCNT_INCR(ev)		uvmmap_evcnt_##ev.ev_count++
126 #define	UVMMAP_EVCNT_DECR(ev)		uvmmap_evcnt_##ev.ev_count--
127 
128 #endif /* defined(UVMMAP_NOCOUNTERS) */
129 
130 UVMMAP_EVCNT_DEFINE(ubackmerge)
131 UVMMAP_EVCNT_DEFINE(uforwmerge)
132 UVMMAP_EVCNT_DEFINE(ubimerge)
133 UVMMAP_EVCNT_DEFINE(unomerge)
134 UVMMAP_EVCNT_DEFINE(kbackmerge)
135 UVMMAP_EVCNT_DEFINE(kforwmerge)
136 UVMMAP_EVCNT_DEFINE(kbimerge)
137 UVMMAP_EVCNT_DEFINE(knomerge)
138 UVMMAP_EVCNT_DEFINE(map_call)
139 UVMMAP_EVCNT_DEFINE(mlk_call)
140 UVMMAP_EVCNT_DEFINE(mlk_hint)
141 UVMMAP_EVCNT_DEFINE(mlk_tree)
142 UVMMAP_EVCNT_DEFINE(mlk_treeloop)
143 
144 const char vmmapbsy[] = "vmmapbsy";
145 
146 /*
147  * cache for vmspace structures.
148  */
149 
150 static struct pool_cache uvm_vmspace_cache;
151 
152 /*
153  * cache for dynamically-allocated map entries.
154  */
155 
156 static struct pool_cache uvm_map_entry_cache;
157 
158 #ifdef PMAP_GROWKERNEL
159 /*
160  * This global represents the end of the kernel virtual address
161  * space.  If we want to exceed this, we must grow the kernel
162  * virtual address space dynamically.
163  *
164  * Note, this variable is locked by kernel_map's lock.
165  */
166 vaddr_t uvm_maxkaddr;
167 #endif
168 
169 #ifndef __USER_VA0_IS_SAFE
170 #ifndef __USER_VA0_DISABLE_DEFAULT
171 #define __USER_VA0_DISABLE_DEFAULT 1
172 #endif
173 #ifdef USER_VA0_DISABLE_DEFAULT /* kernel config option overrides */
174 #undef __USER_VA0_DISABLE_DEFAULT
175 #define __USER_VA0_DISABLE_DEFAULT USER_VA0_DISABLE_DEFAULT
176 #endif
177 int user_va0_disable = __USER_VA0_DISABLE_DEFAULT;
178 #endif
179 
180 /*
181  * macros
182  */
183 
184 /*
185  * uvm_map_align_va: round down or up virtual address
186  */
187 static __inline void
188 uvm_map_align_va(vaddr_t *vap, vsize_t align, int topdown)
189 {
190 
191 	KASSERT(powerof2(align));
192 
193 	if (align != 0 && (*vap & (align - 1)) != 0) {
194 		if (topdown)
195 			*vap = rounddown2(*vap, align);
196 		else
197 			*vap = roundup2(*vap, align);
198 	}
199 }
200 
201 /*
202  * UVM_ET_ISCOMPATIBLE: check some requirements for map entry merging
203  */
204 extern struct vm_map *pager_map;
205 
206 #define	UVM_ET_ISCOMPATIBLE(ent, type, uobj, meflags, \
207     prot, maxprot, inh, adv, wire) \
208 	((ent)->etype == (type) && \
209 	(((ent)->flags ^ (meflags)) & (UVM_MAP_NOMERGE)) == 0 && \
210 	(ent)->object.uvm_obj == (uobj) && \
211 	(ent)->protection == (prot) && \
212 	(ent)->max_protection == (maxprot) && \
213 	(ent)->inheritance == (inh) && \
214 	(ent)->advice == (adv) && \
215 	(ent)->wired_count == (wire))
216 
217 /*
218  * uvm_map_entry_link: insert entry into a map
219  *
220  * => map must be locked
221  */
222 #define uvm_map_entry_link(map, after_where, entry) do { \
223 	uvm_mapent_check(entry); \
224 	(map)->nentries++; \
225 	(entry)->prev = (after_where); \
226 	(entry)->next = (after_where)->next; \
227 	(entry)->prev->next = (entry); \
228 	(entry)->next->prev = (entry); \
229 	uvm_rb_insert((map), (entry)); \
230 } while (/*CONSTCOND*/ 0)
231 
232 /*
233  * uvm_map_entry_unlink: remove entry from a map
234  *
235  * => map must be locked
236  */
237 #define uvm_map_entry_unlink(map, entry) do { \
238 	KASSERT((entry) != (map)->first_free); \
239 	KASSERT((entry) != (map)->hint); \
240 	uvm_mapent_check(entry); \
241 	(map)->nentries--; \
242 	(entry)->next->prev = (entry)->prev; \
243 	(entry)->prev->next = (entry)->next; \
244 	uvm_rb_remove((map), (entry)); \
245 } while (/*CONSTCOND*/ 0)
246 
247 /*
248  * SAVE_HINT: saves the specified entry as the hint for future lookups.
249  *
250  * => map need not be locked.
251  */
252 #define SAVE_HINT(map, check, value) do { \
253 	if ((map)->hint == (check)) \
254 		(map)->hint = (value); \
255 } while (/*CONSTCOND*/ 0)
256 
257 /*
258  * clear_hints: ensure that hints don't point to the entry.
259  *
260  * => map must be write-locked.
261  */
262 static void
263 clear_hints(struct vm_map *map, struct vm_map_entry *ent)
264 {
265 
266 	SAVE_HINT(map, ent, ent->prev);
267 	if (map->first_free == ent) {
268 		map->first_free = ent->prev;
269 	}
270 }
271 
272 /*
273  * VM_MAP_RANGE_CHECK: check and correct range
274  *
275  * => map must at least be read locked
276  */
277 
278 #define VM_MAP_RANGE_CHECK(map, start, end) do { \
279 	if (start < vm_map_min(map))		\
280 		start = vm_map_min(map);	\
281 	if (end > vm_map_max(map))		\
282 		end = vm_map_max(map);		\
283 	if (start > end)			\
284 		start = end;			\
285 } while (/*CONSTCOND*/ 0)
286 
287 /*
288  * local prototypes
289  */
290 
291 static struct vm_map_entry *
292 		uvm_mapent_alloc(struct vm_map *, int);
293 static void	uvm_mapent_copy(struct vm_map_entry *, struct vm_map_entry *);
294 static void	uvm_mapent_free(struct vm_map_entry *);
295 #if defined(DEBUG)
296 static void	_uvm_mapent_check(const struct vm_map_entry *, int);
297 #define	uvm_mapent_check(map)	_uvm_mapent_check(map, __LINE__)
298 #else /* defined(DEBUG) */
299 #define	uvm_mapent_check(e)	/* nothing */
300 #endif /* defined(DEBUG) */
301 
302 static void	uvm_map_entry_unwire(struct vm_map *, struct vm_map_entry *);
303 static void	uvm_map_reference_amap(struct vm_map_entry *, int);
304 static int	uvm_map_space_avail(vaddr_t *, vsize_t, voff_t, vsize_t, int,
305 		    int, struct vm_map_entry *);
306 static void	uvm_map_unreference_amap(struct vm_map_entry *, int);
307 
308 int _uvm_map_sanity(struct vm_map *);
309 int _uvm_tree_sanity(struct vm_map *);
310 static vsize_t uvm_rb_maxgap(const struct vm_map_entry *);
311 
312 #define	ROOT_ENTRY(map)		((struct vm_map_entry *)(map)->rb_tree.rbt_root)
313 #define	LEFT_ENTRY(entry)	((struct vm_map_entry *)(entry)->rb_node.rb_left)
314 #define	RIGHT_ENTRY(entry)	((struct vm_map_entry *)(entry)->rb_node.rb_right)
315 #define	PARENT_ENTRY(map, entry) \
316 	(ROOT_ENTRY(map) == (entry) \
317 	    ? NULL : (struct vm_map_entry *)RB_FATHER(&(entry)->rb_node))
318 
319 /*
320  * These get filled in if/when SYSVSHM shared memory code is loaded
321  *
322  * We do this with function pointers rather the #ifdef SYSVSHM so the
323  * SYSVSHM code can be loaded and unloaded
324  */
325 void (*uvm_shmexit)(struct vmspace *) = NULL;
326 void (*uvm_shmfork)(struct vmspace *, struct vmspace *) = NULL;
327 
328 static int
329 uvm_map_compare_nodes(void *ctx, const void *nparent, const void *nkey)
330 {
331 	const struct vm_map_entry *eparent = nparent;
332 	const struct vm_map_entry *ekey = nkey;
333 
334 	KASSERT(eparent->start < ekey->start || eparent->start >= ekey->end);
335 	KASSERT(ekey->start < eparent->start || ekey->start >= eparent->end);
336 
337 	if (eparent->start < ekey->start)
338 		return -1;
339 	if (eparent->end >= ekey->start)
340 		return 1;
341 	return 0;
342 }
343 
344 static int
345 uvm_map_compare_key(void *ctx, const void *nparent, const void *vkey)
346 {
347 	const struct vm_map_entry *eparent = nparent;
348 	const vaddr_t va = *(const vaddr_t *) vkey;
349 
350 	if (eparent->start < va)
351 		return -1;
352 	if (eparent->end >= va)
353 		return 1;
354 	return 0;
355 }
356 
357 static const rb_tree_ops_t uvm_map_tree_ops = {
358 	.rbto_compare_nodes = uvm_map_compare_nodes,
359 	.rbto_compare_key = uvm_map_compare_key,
360 	.rbto_node_offset = offsetof(struct vm_map_entry, rb_node),
361 	.rbto_context = NULL
362 };
363 
364 /*
365  * uvm_rb_gap: return the gap size between our entry and next entry.
366  */
367 static inline vsize_t
368 uvm_rb_gap(const struct vm_map_entry *entry)
369 {
370 
371 	KASSERT(entry->next != NULL);
372 	return entry->next->start - entry->end;
373 }
374 
375 static vsize_t
376 uvm_rb_maxgap(const struct vm_map_entry *entry)
377 {
378 	struct vm_map_entry *child;
379 	vsize_t maxgap = entry->gap;
380 
381 	/*
382 	 * We need maxgap to be the largest gap of us or any of our
383 	 * descendents.  Since each of our children's maxgap is the
384 	 * cached value of their largest gap of themselves or their
385 	 * descendents, we can just use that value and avoid recursing
386 	 * down the tree to calculate it.
387 	 */
388 	if ((child = LEFT_ENTRY(entry)) != NULL && maxgap < child->maxgap)
389 		maxgap = child->maxgap;
390 
391 	if ((child = RIGHT_ENTRY(entry)) != NULL && maxgap < child->maxgap)
392 		maxgap = child->maxgap;
393 
394 	return maxgap;
395 }
396 
397 static void
398 uvm_rb_fixup(struct vm_map *map, struct vm_map_entry *entry)
399 {
400 	struct vm_map_entry *parent;
401 
402 	KASSERT(entry->gap == uvm_rb_gap(entry));
403 	entry->maxgap = uvm_rb_maxgap(entry);
404 
405 	while ((parent = PARENT_ENTRY(map, entry)) != NULL) {
406 		struct vm_map_entry *brother;
407 		vsize_t maxgap = parent->gap;
408 		unsigned int which;
409 
410 		KDASSERT(parent->gap == uvm_rb_gap(parent));
411 		if (maxgap < entry->maxgap)
412 			maxgap = entry->maxgap;
413 		/*
414 		 * Since we work towards the root, we know entry's maxgap
415 		 * value is OK, but its brothers may now be out-of-date due
416 		 * to rebalancing.  So refresh it.
417 		 */
418 		which = RB_POSITION(&entry->rb_node) ^ RB_DIR_OTHER;
419 		brother = (struct vm_map_entry *)parent->rb_node.rb_nodes[which];
420 		if (brother != NULL) {
421 			KDASSERT(brother->gap == uvm_rb_gap(brother));
422 			brother->maxgap = uvm_rb_maxgap(brother);
423 			if (maxgap < brother->maxgap)
424 				maxgap = brother->maxgap;
425 		}
426 
427 		parent->maxgap = maxgap;
428 		entry = parent;
429 	}
430 }
431 
432 static void
433 uvm_rb_insert(struct vm_map *map, struct vm_map_entry *entry)
434 {
435 	struct vm_map_entry *ret __diagused;
436 
437 	entry->gap = entry->maxgap = uvm_rb_gap(entry);
438 	if (entry->prev != &map->header)
439 		entry->prev->gap = uvm_rb_gap(entry->prev);
440 
441 	ret = rb_tree_insert_node(&map->rb_tree, entry);
442 	KASSERTMSG(ret == entry,
443 	    "uvm_rb_insert: map %p: duplicate entry %p", map, ret);
444 
445 	/*
446 	 * If the previous entry is not our immediate left child, then it's an
447 	 * ancestor and will be fixed up on the way to the root.  We don't
448 	 * have to check entry->prev against &map->header since &map->header
449 	 * will never be in the tree.
450 	 */
451 	uvm_rb_fixup(map,
452 	    LEFT_ENTRY(entry) == entry->prev ? entry->prev : entry);
453 }
454 
455 static void
456 uvm_rb_remove(struct vm_map *map, struct vm_map_entry *entry)
457 {
458 	struct vm_map_entry *prev_parent = NULL, *next_parent = NULL;
459 
460 	/*
461 	 * If we are removing an interior node, then an adjacent node will
462 	 * be used to replace its position in the tree.  Therefore we will
463 	 * need to fixup the tree starting at the parent of the replacement
464 	 * node.  So record their parents for later use.
465 	 */
466 	if (entry->prev != &map->header)
467 		prev_parent = PARENT_ENTRY(map, entry->prev);
468 	if (entry->next != &map->header)
469 		next_parent = PARENT_ENTRY(map, entry->next);
470 
471 	rb_tree_remove_node(&map->rb_tree, entry);
472 
473 	/*
474 	 * If the previous node has a new parent, fixup the tree starting
475 	 * at the previous node's old parent.
476 	 */
477 	if (entry->prev != &map->header) {
478 		/*
479 		 * Update the previous entry's gap due to our absence.
480 		 */
481 		entry->prev->gap = uvm_rb_gap(entry->prev);
482 		uvm_rb_fixup(map, entry->prev);
483 		if (prev_parent != NULL
484 		    && prev_parent != entry
485 		    && prev_parent != PARENT_ENTRY(map, entry->prev))
486 			uvm_rb_fixup(map, prev_parent);
487 	}
488 
489 	/*
490 	 * If the next node has a new parent, fixup the tree starting
491 	 * at the next node's old parent.
492 	 */
493 	if (entry->next != &map->header) {
494 		uvm_rb_fixup(map, entry->next);
495 		if (next_parent != NULL
496 		    && next_parent != entry
497 		    && next_parent != PARENT_ENTRY(map, entry->next))
498 			uvm_rb_fixup(map, next_parent);
499 	}
500 }
501 
502 #if defined(DEBUG)
503 int uvm_debug_check_map = 0;
504 int uvm_debug_check_rbtree = 0;
505 #define uvm_map_check(map, name) \
506 	_uvm_map_check((map), (name), __FILE__, __LINE__)
507 static void
508 _uvm_map_check(struct vm_map *map, const char *name,
509     const char *file, int line)
510 {
511 
512 	if ((uvm_debug_check_map && _uvm_map_sanity(map)) ||
513 	    (uvm_debug_check_rbtree && _uvm_tree_sanity(map))) {
514 		panic("uvm_map_check failed: \"%s\" map=%p (%s:%d)",
515 		    name, map, file, line);
516 	}
517 }
518 #else /* defined(DEBUG) */
519 #define uvm_map_check(map, name)	/* nothing */
520 #endif /* defined(DEBUG) */
521 
522 #if defined(DEBUG) || defined(DDB)
523 int
524 _uvm_map_sanity(struct vm_map *map)
525 {
526 	bool first_free_found = false;
527 	bool hint_found = false;
528 	const struct vm_map_entry *e;
529 	struct vm_map_entry *hint = map->hint;
530 
531 	e = &map->header;
532 	for (;;) {
533 		if (map->first_free == e) {
534 			first_free_found = true;
535 		} else if (!first_free_found && e->next->start > e->end) {
536 			printf("first_free %p should be %p\n",
537 			    map->first_free, e);
538 			return -1;
539 		}
540 		if (hint == e) {
541 			hint_found = true;
542 		}
543 
544 		e = e->next;
545 		if (e == &map->header) {
546 			break;
547 		}
548 	}
549 	if (!first_free_found) {
550 		printf("stale first_free\n");
551 		return -1;
552 	}
553 	if (!hint_found) {
554 		printf("stale hint\n");
555 		return -1;
556 	}
557 	return 0;
558 }
559 
560 int
561 _uvm_tree_sanity(struct vm_map *map)
562 {
563 	struct vm_map_entry *tmp, *trtmp;
564 	int n = 0, i = 1;
565 
566 	for (tmp = map->header.next; tmp != &map->header; tmp = tmp->next) {
567 		if (tmp->gap != uvm_rb_gap(tmp)) {
568 			printf("%d/%d gap %#lx != %#lx %s\n",
569 			    n + 1, map->nentries,
570 			    (ulong)tmp->gap, (ulong)uvm_rb_gap(tmp),
571 			    tmp->next == &map->header ? "(last)" : "");
572 			goto error;
573 		}
574 		/*
575 		 * If any entries are out of order, tmp->gap will be unsigned
576 		 * and will likely exceed the size of the map.
577 		 */
578 		if (tmp->gap >= vm_map_max(map) - vm_map_min(map)) {
579 			printf("too large gap %zu\n", (size_t)tmp->gap);
580 			goto error;
581 		}
582 		n++;
583 	}
584 
585 	if (n != map->nentries) {
586 		printf("nentries: %d vs %d\n", n, map->nentries);
587 		goto error;
588 	}
589 
590 	trtmp = NULL;
591 	for (tmp = map->header.next; tmp != &map->header; tmp = tmp->next) {
592 		if (tmp->maxgap != uvm_rb_maxgap(tmp)) {
593 			printf("maxgap %#lx != %#lx\n",
594 			    (ulong)tmp->maxgap,
595 			    (ulong)uvm_rb_maxgap(tmp));
596 			goto error;
597 		}
598 		if (trtmp != NULL && trtmp->start >= tmp->start) {
599 			printf("corrupt: 0x%"PRIxVADDR"x >= 0x%"PRIxVADDR"x\n",
600 			    trtmp->start, tmp->start);
601 			goto error;
602 		}
603 
604 		trtmp = tmp;
605 	}
606 
607 	for (tmp = map->header.next; tmp != &map->header;
608 	    tmp = tmp->next, i++) {
609 		trtmp = rb_tree_iterate(&map->rb_tree, tmp, RB_DIR_LEFT);
610 		if (trtmp == NULL)
611 			trtmp = &map->header;
612 		if (tmp->prev != trtmp) {
613 			printf("lookup: %d: %p->prev=%p: %p\n",
614 			    i, tmp, tmp->prev, trtmp);
615 			goto error;
616 		}
617 		trtmp = rb_tree_iterate(&map->rb_tree, tmp, RB_DIR_RIGHT);
618 		if (trtmp == NULL)
619 			trtmp = &map->header;
620 		if (tmp->next != trtmp) {
621 			printf("lookup: %d: %p->next=%p: %p\n",
622 			    i, tmp, tmp->next, trtmp);
623 			goto error;
624 		}
625 		trtmp = rb_tree_find_node(&map->rb_tree, &tmp->start);
626 		if (trtmp != tmp) {
627 			printf("lookup: %d: %p - %p: %p\n", i, tmp, trtmp,
628 			    PARENT_ENTRY(map, tmp));
629 			goto error;
630 		}
631 	}
632 
633 	return (0);
634  error:
635 	return (-1);
636 }
637 #endif /* defined(DEBUG) || defined(DDB) */
638 
639 /*
640  * vm_map_lock: acquire an exclusive (write) lock on a map.
641  *
642  * => The locking protocol provides for guaranteed upgrade from shared ->
643  *    exclusive by whichever thread currently has the map marked busy.
644  *    See "LOCKING PROTOCOL NOTES" in uvm_map.h.  This is horrible; among
645  *    other problems, it defeats any fairness guarantees provided by RW
646  *    locks.
647  */
648 
649 void
650 vm_map_lock(struct vm_map *map)
651 {
652 
653 	for (;;) {
654 		rw_enter(&map->lock, RW_WRITER);
655 		if (map->busy == NULL || map->busy == curlwp) {
656 			break;
657 		}
658 		mutex_enter(&map->misc_lock);
659 		rw_exit(&map->lock);
660 		if (map->busy != NULL) {
661 			cv_wait(&map->cv, &map->misc_lock);
662 		}
663 		mutex_exit(&map->misc_lock);
664 	}
665 	map->timestamp++;
666 }
667 
668 /*
669  * vm_map_lock_try: try to lock a map, failing if it is already locked.
670  */
671 
672 bool
673 vm_map_lock_try(struct vm_map *map)
674 {
675 
676 	if (!rw_tryenter(&map->lock, RW_WRITER)) {
677 		return false;
678 	}
679 	if (map->busy != NULL) {
680 		rw_exit(&map->lock);
681 		return false;
682 	}
683 	map->timestamp++;
684 	return true;
685 }
686 
687 /*
688  * vm_map_unlock: release an exclusive lock on a map.
689  */
690 
691 void
692 vm_map_unlock(struct vm_map *map)
693 {
694 
695 	KASSERT(rw_write_held(&map->lock));
696 	KASSERT(map->busy == NULL || map->busy == curlwp);
697 	rw_exit(&map->lock);
698 }
699 
700 /*
701  * vm_map_unbusy: mark the map as unbusy, and wake any waiters that
702  *     want an exclusive lock.
703  */
704 
705 void
706 vm_map_unbusy(struct vm_map *map)
707 {
708 
709 	KASSERT(map->busy == curlwp);
710 
711 	/*
712 	 * Safe to clear 'busy' and 'waiters' with only a read lock held:
713 	 *
714 	 * o they can only be set with a write lock held
715 	 * o writers are blocked out with a read or write hold
716 	 * o at any time, only one thread owns the set of values
717 	 */
718 	mutex_enter(&map->misc_lock);
719 	map->busy = NULL;
720 	cv_broadcast(&map->cv);
721 	mutex_exit(&map->misc_lock);
722 }
723 
724 /*
725  * vm_map_lock_read: acquire a shared (read) lock on a map.
726  */
727 
728 void
729 vm_map_lock_read(struct vm_map *map)
730 {
731 
732 	rw_enter(&map->lock, RW_READER);
733 }
734 
735 /*
736  * vm_map_unlock_read: release a shared lock on a map.
737  */
738 
739 void
740 vm_map_unlock_read(struct vm_map *map)
741 {
742 
743 	rw_exit(&map->lock);
744 }
745 
746 /*
747  * vm_map_busy: mark a map as busy.
748  *
749  * => the caller must hold the map write locked
750  */
751 
752 void
753 vm_map_busy(struct vm_map *map)
754 {
755 
756 	KASSERT(rw_write_held(&map->lock));
757 	KASSERT(map->busy == NULL);
758 
759 	map->busy = curlwp;
760 }
761 
762 /*
763  * vm_map_locked_p: return true if the map is write locked.
764  *
765  * => only for debug purposes like KASSERTs.
766  * => should not be used to verify that a map is not locked.
767  */
768 
769 bool
770 vm_map_locked_p(struct vm_map *map)
771 {
772 
773 	return rw_write_held(&map->lock);
774 }
775 
776 /*
777  * uvm_mapent_alloc: allocate a map entry
778  */
779 
780 static struct vm_map_entry *
781 uvm_mapent_alloc(struct vm_map *map, int flags)
782 {
783 	struct vm_map_entry *me;
784 	int pflags = (flags & UVM_FLAG_NOWAIT) ? PR_NOWAIT : PR_WAITOK;
785 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
786 
787 	me = pool_cache_get(&uvm_map_entry_cache, pflags);
788 	if (__predict_false(me == NULL)) {
789 		return NULL;
790 	}
791 	me->flags = 0;
792 
793 	UVMHIST_LOG(maphist, "<- new entry=%#jx [kentry=%jd]", (uintptr_t)me,
794 	    (map == kernel_map), 0, 0);
795 	return me;
796 }
797 
798 /*
799  * uvm_mapent_free: free map entry
800  */
801 
802 static void
803 uvm_mapent_free(struct vm_map_entry *me)
804 {
805 	UVMHIST_FUNC(__func__);
806 	UVMHIST_CALLARGS(maphist,"<- freeing map entry=%#jx [flags=%#jx]",
807 		(uintptr_t)me, me->flags, 0, 0);
808 	pool_cache_put(&uvm_map_entry_cache, me);
809 }
810 
811 /*
812  * uvm_mapent_copy: copy a map entry, preserving flags
813  */
814 
815 static inline void
816 uvm_mapent_copy(struct vm_map_entry *src, struct vm_map_entry *dst)
817 {
818 
819 	memcpy(dst, src, sizeof(*dst));
820 	dst->flags = 0;
821 }
822 
823 #if defined(DEBUG)
824 static void
825 _uvm_mapent_check(const struct vm_map_entry *entry, int line)
826 {
827 
828 	if (entry->start >= entry->end) {
829 		goto bad;
830 	}
831 	if (UVM_ET_ISOBJ(entry)) {
832 		if (entry->object.uvm_obj == NULL) {
833 			goto bad;
834 		}
835 	} else if (UVM_ET_ISSUBMAP(entry)) {
836 		if (entry->object.sub_map == NULL) {
837 			goto bad;
838 		}
839 	} else {
840 		if (entry->object.uvm_obj != NULL ||
841 		    entry->object.sub_map != NULL) {
842 			goto bad;
843 		}
844 	}
845 	if (!UVM_ET_ISOBJ(entry)) {
846 		if (entry->offset != 0) {
847 			goto bad;
848 		}
849 	}
850 
851 	return;
852 
853 bad:
854 	panic("%s: bad entry %p, line %d", __func__, entry, line);
855 }
856 #endif /* defined(DEBUG) */
857 
858 /*
859  * uvm_map_entry_unwire: unwire a map entry
860  *
861  * => map should be locked by caller
862  */
863 
864 static inline void
865 uvm_map_entry_unwire(struct vm_map *map, struct vm_map_entry *entry)
866 {
867 
868 	entry->wired_count = 0;
869 	uvm_fault_unwire_locked(map, entry->start, entry->end);
870 }
871 
872 
873 /*
874  * wrapper for calling amap_ref()
875  */
876 static inline void
877 uvm_map_reference_amap(struct vm_map_entry *entry, int flags)
878 {
879 
880 	amap_ref(entry->aref.ar_amap, entry->aref.ar_pageoff,
881 	    (entry->end - entry->start) >> PAGE_SHIFT, flags);
882 }
883 
884 
885 /*
886  * wrapper for calling amap_unref()
887  */
888 static inline void
889 uvm_map_unreference_amap(struct vm_map_entry *entry, int flags)
890 {
891 
892 	amap_unref(entry->aref.ar_amap, entry->aref.ar_pageoff,
893 	    (entry->end - entry->start) >> PAGE_SHIFT, flags);
894 }
895 
896 
897 /*
898  * uvm_map_init: init mapping system at boot time.
899  */
900 
901 void
902 uvm_map_init(void)
903 {
904 	/*
905 	 * first, init logging system.
906 	 */
907 
908 	UVMHIST_FUNC(__func__);
909 	UVMHIST_LINK_STATIC(maphist);
910 	UVMHIST_LINK_STATIC(pdhist);
911 	UVMHIST_CALLED(maphist);
912 	UVMHIST_LOG(maphist,"<starting uvm map system>", 0, 0, 0, 0);
913 
914 	/*
915 	 * initialize the global lock for kernel map entry.
916 	 */
917 
918 	mutex_init(&uvm_kentry_lock, MUTEX_DRIVER, IPL_VM);
919 }
920 
921 /*
922  * uvm_map_init_caches: init mapping system caches.
923  */
924 void
925 uvm_map_init_caches(void)
926 {
927 	/*
928 	 * initialize caches.
929 	 */
930 
931 	pool_cache_bootstrap(&uvm_map_entry_cache, sizeof(struct vm_map_entry),
932 	    coherency_unit, 0, PR_LARGECACHE, "vmmpepl", NULL, IPL_NONE, NULL,
933 	    NULL, NULL);
934 	pool_cache_bootstrap(&uvm_vmspace_cache, sizeof(struct vmspace),
935 	    0, 0, 0, "vmsppl", NULL, IPL_NONE, NULL, NULL, NULL);
936 }
937 
938 /*
939  * clippers
940  */
941 
942 /*
943  * uvm_mapent_splitadj: adjust map entries for splitting, after uvm_mapent_copy.
944  */
945 
946 static void
947 uvm_mapent_splitadj(struct vm_map_entry *entry1, struct vm_map_entry *entry2,
948     vaddr_t splitat)
949 {
950 	vaddr_t adj;
951 
952 	KASSERT(entry1->start < splitat);
953 	KASSERT(splitat < entry1->end);
954 
955 	adj = splitat - entry1->start;
956 	entry1->end = entry2->start = splitat;
957 
958 	if (entry1->aref.ar_amap) {
959 		amap_splitref(&entry1->aref, &entry2->aref, adj);
960 	}
961 	if (UVM_ET_ISSUBMAP(entry1)) {
962 		/* ... unlikely to happen, but play it safe */
963 		 uvm_map_reference(entry1->object.sub_map);
964 	} else if (UVM_ET_ISOBJ(entry1)) {
965 		KASSERT(entry1->object.uvm_obj != NULL); /* suppress coverity */
966 		entry2->offset += adj;
967 		if (entry1->object.uvm_obj->pgops &&
968 		    entry1->object.uvm_obj->pgops->pgo_reference)
969 			entry1->object.uvm_obj->pgops->pgo_reference(
970 			    entry1->object.uvm_obj);
971 	}
972 }
973 
974 /*
975  * uvm_map_clip_start: ensure that the entry begins at or after
976  *	the starting address, if it doesn't we split the entry.
977  *
978  * => caller should use UVM_MAP_CLIP_START macro rather than calling
979  *    this directly
980  * => map must be locked by caller
981  */
982 
983 void
984 uvm_map_clip_start(struct vm_map *map, struct vm_map_entry *entry,
985     vaddr_t start)
986 {
987 	struct vm_map_entry *new_entry;
988 
989 	/* uvm_map_simplify_entry(map, entry); */ /* XXX */
990 
991 	uvm_map_check(map, "clip_start entry");
992 	uvm_mapent_check(entry);
993 
994 	/*
995 	 * Split off the front portion.  note that we must insert the new
996 	 * entry BEFORE this one, so that this entry has the specified
997 	 * starting address.
998 	 */
999 	new_entry = uvm_mapent_alloc(map, 0);
1000 	uvm_mapent_copy(entry, new_entry); /* entry -> new_entry */
1001 	uvm_mapent_splitadj(new_entry, entry, start);
1002 	uvm_map_entry_link(map, entry->prev, new_entry);
1003 
1004 	uvm_map_check(map, "clip_start leave");
1005 }
1006 
1007 /*
1008  * uvm_map_clip_end: ensure that the entry ends at or before
1009  *	the ending address, if it does't we split the reference
1010  *
1011  * => caller should use UVM_MAP_CLIP_END macro rather than calling
1012  *    this directly
1013  * => map must be locked by caller
1014  */
1015 
1016 void
1017 uvm_map_clip_end(struct vm_map *map, struct vm_map_entry *entry, vaddr_t end)
1018 {
1019 	struct vm_map_entry *new_entry;
1020 
1021 	uvm_map_check(map, "clip_end entry");
1022 	uvm_mapent_check(entry);
1023 
1024 	/*
1025 	 *	Create a new entry and insert it
1026 	 *	AFTER the specified entry
1027 	 */
1028 	new_entry = uvm_mapent_alloc(map, 0);
1029 	uvm_mapent_copy(entry, new_entry); /* entry -> new_entry */
1030 	uvm_mapent_splitadj(entry, new_entry, end);
1031 	uvm_map_entry_link(map, entry, new_entry);
1032 
1033 	uvm_map_check(map, "clip_end leave");
1034 }
1035 
1036 /*
1037  *   M A P   -   m a i n   e n t r y   p o i n t
1038  */
1039 /*
1040  * uvm_map: establish a valid mapping in a map
1041  *
1042  * => assume startp is page aligned.
1043  * => assume size is a multiple of PAGE_SIZE.
1044  * => assume sys_mmap provides enough of a "hint" to have us skip
1045  *	over text/data/bss area.
1046  * => map must be unlocked (we will lock it)
1047  * => <uobj,uoffset> value meanings (4 cases):
1048  *	 [1] <NULL,uoffset>		== uoffset is a hint for PMAP_PREFER
1049  *	 [2] <NULL,UVM_UNKNOWN_OFFSET>	== don't PMAP_PREFER
1050  *	 [3] <uobj,uoffset>		== normal mapping
1051  *	 [4] <uobj,UVM_UNKNOWN_OFFSET>	== uvm_map finds offset based on VA
1052  *
1053  *    case [4] is for kernel mappings where we don't know the offset until
1054  *    we've found a virtual address.   note that kernel object offsets are
1055  *    always relative to vm_map_min(kernel_map).
1056  *
1057  * => if `align' is non-zero, we align the virtual address to the specified
1058  *	alignment.
1059  *	this is provided as a mechanism for large pages.
1060  *
1061  * => XXXCDC: need way to map in external amap?
1062  */
1063 
1064 int
1065 uvm_map(struct vm_map *map, vaddr_t *startp /* IN/OUT */, vsize_t size,
1066     struct uvm_object *uobj, voff_t uoffset, vsize_t align, uvm_flag_t flags)
1067 {
1068 	struct uvm_map_args args;
1069 	struct vm_map_entry *new_entry;
1070 	int error;
1071 
1072 	KASSERT((size & PAGE_MASK) == 0);
1073 	KASSERT((flags & UVM_FLAG_FIXED) == 0 || align == 0);
1074 
1075 	/*
1076 	 * for pager_map, allocate the new entry first to avoid sleeping
1077 	 * for memory while we have the map locked.
1078 	 */
1079 
1080 	new_entry = NULL;
1081 	if (map == pager_map) {
1082 		new_entry = uvm_mapent_alloc(map, (flags & UVM_FLAG_NOWAIT));
1083 		if (__predict_false(new_entry == NULL))
1084 			return ENOMEM;
1085 	}
1086 	if (map == pager_map)
1087 		flags |= UVM_FLAG_NOMERGE;
1088 
1089 	error = uvm_map_prepare(map, *startp, size, uobj, uoffset, align,
1090 	    flags, &args);
1091 	if (!error) {
1092 		error = uvm_map_enter(map, &args, new_entry);
1093 		*startp = args.uma_start;
1094 	} else if (new_entry) {
1095 		uvm_mapent_free(new_entry);
1096 	}
1097 
1098 #if defined(DEBUG)
1099 	if (!error && VM_MAP_IS_KERNEL(map) && (flags & UVM_FLAG_NOWAIT) == 0) {
1100 		uvm_km_check_empty(map, *startp, *startp + size);
1101 	}
1102 #endif /* defined(DEBUG) */
1103 
1104 	return error;
1105 }
1106 
1107 /*
1108  * uvm_map_prepare:
1109  *
1110  * called with map unlocked.
1111  * on success, returns the map locked.
1112  */
1113 
1114 int
1115 uvm_map_prepare(struct vm_map *map, vaddr_t start, vsize_t size,
1116     struct uvm_object *uobj, voff_t uoffset, vsize_t align, uvm_flag_t flags,
1117     struct uvm_map_args *args)
1118 {
1119 	struct vm_map_entry *prev_entry;
1120 	vm_prot_t prot = UVM_PROTECTION(flags);
1121 	vm_prot_t maxprot = UVM_MAXPROTECTION(flags);
1122 
1123 	UVMHIST_FUNC(__func__);
1124 	UVMHIST_CALLARGS(maphist, "(map=%#jx, start=%#jx, size=%ju, flags=%#jx)",
1125 	    (uintptr_t)map, start, size, flags);
1126 	UVMHIST_LOG(maphist, "  uobj/offset %#jx/%jd", (uintptr_t)uobj,
1127 	    uoffset,0,0);
1128 
1129 	/*
1130 	 * detect a popular device driver bug.
1131 	 */
1132 
1133 	KASSERT(doing_shutdown || curlwp != NULL);
1134 
1135 	/*
1136 	 * zero-sized mapping doesn't make any sense.
1137 	 */
1138 	KASSERT(size > 0);
1139 
1140 	KASSERT((~flags & (UVM_FLAG_NOWAIT | UVM_FLAG_WAITVA)) != 0);
1141 
1142 	uvm_map_check(map, "map entry");
1143 
1144 	/*
1145 	 * check sanity of protection code
1146 	 */
1147 
1148 	if ((prot & maxprot) != prot) {
1149 		UVMHIST_LOG(maphist, "<- prot. failure:  prot=%#jx, max=%#jx",
1150 		prot, maxprot,0,0);
1151 		return EACCES;
1152 	}
1153 
1154 	/*
1155 	 * figure out where to put new VM range
1156 	 */
1157 retry:
1158 	if (vm_map_lock_try(map) == false) {
1159 		if ((flags & UVM_FLAG_TRYLOCK) != 0) {
1160 			return EAGAIN;
1161 		}
1162 		vm_map_lock(map); /* could sleep here */
1163 	}
1164 	if (flags & UVM_FLAG_UNMAP) {
1165 		KASSERT(flags & UVM_FLAG_FIXED);
1166 		KASSERT((flags & UVM_FLAG_NOWAIT) == 0);
1167 
1168 		/*
1169 		 * Set prev_entry to what it will need to be after any existing
1170 		 * entries are removed later in uvm_map_enter().
1171 		 */
1172 
1173 		if (uvm_map_lookup_entry(map, start, &prev_entry)) {
1174 			if (start == prev_entry->start)
1175 				prev_entry = prev_entry->prev;
1176 			else
1177 				UVM_MAP_CLIP_END(map, prev_entry, start);
1178 			SAVE_HINT(map, map->hint, prev_entry);
1179 		}
1180 	} else {
1181 		prev_entry = uvm_map_findspace(map, start, size, &start,
1182 		    uobj, uoffset, align, flags);
1183 	}
1184 	if (prev_entry == NULL) {
1185 		unsigned int timestamp;
1186 
1187 		timestamp = map->timestamp;
1188 		UVMHIST_LOG(maphist,"waiting va timestamp=%#jx",
1189 			    timestamp,0,0,0);
1190 		map->flags |= VM_MAP_WANTVA;
1191 		vm_map_unlock(map);
1192 
1193 		/*
1194 		 * try to reclaim kva and wait until someone does unmap.
1195 		 * fragile locking here, so we awaken every second to
1196 		 * recheck the condition.
1197 		 */
1198 
1199 		mutex_enter(&map->misc_lock);
1200 		while ((map->flags & VM_MAP_WANTVA) != 0 &&
1201 		   map->timestamp == timestamp) {
1202 			if ((flags & UVM_FLAG_WAITVA) == 0) {
1203 				mutex_exit(&map->misc_lock);
1204 				UVMHIST_LOG(maphist,
1205 				    "<- uvm_map_findspace failed!", 0,0,0,0);
1206 				return ENOMEM;
1207 			} else {
1208 				cv_timedwait(&map->cv, &map->misc_lock, hz);
1209 			}
1210 		}
1211 		mutex_exit(&map->misc_lock);
1212 		goto retry;
1213 	}
1214 
1215 #ifdef PMAP_GROWKERNEL
1216 	/*
1217 	 * If the kernel pmap can't map the requested space,
1218 	 * then allocate more resources for it.
1219 	 */
1220 	if (map == kernel_map && uvm_maxkaddr < (start + size))
1221 		uvm_maxkaddr = pmap_growkernel(start + size);
1222 #endif
1223 
1224 	UVMMAP_EVCNT_INCR(map_call);
1225 
1226 	/*
1227 	 * if uobj is null, then uoffset is either a VAC hint for PMAP_PREFER
1228 	 * [typically from uvm_map_reserve] or it is UVM_UNKNOWN_OFFSET.   in
1229 	 * either case we want to zero it  before storing it in the map entry
1230 	 * (because it looks strange and confusing when debugging...)
1231 	 *
1232 	 * if uobj is not null
1233 	 *   if uoffset is not UVM_UNKNOWN_OFFSET then we have a normal mapping
1234 	 *      and we do not need to change uoffset.
1235 	 *   if uoffset is UVM_UNKNOWN_OFFSET then we need to find the offset
1236 	 *      now (based on the starting address of the map).   this case is
1237 	 *      for kernel object mappings where we don't know the offset until
1238 	 *      the virtual address is found (with uvm_map_findspace).   the
1239 	 *      offset is the distance we are from the start of the map.
1240 	 */
1241 
1242 	if (uobj == NULL) {
1243 		uoffset = 0;
1244 	} else {
1245 		if (uoffset == UVM_UNKNOWN_OFFSET) {
1246 			KASSERT(UVM_OBJ_IS_KERN_OBJECT(uobj));
1247 			uoffset = start - vm_map_min(kernel_map);
1248 		}
1249 	}
1250 
1251 	args->uma_flags = flags;
1252 	args->uma_prev = prev_entry;
1253 	args->uma_start = start;
1254 	args->uma_size = size;
1255 	args->uma_uobj = uobj;
1256 	args->uma_uoffset = uoffset;
1257 
1258 	UVMHIST_LOG(maphist, "<- done!", 0,0,0,0);
1259 	return 0;
1260 }
1261 
1262 /*
1263  * uvm_map_enter:
1264  *
1265  * called with map locked.
1266  * unlock the map before returning.
1267  */
1268 
1269 int
1270 uvm_map_enter(struct vm_map *map, const struct uvm_map_args *args,
1271     struct vm_map_entry *new_entry)
1272 {
1273 	struct vm_map_entry *prev_entry = args->uma_prev;
1274 	struct vm_map_entry *dead = NULL, *dead_entries = NULL;
1275 
1276 	const uvm_flag_t flags = args->uma_flags;
1277 	const vm_prot_t prot = UVM_PROTECTION(flags);
1278 	const vm_prot_t maxprot = UVM_MAXPROTECTION(flags);
1279 	const vm_inherit_t inherit = UVM_INHERIT(flags);
1280 	const int amapwaitflag = (flags & UVM_FLAG_NOWAIT) ?
1281 	    AMAP_EXTEND_NOWAIT : 0;
1282 	const int advice = UVM_ADVICE(flags);
1283 
1284 	vaddr_t start = args->uma_start;
1285 	vsize_t size = args->uma_size;
1286 	struct uvm_object *uobj = args->uma_uobj;
1287 	voff_t uoffset = args->uma_uoffset;
1288 
1289 	const int kmap = (vm_map_pmap(map) == pmap_kernel());
1290 	int merged = 0;
1291 	int error;
1292 	int newetype;
1293 
1294 	UVMHIST_FUNC(__func__);
1295 	UVMHIST_CALLARGS(maphist, "(map=%#jx, start=%#jx, size=%ju, flags=%#jx)",
1296 	    (uintptr_t)map, start, size, flags);
1297 	UVMHIST_LOG(maphist, "  uobj/offset %#jx/%jd", (uintptr_t)uobj,
1298 	    uoffset,0,0);
1299 
1300 	KASSERT(map->hint == prev_entry); /* bimerge case assumes this */
1301 	KASSERT(vm_map_locked_p(map));
1302 	KASSERT((flags & (UVM_FLAG_NOWAIT | UVM_FLAG_UNMAP)) !=
1303 		(UVM_FLAG_NOWAIT | UVM_FLAG_UNMAP));
1304 
1305 	if (uobj)
1306 		newetype = UVM_ET_OBJ;
1307 	else
1308 		newetype = 0;
1309 
1310 	if (flags & UVM_FLAG_COPYONW) {
1311 		newetype |= UVM_ET_COPYONWRITE;
1312 		if ((flags & UVM_FLAG_OVERLAY) == 0)
1313 			newetype |= UVM_ET_NEEDSCOPY;
1314 	}
1315 
1316 	/*
1317 	 * For mappings with unmap, remove any old entries now.  Adding the new
1318 	 * entry cannot fail because that can only happen if UVM_FLAG_NOWAIT
1319 	 * is set, and we do not support nowait and unmap together.
1320 	 */
1321 
1322 	if (flags & UVM_FLAG_UNMAP) {
1323 		KASSERT(flags & UVM_FLAG_FIXED);
1324 		uvm_unmap_remove(map, start, start + size, &dead_entries, 0);
1325 #ifdef DEBUG
1326 		struct vm_map_entry *tmp_entry __diagused;
1327 		bool rv __diagused;
1328 
1329 		rv = uvm_map_lookup_entry(map, start, &tmp_entry);
1330 		KASSERT(!rv);
1331 		KASSERTMSG(prev_entry == tmp_entry,
1332 			   "args %p prev_entry %p tmp_entry %p",
1333 			   args, prev_entry, tmp_entry);
1334 #endif
1335 		SAVE_HINT(map, map->hint, prev_entry);
1336 	}
1337 
1338 	/*
1339 	 * try and insert in map by extending previous entry, if possible.
1340 	 * XXX: we don't try and pull back the next entry.   might be useful
1341 	 * for a stack, but we are currently allocating our stack in advance.
1342 	 */
1343 
1344 	if (flags & UVM_FLAG_NOMERGE)
1345 		goto nomerge;
1346 
1347 	if (prev_entry->end == start &&
1348 	    prev_entry != &map->header &&
1349 	    UVM_ET_ISCOMPATIBLE(prev_entry, newetype, uobj, 0,
1350 	    prot, maxprot, inherit, advice, 0)) {
1351 
1352 		if (uobj && prev_entry->offset +
1353 		    (prev_entry->end - prev_entry->start) != uoffset)
1354 			goto forwardmerge;
1355 
1356 		/*
1357 		 * can't extend a shared amap.  note: no need to lock amap to
1358 		 * look at refs since we don't care about its exact value.
1359 		 * if it is one (i.e. we have only reference) it will stay there
1360 		 */
1361 
1362 		if (prev_entry->aref.ar_amap &&
1363 		    amap_refs(prev_entry->aref.ar_amap) != 1) {
1364 			goto forwardmerge;
1365 		}
1366 
1367 		if (prev_entry->aref.ar_amap) {
1368 			error = amap_extend(prev_entry, size,
1369 			    amapwaitflag | AMAP_EXTEND_FORWARDS);
1370 			if (error)
1371 				goto nomerge;
1372 		}
1373 
1374 		if (kmap) {
1375 			UVMMAP_EVCNT_INCR(kbackmerge);
1376 		} else {
1377 			UVMMAP_EVCNT_INCR(ubackmerge);
1378 		}
1379 		UVMHIST_LOG(maphist,"  starting back merge", 0, 0, 0, 0);
1380 
1381 		/*
1382 		 * drop our reference to uobj since we are extending a reference
1383 		 * that we already have (the ref count can not drop to zero).
1384 		 */
1385 
1386 		if (uobj && uobj->pgops->pgo_detach)
1387 			uobj->pgops->pgo_detach(uobj);
1388 
1389 		/*
1390 		 * Now that we've merged the entries, note that we've grown
1391 		 * and our gap has shrunk.  Then fix the tree.
1392 		 */
1393 		prev_entry->end += size;
1394 		prev_entry->gap -= size;
1395 		uvm_rb_fixup(map, prev_entry);
1396 
1397 		uvm_map_check(map, "map backmerged");
1398 
1399 		UVMHIST_LOG(maphist,"<- done (via backmerge)!", 0, 0, 0, 0);
1400 		merged++;
1401 	}
1402 
1403 forwardmerge:
1404 	if (prev_entry->next->start == (start + size) &&
1405 	    prev_entry->next != &map->header &&
1406 	    UVM_ET_ISCOMPATIBLE(prev_entry->next, newetype, uobj, 0,
1407 	    prot, maxprot, inherit, advice, 0)) {
1408 
1409 		if (uobj && prev_entry->next->offset != uoffset + size)
1410 			goto nomerge;
1411 
1412 		/*
1413 		 * can't extend a shared amap.  note: no need to lock amap to
1414 		 * look at refs since we don't care about its exact value.
1415 		 * if it is one (i.e. we have only reference) it will stay there.
1416 		 *
1417 		 * note that we also can't merge two amaps, so if we
1418 		 * merged with the previous entry which has an amap,
1419 		 * and the next entry also has an amap, we give up.
1420 		 *
1421 		 * Interesting cases:
1422 		 * amap, new, amap -> give up second merge (single fwd extend)
1423 		 * amap, new, none -> double forward extend (extend again here)
1424 		 * none, new, amap -> double backward extend (done here)
1425 		 * uobj, new, amap -> single backward extend (done here)
1426 		 *
1427 		 * XXX should we attempt to deal with someone refilling
1428 		 * the deallocated region between two entries that are
1429 		 * backed by the same amap (ie, arefs is 2, "prev" and
1430 		 * "next" refer to it, and adding this allocation will
1431 		 * close the hole, thus restoring arefs to 1 and
1432 		 * deallocating the "next" vm_map_entry)?  -- @@@
1433 		 */
1434 
1435 		if (prev_entry->next->aref.ar_amap &&
1436 		    (amap_refs(prev_entry->next->aref.ar_amap) != 1 ||
1437 		     (merged && prev_entry->aref.ar_amap))) {
1438 			goto nomerge;
1439 		}
1440 
1441 		if (merged) {
1442 			/*
1443 			 * Try to extend the amap of the previous entry to
1444 			 * cover the next entry as well.  If it doesn't work
1445 			 * just skip on, don't actually give up, since we've
1446 			 * already completed the back merge.
1447 			 */
1448 			if (prev_entry->aref.ar_amap) {
1449 				if (amap_extend(prev_entry,
1450 				    prev_entry->next->end -
1451 				    prev_entry->next->start,
1452 				    amapwaitflag | AMAP_EXTEND_FORWARDS))
1453 					goto nomerge;
1454 			}
1455 
1456 			/*
1457 			 * Try to extend the amap of the *next* entry
1458 			 * back to cover the new allocation *and* the
1459 			 * previous entry as well (the previous merge
1460 			 * didn't have an amap already otherwise we
1461 			 * wouldn't be checking here for an amap).  If
1462 			 * it doesn't work just skip on, again, don't
1463 			 * actually give up, since we've already
1464 			 * completed the back merge.
1465 			 */
1466 			else if (prev_entry->next->aref.ar_amap) {
1467 				if (amap_extend(prev_entry->next,
1468 				    prev_entry->end -
1469 				    prev_entry->start,
1470 				    amapwaitflag | AMAP_EXTEND_BACKWARDS))
1471 					goto nomerge;
1472 			}
1473 		} else {
1474 			/*
1475 			 * Pull the next entry's amap backwards to cover this
1476 			 * new allocation.
1477 			 */
1478 			if (prev_entry->next->aref.ar_amap) {
1479 				error = amap_extend(prev_entry->next, size,
1480 				    amapwaitflag | AMAP_EXTEND_BACKWARDS);
1481 				if (error)
1482 					goto nomerge;
1483 			}
1484 		}
1485 
1486 		if (merged) {
1487 			if (kmap) {
1488 				UVMMAP_EVCNT_DECR(kbackmerge);
1489 				UVMMAP_EVCNT_INCR(kbimerge);
1490 			} else {
1491 				UVMMAP_EVCNT_DECR(ubackmerge);
1492 				UVMMAP_EVCNT_INCR(ubimerge);
1493 			}
1494 		} else {
1495 			if (kmap) {
1496 				UVMMAP_EVCNT_INCR(kforwmerge);
1497 			} else {
1498 				UVMMAP_EVCNT_INCR(uforwmerge);
1499 			}
1500 		}
1501 		UVMHIST_LOG(maphist,"  starting forward merge", 0, 0, 0, 0);
1502 
1503 		/*
1504 		 * drop our reference to uobj since we are extending a reference
1505 		 * that we already have (the ref count can not drop to zero).
1506 		 */
1507 		if (uobj && uobj->pgops->pgo_detach)
1508 			uobj->pgops->pgo_detach(uobj);
1509 
1510 		if (merged) {
1511 			dead = prev_entry->next;
1512 			prev_entry->end = dead->end;
1513 			uvm_map_entry_unlink(map, dead);
1514 			if (dead->aref.ar_amap != NULL) {
1515 				prev_entry->aref = dead->aref;
1516 				dead->aref.ar_amap = NULL;
1517 			}
1518 		} else {
1519 			prev_entry->next->start -= size;
1520 			if (prev_entry != &map->header) {
1521 				prev_entry->gap -= size;
1522 				KASSERT(prev_entry->gap == uvm_rb_gap(prev_entry));
1523 				uvm_rb_fixup(map, prev_entry);
1524 			}
1525 			if (uobj)
1526 				prev_entry->next->offset = uoffset;
1527 		}
1528 
1529 		uvm_map_check(map, "map forwardmerged");
1530 
1531 		UVMHIST_LOG(maphist,"<- done forwardmerge", 0, 0, 0, 0);
1532 		merged++;
1533 	}
1534 
1535 nomerge:
1536 	if (!merged) {
1537 		UVMHIST_LOG(maphist,"  allocating new map entry", 0, 0, 0, 0);
1538 		if (kmap) {
1539 			UVMMAP_EVCNT_INCR(knomerge);
1540 		} else {
1541 			UVMMAP_EVCNT_INCR(unomerge);
1542 		}
1543 
1544 		/*
1545 		 * allocate new entry and link it in.
1546 		 */
1547 
1548 		if (new_entry == NULL) {
1549 			new_entry = uvm_mapent_alloc(map,
1550 				(flags & UVM_FLAG_NOWAIT));
1551 			if (__predict_false(new_entry == NULL)) {
1552 				error = ENOMEM;
1553 				goto done;
1554 			}
1555 		}
1556 		new_entry->start = start;
1557 		new_entry->end = new_entry->start + size;
1558 		new_entry->object.uvm_obj = uobj;
1559 		new_entry->offset = uoffset;
1560 
1561 		new_entry->etype = newetype;
1562 
1563 		if (flags & UVM_FLAG_NOMERGE) {
1564 			new_entry->flags |= UVM_MAP_NOMERGE;
1565 		}
1566 
1567 		new_entry->protection = prot;
1568 		new_entry->max_protection = maxprot;
1569 		new_entry->inheritance = inherit;
1570 		new_entry->wired_count = 0;
1571 		new_entry->advice = advice;
1572 		if (flags & UVM_FLAG_OVERLAY) {
1573 
1574 			/*
1575 			 * to_add: for BSS we overallocate a little since we
1576 			 * are likely to extend
1577 			 */
1578 
1579 			vaddr_t to_add = (flags & UVM_FLAG_AMAPPAD) ?
1580 				UVM_AMAP_CHUNK << PAGE_SHIFT : 0;
1581 			struct vm_amap *amap = amap_alloc(size, to_add,
1582 			    (flags & UVM_FLAG_NOWAIT));
1583 			if (__predict_false(amap == NULL)) {
1584 				error = ENOMEM;
1585 				goto done;
1586 			}
1587 			new_entry->aref.ar_pageoff = 0;
1588 			new_entry->aref.ar_amap = amap;
1589 		} else {
1590 			new_entry->aref.ar_pageoff = 0;
1591 			new_entry->aref.ar_amap = NULL;
1592 		}
1593 		uvm_map_entry_link(map, prev_entry, new_entry);
1594 
1595 		/*
1596 		 * Update the free space hint
1597 		 */
1598 
1599 		if ((map->first_free == prev_entry) &&
1600 		    (prev_entry->end >= new_entry->start))
1601 			map->first_free = new_entry;
1602 
1603 		new_entry = NULL;
1604 	}
1605 
1606 	map->size += size;
1607 
1608 	UVMHIST_LOG(maphist,"<- done!", 0, 0, 0, 0);
1609 
1610 	error = 0;
1611 
1612 done:
1613 	vm_map_unlock(map);
1614 
1615 	if (new_entry) {
1616 		uvm_mapent_free(new_entry);
1617 	}
1618 	if (dead) {
1619 		KDASSERT(merged);
1620 		uvm_mapent_free(dead);
1621 	}
1622 	if (dead_entries)
1623 		uvm_unmap_detach(dead_entries, 0);
1624 
1625 	return error;
1626 }
1627 
1628 /*
1629  * uvm_map_lookup_entry_bytree: lookup an entry in tree
1630  */
1631 
1632 static inline bool
1633 uvm_map_lookup_entry_bytree(struct vm_map *map, vaddr_t address,
1634     struct vm_map_entry **entry	/* OUT */)
1635 {
1636 	struct vm_map_entry *prev = &map->header;
1637 	struct vm_map_entry *cur = ROOT_ENTRY(map);
1638 
1639 	while (cur) {
1640 		UVMMAP_EVCNT_INCR(mlk_treeloop);
1641 		if (address >= cur->start) {
1642 			if (address < cur->end) {
1643 				*entry = cur;
1644 				return true;
1645 			}
1646 			prev = cur;
1647 			cur = RIGHT_ENTRY(cur);
1648 		} else
1649 			cur = LEFT_ENTRY(cur);
1650 	}
1651 	*entry = prev;
1652 	return false;
1653 }
1654 
1655 /*
1656  * uvm_map_lookup_entry: find map entry at or before an address
1657  *
1658  * => map must at least be read-locked by caller
1659  * => entry is returned in "entry"
1660  * => return value is true if address is in the returned entry
1661  */
1662 
1663 bool
1664 uvm_map_lookup_entry(struct vm_map *map, vaddr_t address,
1665     struct vm_map_entry **entry	/* OUT */)
1666 {
1667 	struct vm_map_entry *cur;
1668 	UVMHIST_FUNC(__func__);
1669 	UVMHIST_CALLARGS(maphist,"(map=%#jx,addr=%#jx,ent=%#jx)",
1670 	    (uintptr_t)map, address, (uintptr_t)entry, 0);
1671 
1672 	/*
1673 	 * make a quick check to see if we are already looking at
1674 	 * the entry we want (which is usually the case).  note also
1675 	 * that we don't need to save the hint here...  it is the
1676 	 * same hint (unless we are at the header, in which case the
1677 	 * hint didn't buy us anything anyway).
1678 	 */
1679 
1680 	cur = map->hint;
1681 	UVMMAP_EVCNT_INCR(mlk_call);
1682 	if (cur != &map->header &&
1683 	    address >= cur->start && cur->end > address) {
1684 		UVMMAP_EVCNT_INCR(mlk_hint);
1685 		*entry = cur;
1686 		UVMHIST_LOG(maphist,"<- got it via hint (%#jx)",
1687 		    (uintptr_t)cur, 0, 0, 0);
1688 		uvm_mapent_check(*entry);
1689 		return (true);
1690 	}
1691 	uvm_map_check(map, __func__);
1692 
1693 	/*
1694 	 * lookup in the tree.
1695 	 */
1696 
1697 	UVMMAP_EVCNT_INCR(mlk_tree);
1698 	if (__predict_true(uvm_map_lookup_entry_bytree(map, address, entry))) {
1699 		SAVE_HINT(map, map->hint, *entry);
1700 		UVMHIST_LOG(maphist,"<- search got it (%#jx)",
1701 		    (uintptr_t)cur, 0, 0, 0);
1702 		KDASSERT((*entry)->start <= address);
1703 		KDASSERT(address < (*entry)->end);
1704 		uvm_mapent_check(*entry);
1705 		return (true);
1706 	}
1707 
1708 	SAVE_HINT(map, map->hint, *entry);
1709 	UVMHIST_LOG(maphist,"<- failed!",0,0,0,0);
1710 	KDASSERT((*entry) == &map->header || (*entry)->end <= address);
1711 	KDASSERT((*entry)->next == &map->header ||
1712 	    address < (*entry)->next->start);
1713 	return (false);
1714 }
1715 
1716 /*
1717  * See if the range between start and start + length fits in the gap
1718  * entry->next->start and entry->end.  Returns 1 if fits, 0 if doesn't
1719  * fit, and -1 address wraps around.
1720  */
1721 static int
1722 uvm_map_space_avail(vaddr_t *start, vsize_t length, voff_t uoffset,
1723     vsize_t align, int flags, int topdown, struct vm_map_entry *entry)
1724 {
1725 	vaddr_t end;
1726 
1727 #ifdef PMAP_PREFER
1728 	/*
1729 	 * push start address forward as needed to avoid VAC alias problems.
1730 	 * we only do this if a valid offset is specified.
1731 	 */
1732 
1733 	if (uoffset != UVM_UNKNOWN_OFFSET)
1734 		PMAP_PREFER(uoffset, start, length, topdown);
1735 #endif
1736 	if ((flags & UVM_FLAG_COLORMATCH) != 0) {
1737 		KASSERT(align < uvmexp.ncolors);
1738 		if (uvmexp.ncolors > 1) {
1739 			const u_int colormask = uvmexp.colormask;
1740 			const u_int colorsize = colormask + 1;
1741 			vaddr_t hint = atop(*start);
1742 			const u_int color = hint & colormask;
1743 			if (color != align) {
1744 				hint -= color;	/* adjust to color boundary */
1745 				KASSERT((hint & colormask) == 0);
1746 				if (topdown) {
1747 					if (align > color)
1748 						hint -= colorsize;
1749 				} else {
1750 					if (align < color)
1751 						hint += colorsize;
1752 				}
1753 				*start = ptoa(hint + align); /* adjust to color */
1754 			}
1755 		}
1756 	} else {
1757 		KASSERT(powerof2(align));
1758 		uvm_map_align_va(start, align, topdown);
1759 		/*
1760 		 * XXX Should we PMAP_PREFER() here again?
1761 		 * eh...i think we're okay
1762 		 */
1763 	}
1764 
1765 	/*
1766 	 * Find the end of the proposed new region.  Be sure we didn't
1767 	 * wrap around the address; if so, we lose.  Otherwise, if the
1768 	 * proposed new region fits before the next entry, we win.
1769 	 */
1770 
1771 	end = *start + length;
1772 	if (end < *start)
1773 		return (-1);
1774 
1775 	if (entry->next->start >= end && *start >= entry->end)
1776 		return (1);
1777 
1778 	return (0);
1779 }
1780 
1781 /*
1782  * uvm_map_findspace: find "length" sized space in "map".
1783  *
1784  * => "hint" is a hint about where we want it, unless UVM_FLAG_FIXED is
1785  *	set in "flags" (in which case we insist on using "hint").
1786  * => "result" is VA returned
1787  * => uobj/uoffset are to be used to handle VAC alignment, if required
1788  * => if "align" is non-zero, we attempt to align to that value.
1789  * => caller must at least have read-locked map
1790  * => returns NULL on failure, or pointer to prev. map entry if success
1791  * => note this is a cross between the old vm_map_findspace and vm_map_find
1792  */
1793 
1794 struct vm_map_entry *
1795 uvm_map_findspace(struct vm_map *map, vaddr_t hint, vsize_t length,
1796     vaddr_t *result /* OUT */, struct uvm_object *uobj, voff_t uoffset,
1797     vsize_t align, int flags)
1798 {
1799 	struct vm_map_entry *entry;
1800 	struct vm_map_entry *child, *prev, *tmp;
1801 	vaddr_t orig_hint __diagused;
1802 	const int topdown = map->flags & VM_MAP_TOPDOWN;
1803 	UVMHIST_FUNC(__func__);
1804 	UVMHIST_CALLARGS(maphist, "(map=%#jx, hint=%#jx, len=%ju, flags=%#jx)",
1805 	    (uintptr_t)map, hint, length, flags);
1806 
1807 	KASSERT((flags & UVM_FLAG_COLORMATCH) != 0 || powerof2(align));
1808 	KASSERT((flags & UVM_FLAG_COLORMATCH) == 0 || align < uvmexp.ncolors);
1809 	KASSERT((flags & UVM_FLAG_FIXED) == 0 || align == 0);
1810 
1811 	uvm_map_check(map, "map_findspace entry");
1812 
1813 	/*
1814 	 * remember the original hint.  if we are aligning, then we
1815 	 * may have to try again with no alignment constraint if
1816 	 * we fail the first time.
1817 	 */
1818 
1819 	orig_hint = hint;
1820 	if (hint < vm_map_min(map)) {	/* check ranges ... */
1821 		if (flags & UVM_FLAG_FIXED) {
1822 			UVMHIST_LOG(maphist,"<- VA below map range",0,0,0,0);
1823 			return (NULL);
1824 		}
1825 		hint = vm_map_min(map);
1826 	}
1827 	if (hint > vm_map_max(map)) {
1828 		UVMHIST_LOG(maphist,"<- VA %#jx > range [%#jx->%#jx]",
1829 		    hint, vm_map_min(map), vm_map_max(map), 0);
1830 		return (NULL);
1831 	}
1832 
1833 	/*
1834 	 * hint may not be aligned properly; we need round up or down it
1835 	 * before proceeding further.
1836 	 */
1837 	if ((flags & UVM_FLAG_COLORMATCH) == 0)
1838 		uvm_map_align_va(&hint, align, topdown);
1839 
1840 	/*
1841 	 * Look for the first possible address; if there's already
1842 	 * something at this address, we have to start after it.
1843 	 */
1844 
1845 	/*
1846 	 * @@@: there are four, no, eight cases to consider.
1847 	 *
1848 	 * 0: found,     fixed,     bottom up -> fail
1849 	 * 1: found,     fixed,     top down  -> fail
1850 	 * 2: found,     not fixed, bottom up -> start after entry->end,
1851 	 *                                       loop up
1852 	 * 3: found,     not fixed, top down  -> start before entry->start,
1853 	 *                                       loop down
1854 	 * 4: not found, fixed,     bottom up -> check entry->next->start, fail
1855 	 * 5: not found, fixed,     top down  -> check entry->next->start, fail
1856 	 * 6: not found, not fixed, bottom up -> check entry->next->start,
1857 	 *                                       loop up
1858 	 * 7: not found, not fixed, top down  -> check entry->next->start,
1859 	 *                                       loop down
1860 	 *
1861 	 * as you can see, it reduces to roughly five cases, and that
1862 	 * adding top down mapping only adds one unique case (without
1863 	 * it, there would be four cases).
1864 	 */
1865 
1866 	if ((flags & UVM_FLAG_FIXED) == 0 && hint == vm_map_min(map)) {
1867 		entry = map->first_free;
1868 	} else {
1869 		if (uvm_map_lookup_entry(map, hint, &entry)) {
1870 			/* "hint" address already in use ... */
1871 			if (flags & UVM_FLAG_FIXED) {
1872 				UVMHIST_LOG(maphist, "<- fixed & VA in use",
1873 				    0, 0, 0, 0);
1874 				return (NULL);
1875 			}
1876 			if (topdown)
1877 				/* Start from lower gap. */
1878 				entry = entry->prev;
1879 		} else if (flags & UVM_FLAG_FIXED) {
1880 			if (entry->next->start >= hint + length &&
1881 			    hint + length > hint)
1882 				goto found;
1883 
1884 			/* "hint" address is gap but too small */
1885 			UVMHIST_LOG(maphist, "<- fixed mapping failed",
1886 			    0, 0, 0, 0);
1887 			return (NULL); /* only one shot at it ... */
1888 		} else {
1889 			/*
1890 			 * See if given hint fits in this gap.
1891 			 */
1892 			switch (uvm_map_space_avail(&hint, length,
1893 			    uoffset, align, flags, topdown, entry)) {
1894 			case 1:
1895 				goto found;
1896 			case -1:
1897 				goto wraparound;
1898 			}
1899 
1900 			if (topdown) {
1901 				/*
1902 				 * Still there is a chance to fit
1903 				 * if hint > entry->end.
1904 				 */
1905 			} else {
1906 				/* Start from higher gap. */
1907 				entry = entry->next;
1908 				if (entry == &map->header)
1909 					goto notfound;
1910 				goto nextgap;
1911 			}
1912 		}
1913 	}
1914 
1915 	/*
1916 	 * Note that all UVM_FLAGS_FIXED case is already handled.
1917 	 */
1918 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
1919 
1920 	/* Try to find the space in the red-black tree */
1921 
1922 	/* Check slot before any entry */
1923 	hint = topdown ? entry->next->start - length : entry->end;
1924 	switch (uvm_map_space_avail(&hint, length, uoffset, align, flags,
1925 	    topdown, entry)) {
1926 	case 1:
1927 		goto found;
1928 	case -1:
1929 		goto wraparound;
1930 	}
1931 
1932 nextgap:
1933 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
1934 	/* If there is not enough space in the whole tree, we fail */
1935 	tmp = ROOT_ENTRY(map);
1936 	if (tmp == NULL || tmp->maxgap < length)
1937 		goto notfound;
1938 
1939 	prev = NULL; /* previous candidate */
1940 
1941 	/* Find an entry close to hint that has enough space */
1942 	for (; tmp;) {
1943 		KASSERT(tmp->next->start == tmp->end + tmp->gap);
1944 		if (topdown) {
1945 			if (tmp->next->start < hint + length &&
1946 			    (prev == NULL || tmp->end > prev->end)) {
1947 				if (tmp->gap >= length)
1948 					prev = tmp;
1949 				else if ((child = LEFT_ENTRY(tmp)) != NULL
1950 				    && child->maxgap >= length)
1951 					prev = tmp;
1952 			}
1953 		} else {
1954 			if (tmp->end >= hint &&
1955 			    (prev == NULL || tmp->end < prev->end)) {
1956 				if (tmp->gap >= length)
1957 					prev = tmp;
1958 				else if ((child = RIGHT_ENTRY(tmp)) != NULL
1959 				    && child->maxgap >= length)
1960 					prev = tmp;
1961 			}
1962 		}
1963 		if (tmp->next->start < hint + length)
1964 			child = RIGHT_ENTRY(tmp);
1965 		else if (tmp->end > hint)
1966 			child = LEFT_ENTRY(tmp);
1967 		else {
1968 			if (tmp->gap >= length)
1969 				break;
1970 			if (topdown)
1971 				child = LEFT_ENTRY(tmp);
1972 			else
1973 				child = RIGHT_ENTRY(tmp);
1974 		}
1975 		if (child == NULL || child->maxgap < length)
1976 			break;
1977 		tmp = child;
1978 	}
1979 
1980 	if (tmp != NULL && tmp->start < hint && hint < tmp->next->start) {
1981 		/*
1982 		 * Check if the entry that we found satifies the
1983 		 * space requirement
1984 		 */
1985 		if (topdown) {
1986 			if (hint > tmp->next->start - length)
1987 				hint = tmp->next->start - length;
1988 		} else {
1989 			if (hint < tmp->end)
1990 				hint = tmp->end;
1991 		}
1992 		switch (uvm_map_space_avail(&hint, length, uoffset, align,
1993 		    flags, topdown, tmp)) {
1994 		case 1:
1995 			entry = tmp;
1996 			goto found;
1997 		case -1:
1998 			goto wraparound;
1999 		}
2000 		if (tmp->gap >= length)
2001 			goto listsearch;
2002 	}
2003 	if (prev == NULL)
2004 		goto notfound;
2005 
2006 	if (topdown) {
2007 		KASSERT(orig_hint >= prev->next->start - length ||
2008 		    prev->next->start - length > prev->next->start);
2009 		hint = prev->next->start - length;
2010 	} else {
2011 		KASSERT(orig_hint <= prev->end);
2012 		hint = prev->end;
2013 	}
2014 	switch (uvm_map_space_avail(&hint, length, uoffset, align,
2015 	    flags, topdown, prev)) {
2016 	case 1:
2017 		entry = prev;
2018 		goto found;
2019 	case -1:
2020 		goto wraparound;
2021 	}
2022 	if (prev->gap >= length)
2023 		goto listsearch;
2024 
2025 	if (topdown)
2026 		tmp = LEFT_ENTRY(prev);
2027 	else
2028 		tmp = RIGHT_ENTRY(prev);
2029 	for (;;) {
2030 		KASSERT(tmp && tmp->maxgap >= length);
2031 		if (topdown)
2032 			child = RIGHT_ENTRY(tmp);
2033 		else
2034 			child = LEFT_ENTRY(tmp);
2035 		if (child && child->maxgap >= length) {
2036 			tmp = child;
2037 			continue;
2038 		}
2039 		if (tmp->gap >= length)
2040 			break;
2041 		if (topdown)
2042 			tmp = LEFT_ENTRY(tmp);
2043 		else
2044 			tmp = RIGHT_ENTRY(tmp);
2045 	}
2046 
2047 	if (topdown) {
2048 		KASSERT(orig_hint >= tmp->next->start - length ||
2049 		    tmp->next->start - length > tmp->next->start);
2050 		hint = tmp->next->start - length;
2051 	} else {
2052 		KASSERT(orig_hint <= tmp->end);
2053 		hint = tmp->end;
2054 	}
2055 	switch (uvm_map_space_avail(&hint, length, uoffset, align,
2056 	    flags, topdown, tmp)) {
2057 	case 1:
2058 		entry = tmp;
2059 		goto found;
2060 	case -1:
2061 		goto wraparound;
2062 	}
2063 
2064 	/*
2065 	 * The tree fails to find an entry because of offset or alignment
2066 	 * restrictions.  Search the list instead.
2067 	 */
2068  listsearch:
2069 	/*
2070 	 * Look through the rest of the map, trying to fit a new region in
2071 	 * the gap between existing regions, or after the very last region.
2072 	 * note: entry->end = base VA of current gap,
2073 	 *	 entry->next->start = VA of end of current gap
2074 	 */
2075 
2076 	for (;;) {
2077 		/* Update hint for current gap. */
2078 		hint = topdown ? entry->next->start - length : entry->end;
2079 
2080 		/* See if it fits. */
2081 		switch (uvm_map_space_avail(&hint, length, uoffset, align,
2082 		    flags, topdown, entry)) {
2083 		case 1:
2084 			goto found;
2085 		case -1:
2086 			goto wraparound;
2087 		}
2088 
2089 		/* Advance to next/previous gap */
2090 		if (topdown) {
2091 			if (entry == &map->header) {
2092 				UVMHIST_LOG(maphist, "<- failed (off start)",
2093 				    0,0,0,0);
2094 				goto notfound;
2095 			}
2096 			entry = entry->prev;
2097 		} else {
2098 			entry = entry->next;
2099 			if (entry == &map->header) {
2100 				UVMHIST_LOG(maphist, "<- failed (off end)",
2101 				    0,0,0,0);
2102 				goto notfound;
2103 			}
2104 		}
2105 	}
2106 
2107  found:
2108 	SAVE_HINT(map, map->hint, entry);
2109 	*result = hint;
2110 	UVMHIST_LOG(maphist,"<- got it!  (result=%#jx)", hint, 0,0,0);
2111 	KASSERTMSG( topdown || hint >= orig_hint, "hint: %#jx, orig_hint: %#jx",
2112 	    (uintmax_t)hint, (uintmax_t)orig_hint);
2113 	KASSERTMSG(!topdown || hint <= orig_hint, "hint: %#jx, orig_hint: %#jx",
2114 	    (uintmax_t)hint, (uintmax_t)orig_hint);
2115 	KASSERT(entry->end <= hint);
2116 	KASSERT(hint + length <= entry->next->start);
2117 	return (entry);
2118 
2119  wraparound:
2120 	UVMHIST_LOG(maphist, "<- failed (wrap around)", 0,0,0,0);
2121 
2122 	return (NULL);
2123 
2124  notfound:
2125 	UVMHIST_LOG(maphist, "<- failed (notfound)", 0,0,0,0);
2126 
2127 	return (NULL);
2128 }
2129 
2130 /*
2131  *   U N M A P   -   m a i n   h e l p e r   f u n c t i o n s
2132  */
2133 
2134 /*
2135  * uvm_unmap_remove: remove mappings from a vm_map (from "start" up to "stop")
2136  *
2137  * => caller must check alignment and size
2138  * => map must be locked by caller
2139  * => we return a list of map entries that we've remove from the map
2140  *    in "entry_list"
2141  */
2142 
2143 void
2144 uvm_unmap_remove(struct vm_map *map, vaddr_t start, vaddr_t end,
2145     struct vm_map_entry **entry_list /* OUT */, int flags)
2146 {
2147 	struct vm_map_entry *entry, *first_entry, *next;
2148 	vaddr_t len;
2149 	UVMHIST_FUNC(__func__);
2150 	UVMHIST_CALLARGS(maphist,"(map=%#jx, start=%#jx, end=%#jx)",
2151 	    (uintptr_t)map, start, end, 0);
2152 	VM_MAP_RANGE_CHECK(map, start, end);
2153 
2154 	uvm_map_check(map, "unmap_remove entry");
2155 
2156 	/*
2157 	 * find first entry
2158 	 */
2159 
2160 	if (uvm_map_lookup_entry(map, start, &first_entry) == true) {
2161 		/* clip and go... */
2162 		entry = first_entry;
2163 		UVM_MAP_CLIP_START(map, entry, start);
2164 		/* critical!  prevents stale hint */
2165 		SAVE_HINT(map, entry, entry->prev);
2166 	} else {
2167 		entry = first_entry->next;
2168 	}
2169 
2170 	/*
2171 	 * save the free space hint
2172 	 */
2173 
2174 	if (map->first_free != &map->header && map->first_free->start >= start)
2175 		map->first_free = entry->prev;
2176 
2177 	/*
2178 	 * note: we now re-use first_entry for a different task.  we remove
2179 	 * a number of map entries from the map and save them in a linked
2180 	 * list headed by "first_entry".  once we remove them from the map
2181 	 * the caller should unlock the map and drop the references to the
2182 	 * backing objects [c.f. uvm_unmap_detach].  the object is to
2183 	 * separate unmapping from reference dropping.  why?
2184 	 *   [1] the map has to be locked for unmapping
2185 	 *   [2] the map need not be locked for reference dropping
2186 	 *   [3] dropping references may trigger pager I/O, and if we hit
2187 	 *       a pager that does synchronous I/O we may have to wait for it.
2188 	 *   [4] we would like all waiting for I/O to occur with maps unlocked
2189 	 *       so that we don't block other threads.
2190 	 */
2191 
2192 	first_entry = NULL;
2193 	*entry_list = NULL;
2194 
2195 	/*
2196 	 * break up the area into map entry sized regions and unmap.  note
2197 	 * that all mappings have to be removed before we can even consider
2198 	 * dropping references to amaps or VM objects (otherwise we could end
2199 	 * up with a mapping to a page on the free list which would be very bad)
2200 	 */
2201 
2202 	while ((entry != &map->header) && (entry->start < end)) {
2203 		KASSERT((entry->flags & UVM_MAP_STATIC) == 0);
2204 
2205 		UVM_MAP_CLIP_END(map, entry, end);
2206 		next = entry->next;
2207 		len = entry->end - entry->start;
2208 
2209 		/*
2210 		 * unwire before removing addresses from the pmap; otherwise
2211 		 * unwiring will put the entries back into the pmap (XXX).
2212 		 */
2213 
2214 		if (VM_MAPENT_ISWIRED(entry)) {
2215 			uvm_map_entry_unwire(map, entry);
2216 		}
2217 		if (flags & UVM_FLAG_VAONLY) {
2218 
2219 			/* nothing */
2220 
2221 		} else if ((map->flags & VM_MAP_PAGEABLE) == 0) {
2222 
2223 			/*
2224 			 * if the map is non-pageable, any pages mapped there
2225 			 * must be wired and entered with pmap_kenter_pa(),
2226 			 * and we should free any such pages immediately.
2227 			 * this is mostly used for kmem_map.
2228 			 */
2229 			KASSERT(vm_map_pmap(map) == pmap_kernel());
2230 
2231 			uvm_km_pgremove_intrsafe(map, entry->start, entry->end);
2232 		} else if (UVM_ET_ISOBJ(entry) &&
2233 			   UVM_OBJ_IS_KERN_OBJECT(entry->object.uvm_obj)) {
2234 			panic("%s: kernel object %p %p\n",
2235 			    __func__, map, entry);
2236 		} else if (UVM_ET_ISOBJ(entry) || entry->aref.ar_amap) {
2237 			/*
2238 			 * remove mappings the standard way.  lock object
2239 			 * and/or amap to ensure vm_page state does not
2240 			 * change while in pmap_remove().
2241 			 */
2242 
2243 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
2244 			uvm_map_lock_entry(entry, RW_WRITER);
2245 #else
2246 			uvm_map_lock_entry(entry, RW_READER);
2247 #endif
2248 			pmap_remove(map->pmap, entry->start, entry->end);
2249 
2250 			/*
2251 			 * note: if map is dying, leave pmap_update() for
2252 			 * later.  if the map is to be reused (exec) then
2253 			 * pmap_update() will be called.  if the map is
2254 			 * being disposed of (exit) then pmap_destroy()
2255 			 * will be called.
2256 			 */
2257 
2258 			if ((map->flags & VM_MAP_DYING) == 0) {
2259 				pmap_update(vm_map_pmap(map));
2260 			} else {
2261 				KASSERT(vm_map_pmap(map) != pmap_kernel());
2262 			}
2263 
2264 			uvm_map_unlock_entry(entry);
2265 		}
2266 
2267 #if defined(UVMDEBUG)
2268 		/*
2269 		 * check if there's remaining mapping,
2270 		 * which is a bug in caller.
2271 		 */
2272 
2273 		vaddr_t va;
2274 		for (va = entry->start; va < entry->end;
2275 		    va += PAGE_SIZE) {
2276 			if (pmap_extract(vm_map_pmap(map), va, NULL)) {
2277 				panic("%s: %#"PRIxVADDR" has mapping",
2278 				    __func__, va);
2279 			}
2280 		}
2281 
2282 		if (VM_MAP_IS_KERNEL(map) && (flags & UVM_FLAG_NOWAIT) == 0) {
2283 			uvm_km_check_empty(map, entry->start,
2284 			    entry->end);
2285 		}
2286 #endif /* defined(UVMDEBUG) */
2287 
2288 		/*
2289 		 * remove entry from map and put it on our list of entries
2290 		 * that we've nuked.  then go to next entry.
2291 		 */
2292 
2293 		UVMHIST_LOG(maphist, "  removed map entry %#jx",
2294 		    (uintptr_t)entry, 0, 0, 0);
2295 
2296 		/* critical!  prevents stale hint */
2297 		SAVE_HINT(map, entry, entry->prev);
2298 
2299 		uvm_map_entry_unlink(map, entry);
2300 		KASSERT(map->size >= len);
2301 		map->size -= len;
2302 		entry->prev = NULL;
2303 		entry->next = first_entry;
2304 		first_entry = entry;
2305 		entry = next;
2306 	}
2307 
2308 	uvm_map_check(map, "unmap_remove leave");
2309 
2310 	/*
2311 	 * now we've cleaned up the map and are ready for the caller to drop
2312 	 * references to the mapped objects.
2313 	 */
2314 
2315 	*entry_list = first_entry;
2316 	UVMHIST_LOG(maphist,"<- done!", 0, 0, 0, 0);
2317 
2318 	if (map->flags & VM_MAP_WANTVA) {
2319 		mutex_enter(&map->misc_lock);
2320 		map->flags &= ~VM_MAP_WANTVA;
2321 		cv_broadcast(&map->cv);
2322 		mutex_exit(&map->misc_lock);
2323 	}
2324 }
2325 
2326 /*
2327  * uvm_unmap_detach: drop references in a chain of map entries
2328  *
2329  * => we will free the map entries as we traverse the list.
2330  */
2331 
2332 void
2333 uvm_unmap_detach(struct vm_map_entry *first_entry, int flags)
2334 {
2335 	struct vm_map_entry *next_entry;
2336 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
2337 
2338 	while (first_entry) {
2339 		KASSERT(!VM_MAPENT_ISWIRED(first_entry));
2340 		UVMHIST_LOG(maphist,
2341 		    "  detach %#jx: amap=%#jx, obj=%#jx, submap?=%jd",
2342 		    (uintptr_t)first_entry,
2343 		    (uintptr_t)first_entry->aref.ar_amap,
2344 		    (uintptr_t)first_entry->object.uvm_obj,
2345 		    UVM_ET_ISSUBMAP(first_entry));
2346 
2347 		/*
2348 		 * drop reference to amap, if we've got one
2349 		 */
2350 
2351 		if (first_entry->aref.ar_amap)
2352 			uvm_map_unreference_amap(first_entry, flags);
2353 
2354 		/*
2355 		 * drop reference to our backing object, if we've got one
2356 		 */
2357 
2358 		KASSERT(!UVM_ET_ISSUBMAP(first_entry));
2359 		if (UVM_ET_ISOBJ(first_entry) &&
2360 		    first_entry->object.uvm_obj->pgops->pgo_detach) {
2361 			(*first_entry->object.uvm_obj->pgops->pgo_detach)
2362 				(first_entry->object.uvm_obj);
2363 		}
2364 		next_entry = first_entry->next;
2365 		uvm_mapent_free(first_entry);
2366 		first_entry = next_entry;
2367 	}
2368 	UVMHIST_LOG(maphist, "<- done", 0,0,0,0);
2369 }
2370 
2371 /*
2372  *   E X T R A C T I O N   F U N C T I O N S
2373  */
2374 
2375 /*
2376  * uvm_map_reserve: reserve space in a vm_map for future use.
2377  *
2378  * => we reserve space in a map by putting a dummy map entry in the
2379  *    map (dummy means obj=NULL, amap=NULL, prot=VM_PROT_NONE)
2380  * => map should be unlocked (we will write lock it)
2381  * => we return true if we were able to reserve space
2382  * => XXXCDC: should be inline?
2383  */
2384 
2385 int
2386 uvm_map_reserve(struct vm_map *map, vsize_t size,
2387     vaddr_t offset	/* hint for pmap_prefer */,
2388     vsize_t align	/* alignment */,
2389     vaddr_t *raddr	/* IN:hint, OUT: reserved VA */,
2390     uvm_flag_t flags	/* UVM_FLAG_FIXED or UVM_FLAG_COLORMATCH or 0 */)
2391 {
2392 	UVMHIST_FUNC(__func__);
2393 	UVMHIST_CALLARGS(maphist, "(map=%#jx, size=%#jx, offset=%#jx, addr=%#jx)",
2394 	    (uintptr_t)map, size, offset, (uintptr_t)raddr);
2395 
2396 	size = round_page(size);
2397 
2398 	/*
2399 	 * reserve some virtual space.
2400 	 */
2401 
2402 	if (uvm_map(map, raddr, size, NULL, offset, align,
2403 	    UVM_MAPFLAG(UVM_PROT_NONE, UVM_PROT_NONE, UVM_INH_NONE,
2404 	    UVM_ADV_RANDOM, UVM_FLAG_NOMERGE|flags)) != 0) {
2405 	    UVMHIST_LOG(maphist, "<- done (no VM)", 0,0,0,0);
2406 		return (false);
2407 	}
2408 
2409 	UVMHIST_LOG(maphist, "<- done (*raddr=%#jx)", *raddr,0,0,0);
2410 	return (true);
2411 }
2412 
2413 /*
2414  * uvm_map_replace: replace a reserved (blank) area of memory with
2415  * real mappings.
2416  *
2417  * => caller must WRITE-LOCK the map
2418  * => we return true if replacement was a success
2419  * => we expect the newents chain to have nnewents entrys on it and
2420  *    we expect newents->prev to point to the last entry on the list
2421  * => note newents is allowed to be NULL
2422  */
2423 
2424 static int
2425 uvm_map_replace(struct vm_map *map, vaddr_t start, vaddr_t end,
2426     struct vm_map_entry *newents, int nnewents, vsize_t nsize,
2427     struct vm_map_entry **oldentryp)
2428 {
2429 	struct vm_map_entry *oldent, *last;
2430 
2431 	uvm_map_check(map, "map_replace entry");
2432 
2433 	/*
2434 	 * first find the blank map entry at the specified address
2435 	 */
2436 
2437 	if (!uvm_map_lookup_entry(map, start, &oldent)) {
2438 		return (false);
2439 	}
2440 
2441 	/*
2442 	 * check to make sure we have a proper blank entry
2443 	 */
2444 
2445 	if (end < oldent->end) {
2446 		UVM_MAP_CLIP_END(map, oldent, end);
2447 	}
2448 	if (oldent->start != start || oldent->end != end ||
2449 	    oldent->object.uvm_obj != NULL || oldent->aref.ar_amap != NULL) {
2450 		return (false);
2451 	}
2452 
2453 #ifdef DIAGNOSTIC
2454 
2455 	/*
2456 	 * sanity check the newents chain
2457 	 */
2458 
2459 	{
2460 		struct vm_map_entry *tmpent = newents;
2461 		int nent = 0;
2462 		vsize_t sz = 0;
2463 		vaddr_t cur = start;
2464 
2465 		while (tmpent) {
2466 			nent++;
2467 			sz += tmpent->end - tmpent->start;
2468 			if (tmpent->start < cur)
2469 				panic("uvm_map_replace1");
2470 			if (tmpent->start >= tmpent->end || tmpent->end > end) {
2471 				panic("uvm_map_replace2: "
2472 				    "tmpent->start=%#"PRIxVADDR
2473 				    ", tmpent->end=%#"PRIxVADDR
2474 				    ", end=%#"PRIxVADDR,
2475 				    tmpent->start, tmpent->end, end);
2476 			}
2477 			cur = tmpent->end;
2478 			if (tmpent->next) {
2479 				if (tmpent->next->prev != tmpent)
2480 					panic("uvm_map_replace3");
2481 			} else {
2482 				if (newents->prev != tmpent)
2483 					panic("uvm_map_replace4");
2484 			}
2485 			tmpent = tmpent->next;
2486 		}
2487 		if (nent != nnewents)
2488 			panic("uvm_map_replace5");
2489 		if (sz != nsize)
2490 			panic("uvm_map_replace6");
2491 	}
2492 #endif
2493 
2494 	/*
2495 	 * map entry is a valid blank!   replace it.   (this does all the
2496 	 * work of map entry link/unlink...).
2497 	 */
2498 
2499 	if (newents) {
2500 		last = newents->prev;
2501 
2502 		/* critical: flush stale hints out of map */
2503 		SAVE_HINT(map, map->hint, newents);
2504 		if (map->first_free == oldent)
2505 			map->first_free = last;
2506 
2507 		last->next = oldent->next;
2508 		last->next->prev = last;
2509 
2510 		/* Fix RB tree */
2511 		uvm_rb_remove(map, oldent);
2512 
2513 		newents->prev = oldent->prev;
2514 		newents->prev->next = newents;
2515 		map->nentries = map->nentries + (nnewents - 1);
2516 
2517 		/* Fixup the RB tree */
2518 		{
2519 			int i;
2520 			struct vm_map_entry *tmp;
2521 
2522 			tmp = newents;
2523 			for (i = 0; i < nnewents && tmp; i++) {
2524 				uvm_rb_insert(map, tmp);
2525 				tmp = tmp->next;
2526 			}
2527 		}
2528 	} else {
2529 		/* NULL list of new entries: just remove the old one */
2530 		clear_hints(map, oldent);
2531 		uvm_map_entry_unlink(map, oldent);
2532 	}
2533 	map->size -= end - start - nsize;
2534 
2535 	uvm_map_check(map, "map_replace leave");
2536 
2537 	/*
2538 	 * now we can free the old blank entry and return.
2539 	 */
2540 
2541 	*oldentryp = oldent;
2542 	return (true);
2543 }
2544 
2545 /*
2546  * uvm_map_extract: extract a mapping from a map and put it somewhere
2547  *	(maybe removing the old mapping)
2548  *
2549  * => maps should be unlocked (we will write lock them)
2550  * => returns 0 on success, error code otherwise
2551  * => start must be page aligned
2552  * => len must be page sized
2553  * => flags:
2554  *      UVM_EXTRACT_REMOVE: remove mappings from srcmap
2555  *      UVM_EXTRACT_CONTIG: abort if unmapped area (advisory only)
2556  *      UVM_EXTRACT_QREF: for a temporary extraction do quick obj refs
2557  *      UVM_EXTRACT_FIXPROT: set prot to maxprot as we go
2558  *      UVM_EXTRACT_PROT_ALL: set prot to UVM_PROT_ALL as we go
2559  *    >>>NOTE: if you set REMOVE, you are not allowed to use CONTIG or QREF!<<<
2560  *    >>>NOTE: QREF's must be unmapped via the QREF path, thus should only
2561  *             be used from within the kernel in a kernel level map <<<
2562  */
2563 
2564 int
2565 uvm_map_extract(struct vm_map *srcmap, vaddr_t start, vsize_t len,
2566     struct vm_map *dstmap, vaddr_t *dstaddrp, int flags)
2567 {
2568 	vaddr_t dstaddr, end, newend, oldoffset, fudge, orig_fudge;
2569 	struct vm_map_entry *chain, *endchain, *entry, *orig_entry, *newentry,
2570 	    *deadentry, *oldentry;
2571 	struct vm_map_entry *resentry = NULL; /* a dummy reservation entry */
2572 	vsize_t elen __unused;
2573 	int nchain, error, copy_ok;
2574 	vsize_t nsize;
2575 	UVMHIST_FUNC(__func__);
2576 	UVMHIST_CALLARGS(maphist,"(srcmap=%#jx,start=%#jx, len=%#jx",
2577 	    (uintptr_t)srcmap, start, len, 0);
2578 	UVMHIST_LOG(maphist," ...,dstmap=%#jx, flags=%#jx)",
2579 	    (uintptr_t)dstmap, flags, 0, 0);
2580 
2581 	/*
2582 	 * step 0: sanity check: start must be on a page boundary, length
2583 	 * must be page sized.  can't ask for CONTIG/QREF if you asked for
2584 	 * REMOVE.
2585 	 */
2586 
2587 	KASSERT((start & PAGE_MASK) == 0 && (len & PAGE_MASK) == 0);
2588 	KASSERT((flags & UVM_EXTRACT_REMOVE) == 0 ||
2589 		(flags & (UVM_EXTRACT_CONTIG|UVM_EXTRACT_QREF)) == 0);
2590 
2591 	/*
2592 	 * step 1: reserve space in the target map for the extracted area
2593 	 */
2594 
2595 	if ((flags & UVM_EXTRACT_RESERVED) == 0) {
2596 		dstaddr = vm_map_min(dstmap);
2597 		if (!uvm_map_reserve(dstmap, len, start,
2598 		    atop(start) & uvmexp.colormask, &dstaddr,
2599 		    UVM_FLAG_COLORMATCH))
2600 			return (ENOMEM);
2601 		KASSERT((atop(start ^ dstaddr) & uvmexp.colormask) == 0);
2602 		*dstaddrp = dstaddr;	/* pass address back to caller */
2603 		UVMHIST_LOG(maphist, "  dstaddr=%#jx", dstaddr,0,0,0);
2604 	} else {
2605 		dstaddr = *dstaddrp;
2606 	}
2607 
2608 	/*
2609 	 * step 2: setup for the extraction process loop by init'ing the
2610 	 * map entry chain, locking src map, and looking up the first useful
2611 	 * entry in the map.
2612 	 */
2613 
2614 	end = start + len;
2615 	newend = dstaddr + len;
2616 	chain = endchain = NULL;
2617 	nchain = 0;
2618 	nsize = 0;
2619 	vm_map_lock(srcmap);
2620 
2621 	if (uvm_map_lookup_entry(srcmap, start, &entry)) {
2622 
2623 		/* "start" is within an entry */
2624 		if (flags & UVM_EXTRACT_QREF) {
2625 
2626 			/*
2627 			 * for quick references we don't clip the entry, so
2628 			 * the entry may map space "before" the starting
2629 			 * virtual address... this is the "fudge" factor
2630 			 * (which can be non-zero only the first time
2631 			 * through the "while" loop in step 3).
2632 			 */
2633 
2634 			fudge = start - entry->start;
2635 		} else {
2636 
2637 			/*
2638 			 * normal reference: we clip the map to fit (thus
2639 			 * fudge is zero)
2640 			 */
2641 
2642 			UVM_MAP_CLIP_START(srcmap, entry, start);
2643 			SAVE_HINT(srcmap, srcmap->hint, entry->prev);
2644 			fudge = 0;
2645 		}
2646 	} else {
2647 
2648 		/* "start" is not within an entry ... skip to next entry */
2649 		if (flags & UVM_EXTRACT_CONTIG) {
2650 			error = EINVAL;
2651 			goto bad;    /* definite hole here ... */
2652 		}
2653 
2654 		entry = entry->next;
2655 		fudge = 0;
2656 	}
2657 
2658 	/* save values from srcmap for step 6 */
2659 	orig_entry = entry;
2660 	orig_fudge = fudge;
2661 
2662 	/*
2663 	 * step 3: now start looping through the map entries, extracting
2664 	 * as we go.
2665 	 */
2666 
2667 	while (entry->start < end && entry != &srcmap->header) {
2668 
2669 		/* if we are not doing a quick reference, clip it */
2670 		if ((flags & UVM_EXTRACT_QREF) == 0)
2671 			UVM_MAP_CLIP_END(srcmap, entry, end);
2672 
2673 		/* clear needs_copy (allow chunking) */
2674 		if (UVM_ET_ISNEEDSCOPY(entry)) {
2675 			amap_copy(srcmap, entry,
2676 			    AMAP_COPY_NOWAIT|AMAP_COPY_NOMERGE, start, end);
2677 			if (UVM_ET_ISNEEDSCOPY(entry)) {  /* failed? */
2678 				error = ENOMEM;
2679 				goto bad;
2680 			}
2681 
2682 			/* amap_copy could clip (during chunk)!  update fudge */
2683 			if (fudge) {
2684 				fudge = start - entry->start;
2685 				orig_fudge = fudge;
2686 			}
2687 		}
2688 
2689 		/* calculate the offset of this from "start" */
2690 		oldoffset = (entry->start + fudge) - start;
2691 
2692 		/* allocate a new map entry */
2693 		newentry = uvm_mapent_alloc(dstmap, 0);
2694 		if (newentry == NULL) {
2695 			error = ENOMEM;
2696 			goto bad;
2697 		}
2698 
2699 		/* set up new map entry */
2700 		newentry->next = NULL;
2701 		newentry->prev = endchain;
2702 		newentry->start = dstaddr + oldoffset;
2703 		newentry->end =
2704 		    newentry->start + (entry->end - (entry->start + fudge));
2705 		if (newentry->end > newend || newentry->end < newentry->start)
2706 			newentry->end = newend;
2707 		newentry->object.uvm_obj = entry->object.uvm_obj;
2708 		if (newentry->object.uvm_obj) {
2709 			if (newentry->object.uvm_obj->pgops->pgo_reference)
2710 				newentry->object.uvm_obj->pgops->
2711 				    pgo_reference(newentry->object.uvm_obj);
2712 			newentry->offset = entry->offset + fudge;
2713 		} else {
2714 			newentry->offset = 0;
2715 		}
2716 		newentry->etype = entry->etype;
2717 		if (flags & UVM_EXTRACT_PROT_ALL) {
2718 			newentry->protection = newentry->max_protection =
2719 			    UVM_PROT_ALL;
2720 		} else {
2721 			newentry->protection = (flags & UVM_EXTRACT_FIXPROT) ?
2722 			    entry->max_protection : entry->protection;
2723 			newentry->max_protection = entry->max_protection;
2724 		}
2725 		newentry->inheritance = entry->inheritance;
2726 		newentry->wired_count = 0;
2727 		newentry->aref.ar_amap = entry->aref.ar_amap;
2728 		if (newentry->aref.ar_amap) {
2729 			newentry->aref.ar_pageoff =
2730 			    entry->aref.ar_pageoff + (fudge >> PAGE_SHIFT);
2731 			uvm_map_reference_amap(newentry, AMAP_SHARED |
2732 			    ((flags & UVM_EXTRACT_QREF) ? AMAP_REFALL : 0));
2733 		} else {
2734 			newentry->aref.ar_pageoff = 0;
2735 		}
2736 		newentry->advice = entry->advice;
2737 		if ((flags & UVM_EXTRACT_QREF) != 0) {
2738 			newentry->flags |= UVM_MAP_NOMERGE;
2739 		}
2740 
2741 		/* now link it on the chain */
2742 		nchain++;
2743 		nsize += newentry->end - newentry->start;
2744 		if (endchain == NULL) {
2745 			chain = endchain = newentry;
2746 		} else {
2747 			endchain->next = newentry;
2748 			endchain = newentry;
2749 		}
2750 
2751 		/* end of 'while' loop! */
2752 		if ((flags & UVM_EXTRACT_CONTIG) && entry->end < end &&
2753 		    (entry->next == &srcmap->header ||
2754 		    entry->next->start != entry->end)) {
2755 			error = EINVAL;
2756 			goto bad;
2757 		}
2758 		entry = entry->next;
2759 		fudge = 0;
2760 	}
2761 
2762 	/*
2763 	 * step 4: close off chain (in format expected by uvm_map_replace)
2764 	 */
2765 
2766 	if (chain)
2767 		chain->prev = endchain;
2768 
2769 	/*
2770 	 * step 5: attempt to lock the dest map so we can pmap_copy.
2771 	 * note usage of copy_ok:
2772 	 *   1 => dstmap locked, pmap_copy ok, and we "replace" here (step 5)
2773 	 *   0 => dstmap unlocked, NO pmap_copy, and we will "replace" in step 7
2774 	 */
2775 
2776 	if (srcmap == dstmap || vm_map_lock_try(dstmap) == true) {
2777 		copy_ok = 1;
2778 		if (!uvm_map_replace(dstmap, dstaddr, dstaddr+len, chain,
2779 		    nchain, nsize, &resentry)) {
2780 			if (srcmap != dstmap)
2781 				vm_map_unlock(dstmap);
2782 			error = EIO;
2783 			goto bad;
2784 		}
2785 	} else {
2786 		copy_ok = 0;
2787 		/* replace defered until step 7 */
2788 	}
2789 
2790 	/*
2791 	 * step 6: traverse the srcmap a second time to do the following:
2792 	 *  - if we got a lock on the dstmap do pmap_copy
2793 	 *  - if UVM_EXTRACT_REMOVE remove the entries
2794 	 * we make use of orig_entry and orig_fudge (saved in step 2)
2795 	 */
2796 
2797 	if (copy_ok || (flags & UVM_EXTRACT_REMOVE)) {
2798 
2799 		/* purge possible stale hints from srcmap */
2800 		if (flags & UVM_EXTRACT_REMOVE) {
2801 			SAVE_HINT(srcmap, srcmap->hint, orig_entry->prev);
2802 			if (srcmap->first_free != &srcmap->header &&
2803 			    srcmap->first_free->start >= start)
2804 				srcmap->first_free = orig_entry->prev;
2805 		}
2806 
2807 		entry = orig_entry;
2808 		fudge = orig_fudge;
2809 		deadentry = NULL;	/* for UVM_EXTRACT_REMOVE */
2810 
2811 		while (entry->start < end && entry != &srcmap->header) {
2812 			if (copy_ok) {
2813 				oldoffset = (entry->start + fudge) - start;
2814 				elen = MIN(end, entry->end) -
2815 				    (entry->start + fudge);
2816 				pmap_copy(dstmap->pmap, srcmap->pmap,
2817 				    dstaddr + oldoffset, elen,
2818 				    entry->start + fudge);
2819 			}
2820 
2821 			/* we advance "entry" in the following if statement */
2822 			if (flags & UVM_EXTRACT_REMOVE) {
2823 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
2824 				uvm_map_lock_entry(entry, RW_WRITER);
2825 #else
2826 				uvm_map_lock_entry(entry, RW_READER);
2827 #endif
2828 				pmap_remove(srcmap->pmap, entry->start,
2829 						entry->end);
2830 				uvm_map_unlock_entry(entry);
2831 				oldentry = entry;	/* save entry */
2832 				entry = entry->next;	/* advance */
2833 				uvm_map_entry_unlink(srcmap, oldentry);
2834 							/* add to dead list */
2835 				oldentry->next = deadentry;
2836 				deadentry = oldentry;
2837 			} else {
2838 				entry = entry->next;		/* advance */
2839 			}
2840 
2841 			/* end of 'while' loop */
2842 			fudge = 0;
2843 		}
2844 		pmap_update(srcmap->pmap);
2845 
2846 		/*
2847 		 * unlock dstmap.  we will dispose of deadentry in
2848 		 * step 7 if needed
2849 		 */
2850 
2851 		if (copy_ok && srcmap != dstmap)
2852 			vm_map_unlock(dstmap);
2853 
2854 	} else {
2855 		deadentry = NULL;
2856 	}
2857 
2858 	/*
2859 	 * step 7: we are done with the source map, unlock.   if copy_ok
2860 	 * is 0 then we have not replaced the dummy mapping in dstmap yet
2861 	 * and we need to do so now.
2862 	 */
2863 
2864 	vm_map_unlock(srcmap);
2865 	if ((flags & UVM_EXTRACT_REMOVE) && deadentry)
2866 		uvm_unmap_detach(deadentry, 0);   /* dispose of old entries */
2867 
2868 	/* now do the replacement if we didn't do it in step 5 */
2869 	if (copy_ok == 0) {
2870 		vm_map_lock(dstmap);
2871 		error = uvm_map_replace(dstmap, dstaddr, dstaddr+len, chain,
2872 		    nchain, nsize, &resentry);
2873 		vm_map_unlock(dstmap);
2874 
2875 		if (error == false) {
2876 			error = EIO;
2877 			goto bad2;
2878 		}
2879 	}
2880 
2881 	if (resentry != NULL)
2882 		uvm_mapent_free(resentry);
2883 
2884 	return (0);
2885 
2886 	/*
2887 	 * bad: failure recovery
2888 	 */
2889 bad:
2890 	vm_map_unlock(srcmap);
2891 bad2:			/* src already unlocked */
2892 	if (chain)
2893 		uvm_unmap_detach(chain,
2894 		    (flags & UVM_EXTRACT_QREF) ? AMAP_REFALL : 0);
2895 
2896 	if (resentry != NULL)
2897 		uvm_mapent_free(resentry);
2898 
2899 	if ((flags & UVM_EXTRACT_RESERVED) == 0) {
2900 		uvm_unmap(dstmap, dstaddr, dstaddr+len);   /* ??? */
2901 	}
2902 	return (error);
2903 }
2904 
2905 /* end of extraction functions */
2906 
2907 /*
2908  * uvm_map_submap: punch down part of a map into a submap
2909  *
2910  * => only the kernel_map is allowed to be submapped
2911  * => the purpose of submapping is to break up the locking granularity
2912  *	of a larger map
2913  * => the range specified must have been mapped previously with a uvm_map()
2914  *	call [with uobj==NULL] to create a blank map entry in the main map.
2915  *	[And it had better still be blank!]
2916  * => maps which contain submaps should never be copied or forked.
2917  * => to remove a submap, use uvm_unmap() on the main map
2918  *	and then uvm_map_deallocate() the submap.
2919  * => main map must be unlocked.
2920  * => submap must have been init'd and have a zero reference count.
2921  *	[need not be locked as we don't actually reference it]
2922  */
2923 
2924 int
2925 uvm_map_submap(struct vm_map *map, vaddr_t start, vaddr_t end,
2926     struct vm_map *submap)
2927 {
2928 	struct vm_map_entry *entry;
2929 	int error;
2930 
2931 	vm_map_lock(map);
2932 	VM_MAP_RANGE_CHECK(map, start, end);
2933 
2934 	if (uvm_map_lookup_entry(map, start, &entry)) {
2935 		UVM_MAP_CLIP_START(map, entry, start);
2936 		UVM_MAP_CLIP_END(map, entry, end);	/* to be safe */
2937 	} else {
2938 		entry = NULL;
2939 	}
2940 
2941 	if (entry != NULL &&
2942 	    entry->start == start && entry->end == end &&
2943 	    entry->object.uvm_obj == NULL && entry->aref.ar_amap == NULL &&
2944 	    !UVM_ET_ISCOPYONWRITE(entry) && !UVM_ET_ISNEEDSCOPY(entry)) {
2945 		entry->etype |= UVM_ET_SUBMAP;
2946 		entry->object.sub_map = submap;
2947 		entry->offset = 0;
2948 		uvm_map_reference(submap);
2949 		error = 0;
2950 	} else {
2951 		error = EINVAL;
2952 	}
2953 	vm_map_unlock(map);
2954 
2955 	return error;
2956 }
2957 
2958 /*
2959  * uvm_map_protect_user: change map protection on behalf of the user.
2960  * Enforces PAX settings as necessary.
2961  */
2962 int
2963 uvm_map_protect_user(struct lwp *l, vaddr_t start, vaddr_t end,
2964     vm_prot_t new_prot)
2965 {
2966 	int error;
2967 
2968 	if ((error = PAX_MPROTECT_VALIDATE(l, new_prot)))
2969 		return error;
2970 
2971 	return uvm_map_protect(&l->l_proc->p_vmspace->vm_map, start, end,
2972 	    new_prot, false);
2973 }
2974 
2975 
2976 /*
2977  * uvm_map_protect: change map protection
2978  *
2979  * => set_max means set max_protection.
2980  * => map must be unlocked.
2981  */
2982 
2983 #define MASK(entry)	(UVM_ET_ISCOPYONWRITE(entry) ? \
2984 			 ~VM_PROT_WRITE : VM_PROT_ALL)
2985 
2986 int
2987 uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
2988     vm_prot_t new_prot, bool set_max)
2989 {
2990 	struct vm_map_entry *current, *entry;
2991 	int error = 0;
2992 	UVMHIST_FUNC(__func__);
2993 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_prot=%#jx)",
2994 	    (uintptr_t)map, start, end, new_prot);
2995 
2996 	vm_map_lock(map);
2997 	VM_MAP_RANGE_CHECK(map, start, end);
2998 	if (uvm_map_lookup_entry(map, start, &entry)) {
2999 		UVM_MAP_CLIP_START(map, entry, start);
3000 	} else {
3001 		entry = entry->next;
3002 	}
3003 
3004 	/*
3005 	 * make a first pass to check for protection violations.
3006 	 */
3007 
3008 	current = entry;
3009 	while ((current != &map->header) && (current->start < end)) {
3010 		if (UVM_ET_ISSUBMAP(current)) {
3011 			error = EINVAL;
3012 			goto out;
3013 		}
3014 		if ((new_prot & current->max_protection) != new_prot) {
3015 			error = EACCES;
3016 			goto out;
3017 		}
3018 		/*
3019 		 * Don't allow VM_PROT_EXECUTE to be set on entries that
3020 		 * point to vnodes that are associated with a NOEXEC file
3021 		 * system.
3022 		 */
3023 		if (UVM_ET_ISOBJ(current) &&
3024 		    UVM_OBJ_IS_VNODE(current->object.uvm_obj)) {
3025 			struct vnode *vp =
3026 			    (struct vnode *) current->object.uvm_obj;
3027 
3028 			if ((new_prot & VM_PROT_EXECUTE) != 0 &&
3029 			    (vp->v_mount->mnt_flag & MNT_NOEXEC) != 0) {
3030 				error = EACCES;
3031 				goto out;
3032 			}
3033 		}
3034 
3035 		current = current->next;
3036 	}
3037 
3038 	/* go back and fix up protections (no need to clip this time). */
3039 
3040 	current = entry;
3041 	while ((current != &map->header) && (current->start < end)) {
3042 		vm_prot_t old_prot;
3043 
3044 		UVM_MAP_CLIP_END(map, current, end);
3045 		old_prot = current->protection;
3046 		if (set_max)
3047 			current->protection =
3048 			    (current->max_protection = new_prot) & old_prot;
3049 		else
3050 			current->protection = new_prot;
3051 
3052 		/*
3053 		 * update physical map if necessary.  worry about copy-on-write
3054 		 * here -- CHECK THIS XXX
3055 		 */
3056 
3057 		if (current->protection != old_prot) {
3058 			/* update pmap! */
3059 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
3060 			uvm_map_lock_entry(current, RW_WRITER);
3061 #else
3062 			uvm_map_lock_entry(current, RW_READER);
3063 #endif
3064 			pmap_protect(map->pmap, current->start, current->end,
3065 			    current->protection & MASK(current));
3066 			uvm_map_unlock_entry(current);
3067 
3068 			/*
3069 			 * If this entry points at a vnode, and the
3070 			 * protection includes VM_PROT_EXECUTE, mark
3071 			 * the vnode as VEXECMAP.
3072 			 */
3073 			if (UVM_ET_ISOBJ(current)) {
3074 				struct uvm_object *uobj =
3075 				    current->object.uvm_obj;
3076 
3077 				if (UVM_OBJ_IS_VNODE(uobj) &&
3078 				    (current->protection & VM_PROT_EXECUTE)) {
3079 					vn_markexec((struct vnode *) uobj);
3080 				}
3081 			}
3082 		}
3083 
3084 		/*
3085 		 * If the map is configured to lock any future mappings,
3086 		 * wire this entry now if the old protection was VM_PROT_NONE
3087 		 * and the new protection is not VM_PROT_NONE.
3088 		 */
3089 
3090 		if ((map->flags & VM_MAP_WIREFUTURE) != 0 &&
3091 		    VM_MAPENT_ISWIRED(current) == 0 &&
3092 		    old_prot == VM_PROT_NONE &&
3093 		    new_prot != VM_PROT_NONE) {
3094 
3095 			/*
3096 			 * We must call pmap_update() here because the
3097 			 * pmap_protect() call above might have removed some
3098 			 * pmap entries and uvm_map_pageable() might create
3099 			 * some new pmap entries that rely on the prior
3100 			 * removals being completely finished.
3101 			 */
3102 
3103 			pmap_update(map->pmap);
3104 
3105 			if (uvm_map_pageable(map, current->start,
3106 			    current->end, false,
3107 			    UVM_LK_ENTER|UVM_LK_EXIT) != 0) {
3108 
3109 				/*
3110 				 * If locking the entry fails, remember the
3111 				 * error if it's the first one.  Note we
3112 				 * still continue setting the protection in
3113 				 * the map, but will return the error
3114 				 * condition regardless.
3115 				 *
3116 				 * XXX Ignore what the actual error is,
3117 				 * XXX just call it a resource shortage
3118 				 * XXX so that it doesn't get confused
3119 				 * XXX what uvm_map_protect() itself would
3120 				 * XXX normally return.
3121 				 */
3122 
3123 				error = ENOMEM;
3124 			}
3125 		}
3126 		current = current->next;
3127 	}
3128 	pmap_update(map->pmap);
3129 
3130  out:
3131 	vm_map_unlock(map);
3132 
3133 	UVMHIST_LOG(maphist, "<- done, error=%jd",error,0,0,0);
3134 	return error;
3135 }
3136 
3137 #undef  MASK
3138 
3139 /*
3140  * uvm_map_inherit: set inheritance code for range of addrs in map.
3141  *
3142  * => map must be unlocked
3143  * => note that the inherit code is used during a "fork".  see fork
3144  *	code for details.
3145  */
3146 
3147 int
3148 uvm_map_inherit(struct vm_map *map, vaddr_t start, vaddr_t end,
3149     vm_inherit_t new_inheritance)
3150 {
3151 	struct vm_map_entry *entry, *temp_entry;
3152 	UVMHIST_FUNC(__func__);
3153 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_inh=%#jx)",
3154 	    (uintptr_t)map, start, end, new_inheritance);
3155 
3156 	switch (new_inheritance) {
3157 	case MAP_INHERIT_NONE:
3158 	case MAP_INHERIT_COPY:
3159 	case MAP_INHERIT_SHARE:
3160 	case MAP_INHERIT_ZERO:
3161 		break;
3162 	default:
3163 		UVMHIST_LOG(maphist,"<- done (INVALID ARG)",0,0,0,0);
3164 		return EINVAL;
3165 	}
3166 
3167 	vm_map_lock(map);
3168 	VM_MAP_RANGE_CHECK(map, start, end);
3169 	if (uvm_map_lookup_entry(map, start, &temp_entry)) {
3170 		entry = temp_entry;
3171 		UVM_MAP_CLIP_START(map, entry, start);
3172 	}  else {
3173 		entry = temp_entry->next;
3174 	}
3175 	while ((entry != &map->header) && (entry->start < end)) {
3176 		UVM_MAP_CLIP_END(map, entry, end);
3177 		entry->inheritance = new_inheritance;
3178 		entry = entry->next;
3179 	}
3180 	vm_map_unlock(map);
3181 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3182 	return 0;
3183 }
3184 
3185 /*
3186  * uvm_map_advice: set advice code for range of addrs in map.
3187  *
3188  * => map must be unlocked
3189  */
3190 
3191 int
3192 uvm_map_advice(struct vm_map *map, vaddr_t start, vaddr_t end, int new_advice)
3193 {
3194 	struct vm_map_entry *entry, *temp_entry;
3195 	UVMHIST_FUNC(__func__);
3196 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_adv=%#jx)",
3197 	    (uintptr_t)map, start, end, new_advice);
3198 
3199 	vm_map_lock(map);
3200 	VM_MAP_RANGE_CHECK(map, start, end);
3201 	if (uvm_map_lookup_entry(map, start, &temp_entry)) {
3202 		entry = temp_entry;
3203 		UVM_MAP_CLIP_START(map, entry, start);
3204 	} else {
3205 		entry = temp_entry->next;
3206 	}
3207 
3208 	/*
3209 	 * XXXJRT: disallow holes?
3210 	 */
3211 
3212 	while ((entry != &map->header) && (entry->start < end)) {
3213 		UVM_MAP_CLIP_END(map, entry, end);
3214 
3215 		switch (new_advice) {
3216 		case MADV_NORMAL:
3217 		case MADV_RANDOM:
3218 		case MADV_SEQUENTIAL:
3219 			/* nothing special here */
3220 			break;
3221 
3222 		default:
3223 			vm_map_unlock(map);
3224 			UVMHIST_LOG(maphist,"<- done (INVALID ARG)",0,0,0,0);
3225 			return EINVAL;
3226 		}
3227 		entry->advice = new_advice;
3228 		entry = entry->next;
3229 	}
3230 
3231 	vm_map_unlock(map);
3232 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3233 	return 0;
3234 }
3235 
3236 /*
3237  * uvm_map_willneed: apply MADV_WILLNEED
3238  */
3239 
3240 int
3241 uvm_map_willneed(struct vm_map *map, vaddr_t start, vaddr_t end)
3242 {
3243 	struct vm_map_entry *entry;
3244 	UVMHIST_FUNC(__func__);
3245 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx)",
3246 	    (uintptr_t)map, start, end, 0);
3247 
3248 	vm_map_lock_read(map);
3249 	VM_MAP_RANGE_CHECK(map, start, end);
3250 	if (!uvm_map_lookup_entry(map, start, &entry)) {
3251 		entry = entry->next;
3252 	}
3253 	while (entry->start < end) {
3254 		struct vm_amap * const amap = entry->aref.ar_amap;
3255 		struct uvm_object * const uobj = entry->object.uvm_obj;
3256 
3257 		KASSERT(entry != &map->header);
3258 		KASSERT(start < entry->end);
3259 		/*
3260 		 * For now, we handle only the easy but commonly-requested case.
3261 		 * ie. start prefetching of backing uobj pages.
3262 		 *
3263 		 * XXX It might be useful to pmap_enter() the already-in-core
3264 		 * pages by inventing a "weak" mode for uvm_fault() which would
3265 		 * only do the PGO_LOCKED pgo_get().
3266 		 */
3267 		if (UVM_ET_ISOBJ(entry) && amap == NULL && uobj != NULL) {
3268 			off_t offset;
3269 			off_t size;
3270 
3271 			offset = entry->offset;
3272 			if (start < entry->start) {
3273 				offset += entry->start - start;
3274 			}
3275 			size = entry->offset + (entry->end - entry->start);
3276 			if (entry->end < end) {
3277 				size -= end - entry->end;
3278 			}
3279 			uvm_readahead(uobj, offset, size);
3280 		}
3281 		entry = entry->next;
3282 	}
3283 	vm_map_unlock_read(map);
3284 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3285 	return 0;
3286 }
3287 
3288 /*
3289  * uvm_map_pageable: sets the pageability of a range in a map.
3290  *
3291  * => wires map entries.  should not be used for transient page locking.
3292  *	for that, use uvm_fault_wire()/uvm_fault_unwire() (see uvm_vslock()).
3293  * => regions specified as not pageable require lock-down (wired) memory
3294  *	and page tables.
3295  * => map must never be read-locked
3296  * => if islocked is true, map is already write-locked
3297  * => we always unlock the map, since we must downgrade to a read-lock
3298  *	to call uvm_fault_wire()
3299  * => XXXCDC: check this and try and clean it up.
3300  */
3301 
3302 int
3303 uvm_map_pageable(struct vm_map *map, vaddr_t start, vaddr_t end,
3304     bool new_pageable, int lockflags)
3305 {
3306 	struct vm_map_entry *entry, *start_entry, *failed_entry;
3307 	int rv;
3308 #ifdef DIAGNOSTIC
3309 	u_int timestamp_save;
3310 #endif
3311 	UVMHIST_FUNC(__func__);
3312 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_pageable=%ju)",
3313 	    (uintptr_t)map, start, end, new_pageable);
3314 	KASSERT(map->flags & VM_MAP_PAGEABLE);
3315 
3316 	if ((lockflags & UVM_LK_ENTER) == 0)
3317 		vm_map_lock(map);
3318 	VM_MAP_RANGE_CHECK(map, start, end);
3319 
3320 	/*
3321 	 * only one pageability change may take place at one time, since
3322 	 * uvm_fault_wire assumes it will be called only once for each
3323 	 * wiring/unwiring.  therefore, we have to make sure we're actually
3324 	 * changing the pageability for the entire region.  we do so before
3325 	 * making any changes.
3326 	 */
3327 
3328 	if (uvm_map_lookup_entry(map, start, &start_entry) == false) {
3329 		if ((lockflags & UVM_LK_EXIT) == 0)
3330 			vm_map_unlock(map);
3331 
3332 		UVMHIST_LOG(maphist,"<- done (fault)",0,0,0,0);
3333 		return EFAULT;
3334 	}
3335 	entry = start_entry;
3336 
3337 	if (start == end) {		/* nothing required */
3338 		if ((lockflags & UVM_LK_EXIT) == 0)
3339 			vm_map_unlock(map);
3340 
3341 		UVMHIST_LOG(maphist,"<- done (nothing)",0,0,0,0);
3342 		return 0;
3343 	}
3344 
3345 	/*
3346 	 * handle wiring and unwiring separately.
3347 	 */
3348 
3349 	if (new_pageable) {		/* unwire */
3350 		UVM_MAP_CLIP_START(map, entry, start);
3351 
3352 		/*
3353 		 * unwiring.  first ensure that the range to be unwired is
3354 		 * really wired down and that there are no holes.
3355 		 */
3356 
3357 		while ((entry != &map->header) && (entry->start < end)) {
3358 			if (entry->wired_count == 0 ||
3359 			    (entry->end < end &&
3360 			     (entry->next == &map->header ||
3361 			      entry->next->start > entry->end))) {
3362 				if ((lockflags & UVM_LK_EXIT) == 0)
3363 					vm_map_unlock(map);
3364 				UVMHIST_LOG(maphist, "<- done (INVAL)",0,0,0,0);
3365 				return EINVAL;
3366 			}
3367 			entry = entry->next;
3368 		}
3369 
3370 		/*
3371 		 * POSIX 1003.1b - a single munlock call unlocks a region,
3372 		 * regardless of the number of mlock calls made on that
3373 		 * region.
3374 		 */
3375 
3376 		entry = start_entry;
3377 		while ((entry != &map->header) && (entry->start < end)) {
3378 			UVM_MAP_CLIP_END(map, entry, end);
3379 			if (VM_MAPENT_ISWIRED(entry))
3380 				uvm_map_entry_unwire(map, entry);
3381 			entry = entry->next;
3382 		}
3383 		if ((lockflags & UVM_LK_EXIT) == 0)
3384 			vm_map_unlock(map);
3385 		UVMHIST_LOG(maphist,"<- done (OK UNWIRE)",0,0,0,0);
3386 		return 0;
3387 	}
3388 
3389 	/*
3390 	 * wire case: in two passes [XXXCDC: ugly block of code here]
3391 	 *
3392 	 * 1: holding the write lock, we create any anonymous maps that need
3393 	 *    to be created.  then we clip each map entry to the region to
3394 	 *    be wired and increment its wiring count.
3395 	 *
3396 	 * 2: we downgrade to a read lock, and call uvm_fault_wire to fault
3397 	 *    in the pages for any newly wired area (wired_count == 1).
3398 	 *
3399 	 *    downgrading to a read lock for uvm_fault_wire avoids a possible
3400 	 *    deadlock with another thread that may have faulted on one of
3401 	 *    the pages to be wired (it would mark the page busy, blocking
3402 	 *    us, then in turn block on the map lock that we hold).  because
3403 	 *    of problems in the recursive lock package, we cannot upgrade
3404 	 *    to a write lock in vm_map_lookup.  thus, any actions that
3405 	 *    require the write lock must be done beforehand.  because we
3406 	 *    keep the read lock on the map, the copy-on-write status of the
3407 	 *    entries we modify here cannot change.
3408 	 */
3409 
3410 	while ((entry != &map->header) && (entry->start < end)) {
3411 		if (VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3412 
3413 			/*
3414 			 * perform actions of vm_map_lookup that need the
3415 			 * write lock on the map: create an anonymous map
3416 			 * for a copy-on-write region, or an anonymous map
3417 			 * for a zero-fill region.  (XXXCDC: submap case
3418 			 * ok?)
3419 			 */
3420 
3421 			if (!UVM_ET_ISSUBMAP(entry)) {  /* not submap */
3422 				if (UVM_ET_ISNEEDSCOPY(entry) &&
3423 				    ((entry->max_protection & VM_PROT_WRITE) ||
3424 				     (entry->object.uvm_obj == NULL))) {
3425 					amap_copy(map, entry, 0, start, end);
3426 					/* XXXCDC: wait OK? */
3427 				}
3428 			}
3429 		}
3430 		UVM_MAP_CLIP_START(map, entry, start);
3431 		UVM_MAP_CLIP_END(map, entry, end);
3432 		entry->wired_count++;
3433 
3434 		/*
3435 		 * Check for holes
3436 		 */
3437 
3438 		if (entry->protection == VM_PROT_NONE ||
3439 		    (entry->end < end &&
3440 		     (entry->next == &map->header ||
3441 		      entry->next->start > entry->end))) {
3442 
3443 			/*
3444 			 * found one.  amap creation actions do not need to
3445 			 * be undone, but the wired counts need to be restored.
3446 			 */
3447 
3448 			while (entry != &map->header && entry->end > start) {
3449 				entry->wired_count--;
3450 				entry = entry->prev;
3451 			}
3452 			if ((lockflags & UVM_LK_EXIT) == 0)
3453 				vm_map_unlock(map);
3454 			UVMHIST_LOG(maphist,"<- done (INVALID WIRE)",0,0,0,0);
3455 			return EINVAL;
3456 		}
3457 		entry = entry->next;
3458 	}
3459 
3460 	/*
3461 	 * Pass 2.
3462 	 */
3463 
3464 #ifdef DIAGNOSTIC
3465 	timestamp_save = map->timestamp;
3466 #endif
3467 	vm_map_busy(map);
3468 	vm_map_unlock(map);
3469 
3470 	rv = 0;
3471 	entry = start_entry;
3472 	while (entry != &map->header && entry->start < end) {
3473 		if (entry->wired_count == 1) {
3474 			rv = uvm_fault_wire(map, entry->start, entry->end,
3475 			    entry->max_protection, 1);
3476 			if (rv) {
3477 
3478 				/*
3479 				 * wiring failed.  break out of the loop.
3480 				 * we'll clean up the map below, once we
3481 				 * have a write lock again.
3482 				 */
3483 
3484 				break;
3485 			}
3486 		}
3487 		entry = entry->next;
3488 	}
3489 
3490 	if (rv) {	/* failed? */
3491 
3492 		/*
3493 		 * Get back to an exclusive (write) lock.
3494 		 */
3495 
3496 		vm_map_lock(map);
3497 		vm_map_unbusy(map);
3498 
3499 #ifdef DIAGNOSTIC
3500 		if (timestamp_save + 1 != map->timestamp)
3501 			panic("uvm_map_pageable: stale map");
3502 #endif
3503 
3504 		/*
3505 		 * first drop the wiring count on all the entries
3506 		 * which haven't actually been wired yet.
3507 		 */
3508 
3509 		failed_entry = entry;
3510 		while (entry != &map->header && entry->start < end) {
3511 			entry->wired_count--;
3512 			entry = entry->next;
3513 		}
3514 
3515 		/*
3516 		 * now, unwire all the entries that were successfully
3517 		 * wired above.
3518 		 */
3519 
3520 		entry = start_entry;
3521 		while (entry != failed_entry) {
3522 			entry->wired_count--;
3523 			if (VM_MAPENT_ISWIRED(entry) == 0)
3524 				uvm_map_entry_unwire(map, entry);
3525 			entry = entry->next;
3526 		}
3527 		if ((lockflags & UVM_LK_EXIT) == 0)
3528 			vm_map_unlock(map);
3529 		UVMHIST_LOG(maphist, "<- done (RV=%jd)", rv,0,0,0);
3530 		return (rv);
3531 	}
3532 
3533 	if ((lockflags & UVM_LK_EXIT) == 0) {
3534 		vm_map_unbusy(map);
3535 	} else {
3536 
3537 		/*
3538 		 * Get back to an exclusive (write) lock.
3539 		 */
3540 
3541 		vm_map_lock(map);
3542 		vm_map_unbusy(map);
3543 	}
3544 
3545 	UVMHIST_LOG(maphist,"<- done (OK WIRE)",0,0,0,0);
3546 	return 0;
3547 }
3548 
3549 /*
3550  * uvm_map_pageable_all: special case of uvm_map_pageable - affects
3551  * all mapped regions.
3552  *
3553  * => map must not be locked.
3554  * => if no flags are specified, all regions are unwired.
3555  * => XXXJRT: has some of the same problems as uvm_map_pageable() above.
3556  */
3557 
3558 int
3559 uvm_map_pageable_all(struct vm_map *map, int flags, vsize_t limit)
3560 {
3561 	struct vm_map_entry *entry, *failed_entry;
3562 	vsize_t size;
3563 	int rv;
3564 #ifdef DIAGNOSTIC
3565 	u_int timestamp_save;
3566 #endif
3567 	UVMHIST_FUNC(__func__);
3568 	UVMHIST_CALLARGS(maphist,"(map=%#jx,flags=%#jx)", (uintptr_t)map, flags,
3569 	    0, 0);
3570 
3571 	KASSERT(map->flags & VM_MAP_PAGEABLE);
3572 
3573 	vm_map_lock(map);
3574 
3575 	/*
3576 	 * handle wiring and unwiring separately.
3577 	 */
3578 
3579 	if (flags == 0) {			/* unwire */
3580 
3581 		/*
3582 		 * POSIX 1003.1b -- munlockall unlocks all regions,
3583 		 * regardless of how many times mlockall has been called.
3584 		 */
3585 
3586 		for (entry = map->header.next; entry != &map->header;
3587 		     entry = entry->next) {
3588 			if (VM_MAPENT_ISWIRED(entry))
3589 				uvm_map_entry_unwire(map, entry);
3590 		}
3591 		map->flags &= ~VM_MAP_WIREFUTURE;
3592 		vm_map_unlock(map);
3593 		UVMHIST_LOG(maphist,"<- done (OK UNWIRE)",0,0,0,0);
3594 		return 0;
3595 	}
3596 
3597 	if (flags & MCL_FUTURE) {
3598 
3599 		/*
3600 		 * must wire all future mappings; remember this.
3601 		 */
3602 
3603 		map->flags |= VM_MAP_WIREFUTURE;
3604 	}
3605 
3606 	if ((flags & MCL_CURRENT) == 0) {
3607 
3608 		/*
3609 		 * no more work to do!
3610 		 */
3611 
3612 		UVMHIST_LOG(maphist,"<- done (OK no wire)",0,0,0,0);
3613 		vm_map_unlock(map);
3614 		return 0;
3615 	}
3616 
3617 	/*
3618 	 * wire case: in three passes [XXXCDC: ugly block of code here]
3619 	 *
3620 	 * 1: holding the write lock, count all pages mapped by non-wired
3621 	 *    entries.  if this would cause us to go over our limit, we fail.
3622 	 *
3623 	 * 2: still holding the write lock, we create any anonymous maps that
3624 	 *    need to be created.  then we increment its wiring count.
3625 	 *
3626 	 * 3: we downgrade to a read lock, and call uvm_fault_wire to fault
3627 	 *    in the pages for any newly wired area (wired_count == 1).
3628 	 *
3629 	 *    downgrading to a read lock for uvm_fault_wire avoids a possible
3630 	 *    deadlock with another thread that may have faulted on one of
3631 	 *    the pages to be wired (it would mark the page busy, blocking
3632 	 *    us, then in turn block on the map lock that we hold).  because
3633 	 *    of problems in the recursive lock package, we cannot upgrade
3634 	 *    to a write lock in vm_map_lookup.  thus, any actions that
3635 	 *    require the write lock must be done beforehand.  because we
3636 	 *    keep the read lock on the map, the copy-on-write status of the
3637 	 *    entries we modify here cannot change.
3638 	 */
3639 
3640 	for (size = 0, entry = map->header.next; entry != &map->header;
3641 	     entry = entry->next) {
3642 		if (entry->protection != VM_PROT_NONE &&
3643 		    VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3644 			size += entry->end - entry->start;
3645 		}
3646 	}
3647 
3648 	if (atop(size) + uvmexp.wired > uvmexp.wiredmax) {
3649 		vm_map_unlock(map);
3650 		return ENOMEM;
3651 	}
3652 
3653 	if (limit != 0 &&
3654 	    (size + ptoa(pmap_wired_count(vm_map_pmap(map))) > limit)) {
3655 		vm_map_unlock(map);
3656 		return ENOMEM;
3657 	}
3658 
3659 	/*
3660 	 * Pass 2.
3661 	 */
3662 
3663 	for (entry = map->header.next; entry != &map->header;
3664 	     entry = entry->next) {
3665 		if (entry->protection == VM_PROT_NONE)
3666 			continue;
3667 		if (VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3668 
3669 			/*
3670 			 * perform actions of vm_map_lookup that need the
3671 			 * write lock on the map: create an anonymous map
3672 			 * for a copy-on-write region, or an anonymous map
3673 			 * for a zero-fill region.  (XXXCDC: submap case
3674 			 * ok?)
3675 			 */
3676 
3677 			if (!UVM_ET_ISSUBMAP(entry)) {	/* not submap */
3678 				if (UVM_ET_ISNEEDSCOPY(entry) &&
3679 				    ((entry->max_protection & VM_PROT_WRITE) ||
3680 				     (entry->object.uvm_obj == NULL))) {
3681 					amap_copy(map, entry, 0, entry->start,
3682 					    entry->end);
3683 					/* XXXCDC: wait OK? */
3684 				}
3685 			}
3686 		}
3687 		entry->wired_count++;
3688 	}
3689 
3690 	/*
3691 	 * Pass 3.
3692 	 */
3693 
3694 #ifdef DIAGNOSTIC
3695 	timestamp_save = map->timestamp;
3696 #endif
3697 	vm_map_busy(map);
3698 	vm_map_unlock(map);
3699 
3700 	rv = 0;
3701 	for (entry = map->header.next; entry != &map->header;
3702 	     entry = entry->next) {
3703 		if (entry->wired_count == 1) {
3704 			rv = uvm_fault_wire(map, entry->start, entry->end,
3705 			    entry->max_protection, 1);
3706 			if (rv) {
3707 
3708 				/*
3709 				 * wiring failed.  break out of the loop.
3710 				 * we'll clean up the map below, once we
3711 				 * have a write lock again.
3712 				 */
3713 
3714 				break;
3715 			}
3716 		}
3717 	}
3718 
3719 	if (rv) {
3720 
3721 		/*
3722 		 * Get back an exclusive (write) lock.
3723 		 */
3724 
3725 		vm_map_lock(map);
3726 		vm_map_unbusy(map);
3727 
3728 #ifdef DIAGNOSTIC
3729 		if (timestamp_save + 1 != map->timestamp)
3730 			panic("uvm_map_pageable_all: stale map");
3731 #endif
3732 
3733 		/*
3734 		 * first drop the wiring count on all the entries
3735 		 * which haven't actually been wired yet.
3736 		 *
3737 		 * Skip VM_PROT_NONE entries like we did above.
3738 		 */
3739 
3740 		failed_entry = entry;
3741 		for (/* nothing */; entry != &map->header;
3742 		     entry = entry->next) {
3743 			if (entry->protection == VM_PROT_NONE)
3744 				continue;
3745 			entry->wired_count--;
3746 		}
3747 
3748 		/*
3749 		 * now, unwire all the entries that were successfully
3750 		 * wired above.
3751 		 *
3752 		 * Skip VM_PROT_NONE entries like we did above.
3753 		 */
3754 
3755 		for (entry = map->header.next; entry != failed_entry;
3756 		     entry = entry->next) {
3757 			if (entry->protection == VM_PROT_NONE)
3758 				continue;
3759 			entry->wired_count--;
3760 			if (VM_MAPENT_ISWIRED(entry))
3761 				uvm_map_entry_unwire(map, entry);
3762 		}
3763 		vm_map_unlock(map);
3764 		UVMHIST_LOG(maphist,"<- done (RV=%jd)", rv,0,0,0);
3765 		return (rv);
3766 	}
3767 
3768 	vm_map_unbusy(map);
3769 
3770 	UVMHIST_LOG(maphist,"<- done (OK WIRE)",0,0,0,0);
3771 	return 0;
3772 }
3773 
3774 /*
3775  * uvm_map_clean: clean out a map range
3776  *
3777  * => valid flags:
3778  *   if (flags & PGO_CLEANIT): dirty pages are cleaned first
3779  *   if (flags & PGO_SYNCIO): dirty pages are written synchronously
3780  *   if (flags & PGO_DEACTIVATE): any cached pages are deactivated after clean
3781  *   if (flags & PGO_FREE): any cached pages are freed after clean
3782  * => returns an error if any part of the specified range isn't mapped
3783  * => never a need to flush amap layer since the anonymous memory has
3784  *	no permanent home, but may deactivate pages there
3785  * => called from sys_msync() and sys_madvise()
3786  * => caller must not write-lock map (read OK).
3787  * => we may sleep while cleaning if SYNCIO [with map read-locked]
3788  */
3789 
3790 int
3791 uvm_map_clean(struct vm_map *map, vaddr_t start, vaddr_t end, int flags)
3792 {
3793 	struct vm_map_entry *current, *entry;
3794 	struct uvm_object *uobj;
3795 	struct vm_amap *amap;
3796 	struct vm_anon *anon;
3797 	struct vm_page *pg;
3798 	vaddr_t offset;
3799 	vsize_t size;
3800 	voff_t uoff;
3801 	int error, refs;
3802 	UVMHIST_FUNC(__func__);
3803 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,flags=%#jx)",
3804 	    (uintptr_t)map, start, end, flags);
3805 
3806 	KASSERT((flags & (PGO_FREE|PGO_DEACTIVATE)) !=
3807 		(PGO_FREE|PGO_DEACTIVATE));
3808 
3809 	vm_map_lock_read(map);
3810 	VM_MAP_RANGE_CHECK(map, start, end);
3811 	if (uvm_map_lookup_entry(map, start, &entry) == false) {
3812 		vm_map_unlock_read(map);
3813 		return EFAULT;
3814 	}
3815 
3816 	/*
3817 	 * Make a first pass to check for holes and wiring problems.
3818 	 */
3819 
3820 	for (current = entry; current->start < end; current = current->next) {
3821 		if (UVM_ET_ISSUBMAP(current)) {
3822 			vm_map_unlock_read(map);
3823 			return EINVAL;
3824 		}
3825 		if ((flags & PGO_FREE) != 0 && VM_MAPENT_ISWIRED(entry)) {
3826 			vm_map_unlock_read(map);
3827 			return EBUSY;
3828 		}
3829 		if (end <= current->end) {
3830 			break;
3831 		}
3832 		if (current->end != current->next->start) {
3833 			vm_map_unlock_read(map);
3834 			return EFAULT;
3835 		}
3836 	}
3837 
3838 	error = 0;
3839 	for (current = entry; start < end; current = current->next) {
3840 		amap = current->aref.ar_amap;	/* upper layer */
3841 		uobj = current->object.uvm_obj;	/* lower layer */
3842 		KASSERT(start >= current->start);
3843 
3844 		/*
3845 		 * No amap cleaning necessary if:
3846 		 *
3847 		 *	(1) There's no amap.
3848 		 *
3849 		 *	(2) We're not deactivating or freeing pages.
3850 		 */
3851 
3852 		if (amap == NULL || (flags & (PGO_DEACTIVATE|PGO_FREE)) == 0)
3853 			goto flush_object;
3854 
3855 		offset = start - current->start;
3856 		size = MIN(end, current->end) - start;
3857 
3858 		amap_lock(amap, RW_WRITER);
3859 		for ( ; size != 0; size -= PAGE_SIZE, offset += PAGE_SIZE) {
3860 			anon = amap_lookup(&current->aref, offset);
3861 			if (anon == NULL)
3862 				continue;
3863 
3864 			KASSERT(anon->an_lock == amap->am_lock);
3865 			pg = anon->an_page;
3866 			if (pg == NULL) {
3867 				continue;
3868 			}
3869 			if (pg->flags & PG_BUSY) {
3870 				continue;
3871 			}
3872 
3873 			switch (flags & (PGO_CLEANIT|PGO_FREE|PGO_DEACTIVATE)) {
3874 
3875 			/*
3876 			 * In these first 3 cases, we just deactivate the page.
3877 			 */
3878 
3879 			case PGO_CLEANIT|PGO_FREE:
3880 			case PGO_CLEANIT|PGO_DEACTIVATE:
3881 			case PGO_DEACTIVATE:
3882  deactivate_it:
3883 				/*
3884 				 * skip the page if it's loaned or wired,
3885 				 * since it shouldn't be on a paging queue
3886 				 * at all in these cases.
3887 				 */
3888 
3889 				if (pg->loan_count != 0 ||
3890 				    pg->wire_count != 0) {
3891 					continue;
3892 				}
3893 				KASSERT(pg->uanon == anon);
3894 				uvm_pagelock(pg);
3895 				uvm_pagedeactivate(pg);
3896 				uvm_pageunlock(pg);
3897 				continue;
3898 
3899 			case PGO_FREE:
3900 
3901 				/*
3902 				 * If there are multiple references to
3903 				 * the amap, just deactivate the page.
3904 				 */
3905 
3906 				if (amap_refs(amap) > 1)
3907 					goto deactivate_it;
3908 
3909 				/* skip the page if it's wired */
3910 				if (pg->wire_count != 0) {
3911 					continue;
3912 				}
3913 				amap_unadd(&current->aref, offset);
3914 				refs = --anon->an_ref;
3915 				if (refs == 0) {
3916 					uvm_anfree(anon);
3917 				}
3918 				continue;
3919 			}
3920 		}
3921 		amap_unlock(amap);
3922 
3923  flush_object:
3924 		/*
3925 		 * flush pages if we've got a valid backing object.
3926 		 * note that we must always clean object pages before
3927 		 * freeing them since otherwise we could reveal stale
3928 		 * data from files.
3929 		 */
3930 
3931 		uoff = current->offset + (start - current->start);
3932 		size = MIN(end, current->end) - start;
3933 		if (uobj != NULL) {
3934 			rw_enter(uobj->vmobjlock, RW_WRITER);
3935 			if (uobj->pgops->pgo_put != NULL)
3936 				error = (uobj->pgops->pgo_put)(uobj, uoff,
3937 				    uoff + size, flags | PGO_CLEANIT);
3938 			else
3939 				error = 0;
3940 		}
3941 		start += size;
3942 	}
3943 	vm_map_unlock_read(map);
3944 	return (error);
3945 }
3946 
3947 
3948 /*
3949  * uvm_map_checkprot: check protection in map
3950  *
3951  * => must allow specified protection in a fully allocated region.
3952  * => map must be read or write locked by caller.
3953  */
3954 
3955 bool
3956 uvm_map_checkprot(struct vm_map *map, vaddr_t start, vaddr_t end,
3957     vm_prot_t protection)
3958 {
3959 	struct vm_map_entry *entry;
3960 	struct vm_map_entry *tmp_entry;
3961 
3962 	if (!uvm_map_lookup_entry(map, start, &tmp_entry)) {
3963 		return (false);
3964 	}
3965 	entry = tmp_entry;
3966 	while (start < end) {
3967 		if (entry == &map->header) {
3968 			return (false);
3969 		}
3970 
3971 		/*
3972 		 * no holes allowed
3973 		 */
3974 
3975 		if (start < entry->start) {
3976 			return (false);
3977 		}
3978 
3979 		/*
3980 		 * check protection associated with entry
3981 		 */
3982 
3983 		if ((entry->protection & protection) != protection) {
3984 			return (false);
3985 		}
3986 		start = entry->end;
3987 		entry = entry->next;
3988 	}
3989 	return (true);
3990 }
3991 
3992 /*
3993  * uvmspace_alloc: allocate a vmspace structure.
3994  *
3995  * - structure includes vm_map and pmap
3996  * - XXX: no locking on this structure
3997  * - refcnt set to 1, rest must be init'd by caller
3998  */
3999 struct vmspace *
4000 uvmspace_alloc(vaddr_t vmin, vaddr_t vmax, bool topdown)
4001 {
4002 	struct vmspace *vm;
4003 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4004 
4005 	vm = pool_cache_get(&uvm_vmspace_cache, PR_WAITOK);
4006 	uvmspace_init(vm, NULL, vmin, vmax, topdown);
4007 	UVMHIST_LOG(maphist,"<- done (vm=%#jx)", (uintptr_t)vm, 0, 0, 0);
4008 	return (vm);
4009 }
4010 
4011 /*
4012  * uvmspace_init: initialize a vmspace structure.
4013  *
4014  * - XXX: no locking on this structure
4015  * - refcnt set to 1, rest must be init'd by caller
4016  */
4017 void
4018 uvmspace_init(struct vmspace *vm, struct pmap *pmap, vaddr_t vmin,
4019     vaddr_t vmax, bool topdown)
4020 {
4021 	UVMHIST_FUNC(__func__);
4022 	UVMHIST_CALLARGS(maphist, "(vm=%#jx, pmap=%#jx, vmin=%#jx, vmax=%#jx",
4023 	    (uintptr_t)vm, (uintptr_t)pmap, vmin, vmax);
4024 	UVMHIST_LOG(maphist, "   topdown=%ju)", topdown, 0, 0, 0);
4025 
4026 	memset(vm, 0, sizeof(*vm));
4027 	uvm_map_setup(&vm->vm_map, vmin, vmax, VM_MAP_PAGEABLE
4028 	    | (topdown ? VM_MAP_TOPDOWN : 0)
4029 	    );
4030 	if (pmap)
4031 		pmap_reference(pmap);
4032 	else
4033 		pmap = pmap_create();
4034 	vm->vm_map.pmap = pmap;
4035 	vm->vm_refcnt = 1;
4036 	UVMHIST_LOG(maphist,"<- done",0,0,0,0);
4037 }
4038 
4039 /*
4040  * uvmspace_share: share a vmspace between two processes
4041  *
4042  * - used for vfork, threads(?)
4043  */
4044 
4045 void
4046 uvmspace_share(struct proc *p1, struct proc *p2)
4047 {
4048 
4049 	uvmspace_addref(p1->p_vmspace);
4050 	p2->p_vmspace = p1->p_vmspace;
4051 }
4052 
4053 #if 0
4054 
4055 /*
4056  * uvmspace_unshare: ensure that process "p" has its own, unshared, vmspace
4057  *
4058  * - XXX: no locking on vmspace
4059  */
4060 
4061 void
4062 uvmspace_unshare(struct lwp *l)
4063 {
4064 	struct proc *p = l->l_proc;
4065 	struct vmspace *nvm, *ovm = p->p_vmspace;
4066 
4067 	if (ovm->vm_refcnt == 1)
4068 		/* nothing to do: vmspace isn't shared in the first place */
4069 		return;
4070 
4071 	/* make a new vmspace, still holding old one */
4072 	nvm = uvmspace_fork(ovm);
4073 
4074 	kpreempt_disable();
4075 	pmap_deactivate(l);		/* unbind old vmspace */
4076 	p->p_vmspace = nvm;
4077 	pmap_activate(l);		/* switch to new vmspace */
4078 	kpreempt_enable();
4079 
4080 	uvmspace_free(ovm);		/* drop reference to old vmspace */
4081 }
4082 
4083 #endif
4084 
4085 
4086 /*
4087  * uvmspace_spawn: a new process has been spawned and needs a vmspace
4088  */
4089 
4090 void
4091 uvmspace_spawn(struct lwp *l, vaddr_t start, vaddr_t end, bool topdown)
4092 {
4093 	struct proc *p = l->l_proc;
4094 	struct vmspace *nvm;
4095 
4096 #ifdef __HAVE_CPU_VMSPACE_EXEC
4097 	cpu_vmspace_exec(l, start, end);
4098 #endif
4099 
4100 	nvm = uvmspace_alloc(start, end, topdown);
4101 	kpreempt_disable();
4102 	p->p_vmspace = nvm;
4103 	pmap_activate(l);
4104 	kpreempt_enable();
4105 }
4106 
4107 /*
4108  * uvmspace_exec: the process wants to exec a new program
4109  */
4110 
4111 void
4112 uvmspace_exec(struct lwp *l, vaddr_t start, vaddr_t end, bool topdown)
4113 {
4114 	struct proc *p = l->l_proc;
4115 	struct vmspace *nvm, *ovm = p->p_vmspace;
4116 	struct vm_map *map;
4117 	int flags;
4118 
4119 	KASSERT(ovm != NULL);
4120 #ifdef __HAVE_CPU_VMSPACE_EXEC
4121 	cpu_vmspace_exec(l, start, end);
4122 #endif
4123 
4124 	map = &ovm->vm_map;
4125 	/*
4126 	 * see if more than one process is using this vmspace...
4127 	 */
4128 
4129 	if (ovm->vm_refcnt == 1
4130 	    && topdown == ((ovm->vm_map.flags & VM_MAP_TOPDOWN) != 0)) {
4131 
4132 		/*
4133 		 * if p is the only process using its vmspace then we can safely
4134 		 * recycle that vmspace for the program that is being exec'd.
4135 		 * But only if TOPDOWN matches the requested value for the new
4136 		 * vm space!
4137 		 */
4138 
4139 		/*
4140 		 * SYSV SHM semantics require us to kill all segments on an exec
4141 		 */
4142 		if (uvm_shmexit && ovm->vm_shm)
4143 			(*uvm_shmexit)(ovm);
4144 
4145 		/*
4146 		 * POSIX 1003.1b -- "lock future mappings" is revoked
4147 		 * when a process execs another program image.
4148 		 */
4149 
4150 		map->flags &= ~VM_MAP_WIREFUTURE;
4151 
4152 		/*
4153 		 * now unmap the old program.
4154 		 *
4155 		 * XXX set VM_MAP_DYING for the duration, so pmap_update()
4156 		 * is not called until the pmap has been totally cleared out
4157 		 * after pmap_remove_all(), or it can confuse some pmap
4158 		 * implementations.  it would be nice to handle this by
4159 		 * deferring the pmap_update() while it is known the address
4160 		 * space is not visible to any user LWP other than curlwp,
4161 		 * but there isn't an elegant way of inferring that right
4162 		 * now.
4163 		 */
4164 
4165 		flags = pmap_remove_all(map->pmap) ? UVM_FLAG_VAONLY : 0;
4166 		map->flags |= VM_MAP_DYING;
4167 		uvm_unmap1(map, vm_map_min(map), vm_map_max(map), flags);
4168 		map->flags &= ~VM_MAP_DYING;
4169 		pmap_update(map->pmap);
4170 		KASSERT(map->header.prev == &map->header);
4171 		KASSERT(map->nentries == 0);
4172 
4173 		/*
4174 		 * resize the map
4175 		 */
4176 
4177 		vm_map_setmin(map, start);
4178 		vm_map_setmax(map, end);
4179 	} else {
4180 
4181 		/*
4182 		 * p's vmspace is being shared, so we can't reuse it for p since
4183 		 * it is still being used for others.   allocate a new vmspace
4184 		 * for p
4185 		 */
4186 
4187 		nvm = uvmspace_alloc(start, end, topdown);
4188 
4189 		/*
4190 		 * install new vmspace and drop our ref to the old one.
4191 		 */
4192 
4193 		kpreempt_disable();
4194 		pmap_deactivate(l);
4195 		p->p_vmspace = nvm;
4196 		pmap_activate(l);
4197 		kpreempt_enable();
4198 
4199 		uvmspace_free(ovm);
4200 	}
4201 }
4202 
4203 /*
4204  * uvmspace_addref: add a reference to a vmspace.
4205  */
4206 
4207 void
4208 uvmspace_addref(struct vmspace *vm)
4209 {
4210 
4211 	KASSERT((vm->vm_map.flags & VM_MAP_DYING) == 0);
4212 	KASSERT(vm->vm_refcnt > 0);
4213 	atomic_inc_uint(&vm->vm_refcnt);
4214 }
4215 
4216 /*
4217  * uvmspace_free: free a vmspace data structure
4218  */
4219 
4220 void
4221 uvmspace_free(struct vmspace *vm)
4222 {
4223 	struct vm_map_entry *dead_entries;
4224 	struct vm_map *map = &vm->vm_map;
4225 	int flags;
4226 
4227 	UVMHIST_FUNC(__func__);
4228 	UVMHIST_CALLARGS(maphist,"(vm=%#jx) ref=%jd", (uintptr_t)vm,
4229 	    vm->vm_refcnt, 0, 0);
4230 	if (atomic_dec_uint_nv(&vm->vm_refcnt) > 0)
4231 		return;
4232 
4233 	/*
4234 	 * at this point, there should be no other references to the map.
4235 	 * delete all of the mappings, then destroy the pmap.
4236 	 */
4237 
4238 	map->flags |= VM_MAP_DYING;
4239 	flags = pmap_remove_all(map->pmap) ? UVM_FLAG_VAONLY : 0;
4240 
4241 	/* Get rid of any SYSV shared memory segments. */
4242 	if (uvm_shmexit && vm->vm_shm != NULL)
4243 		(*uvm_shmexit)(vm);
4244 
4245 	if (map->nentries) {
4246 		uvm_unmap_remove(map, vm_map_min(map), vm_map_max(map),
4247 		    &dead_entries, flags);
4248 		if (dead_entries != NULL)
4249 			uvm_unmap_detach(dead_entries, 0);
4250 	}
4251 	KASSERT(map->nentries == 0);
4252 	KASSERT(map->size == 0);
4253 
4254 	mutex_destroy(&map->misc_lock);
4255 	rw_destroy(&map->lock);
4256 	cv_destroy(&map->cv);
4257 	pmap_destroy(map->pmap);
4258 	pool_cache_put(&uvm_vmspace_cache, vm);
4259 }
4260 
4261 static struct vm_map_entry *
4262 uvm_mapent_clone(struct vm_map *new_map, struct vm_map_entry *old_entry,
4263     int flags)
4264 {
4265 	struct vm_map_entry *new_entry;
4266 
4267 	new_entry = uvm_mapent_alloc(new_map, 0);
4268 	/* old_entry -> new_entry */
4269 	uvm_mapent_copy(old_entry, new_entry);
4270 
4271 	/* new pmap has nothing wired in it */
4272 	new_entry->wired_count = 0;
4273 
4274 	/*
4275 	 * gain reference to object backing the map (can't
4276 	 * be a submap, already checked this case).
4277 	 */
4278 
4279 	if (new_entry->aref.ar_amap)
4280 		uvm_map_reference_amap(new_entry, flags);
4281 
4282 	if (new_entry->object.uvm_obj &&
4283 	    new_entry->object.uvm_obj->pgops->pgo_reference)
4284 		new_entry->object.uvm_obj->pgops->pgo_reference(
4285 			new_entry->object.uvm_obj);
4286 
4287 	/* insert entry at end of new_map's entry list */
4288 	uvm_map_entry_link(new_map, new_map->header.prev,
4289 	    new_entry);
4290 
4291 	return new_entry;
4292 }
4293 
4294 /*
4295  * share the mapping: this means we want the old and
4296  * new entries to share amaps and backing objects.
4297  */
4298 static void
4299 uvm_mapent_forkshared(struct vm_map *new_map, struct vm_map *old_map,
4300     struct vm_map_entry *old_entry)
4301 {
4302 	/*
4303 	 * if the old_entry needs a new amap (due to prev fork)
4304 	 * then we need to allocate it now so that we have
4305 	 * something we own to share with the new_entry.   [in
4306 	 * other words, we need to clear needs_copy]
4307 	 */
4308 
4309 	if (UVM_ET_ISNEEDSCOPY(old_entry)) {
4310 		/* get our own amap, clears needs_copy */
4311 		amap_copy(old_map, old_entry, AMAP_COPY_NOCHUNK,
4312 		    0, 0);
4313 		/* XXXCDC: WAITOK??? */
4314 	}
4315 
4316 	uvm_mapent_clone(new_map, old_entry, AMAP_SHARED);
4317 }
4318 
4319 
4320 static void
4321 uvm_mapent_forkcopy(struct vm_map *new_map, struct vm_map *old_map,
4322     struct vm_map_entry *old_entry)
4323 {
4324 	struct vm_map_entry *new_entry;
4325 
4326 	/*
4327 	 * copy-on-write the mapping (using mmap's
4328 	 * MAP_PRIVATE semantics)
4329 	 *
4330 	 * allocate new_entry, adjust reference counts.
4331 	 * (note that new references are read-only).
4332 	 */
4333 
4334 	new_entry = uvm_mapent_clone(new_map, old_entry, 0);
4335 
4336 	new_entry->etype |=
4337 	    (UVM_ET_COPYONWRITE|UVM_ET_NEEDSCOPY);
4338 
4339 	/*
4340 	 * the new entry will need an amap.  it will either
4341 	 * need to be copied from the old entry or created
4342 	 * from scratch (if the old entry does not have an
4343 	 * amap).  can we defer this process until later
4344 	 * (by setting "needs_copy") or do we need to copy
4345 	 * the amap now?
4346 	 *
4347 	 * we must copy the amap now if any of the following
4348 	 * conditions hold:
4349 	 * 1. the old entry has an amap and that amap is
4350 	 *    being shared.  this means that the old (parent)
4351 	 *    process is sharing the amap with another
4352 	 *    process.  if we do not clear needs_copy here
4353 	 *    we will end up in a situation where both the
4354 	 *    parent and child process are refering to the
4355 	 *    same amap with "needs_copy" set.  if the
4356 	 *    parent write-faults, the fault routine will
4357 	 *    clear "needs_copy" in the parent by allocating
4358 	 *    a new amap.   this is wrong because the
4359 	 *    parent is supposed to be sharing the old amap
4360 	 *    and the new amap will break that.
4361 	 *
4362 	 * 2. if the old entry has an amap and a non-zero
4363 	 *    wire count then we are going to have to call
4364 	 *    amap_cow_now to avoid page faults in the
4365 	 *    parent process.   since amap_cow_now requires
4366 	 *    "needs_copy" to be clear we might as well
4367 	 *    clear it here as well.
4368 	 *
4369 	 */
4370 
4371 	if (old_entry->aref.ar_amap != NULL) {
4372 		if ((amap_flags(old_entry->aref.ar_amap) & AMAP_SHARED) != 0 ||
4373 		    VM_MAPENT_ISWIRED(old_entry)) {
4374 
4375 			amap_copy(new_map, new_entry,
4376 			    AMAP_COPY_NOCHUNK, 0, 0);
4377 			/* XXXCDC: M_WAITOK ... ok? */
4378 		}
4379 	}
4380 
4381 	/*
4382 	 * if the parent's entry is wired down, then the
4383 	 * parent process does not want page faults on
4384 	 * access to that memory.  this means that we
4385 	 * cannot do copy-on-write because we can't write
4386 	 * protect the old entry.   in this case we
4387 	 * resolve all copy-on-write faults now, using
4388 	 * amap_cow_now.   note that we have already
4389 	 * allocated any needed amap (above).
4390 	 */
4391 
4392 	if (VM_MAPENT_ISWIRED(old_entry)) {
4393 
4394 		/*
4395 		 * resolve all copy-on-write faults now
4396 		 * (note that there is nothing to do if
4397 		 * the old mapping does not have an amap).
4398 		 */
4399 		if (old_entry->aref.ar_amap)
4400 			amap_cow_now(new_map, new_entry);
4401 
4402 	} else {
4403 		/*
4404 		 * setup mappings to trigger copy-on-write faults
4405 		 * we must write-protect the parent if it has
4406 		 * an amap and it is not already "needs_copy"...
4407 		 * if it is already "needs_copy" then the parent
4408 		 * has already been write-protected by a previous
4409 		 * fork operation.
4410 		 */
4411 		if (old_entry->aref.ar_amap &&
4412 		    !UVM_ET_ISNEEDSCOPY(old_entry)) {
4413 			if (old_entry->max_protection & VM_PROT_WRITE) {
4414 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
4415 				uvm_map_lock_entry(old_entry, RW_WRITER);
4416 #else
4417 				uvm_map_lock_entry(old_entry, RW_READER);
4418 #endif
4419 				pmap_protect(old_map->pmap,
4420 				    old_entry->start, old_entry->end,
4421 				    old_entry->protection & ~VM_PROT_WRITE);
4422 				uvm_map_unlock_entry(old_entry);
4423 			}
4424 			old_entry->etype |= UVM_ET_NEEDSCOPY;
4425 		}
4426 	}
4427 }
4428 
4429 /*
4430  * zero the mapping: the new entry will be zero initialized
4431  */
4432 static void
4433 uvm_mapent_forkzero(struct vm_map *new_map, struct vm_map *old_map,
4434     struct vm_map_entry *old_entry)
4435 {
4436 	struct vm_map_entry *new_entry;
4437 
4438 	new_entry = uvm_mapent_clone(new_map, old_entry, 0);
4439 
4440 	new_entry->etype |=
4441 	    (UVM_ET_COPYONWRITE|UVM_ET_NEEDSCOPY);
4442 
4443 	if (new_entry->aref.ar_amap) {
4444 		uvm_map_unreference_amap(new_entry, 0);
4445 		new_entry->aref.ar_pageoff = 0;
4446 		new_entry->aref.ar_amap = NULL;
4447 	}
4448 
4449 	if (UVM_ET_ISOBJ(new_entry)) {
4450 		if (new_entry->object.uvm_obj->pgops->pgo_detach)
4451 			new_entry->object.uvm_obj->pgops->pgo_detach(
4452 			    new_entry->object.uvm_obj);
4453 		new_entry->object.uvm_obj = NULL;
4454 		new_entry->etype &= ~UVM_ET_OBJ;
4455 	}
4456 }
4457 
4458 /*
4459  *   F O R K   -   m a i n   e n t r y   p o i n t
4460  */
4461 /*
4462  * uvmspace_fork: fork a process' main map
4463  *
4464  * => create a new vmspace for child process from parent.
4465  * => parent's map must not be locked.
4466  */
4467 
4468 struct vmspace *
4469 uvmspace_fork(struct vmspace *vm1)
4470 {
4471 	struct vmspace *vm2;
4472 	struct vm_map *old_map = &vm1->vm_map;
4473 	struct vm_map *new_map;
4474 	struct vm_map_entry *old_entry;
4475 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4476 
4477 	vm_map_lock(old_map);
4478 
4479 	vm2 = uvmspace_alloc(vm_map_min(old_map), vm_map_max(old_map),
4480 	    vm1->vm_map.flags & VM_MAP_TOPDOWN);
4481 	memcpy(&vm2->vm_startcopy, &vm1->vm_startcopy,
4482 	    (char *) (vm1 + 1) - (char *) &vm1->vm_startcopy);
4483 	new_map = &vm2->vm_map;		  /* XXX */
4484 
4485 	old_entry = old_map->header.next;
4486 	new_map->size = old_map->size;
4487 
4488 	/*
4489 	 * go entry-by-entry
4490 	 */
4491 
4492 	while (old_entry != &old_map->header) {
4493 
4494 		/*
4495 		 * first, some sanity checks on the old entry
4496 		 */
4497 
4498 		KASSERT(!UVM_ET_ISSUBMAP(old_entry));
4499 		KASSERT(UVM_ET_ISCOPYONWRITE(old_entry) ||
4500 			!UVM_ET_ISNEEDSCOPY(old_entry));
4501 
4502 		switch (old_entry->inheritance) {
4503 		case MAP_INHERIT_NONE:
4504 			/*
4505 			 * drop the mapping, modify size
4506 			 */
4507 			new_map->size -= old_entry->end - old_entry->start;
4508 			break;
4509 
4510 		case MAP_INHERIT_SHARE:
4511 			uvm_mapent_forkshared(new_map, old_map, old_entry);
4512 			break;
4513 
4514 		case MAP_INHERIT_COPY:
4515 			uvm_mapent_forkcopy(new_map, old_map, old_entry);
4516 			break;
4517 
4518 		case MAP_INHERIT_ZERO:
4519 			uvm_mapent_forkzero(new_map, old_map, old_entry);
4520 			break;
4521 		default:
4522 			KASSERT(0);
4523 			break;
4524 		}
4525 		old_entry = old_entry->next;
4526 	}
4527 
4528 	pmap_update(old_map->pmap);
4529 	vm_map_unlock(old_map);
4530 
4531 	if (uvm_shmfork && vm1->vm_shm)
4532 		(*uvm_shmfork)(vm1, vm2);
4533 
4534 #ifdef PMAP_FORK
4535 	pmap_fork(vm1->vm_map.pmap, vm2->vm_map.pmap);
4536 #endif
4537 
4538 	UVMHIST_LOG(maphist,"<- done",0,0,0,0);
4539 	return (vm2);
4540 }
4541 
4542 
4543 /*
4544  * uvm_mapent_trymerge: try to merge an entry with its neighbors.
4545  *
4546  * => called with map locked.
4547  * => return non zero if successfully merged.
4548  */
4549 
4550 int
4551 uvm_mapent_trymerge(struct vm_map *map, struct vm_map_entry *entry, int flags)
4552 {
4553 	struct uvm_object *uobj;
4554 	struct vm_map_entry *next;
4555 	struct vm_map_entry *prev;
4556 	vsize_t size;
4557 	int merged = 0;
4558 	bool copying;
4559 	int newetype;
4560 
4561 	if (entry->aref.ar_amap != NULL) {
4562 		return 0;
4563 	}
4564 	if ((entry->flags & UVM_MAP_NOMERGE) != 0) {
4565 		return 0;
4566 	}
4567 
4568 	uobj = entry->object.uvm_obj;
4569 	size = entry->end - entry->start;
4570 	copying = (flags & UVM_MERGE_COPYING) != 0;
4571 	newetype = copying ? (entry->etype & ~UVM_ET_NEEDSCOPY) : entry->etype;
4572 
4573 	next = entry->next;
4574 	if (next != &map->header &&
4575 	    next->start == entry->end &&
4576 	    ((copying && next->aref.ar_amap != NULL &&
4577 	    amap_refs(next->aref.ar_amap) == 1) ||
4578 	    (!copying && next->aref.ar_amap == NULL)) &&
4579 	    UVM_ET_ISCOMPATIBLE(next, newetype,
4580 	    uobj, entry->flags, entry->protection,
4581 	    entry->max_protection, entry->inheritance, entry->advice,
4582 	    entry->wired_count) &&
4583 	    (uobj == NULL || entry->offset + size == next->offset)) {
4584 		int error;
4585 
4586 		if (copying) {
4587 			error = amap_extend(next, size,
4588 			    AMAP_EXTEND_NOWAIT|AMAP_EXTEND_BACKWARDS);
4589 		} else {
4590 			error = 0;
4591 		}
4592 		if (error == 0) {
4593 			if (uobj) {
4594 				if (uobj->pgops->pgo_detach) {
4595 					uobj->pgops->pgo_detach(uobj);
4596 				}
4597 			}
4598 
4599 			entry->end = next->end;
4600 			clear_hints(map, next);
4601 			uvm_map_entry_unlink(map, next);
4602 			if (copying) {
4603 				entry->aref = next->aref;
4604 				entry->etype &= ~UVM_ET_NEEDSCOPY;
4605 			}
4606 			uvm_map_check(map, "trymerge forwardmerge");
4607 			uvm_mapent_free(next);
4608 			merged++;
4609 		}
4610 	}
4611 
4612 	prev = entry->prev;
4613 	if (prev != &map->header &&
4614 	    prev->end == entry->start &&
4615 	    ((copying && !merged && prev->aref.ar_amap != NULL &&
4616 	    amap_refs(prev->aref.ar_amap) == 1) ||
4617 	    (!copying && prev->aref.ar_amap == NULL)) &&
4618 	    UVM_ET_ISCOMPATIBLE(prev, newetype,
4619 	    uobj, entry->flags, entry->protection,
4620 	    entry->max_protection, entry->inheritance, entry->advice,
4621 	    entry->wired_count) &&
4622 	    (uobj == NULL ||
4623 	    prev->offset + prev->end - prev->start == entry->offset)) {
4624 		int error;
4625 
4626 		if (copying) {
4627 			error = amap_extend(prev, size,
4628 			    AMAP_EXTEND_NOWAIT|AMAP_EXTEND_FORWARDS);
4629 		} else {
4630 			error = 0;
4631 		}
4632 		if (error == 0) {
4633 			if (uobj) {
4634 				if (uobj->pgops->pgo_detach) {
4635 					uobj->pgops->pgo_detach(uobj);
4636 				}
4637 				entry->offset = prev->offset;
4638 			}
4639 
4640 			entry->start = prev->start;
4641 			clear_hints(map, prev);
4642 			uvm_map_entry_unlink(map, prev);
4643 			if (copying) {
4644 				entry->aref = prev->aref;
4645 				entry->etype &= ~UVM_ET_NEEDSCOPY;
4646 			}
4647 			uvm_map_check(map, "trymerge backmerge");
4648 			uvm_mapent_free(prev);
4649 			merged++;
4650 		}
4651 	}
4652 
4653 	return merged;
4654 }
4655 
4656 /*
4657  * uvm_map_setup: init map
4658  *
4659  * => map must not be in service yet.
4660  */
4661 
4662 void
4663 uvm_map_setup(struct vm_map *map, vaddr_t vmin, vaddr_t vmax, int flags)
4664 {
4665 
4666 	rb_tree_init(&map->rb_tree, &uvm_map_tree_ops);
4667 	map->header.next = map->header.prev = &map->header;
4668 	map->nentries = 0;
4669 	map->size = 0;
4670 	map->ref_count = 1;
4671 	vm_map_setmin(map, vmin);
4672 	vm_map_setmax(map, vmax);
4673 	map->flags = flags;
4674 	map->first_free = &map->header;
4675 	map->hint = &map->header;
4676 	map->timestamp = 0;
4677 	map->busy = NULL;
4678 
4679 	rw_init(&map->lock);
4680 	cv_init(&map->cv, "vm_map");
4681 	mutex_init(&map->misc_lock, MUTEX_DRIVER, IPL_NONE);
4682 }
4683 
4684 /*
4685  *   U N M A P   -   m a i n   e n t r y   p o i n t
4686  */
4687 
4688 /*
4689  * uvm_unmap1: remove mappings from a vm_map (from "start" up to "stop")
4690  *
4691  * => caller must check alignment and size
4692  * => map must be unlocked (we will lock it)
4693  * => flags is UVM_FLAG_QUANTUM or 0.
4694  */
4695 
4696 void
4697 uvm_unmap1(struct vm_map *map, vaddr_t start, vaddr_t end, int flags)
4698 {
4699 	struct vm_map_entry *dead_entries;
4700 	UVMHIST_FUNC(__func__);
4701 	UVMHIST_CALLARGS(maphist, "  (map=%#jx, start=%#jx, end=%#jx)",
4702 	    (uintptr_t)map, start, end, 0);
4703 
4704 	KASSERTMSG(start < end,
4705 	    "%s: map %p: start %#jx < end %#jx", __func__, map,
4706 	    (uintmax_t)start, (uintmax_t)end);
4707 	if (map == kernel_map) {
4708 		LOCKDEBUG_MEM_CHECK((void *)start, end - start);
4709 	}
4710 
4711 	/*
4712 	 * work now done by helper functions.   wipe the pmap's and then
4713 	 * detach from the dead entries...
4714 	 */
4715 	vm_map_lock(map);
4716 	uvm_unmap_remove(map, start, end, &dead_entries, flags);
4717 	vm_map_unlock(map);
4718 
4719 	if (dead_entries != NULL)
4720 		uvm_unmap_detach(dead_entries, 0);
4721 
4722 	UVMHIST_LOG(maphist, "<- done", 0,0,0,0);
4723 }
4724 
4725 
4726 /*
4727  * uvm_map_reference: add reference to a map
4728  *
4729  * => map need not be locked
4730  */
4731 
4732 void
4733 uvm_map_reference(struct vm_map *map)
4734 {
4735 
4736 	atomic_inc_uint(&map->ref_count);
4737 }
4738 
4739 void
4740 uvm_map_lock_entry(struct vm_map_entry *entry, krw_t op)
4741 {
4742 
4743 	if (entry->aref.ar_amap != NULL) {
4744 		amap_lock(entry->aref.ar_amap, op);
4745 	}
4746 	if (UVM_ET_ISOBJ(entry)) {
4747 		rw_enter(entry->object.uvm_obj->vmobjlock, op);
4748 	}
4749 }
4750 
4751 void
4752 uvm_map_unlock_entry(struct vm_map_entry *entry)
4753 {
4754 
4755 	if (UVM_ET_ISOBJ(entry)) {
4756 		rw_exit(entry->object.uvm_obj->vmobjlock);
4757 	}
4758 	if (entry->aref.ar_amap != NULL) {
4759 		amap_unlock(entry->aref.ar_amap);
4760 	}
4761 }
4762 
4763 #define	UVM_VOADDR_TYPE_MASK	0x3UL
4764 #define	UVM_VOADDR_TYPE_UOBJ	0x1UL
4765 #define	UVM_VOADDR_TYPE_ANON	0x2UL
4766 #define	UVM_VOADDR_OBJECT_MASK	~UVM_VOADDR_TYPE_MASK
4767 
4768 #define	UVM_VOADDR_GET_TYPE(voa)					\
4769 	((voa)->object & UVM_VOADDR_TYPE_MASK)
4770 #define	UVM_VOADDR_GET_OBJECT(voa)					\
4771 	((voa)->object & UVM_VOADDR_OBJECT_MASK)
4772 #define	UVM_VOADDR_SET_OBJECT(voa, obj, type)				\
4773 do {									\
4774 	KASSERT(((uintptr_t)(obj) & UVM_VOADDR_TYPE_MASK) == 0);	\
4775 	(voa)->object = ((uintptr_t)(obj)) | (type);			\
4776 } while (/*CONSTCOND*/0)
4777 
4778 #define	UVM_VOADDR_GET_UOBJ(voa)					\
4779 	((struct uvm_object *)UVM_VOADDR_GET_OBJECT(voa))
4780 #define	UVM_VOADDR_SET_UOBJ(voa, uobj)					\
4781 	UVM_VOADDR_SET_OBJECT(voa, uobj, UVM_VOADDR_TYPE_UOBJ)
4782 
4783 #define	UVM_VOADDR_GET_ANON(voa)					\
4784 	((struct vm_anon *)UVM_VOADDR_GET_OBJECT(voa))
4785 #define	UVM_VOADDR_SET_ANON(voa, anon)					\
4786 	UVM_VOADDR_SET_OBJECT(voa, anon, UVM_VOADDR_TYPE_ANON)
4787 
4788 /*
4789  * uvm_voaddr_acquire: returns the virtual object address corresponding
4790  * to the specified virtual address.
4791  *
4792  * => resolves COW so the true page identity is tracked.
4793  *
4794  * => acquires a reference on the page's owner (uvm_object or vm_anon)
4795  */
4796 bool
4797 uvm_voaddr_acquire(struct vm_map * const map, vaddr_t const va,
4798     struct uvm_voaddr * const voaddr)
4799 {
4800 	struct vm_map_entry *entry;
4801 	struct vm_anon *anon = NULL;
4802 	bool result = false;
4803 	bool exclusive = false;
4804 	void (*unlock_fn)(struct vm_map *);
4805 
4806 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4807 	UVMHIST_LOG(maphist,"(map=%#jx,va=%#jx)", (uintptr_t)map, va, 0, 0);
4808 
4809 	const vaddr_t start = trunc_page(va);
4810 	const vaddr_t end = round_page(va+1);
4811 
4812  lookup_again:
4813 	if (__predict_false(exclusive)) {
4814 		vm_map_lock(map);
4815 		unlock_fn = vm_map_unlock;
4816 	} else {
4817 		vm_map_lock_read(map);
4818 		unlock_fn = vm_map_unlock_read;
4819 	}
4820 
4821 	if (__predict_false(!uvm_map_lookup_entry(map, start, &entry))) {
4822 		unlock_fn(map);
4823 		UVMHIST_LOG(maphist,"<- done (no entry)",0,0,0,0);
4824 		return false;
4825 	}
4826 
4827 	if (__predict_false(entry->protection == VM_PROT_NONE)) {
4828 		unlock_fn(map);
4829 		UVMHIST_LOG(maphist,"<- done (PROT_NONE)",0,0,0,0);
4830 		return false;
4831 	}
4832 
4833 	/*
4834 	 * We have a fast path for the common case of "no COW resolution
4835 	 * needed" whereby we have taken a read lock on the map and if
4836 	 * we don't encounter any need to create a vm_anon then great!
4837 	 * But if we do, we loop around again, instead taking an exclusive
4838 	 * lock so that we can perform the fault.
4839 	 *
4840 	 * In the event that we have to resolve the fault, we do nearly the
4841 	 * same work as uvm_map_pageable() does:
4842 	 *
4843 	 * 1: holding the write lock, we create any anonymous maps that need
4844 	 *    to be created.  however, we do NOT need to clip the map entries
4845 	 *    in this case.
4846 	 *
4847 	 * 2: we downgrade to a read lock, and call uvm_fault_wire to fault
4848 	 *    in the page (assuming the entry is not already wired).  this
4849 	 *    is done because we need the vm_anon to be present.
4850 	 */
4851 	if (__predict_true(!VM_MAPENT_ISWIRED(entry))) {
4852 
4853 		bool need_fault = false;
4854 
4855 		/*
4856 		 * perform the action of vm_map_lookup that need the
4857 		 * write lock on the map: create an anonymous map for
4858 		 * a copy-on-write region, or an anonymous map for
4859 		 * a zero-fill region.
4860 		 */
4861 		if (__predict_false(UVM_ET_ISSUBMAP(entry))) {
4862 			unlock_fn(map);
4863 			UVMHIST_LOG(maphist,"<- done (submap)",0,0,0,0);
4864 			return false;
4865 		}
4866 		if (__predict_false(UVM_ET_ISNEEDSCOPY(entry) &&
4867 		    ((entry->max_protection & VM_PROT_WRITE) ||
4868 		     (entry->object.uvm_obj == NULL)))) {
4869 			if (!exclusive) {
4870 				/* need to take the slow path */
4871 				KASSERT(unlock_fn == vm_map_unlock_read);
4872 				vm_map_unlock_read(map);
4873 				exclusive = true;
4874 				goto lookup_again;
4875 			}
4876 			need_fault = true;
4877 			amap_copy(map, entry, 0, start, end);
4878 			/* XXXCDC: wait OK? */
4879 		}
4880 
4881 		/*
4882 		 * do a quick check to see if the fault has already
4883 		 * been resolved to the upper layer.
4884 		 */
4885 		if (__predict_true(entry->aref.ar_amap != NULL &&
4886 				   need_fault == false)) {
4887 			amap_lock(entry->aref.ar_amap, RW_WRITER);
4888 			anon = amap_lookup(&entry->aref, start - entry->start);
4889 			if (__predict_true(anon != NULL)) {
4890 				/* amap unlocked below */
4891 				goto found_anon;
4892 			}
4893 			amap_unlock(entry->aref.ar_amap);
4894 			need_fault = true;
4895 		}
4896 
4897 		/*
4898 		 * we predict this test as false because if we reach
4899 		 * this point, then we are likely dealing with a
4900 		 * shared memory region backed by a uvm_object, in
4901 		 * which case a fault to create the vm_anon is not
4902 		 * necessary.
4903 		 */
4904 		if (__predict_false(need_fault)) {
4905 			if (exclusive) {
4906 				vm_map_busy(map);
4907 				vm_map_unlock(map);
4908 				unlock_fn = vm_map_unbusy;
4909 			}
4910 
4911 			if (uvm_fault_wire(map, start, end,
4912 					   entry->max_protection, 1)) {
4913 				/* wiring failed */
4914 				unlock_fn(map);
4915 				UVMHIST_LOG(maphist,"<- done (wire failed)",
4916 					    0,0,0,0);
4917 				return false;
4918 			}
4919 
4920 			/*
4921 			 * now that we have resolved the fault, we can unwire
4922 			 * the page.
4923 			 */
4924 			if (exclusive) {
4925 				vm_map_lock(map);
4926 				vm_map_unbusy(map);
4927 				unlock_fn = vm_map_unlock;
4928 			}
4929 
4930 			uvm_fault_unwire_locked(map, start, end);
4931 		}
4932 	}
4933 
4934 	/* check the upper layer */
4935 	if (entry->aref.ar_amap) {
4936 		amap_lock(entry->aref.ar_amap, RW_WRITER);
4937 		anon = amap_lookup(&entry->aref, start - entry->start);
4938 		if (anon) {
4939  found_anon:		KASSERT(anon->an_lock == entry->aref.ar_amap->am_lock);
4940 			anon->an_ref++;
4941 			rw_obj_hold(anon->an_lock);
4942 			KASSERT(anon->an_ref != 0);
4943 			UVM_VOADDR_SET_ANON(voaddr, anon);
4944 			voaddr->offset = va & PAGE_MASK;
4945 			result = true;
4946 		}
4947 		amap_unlock(entry->aref.ar_amap);
4948 	}
4949 
4950 	/* check the lower layer */
4951 	if (!result && UVM_ET_ISOBJ(entry)) {
4952 		struct uvm_object *uobj = entry->object.uvm_obj;
4953 
4954 		KASSERT(uobj != NULL);
4955 		(*uobj->pgops->pgo_reference)(uobj);
4956 		UVM_VOADDR_SET_UOBJ(voaddr, uobj);
4957 		voaddr->offset = entry->offset + (va - entry->start);
4958 		result = true;
4959 	}
4960 
4961 	unlock_fn(map);
4962 
4963 	if (result) {
4964 		UVMHIST_LOG(maphist,
4965 		    "<- done OK (type=%jd,owner=%#jx,offset=%#jx)",
4966 		    UVM_VOADDR_GET_TYPE(voaddr),
4967 		    UVM_VOADDR_GET_OBJECT(voaddr),
4968 		    voaddr->offset, 0);
4969 	} else {
4970 		UVMHIST_LOG(maphist,"<- done (failed)",0,0,0,0);
4971 	}
4972 
4973 	return result;
4974 }
4975 
4976 /*
4977  * uvm_voaddr_release: release the references held by the
4978  * vitual object address.
4979  */
4980 void
4981 uvm_voaddr_release(struct uvm_voaddr * const voaddr)
4982 {
4983 
4984 	switch (UVM_VOADDR_GET_TYPE(voaddr)) {
4985 	case UVM_VOADDR_TYPE_UOBJ: {
4986 		struct uvm_object * const uobj = UVM_VOADDR_GET_UOBJ(voaddr);
4987 
4988 		KASSERT(uobj != NULL);
4989 		KASSERT(uobj->pgops->pgo_detach != NULL);
4990 		(*uobj->pgops->pgo_detach)(uobj);
4991 		break;
4992 	    }
4993 	case UVM_VOADDR_TYPE_ANON: {
4994 		struct vm_anon * const anon = UVM_VOADDR_GET_ANON(voaddr);
4995 		krwlock_t *lock;
4996 
4997 		KASSERT(anon != NULL);
4998 		rw_enter((lock = anon->an_lock), RW_WRITER);
4999 	    	KASSERT(anon->an_ref > 0);
5000 		if (--anon->an_ref == 0) {
5001 			uvm_anfree(anon);
5002 		}
5003 		rw_exit(lock);
5004 		rw_obj_free(lock);
5005 	    	break;
5006 	    }
5007 	default:
5008 		panic("uvm_voaddr_release: bad type");
5009 	}
5010 	memset(voaddr, 0, sizeof(*voaddr));
5011 }
5012 
5013 /*
5014  * uvm_voaddr_compare: compare two uvm_voaddr objects.
5015  *
5016  * => memcmp() semantics
5017  */
5018 int
5019 uvm_voaddr_compare(const struct uvm_voaddr * const voaddr1,
5020     const struct uvm_voaddr * const voaddr2)
5021 {
5022 	const uintptr_t type1 = UVM_VOADDR_GET_TYPE(voaddr1);
5023 	const uintptr_t type2 = UVM_VOADDR_GET_TYPE(voaddr2);
5024 
5025 	KASSERT(type1 == UVM_VOADDR_TYPE_UOBJ ||
5026 		type1 == UVM_VOADDR_TYPE_ANON);
5027 
5028 	KASSERT(type2 == UVM_VOADDR_TYPE_UOBJ ||
5029 		type2 == UVM_VOADDR_TYPE_ANON);
5030 
5031 	if (type1 < type2)
5032 		return -1;
5033 	if (type1 > type2)
5034 		return 1;
5035 
5036 	const uintptr_t addr1 = UVM_VOADDR_GET_OBJECT(voaddr1);
5037 	const uintptr_t addr2 = UVM_VOADDR_GET_OBJECT(voaddr2);
5038 
5039 	if (addr1 < addr2)
5040 		return -1;
5041 	if (addr1 > addr2)
5042 		return 1;
5043 
5044 	if (voaddr1->offset < voaddr2->offset)
5045 		return -1;
5046 	if (voaddr1->offset > voaddr2->offset)
5047 		return 1;
5048 
5049 	return 0;
5050 }
5051 
5052 #if defined(DDB) || defined(DEBUGPRINT)
5053 
5054 /*
5055  * uvm_map_printit: actually prints the map
5056  */
5057 
5058 void
5059 uvm_map_printit(struct vm_map *map, bool full,
5060     void (*pr)(const char *, ...))
5061 {
5062 	struct vm_map_entry *entry;
5063 
5064 	(*pr)("MAP %p: [%#lx->%#lx]\n", map, vm_map_min(map),
5065 	    vm_map_max(map));
5066 	(*pr)("\t#ent=%d, sz=%d, ref=%d, version=%d, flags=%#x\n",
5067 	    map->nentries, map->size, map->ref_count, map->timestamp,
5068 	    map->flags);
5069 	(*pr)("\tpmap=%p(resident=%ld, wired=%ld)\n", map->pmap,
5070 	    pmap_resident_count(map->pmap), pmap_wired_count(map->pmap));
5071 	if (!full)
5072 		return;
5073 	for (entry = map->header.next; entry != &map->header;
5074 	    entry = entry->next) {
5075 		(*pr)(" - %p: %#lx->%#lx: obj=%p/%#llx, amap=%p/%d\n",
5076 		    entry, entry->start, entry->end, entry->object.uvm_obj,
5077 		    (long long)entry->offset, entry->aref.ar_amap,
5078 		    entry->aref.ar_pageoff);
5079 		(*pr)(
5080 		    "\tsubmap=%c, cow=%c, nc=%c, prot(max)=%d/%d, inh=%d, "
5081 		    "wc=%d, adv=%d\n",
5082 		    (entry->etype & UVM_ET_SUBMAP) ? 'T' : 'F',
5083 		    (entry->etype & UVM_ET_COPYONWRITE) ? 'T' : 'F',
5084 		    (entry->etype & UVM_ET_NEEDSCOPY) ? 'T' : 'F',
5085 		    entry->protection, entry->max_protection,
5086 		    entry->inheritance, entry->wired_count, entry->advice);
5087 	}
5088 }
5089 
5090 void
5091 uvm_whatis(uintptr_t addr, void (*pr)(const char *, ...))
5092 {
5093 	struct vm_map *map;
5094 
5095 	for (map = kernel_map;;) {
5096 		struct vm_map_entry *entry;
5097 
5098 		if (!uvm_map_lookup_entry_bytree(map, (vaddr_t)addr, &entry)) {
5099 			break;
5100 		}
5101 		(*pr)("%p is %p+%zu from VMMAP %p\n",
5102 		    (void *)addr, (void *)entry->start,
5103 		    (size_t)(addr - (uintptr_t)entry->start), map);
5104 		if (!UVM_ET_ISSUBMAP(entry)) {
5105 			break;
5106 		}
5107 		map = entry->object.sub_map;
5108 	}
5109 }
5110 
5111 #endif /* DDB || DEBUGPRINT */
5112 
5113 #ifndef __USER_VA0_IS_SAFE
5114 static int
5115 sysctl_user_va0_disable(SYSCTLFN_ARGS)
5116 {
5117 	struct sysctlnode node;
5118 	int t, error;
5119 
5120 	node = *rnode;
5121 	node.sysctl_data = &t;
5122 	t = user_va0_disable;
5123 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
5124 	if (error || newp == NULL)
5125 		return (error);
5126 
5127 	if (!t && user_va0_disable &&
5128 	    kauth_authorize_system(l->l_cred, KAUTH_SYSTEM_MAP_VA_ZERO, 0,
5129 	    NULL, NULL, NULL))
5130 		return EPERM;
5131 
5132 	user_va0_disable = !!t;
5133 	return 0;
5134 }
5135 #endif
5136 
5137 static int
5138 fill_vmentry(struct lwp *l, struct proc *p, struct kinfo_vmentry *kve,
5139     struct vm_map *m, struct vm_map_entry *e)
5140 {
5141 #ifndef _RUMPKERNEL
5142 	int error;
5143 
5144 	memset(kve, 0, sizeof(*kve));
5145 	KASSERT(e != NULL);
5146 	if (UVM_ET_ISOBJ(e)) {
5147 		struct uvm_object *uobj = e->object.uvm_obj;
5148 		KASSERT(uobj != NULL);
5149 		kve->kve_ref_count = uobj->uo_refs;
5150 		kve->kve_count = uobj->uo_npages;
5151 		if (UVM_OBJ_IS_VNODE(uobj)) {
5152 			struct vattr va;
5153 			struct vnode *vp = (struct vnode *)uobj;
5154 			vn_lock(vp, LK_SHARED | LK_RETRY);
5155 			error = VOP_GETATTR(vp, &va, l->l_cred);
5156 			VOP_UNLOCK(vp);
5157 			kve->kve_type = KVME_TYPE_VNODE;
5158 			if (error == 0) {
5159 				kve->kve_vn_size = vp->v_size;
5160 				kve->kve_vn_type = (int)vp->v_type;
5161 				kve->kve_vn_mode = va.va_mode;
5162 				kve->kve_vn_rdev = va.va_rdev;
5163 				kve->kve_vn_fileid = va.va_fileid;
5164 				kve->kve_vn_fsid = va.va_fsid;
5165 				error = vnode_to_path(kve->kve_path,
5166 				    sizeof(kve->kve_path) / 2, vp, l, p);
5167 #ifdef DIAGNOSTIC
5168 				if (error)
5169 					printf("%s: vp %p error %d\n", __func__,
5170 						vp, error);
5171 #endif
5172 			}
5173 		} else if (UVM_OBJ_IS_KERN_OBJECT(uobj)) {
5174 			kve->kve_type = KVME_TYPE_KERN;
5175 		} else if (UVM_OBJ_IS_DEVICE(uobj)) {
5176 			kve->kve_type = KVME_TYPE_DEVICE;
5177 		} else if (UVM_OBJ_IS_AOBJ(uobj)) {
5178 			kve->kve_type = KVME_TYPE_ANON;
5179 		} else {
5180 			kve->kve_type = KVME_TYPE_OBJECT;
5181 		}
5182 	} else if (UVM_ET_ISSUBMAP(e)) {
5183 		struct vm_map *map = e->object.sub_map;
5184 		KASSERT(map != NULL);
5185 		kve->kve_ref_count = map->ref_count;
5186 		kve->kve_count = map->nentries;
5187 		kve->kve_type = KVME_TYPE_SUBMAP;
5188 	} else
5189 		kve->kve_type = KVME_TYPE_UNKNOWN;
5190 
5191 	kve->kve_start = e->start;
5192 	kve->kve_end = e->end;
5193 	kve->kve_offset = e->offset;
5194 	kve->kve_wired_count = e->wired_count;
5195 	kve->kve_inheritance = e->inheritance;
5196 	kve->kve_attributes = 0; /* unused */
5197 	kve->kve_advice = e->advice;
5198 #define PROT(p) (((p) & VM_PROT_READ) ? KVME_PROT_READ : 0) | \
5199 	(((p) & VM_PROT_WRITE) ? KVME_PROT_WRITE : 0) | \
5200 	(((p) & VM_PROT_EXECUTE) ? KVME_PROT_EXEC : 0)
5201 	kve->kve_protection = PROT(e->protection);
5202 	kve->kve_max_protection = PROT(e->max_protection);
5203 	kve->kve_flags |= (e->etype & UVM_ET_COPYONWRITE)
5204 	    ? KVME_FLAG_COW : 0;
5205 	kve->kve_flags |= (e->etype & UVM_ET_NEEDSCOPY)
5206 	    ? KVME_FLAG_NEEDS_COPY : 0;
5207 	kve->kve_flags |= (m->flags & VM_MAP_TOPDOWN)
5208 	    ? KVME_FLAG_GROWS_DOWN : KVME_FLAG_GROWS_UP;
5209 	kve->kve_flags |= (m->flags & VM_MAP_PAGEABLE)
5210 	    ? KVME_FLAG_PAGEABLE : 0;
5211 #endif
5212 	return 0;
5213 }
5214 
5215 static int
5216 fill_vmentries(struct lwp *l, pid_t pid, u_int elem_size, void *oldp,
5217     size_t *oldlenp)
5218 {
5219 	int error;
5220 	struct proc *p;
5221 	struct kinfo_vmentry *vme;
5222 	struct vmspace *vm;
5223 	struct vm_map *map;
5224 	struct vm_map_entry *entry;
5225 	char *dp;
5226 	size_t count, vmesize;
5227 
5228 	if (elem_size == 0 || elem_size > 2 * sizeof(*vme))
5229 		return EINVAL;
5230 
5231 	if (oldp) {
5232 		if (*oldlenp > 10UL * 1024UL * 1024UL)
5233 			return E2BIG;
5234 		count = *oldlenp / elem_size;
5235 		if (count == 0)
5236 			return ENOMEM;
5237 		vmesize = count * sizeof(*vme);
5238 	} else
5239 		vmesize = 0;
5240 
5241 	if ((error = proc_find_locked(l, &p, pid)) != 0)
5242 		return error;
5243 
5244 	vme = NULL;
5245 	count = 0;
5246 
5247 	if ((error = proc_vmspace_getref(p, &vm)) != 0)
5248 		goto out;
5249 
5250 	map = &vm->vm_map;
5251 	vm_map_lock_read(map);
5252 
5253 	dp = oldp;
5254 	if (oldp)
5255 		vme = kmem_alloc(vmesize, KM_SLEEP);
5256 	for (entry = map->header.next; entry != &map->header;
5257 	    entry = entry->next) {
5258 		if (oldp && (dp - (char *)oldp) < vmesize) {
5259 			error = fill_vmentry(l, p, &vme[count], map, entry);
5260 			if (error)
5261 				goto out;
5262 			dp += elem_size;
5263 		}
5264 		count++;
5265 	}
5266 	vm_map_unlock_read(map);
5267 	uvmspace_free(vm);
5268 
5269 out:
5270 	if (pid != -1)
5271 		mutex_exit(p->p_lock);
5272 	if (error == 0) {
5273 		const u_int esize = uimin(sizeof(*vme), elem_size);
5274 		dp = oldp;
5275 		for (size_t i = 0; i < count; i++) {
5276 			if (oldp && (dp - (char *)oldp) < vmesize) {
5277 				error = sysctl_copyout(l, &vme[i], dp, esize);
5278 				if (error)
5279 					break;
5280 				dp += elem_size;
5281 			} else
5282 				break;
5283 		}
5284 		count *= elem_size;
5285 		if (oldp != NULL && *oldlenp < count)
5286 			error = ENOSPC;
5287 		*oldlenp = count;
5288 	}
5289 	if (vme)
5290 		kmem_free(vme, vmesize);
5291 	return error;
5292 }
5293 
5294 static int
5295 sysctl_vmproc(SYSCTLFN_ARGS)
5296 {
5297 	int error;
5298 
5299 	if (namelen == 1 && name[0] == CTL_QUERY)
5300 		return (sysctl_query(SYSCTLFN_CALL(rnode)));
5301 
5302 	if (namelen == 0)
5303 		return EINVAL;
5304 
5305 	switch (name[0]) {
5306 	case VM_PROC_MAP:
5307 		if (namelen != 3)
5308 			return EINVAL;
5309 		sysctl_unlock();
5310 		error = fill_vmentries(l, name[1], name[2], oldp, oldlenp);
5311 		sysctl_relock();
5312 		return error;
5313 	default:
5314 		return EINVAL;
5315 	}
5316 }
5317 
5318 SYSCTL_SETUP(sysctl_uvmmap_setup, "sysctl uvmmap setup")
5319 {
5320 
5321 	sysctl_createv(clog, 0, NULL, NULL,
5322 		       CTLFLAG_PERMANENT,
5323 		       CTLTYPE_STRUCT, "proc",
5324 		       SYSCTL_DESCR("Process vm information"),
5325 		       sysctl_vmproc, 0, NULL, 0,
5326 		       CTL_VM, VM_PROC, CTL_EOL);
5327 #ifndef __USER_VA0_IS_SAFE
5328         sysctl_createv(clog, 0, NULL, NULL,
5329                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
5330                        CTLTYPE_INT, "user_va0_disable",
5331                        SYSCTL_DESCR("Disable VA 0"),
5332                        sysctl_user_va0_disable, 0, &user_va0_disable, 0,
5333                        CTL_VM, CTL_CREATE, CTL_EOL);
5334 #endif
5335 }
5336