xref: /netbsd-src/sys/uvm/uvm_map.c (revision 972fdaff44babb0781c0f95f2aea248ec621cdd2)
1 /*	$NetBSD: uvm_map.c,v 1.407 2023/08/03 03:15:48 rin Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Charles D. Cranor and Washington University.
5  * Copyright (c) 1991, 1993, The Regents of the University of California.
6  *
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to Berkeley by
10  * The Mach Operating System project at Carnegie-Mellon University.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)vm_map.c    8.3 (Berkeley) 1/12/94
37  * from: Id: uvm_map.c,v 1.1.2.27 1998/02/07 01:16:54 chs Exp
38  *
39  *
40  * Copyright (c) 1987, 1990 Carnegie-Mellon University.
41  * All rights reserved.
42  *
43  * Permission to use, copy, modify and distribute this software and
44  * its documentation is hereby granted, provided that both the copyright
45  * notice and this permission notice appear in all copies of the
46  * software, derivative works or modified versions, and any portions
47  * thereof, and that both notices appear in supporting documentation.
48  *
49  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
50  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND
51  * FOR ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
52  *
53  * Carnegie Mellon requests users of this software to return to
54  *
55  *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
56  *  School of Computer Science
57  *  Carnegie Mellon University
58  *  Pittsburgh PA 15213-3890
59  *
60  * any improvements or extensions that they make and grant Carnegie the
61  * rights to redistribute these changes.
62  */
63 
64 /*
65  * uvm_map.c: uvm map operations
66  */
67 
68 #include <sys/cdefs.h>
69 __KERNEL_RCSID(0, "$NetBSD: uvm_map.c,v 1.407 2023/08/03 03:15:48 rin Exp $");
70 
71 #include "opt_ddb.h"
72 #include "opt_pax.h"
73 #include "opt_uvmhist.h"
74 #include "opt_uvm.h"
75 #include "opt_sysv.h"
76 
77 #include <sys/param.h>
78 #include <sys/systm.h>
79 #include <sys/mman.h>
80 #include <sys/proc.h>
81 #include <sys/pool.h>
82 #include <sys/kernel.h>
83 #include <sys/mount.h>
84 #include <sys/pax.h>
85 #include <sys/vnode.h>
86 #include <sys/filedesc.h>
87 #include <sys/lockdebug.h>
88 #include <sys/atomic.h>
89 #include <sys/sysctl.h>
90 #ifndef __USER_VA0_IS_SAFE
91 #include <sys/kauth.h>
92 #include "opt_user_va0_disable_default.h"
93 #endif
94 
95 #include <sys/shm.h>
96 
97 #include <uvm/uvm.h>
98 #include <uvm/uvm_readahead.h>
99 
100 #if defined(DDB) || defined(DEBUGPRINT)
101 #include <uvm/uvm_ddb.h>
102 #endif
103 
104 #ifdef UVMHIST
105 #ifndef UVMHIST_MAPHIST_SIZE
106 #define UVMHIST_MAPHIST_SIZE 100
107 #endif
108 static struct kern_history_ent maphistbuf[UVMHIST_MAPHIST_SIZE];
109 UVMHIST_DEFINE(maphist) = UVMHIST_INITIALIZER(maphist, maphistbuf);
110 #endif
111 
112 #if !defined(UVMMAP_COUNTERS)
113 
114 #define	UVMMAP_EVCNT_DEFINE(name)	/* nothing */
115 #define UVMMAP_EVCNT_INCR(ev)		/* nothing */
116 #define UVMMAP_EVCNT_DECR(ev)		/* nothing */
117 
118 #else /* defined(UVMMAP_NOCOUNTERS) */
119 
120 #include <sys/evcnt.h>
121 #define	UVMMAP_EVCNT_DEFINE(name) \
122 struct evcnt uvmmap_evcnt_##name = EVCNT_INITIALIZER(EVCNT_TYPE_MISC, NULL, \
123     "uvmmap", #name); \
124 EVCNT_ATTACH_STATIC(uvmmap_evcnt_##name);
125 #define	UVMMAP_EVCNT_INCR(ev)		uvmmap_evcnt_##ev.ev_count++
126 #define	UVMMAP_EVCNT_DECR(ev)		uvmmap_evcnt_##ev.ev_count--
127 
128 #endif /* defined(UVMMAP_NOCOUNTERS) */
129 
130 UVMMAP_EVCNT_DEFINE(ubackmerge)
131 UVMMAP_EVCNT_DEFINE(uforwmerge)
132 UVMMAP_EVCNT_DEFINE(ubimerge)
133 UVMMAP_EVCNT_DEFINE(unomerge)
134 UVMMAP_EVCNT_DEFINE(kbackmerge)
135 UVMMAP_EVCNT_DEFINE(kforwmerge)
136 UVMMAP_EVCNT_DEFINE(kbimerge)
137 UVMMAP_EVCNT_DEFINE(knomerge)
138 UVMMAP_EVCNT_DEFINE(map_call)
139 UVMMAP_EVCNT_DEFINE(mlk_call)
140 UVMMAP_EVCNT_DEFINE(mlk_hint)
141 UVMMAP_EVCNT_DEFINE(mlk_tree)
142 UVMMAP_EVCNT_DEFINE(mlk_treeloop)
143 
144 const char vmmapbsy[] = "vmmapbsy";
145 
146 /*
147  * cache for vmspace structures.
148  */
149 
150 static struct pool_cache uvm_vmspace_cache;
151 
152 /*
153  * cache for dynamically-allocated map entries.
154  */
155 
156 static struct pool_cache uvm_map_entry_cache;
157 
158 #ifdef PMAP_GROWKERNEL
159 /*
160  * This global represents the end of the kernel virtual address
161  * space.  If we want to exceed this, we must grow the kernel
162  * virtual address space dynamically.
163  *
164  * Note, this variable is locked by kernel_map's lock.
165  */
166 vaddr_t uvm_maxkaddr;
167 #endif
168 
169 #ifndef __USER_VA0_IS_SAFE
170 #ifndef __USER_VA0_DISABLE_DEFAULT
171 #define __USER_VA0_DISABLE_DEFAULT 1
172 #endif
173 #ifdef USER_VA0_DISABLE_DEFAULT /* kernel config option overrides */
174 #undef __USER_VA0_DISABLE_DEFAULT
175 #define __USER_VA0_DISABLE_DEFAULT USER_VA0_DISABLE_DEFAULT
176 #endif
177 int user_va0_disable = __USER_VA0_DISABLE_DEFAULT;
178 #endif
179 
180 /*
181  * macros
182  */
183 
184 /*
185  * uvm_map_align_va: round down or up virtual address
186  */
187 static __inline void
188 uvm_map_align_va(vaddr_t *vap, vsize_t align, int topdown)
189 {
190 
191 	KASSERT(powerof2(align));
192 
193 	if (align != 0 && (*vap & (align - 1)) != 0) {
194 		if (topdown)
195 			*vap = rounddown2(*vap, align);
196 		else
197 			*vap = roundup2(*vap, align);
198 	}
199 }
200 
201 /*
202  * UVM_ET_ISCOMPATIBLE: check some requirements for map entry merging
203  */
204 extern struct vm_map *pager_map;
205 
206 #define	UVM_ET_ISCOMPATIBLE(ent, type, uobj, meflags, \
207     prot, maxprot, inh, adv, wire) \
208 	((ent)->etype == (type) && \
209 	(((ent)->flags ^ (meflags)) & (UVM_MAP_NOMERGE)) == 0 && \
210 	(ent)->object.uvm_obj == (uobj) && \
211 	(ent)->protection == (prot) && \
212 	(ent)->max_protection == (maxprot) && \
213 	(ent)->inheritance == (inh) && \
214 	(ent)->advice == (adv) && \
215 	(ent)->wired_count == (wire))
216 
217 /*
218  * uvm_map_entry_link: insert entry into a map
219  *
220  * => map must be locked
221  */
222 #define uvm_map_entry_link(map, after_where, entry) do { \
223 	uvm_mapent_check(entry); \
224 	(map)->nentries++; \
225 	(entry)->prev = (after_where); \
226 	(entry)->next = (after_where)->next; \
227 	(entry)->prev->next = (entry); \
228 	(entry)->next->prev = (entry); \
229 	uvm_rb_insert((map), (entry)); \
230 } while (/*CONSTCOND*/ 0)
231 
232 /*
233  * uvm_map_entry_unlink: remove entry from a map
234  *
235  * => map must be locked
236  */
237 #define uvm_map_entry_unlink(map, entry) do { \
238 	KASSERT((entry) != (map)->first_free); \
239 	KASSERT((entry) != (map)->hint); \
240 	uvm_mapent_check(entry); \
241 	(map)->nentries--; \
242 	(entry)->next->prev = (entry)->prev; \
243 	(entry)->prev->next = (entry)->next; \
244 	uvm_rb_remove((map), (entry)); \
245 } while (/*CONSTCOND*/ 0)
246 
247 /*
248  * SAVE_HINT: saves the specified entry as the hint for future lookups.
249  *
250  * => map need not be locked.
251  */
252 #define SAVE_HINT(map, check, value) do { \
253 	if ((map)->hint == (check)) \
254 		(map)->hint = (value); \
255 } while (/*CONSTCOND*/ 0)
256 
257 /*
258  * clear_hints: ensure that hints don't point to the entry.
259  *
260  * => map must be write-locked.
261  */
262 static void
263 clear_hints(struct vm_map *map, struct vm_map_entry *ent)
264 {
265 
266 	SAVE_HINT(map, ent, ent->prev);
267 	if (map->first_free == ent) {
268 		map->first_free = ent->prev;
269 	}
270 }
271 
272 /*
273  * VM_MAP_RANGE_CHECK: check and correct range
274  *
275  * => map must at least be read locked
276  */
277 
278 #define VM_MAP_RANGE_CHECK(map, start, end) do { \
279 	if (start < vm_map_min(map))		\
280 		start = vm_map_min(map);	\
281 	if (end > vm_map_max(map))		\
282 		end = vm_map_max(map);		\
283 	if (start > end)			\
284 		start = end;			\
285 } while (/*CONSTCOND*/ 0)
286 
287 /*
288  * local prototypes
289  */
290 
291 static struct vm_map_entry *
292 		uvm_mapent_alloc(struct vm_map *, int);
293 static void	uvm_mapent_copy(struct vm_map_entry *, struct vm_map_entry *);
294 static void	uvm_mapent_free(struct vm_map_entry *);
295 #if defined(DEBUG)
296 static void	_uvm_mapent_check(const struct vm_map_entry *, int);
297 #define	uvm_mapent_check(map)	_uvm_mapent_check(map, __LINE__)
298 #else /* defined(DEBUG) */
299 #define	uvm_mapent_check(e)	/* nothing */
300 #endif /* defined(DEBUG) */
301 
302 static void	uvm_map_entry_unwire(struct vm_map *, struct vm_map_entry *);
303 static void	uvm_map_reference_amap(struct vm_map_entry *, int);
304 static int	uvm_map_space_avail(vaddr_t *, vsize_t, voff_t, vsize_t, int,
305 		    int, struct vm_map_entry *);
306 static void	uvm_map_unreference_amap(struct vm_map_entry *, int);
307 
308 int _uvm_map_sanity(struct vm_map *);
309 int _uvm_tree_sanity(struct vm_map *);
310 static vsize_t uvm_rb_maxgap(const struct vm_map_entry *);
311 
312 #define	ROOT_ENTRY(map)		((struct vm_map_entry *)(map)->rb_tree.rbt_root)
313 #define	LEFT_ENTRY(entry)	((struct vm_map_entry *)(entry)->rb_node.rb_left)
314 #define	RIGHT_ENTRY(entry)	((struct vm_map_entry *)(entry)->rb_node.rb_right)
315 #define	PARENT_ENTRY(map, entry) \
316 	(ROOT_ENTRY(map) == (entry) \
317 	    ? NULL : (struct vm_map_entry *)RB_FATHER(&(entry)->rb_node))
318 
319 /*
320  * These get filled in if/when SYSVSHM shared memory code is loaded
321  *
322  * We do this with function pointers rather the #ifdef SYSVSHM so the
323  * SYSVSHM code can be loaded and unloaded
324  */
325 void (*uvm_shmexit)(struct vmspace *) = NULL;
326 void (*uvm_shmfork)(struct vmspace *, struct vmspace *) = NULL;
327 
328 static int
329 uvm_map_compare_nodes(void *ctx, const void *nparent, const void *nkey)
330 {
331 	const struct vm_map_entry *eparent = nparent;
332 	const struct vm_map_entry *ekey = nkey;
333 
334 	KASSERT(eparent->start < ekey->start || eparent->start >= ekey->end);
335 	KASSERT(ekey->start < eparent->start || ekey->start >= eparent->end);
336 
337 	if (eparent->start < ekey->start)
338 		return -1;
339 	if (eparent->end >= ekey->start)
340 		return 1;
341 	return 0;
342 }
343 
344 static int
345 uvm_map_compare_key(void *ctx, const void *nparent, const void *vkey)
346 {
347 	const struct vm_map_entry *eparent = nparent;
348 	const vaddr_t va = *(const vaddr_t *) vkey;
349 
350 	if (eparent->start < va)
351 		return -1;
352 	if (eparent->end >= va)
353 		return 1;
354 	return 0;
355 }
356 
357 static const rb_tree_ops_t uvm_map_tree_ops = {
358 	.rbto_compare_nodes = uvm_map_compare_nodes,
359 	.rbto_compare_key = uvm_map_compare_key,
360 	.rbto_node_offset = offsetof(struct vm_map_entry, rb_node),
361 	.rbto_context = NULL
362 };
363 
364 /*
365  * uvm_rb_gap: return the gap size between our entry and next entry.
366  */
367 static inline vsize_t
368 uvm_rb_gap(const struct vm_map_entry *entry)
369 {
370 
371 	KASSERT(entry->next != NULL);
372 	return entry->next->start - entry->end;
373 }
374 
375 static vsize_t
376 uvm_rb_maxgap(const struct vm_map_entry *entry)
377 {
378 	struct vm_map_entry *child;
379 	vsize_t maxgap = entry->gap;
380 
381 	/*
382 	 * We need maxgap to be the largest gap of us or any of our
383 	 * descendents.  Since each of our children's maxgap is the
384 	 * cached value of their largest gap of themselves or their
385 	 * descendents, we can just use that value and avoid recursing
386 	 * down the tree to calculate it.
387 	 */
388 	if ((child = LEFT_ENTRY(entry)) != NULL && maxgap < child->maxgap)
389 		maxgap = child->maxgap;
390 
391 	if ((child = RIGHT_ENTRY(entry)) != NULL && maxgap < child->maxgap)
392 		maxgap = child->maxgap;
393 
394 	return maxgap;
395 }
396 
397 static void
398 uvm_rb_fixup(struct vm_map *map, struct vm_map_entry *entry)
399 {
400 	struct vm_map_entry *parent;
401 
402 	KASSERT(entry->gap == uvm_rb_gap(entry));
403 	entry->maxgap = uvm_rb_maxgap(entry);
404 
405 	while ((parent = PARENT_ENTRY(map, entry)) != NULL) {
406 		struct vm_map_entry *brother;
407 		vsize_t maxgap = parent->gap;
408 		unsigned int which;
409 
410 		KDASSERT(parent->gap == uvm_rb_gap(parent));
411 		if (maxgap < entry->maxgap)
412 			maxgap = entry->maxgap;
413 		/*
414 		 * Since we work towards the root, we know entry's maxgap
415 		 * value is OK, but its brothers may now be out-of-date due
416 		 * to rebalancing.  So refresh it.
417 		 */
418 		which = RB_POSITION(&entry->rb_node) ^ RB_DIR_OTHER;
419 		brother = (struct vm_map_entry *)parent->rb_node.rb_nodes[which];
420 		if (brother != NULL) {
421 			KDASSERT(brother->gap == uvm_rb_gap(brother));
422 			brother->maxgap = uvm_rb_maxgap(brother);
423 			if (maxgap < brother->maxgap)
424 				maxgap = brother->maxgap;
425 		}
426 
427 		parent->maxgap = maxgap;
428 		entry = parent;
429 	}
430 }
431 
432 static void
433 uvm_rb_insert(struct vm_map *map, struct vm_map_entry *entry)
434 {
435 	struct vm_map_entry *ret __diagused;
436 
437 	entry->gap = entry->maxgap = uvm_rb_gap(entry);
438 	if (entry->prev != &map->header)
439 		entry->prev->gap = uvm_rb_gap(entry->prev);
440 
441 	ret = rb_tree_insert_node(&map->rb_tree, entry);
442 	KASSERTMSG(ret == entry,
443 	    "uvm_rb_insert: map %p: duplicate entry %p", map, ret);
444 
445 	/*
446 	 * If the previous entry is not our immediate left child, then it's an
447 	 * ancestor and will be fixed up on the way to the root.  We don't
448 	 * have to check entry->prev against &map->header since &map->header
449 	 * will never be in the tree.
450 	 */
451 	uvm_rb_fixup(map,
452 	    LEFT_ENTRY(entry) == entry->prev ? entry->prev : entry);
453 }
454 
455 static void
456 uvm_rb_remove(struct vm_map *map, struct vm_map_entry *entry)
457 {
458 	struct vm_map_entry *prev_parent = NULL, *next_parent = NULL;
459 
460 	/*
461 	 * If we are removing an interior node, then an adjacent node will
462 	 * be used to replace its position in the tree.  Therefore we will
463 	 * need to fixup the tree starting at the parent of the replacement
464 	 * node.  So record their parents for later use.
465 	 */
466 	if (entry->prev != &map->header)
467 		prev_parent = PARENT_ENTRY(map, entry->prev);
468 	if (entry->next != &map->header)
469 		next_parent = PARENT_ENTRY(map, entry->next);
470 
471 	rb_tree_remove_node(&map->rb_tree, entry);
472 
473 	/*
474 	 * If the previous node has a new parent, fixup the tree starting
475 	 * at the previous node's old parent.
476 	 */
477 	if (entry->prev != &map->header) {
478 		/*
479 		 * Update the previous entry's gap due to our absence.
480 		 */
481 		entry->prev->gap = uvm_rb_gap(entry->prev);
482 		uvm_rb_fixup(map, entry->prev);
483 		if (prev_parent != NULL
484 		    && prev_parent != entry
485 		    && prev_parent != PARENT_ENTRY(map, entry->prev))
486 			uvm_rb_fixup(map, prev_parent);
487 	}
488 
489 	/*
490 	 * If the next node has a new parent, fixup the tree starting
491 	 * at the next node's old parent.
492 	 */
493 	if (entry->next != &map->header) {
494 		uvm_rb_fixup(map, entry->next);
495 		if (next_parent != NULL
496 		    && next_parent != entry
497 		    && next_parent != PARENT_ENTRY(map, entry->next))
498 			uvm_rb_fixup(map, next_parent);
499 	}
500 }
501 
502 #if defined(DEBUG)
503 int uvm_debug_check_map = 0;
504 int uvm_debug_check_rbtree = 0;
505 #define uvm_map_check(map, name) \
506 	_uvm_map_check((map), (name), __FILE__, __LINE__)
507 static void
508 _uvm_map_check(struct vm_map *map, const char *name,
509     const char *file, int line)
510 {
511 
512 	if ((uvm_debug_check_map && _uvm_map_sanity(map)) ||
513 	    (uvm_debug_check_rbtree && _uvm_tree_sanity(map))) {
514 		panic("uvm_map_check failed: \"%s\" map=%p (%s:%d)",
515 		    name, map, file, line);
516 	}
517 }
518 #else /* defined(DEBUG) */
519 #define uvm_map_check(map, name)	/* nothing */
520 #endif /* defined(DEBUG) */
521 
522 #if defined(DEBUG) || defined(DDB)
523 int
524 _uvm_map_sanity(struct vm_map *map)
525 {
526 	bool first_free_found = false;
527 	bool hint_found = false;
528 	const struct vm_map_entry *e;
529 	struct vm_map_entry *hint = map->hint;
530 
531 	e = &map->header;
532 	for (;;) {
533 		if (map->first_free == e) {
534 			first_free_found = true;
535 		} else if (!first_free_found && e->next->start > e->end) {
536 			printf("first_free %p should be %p\n",
537 			    map->first_free, e);
538 			return -1;
539 		}
540 		if (hint == e) {
541 			hint_found = true;
542 		}
543 
544 		e = e->next;
545 		if (e == &map->header) {
546 			break;
547 		}
548 	}
549 	if (!first_free_found) {
550 		printf("stale first_free\n");
551 		return -1;
552 	}
553 	if (!hint_found) {
554 		printf("stale hint\n");
555 		return -1;
556 	}
557 	return 0;
558 }
559 
560 int
561 _uvm_tree_sanity(struct vm_map *map)
562 {
563 	struct vm_map_entry *tmp, *trtmp;
564 	int n = 0, i = 1;
565 
566 	for (tmp = map->header.next; tmp != &map->header; tmp = tmp->next) {
567 		if (tmp->gap != uvm_rb_gap(tmp)) {
568 			printf("%d/%d gap %#lx != %#lx %s\n",
569 			    n + 1, map->nentries,
570 			    (ulong)tmp->gap, (ulong)uvm_rb_gap(tmp),
571 			    tmp->next == &map->header ? "(last)" : "");
572 			goto error;
573 		}
574 		/*
575 		 * If any entries are out of order, tmp->gap will be unsigned
576 		 * and will likely exceed the size of the map.
577 		 */
578 		if (tmp->gap >= vm_map_max(map) - vm_map_min(map)) {
579 			printf("too large gap %zu\n", (size_t)tmp->gap);
580 			goto error;
581 		}
582 		n++;
583 	}
584 
585 	if (n != map->nentries) {
586 		printf("nentries: %d vs %d\n", n, map->nentries);
587 		goto error;
588 	}
589 
590 	trtmp = NULL;
591 	for (tmp = map->header.next; tmp != &map->header; tmp = tmp->next) {
592 		if (tmp->maxgap != uvm_rb_maxgap(tmp)) {
593 			printf("maxgap %#lx != %#lx\n",
594 			    (ulong)tmp->maxgap,
595 			    (ulong)uvm_rb_maxgap(tmp));
596 			goto error;
597 		}
598 		if (trtmp != NULL && trtmp->start >= tmp->start) {
599 			printf("corrupt: 0x%"PRIxVADDR"x >= 0x%"PRIxVADDR"x\n",
600 			    trtmp->start, tmp->start);
601 			goto error;
602 		}
603 
604 		trtmp = tmp;
605 	}
606 
607 	for (tmp = map->header.next; tmp != &map->header;
608 	    tmp = tmp->next, i++) {
609 		trtmp = rb_tree_iterate(&map->rb_tree, tmp, RB_DIR_LEFT);
610 		if (trtmp == NULL)
611 			trtmp = &map->header;
612 		if (tmp->prev != trtmp) {
613 			printf("lookup: %d: %p->prev=%p: %p\n",
614 			    i, tmp, tmp->prev, trtmp);
615 			goto error;
616 		}
617 		trtmp = rb_tree_iterate(&map->rb_tree, tmp, RB_DIR_RIGHT);
618 		if (trtmp == NULL)
619 			trtmp = &map->header;
620 		if (tmp->next != trtmp) {
621 			printf("lookup: %d: %p->next=%p: %p\n",
622 			    i, tmp, tmp->next, trtmp);
623 			goto error;
624 		}
625 		trtmp = rb_tree_find_node(&map->rb_tree, &tmp->start);
626 		if (trtmp != tmp) {
627 			printf("lookup: %d: %p - %p: %p\n", i, tmp, trtmp,
628 			    PARENT_ENTRY(map, tmp));
629 			goto error;
630 		}
631 	}
632 
633 	return (0);
634  error:
635 	return (-1);
636 }
637 #endif /* defined(DEBUG) || defined(DDB) */
638 
639 /*
640  * vm_map_lock: acquire an exclusive (write) lock on a map.
641  *
642  * => The locking protocol provides for guaranteed upgrade from shared ->
643  *    exclusive by whichever thread currently has the map marked busy.
644  *    See "LOCKING PROTOCOL NOTES" in uvm_map.h.  This is horrible; among
645  *    other problems, it defeats any fairness guarantees provided by RW
646  *    locks.
647  */
648 
649 void
650 vm_map_lock(struct vm_map *map)
651 {
652 
653 	for (;;) {
654 		rw_enter(&map->lock, RW_WRITER);
655 		if (map->busy == NULL || map->busy == curlwp) {
656 			break;
657 		}
658 		mutex_enter(&map->misc_lock);
659 		rw_exit(&map->lock);
660 		if (map->busy != NULL) {
661 			cv_wait(&map->cv, &map->misc_lock);
662 		}
663 		mutex_exit(&map->misc_lock);
664 	}
665 	map->timestamp++;
666 }
667 
668 /*
669  * vm_map_lock_try: try to lock a map, failing if it is already locked.
670  */
671 
672 bool
673 vm_map_lock_try(struct vm_map *map)
674 {
675 
676 	if (!rw_tryenter(&map->lock, RW_WRITER)) {
677 		return false;
678 	}
679 	if (map->busy != NULL) {
680 		rw_exit(&map->lock);
681 		return false;
682 	}
683 	map->timestamp++;
684 	return true;
685 }
686 
687 /*
688  * vm_map_unlock: release an exclusive lock on a map.
689  */
690 
691 void
692 vm_map_unlock(struct vm_map *map)
693 {
694 
695 	KASSERT(rw_write_held(&map->lock));
696 	KASSERT(map->busy == NULL || map->busy == curlwp);
697 	rw_exit(&map->lock);
698 }
699 
700 /*
701  * vm_map_unbusy: mark the map as unbusy, and wake any waiters that
702  *     want an exclusive lock.
703  */
704 
705 void
706 vm_map_unbusy(struct vm_map *map)
707 {
708 
709 	KASSERT(map->busy == curlwp);
710 
711 	/*
712 	 * Safe to clear 'busy' and 'waiters' with only a read lock held:
713 	 *
714 	 * o they can only be set with a write lock held
715 	 * o writers are blocked out with a read or write hold
716 	 * o at any time, only one thread owns the set of values
717 	 */
718 	mutex_enter(&map->misc_lock);
719 	map->busy = NULL;
720 	cv_broadcast(&map->cv);
721 	mutex_exit(&map->misc_lock);
722 }
723 
724 /*
725  * vm_map_lock_read: acquire a shared (read) lock on a map.
726  */
727 
728 void
729 vm_map_lock_read(struct vm_map *map)
730 {
731 
732 	rw_enter(&map->lock, RW_READER);
733 }
734 
735 /*
736  * vm_map_unlock_read: release a shared lock on a map.
737  */
738 
739 void
740 vm_map_unlock_read(struct vm_map *map)
741 {
742 
743 	rw_exit(&map->lock);
744 }
745 
746 /*
747  * vm_map_busy: mark a map as busy.
748  *
749  * => the caller must hold the map write locked
750  */
751 
752 void
753 vm_map_busy(struct vm_map *map)
754 {
755 
756 	KASSERT(rw_write_held(&map->lock));
757 	KASSERT(map->busy == NULL);
758 
759 	map->busy = curlwp;
760 }
761 
762 /*
763  * vm_map_locked_p: return true if the map is write locked.
764  *
765  * => only for debug purposes like KASSERTs.
766  * => should not be used to verify that a map is not locked.
767  */
768 
769 bool
770 vm_map_locked_p(struct vm_map *map)
771 {
772 
773 	return rw_write_held(&map->lock);
774 }
775 
776 /*
777  * uvm_mapent_alloc: allocate a map entry
778  */
779 
780 static struct vm_map_entry *
781 uvm_mapent_alloc(struct vm_map *map, int flags)
782 {
783 	struct vm_map_entry *me;
784 	int pflags = (flags & UVM_FLAG_NOWAIT) ? PR_NOWAIT : PR_WAITOK;
785 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
786 
787 	me = pool_cache_get(&uvm_map_entry_cache, pflags);
788 	if (__predict_false(me == NULL)) {
789 		return NULL;
790 	}
791 	me->flags = 0;
792 
793 	UVMHIST_LOG(maphist, "<- new entry=%#jx [kentry=%jd]", (uintptr_t)me,
794 	    (map == kernel_map), 0, 0);
795 	return me;
796 }
797 
798 /*
799  * uvm_mapent_free: free map entry
800  */
801 
802 static void
803 uvm_mapent_free(struct vm_map_entry *me)
804 {
805 	UVMHIST_FUNC(__func__);
806 	UVMHIST_CALLARGS(maphist,"<- freeing map entry=%#jx [flags=%#jx]",
807 		(uintptr_t)me, me->flags, 0, 0);
808 	pool_cache_put(&uvm_map_entry_cache, me);
809 }
810 
811 /*
812  * uvm_mapent_copy: copy a map entry, preserving flags
813  */
814 
815 static inline void
816 uvm_mapent_copy(struct vm_map_entry *src, struct vm_map_entry *dst)
817 {
818 
819 	memcpy(dst, src, sizeof(*dst));
820 	dst->flags = 0;
821 }
822 
823 #if defined(DEBUG)
824 static void
825 _uvm_mapent_check(const struct vm_map_entry *entry, int line)
826 {
827 
828 	if (entry->start >= entry->end) {
829 		goto bad;
830 	}
831 	if (UVM_ET_ISOBJ(entry)) {
832 		if (entry->object.uvm_obj == NULL) {
833 			goto bad;
834 		}
835 	} else if (UVM_ET_ISSUBMAP(entry)) {
836 		if (entry->object.sub_map == NULL) {
837 			goto bad;
838 		}
839 	} else {
840 		if (entry->object.uvm_obj != NULL ||
841 		    entry->object.sub_map != NULL) {
842 			goto bad;
843 		}
844 	}
845 	if (!UVM_ET_ISOBJ(entry)) {
846 		if (entry->offset != 0) {
847 			goto bad;
848 		}
849 	}
850 
851 	return;
852 
853 bad:
854 	panic("%s: bad entry %p, line %d", __func__, entry, line);
855 }
856 #endif /* defined(DEBUG) */
857 
858 /*
859  * uvm_map_entry_unwire: unwire a map entry
860  *
861  * => map should be locked by caller
862  */
863 
864 static inline void
865 uvm_map_entry_unwire(struct vm_map *map, struct vm_map_entry *entry)
866 {
867 
868 	entry->wired_count = 0;
869 	uvm_fault_unwire_locked(map, entry->start, entry->end);
870 }
871 
872 
873 /*
874  * wrapper for calling amap_ref()
875  */
876 static inline void
877 uvm_map_reference_amap(struct vm_map_entry *entry, int flags)
878 {
879 
880 	amap_ref(entry->aref.ar_amap, entry->aref.ar_pageoff,
881 	    (entry->end - entry->start) >> PAGE_SHIFT, flags);
882 }
883 
884 
885 /*
886  * wrapper for calling amap_unref()
887  */
888 static inline void
889 uvm_map_unreference_amap(struct vm_map_entry *entry, int flags)
890 {
891 
892 	amap_unref(entry->aref.ar_amap, entry->aref.ar_pageoff,
893 	    (entry->end - entry->start) >> PAGE_SHIFT, flags);
894 }
895 
896 
897 /*
898  * uvm_map_init: init mapping system at boot time.
899  */
900 
901 void
902 uvm_map_init(void)
903 {
904 	/*
905 	 * first, init logging system.
906 	 */
907 
908 	UVMHIST_FUNC(__func__);
909 	UVMHIST_LINK_STATIC(maphist);
910 	UVMHIST_LINK_STATIC(pdhist);
911 	UVMHIST_CALLED(maphist);
912 	UVMHIST_LOG(maphist,"<starting uvm map system>", 0, 0, 0, 0);
913 
914 	/*
915 	 * initialize the global lock for kernel map entry.
916 	 */
917 
918 	mutex_init(&uvm_kentry_lock, MUTEX_DRIVER, IPL_VM);
919 }
920 
921 /*
922  * uvm_map_init_caches: init mapping system caches.
923  */
924 void
925 uvm_map_init_caches(void)
926 {
927 	/*
928 	 * initialize caches.
929 	 */
930 
931 	pool_cache_bootstrap(&uvm_map_entry_cache, sizeof(struct vm_map_entry),
932 	    coherency_unit, 0, PR_LARGECACHE, "vmmpepl", NULL, IPL_NONE, NULL,
933 	    NULL, NULL);
934 	pool_cache_bootstrap(&uvm_vmspace_cache, sizeof(struct vmspace),
935 	    0, 0, 0, "vmsppl", NULL, IPL_NONE, NULL, NULL, NULL);
936 }
937 
938 /*
939  * clippers
940  */
941 
942 /*
943  * uvm_mapent_splitadj: adjust map entries for splitting, after uvm_mapent_copy.
944  */
945 
946 static void
947 uvm_mapent_splitadj(struct vm_map_entry *entry1, struct vm_map_entry *entry2,
948     vaddr_t splitat)
949 {
950 	vaddr_t adj;
951 
952 	KASSERT(entry1->start < splitat);
953 	KASSERT(splitat < entry1->end);
954 
955 	adj = splitat - entry1->start;
956 	entry1->end = entry2->start = splitat;
957 
958 	if (entry1->aref.ar_amap) {
959 		amap_splitref(&entry1->aref, &entry2->aref, adj);
960 	}
961 	if (UVM_ET_ISSUBMAP(entry1)) {
962 		/* ... unlikely to happen, but play it safe */
963 		 uvm_map_reference(entry1->object.sub_map);
964 	} else if (UVM_ET_ISOBJ(entry1)) {
965 		KASSERT(entry1->object.uvm_obj != NULL); /* suppress coverity */
966 		entry2->offset += adj;
967 		if (entry1->object.uvm_obj->pgops &&
968 		    entry1->object.uvm_obj->pgops->pgo_reference)
969 			entry1->object.uvm_obj->pgops->pgo_reference(
970 			    entry1->object.uvm_obj);
971 	}
972 }
973 
974 /*
975  * uvm_map_clip_start: ensure that the entry begins at or after
976  *	the starting address, if it doesn't we split the entry.
977  *
978  * => caller should use UVM_MAP_CLIP_START macro rather than calling
979  *    this directly
980  * => map must be locked by caller
981  */
982 
983 void
984 uvm_map_clip_start(struct vm_map *map, struct vm_map_entry *entry,
985     vaddr_t start)
986 {
987 	struct vm_map_entry *new_entry;
988 
989 	/* uvm_map_simplify_entry(map, entry); */ /* XXX */
990 
991 	uvm_map_check(map, "clip_start entry");
992 	uvm_mapent_check(entry);
993 
994 	/*
995 	 * Split off the front portion.  note that we must insert the new
996 	 * entry BEFORE this one, so that this entry has the specified
997 	 * starting address.
998 	 */
999 	new_entry = uvm_mapent_alloc(map, 0);
1000 	uvm_mapent_copy(entry, new_entry); /* entry -> new_entry */
1001 	uvm_mapent_splitadj(new_entry, entry, start);
1002 	uvm_map_entry_link(map, entry->prev, new_entry);
1003 
1004 	uvm_map_check(map, "clip_start leave");
1005 }
1006 
1007 /*
1008  * uvm_map_clip_end: ensure that the entry ends at or before
1009  *	the ending address, if it does't we split the reference
1010  *
1011  * => caller should use UVM_MAP_CLIP_END macro rather than calling
1012  *    this directly
1013  * => map must be locked by caller
1014  */
1015 
1016 void
1017 uvm_map_clip_end(struct vm_map *map, struct vm_map_entry *entry, vaddr_t end)
1018 {
1019 	struct vm_map_entry *new_entry;
1020 
1021 	uvm_map_check(map, "clip_end entry");
1022 	uvm_mapent_check(entry);
1023 
1024 	/*
1025 	 *	Create a new entry and insert it
1026 	 *	AFTER the specified entry
1027 	 */
1028 	new_entry = uvm_mapent_alloc(map, 0);
1029 	uvm_mapent_copy(entry, new_entry); /* entry -> new_entry */
1030 	uvm_mapent_splitadj(entry, new_entry, end);
1031 	uvm_map_entry_link(map, entry, new_entry);
1032 
1033 	uvm_map_check(map, "clip_end leave");
1034 }
1035 
1036 /*
1037  *   M A P   -   m a i n   e n t r y   p o i n t
1038  */
1039 /*
1040  * uvm_map: establish a valid mapping in a map
1041  *
1042  * => assume startp is page aligned.
1043  * => assume size is a multiple of PAGE_SIZE.
1044  * => assume sys_mmap provides enough of a "hint" to have us skip
1045  *	over text/data/bss area.
1046  * => map must be unlocked (we will lock it)
1047  * => <uobj,uoffset> value meanings (4 cases):
1048  *	 [1] <NULL,uoffset>		== uoffset is a hint for PMAP_PREFER
1049  *	 [2] <NULL,UVM_UNKNOWN_OFFSET>	== don't PMAP_PREFER
1050  *	 [3] <uobj,uoffset>		== normal mapping
1051  *	 [4] <uobj,UVM_UNKNOWN_OFFSET>	== uvm_map finds offset based on VA
1052  *
1053  *    case [4] is for kernel mappings where we don't know the offset until
1054  *    we've found a virtual address.   note that kernel object offsets are
1055  *    always relative to vm_map_min(kernel_map).
1056  *
1057  * => if `align' is non-zero, we align the virtual address to the specified
1058  *	alignment.
1059  *	this is provided as a mechanism for large pages.
1060  *
1061  * => XXXCDC: need way to map in external amap?
1062  */
1063 
1064 int
1065 uvm_map(struct vm_map *map, vaddr_t *startp /* IN/OUT */, vsize_t size,
1066     struct uvm_object *uobj, voff_t uoffset, vsize_t align, uvm_flag_t flags)
1067 {
1068 	struct uvm_map_args args;
1069 	struct vm_map_entry *new_entry;
1070 	int error;
1071 
1072 	KASSERT((size & PAGE_MASK) == 0);
1073 	KASSERT((flags & UVM_FLAG_FIXED) == 0 || align == 0);
1074 
1075 	/*
1076 	 * for pager_map, allocate the new entry first to avoid sleeping
1077 	 * for memory while we have the map locked.
1078 	 */
1079 
1080 	new_entry = NULL;
1081 	if (map == pager_map) {
1082 		new_entry = uvm_mapent_alloc(map, (flags & UVM_FLAG_NOWAIT));
1083 		if (__predict_false(new_entry == NULL))
1084 			return ENOMEM;
1085 	}
1086 	if (map == pager_map)
1087 		flags |= UVM_FLAG_NOMERGE;
1088 
1089 	error = uvm_map_prepare(map, *startp, size, uobj, uoffset, align,
1090 	    flags, &args);
1091 	if (!error) {
1092 		error = uvm_map_enter(map, &args, new_entry);
1093 		*startp = args.uma_start;
1094 	} else if (new_entry) {
1095 		uvm_mapent_free(new_entry);
1096 	}
1097 
1098 #if defined(DEBUG)
1099 	if (!error && VM_MAP_IS_KERNEL(map) && (flags & UVM_FLAG_NOWAIT) == 0) {
1100 		uvm_km_check_empty(map, *startp, *startp + size);
1101 	}
1102 #endif /* defined(DEBUG) */
1103 
1104 	return error;
1105 }
1106 
1107 /*
1108  * uvm_map_prepare:
1109  *
1110  * called with map unlocked.
1111  * on success, returns the map locked.
1112  */
1113 
1114 int
1115 uvm_map_prepare(struct vm_map *map, vaddr_t start, vsize_t size,
1116     struct uvm_object *uobj, voff_t uoffset, vsize_t align, uvm_flag_t flags,
1117     struct uvm_map_args *args)
1118 {
1119 	struct vm_map_entry *prev_entry;
1120 	vm_prot_t prot = UVM_PROTECTION(flags);
1121 	vm_prot_t maxprot = UVM_MAXPROTECTION(flags);
1122 
1123 	UVMHIST_FUNC(__func__);
1124 	UVMHIST_CALLARGS(maphist, "(map=%#jx, start=%#jx, size=%jx, flags=%#jx)",
1125 	    (uintptr_t)map, start, size, flags);
1126 	UVMHIST_LOG(maphist, "  uobj/offset %#jx/%jd", (uintptr_t)uobj,
1127 	    uoffset,0,0);
1128 
1129 	/*
1130 	 * detect a popular device driver bug.
1131 	 */
1132 
1133 	KASSERT(doing_shutdown || curlwp != NULL);
1134 
1135 	/*
1136 	 * zero-sized mapping doesn't make any sense.
1137 	 */
1138 	KASSERT(size > 0);
1139 
1140 	KASSERT((~flags & (UVM_FLAG_NOWAIT | UVM_FLAG_WAITVA)) != 0);
1141 
1142 	uvm_map_check(map, "map entry");
1143 
1144 	/*
1145 	 * check sanity of protection code
1146 	 */
1147 
1148 	if ((prot & maxprot) != prot) {
1149 		UVMHIST_LOG(maphist, "<- prot. failure:  prot=%#jx, max=%#jx",
1150 		prot, maxprot,0,0);
1151 		return EACCES;
1152 	}
1153 
1154 	/*
1155 	 * figure out where to put new VM range
1156 	 */
1157 retry:
1158 	if (vm_map_lock_try(map) == false) {
1159 		if ((flags & UVM_FLAG_TRYLOCK) != 0) {
1160 			return EAGAIN;
1161 		}
1162 		vm_map_lock(map); /* could sleep here */
1163 	}
1164 	if (flags & UVM_FLAG_UNMAP) {
1165 		KASSERT(flags & UVM_FLAG_FIXED);
1166 		KASSERT((flags & UVM_FLAG_NOWAIT) == 0);
1167 
1168 		/*
1169 		 * Set prev_entry to what it will need to be after any existing
1170 		 * entries are removed later in uvm_map_enter().
1171 		 */
1172 
1173 		if (uvm_map_lookup_entry(map, start, &prev_entry)) {
1174 			if (start == prev_entry->start)
1175 				prev_entry = prev_entry->prev;
1176 			else
1177 				UVM_MAP_CLIP_END(map, prev_entry, start);
1178 			SAVE_HINT(map, map->hint, prev_entry);
1179 		}
1180 	} else {
1181 		prev_entry = uvm_map_findspace(map, start, size, &start,
1182 		    uobj, uoffset, align, flags);
1183 	}
1184 	if (prev_entry == NULL) {
1185 		unsigned int timestamp;
1186 
1187 		timestamp = map->timestamp;
1188 		UVMHIST_LOG(maphist,"waiting va timestamp=%#jx",
1189 			    timestamp,0,0,0);
1190 		map->flags |= VM_MAP_WANTVA;
1191 		vm_map_unlock(map);
1192 
1193 		/*
1194 		 * try to reclaim kva and wait until someone does unmap.
1195 		 * fragile locking here, so we awaken every second to
1196 		 * recheck the condition.
1197 		 */
1198 
1199 		mutex_enter(&map->misc_lock);
1200 		while ((map->flags & VM_MAP_WANTVA) != 0 &&
1201 		   map->timestamp == timestamp) {
1202 			if ((flags & UVM_FLAG_WAITVA) == 0) {
1203 				mutex_exit(&map->misc_lock);
1204 				UVMHIST_LOG(maphist,
1205 				    "<- uvm_map_findspace failed!", 0,0,0,0);
1206 				return ENOMEM;
1207 			} else {
1208 				cv_timedwait(&map->cv, &map->misc_lock, hz);
1209 			}
1210 		}
1211 		mutex_exit(&map->misc_lock);
1212 		goto retry;
1213 	}
1214 
1215 #ifdef PMAP_GROWKERNEL
1216 	/*
1217 	 * If the kernel pmap can't map the requested space,
1218 	 * then allocate more resources for it.
1219 	 */
1220 	if (map == kernel_map && uvm_maxkaddr < (start + size))
1221 		uvm_maxkaddr = pmap_growkernel(start + size);
1222 #endif
1223 
1224 	UVMMAP_EVCNT_INCR(map_call);
1225 
1226 	/*
1227 	 * if uobj is null, then uoffset is either a VAC hint for PMAP_PREFER
1228 	 * [typically from uvm_map_reserve] or it is UVM_UNKNOWN_OFFSET.   in
1229 	 * either case we want to zero it  before storing it in the map entry
1230 	 * (because it looks strange and confusing when debugging...)
1231 	 *
1232 	 * if uobj is not null
1233 	 *   if uoffset is not UVM_UNKNOWN_OFFSET then we have a normal mapping
1234 	 *      and we do not need to change uoffset.
1235 	 *   if uoffset is UVM_UNKNOWN_OFFSET then we need to find the offset
1236 	 *      now (based on the starting address of the map).   this case is
1237 	 *      for kernel object mappings where we don't know the offset until
1238 	 *      the virtual address is found (with uvm_map_findspace).   the
1239 	 *      offset is the distance we are from the start of the map.
1240 	 */
1241 
1242 	if (uobj == NULL) {
1243 		uoffset = 0;
1244 	} else {
1245 		if (uoffset == UVM_UNKNOWN_OFFSET) {
1246 			KASSERT(UVM_OBJ_IS_KERN_OBJECT(uobj));
1247 			uoffset = start - vm_map_min(kernel_map);
1248 		}
1249 	}
1250 
1251 	args->uma_flags = flags;
1252 	args->uma_prev = prev_entry;
1253 	args->uma_start = start;
1254 	args->uma_size = size;
1255 	args->uma_uobj = uobj;
1256 	args->uma_uoffset = uoffset;
1257 
1258 	UVMHIST_LOG(maphist, "<- done!", 0,0,0,0);
1259 	return 0;
1260 }
1261 
1262 /*
1263  * uvm_map_enter:
1264  *
1265  * called with map locked.
1266  * unlock the map before returning.
1267  */
1268 
1269 int
1270 uvm_map_enter(struct vm_map *map, const struct uvm_map_args *args,
1271     struct vm_map_entry *new_entry)
1272 {
1273 	struct vm_map_entry *prev_entry = args->uma_prev;
1274 	struct vm_map_entry *dead = NULL, *dead_entries = NULL;
1275 
1276 	const uvm_flag_t flags = args->uma_flags;
1277 	const vm_prot_t prot = UVM_PROTECTION(flags);
1278 	const vm_prot_t maxprot = UVM_MAXPROTECTION(flags);
1279 	const vm_inherit_t inherit = UVM_INHERIT(flags);
1280 	const int amapwaitflag = (flags & UVM_FLAG_NOWAIT) ?
1281 	    AMAP_EXTEND_NOWAIT : 0;
1282 	const int advice = UVM_ADVICE(flags);
1283 
1284 	vaddr_t start = args->uma_start;
1285 	vsize_t size = args->uma_size;
1286 	struct uvm_object *uobj = args->uma_uobj;
1287 	voff_t uoffset = args->uma_uoffset;
1288 
1289 	const int kmap = (vm_map_pmap(map) == pmap_kernel());
1290 	int merged = 0;
1291 	int error;
1292 	int newetype;
1293 
1294 	UVMHIST_FUNC(__func__);
1295 	UVMHIST_CALLARGS(maphist, "(map=%#jx, start=%#jx, size=%ju, flags=%#jx)",
1296 	    (uintptr_t)map, start, size, flags);
1297 	UVMHIST_LOG(maphist, "  uobj/offset %#jx/%jd", (uintptr_t)uobj,
1298 	    uoffset,0,0);
1299 
1300 	KASSERT(map->hint == prev_entry); /* bimerge case assumes this */
1301 	KASSERT(vm_map_locked_p(map));
1302 	KASSERT((flags & (UVM_FLAG_NOWAIT | UVM_FLAG_UNMAP)) !=
1303 		(UVM_FLAG_NOWAIT | UVM_FLAG_UNMAP));
1304 
1305 	if (uobj)
1306 		newetype = UVM_ET_OBJ;
1307 	else
1308 		newetype = 0;
1309 
1310 	if (flags & UVM_FLAG_COPYONW) {
1311 		newetype |= UVM_ET_COPYONWRITE;
1312 		if ((flags & UVM_FLAG_OVERLAY) == 0)
1313 			newetype |= UVM_ET_NEEDSCOPY;
1314 	}
1315 
1316 	/*
1317 	 * For mappings with unmap, remove any old entries now.  Adding the new
1318 	 * entry cannot fail because that can only happen if UVM_FLAG_NOWAIT
1319 	 * is set, and we do not support nowait and unmap together.
1320 	 */
1321 
1322 	if (flags & UVM_FLAG_UNMAP) {
1323 		KASSERT(flags & UVM_FLAG_FIXED);
1324 		uvm_unmap_remove(map, start, start + size, &dead_entries, 0);
1325 #ifdef DEBUG
1326 		struct vm_map_entry *tmp_entry __diagused;
1327 		bool rv __diagused;
1328 
1329 		rv = uvm_map_lookup_entry(map, start, &tmp_entry);
1330 		KASSERT(!rv);
1331 		KASSERTMSG(prev_entry == tmp_entry,
1332 			   "args %p prev_entry %p tmp_entry %p",
1333 			   args, prev_entry, tmp_entry);
1334 #endif
1335 		SAVE_HINT(map, map->hint, prev_entry);
1336 	}
1337 
1338 	/*
1339 	 * try and insert in map by extending previous entry, if possible.
1340 	 * XXX: we don't try and pull back the next entry.   might be useful
1341 	 * for a stack, but we are currently allocating our stack in advance.
1342 	 */
1343 
1344 	if (flags & UVM_FLAG_NOMERGE)
1345 		goto nomerge;
1346 
1347 	if (prev_entry->end == start &&
1348 	    prev_entry != &map->header &&
1349 	    UVM_ET_ISCOMPATIBLE(prev_entry, newetype, uobj, 0,
1350 	    prot, maxprot, inherit, advice, 0)) {
1351 
1352 		if (uobj && prev_entry->offset +
1353 		    (prev_entry->end - prev_entry->start) != uoffset)
1354 			goto forwardmerge;
1355 
1356 		/*
1357 		 * can't extend a shared amap.  note: no need to lock amap to
1358 		 * look at refs since we don't care about its exact value.
1359 		 * if it is one (i.e. we have only reference) it will stay there
1360 		 */
1361 
1362 		if (prev_entry->aref.ar_amap &&
1363 		    amap_refs(prev_entry->aref.ar_amap) != 1) {
1364 			goto forwardmerge;
1365 		}
1366 
1367 		if (prev_entry->aref.ar_amap) {
1368 			error = amap_extend(prev_entry, size,
1369 			    amapwaitflag | AMAP_EXTEND_FORWARDS);
1370 			if (error)
1371 				goto nomerge;
1372 		}
1373 
1374 		if (kmap) {
1375 			UVMMAP_EVCNT_INCR(kbackmerge);
1376 		} else {
1377 			UVMMAP_EVCNT_INCR(ubackmerge);
1378 		}
1379 		UVMHIST_LOG(maphist,"  starting back merge", 0, 0, 0, 0);
1380 
1381 		/*
1382 		 * drop our reference to uobj since we are extending a reference
1383 		 * that we already have (the ref count can not drop to zero).
1384 		 */
1385 
1386 		if (uobj && uobj->pgops->pgo_detach)
1387 			uobj->pgops->pgo_detach(uobj);
1388 
1389 		/*
1390 		 * Now that we've merged the entries, note that we've grown
1391 		 * and our gap has shrunk.  Then fix the tree.
1392 		 */
1393 		prev_entry->end += size;
1394 		prev_entry->gap -= size;
1395 		uvm_rb_fixup(map, prev_entry);
1396 
1397 		uvm_map_check(map, "map backmerged");
1398 
1399 		UVMHIST_LOG(maphist,"<- done (via backmerge)!", 0, 0, 0, 0);
1400 		merged++;
1401 	}
1402 
1403 forwardmerge:
1404 	if (prev_entry->next->start == (start + size) &&
1405 	    prev_entry->next != &map->header &&
1406 	    UVM_ET_ISCOMPATIBLE(prev_entry->next, newetype, uobj, 0,
1407 	    prot, maxprot, inherit, advice, 0)) {
1408 
1409 		if (uobj && prev_entry->next->offset != uoffset + size)
1410 			goto nomerge;
1411 
1412 		/*
1413 		 * can't extend a shared amap.  note: no need to lock amap to
1414 		 * look at refs since we don't care about its exact value.
1415 		 * if it is one (i.e. we have only reference) it will stay there.
1416 		 *
1417 		 * note that we also can't merge two amaps, so if we
1418 		 * merged with the previous entry which has an amap,
1419 		 * and the next entry also has an amap, we give up.
1420 		 *
1421 		 * Interesting cases:
1422 		 * amap, new, amap -> give up second merge (single fwd extend)
1423 		 * amap, new, none -> double forward extend (extend again here)
1424 		 * none, new, amap -> double backward extend (done here)
1425 		 * uobj, new, amap -> single backward extend (done here)
1426 		 *
1427 		 * XXX should we attempt to deal with someone refilling
1428 		 * the deallocated region between two entries that are
1429 		 * backed by the same amap (ie, arefs is 2, "prev" and
1430 		 * "next" refer to it, and adding this allocation will
1431 		 * close the hole, thus restoring arefs to 1 and
1432 		 * deallocating the "next" vm_map_entry)?  -- @@@
1433 		 */
1434 
1435 		if (prev_entry->next->aref.ar_amap &&
1436 		    (amap_refs(prev_entry->next->aref.ar_amap) != 1 ||
1437 		     (merged && prev_entry->aref.ar_amap))) {
1438 			goto nomerge;
1439 		}
1440 
1441 		if (merged) {
1442 			/*
1443 			 * Try to extend the amap of the previous entry to
1444 			 * cover the next entry as well.  If it doesn't work
1445 			 * just skip on, don't actually give up, since we've
1446 			 * already completed the back merge.
1447 			 */
1448 			if (prev_entry->aref.ar_amap) {
1449 				if (amap_extend(prev_entry,
1450 				    prev_entry->next->end -
1451 				    prev_entry->next->start,
1452 				    amapwaitflag | AMAP_EXTEND_FORWARDS))
1453 					goto nomerge;
1454 			}
1455 
1456 			/*
1457 			 * Try to extend the amap of the *next* entry
1458 			 * back to cover the new allocation *and* the
1459 			 * previous entry as well (the previous merge
1460 			 * didn't have an amap already otherwise we
1461 			 * wouldn't be checking here for an amap).  If
1462 			 * it doesn't work just skip on, again, don't
1463 			 * actually give up, since we've already
1464 			 * completed the back merge.
1465 			 */
1466 			else if (prev_entry->next->aref.ar_amap) {
1467 				if (amap_extend(prev_entry->next,
1468 				    prev_entry->end -
1469 				    prev_entry->start,
1470 				    amapwaitflag | AMAP_EXTEND_BACKWARDS))
1471 					goto nomerge;
1472 			}
1473 		} else {
1474 			/*
1475 			 * Pull the next entry's amap backwards to cover this
1476 			 * new allocation.
1477 			 */
1478 			if (prev_entry->next->aref.ar_amap) {
1479 				error = amap_extend(prev_entry->next, size,
1480 				    amapwaitflag | AMAP_EXTEND_BACKWARDS);
1481 				if (error)
1482 					goto nomerge;
1483 			}
1484 		}
1485 
1486 		if (merged) {
1487 			if (kmap) {
1488 				UVMMAP_EVCNT_DECR(kbackmerge);
1489 				UVMMAP_EVCNT_INCR(kbimerge);
1490 			} else {
1491 				UVMMAP_EVCNT_DECR(ubackmerge);
1492 				UVMMAP_EVCNT_INCR(ubimerge);
1493 			}
1494 		} else {
1495 			if (kmap) {
1496 				UVMMAP_EVCNT_INCR(kforwmerge);
1497 			} else {
1498 				UVMMAP_EVCNT_INCR(uforwmerge);
1499 			}
1500 		}
1501 		UVMHIST_LOG(maphist,"  starting forward merge", 0, 0, 0, 0);
1502 
1503 		/*
1504 		 * drop our reference to uobj since we are extending a reference
1505 		 * that we already have (the ref count can not drop to zero).
1506 		 */
1507 		if (uobj && uobj->pgops->pgo_detach)
1508 			uobj->pgops->pgo_detach(uobj);
1509 
1510 		if (merged) {
1511 			dead = prev_entry->next;
1512 			prev_entry->end = dead->end;
1513 			uvm_map_entry_unlink(map, dead);
1514 			if (dead->aref.ar_amap != NULL) {
1515 				prev_entry->aref = dead->aref;
1516 				dead->aref.ar_amap = NULL;
1517 			}
1518 		} else {
1519 			prev_entry->next->start -= size;
1520 			if (prev_entry != &map->header) {
1521 				prev_entry->gap -= size;
1522 				KASSERT(prev_entry->gap == uvm_rb_gap(prev_entry));
1523 				uvm_rb_fixup(map, prev_entry);
1524 			}
1525 			if (uobj)
1526 				prev_entry->next->offset = uoffset;
1527 		}
1528 
1529 		uvm_map_check(map, "map forwardmerged");
1530 
1531 		UVMHIST_LOG(maphist,"<- done forwardmerge", 0, 0, 0, 0);
1532 		merged++;
1533 	}
1534 
1535 nomerge:
1536 	if (!merged) {
1537 		UVMHIST_LOG(maphist,"  allocating new map entry", 0, 0, 0, 0);
1538 		if (kmap) {
1539 			UVMMAP_EVCNT_INCR(knomerge);
1540 		} else {
1541 			UVMMAP_EVCNT_INCR(unomerge);
1542 		}
1543 
1544 		/*
1545 		 * allocate new entry and link it in.
1546 		 */
1547 
1548 		if (new_entry == NULL) {
1549 			new_entry = uvm_mapent_alloc(map,
1550 				(flags & UVM_FLAG_NOWAIT));
1551 			if (__predict_false(new_entry == NULL)) {
1552 				error = ENOMEM;
1553 				goto done;
1554 			}
1555 		}
1556 		new_entry->start = start;
1557 		new_entry->end = new_entry->start + size;
1558 		new_entry->object.uvm_obj = uobj;
1559 		new_entry->offset = uoffset;
1560 
1561 		new_entry->etype = newetype;
1562 
1563 		if (flags & UVM_FLAG_NOMERGE) {
1564 			new_entry->flags |= UVM_MAP_NOMERGE;
1565 		}
1566 
1567 		new_entry->protection = prot;
1568 		new_entry->max_protection = maxprot;
1569 		new_entry->inheritance = inherit;
1570 		new_entry->wired_count = 0;
1571 		new_entry->advice = advice;
1572 		if (flags & UVM_FLAG_OVERLAY) {
1573 
1574 			/*
1575 			 * to_add: for BSS we overallocate a little since we
1576 			 * are likely to extend
1577 			 */
1578 
1579 			vaddr_t to_add = (flags & UVM_FLAG_AMAPPAD) ?
1580 				UVM_AMAP_CHUNK << PAGE_SHIFT : 0;
1581 			struct vm_amap *amap = amap_alloc(size, to_add,
1582 			    (flags & UVM_FLAG_NOWAIT));
1583 			if (__predict_false(amap == NULL)) {
1584 				error = ENOMEM;
1585 				goto done;
1586 			}
1587 			new_entry->aref.ar_pageoff = 0;
1588 			new_entry->aref.ar_amap = amap;
1589 		} else {
1590 			new_entry->aref.ar_pageoff = 0;
1591 			new_entry->aref.ar_amap = NULL;
1592 		}
1593 		uvm_map_entry_link(map, prev_entry, new_entry);
1594 
1595 		/*
1596 		 * Update the free space hint
1597 		 */
1598 
1599 		if ((map->first_free == prev_entry) &&
1600 		    (prev_entry->end >= new_entry->start))
1601 			map->first_free = new_entry;
1602 
1603 		new_entry = NULL;
1604 	}
1605 
1606 	map->size += size;
1607 
1608 	UVMHIST_LOG(maphist,"<- done!", 0, 0, 0, 0);
1609 
1610 	error = 0;
1611 
1612 done:
1613 	vm_map_unlock(map);
1614 
1615 	if (new_entry) {
1616 		uvm_mapent_free(new_entry);
1617 	}
1618 	if (dead) {
1619 		KDASSERT(merged);
1620 		uvm_mapent_free(dead);
1621 	}
1622 	if (dead_entries)
1623 		uvm_unmap_detach(dead_entries, 0);
1624 
1625 	return error;
1626 }
1627 
1628 /*
1629  * uvm_map_lookup_entry_bytree: lookup an entry in tree
1630  */
1631 
1632 static inline bool
1633 uvm_map_lookup_entry_bytree(struct vm_map *map, vaddr_t address,
1634     struct vm_map_entry **entry	/* OUT */)
1635 {
1636 	struct vm_map_entry *prev = &map->header;
1637 	struct vm_map_entry *cur = ROOT_ENTRY(map);
1638 
1639 	while (cur) {
1640 		UVMMAP_EVCNT_INCR(mlk_treeloop);
1641 		if (address >= cur->start) {
1642 			if (address < cur->end) {
1643 				*entry = cur;
1644 				return true;
1645 			}
1646 			prev = cur;
1647 			cur = RIGHT_ENTRY(cur);
1648 		} else
1649 			cur = LEFT_ENTRY(cur);
1650 	}
1651 	*entry = prev;
1652 	return false;
1653 }
1654 
1655 /*
1656  * uvm_map_lookup_entry: find map entry at or before an address
1657  *
1658  * => map must at least be read-locked by caller
1659  * => entry is returned in "entry"
1660  * => return value is true if address is in the returned entry
1661  */
1662 
1663 bool
1664 uvm_map_lookup_entry(struct vm_map *map, vaddr_t address,
1665     struct vm_map_entry **entry	/* OUT */)
1666 {
1667 	struct vm_map_entry *cur;
1668 	UVMHIST_FUNC(__func__);
1669 	UVMHIST_CALLARGS(maphist,"(map=%#jx,addr=%#jx,ent=%#jx)",
1670 	    (uintptr_t)map, address, (uintptr_t)entry, 0);
1671 
1672 	/*
1673 	 * make a quick check to see if we are already looking at
1674 	 * the entry we want (which is usually the case).  note also
1675 	 * that we don't need to save the hint here...  it is the
1676 	 * same hint (unless we are at the header, in which case the
1677 	 * hint didn't buy us anything anyway).
1678 	 */
1679 
1680 	cur = map->hint;
1681 	UVMMAP_EVCNT_INCR(mlk_call);
1682 	if (cur != &map->header &&
1683 	    address >= cur->start && cur->end > address) {
1684 		UVMMAP_EVCNT_INCR(mlk_hint);
1685 		*entry = cur;
1686 		UVMHIST_LOG(maphist,"<- got it via hint (%#jx)",
1687 		    (uintptr_t)cur, 0, 0, 0);
1688 		uvm_mapent_check(*entry);
1689 		return (true);
1690 	}
1691 	uvm_map_check(map, __func__);
1692 
1693 	/*
1694 	 * lookup in the tree.
1695 	 */
1696 
1697 	UVMMAP_EVCNT_INCR(mlk_tree);
1698 	if (__predict_true(uvm_map_lookup_entry_bytree(map, address, entry))) {
1699 		SAVE_HINT(map, map->hint, *entry);
1700 		UVMHIST_LOG(maphist,"<- search got it (%#jx)",
1701 		    (uintptr_t)cur, 0, 0, 0);
1702 		KDASSERT((*entry)->start <= address);
1703 		KDASSERT(address < (*entry)->end);
1704 		uvm_mapent_check(*entry);
1705 		return (true);
1706 	}
1707 
1708 	SAVE_HINT(map, map->hint, *entry);
1709 	UVMHIST_LOG(maphist,"<- failed!",0,0,0,0);
1710 	KDASSERT((*entry) == &map->header || (*entry)->end <= address);
1711 	KDASSERT((*entry)->next == &map->header ||
1712 	    address < (*entry)->next->start);
1713 	return (false);
1714 }
1715 
1716 /*
1717  * See if the range between start and start + length fits in the gap
1718  * entry->next->start and entry->end.  Returns 1 if fits, 0 if doesn't
1719  * fit, and -1 address wraps around.
1720  */
1721 static int
1722 uvm_map_space_avail(vaddr_t *start, vsize_t length, voff_t uoffset,
1723     vsize_t align, int flags, int topdown, struct vm_map_entry *entry)
1724 {
1725 	vaddr_t end;
1726 
1727 #ifdef PMAP_PREFER
1728 	/*
1729 	 * push start address forward as needed to avoid VAC alias problems.
1730 	 * we only do this if a valid offset is specified.
1731 	 */
1732 
1733 	if (uoffset != UVM_UNKNOWN_OFFSET)
1734 		PMAP_PREFER(uoffset, start, length, topdown);
1735 #endif
1736 	if ((flags & UVM_FLAG_COLORMATCH) != 0) {
1737 		KASSERT(align < uvmexp.ncolors);
1738 		if (uvmexp.ncolors > 1) {
1739 			const u_int colormask = uvmexp.colormask;
1740 			const u_int colorsize = colormask + 1;
1741 			vaddr_t hint = atop(*start);
1742 			const u_int color = hint & colormask;
1743 			if (color != align) {
1744 				hint -= color;	/* adjust to color boundary */
1745 				KASSERT((hint & colormask) == 0);
1746 				if (topdown) {
1747 					if (align > color)
1748 						hint -= colorsize;
1749 				} else {
1750 					if (align < color)
1751 						hint += colorsize;
1752 				}
1753 				*start = ptoa(hint + align); /* adjust to color */
1754 			}
1755 		}
1756 	} else {
1757 		KASSERT(powerof2(align));
1758 		uvm_map_align_va(start, align, topdown);
1759 		/*
1760 		 * XXX Should we PMAP_PREFER() here again?
1761 		 * eh...i think we're okay
1762 		 */
1763 	}
1764 
1765 	/*
1766 	 * Find the end of the proposed new region.  Be sure we didn't
1767 	 * wrap around the address; if so, we lose.  Otherwise, if the
1768 	 * proposed new region fits before the next entry, we win.
1769 	 */
1770 
1771 	end = *start + length;
1772 	if (end < *start)
1773 		return (-1);
1774 
1775 	if (entry->next->start >= end && *start >= entry->end)
1776 		return (1);
1777 
1778 	return (0);
1779 }
1780 
1781 static void
1782 uvm_findspace_invariants(struct vm_map *map, vaddr_t orig_hint, vaddr_t length,
1783     struct uvm_object *uobj, voff_t uoffset, vsize_t align, int flags,
1784     vaddr_t hint, struct vm_map_entry *entry, int line)
1785 {
1786 	const int topdown = map->flags & VM_MAP_TOPDOWN;
1787 
1788 	KASSERTMSG( topdown || hint >= orig_hint,
1789 	    "map=%p hint=%#"PRIxVADDR" orig_hint=%#"PRIxVADDR
1790 	    " length=%#"PRIxVSIZE" uobj=%p uoffset=%#llx align=%"PRIxVSIZE
1791 	    " flags=%#x entry=%p (uvm_map_findspace line %d)",
1792 	    map, hint, orig_hint,
1793 	    length, uobj, (unsigned long long)uoffset, align,
1794 	    flags, entry, line);
1795 #ifndef __sh3__ /* XXXRO: kern/51254 */
1796 	KASSERTMSG(!topdown || hint <= orig_hint,
1797 #else
1798 	if (__predict_false(!(!topdown || hint <= orig_hint)))
1799 		printf(
1800 #endif
1801 	    "map=%p hint=%#"PRIxVADDR" orig_hint=%#"PRIxVADDR
1802 	    " length=%#"PRIxVSIZE" uobj=%p uoffset=%#llx align=%"PRIxVSIZE
1803 	    " flags=%#x entry=%p (uvm_map_findspace line %d)",
1804 	    map, hint, orig_hint,
1805 	    length, uobj, (unsigned long long)uoffset, align,
1806 	    flags, entry, line);
1807 }
1808 
1809 /*
1810  * uvm_map_findspace: find "length" sized space in "map".
1811  *
1812  * => "hint" is a hint about where we want it, unless UVM_FLAG_FIXED is
1813  *	set in "flags" (in which case we insist on using "hint").
1814  * => "result" is VA returned
1815  * => uobj/uoffset are to be used to handle VAC alignment, if required
1816  * => if "align" is non-zero, we attempt to align to that value.
1817  * => caller must at least have read-locked map
1818  * => returns NULL on failure, or pointer to prev. map entry if success
1819  * => note this is a cross between the old vm_map_findspace and vm_map_find
1820  */
1821 
1822 struct vm_map_entry *
1823 uvm_map_findspace(struct vm_map *map, vaddr_t hint, vsize_t length,
1824     vaddr_t *result /* OUT */, struct uvm_object *uobj, voff_t uoffset,
1825     vsize_t align, int flags)
1826 {
1827 #define	INVARIANTS()							      \
1828 	uvm_findspace_invariants(map, orig_hint, length, uobj, uoffset, align,\
1829 	    flags, hint, entry, __LINE__)
1830 	struct vm_map_entry *entry = NULL;
1831 	struct vm_map_entry *child, *prev, *tmp;
1832 	vaddr_t orig_hint __diagused;
1833 	const int topdown = map->flags & VM_MAP_TOPDOWN;
1834 	int avail;
1835 	UVMHIST_FUNC(__func__);
1836 	UVMHIST_CALLARGS(maphist, "(map=%#jx, hint=%#jx, len=%ju, flags=%#jx...",
1837 	    (uintptr_t)map, hint, length, flags);
1838 	UVMHIST_LOG(maphist, " uobj=%#jx, uoffset=%#jx, align=%#jx)",
1839 	    (uintptr_t)uobj, uoffset, align, 0);
1840 
1841 	KASSERT((flags & UVM_FLAG_COLORMATCH) != 0 || powerof2(align));
1842 	KASSERT((flags & UVM_FLAG_COLORMATCH) == 0 || align < uvmexp.ncolors);
1843 	KASSERT((flags & UVM_FLAG_FIXED) == 0 || align == 0);
1844 
1845 	uvm_map_check(map, "map_findspace entry");
1846 
1847 	/*
1848 	 * Clamp the hint to the VM map's min/max address, and remmeber
1849 	 * the clamped original hint.  Remember the original hint,
1850 	 * clamped to the min/max address.  If we are aligning, then we
1851 	 * may have to try again with no alignment constraint if we
1852 	 * fail the first time.
1853 	 *
1854 	 * We use the original hint to verify later that the search has
1855 	 * been monotonic -- that is, nonincreasing or nondecreasing,
1856 	 * according to topdown or !topdown respectively.  But the
1857 	 * clamping is not monotonic.
1858 	 */
1859 	if (hint < vm_map_min(map)) {	/* check ranges ... */
1860 		if (flags & UVM_FLAG_FIXED) {
1861 			UVMHIST_LOG(maphist,"<- VA below map range",0,0,0,0);
1862 			return (NULL);
1863 		}
1864 		hint = vm_map_min(map);
1865 	}
1866 	if (hint > vm_map_max(map)) {
1867 		UVMHIST_LOG(maphist,"<- VA %#jx > range [%#jx->%#jx]",
1868 		    hint, vm_map_min(map), vm_map_max(map), 0);
1869 		return (NULL);
1870 	}
1871 	orig_hint = hint;
1872 	INVARIANTS();
1873 
1874 	UVMHIST_LOG(maphist,"<- VA %#jx vs range [%#jx->%#jx]",
1875 	    hint, vm_map_min(map), vm_map_max(map), 0);
1876 
1877 	/*
1878 	 * hint may not be aligned properly; we need round up or down it
1879 	 * before proceeding further.
1880 	 */
1881 	if ((flags & UVM_FLAG_COLORMATCH) == 0) {
1882 		uvm_map_align_va(&hint, align, topdown);
1883 		INVARIANTS();
1884 	}
1885 
1886 	UVMHIST_LOG(maphist,"<- VA %#jx vs range [%#jx->%#jx]",
1887 	    hint, vm_map_min(map), vm_map_max(map), 0);
1888 	/*
1889 	 * Look for the first possible address; if there's already
1890 	 * something at this address, we have to start after it.
1891 	 */
1892 
1893 	/*
1894 	 * @@@: there are four, no, eight cases to consider.
1895 	 *
1896 	 * 0: found,     fixed,     bottom up -> fail
1897 	 * 1: found,     fixed,     top down  -> fail
1898 	 * 2: found,     not fixed, bottom up -> start after entry->end,
1899 	 *                                       loop up
1900 	 * 3: found,     not fixed, top down  -> start before entry->start,
1901 	 *                                       loop down
1902 	 * 4: not found, fixed,     bottom up -> check entry->next->start, fail
1903 	 * 5: not found, fixed,     top down  -> check entry->next->start, fail
1904 	 * 6: not found, not fixed, bottom up -> check entry->next->start,
1905 	 *                                       loop up
1906 	 * 7: not found, not fixed, top down  -> check entry->next->start,
1907 	 *                                       loop down
1908 	 *
1909 	 * as you can see, it reduces to roughly five cases, and that
1910 	 * adding top down mapping only adds one unique case (without
1911 	 * it, there would be four cases).
1912 	 */
1913 
1914 	if ((flags & UVM_FLAG_FIXED) == 0 &&
1915 	    hint == (topdown ? vm_map_max(map) : vm_map_min(map))) {
1916 		/*
1917 		 * The uvm_map_findspace algorithm is monotonic -- for
1918 		 * topdown VM it starts with a high hint and returns a
1919 		 * lower free address; for !topdown VM it starts with a
1920 		 * low hint and returns a higher free address.  As an
1921 		 * optimization, start with the first (highest for
1922 		 * topdown, lowest for !topdown) free address.
1923 		 *
1924 		 * XXX This `optimization' probably doesn't actually do
1925 		 * much in practice unless userland explicitly passes
1926 		 * the VM map's minimum or maximum address, which
1927 		 * varies from machine to machine (VM_MAX/MIN_ADDRESS,
1928 		 * e.g. 0x7fbfdfeff000 on amd64 but 0xfffffffff000 on
1929 		 * aarch64) and may vary according to other factors
1930 		 * like sysctl vm.user_va0_disable.  In particular, if
1931 		 * the user specifies 0 as a hint to mmap, then mmap
1932 		 * will choose a default address which is usually _not_
1933 		 * VM_MAX/MIN_ADDRESS but something else instead like
1934 		 * VM_MAX_ADDRESS - stack size - guard page overhead,
1935 		 * in which case this branch is never hit.
1936 		 *
1937 		 * In fact, this branch appears to have been broken for
1938 		 * two decades between when topdown was introduced in
1939 		 * ~2003 and when it was adapted to handle the topdown
1940 		 * case without violating the monotonicity assertion in
1941 		 * 2022.  Maybe Someone^TM should either ditch the
1942 		 * optimization or find a better way to do it.
1943 		 */
1944 		entry = map->first_free;
1945 	} else {
1946 		if (uvm_map_lookup_entry(map, hint, &entry)) {
1947 			/* "hint" address already in use ... */
1948 			if (flags & UVM_FLAG_FIXED) {
1949 				UVMHIST_LOG(maphist, "<- fixed & VA in use",
1950 				    0, 0, 0, 0);
1951 				return (NULL);
1952 			}
1953 			if (topdown)
1954 				/* Start from lower gap. */
1955 				entry = entry->prev;
1956 		} else if (flags & UVM_FLAG_FIXED) {
1957 			if (entry->next->start >= hint + length &&
1958 			    hint + length > hint)
1959 				goto found;
1960 
1961 			/* "hint" address is gap but too small */
1962 			UVMHIST_LOG(maphist, "<- fixed mapping failed",
1963 			    0, 0, 0, 0);
1964 			return (NULL); /* only one shot at it ... */
1965 		} else {
1966 			/*
1967 			 * See if given hint fits in this gap.
1968 			 */
1969 			avail = uvm_map_space_avail(&hint, length,
1970 			    uoffset, align, flags, topdown, entry);
1971 			INVARIANTS();
1972 			switch (avail) {
1973 			case 1:
1974 				goto found;
1975 			case -1:
1976 				goto wraparound;
1977 			}
1978 
1979 			if (topdown) {
1980 				/*
1981 				 * Still there is a chance to fit
1982 				 * if hint > entry->end.
1983 				 */
1984 			} else {
1985 				/* Start from higher gap. */
1986 				entry = entry->next;
1987 				if (entry == &map->header)
1988 					goto notfound;
1989 				goto nextgap;
1990 			}
1991 		}
1992 	}
1993 
1994 	/*
1995 	 * Note that all UVM_FLAGS_FIXED case is already handled.
1996 	 */
1997 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
1998 
1999 	/* Try to find the space in the red-black tree */
2000 
2001 	/* Check slot before any entry */
2002 	if (topdown) {
2003 		KASSERTMSG(entry->next->start >= vm_map_min(map),
2004 		    "map=%p entry=%p entry->next=%p"
2005 		    " entry->next->start=0x%"PRIxVADDR" min=0x%"PRIxVADDR,
2006 		    map, entry, entry->next,
2007 		    entry->next->start, vm_map_min(map));
2008 		if (length > entry->next->start - vm_map_min(map))
2009 			hint = vm_map_min(map); /* XXX goto wraparound? */
2010 		else
2011 			hint = entry->next->start - length;
2012 		KASSERT(hint >= vm_map_min(map));
2013 	} else {
2014 		hint = entry->end;
2015 	}
2016 	INVARIANTS();
2017 	avail = uvm_map_space_avail(&hint, length, uoffset, align, flags,
2018 	    topdown, entry);
2019 	INVARIANTS();
2020 	switch (avail) {
2021 	case 1:
2022 		goto found;
2023 	case -1:
2024 		goto wraparound;
2025 	}
2026 
2027 nextgap:
2028 	KDASSERT((flags & UVM_FLAG_FIXED) == 0);
2029 	/* If there is not enough space in the whole tree, we fail */
2030 	tmp = ROOT_ENTRY(map);
2031 	if (tmp == NULL || tmp->maxgap < length)
2032 		goto notfound;
2033 
2034 	prev = NULL; /* previous candidate */
2035 
2036 	/* Find an entry close to hint that has enough space */
2037 	for (; tmp;) {
2038 		KASSERT(tmp->next->start == tmp->end + tmp->gap);
2039 		if (topdown) {
2040 			if (tmp->next->start < hint + length &&
2041 			    (prev == NULL || tmp->end > prev->end)) {
2042 				if (tmp->gap >= length)
2043 					prev = tmp;
2044 				else if ((child = LEFT_ENTRY(tmp)) != NULL
2045 				    && child->maxgap >= length)
2046 					prev = tmp;
2047 			}
2048 		} else {
2049 			if (tmp->end >= hint &&
2050 			    (prev == NULL || tmp->end < prev->end)) {
2051 				if (tmp->gap >= length)
2052 					prev = tmp;
2053 				else if ((child = RIGHT_ENTRY(tmp)) != NULL
2054 				    && child->maxgap >= length)
2055 					prev = tmp;
2056 			}
2057 		}
2058 		if (tmp->next->start < hint + length)
2059 			child = RIGHT_ENTRY(tmp);
2060 		else if (tmp->end > hint)
2061 			child = LEFT_ENTRY(tmp);
2062 		else {
2063 			if (tmp->gap >= length)
2064 				break;
2065 			if (topdown)
2066 				child = LEFT_ENTRY(tmp);
2067 			else
2068 				child = RIGHT_ENTRY(tmp);
2069 		}
2070 		if (child == NULL || child->maxgap < length)
2071 			break;
2072 		tmp = child;
2073 	}
2074 
2075 	if (tmp != NULL && tmp->start < hint && hint < tmp->next->start) {
2076 		/*
2077 		 * Check if the entry that we found satifies the
2078 		 * space requirement
2079 		 */
2080 		if (topdown) {
2081 			if (hint > tmp->next->start - length)
2082 				hint = tmp->next->start - length;
2083 		} else {
2084 			if (hint < tmp->end)
2085 				hint = tmp->end;
2086 		}
2087 		INVARIANTS();
2088 		avail = uvm_map_space_avail(&hint, length, uoffset, align,
2089 		    flags, topdown, tmp);
2090 		INVARIANTS();
2091 		switch (avail) {
2092 		case 1:
2093 			entry = tmp;
2094 			goto found;
2095 		case -1:
2096 			goto wraparound;
2097 		}
2098 		if (tmp->gap >= length)
2099 			goto listsearch;
2100 	}
2101 	if (prev == NULL)
2102 		goto notfound;
2103 
2104 	if (topdown) {
2105 		KASSERT(orig_hint >= prev->next->start - length ||
2106 		    prev->next->start - length > prev->next->start);
2107 		hint = prev->next->start - length;
2108 	} else {
2109 		KASSERT(orig_hint <= prev->end);
2110 		hint = prev->end;
2111 	}
2112 	INVARIANTS();
2113 	avail = uvm_map_space_avail(&hint, length, uoffset, align,
2114 	    flags, topdown, prev);
2115 	INVARIANTS();
2116 	switch (avail) {
2117 	case 1:
2118 		entry = prev;
2119 		goto found;
2120 	case -1:
2121 		goto wraparound;
2122 	}
2123 	if (prev->gap >= length)
2124 		goto listsearch;
2125 
2126 	if (topdown)
2127 		tmp = LEFT_ENTRY(prev);
2128 	else
2129 		tmp = RIGHT_ENTRY(prev);
2130 	for (;;) {
2131 		KASSERT(tmp);
2132 		KASSERTMSG(tmp->maxgap >= length,
2133 		    "tmp->maxgap=0x%"PRIxVSIZE" length=0x%"PRIxVSIZE,
2134 		    tmp->maxgap, length);
2135 		if (topdown)
2136 			child = RIGHT_ENTRY(tmp);
2137 		else
2138 			child = LEFT_ENTRY(tmp);
2139 		if (child && child->maxgap >= length) {
2140 			tmp = child;
2141 			continue;
2142 		}
2143 		if (tmp->gap >= length)
2144 			break;
2145 		if (topdown)
2146 			tmp = LEFT_ENTRY(tmp);
2147 		else
2148 			tmp = RIGHT_ENTRY(tmp);
2149 	}
2150 
2151 	if (topdown) {
2152 		KASSERT(orig_hint >= tmp->next->start - length ||
2153 		    tmp->next->start - length > tmp->next->start);
2154 		hint = tmp->next->start - length;
2155 	} else {
2156 		KASSERT(orig_hint <= tmp->end);
2157 		hint = tmp->end;
2158 	}
2159 	INVARIANTS();
2160 	avail = uvm_map_space_avail(&hint, length, uoffset, align,
2161 	    flags, topdown, tmp);
2162 	INVARIANTS();
2163 	switch (avail) {
2164 	case 1:
2165 		entry = tmp;
2166 		goto found;
2167 	case -1:
2168 		goto wraparound;
2169 	}
2170 
2171 	/*
2172 	 * The tree fails to find an entry because of offset or alignment
2173 	 * restrictions.  Search the list instead.
2174 	 */
2175  listsearch:
2176 	/*
2177 	 * Look through the rest of the map, trying to fit a new region in
2178 	 * the gap between existing regions, or after the very last region.
2179 	 * note: entry->end = base VA of current gap,
2180 	 *	 entry->next->start = VA of end of current gap
2181 	 */
2182 
2183 	INVARIANTS();
2184 	for (;;) {
2185 		/* Update hint for current gap. */
2186 		hint = topdown ? entry->next->start - length : entry->end;
2187 		INVARIANTS();
2188 
2189 		/* See if it fits. */
2190 		avail = uvm_map_space_avail(&hint, length, uoffset, align,
2191 		    flags, topdown, entry);
2192 		INVARIANTS();
2193 		switch (avail) {
2194 		case 1:
2195 			goto found;
2196 		case -1:
2197 			goto wraparound;
2198 		}
2199 
2200 		/* Advance to next/previous gap */
2201 		if (topdown) {
2202 			if (entry == &map->header) {
2203 				UVMHIST_LOG(maphist, "<- failed (off start)",
2204 				    0,0,0,0);
2205 				goto notfound;
2206 			}
2207 			entry = entry->prev;
2208 		} else {
2209 			entry = entry->next;
2210 			if (entry == &map->header) {
2211 				UVMHIST_LOG(maphist, "<- failed (off end)",
2212 				    0,0,0,0);
2213 				goto notfound;
2214 			}
2215 		}
2216 	}
2217 
2218  found:
2219 	SAVE_HINT(map, map->hint, entry);
2220 	*result = hint;
2221 	UVMHIST_LOG(maphist,"<- got it!  (result=%#jx)", hint, 0,0,0);
2222 	INVARIANTS();
2223 	KASSERT(entry->end <= hint);
2224 	KASSERT(hint + length <= entry->next->start);
2225 	return (entry);
2226 
2227  wraparound:
2228 	UVMHIST_LOG(maphist, "<- failed (wrap around)", 0,0,0,0);
2229 
2230 	return (NULL);
2231 
2232  notfound:
2233 	UVMHIST_LOG(maphist, "<- failed (notfound)", 0,0,0,0);
2234 
2235 	return (NULL);
2236 #undef INVARIANTS
2237 }
2238 
2239 /*
2240  *   U N M A P   -   m a i n   h e l p e r   f u n c t i o n s
2241  */
2242 
2243 /*
2244  * uvm_unmap_remove: remove mappings from a vm_map (from "start" up to "stop")
2245  *
2246  * => caller must check alignment and size
2247  * => map must be locked by caller
2248  * => we return a list of map entries that we've remove from the map
2249  *    in "entry_list"
2250  */
2251 
2252 void
2253 uvm_unmap_remove(struct vm_map *map, vaddr_t start, vaddr_t end,
2254     struct vm_map_entry **entry_list /* OUT */, int flags)
2255 {
2256 	struct vm_map_entry *entry, *first_entry, *next;
2257 	vaddr_t len;
2258 	UVMHIST_FUNC(__func__);
2259 	UVMHIST_CALLARGS(maphist,"(map=%#jx, start=%#jx, end=%#jx)",
2260 	    (uintptr_t)map, start, end, 0);
2261 	VM_MAP_RANGE_CHECK(map, start, end);
2262 
2263 	uvm_map_check(map, "unmap_remove entry");
2264 
2265 	/*
2266 	 * find first entry
2267 	 */
2268 
2269 	if (uvm_map_lookup_entry(map, start, &first_entry) == true) {
2270 		/* clip and go... */
2271 		entry = first_entry;
2272 		UVM_MAP_CLIP_START(map, entry, start);
2273 		/* critical!  prevents stale hint */
2274 		SAVE_HINT(map, entry, entry->prev);
2275 	} else {
2276 		entry = first_entry->next;
2277 	}
2278 
2279 	/*
2280 	 * save the free space hint
2281 	 */
2282 
2283 	if (map->first_free != &map->header && map->first_free->start >= start)
2284 		map->first_free = entry->prev;
2285 
2286 	/*
2287 	 * note: we now re-use first_entry for a different task.  we remove
2288 	 * a number of map entries from the map and save them in a linked
2289 	 * list headed by "first_entry".  once we remove them from the map
2290 	 * the caller should unlock the map and drop the references to the
2291 	 * backing objects [c.f. uvm_unmap_detach].  the object is to
2292 	 * separate unmapping from reference dropping.  why?
2293 	 *   [1] the map has to be locked for unmapping
2294 	 *   [2] the map need not be locked for reference dropping
2295 	 *   [3] dropping references may trigger pager I/O, and if we hit
2296 	 *       a pager that does synchronous I/O we may have to wait for it.
2297 	 *   [4] we would like all waiting for I/O to occur with maps unlocked
2298 	 *       so that we don't block other threads.
2299 	 */
2300 
2301 	first_entry = NULL;
2302 	*entry_list = NULL;
2303 
2304 	/*
2305 	 * break up the area into map entry sized regions and unmap.  note
2306 	 * that all mappings have to be removed before we can even consider
2307 	 * dropping references to amaps or VM objects (otherwise we could end
2308 	 * up with a mapping to a page on the free list which would be very bad)
2309 	 */
2310 
2311 	while ((entry != &map->header) && (entry->start < end)) {
2312 		KASSERT((entry->flags & UVM_MAP_STATIC) == 0);
2313 
2314 		UVM_MAP_CLIP_END(map, entry, end);
2315 		next = entry->next;
2316 		len = entry->end - entry->start;
2317 
2318 		/*
2319 		 * unwire before removing addresses from the pmap; otherwise
2320 		 * unwiring will put the entries back into the pmap (XXX).
2321 		 */
2322 
2323 		if (VM_MAPENT_ISWIRED(entry)) {
2324 			uvm_map_entry_unwire(map, entry);
2325 		}
2326 		if (flags & UVM_FLAG_VAONLY) {
2327 
2328 			/* nothing */
2329 
2330 		} else if ((map->flags & VM_MAP_PAGEABLE) == 0) {
2331 
2332 			/*
2333 			 * if the map is non-pageable, any pages mapped there
2334 			 * must be wired and entered with pmap_kenter_pa(),
2335 			 * and we should free any such pages immediately.
2336 			 * this is mostly used for kmem_map.
2337 			 */
2338 			KASSERT(vm_map_pmap(map) == pmap_kernel());
2339 
2340 			uvm_km_pgremove_intrsafe(map, entry->start, entry->end);
2341 		} else if (UVM_ET_ISOBJ(entry) &&
2342 			   UVM_OBJ_IS_KERN_OBJECT(entry->object.uvm_obj)) {
2343 			panic("%s: kernel object %p %p\n",
2344 			    __func__, map, entry);
2345 		} else if (UVM_ET_ISOBJ(entry) || entry->aref.ar_amap) {
2346 			/*
2347 			 * remove mappings the standard way.  lock object
2348 			 * and/or amap to ensure vm_page state does not
2349 			 * change while in pmap_remove().
2350 			 */
2351 
2352 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
2353 			uvm_map_lock_entry(entry, RW_WRITER);
2354 #else
2355 			uvm_map_lock_entry(entry, RW_READER);
2356 #endif
2357 			pmap_remove(map->pmap, entry->start, entry->end);
2358 
2359 			/*
2360 			 * note: if map is dying, leave pmap_update() for
2361 			 * later.  if the map is to be reused (exec) then
2362 			 * pmap_update() will be called.  if the map is
2363 			 * being disposed of (exit) then pmap_destroy()
2364 			 * will be called.
2365 			 */
2366 
2367 			if ((map->flags & VM_MAP_DYING) == 0) {
2368 				pmap_update(vm_map_pmap(map));
2369 			} else {
2370 				KASSERT(vm_map_pmap(map) != pmap_kernel());
2371 			}
2372 
2373 			uvm_map_unlock_entry(entry);
2374 		}
2375 
2376 #if defined(UVMDEBUG)
2377 		/*
2378 		 * check if there's remaining mapping,
2379 		 * which is a bug in caller.
2380 		 */
2381 
2382 		vaddr_t va;
2383 		for (va = entry->start; va < entry->end;
2384 		    va += PAGE_SIZE) {
2385 			if (pmap_extract(vm_map_pmap(map), va, NULL)) {
2386 				panic("%s: %#"PRIxVADDR" has mapping",
2387 				    __func__, va);
2388 			}
2389 		}
2390 
2391 		if (VM_MAP_IS_KERNEL(map) && (flags & UVM_FLAG_NOWAIT) == 0) {
2392 			uvm_km_check_empty(map, entry->start, entry->end);
2393 		}
2394 #endif /* defined(UVMDEBUG) */
2395 
2396 		/*
2397 		 * remove entry from map and put it on our list of entries
2398 		 * that we've nuked.  then go to next entry.
2399 		 */
2400 
2401 		UVMHIST_LOG(maphist, "  removed map entry %#jx",
2402 		    (uintptr_t)entry, 0, 0, 0);
2403 
2404 		/* critical!  prevents stale hint */
2405 		SAVE_HINT(map, entry, entry->prev);
2406 
2407 		uvm_map_entry_unlink(map, entry);
2408 		KASSERT(map->size >= len);
2409 		map->size -= len;
2410 		entry->prev = NULL;
2411 		entry->next = first_entry;
2412 		first_entry = entry;
2413 		entry = next;
2414 	}
2415 
2416 	uvm_map_check(map, "unmap_remove leave");
2417 
2418 	/*
2419 	 * now we've cleaned up the map and are ready for the caller to drop
2420 	 * references to the mapped objects.
2421 	 */
2422 
2423 	*entry_list = first_entry;
2424 	UVMHIST_LOG(maphist,"<- done!", 0, 0, 0, 0);
2425 
2426 	if (map->flags & VM_MAP_WANTVA) {
2427 		mutex_enter(&map->misc_lock);
2428 		map->flags &= ~VM_MAP_WANTVA;
2429 		cv_broadcast(&map->cv);
2430 		mutex_exit(&map->misc_lock);
2431 	}
2432 }
2433 
2434 /*
2435  * uvm_unmap_detach: drop references in a chain of map entries
2436  *
2437  * => we will free the map entries as we traverse the list.
2438  */
2439 
2440 void
2441 uvm_unmap_detach(struct vm_map_entry *first_entry, int flags)
2442 {
2443 	struct vm_map_entry *next_entry;
2444 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
2445 
2446 	while (first_entry) {
2447 		KASSERT(!VM_MAPENT_ISWIRED(first_entry));
2448 		UVMHIST_LOG(maphist,
2449 		    "  detach %#jx: amap=%#jx, obj=%#jx, submap?=%jd",
2450 		    (uintptr_t)first_entry,
2451 		    (uintptr_t)first_entry->aref.ar_amap,
2452 		    (uintptr_t)first_entry->object.uvm_obj,
2453 		    UVM_ET_ISSUBMAP(first_entry));
2454 
2455 		/*
2456 		 * drop reference to amap, if we've got one
2457 		 */
2458 
2459 		if (first_entry->aref.ar_amap)
2460 			uvm_map_unreference_amap(first_entry, flags);
2461 
2462 		/*
2463 		 * drop reference to our backing object, if we've got one
2464 		 */
2465 
2466 		KASSERT(!UVM_ET_ISSUBMAP(first_entry));
2467 		if (UVM_ET_ISOBJ(first_entry) &&
2468 		    first_entry->object.uvm_obj->pgops->pgo_detach) {
2469 			(*first_entry->object.uvm_obj->pgops->pgo_detach)
2470 				(first_entry->object.uvm_obj);
2471 		}
2472 		next_entry = first_entry->next;
2473 		uvm_mapent_free(first_entry);
2474 		first_entry = next_entry;
2475 	}
2476 	UVMHIST_LOG(maphist, "<- done", 0,0,0,0);
2477 }
2478 
2479 /*
2480  *   E X T R A C T I O N   F U N C T I O N S
2481  */
2482 
2483 /*
2484  * uvm_map_reserve: reserve space in a vm_map for future use.
2485  *
2486  * => we reserve space in a map by putting a dummy map entry in the
2487  *    map (dummy means obj=NULL, amap=NULL, prot=VM_PROT_NONE)
2488  * => map should be unlocked (we will write lock it)
2489  * => we return true if we were able to reserve space
2490  * => XXXCDC: should be inline?
2491  */
2492 
2493 int
2494 uvm_map_reserve(struct vm_map *map, vsize_t size,
2495     vaddr_t offset	/* hint for pmap_prefer */,
2496     vsize_t align	/* alignment */,
2497     vaddr_t *raddr	/* IN:hint, OUT: reserved VA */,
2498     uvm_flag_t flags	/* UVM_FLAG_FIXED or UVM_FLAG_COLORMATCH or 0 */)
2499 {
2500 	UVMHIST_FUNC(__func__);
2501 	UVMHIST_CALLARGS(maphist, "(map=%#jx, size=%#jx, offset=%#jx, addr=%#jx)",
2502 	    (uintptr_t)map, size, offset, (uintptr_t)raddr);
2503 
2504 	size = round_page(size);
2505 
2506 	/*
2507 	 * reserve some virtual space.
2508 	 */
2509 
2510 	if (uvm_map(map, raddr, size, NULL, offset, align,
2511 	    UVM_MAPFLAG(UVM_PROT_NONE, UVM_PROT_NONE, UVM_INH_NONE,
2512 	    UVM_ADV_RANDOM, UVM_FLAG_NOMERGE|flags)) != 0) {
2513 	    UVMHIST_LOG(maphist, "<- done (no VM)", 0,0,0,0);
2514 		return (false);
2515 	}
2516 
2517 	UVMHIST_LOG(maphist, "<- done (*raddr=%#jx)", *raddr,0,0,0);
2518 	return (true);
2519 }
2520 
2521 /*
2522  * uvm_map_replace: replace a reserved (blank) area of memory with
2523  * real mappings.
2524  *
2525  * => caller must WRITE-LOCK the map
2526  * => we return true if replacement was a success
2527  * => we expect the newents chain to have nnewents entrys on it and
2528  *    we expect newents->prev to point to the last entry on the list
2529  * => note newents is allowed to be NULL
2530  */
2531 
2532 static int
2533 uvm_map_replace(struct vm_map *map, vaddr_t start, vaddr_t end,
2534     struct vm_map_entry *newents, int nnewents, vsize_t nsize,
2535     struct vm_map_entry **oldentryp)
2536 {
2537 	struct vm_map_entry *oldent, *last;
2538 
2539 	uvm_map_check(map, "map_replace entry");
2540 
2541 	/*
2542 	 * first find the blank map entry at the specified address
2543 	 */
2544 
2545 	if (!uvm_map_lookup_entry(map, start, &oldent)) {
2546 		return (false);
2547 	}
2548 
2549 	/*
2550 	 * check to make sure we have a proper blank entry
2551 	 */
2552 
2553 	if (end < oldent->end) {
2554 		UVM_MAP_CLIP_END(map, oldent, end);
2555 	}
2556 	if (oldent->start != start || oldent->end != end ||
2557 	    oldent->object.uvm_obj != NULL || oldent->aref.ar_amap != NULL) {
2558 		return (false);
2559 	}
2560 
2561 #ifdef DIAGNOSTIC
2562 
2563 	/*
2564 	 * sanity check the newents chain
2565 	 */
2566 
2567 	{
2568 		struct vm_map_entry *tmpent = newents;
2569 		int nent = 0;
2570 		vsize_t sz = 0;
2571 		vaddr_t cur = start;
2572 
2573 		while (tmpent) {
2574 			nent++;
2575 			sz += tmpent->end - tmpent->start;
2576 			if (tmpent->start < cur)
2577 				panic("uvm_map_replace1");
2578 			if (tmpent->start >= tmpent->end || tmpent->end > end) {
2579 				panic("uvm_map_replace2: "
2580 				    "tmpent->start=%#"PRIxVADDR
2581 				    ", tmpent->end=%#"PRIxVADDR
2582 				    ", end=%#"PRIxVADDR,
2583 				    tmpent->start, tmpent->end, end);
2584 			}
2585 			cur = tmpent->end;
2586 			if (tmpent->next) {
2587 				if (tmpent->next->prev != tmpent)
2588 					panic("uvm_map_replace3");
2589 			} else {
2590 				if (newents->prev != tmpent)
2591 					panic("uvm_map_replace4");
2592 			}
2593 			tmpent = tmpent->next;
2594 		}
2595 		if (nent != nnewents)
2596 			panic("uvm_map_replace5");
2597 		if (sz != nsize)
2598 			panic("uvm_map_replace6");
2599 	}
2600 #endif
2601 
2602 	/*
2603 	 * map entry is a valid blank!   replace it.   (this does all the
2604 	 * work of map entry link/unlink...).
2605 	 */
2606 
2607 	if (newents) {
2608 		last = newents->prev;
2609 
2610 		/* critical: flush stale hints out of map */
2611 		SAVE_HINT(map, map->hint, newents);
2612 		if (map->first_free == oldent)
2613 			map->first_free = last;
2614 
2615 		last->next = oldent->next;
2616 		last->next->prev = last;
2617 
2618 		/* Fix RB tree */
2619 		uvm_rb_remove(map, oldent);
2620 
2621 		newents->prev = oldent->prev;
2622 		newents->prev->next = newents;
2623 		map->nentries = map->nentries + (nnewents - 1);
2624 
2625 		/* Fixup the RB tree */
2626 		{
2627 			int i;
2628 			struct vm_map_entry *tmp;
2629 
2630 			tmp = newents;
2631 			for (i = 0; i < nnewents && tmp; i++) {
2632 				uvm_rb_insert(map, tmp);
2633 				tmp = tmp->next;
2634 			}
2635 		}
2636 	} else {
2637 		/* NULL list of new entries: just remove the old one */
2638 		clear_hints(map, oldent);
2639 		uvm_map_entry_unlink(map, oldent);
2640 	}
2641 	map->size -= end - start - nsize;
2642 
2643 	uvm_map_check(map, "map_replace leave");
2644 
2645 	/*
2646 	 * now we can free the old blank entry and return.
2647 	 */
2648 
2649 	*oldentryp = oldent;
2650 	return (true);
2651 }
2652 
2653 /*
2654  * uvm_map_extract: extract a mapping from a map and put it somewhere
2655  *	(maybe removing the old mapping)
2656  *
2657  * => maps should be unlocked (we will write lock them)
2658  * => returns 0 on success, error code otherwise
2659  * => start must be page aligned
2660  * => len must be page sized
2661  * => flags:
2662  *      UVM_EXTRACT_REMOVE: remove mappings from srcmap
2663  *      UVM_EXTRACT_CONTIG: abort if unmapped area (advisory only)
2664  *      UVM_EXTRACT_QREF: for a temporary extraction do quick obj refs
2665  *      UVM_EXTRACT_FIXPROT: set prot to maxprot as we go
2666  *      UVM_EXTRACT_PROT_ALL: set prot to UVM_PROT_ALL as we go
2667  *    >>>NOTE: if you set REMOVE, you are not allowed to use CONTIG or QREF!<<<
2668  *    >>>NOTE: QREF's must be unmapped via the QREF path, thus should only
2669  *             be used from within the kernel in a kernel level map <<<
2670  */
2671 
2672 int
2673 uvm_map_extract(struct vm_map *srcmap, vaddr_t start, vsize_t len,
2674     struct vm_map *dstmap, vaddr_t *dstaddrp, int flags)
2675 {
2676 	vaddr_t dstaddr, end, newend, oldoffset, fudge, orig_fudge;
2677 	struct vm_map_entry *chain, *endchain, *entry, *orig_entry, *newentry,
2678 	    *deadentry, *oldentry;
2679 	struct vm_map_entry *resentry = NULL; /* a dummy reservation entry */
2680 	vsize_t elen __unused;
2681 	int nchain, error, copy_ok;
2682 	vsize_t nsize;
2683 	UVMHIST_FUNC(__func__);
2684 	UVMHIST_CALLARGS(maphist,"(srcmap=%#jx,start=%#jx, len=%#jx",
2685 	    (uintptr_t)srcmap, start, len, 0);
2686 	UVMHIST_LOG(maphist," ...,dstmap=%#jx, flags=%#jx)",
2687 	    (uintptr_t)dstmap, flags, 0, 0);
2688 
2689 	/*
2690 	 * step 0: sanity check: start must be on a page boundary, length
2691 	 * must be page sized.  can't ask for CONTIG/QREF if you asked for
2692 	 * REMOVE.
2693 	 */
2694 
2695 	KASSERTMSG((start & PAGE_MASK) == 0, "start=0x%"PRIxVADDR, start);
2696 	KASSERTMSG((len & PAGE_MASK) == 0, "len=0x%"PRIxVADDR, len);
2697 	KASSERT((flags & UVM_EXTRACT_REMOVE) == 0 ||
2698 		(flags & (UVM_EXTRACT_CONTIG|UVM_EXTRACT_QREF)) == 0);
2699 
2700 	/*
2701 	 * step 1: reserve space in the target map for the extracted area
2702 	 */
2703 
2704 	if ((flags & UVM_EXTRACT_RESERVED) == 0) {
2705 		dstaddr = vm_map_min(dstmap);
2706 		if (!uvm_map_reserve(dstmap, len, start,
2707 		    atop(start) & uvmexp.colormask, &dstaddr,
2708 		    UVM_FLAG_COLORMATCH))
2709 			return (ENOMEM);
2710 		KASSERT((atop(start ^ dstaddr) & uvmexp.colormask) == 0);
2711 		*dstaddrp = dstaddr;	/* pass address back to caller */
2712 		UVMHIST_LOG(maphist, "  dstaddr=%#jx", dstaddr,0,0,0);
2713 	} else {
2714 		dstaddr = *dstaddrp;
2715 	}
2716 
2717 	/*
2718 	 * step 2: setup for the extraction process loop by init'ing the
2719 	 * map entry chain, locking src map, and looking up the first useful
2720 	 * entry in the map.
2721 	 */
2722 
2723 	end = start + len;
2724 	newend = dstaddr + len;
2725 	chain = endchain = NULL;
2726 	nchain = 0;
2727 	nsize = 0;
2728 	vm_map_lock(srcmap);
2729 
2730 	if (uvm_map_lookup_entry(srcmap, start, &entry)) {
2731 
2732 		/* "start" is within an entry */
2733 		if (flags & UVM_EXTRACT_QREF) {
2734 
2735 			/*
2736 			 * for quick references we don't clip the entry, so
2737 			 * the entry may map space "before" the starting
2738 			 * virtual address... this is the "fudge" factor
2739 			 * (which can be non-zero only the first time
2740 			 * through the "while" loop in step 3).
2741 			 */
2742 
2743 			fudge = start - entry->start;
2744 		} else {
2745 
2746 			/*
2747 			 * normal reference: we clip the map to fit (thus
2748 			 * fudge is zero)
2749 			 */
2750 
2751 			UVM_MAP_CLIP_START(srcmap, entry, start);
2752 			SAVE_HINT(srcmap, srcmap->hint, entry->prev);
2753 			fudge = 0;
2754 		}
2755 	} else {
2756 
2757 		/* "start" is not within an entry ... skip to next entry */
2758 		if (flags & UVM_EXTRACT_CONTIG) {
2759 			error = EINVAL;
2760 			goto bad;    /* definite hole here ... */
2761 		}
2762 
2763 		entry = entry->next;
2764 		fudge = 0;
2765 	}
2766 
2767 	/* save values from srcmap for step 6 */
2768 	orig_entry = entry;
2769 	orig_fudge = fudge;
2770 
2771 	/*
2772 	 * step 3: now start looping through the map entries, extracting
2773 	 * as we go.
2774 	 */
2775 
2776 	while (entry->start < end && entry != &srcmap->header) {
2777 
2778 		/* if we are not doing a quick reference, clip it */
2779 		if ((flags & UVM_EXTRACT_QREF) == 0)
2780 			UVM_MAP_CLIP_END(srcmap, entry, end);
2781 
2782 		/* clear needs_copy (allow chunking) */
2783 		if (UVM_ET_ISNEEDSCOPY(entry)) {
2784 			amap_copy(srcmap, entry,
2785 			    AMAP_COPY_NOWAIT|AMAP_COPY_NOMERGE, start, end);
2786 			if (UVM_ET_ISNEEDSCOPY(entry)) {  /* failed? */
2787 				error = ENOMEM;
2788 				goto bad;
2789 			}
2790 
2791 			/* amap_copy could clip (during chunk)!  update fudge */
2792 			if (fudge) {
2793 				fudge = start - entry->start;
2794 				orig_fudge = fudge;
2795 			}
2796 		}
2797 
2798 		/* calculate the offset of this from "start" */
2799 		oldoffset = (entry->start + fudge) - start;
2800 
2801 		/* allocate a new map entry */
2802 		newentry = uvm_mapent_alloc(dstmap, 0);
2803 		if (newentry == NULL) {
2804 			error = ENOMEM;
2805 			goto bad;
2806 		}
2807 
2808 		/* set up new map entry */
2809 		newentry->next = NULL;
2810 		newentry->prev = endchain;
2811 		newentry->start = dstaddr + oldoffset;
2812 		newentry->end =
2813 		    newentry->start + (entry->end - (entry->start + fudge));
2814 		if (newentry->end > newend || newentry->end < newentry->start)
2815 			newentry->end = newend;
2816 		newentry->object.uvm_obj = entry->object.uvm_obj;
2817 		if (newentry->object.uvm_obj) {
2818 			if (newentry->object.uvm_obj->pgops->pgo_reference)
2819 				newentry->object.uvm_obj->pgops->
2820 				    pgo_reference(newentry->object.uvm_obj);
2821 			newentry->offset = entry->offset + fudge;
2822 		} else {
2823 			newentry->offset = 0;
2824 		}
2825 		newentry->etype = entry->etype;
2826 		if (flags & UVM_EXTRACT_PROT_ALL) {
2827 			newentry->protection = newentry->max_protection =
2828 			    UVM_PROT_ALL;
2829 		} else {
2830 			newentry->protection = (flags & UVM_EXTRACT_FIXPROT) ?
2831 			    entry->max_protection : entry->protection;
2832 			newentry->max_protection = entry->max_protection;
2833 		}
2834 		newentry->inheritance = entry->inheritance;
2835 		newentry->wired_count = 0;
2836 		newentry->aref.ar_amap = entry->aref.ar_amap;
2837 		if (newentry->aref.ar_amap) {
2838 			newentry->aref.ar_pageoff =
2839 			    entry->aref.ar_pageoff + (fudge >> PAGE_SHIFT);
2840 			uvm_map_reference_amap(newentry, AMAP_SHARED |
2841 			    ((flags & UVM_EXTRACT_QREF) ? AMAP_REFALL : 0));
2842 		} else {
2843 			newentry->aref.ar_pageoff = 0;
2844 		}
2845 		newentry->advice = entry->advice;
2846 		if ((flags & UVM_EXTRACT_QREF) != 0) {
2847 			newentry->flags |= UVM_MAP_NOMERGE;
2848 		}
2849 
2850 		/* now link it on the chain */
2851 		nchain++;
2852 		nsize += newentry->end - newentry->start;
2853 		if (endchain == NULL) {
2854 			chain = endchain = newentry;
2855 		} else {
2856 			endchain->next = newentry;
2857 			endchain = newentry;
2858 		}
2859 
2860 		/* end of 'while' loop! */
2861 		if ((flags & UVM_EXTRACT_CONTIG) && entry->end < end &&
2862 		    (entry->next == &srcmap->header ||
2863 		    entry->next->start != entry->end)) {
2864 			error = EINVAL;
2865 			goto bad;
2866 		}
2867 		entry = entry->next;
2868 		fudge = 0;
2869 	}
2870 
2871 	/*
2872 	 * step 4: close off chain (in format expected by uvm_map_replace)
2873 	 */
2874 
2875 	if (chain)
2876 		chain->prev = endchain;
2877 
2878 	/*
2879 	 * step 5: attempt to lock the dest map so we can pmap_copy.
2880 	 * note usage of copy_ok:
2881 	 *   1 => dstmap locked, pmap_copy ok, and we "replace" here (step 5)
2882 	 *   0 => dstmap unlocked, NO pmap_copy, and we will "replace" in step 7
2883 	 */
2884 
2885 	if (srcmap == dstmap || vm_map_lock_try(dstmap) == true) {
2886 		copy_ok = 1;
2887 		if (!uvm_map_replace(dstmap, dstaddr, dstaddr+len, chain,
2888 		    nchain, nsize, &resentry)) {
2889 			if (srcmap != dstmap)
2890 				vm_map_unlock(dstmap);
2891 			error = EIO;
2892 			goto bad;
2893 		}
2894 	} else {
2895 		copy_ok = 0;
2896 		/* replace defered until step 7 */
2897 	}
2898 
2899 	/*
2900 	 * step 6: traverse the srcmap a second time to do the following:
2901 	 *  - if we got a lock on the dstmap do pmap_copy
2902 	 *  - if UVM_EXTRACT_REMOVE remove the entries
2903 	 * we make use of orig_entry and orig_fudge (saved in step 2)
2904 	 */
2905 
2906 	if (copy_ok || (flags & UVM_EXTRACT_REMOVE)) {
2907 
2908 		/* purge possible stale hints from srcmap */
2909 		if (flags & UVM_EXTRACT_REMOVE) {
2910 			SAVE_HINT(srcmap, srcmap->hint, orig_entry->prev);
2911 			if (srcmap->first_free != &srcmap->header &&
2912 			    srcmap->first_free->start >= start)
2913 				srcmap->first_free = orig_entry->prev;
2914 		}
2915 
2916 		entry = orig_entry;
2917 		fudge = orig_fudge;
2918 		deadentry = NULL;	/* for UVM_EXTRACT_REMOVE */
2919 
2920 		while (entry->start < end && entry != &srcmap->header) {
2921 			if (copy_ok) {
2922 				oldoffset = (entry->start + fudge) - start;
2923 				elen = MIN(end, entry->end) -
2924 				    (entry->start + fudge);
2925 				pmap_copy(dstmap->pmap, srcmap->pmap,
2926 				    dstaddr + oldoffset, elen,
2927 				    entry->start + fudge);
2928 			}
2929 
2930 			/* we advance "entry" in the following if statement */
2931 			if (flags & UVM_EXTRACT_REMOVE) {
2932 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
2933 				uvm_map_lock_entry(entry, RW_WRITER);
2934 #else
2935 				uvm_map_lock_entry(entry, RW_READER);
2936 #endif
2937 				pmap_remove(srcmap->pmap, entry->start,
2938 						entry->end);
2939 				uvm_map_unlock_entry(entry);
2940 				oldentry = entry;	/* save entry */
2941 				entry = entry->next;	/* advance */
2942 				uvm_map_entry_unlink(srcmap, oldentry);
2943 							/* add to dead list */
2944 				oldentry->next = deadentry;
2945 				deadentry = oldentry;
2946 			} else {
2947 				entry = entry->next;		/* advance */
2948 			}
2949 
2950 			/* end of 'while' loop */
2951 			fudge = 0;
2952 		}
2953 		pmap_update(srcmap->pmap);
2954 
2955 		/*
2956 		 * unlock dstmap.  we will dispose of deadentry in
2957 		 * step 7 if needed
2958 		 */
2959 
2960 		if (copy_ok && srcmap != dstmap)
2961 			vm_map_unlock(dstmap);
2962 
2963 	} else {
2964 		deadentry = NULL;
2965 	}
2966 
2967 	/*
2968 	 * step 7: we are done with the source map, unlock.   if copy_ok
2969 	 * is 0 then we have not replaced the dummy mapping in dstmap yet
2970 	 * and we need to do so now.
2971 	 */
2972 
2973 	vm_map_unlock(srcmap);
2974 	if ((flags & UVM_EXTRACT_REMOVE) && deadentry)
2975 		uvm_unmap_detach(deadentry, 0);   /* dispose of old entries */
2976 
2977 	/* now do the replacement if we didn't do it in step 5 */
2978 	if (copy_ok == 0) {
2979 		vm_map_lock(dstmap);
2980 		error = uvm_map_replace(dstmap, dstaddr, dstaddr+len, chain,
2981 		    nchain, nsize, &resentry);
2982 		vm_map_unlock(dstmap);
2983 
2984 		if (error == false) {
2985 			error = EIO;
2986 			goto bad2;
2987 		}
2988 	}
2989 
2990 	if (resentry != NULL)
2991 		uvm_mapent_free(resentry);
2992 
2993 	return (0);
2994 
2995 	/*
2996 	 * bad: failure recovery
2997 	 */
2998 bad:
2999 	vm_map_unlock(srcmap);
3000 bad2:			/* src already unlocked */
3001 	if (chain)
3002 		uvm_unmap_detach(chain,
3003 		    (flags & UVM_EXTRACT_QREF) ? AMAP_REFALL : 0);
3004 
3005 	if (resentry != NULL)
3006 		uvm_mapent_free(resentry);
3007 
3008 	if ((flags & UVM_EXTRACT_RESERVED) == 0) {
3009 		uvm_unmap(dstmap, dstaddr, dstaddr+len);   /* ??? */
3010 	}
3011 	return (error);
3012 }
3013 
3014 /* end of extraction functions */
3015 
3016 /*
3017  * uvm_map_submap: punch down part of a map into a submap
3018  *
3019  * => only the kernel_map is allowed to be submapped
3020  * => the purpose of submapping is to break up the locking granularity
3021  *	of a larger map
3022  * => the range specified must have been mapped previously with a uvm_map()
3023  *	call [with uobj==NULL] to create a blank map entry in the main map.
3024  *	[And it had better still be blank!]
3025  * => maps which contain submaps should never be copied or forked.
3026  * => to remove a submap, use uvm_unmap() on the main map
3027  *	and then uvm_map_deallocate() the submap.
3028  * => main map must be unlocked.
3029  * => submap must have been init'd and have a zero reference count.
3030  *	[need not be locked as we don't actually reference it]
3031  */
3032 
3033 int
3034 uvm_map_submap(struct vm_map *map, vaddr_t start, vaddr_t end,
3035     struct vm_map *submap)
3036 {
3037 	struct vm_map_entry *entry;
3038 	int error;
3039 
3040 	vm_map_lock(map);
3041 	VM_MAP_RANGE_CHECK(map, start, end);
3042 
3043 	if (uvm_map_lookup_entry(map, start, &entry)) {
3044 		UVM_MAP_CLIP_START(map, entry, start);
3045 		UVM_MAP_CLIP_END(map, entry, end);	/* to be safe */
3046 	} else {
3047 		entry = NULL;
3048 	}
3049 
3050 	if (entry != NULL &&
3051 	    entry->start == start && entry->end == end &&
3052 	    entry->object.uvm_obj == NULL && entry->aref.ar_amap == NULL &&
3053 	    !UVM_ET_ISCOPYONWRITE(entry) && !UVM_ET_ISNEEDSCOPY(entry)) {
3054 		entry->etype |= UVM_ET_SUBMAP;
3055 		entry->object.sub_map = submap;
3056 		entry->offset = 0;
3057 		uvm_map_reference(submap);
3058 		error = 0;
3059 	} else {
3060 		error = EINVAL;
3061 	}
3062 	vm_map_unlock(map);
3063 
3064 	return error;
3065 }
3066 
3067 /*
3068  * uvm_map_protect_user: change map protection on behalf of the user.
3069  * Enforces PAX settings as necessary.
3070  */
3071 int
3072 uvm_map_protect_user(struct lwp *l, vaddr_t start, vaddr_t end,
3073     vm_prot_t new_prot)
3074 {
3075 	int error;
3076 
3077 	if ((error = PAX_MPROTECT_VALIDATE(l, new_prot)))
3078 		return error;
3079 
3080 	return uvm_map_protect(&l->l_proc->p_vmspace->vm_map, start, end,
3081 	    new_prot, false);
3082 }
3083 
3084 
3085 /*
3086  * uvm_map_protect: change map protection
3087  *
3088  * => set_max means set max_protection.
3089  * => map must be unlocked.
3090  */
3091 
3092 #define MASK(entry)	(UVM_ET_ISCOPYONWRITE(entry) ? \
3093 			 ~VM_PROT_WRITE : VM_PROT_ALL)
3094 
3095 int
3096 uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
3097     vm_prot_t new_prot, bool set_max)
3098 {
3099 	struct vm_map_entry *current, *entry;
3100 	int error = 0;
3101 	UVMHIST_FUNC(__func__);
3102 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_prot=%#jx)",
3103 	    (uintptr_t)map, start, end, new_prot);
3104 
3105 	vm_map_lock(map);
3106 	VM_MAP_RANGE_CHECK(map, start, end);
3107 	if (uvm_map_lookup_entry(map, start, &entry)) {
3108 		UVM_MAP_CLIP_START(map, entry, start);
3109 	} else {
3110 		entry = entry->next;
3111 	}
3112 
3113 	/*
3114 	 * make a first pass to check for protection violations.
3115 	 */
3116 
3117 	current = entry;
3118 	while ((current != &map->header) && (current->start < end)) {
3119 		if (UVM_ET_ISSUBMAP(current)) {
3120 			error = EINVAL;
3121 			goto out;
3122 		}
3123 		if ((new_prot & current->max_protection) != new_prot) {
3124 			error = EACCES;
3125 			goto out;
3126 		}
3127 		/*
3128 		 * Don't allow VM_PROT_EXECUTE to be set on entries that
3129 		 * point to vnodes that are associated with a NOEXEC file
3130 		 * system.
3131 		 */
3132 		if (UVM_ET_ISOBJ(current) &&
3133 		    UVM_OBJ_IS_VNODE(current->object.uvm_obj)) {
3134 			struct vnode *vp =
3135 			    (struct vnode *) current->object.uvm_obj;
3136 
3137 			if ((new_prot & VM_PROT_EXECUTE) != 0 &&
3138 			    (vp->v_mount->mnt_flag & MNT_NOEXEC) != 0) {
3139 				error = EACCES;
3140 				goto out;
3141 			}
3142 		}
3143 
3144 		current = current->next;
3145 	}
3146 
3147 	/* go back and fix up protections (no need to clip this time). */
3148 
3149 	current = entry;
3150 	while ((current != &map->header) && (current->start < end)) {
3151 		vm_prot_t old_prot;
3152 
3153 		UVM_MAP_CLIP_END(map, current, end);
3154 		old_prot = current->protection;
3155 		if (set_max)
3156 			current->protection =
3157 			    (current->max_protection = new_prot) & old_prot;
3158 		else
3159 			current->protection = new_prot;
3160 
3161 		/*
3162 		 * update physical map if necessary.  worry about copy-on-write
3163 		 * here -- CHECK THIS XXX
3164 		 */
3165 
3166 		if (current->protection != old_prot) {
3167 			/* update pmap! */
3168 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
3169 			uvm_map_lock_entry(current, RW_WRITER);
3170 #else
3171 			uvm_map_lock_entry(current, RW_READER);
3172 #endif
3173 			pmap_protect(map->pmap, current->start, current->end,
3174 			    current->protection & MASK(current));
3175 			uvm_map_unlock_entry(current);
3176 
3177 			/*
3178 			 * If this entry points at a vnode, and the
3179 			 * protection includes VM_PROT_EXECUTE, mark
3180 			 * the vnode as VEXECMAP.
3181 			 */
3182 			if (UVM_ET_ISOBJ(current)) {
3183 				struct uvm_object *uobj =
3184 				    current->object.uvm_obj;
3185 
3186 				if (UVM_OBJ_IS_VNODE(uobj) &&
3187 				    (current->protection & VM_PROT_EXECUTE)) {
3188 					vn_markexec((struct vnode *) uobj);
3189 				}
3190 			}
3191 		}
3192 
3193 		/*
3194 		 * If the map is configured to lock any future mappings,
3195 		 * wire this entry now if the old protection was VM_PROT_NONE
3196 		 * and the new protection is not VM_PROT_NONE.
3197 		 */
3198 
3199 		if ((map->flags & VM_MAP_WIREFUTURE) != 0 &&
3200 		    VM_MAPENT_ISWIRED(current) == 0 &&
3201 		    old_prot == VM_PROT_NONE &&
3202 		    new_prot != VM_PROT_NONE) {
3203 
3204 			/*
3205 			 * We must call pmap_update() here because the
3206 			 * pmap_protect() call above might have removed some
3207 			 * pmap entries and uvm_map_pageable() might create
3208 			 * some new pmap entries that rely on the prior
3209 			 * removals being completely finished.
3210 			 */
3211 
3212 			pmap_update(map->pmap);
3213 
3214 			if (uvm_map_pageable(map, current->start,
3215 			    current->end, false,
3216 			    UVM_LK_ENTER|UVM_LK_EXIT) != 0) {
3217 
3218 				/*
3219 				 * If locking the entry fails, remember the
3220 				 * error if it's the first one.  Note we
3221 				 * still continue setting the protection in
3222 				 * the map, but will return the error
3223 				 * condition regardless.
3224 				 *
3225 				 * XXX Ignore what the actual error is,
3226 				 * XXX just call it a resource shortage
3227 				 * XXX so that it doesn't get confused
3228 				 * XXX what uvm_map_protect() itself would
3229 				 * XXX normally return.
3230 				 */
3231 
3232 				error = ENOMEM;
3233 			}
3234 		}
3235 		current = current->next;
3236 	}
3237 	pmap_update(map->pmap);
3238 
3239  out:
3240 	vm_map_unlock(map);
3241 
3242 	UVMHIST_LOG(maphist, "<- done, error=%jd",error,0,0,0);
3243 	return error;
3244 }
3245 
3246 #undef  MASK
3247 
3248 /*
3249  * uvm_map_inherit: set inheritance code for range of addrs in map.
3250  *
3251  * => map must be unlocked
3252  * => note that the inherit code is used during a "fork".  see fork
3253  *	code for details.
3254  */
3255 
3256 int
3257 uvm_map_inherit(struct vm_map *map, vaddr_t start, vaddr_t end,
3258     vm_inherit_t new_inheritance)
3259 {
3260 	struct vm_map_entry *entry, *temp_entry;
3261 	UVMHIST_FUNC(__func__);
3262 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_inh=%#jx)",
3263 	    (uintptr_t)map, start, end, new_inheritance);
3264 
3265 	switch (new_inheritance) {
3266 	case MAP_INHERIT_NONE:
3267 	case MAP_INHERIT_COPY:
3268 	case MAP_INHERIT_SHARE:
3269 	case MAP_INHERIT_ZERO:
3270 		break;
3271 	default:
3272 		UVMHIST_LOG(maphist,"<- done (INVALID ARG)",0,0,0,0);
3273 		return EINVAL;
3274 	}
3275 
3276 	vm_map_lock(map);
3277 	VM_MAP_RANGE_CHECK(map, start, end);
3278 	if (uvm_map_lookup_entry(map, start, &temp_entry)) {
3279 		entry = temp_entry;
3280 		UVM_MAP_CLIP_START(map, entry, start);
3281 	}  else {
3282 		entry = temp_entry->next;
3283 	}
3284 	while ((entry != &map->header) && (entry->start < end)) {
3285 		UVM_MAP_CLIP_END(map, entry, end);
3286 		entry->inheritance = new_inheritance;
3287 		entry = entry->next;
3288 	}
3289 	vm_map_unlock(map);
3290 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3291 	return 0;
3292 }
3293 
3294 /*
3295  * uvm_map_advice: set advice code for range of addrs in map.
3296  *
3297  * => map must be unlocked
3298  */
3299 
3300 int
3301 uvm_map_advice(struct vm_map *map, vaddr_t start, vaddr_t end, int new_advice)
3302 {
3303 	struct vm_map_entry *entry, *temp_entry;
3304 	UVMHIST_FUNC(__func__);
3305 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_adv=%#jx)",
3306 	    (uintptr_t)map, start, end, new_advice);
3307 
3308 	vm_map_lock(map);
3309 	VM_MAP_RANGE_CHECK(map, start, end);
3310 	if (uvm_map_lookup_entry(map, start, &temp_entry)) {
3311 		entry = temp_entry;
3312 		UVM_MAP_CLIP_START(map, entry, start);
3313 	} else {
3314 		entry = temp_entry->next;
3315 	}
3316 
3317 	/*
3318 	 * XXXJRT: disallow holes?
3319 	 */
3320 
3321 	while ((entry != &map->header) && (entry->start < end)) {
3322 		UVM_MAP_CLIP_END(map, entry, end);
3323 
3324 		switch (new_advice) {
3325 		case MADV_NORMAL:
3326 		case MADV_RANDOM:
3327 		case MADV_SEQUENTIAL:
3328 			/* nothing special here */
3329 			break;
3330 
3331 		default:
3332 			vm_map_unlock(map);
3333 			UVMHIST_LOG(maphist,"<- done (INVALID ARG)",0,0,0,0);
3334 			return EINVAL;
3335 		}
3336 		entry->advice = new_advice;
3337 		entry = entry->next;
3338 	}
3339 
3340 	vm_map_unlock(map);
3341 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3342 	return 0;
3343 }
3344 
3345 /*
3346  * uvm_map_willneed: apply MADV_WILLNEED
3347  */
3348 
3349 int
3350 uvm_map_willneed(struct vm_map *map, vaddr_t start, vaddr_t end)
3351 {
3352 	struct vm_map_entry *entry;
3353 	UVMHIST_FUNC(__func__);
3354 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx)",
3355 	    (uintptr_t)map, start, end, 0);
3356 
3357 	vm_map_lock_read(map);
3358 	VM_MAP_RANGE_CHECK(map, start, end);
3359 	if (!uvm_map_lookup_entry(map, start, &entry)) {
3360 		entry = entry->next;
3361 	}
3362 	while (entry->start < end) {
3363 		struct vm_amap * const amap = entry->aref.ar_amap;
3364 		struct uvm_object * const uobj = entry->object.uvm_obj;
3365 
3366 		KASSERT(entry != &map->header);
3367 		KASSERT(start < entry->end);
3368 		/*
3369 		 * For now, we handle only the easy but commonly-requested case.
3370 		 * ie. start prefetching of backing uobj pages.
3371 		 *
3372 		 * XXX It might be useful to pmap_enter() the already-in-core
3373 		 * pages by inventing a "weak" mode for uvm_fault() which would
3374 		 * only do the PGO_LOCKED pgo_get().
3375 		 */
3376 		if (UVM_ET_ISOBJ(entry) && amap == NULL && uobj != NULL) {
3377 			off_t offset;
3378 			off_t size;
3379 
3380 			offset = entry->offset;
3381 			if (start < entry->start) {
3382 				offset += entry->start - start;
3383 			}
3384 			size = entry->offset + (entry->end - entry->start);
3385 			if (entry->end < end) {
3386 				size -= end - entry->end;
3387 			}
3388 			uvm_readahead(uobj, offset, size);
3389 		}
3390 		entry = entry->next;
3391 	}
3392 	vm_map_unlock_read(map);
3393 	UVMHIST_LOG(maphist,"<- done (OK)",0,0,0,0);
3394 	return 0;
3395 }
3396 
3397 /*
3398  * uvm_map_pageable: sets the pageability of a range in a map.
3399  *
3400  * => wires map entries.  should not be used for transient page locking.
3401  *	for that, use uvm_fault_wire()/uvm_fault_unwire() (see uvm_vslock()).
3402  * => regions specified as not pageable require lock-down (wired) memory
3403  *	and page tables.
3404  * => map must never be read-locked
3405  * => if islocked is true, map is already write-locked
3406  * => we always unlock the map, since we must downgrade to a read-lock
3407  *	to call uvm_fault_wire()
3408  * => XXXCDC: check this and try and clean it up.
3409  */
3410 
3411 int
3412 uvm_map_pageable(struct vm_map *map, vaddr_t start, vaddr_t end,
3413     bool new_pageable, int lockflags)
3414 {
3415 	struct vm_map_entry *entry, *start_entry, *failed_entry;
3416 	int rv;
3417 #ifdef DIAGNOSTIC
3418 	u_int timestamp_save;
3419 #endif
3420 	UVMHIST_FUNC(__func__);
3421 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,new_pageable=%ju)",
3422 	    (uintptr_t)map, start, end, new_pageable);
3423 	KASSERT(map->flags & VM_MAP_PAGEABLE);
3424 
3425 	if ((lockflags & UVM_LK_ENTER) == 0)
3426 		vm_map_lock(map);
3427 	VM_MAP_RANGE_CHECK(map, start, end);
3428 
3429 	/*
3430 	 * only one pageability change may take place at one time, since
3431 	 * uvm_fault_wire assumes it will be called only once for each
3432 	 * wiring/unwiring.  therefore, we have to make sure we're actually
3433 	 * changing the pageability for the entire region.  we do so before
3434 	 * making any changes.
3435 	 */
3436 
3437 	if (uvm_map_lookup_entry(map, start, &start_entry) == false) {
3438 		if ((lockflags & UVM_LK_EXIT) == 0)
3439 			vm_map_unlock(map);
3440 
3441 		UVMHIST_LOG(maphist,"<- done (fault)",0,0,0,0);
3442 		return EFAULT;
3443 	}
3444 	entry = start_entry;
3445 
3446 	if (start == end) {		/* nothing required */
3447 		if ((lockflags & UVM_LK_EXIT) == 0)
3448 			vm_map_unlock(map);
3449 
3450 		UVMHIST_LOG(maphist,"<- done (nothing)",0,0,0,0);
3451 		return 0;
3452 	}
3453 
3454 	/*
3455 	 * handle wiring and unwiring separately.
3456 	 */
3457 
3458 	if (new_pageable) {		/* unwire */
3459 		UVM_MAP_CLIP_START(map, entry, start);
3460 
3461 		/*
3462 		 * unwiring.  first ensure that the range to be unwired is
3463 		 * really wired down and that there are no holes.
3464 		 */
3465 
3466 		while ((entry != &map->header) && (entry->start < end)) {
3467 			if (entry->wired_count == 0 ||
3468 			    (entry->end < end &&
3469 			     (entry->next == &map->header ||
3470 			      entry->next->start > entry->end))) {
3471 				if ((lockflags & UVM_LK_EXIT) == 0)
3472 					vm_map_unlock(map);
3473 				UVMHIST_LOG(maphist, "<- done (INVAL)",0,0,0,0);
3474 				return EINVAL;
3475 			}
3476 			entry = entry->next;
3477 		}
3478 
3479 		/*
3480 		 * POSIX 1003.1b - a single munlock call unlocks a region,
3481 		 * regardless of the number of mlock calls made on that
3482 		 * region.
3483 		 */
3484 
3485 		entry = start_entry;
3486 		while ((entry != &map->header) && (entry->start < end)) {
3487 			UVM_MAP_CLIP_END(map, entry, end);
3488 			if (VM_MAPENT_ISWIRED(entry))
3489 				uvm_map_entry_unwire(map, entry);
3490 			entry = entry->next;
3491 		}
3492 		if ((lockflags & UVM_LK_EXIT) == 0)
3493 			vm_map_unlock(map);
3494 		UVMHIST_LOG(maphist,"<- done (OK UNWIRE)",0,0,0,0);
3495 		return 0;
3496 	}
3497 
3498 	/*
3499 	 * wire case: in two passes [XXXCDC: ugly block of code here]
3500 	 *
3501 	 * 1: holding the write lock, we create any anonymous maps that need
3502 	 *    to be created.  then we clip each map entry to the region to
3503 	 *    be wired and increment its wiring count.
3504 	 *
3505 	 * 2: we downgrade to a read lock, and call uvm_fault_wire to fault
3506 	 *    in the pages for any newly wired area (wired_count == 1).
3507 	 *
3508 	 *    downgrading to a read lock for uvm_fault_wire avoids a possible
3509 	 *    deadlock with another thread that may have faulted on one of
3510 	 *    the pages to be wired (it would mark the page busy, blocking
3511 	 *    us, then in turn block on the map lock that we hold).  because
3512 	 *    of problems in the recursive lock package, we cannot upgrade
3513 	 *    to a write lock in vm_map_lookup.  thus, any actions that
3514 	 *    require the write lock must be done beforehand.  because we
3515 	 *    keep the read lock on the map, the copy-on-write status of the
3516 	 *    entries we modify here cannot change.
3517 	 */
3518 
3519 	while ((entry != &map->header) && (entry->start < end)) {
3520 		if (VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3521 
3522 			/*
3523 			 * perform actions of vm_map_lookup that need the
3524 			 * write lock on the map: create an anonymous map
3525 			 * for a copy-on-write region, or an anonymous map
3526 			 * for a zero-fill region.  (XXXCDC: submap case
3527 			 * ok?)
3528 			 */
3529 
3530 			if (!UVM_ET_ISSUBMAP(entry)) {  /* not submap */
3531 				if (UVM_ET_ISNEEDSCOPY(entry) &&
3532 				    ((entry->max_protection & VM_PROT_WRITE) ||
3533 				     (entry->object.uvm_obj == NULL))) {
3534 					amap_copy(map, entry, 0, start, end);
3535 					/* XXXCDC: wait OK? */
3536 				}
3537 			}
3538 		}
3539 		UVM_MAP_CLIP_START(map, entry, start);
3540 		UVM_MAP_CLIP_END(map, entry, end);
3541 		entry->wired_count++;
3542 
3543 		/*
3544 		 * Check for holes
3545 		 */
3546 
3547 		if (entry->protection == VM_PROT_NONE ||
3548 		    (entry->end < end &&
3549 		     (entry->next == &map->header ||
3550 		      entry->next->start > entry->end))) {
3551 
3552 			/*
3553 			 * found one.  amap creation actions do not need to
3554 			 * be undone, but the wired counts need to be restored.
3555 			 */
3556 
3557 			while (entry != &map->header && entry->end > start) {
3558 				entry->wired_count--;
3559 				entry = entry->prev;
3560 			}
3561 			if ((lockflags & UVM_LK_EXIT) == 0)
3562 				vm_map_unlock(map);
3563 			UVMHIST_LOG(maphist,"<- done (INVALID WIRE)",0,0,0,0);
3564 			return EINVAL;
3565 		}
3566 		entry = entry->next;
3567 	}
3568 
3569 	/*
3570 	 * Pass 2.
3571 	 */
3572 
3573 #ifdef DIAGNOSTIC
3574 	timestamp_save = map->timestamp;
3575 #endif
3576 	vm_map_busy(map);
3577 	vm_map_unlock(map);
3578 
3579 	rv = 0;
3580 	entry = start_entry;
3581 	while (entry != &map->header && entry->start < end) {
3582 		if (entry->wired_count == 1) {
3583 			rv = uvm_fault_wire(map, entry->start, entry->end,
3584 			    entry->max_protection, 1);
3585 			if (rv) {
3586 
3587 				/*
3588 				 * wiring failed.  break out of the loop.
3589 				 * we'll clean up the map below, once we
3590 				 * have a write lock again.
3591 				 */
3592 
3593 				break;
3594 			}
3595 		}
3596 		entry = entry->next;
3597 	}
3598 
3599 	if (rv) {	/* failed? */
3600 
3601 		/*
3602 		 * Get back to an exclusive (write) lock.
3603 		 */
3604 
3605 		vm_map_lock(map);
3606 		vm_map_unbusy(map);
3607 
3608 #ifdef DIAGNOSTIC
3609 		if (timestamp_save + 1 != map->timestamp)
3610 			panic("uvm_map_pageable: stale map");
3611 #endif
3612 
3613 		/*
3614 		 * first drop the wiring count on all the entries
3615 		 * which haven't actually been wired yet.
3616 		 */
3617 
3618 		failed_entry = entry;
3619 		while (entry != &map->header && entry->start < end) {
3620 			entry->wired_count--;
3621 			entry = entry->next;
3622 		}
3623 
3624 		/*
3625 		 * now, unwire all the entries that were successfully
3626 		 * wired above.
3627 		 */
3628 
3629 		entry = start_entry;
3630 		while (entry != failed_entry) {
3631 			entry->wired_count--;
3632 			if (VM_MAPENT_ISWIRED(entry) == 0)
3633 				uvm_map_entry_unwire(map, entry);
3634 			entry = entry->next;
3635 		}
3636 		if ((lockflags & UVM_LK_EXIT) == 0)
3637 			vm_map_unlock(map);
3638 		UVMHIST_LOG(maphist, "<- done (RV=%jd)", rv,0,0,0);
3639 		return (rv);
3640 	}
3641 
3642 	if ((lockflags & UVM_LK_EXIT) == 0) {
3643 		vm_map_unbusy(map);
3644 	} else {
3645 
3646 		/*
3647 		 * Get back to an exclusive (write) lock.
3648 		 */
3649 
3650 		vm_map_lock(map);
3651 		vm_map_unbusy(map);
3652 	}
3653 
3654 	UVMHIST_LOG(maphist,"<- done (OK WIRE)",0,0,0,0);
3655 	return 0;
3656 }
3657 
3658 /*
3659  * uvm_map_pageable_all: special case of uvm_map_pageable - affects
3660  * all mapped regions.
3661  *
3662  * => map must not be locked.
3663  * => if no flags are specified, all regions are unwired.
3664  * => XXXJRT: has some of the same problems as uvm_map_pageable() above.
3665  */
3666 
3667 int
3668 uvm_map_pageable_all(struct vm_map *map, int flags, vsize_t limit)
3669 {
3670 	struct vm_map_entry *entry, *failed_entry;
3671 	vsize_t size;
3672 	int rv;
3673 #ifdef DIAGNOSTIC
3674 	u_int timestamp_save;
3675 #endif
3676 	UVMHIST_FUNC(__func__);
3677 	UVMHIST_CALLARGS(maphist,"(map=%#jx,flags=%#jx)", (uintptr_t)map, flags,
3678 	    0, 0);
3679 
3680 	KASSERT(map->flags & VM_MAP_PAGEABLE);
3681 
3682 	vm_map_lock(map);
3683 
3684 	/*
3685 	 * handle wiring and unwiring separately.
3686 	 */
3687 
3688 	if (flags == 0) {			/* unwire */
3689 
3690 		/*
3691 		 * POSIX 1003.1b -- munlockall unlocks all regions,
3692 		 * regardless of how many times mlockall has been called.
3693 		 */
3694 
3695 		for (entry = map->header.next; entry != &map->header;
3696 		     entry = entry->next) {
3697 			if (VM_MAPENT_ISWIRED(entry))
3698 				uvm_map_entry_unwire(map, entry);
3699 		}
3700 		map->flags &= ~VM_MAP_WIREFUTURE;
3701 		vm_map_unlock(map);
3702 		UVMHIST_LOG(maphist,"<- done (OK UNWIRE)",0,0,0,0);
3703 		return 0;
3704 	}
3705 
3706 	if (flags & MCL_FUTURE) {
3707 
3708 		/*
3709 		 * must wire all future mappings; remember this.
3710 		 */
3711 
3712 		map->flags |= VM_MAP_WIREFUTURE;
3713 	}
3714 
3715 	if ((flags & MCL_CURRENT) == 0) {
3716 
3717 		/*
3718 		 * no more work to do!
3719 		 */
3720 
3721 		UVMHIST_LOG(maphist,"<- done (OK no wire)",0,0,0,0);
3722 		vm_map_unlock(map);
3723 		return 0;
3724 	}
3725 
3726 	/*
3727 	 * wire case: in three passes [XXXCDC: ugly block of code here]
3728 	 *
3729 	 * 1: holding the write lock, count all pages mapped by non-wired
3730 	 *    entries.  if this would cause us to go over our limit, we fail.
3731 	 *
3732 	 * 2: still holding the write lock, we create any anonymous maps that
3733 	 *    need to be created.  then we increment its wiring count.
3734 	 *
3735 	 * 3: we downgrade to a read lock, and call uvm_fault_wire to fault
3736 	 *    in the pages for any newly wired area (wired_count == 1).
3737 	 *
3738 	 *    downgrading to a read lock for uvm_fault_wire avoids a possible
3739 	 *    deadlock with another thread that may have faulted on one of
3740 	 *    the pages to be wired (it would mark the page busy, blocking
3741 	 *    us, then in turn block on the map lock that we hold).  because
3742 	 *    of problems in the recursive lock package, we cannot upgrade
3743 	 *    to a write lock in vm_map_lookup.  thus, any actions that
3744 	 *    require the write lock must be done beforehand.  because we
3745 	 *    keep the read lock on the map, the copy-on-write status of the
3746 	 *    entries we modify here cannot change.
3747 	 */
3748 
3749 	for (size = 0, entry = map->header.next; entry != &map->header;
3750 	     entry = entry->next) {
3751 		if (entry->protection != VM_PROT_NONE &&
3752 		    VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3753 			size += entry->end - entry->start;
3754 		}
3755 	}
3756 
3757 	if (atop(size) + uvmexp.wired > uvmexp.wiredmax) {
3758 		vm_map_unlock(map);
3759 		return ENOMEM;
3760 	}
3761 
3762 	if (limit != 0 &&
3763 	    (size + ptoa(pmap_wired_count(vm_map_pmap(map))) > limit)) {
3764 		vm_map_unlock(map);
3765 		return ENOMEM;
3766 	}
3767 
3768 	/*
3769 	 * Pass 2.
3770 	 */
3771 
3772 	for (entry = map->header.next; entry != &map->header;
3773 	     entry = entry->next) {
3774 		if (entry->protection == VM_PROT_NONE)
3775 			continue;
3776 		if (VM_MAPENT_ISWIRED(entry) == 0) { /* not already wired? */
3777 
3778 			/*
3779 			 * perform actions of vm_map_lookup that need the
3780 			 * write lock on the map: create an anonymous map
3781 			 * for a copy-on-write region, or an anonymous map
3782 			 * for a zero-fill region.  (XXXCDC: submap case
3783 			 * ok?)
3784 			 */
3785 
3786 			if (!UVM_ET_ISSUBMAP(entry)) {	/* not submap */
3787 				if (UVM_ET_ISNEEDSCOPY(entry) &&
3788 				    ((entry->max_protection & VM_PROT_WRITE) ||
3789 				     (entry->object.uvm_obj == NULL))) {
3790 					amap_copy(map, entry, 0, entry->start,
3791 					    entry->end);
3792 					/* XXXCDC: wait OK? */
3793 				}
3794 			}
3795 		}
3796 		entry->wired_count++;
3797 	}
3798 
3799 	/*
3800 	 * Pass 3.
3801 	 */
3802 
3803 #ifdef DIAGNOSTIC
3804 	timestamp_save = map->timestamp;
3805 #endif
3806 	vm_map_busy(map);
3807 	vm_map_unlock(map);
3808 
3809 	rv = 0;
3810 	for (entry = map->header.next; entry != &map->header;
3811 	     entry = entry->next) {
3812 		if (entry->wired_count == 1) {
3813 			rv = uvm_fault_wire(map, entry->start, entry->end,
3814 			    entry->max_protection, 1);
3815 			if (rv) {
3816 
3817 				/*
3818 				 * wiring failed.  break out of the loop.
3819 				 * we'll clean up the map below, once we
3820 				 * have a write lock again.
3821 				 */
3822 
3823 				break;
3824 			}
3825 		}
3826 	}
3827 
3828 	if (rv) {
3829 
3830 		/*
3831 		 * Get back an exclusive (write) lock.
3832 		 */
3833 
3834 		vm_map_lock(map);
3835 		vm_map_unbusy(map);
3836 
3837 #ifdef DIAGNOSTIC
3838 		if (timestamp_save + 1 != map->timestamp)
3839 			panic("uvm_map_pageable_all: stale map");
3840 #endif
3841 
3842 		/*
3843 		 * first drop the wiring count on all the entries
3844 		 * which haven't actually been wired yet.
3845 		 *
3846 		 * Skip VM_PROT_NONE entries like we did above.
3847 		 */
3848 
3849 		failed_entry = entry;
3850 		for (/* nothing */; entry != &map->header;
3851 		     entry = entry->next) {
3852 			if (entry->protection == VM_PROT_NONE)
3853 				continue;
3854 			entry->wired_count--;
3855 		}
3856 
3857 		/*
3858 		 * now, unwire all the entries that were successfully
3859 		 * wired above.
3860 		 *
3861 		 * Skip VM_PROT_NONE entries like we did above.
3862 		 */
3863 
3864 		for (entry = map->header.next; entry != failed_entry;
3865 		     entry = entry->next) {
3866 			if (entry->protection == VM_PROT_NONE)
3867 				continue;
3868 			entry->wired_count--;
3869 			if (VM_MAPENT_ISWIRED(entry))
3870 				uvm_map_entry_unwire(map, entry);
3871 		}
3872 		vm_map_unlock(map);
3873 		UVMHIST_LOG(maphist,"<- done (RV=%jd)", rv,0,0,0);
3874 		return (rv);
3875 	}
3876 
3877 	vm_map_unbusy(map);
3878 
3879 	UVMHIST_LOG(maphist,"<- done (OK WIRE)",0,0,0,0);
3880 	return 0;
3881 }
3882 
3883 /*
3884  * uvm_map_clean: clean out a map range
3885  *
3886  * => valid flags:
3887  *   if (flags & PGO_CLEANIT): dirty pages are cleaned first
3888  *   if (flags & PGO_SYNCIO): dirty pages are written synchronously
3889  *   if (flags & PGO_DEACTIVATE): any cached pages are deactivated after clean
3890  *   if (flags & PGO_FREE): any cached pages are freed after clean
3891  * => returns an error if any part of the specified range isn't mapped
3892  * => never a need to flush amap layer since the anonymous memory has
3893  *	no permanent home, but may deactivate pages there
3894  * => called from sys_msync() and sys_madvise()
3895  * => caller must not have map locked
3896  */
3897 
3898 int
3899 uvm_map_clean(struct vm_map *map, vaddr_t start, vaddr_t end, int flags)
3900 {
3901 	struct vm_map_entry *current, *entry;
3902 	struct uvm_object *uobj;
3903 	struct vm_amap *amap;
3904 	struct vm_anon *anon;
3905 	struct vm_page *pg;
3906 	vaddr_t offset;
3907 	vsize_t size;
3908 	voff_t uoff;
3909 	int error, refs;
3910 	UVMHIST_FUNC(__func__);
3911 	UVMHIST_CALLARGS(maphist,"(map=%#jx,start=%#jx,end=%#jx,flags=%#jx)",
3912 	    (uintptr_t)map, start, end, flags);
3913 
3914 	KASSERT((flags & (PGO_FREE|PGO_DEACTIVATE)) !=
3915 		(PGO_FREE|PGO_DEACTIVATE));
3916 
3917 	vm_map_lock(map);
3918 	VM_MAP_RANGE_CHECK(map, start, end);
3919 	if (!uvm_map_lookup_entry(map, start, &entry)) {
3920 		vm_map_unlock(map);
3921 		return EFAULT;
3922 	}
3923 
3924 	/*
3925 	 * Make a first pass to check for holes and wiring problems.
3926 	 */
3927 
3928 	for (current = entry; current->start < end; current = current->next) {
3929 		if (UVM_ET_ISSUBMAP(current)) {
3930 			vm_map_unlock(map);
3931 			return EINVAL;
3932 		}
3933 		if ((flags & PGO_FREE) != 0 && VM_MAPENT_ISWIRED(entry)) {
3934 			vm_map_unlock(map);
3935 			return EBUSY;
3936 		}
3937 		if (end <= current->end) {
3938 			break;
3939 		}
3940 		if (current->end != current->next->start) {
3941 			vm_map_unlock(map);
3942 			return EFAULT;
3943 		}
3944 	}
3945 
3946 	vm_map_busy(map);
3947 	vm_map_unlock(map);
3948 	error = 0;
3949 	for (current = entry; start < end; current = current->next) {
3950 		amap = current->aref.ar_amap;	/* upper layer */
3951 		uobj = current->object.uvm_obj;	/* lower layer */
3952 		KASSERT(start >= current->start);
3953 
3954 		/*
3955 		 * No amap cleaning necessary if:
3956 		 *
3957 		 *	(1) There's no amap.
3958 		 *
3959 		 *	(2) We're not deactivating or freeing pages.
3960 		 */
3961 
3962 		if (amap == NULL || (flags & (PGO_DEACTIVATE|PGO_FREE)) == 0)
3963 			goto flush_object;
3964 
3965 		offset = start - current->start;
3966 		size = MIN(end, current->end) - start;
3967 
3968 		amap_lock(amap, RW_WRITER);
3969 		for ( ; size != 0; size -= PAGE_SIZE, offset += PAGE_SIZE) {
3970 			anon = amap_lookup(&current->aref, offset);
3971 			if (anon == NULL)
3972 				continue;
3973 
3974 			KASSERT(anon->an_lock == amap->am_lock);
3975 			pg = anon->an_page;
3976 			if (pg == NULL) {
3977 				continue;
3978 			}
3979 			if (pg->flags & PG_BUSY) {
3980 				continue;
3981 			}
3982 
3983 			switch (flags & (PGO_CLEANIT|PGO_FREE|PGO_DEACTIVATE)) {
3984 
3985 			/*
3986 			 * In these first 3 cases, we just deactivate the page.
3987 			 */
3988 
3989 			case PGO_CLEANIT|PGO_FREE:
3990 			case PGO_CLEANIT|PGO_DEACTIVATE:
3991 			case PGO_DEACTIVATE:
3992  deactivate_it:
3993 				/*
3994 				 * skip the page if it's loaned or wired,
3995 				 * since it shouldn't be on a paging queue
3996 				 * at all in these cases.
3997 				 */
3998 
3999 				if (pg->loan_count != 0 ||
4000 				    pg->wire_count != 0) {
4001 					continue;
4002 				}
4003 				KASSERT(pg->uanon == anon);
4004 				uvm_pagelock(pg);
4005 				uvm_pagedeactivate(pg);
4006 				uvm_pageunlock(pg);
4007 				continue;
4008 
4009 			case PGO_FREE:
4010 
4011 				/*
4012 				 * If there are multiple references to
4013 				 * the amap, just deactivate the page.
4014 				 */
4015 
4016 				if (amap_refs(amap) > 1)
4017 					goto deactivate_it;
4018 
4019 				/* skip the page if it's wired */
4020 				if (pg->wire_count != 0) {
4021 					continue;
4022 				}
4023 				amap_unadd(&current->aref, offset);
4024 				refs = --anon->an_ref;
4025 				if (refs == 0) {
4026 					uvm_anfree(anon);
4027 				}
4028 				continue;
4029 			}
4030 		}
4031 		amap_unlock(amap);
4032 
4033  flush_object:
4034 		/*
4035 		 * flush pages if we've got a valid backing object.
4036 		 * note that we must always clean object pages before
4037 		 * freeing them since otherwise we could reveal stale
4038 		 * data from files.
4039 		 */
4040 
4041 		uoff = current->offset + (start - current->start);
4042 		size = MIN(end, current->end) - start;
4043 		if (uobj != NULL) {
4044 			rw_enter(uobj->vmobjlock, RW_WRITER);
4045 			if (uobj->pgops->pgo_put != NULL)
4046 				error = (uobj->pgops->pgo_put)(uobj, uoff,
4047 				    uoff + size, flags | PGO_CLEANIT);
4048 			else
4049 				error = 0;
4050 		}
4051 		start += size;
4052 	}
4053 	vm_map_unbusy(map);
4054 	return error;
4055 }
4056 
4057 
4058 /*
4059  * uvm_map_checkprot: check protection in map
4060  *
4061  * => must allow specified protection in a fully allocated region.
4062  * => map must be read or write locked by caller.
4063  */
4064 
4065 bool
4066 uvm_map_checkprot(struct vm_map *map, vaddr_t start, vaddr_t end,
4067     vm_prot_t protection)
4068 {
4069 	struct vm_map_entry *entry;
4070 	struct vm_map_entry *tmp_entry;
4071 
4072 	if (!uvm_map_lookup_entry(map, start, &tmp_entry)) {
4073 		return (false);
4074 	}
4075 	entry = tmp_entry;
4076 	while (start < end) {
4077 		if (entry == &map->header) {
4078 			return (false);
4079 		}
4080 
4081 		/*
4082 		 * no holes allowed
4083 		 */
4084 
4085 		if (start < entry->start) {
4086 			return (false);
4087 		}
4088 
4089 		/*
4090 		 * check protection associated with entry
4091 		 */
4092 
4093 		if ((entry->protection & protection) != protection) {
4094 			return (false);
4095 		}
4096 		start = entry->end;
4097 		entry = entry->next;
4098 	}
4099 	return (true);
4100 }
4101 
4102 /*
4103  * uvmspace_alloc: allocate a vmspace structure.
4104  *
4105  * - structure includes vm_map and pmap
4106  * - XXX: no locking on this structure
4107  * - refcnt set to 1, rest must be init'd by caller
4108  */
4109 struct vmspace *
4110 uvmspace_alloc(vaddr_t vmin, vaddr_t vmax, bool topdown)
4111 {
4112 	struct vmspace *vm;
4113 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4114 
4115 	vm = pool_cache_get(&uvm_vmspace_cache, PR_WAITOK);
4116 	uvmspace_init(vm, NULL, vmin, vmax, topdown);
4117 	UVMHIST_LOG(maphist,"<- done (vm=%#jx)", (uintptr_t)vm, 0, 0, 0);
4118 	return (vm);
4119 }
4120 
4121 /*
4122  * uvmspace_init: initialize a vmspace structure.
4123  *
4124  * - XXX: no locking on this structure
4125  * - refcnt set to 1, rest must be init'd by caller
4126  */
4127 void
4128 uvmspace_init(struct vmspace *vm, struct pmap *pmap, vaddr_t vmin,
4129     vaddr_t vmax, bool topdown)
4130 {
4131 	UVMHIST_FUNC(__func__);
4132 	UVMHIST_CALLARGS(maphist, "(vm=%#jx, pmap=%#jx, vmin=%#jx, vmax=%#jx",
4133 	    (uintptr_t)vm, (uintptr_t)pmap, vmin, vmax);
4134 	UVMHIST_LOG(maphist, "   topdown=%ju)", topdown, 0, 0, 0);
4135 
4136 	memset(vm, 0, sizeof(*vm));
4137 	uvm_map_setup(&vm->vm_map, vmin, vmax, VM_MAP_PAGEABLE
4138 	    | (topdown ? VM_MAP_TOPDOWN : 0)
4139 	    );
4140 	if (pmap)
4141 		pmap_reference(pmap);
4142 	else
4143 		pmap = pmap_create();
4144 	vm->vm_map.pmap = pmap;
4145 	vm->vm_refcnt = 1;
4146 	UVMHIST_LOG(maphist,"<- done",0,0,0,0);
4147 }
4148 
4149 /*
4150  * uvmspace_share: share a vmspace between two processes
4151  *
4152  * - used for vfork, threads(?)
4153  */
4154 
4155 void
4156 uvmspace_share(struct proc *p1, struct proc *p2)
4157 {
4158 
4159 	uvmspace_addref(p1->p_vmspace);
4160 	p2->p_vmspace = p1->p_vmspace;
4161 }
4162 
4163 #if 0
4164 
4165 /*
4166  * uvmspace_unshare: ensure that process "p" has its own, unshared, vmspace
4167  *
4168  * - XXX: no locking on vmspace
4169  */
4170 
4171 void
4172 uvmspace_unshare(struct lwp *l)
4173 {
4174 	struct proc *p = l->l_proc;
4175 	struct vmspace *nvm, *ovm = p->p_vmspace;
4176 
4177 	if (ovm->vm_refcnt == 1)
4178 		/* nothing to do: vmspace isn't shared in the first place */
4179 		return;
4180 
4181 	/* make a new vmspace, still holding old one */
4182 	nvm = uvmspace_fork(ovm);
4183 
4184 	kpreempt_disable();
4185 	pmap_deactivate(l);		/* unbind old vmspace */
4186 	p->p_vmspace = nvm;
4187 	pmap_activate(l);		/* switch to new vmspace */
4188 	kpreempt_enable();
4189 
4190 	uvmspace_free(ovm);		/* drop reference to old vmspace */
4191 }
4192 
4193 #endif
4194 
4195 
4196 /*
4197  * uvmspace_spawn: a new process has been spawned and needs a vmspace
4198  */
4199 
4200 void
4201 uvmspace_spawn(struct lwp *l, vaddr_t start, vaddr_t end, bool topdown)
4202 {
4203 	struct proc *p = l->l_proc;
4204 	struct vmspace *nvm;
4205 
4206 #ifdef __HAVE_CPU_VMSPACE_EXEC
4207 	cpu_vmspace_exec(l, start, end);
4208 #endif
4209 
4210 	nvm = uvmspace_alloc(start, end, topdown);
4211 	kpreempt_disable();
4212 	p->p_vmspace = nvm;
4213 	pmap_activate(l);
4214 	kpreempt_enable();
4215 }
4216 
4217 /*
4218  * uvmspace_exec: the process wants to exec a new program
4219  */
4220 
4221 void
4222 uvmspace_exec(struct lwp *l, vaddr_t start, vaddr_t end, bool topdown)
4223 {
4224 	struct proc *p = l->l_proc;
4225 	struct vmspace *nvm, *ovm = p->p_vmspace;
4226 	struct vm_map *map;
4227 	int flags;
4228 
4229 	KASSERT(ovm != NULL);
4230 #ifdef __HAVE_CPU_VMSPACE_EXEC
4231 	cpu_vmspace_exec(l, start, end);
4232 #endif
4233 
4234 	map = &ovm->vm_map;
4235 	/*
4236 	 * see if more than one process is using this vmspace...
4237 	 */
4238 
4239 	if (ovm->vm_refcnt == 1
4240 	    && topdown == ((ovm->vm_map.flags & VM_MAP_TOPDOWN) != 0)) {
4241 
4242 		/*
4243 		 * if p is the only process using its vmspace then we can safely
4244 		 * recycle that vmspace for the program that is being exec'd.
4245 		 * But only if TOPDOWN matches the requested value for the new
4246 		 * vm space!
4247 		 */
4248 
4249 		/*
4250 		 * SYSV SHM semantics require us to kill all segments on an exec
4251 		 */
4252 		if (uvm_shmexit && ovm->vm_shm)
4253 			(*uvm_shmexit)(ovm);
4254 
4255 		/*
4256 		 * POSIX 1003.1b -- "lock future mappings" is revoked
4257 		 * when a process execs another program image.
4258 		 */
4259 
4260 		map->flags &= ~VM_MAP_WIREFUTURE;
4261 
4262 		/*
4263 		 * now unmap the old program.
4264 		 *
4265 		 * XXX set VM_MAP_DYING for the duration, so pmap_update()
4266 		 * is not called until the pmap has been totally cleared out
4267 		 * after pmap_remove_all(), or it can confuse some pmap
4268 		 * implementations.  it would be nice to handle this by
4269 		 * deferring the pmap_update() while it is known the address
4270 		 * space is not visible to any user LWP other than curlwp,
4271 		 * but there isn't an elegant way of inferring that right
4272 		 * now.
4273 		 */
4274 
4275 		flags = pmap_remove_all(map->pmap) ? UVM_FLAG_VAONLY : 0;
4276 		map->flags |= VM_MAP_DYING;
4277 		uvm_unmap1(map, vm_map_min(map), vm_map_max(map), flags);
4278 		map->flags &= ~VM_MAP_DYING;
4279 		pmap_update(map->pmap);
4280 		KASSERT(map->header.prev == &map->header);
4281 		KASSERT(map->nentries == 0);
4282 
4283 		/*
4284 		 * resize the map
4285 		 */
4286 
4287 		vm_map_setmin(map, start);
4288 		vm_map_setmax(map, end);
4289 	} else {
4290 
4291 		/*
4292 		 * p's vmspace is being shared, so we can't reuse it for p since
4293 		 * it is still being used for others.   allocate a new vmspace
4294 		 * for p
4295 		 */
4296 
4297 		nvm = uvmspace_alloc(start, end, topdown);
4298 
4299 		/*
4300 		 * install new vmspace and drop our ref to the old one.
4301 		 */
4302 
4303 		kpreempt_disable();
4304 		pmap_deactivate(l);
4305 		p->p_vmspace = nvm;
4306 		pmap_activate(l);
4307 		kpreempt_enable();
4308 
4309 		uvmspace_free(ovm);
4310 	}
4311 }
4312 
4313 /*
4314  * uvmspace_addref: add a reference to a vmspace.
4315  */
4316 
4317 void
4318 uvmspace_addref(struct vmspace *vm)
4319 {
4320 
4321 	KASSERT((vm->vm_map.flags & VM_MAP_DYING) == 0);
4322 	KASSERT(vm->vm_refcnt > 0);
4323 	atomic_inc_uint(&vm->vm_refcnt);
4324 }
4325 
4326 /*
4327  * uvmspace_free: free a vmspace data structure
4328  */
4329 
4330 void
4331 uvmspace_free(struct vmspace *vm)
4332 {
4333 	struct vm_map_entry *dead_entries;
4334 	struct vm_map *map = &vm->vm_map;
4335 	int flags;
4336 
4337 	UVMHIST_FUNC(__func__);
4338 	UVMHIST_CALLARGS(maphist,"(vm=%#jx) ref=%jd", (uintptr_t)vm,
4339 	    vm->vm_refcnt, 0, 0);
4340 
4341 	membar_release();
4342 	if (atomic_dec_uint_nv(&vm->vm_refcnt) > 0)
4343 		return;
4344 	membar_acquire();
4345 
4346 	/*
4347 	 * at this point, there should be no other references to the map.
4348 	 * delete all of the mappings, then destroy the pmap.
4349 	 */
4350 
4351 	map->flags |= VM_MAP_DYING;
4352 	flags = pmap_remove_all(map->pmap) ? UVM_FLAG_VAONLY : 0;
4353 
4354 	/* Get rid of any SYSV shared memory segments. */
4355 	if (uvm_shmexit && vm->vm_shm != NULL)
4356 		(*uvm_shmexit)(vm);
4357 
4358 	if (map->nentries) {
4359 		uvm_unmap_remove(map, vm_map_min(map), vm_map_max(map),
4360 		    &dead_entries, flags);
4361 		if (dead_entries != NULL)
4362 			uvm_unmap_detach(dead_entries, 0);
4363 	}
4364 	KASSERT(map->nentries == 0);
4365 	KASSERT(map->size == 0);
4366 
4367 	mutex_destroy(&map->misc_lock);
4368 	rw_destroy(&map->lock);
4369 	cv_destroy(&map->cv);
4370 	pmap_destroy(map->pmap);
4371 	pool_cache_put(&uvm_vmspace_cache, vm);
4372 }
4373 
4374 static struct vm_map_entry *
4375 uvm_mapent_clone(struct vm_map *new_map, struct vm_map_entry *old_entry,
4376     int flags)
4377 {
4378 	struct vm_map_entry *new_entry;
4379 
4380 	new_entry = uvm_mapent_alloc(new_map, 0);
4381 	/* old_entry -> new_entry */
4382 	uvm_mapent_copy(old_entry, new_entry);
4383 
4384 	/* new pmap has nothing wired in it */
4385 	new_entry->wired_count = 0;
4386 
4387 	/*
4388 	 * gain reference to object backing the map (can't
4389 	 * be a submap, already checked this case).
4390 	 */
4391 
4392 	if (new_entry->aref.ar_amap)
4393 		uvm_map_reference_amap(new_entry, flags);
4394 
4395 	if (new_entry->object.uvm_obj &&
4396 	    new_entry->object.uvm_obj->pgops->pgo_reference)
4397 		new_entry->object.uvm_obj->pgops->pgo_reference(
4398 			new_entry->object.uvm_obj);
4399 
4400 	/* insert entry at end of new_map's entry list */
4401 	uvm_map_entry_link(new_map, new_map->header.prev,
4402 	    new_entry);
4403 
4404 	return new_entry;
4405 }
4406 
4407 /*
4408  * share the mapping: this means we want the old and
4409  * new entries to share amaps and backing objects.
4410  */
4411 static void
4412 uvm_mapent_forkshared(struct vm_map *new_map, struct vm_map *old_map,
4413     struct vm_map_entry *old_entry)
4414 {
4415 	/*
4416 	 * if the old_entry needs a new amap (due to prev fork)
4417 	 * then we need to allocate it now so that we have
4418 	 * something we own to share with the new_entry.   [in
4419 	 * other words, we need to clear needs_copy]
4420 	 */
4421 
4422 	if (UVM_ET_ISNEEDSCOPY(old_entry)) {
4423 		/* get our own amap, clears needs_copy */
4424 		amap_copy(old_map, old_entry, AMAP_COPY_NOCHUNK,
4425 		    0, 0);
4426 		/* XXXCDC: WAITOK??? */
4427 	}
4428 
4429 	uvm_mapent_clone(new_map, old_entry, AMAP_SHARED);
4430 }
4431 
4432 
4433 static void
4434 uvm_mapent_forkcopy(struct vm_map *new_map, struct vm_map *old_map,
4435     struct vm_map_entry *old_entry)
4436 {
4437 	struct vm_map_entry *new_entry;
4438 
4439 	/*
4440 	 * copy-on-write the mapping (using mmap's
4441 	 * MAP_PRIVATE semantics)
4442 	 *
4443 	 * allocate new_entry, adjust reference counts.
4444 	 * (note that new references are read-only).
4445 	 */
4446 
4447 	new_entry = uvm_mapent_clone(new_map, old_entry, 0);
4448 
4449 	new_entry->etype |=
4450 	    (UVM_ET_COPYONWRITE|UVM_ET_NEEDSCOPY);
4451 
4452 	/*
4453 	 * the new entry will need an amap.  it will either
4454 	 * need to be copied from the old entry or created
4455 	 * from scratch (if the old entry does not have an
4456 	 * amap).  can we defer this process until later
4457 	 * (by setting "needs_copy") or do we need to copy
4458 	 * the amap now?
4459 	 *
4460 	 * we must copy the amap now if any of the following
4461 	 * conditions hold:
4462 	 * 1. the old entry has an amap and that amap is
4463 	 *    being shared.  this means that the old (parent)
4464 	 *    process is sharing the amap with another
4465 	 *    process.  if we do not clear needs_copy here
4466 	 *    we will end up in a situation where both the
4467 	 *    parent and child process are referring to the
4468 	 *    same amap with "needs_copy" set.  if the
4469 	 *    parent write-faults, the fault routine will
4470 	 *    clear "needs_copy" in the parent by allocating
4471 	 *    a new amap.   this is wrong because the
4472 	 *    parent is supposed to be sharing the old amap
4473 	 *    and the new amap will break that.
4474 	 *
4475 	 * 2. if the old entry has an amap and a non-zero
4476 	 *    wire count then we are going to have to call
4477 	 *    amap_cow_now to avoid page faults in the
4478 	 *    parent process.   since amap_cow_now requires
4479 	 *    "needs_copy" to be clear we might as well
4480 	 *    clear it here as well.
4481 	 *
4482 	 */
4483 
4484 	if (old_entry->aref.ar_amap != NULL) {
4485 		if ((amap_flags(old_entry->aref.ar_amap) & AMAP_SHARED) != 0 ||
4486 		    VM_MAPENT_ISWIRED(old_entry)) {
4487 
4488 			amap_copy(new_map, new_entry,
4489 			    AMAP_COPY_NOCHUNK, 0, 0);
4490 			/* XXXCDC: M_WAITOK ... ok? */
4491 		}
4492 	}
4493 
4494 	/*
4495 	 * if the parent's entry is wired down, then the
4496 	 * parent process does not want page faults on
4497 	 * access to that memory.  this means that we
4498 	 * cannot do copy-on-write because we can't write
4499 	 * protect the old entry.   in this case we
4500 	 * resolve all copy-on-write faults now, using
4501 	 * amap_cow_now.   note that we have already
4502 	 * allocated any needed amap (above).
4503 	 */
4504 
4505 	if (VM_MAPENT_ISWIRED(old_entry)) {
4506 
4507 		/*
4508 		 * resolve all copy-on-write faults now
4509 		 * (note that there is nothing to do if
4510 		 * the old mapping does not have an amap).
4511 		 */
4512 		if (old_entry->aref.ar_amap)
4513 			amap_cow_now(new_map, new_entry);
4514 
4515 	} else {
4516 		/*
4517 		 * setup mappings to trigger copy-on-write faults
4518 		 * we must write-protect the parent if it has
4519 		 * an amap and it is not already "needs_copy"...
4520 		 * if it is already "needs_copy" then the parent
4521 		 * has already been write-protected by a previous
4522 		 * fork operation.
4523 		 */
4524 		if (old_entry->aref.ar_amap &&
4525 		    !UVM_ET_ISNEEDSCOPY(old_entry)) {
4526 			if (old_entry->max_protection & VM_PROT_WRITE) {
4527 #ifdef __HAVE_UNLOCKED_PMAP /* XXX temporary */
4528 				uvm_map_lock_entry(old_entry, RW_WRITER);
4529 #else
4530 				uvm_map_lock_entry(old_entry, RW_READER);
4531 #endif
4532 				pmap_protect(old_map->pmap,
4533 				    old_entry->start, old_entry->end,
4534 				    old_entry->protection & ~VM_PROT_WRITE);
4535 				uvm_map_unlock_entry(old_entry);
4536 			}
4537 			old_entry->etype |= UVM_ET_NEEDSCOPY;
4538 		}
4539 	}
4540 }
4541 
4542 /*
4543  * zero the mapping: the new entry will be zero initialized
4544  */
4545 static void
4546 uvm_mapent_forkzero(struct vm_map *new_map, struct vm_map *old_map,
4547     struct vm_map_entry *old_entry)
4548 {
4549 	struct vm_map_entry *new_entry;
4550 
4551 	new_entry = uvm_mapent_clone(new_map, old_entry, 0);
4552 
4553 	new_entry->etype |=
4554 	    (UVM_ET_COPYONWRITE|UVM_ET_NEEDSCOPY);
4555 
4556 	if (new_entry->aref.ar_amap) {
4557 		uvm_map_unreference_amap(new_entry, 0);
4558 		new_entry->aref.ar_pageoff = 0;
4559 		new_entry->aref.ar_amap = NULL;
4560 	}
4561 
4562 	if (UVM_ET_ISOBJ(new_entry)) {
4563 		if (new_entry->object.uvm_obj->pgops->pgo_detach)
4564 			new_entry->object.uvm_obj->pgops->pgo_detach(
4565 			    new_entry->object.uvm_obj);
4566 		new_entry->object.uvm_obj = NULL;
4567 		new_entry->offset = 0;
4568 		new_entry->etype &= ~UVM_ET_OBJ;
4569 	}
4570 }
4571 
4572 /*
4573  *   F O R K   -   m a i n   e n t r y   p o i n t
4574  */
4575 /*
4576  * uvmspace_fork: fork a process' main map
4577  *
4578  * => create a new vmspace for child process from parent.
4579  * => parent's map must not be locked.
4580  */
4581 
4582 struct vmspace *
4583 uvmspace_fork(struct vmspace *vm1)
4584 {
4585 	struct vmspace *vm2;
4586 	struct vm_map *old_map = &vm1->vm_map;
4587 	struct vm_map *new_map;
4588 	struct vm_map_entry *old_entry;
4589 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4590 
4591 	vm_map_lock(old_map);
4592 
4593 	vm2 = uvmspace_alloc(vm_map_min(old_map), vm_map_max(old_map),
4594 	    vm1->vm_map.flags & VM_MAP_TOPDOWN);
4595 	memcpy(&vm2->vm_startcopy, &vm1->vm_startcopy,
4596 	    (char *) (vm1 + 1) - (char *) &vm1->vm_startcopy);
4597 	new_map = &vm2->vm_map;		  /* XXX */
4598 
4599 	old_entry = old_map->header.next;
4600 	new_map->size = old_map->size;
4601 
4602 	/*
4603 	 * go entry-by-entry
4604 	 */
4605 
4606 	while (old_entry != &old_map->header) {
4607 
4608 		/*
4609 		 * first, some sanity checks on the old entry
4610 		 */
4611 
4612 		KASSERT(!UVM_ET_ISSUBMAP(old_entry));
4613 		KASSERT(UVM_ET_ISCOPYONWRITE(old_entry) ||
4614 			!UVM_ET_ISNEEDSCOPY(old_entry));
4615 
4616 		switch (old_entry->inheritance) {
4617 		case MAP_INHERIT_NONE:
4618 			/*
4619 			 * drop the mapping, modify size
4620 			 */
4621 			new_map->size -= old_entry->end - old_entry->start;
4622 			break;
4623 
4624 		case MAP_INHERIT_SHARE:
4625 			uvm_mapent_forkshared(new_map, old_map, old_entry);
4626 			break;
4627 
4628 		case MAP_INHERIT_COPY:
4629 			uvm_mapent_forkcopy(new_map, old_map, old_entry);
4630 			break;
4631 
4632 		case MAP_INHERIT_ZERO:
4633 			uvm_mapent_forkzero(new_map, old_map, old_entry);
4634 			break;
4635 		default:
4636 			KASSERT(0);
4637 			break;
4638 		}
4639 		old_entry = old_entry->next;
4640 	}
4641 
4642 	pmap_update(old_map->pmap);
4643 	vm_map_unlock(old_map);
4644 
4645 	if (uvm_shmfork && vm1->vm_shm)
4646 		(*uvm_shmfork)(vm1, vm2);
4647 
4648 #ifdef PMAP_FORK
4649 	pmap_fork(vm1->vm_map.pmap, vm2->vm_map.pmap);
4650 #endif
4651 
4652 	UVMHIST_LOG(maphist,"<- done",0,0,0,0);
4653 	return (vm2);
4654 }
4655 
4656 
4657 /*
4658  * uvm_mapent_trymerge: try to merge an entry with its neighbors.
4659  *
4660  * => called with map locked.
4661  * => return non zero if successfully merged.
4662  */
4663 
4664 int
4665 uvm_mapent_trymerge(struct vm_map *map, struct vm_map_entry *entry, int flags)
4666 {
4667 	struct uvm_object *uobj;
4668 	struct vm_map_entry *next;
4669 	struct vm_map_entry *prev;
4670 	vsize_t size;
4671 	int merged = 0;
4672 	bool copying;
4673 	int newetype;
4674 
4675 	if (entry->aref.ar_amap != NULL) {
4676 		return 0;
4677 	}
4678 	if ((entry->flags & UVM_MAP_NOMERGE) != 0) {
4679 		return 0;
4680 	}
4681 
4682 	uobj = entry->object.uvm_obj;
4683 	size = entry->end - entry->start;
4684 	copying = (flags & UVM_MERGE_COPYING) != 0;
4685 	newetype = copying ? (entry->etype & ~UVM_ET_NEEDSCOPY) : entry->etype;
4686 
4687 	next = entry->next;
4688 	if (next != &map->header &&
4689 	    next->start == entry->end &&
4690 	    ((copying && next->aref.ar_amap != NULL &&
4691 	    amap_refs(next->aref.ar_amap) == 1) ||
4692 	    (!copying && next->aref.ar_amap == NULL)) &&
4693 	    UVM_ET_ISCOMPATIBLE(next, newetype,
4694 	    uobj, entry->flags, entry->protection,
4695 	    entry->max_protection, entry->inheritance, entry->advice,
4696 	    entry->wired_count) &&
4697 	    (uobj == NULL || entry->offset + size == next->offset)) {
4698 		int error;
4699 
4700 		if (copying) {
4701 			error = amap_extend(next, size,
4702 			    AMAP_EXTEND_NOWAIT|AMAP_EXTEND_BACKWARDS);
4703 		} else {
4704 			error = 0;
4705 		}
4706 		if (error == 0) {
4707 			if (uobj) {
4708 				if (uobj->pgops->pgo_detach) {
4709 					uobj->pgops->pgo_detach(uobj);
4710 				}
4711 			}
4712 
4713 			entry->end = next->end;
4714 			clear_hints(map, next);
4715 			uvm_map_entry_unlink(map, next);
4716 			if (copying) {
4717 				entry->aref = next->aref;
4718 				entry->etype &= ~UVM_ET_NEEDSCOPY;
4719 			}
4720 			uvm_map_check(map, "trymerge forwardmerge");
4721 			uvm_mapent_free(next);
4722 			merged++;
4723 		}
4724 	}
4725 
4726 	prev = entry->prev;
4727 	if (prev != &map->header &&
4728 	    prev->end == entry->start &&
4729 	    ((copying && !merged && prev->aref.ar_amap != NULL &&
4730 	    amap_refs(prev->aref.ar_amap) == 1) ||
4731 	    (!copying && prev->aref.ar_amap == NULL)) &&
4732 	    UVM_ET_ISCOMPATIBLE(prev, newetype,
4733 	    uobj, entry->flags, entry->protection,
4734 	    entry->max_protection, entry->inheritance, entry->advice,
4735 	    entry->wired_count) &&
4736 	    (uobj == NULL ||
4737 	    prev->offset + prev->end - prev->start == entry->offset)) {
4738 		int error;
4739 
4740 		if (copying) {
4741 			error = amap_extend(prev, size,
4742 			    AMAP_EXTEND_NOWAIT|AMAP_EXTEND_FORWARDS);
4743 		} else {
4744 			error = 0;
4745 		}
4746 		if (error == 0) {
4747 			if (uobj) {
4748 				if (uobj->pgops->pgo_detach) {
4749 					uobj->pgops->pgo_detach(uobj);
4750 				}
4751 				entry->offset = prev->offset;
4752 			}
4753 
4754 			entry->start = prev->start;
4755 			clear_hints(map, prev);
4756 			uvm_map_entry_unlink(map, prev);
4757 			if (copying) {
4758 				entry->aref = prev->aref;
4759 				entry->etype &= ~UVM_ET_NEEDSCOPY;
4760 			}
4761 			uvm_map_check(map, "trymerge backmerge");
4762 			uvm_mapent_free(prev);
4763 			merged++;
4764 		}
4765 	}
4766 
4767 	return merged;
4768 }
4769 
4770 /*
4771  * uvm_map_setup: init map
4772  *
4773  * => map must not be in service yet.
4774  */
4775 
4776 void
4777 uvm_map_setup(struct vm_map *map, vaddr_t vmin, vaddr_t vmax, int flags)
4778 {
4779 
4780 	rb_tree_init(&map->rb_tree, &uvm_map_tree_ops);
4781 	map->header.next = map->header.prev = &map->header;
4782 	map->nentries = 0;
4783 	map->size = 0;
4784 	map->ref_count = 1;
4785 	vm_map_setmin(map, vmin);
4786 	vm_map_setmax(map, vmax);
4787 	map->flags = flags;
4788 	map->first_free = &map->header;
4789 	map->hint = &map->header;
4790 	map->timestamp = 0;
4791 	map->busy = NULL;
4792 
4793 	rw_init(&map->lock);
4794 	cv_init(&map->cv, "vm_map");
4795 	mutex_init(&map->misc_lock, MUTEX_DRIVER, IPL_NONE);
4796 }
4797 
4798 /*
4799  *   U N M A P   -   m a i n   e n t r y   p o i n t
4800  */
4801 
4802 /*
4803  * uvm_unmap1: remove mappings from a vm_map (from "start" up to "stop")
4804  *
4805  * => caller must check alignment and size
4806  * => map must be unlocked (we will lock it)
4807  * => flags is UVM_FLAG_QUANTUM or 0.
4808  */
4809 
4810 void
4811 uvm_unmap1(struct vm_map *map, vaddr_t start, vaddr_t end, int flags)
4812 {
4813 	struct vm_map_entry *dead_entries;
4814 	UVMHIST_FUNC(__func__);
4815 	UVMHIST_CALLARGS(maphist, "  (map=%#jx, start=%#jx, end=%#jx)",
4816 	    (uintptr_t)map, start, end, 0);
4817 
4818 	KASSERTMSG(start < end,
4819 	    "%s: map %p: start %#jx < end %#jx", __func__, map,
4820 	    (uintmax_t)start, (uintmax_t)end);
4821 	if (map == kernel_map) {
4822 		LOCKDEBUG_MEM_CHECK((void *)start, end - start);
4823 	}
4824 
4825 	/*
4826 	 * work now done by helper functions.   wipe the pmap's and then
4827 	 * detach from the dead entries...
4828 	 */
4829 	vm_map_lock(map);
4830 	uvm_unmap_remove(map, start, end, &dead_entries, flags);
4831 	vm_map_unlock(map);
4832 
4833 	if (dead_entries != NULL)
4834 		uvm_unmap_detach(dead_entries, 0);
4835 
4836 	UVMHIST_LOG(maphist, "<- done", 0,0,0,0);
4837 }
4838 
4839 
4840 /*
4841  * uvm_map_reference: add reference to a map
4842  *
4843  * => map need not be locked
4844  */
4845 
4846 void
4847 uvm_map_reference(struct vm_map *map)
4848 {
4849 
4850 	atomic_inc_uint(&map->ref_count);
4851 }
4852 
4853 void
4854 uvm_map_lock_entry(struct vm_map_entry *entry, krw_t op)
4855 {
4856 
4857 	if (entry->aref.ar_amap != NULL) {
4858 		amap_lock(entry->aref.ar_amap, op);
4859 	}
4860 	if (UVM_ET_ISOBJ(entry)) {
4861 		rw_enter(entry->object.uvm_obj->vmobjlock, op);
4862 	}
4863 }
4864 
4865 void
4866 uvm_map_unlock_entry(struct vm_map_entry *entry)
4867 {
4868 
4869 	if (UVM_ET_ISOBJ(entry)) {
4870 		rw_exit(entry->object.uvm_obj->vmobjlock);
4871 	}
4872 	if (entry->aref.ar_amap != NULL) {
4873 		amap_unlock(entry->aref.ar_amap);
4874 	}
4875 }
4876 
4877 #define	UVM_VOADDR_TYPE_MASK	0x3UL
4878 #define	UVM_VOADDR_TYPE_UOBJ	0x1UL
4879 #define	UVM_VOADDR_TYPE_ANON	0x2UL
4880 #define	UVM_VOADDR_OBJECT_MASK	~UVM_VOADDR_TYPE_MASK
4881 
4882 #define	UVM_VOADDR_GET_TYPE(voa)					\
4883 	((voa)->object & UVM_VOADDR_TYPE_MASK)
4884 #define	UVM_VOADDR_GET_OBJECT(voa)					\
4885 	((voa)->object & UVM_VOADDR_OBJECT_MASK)
4886 #define	UVM_VOADDR_SET_OBJECT(voa, obj, type)				\
4887 do {									\
4888 	KASSERT(((uintptr_t)(obj) & UVM_VOADDR_TYPE_MASK) == 0);	\
4889 	(voa)->object = ((uintptr_t)(obj)) | (type);			\
4890 } while (/*CONSTCOND*/0)
4891 
4892 #define	UVM_VOADDR_GET_UOBJ(voa)					\
4893 	((struct uvm_object *)UVM_VOADDR_GET_OBJECT(voa))
4894 #define	UVM_VOADDR_SET_UOBJ(voa, uobj)					\
4895 	UVM_VOADDR_SET_OBJECT(voa, uobj, UVM_VOADDR_TYPE_UOBJ)
4896 
4897 #define	UVM_VOADDR_GET_ANON(voa)					\
4898 	((struct vm_anon *)UVM_VOADDR_GET_OBJECT(voa))
4899 #define	UVM_VOADDR_SET_ANON(voa, anon)					\
4900 	UVM_VOADDR_SET_OBJECT(voa, anon, UVM_VOADDR_TYPE_ANON)
4901 
4902 /*
4903  * uvm_voaddr_acquire: returns the virtual object address corresponding
4904  * to the specified virtual address.
4905  *
4906  * => resolves COW so the true page identity is tracked.
4907  *
4908  * => acquires a reference on the page's owner (uvm_object or vm_anon)
4909  */
4910 bool
4911 uvm_voaddr_acquire(struct vm_map * const map, vaddr_t const va,
4912     struct uvm_voaddr * const voaddr)
4913 {
4914 	struct vm_map_entry *entry;
4915 	struct vm_anon *anon = NULL;
4916 	bool result = false;
4917 	bool exclusive = false;
4918 	void (*unlock_fn)(struct vm_map *);
4919 
4920 	UVMHIST_FUNC(__func__); UVMHIST_CALLED(maphist);
4921 	UVMHIST_LOG(maphist,"(map=%#jx,va=%#jx)", (uintptr_t)map, va, 0, 0);
4922 
4923 	const vaddr_t start = trunc_page(va);
4924 	const vaddr_t end = round_page(va+1);
4925 
4926  lookup_again:
4927 	if (__predict_false(exclusive)) {
4928 		vm_map_lock(map);
4929 		unlock_fn = vm_map_unlock;
4930 	} else {
4931 		vm_map_lock_read(map);
4932 		unlock_fn = vm_map_unlock_read;
4933 	}
4934 
4935 	if (__predict_false(!uvm_map_lookup_entry(map, start, &entry))) {
4936 		unlock_fn(map);
4937 		UVMHIST_LOG(maphist,"<- done (no entry)",0,0,0,0);
4938 		return false;
4939 	}
4940 
4941 	if (__predict_false(entry->protection == VM_PROT_NONE)) {
4942 		unlock_fn(map);
4943 		UVMHIST_LOG(maphist,"<- done (PROT_NONE)",0,0,0,0);
4944 		return false;
4945 	}
4946 
4947 	/*
4948 	 * We have a fast path for the common case of "no COW resolution
4949 	 * needed" whereby we have taken a read lock on the map and if
4950 	 * we don't encounter any need to create a vm_anon then great!
4951 	 * But if we do, we loop around again, instead taking an exclusive
4952 	 * lock so that we can perform the fault.
4953 	 *
4954 	 * In the event that we have to resolve the fault, we do nearly the
4955 	 * same work as uvm_map_pageable() does:
4956 	 *
4957 	 * 1: holding the write lock, we create any anonymous maps that need
4958 	 *    to be created.  however, we do NOT need to clip the map entries
4959 	 *    in this case.
4960 	 *
4961 	 * 2: we downgrade to a read lock, and call uvm_fault_wire to fault
4962 	 *    in the page (assuming the entry is not already wired).  this
4963 	 *    is done because we need the vm_anon to be present.
4964 	 */
4965 	if (__predict_true(!VM_MAPENT_ISWIRED(entry))) {
4966 
4967 		bool need_fault = false;
4968 
4969 		/*
4970 		 * perform the action of vm_map_lookup that need the
4971 		 * write lock on the map: create an anonymous map for
4972 		 * a copy-on-write region, or an anonymous map for
4973 		 * a zero-fill region.
4974 		 */
4975 		if (__predict_false(UVM_ET_ISSUBMAP(entry))) {
4976 			unlock_fn(map);
4977 			UVMHIST_LOG(maphist,"<- done (submap)",0,0,0,0);
4978 			return false;
4979 		}
4980 		if (__predict_false(UVM_ET_ISNEEDSCOPY(entry) &&
4981 		    ((entry->max_protection & VM_PROT_WRITE) ||
4982 		     (entry->object.uvm_obj == NULL)))) {
4983 			if (!exclusive) {
4984 				/* need to take the slow path */
4985 				KASSERT(unlock_fn == vm_map_unlock_read);
4986 				vm_map_unlock_read(map);
4987 				exclusive = true;
4988 				goto lookup_again;
4989 			}
4990 			need_fault = true;
4991 			amap_copy(map, entry, 0, start, end);
4992 			/* XXXCDC: wait OK? */
4993 		}
4994 
4995 		/*
4996 		 * do a quick check to see if the fault has already
4997 		 * been resolved to the upper layer.
4998 		 */
4999 		if (__predict_true(entry->aref.ar_amap != NULL &&
5000 				   need_fault == false)) {
5001 			amap_lock(entry->aref.ar_amap, RW_WRITER);
5002 			anon = amap_lookup(&entry->aref, start - entry->start);
5003 			if (__predict_true(anon != NULL)) {
5004 				/* amap unlocked below */
5005 				goto found_anon;
5006 			}
5007 			amap_unlock(entry->aref.ar_amap);
5008 			need_fault = true;
5009 		}
5010 
5011 		/*
5012 		 * we predict this test as false because if we reach
5013 		 * this point, then we are likely dealing with a
5014 		 * shared memory region backed by a uvm_object, in
5015 		 * which case a fault to create the vm_anon is not
5016 		 * necessary.
5017 		 */
5018 		if (__predict_false(need_fault)) {
5019 			if (exclusive) {
5020 				vm_map_busy(map);
5021 				vm_map_unlock(map);
5022 				unlock_fn = vm_map_unbusy;
5023 			}
5024 
5025 			if (uvm_fault_wire(map, start, end,
5026 					   entry->max_protection, 1)) {
5027 				/* wiring failed */
5028 				unlock_fn(map);
5029 				UVMHIST_LOG(maphist,"<- done (wire failed)",
5030 					    0,0,0,0);
5031 				return false;
5032 			}
5033 
5034 			/*
5035 			 * now that we have resolved the fault, we can unwire
5036 			 * the page.
5037 			 */
5038 			if (exclusive) {
5039 				vm_map_lock(map);
5040 				vm_map_unbusy(map);
5041 				unlock_fn = vm_map_unlock;
5042 			}
5043 
5044 			uvm_fault_unwire_locked(map, start, end);
5045 		}
5046 	}
5047 
5048 	/* check the upper layer */
5049 	if (entry->aref.ar_amap) {
5050 		amap_lock(entry->aref.ar_amap, RW_WRITER);
5051 		anon = amap_lookup(&entry->aref, start - entry->start);
5052 		if (anon) {
5053  found_anon:		KASSERT(anon->an_lock == entry->aref.ar_amap->am_lock);
5054 			anon->an_ref++;
5055 			rw_obj_hold(anon->an_lock);
5056 			KASSERT(anon->an_ref != 0);
5057 			UVM_VOADDR_SET_ANON(voaddr, anon);
5058 			voaddr->offset = va & PAGE_MASK;
5059 			result = true;
5060 		}
5061 		amap_unlock(entry->aref.ar_amap);
5062 	}
5063 
5064 	/* check the lower layer */
5065 	if (!result && UVM_ET_ISOBJ(entry)) {
5066 		struct uvm_object *uobj = entry->object.uvm_obj;
5067 
5068 		KASSERT(uobj != NULL);
5069 		(*uobj->pgops->pgo_reference)(uobj);
5070 		UVM_VOADDR_SET_UOBJ(voaddr, uobj);
5071 		voaddr->offset = entry->offset + (va - entry->start);
5072 		result = true;
5073 	}
5074 
5075 	unlock_fn(map);
5076 
5077 	if (result) {
5078 		UVMHIST_LOG(maphist,
5079 		    "<- done OK (type=%jd,owner=%#jx,offset=%#jx)",
5080 		    UVM_VOADDR_GET_TYPE(voaddr),
5081 		    UVM_VOADDR_GET_OBJECT(voaddr),
5082 		    voaddr->offset, 0);
5083 	} else {
5084 		UVMHIST_LOG(maphist,"<- done (failed)",0,0,0,0);
5085 	}
5086 
5087 	return result;
5088 }
5089 
5090 /*
5091  * uvm_voaddr_release: release the references held by the
5092  * vitual object address.
5093  */
5094 void
5095 uvm_voaddr_release(struct uvm_voaddr * const voaddr)
5096 {
5097 
5098 	switch (UVM_VOADDR_GET_TYPE(voaddr)) {
5099 	case UVM_VOADDR_TYPE_UOBJ: {
5100 		struct uvm_object * const uobj = UVM_VOADDR_GET_UOBJ(voaddr);
5101 
5102 		KASSERT(uobj != NULL);
5103 		KASSERT(uobj->pgops->pgo_detach != NULL);
5104 		(*uobj->pgops->pgo_detach)(uobj);
5105 		break;
5106 	    }
5107 	case UVM_VOADDR_TYPE_ANON: {
5108 		struct vm_anon * const anon = UVM_VOADDR_GET_ANON(voaddr);
5109 		krwlock_t *lock;
5110 
5111 		KASSERT(anon != NULL);
5112 		rw_enter((lock = anon->an_lock), RW_WRITER);
5113 	    	KASSERT(anon->an_ref > 0);
5114 		if (--anon->an_ref == 0) {
5115 			uvm_anfree(anon);
5116 		}
5117 		rw_exit(lock);
5118 		rw_obj_free(lock);
5119 	    	break;
5120 	    }
5121 	default:
5122 		panic("uvm_voaddr_release: bad type");
5123 	}
5124 	memset(voaddr, 0, sizeof(*voaddr));
5125 }
5126 
5127 /*
5128  * uvm_voaddr_compare: compare two uvm_voaddr objects.
5129  *
5130  * => memcmp() semantics
5131  */
5132 int
5133 uvm_voaddr_compare(const struct uvm_voaddr * const voaddr1,
5134     const struct uvm_voaddr * const voaddr2)
5135 {
5136 	const uintptr_t type1 = UVM_VOADDR_GET_TYPE(voaddr1);
5137 	const uintptr_t type2 = UVM_VOADDR_GET_TYPE(voaddr2);
5138 
5139 	KASSERT(type1 == UVM_VOADDR_TYPE_UOBJ ||
5140 		type1 == UVM_VOADDR_TYPE_ANON);
5141 
5142 	KASSERT(type2 == UVM_VOADDR_TYPE_UOBJ ||
5143 		type2 == UVM_VOADDR_TYPE_ANON);
5144 
5145 	if (type1 < type2)
5146 		return -1;
5147 	if (type1 > type2)
5148 		return 1;
5149 
5150 	const uintptr_t addr1 = UVM_VOADDR_GET_OBJECT(voaddr1);
5151 	const uintptr_t addr2 = UVM_VOADDR_GET_OBJECT(voaddr2);
5152 
5153 	if (addr1 < addr2)
5154 		return -1;
5155 	if (addr1 > addr2)
5156 		return 1;
5157 
5158 	if (voaddr1->offset < voaddr2->offset)
5159 		return -1;
5160 	if (voaddr1->offset > voaddr2->offset)
5161 		return 1;
5162 
5163 	return 0;
5164 }
5165 
5166 #if defined(DDB) || defined(DEBUGPRINT)
5167 
5168 /*
5169  * uvm_map_printit: actually prints the map
5170  */
5171 
5172 void
5173 uvm_map_printit(struct vm_map *map, bool full,
5174     void (*pr)(const char *, ...))
5175 {
5176 	struct vm_map_entry *entry;
5177 
5178 	(*pr)("MAP %p: [%#lx->%#lx]\n", map, vm_map_min(map),
5179 	    vm_map_max(map));
5180 	(*pr)("\t#ent=%d, sz=%d, ref=%d, version=%d, flags=%#x\n",
5181 	    map->nentries, map->size, map->ref_count, map->timestamp,
5182 	    map->flags);
5183 	(*pr)("\tpmap=%p(resident=%ld, wired=%ld)\n", map->pmap,
5184 	    pmap_resident_count(map->pmap), pmap_wired_count(map->pmap));
5185 	if (!full)
5186 		return;
5187 	for (entry = map->header.next; entry != &map->header;
5188 	    entry = entry->next) {
5189 		(*pr)(" - %p: %#lx->%#lx: obj=%p/%#llx, amap=%p/%d\n",
5190 		    entry, entry->start, entry->end, entry->object.uvm_obj,
5191 		    (long long)entry->offset, entry->aref.ar_amap,
5192 		    entry->aref.ar_pageoff);
5193 		(*pr)(
5194 		    "\tsubmap=%c, cow=%c, nc=%c, prot(max)=%d/%d, inh=%d, "
5195 		    "wc=%d, adv=%d%s\n",
5196 		    (entry->etype & UVM_ET_SUBMAP) ? 'T' : 'F',
5197 		    (entry->etype & UVM_ET_COPYONWRITE) ? 'T' : 'F',
5198 		    (entry->etype & UVM_ET_NEEDSCOPY) ? 'T' : 'F',
5199 		    entry->protection, entry->max_protection,
5200 		    entry->inheritance, entry->wired_count, entry->advice,
5201 		    entry == map->first_free ? " (first_free)" : "");
5202 	}
5203 }
5204 
5205 void
5206 uvm_whatis(uintptr_t addr, void (*pr)(const char *, ...))
5207 {
5208 	struct vm_map *map;
5209 
5210 	for (map = kernel_map;;) {
5211 		struct vm_map_entry *entry;
5212 
5213 		if (!uvm_map_lookup_entry_bytree(map, (vaddr_t)addr, &entry)) {
5214 			break;
5215 		}
5216 		(*pr)("%p is %p+%zu from VMMAP %p\n",
5217 		    (void *)addr, (void *)entry->start,
5218 		    (size_t)(addr - (uintptr_t)entry->start), map);
5219 		if (!UVM_ET_ISSUBMAP(entry)) {
5220 			break;
5221 		}
5222 		map = entry->object.sub_map;
5223 	}
5224 }
5225 
5226 #endif /* DDB || DEBUGPRINT */
5227 
5228 #ifndef __USER_VA0_IS_SAFE
5229 static int
5230 sysctl_user_va0_disable(SYSCTLFN_ARGS)
5231 {
5232 	struct sysctlnode node;
5233 	int t, error;
5234 
5235 	node = *rnode;
5236 	node.sysctl_data = &t;
5237 	t = user_va0_disable;
5238 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
5239 	if (error || newp == NULL)
5240 		return (error);
5241 
5242 	if (!t && user_va0_disable &&
5243 	    kauth_authorize_system(l->l_cred, KAUTH_SYSTEM_MAP_VA_ZERO, 0,
5244 	    NULL, NULL, NULL))
5245 		return EPERM;
5246 
5247 	user_va0_disable = !!t;
5248 	return 0;
5249 }
5250 #endif
5251 
5252 static int
5253 fill_vmentry(struct lwp *l, struct proc *p, struct kinfo_vmentry *kve,
5254     struct vm_map *m, struct vm_map_entry *e)
5255 {
5256 #ifndef _RUMPKERNEL
5257 	int error;
5258 
5259 	memset(kve, 0, sizeof(*kve));
5260 	KASSERT(e != NULL);
5261 	if (UVM_ET_ISOBJ(e)) {
5262 		struct uvm_object *uobj = e->object.uvm_obj;
5263 		KASSERT(uobj != NULL);
5264 		kve->kve_ref_count = uobj->uo_refs;
5265 		kve->kve_count = uobj->uo_npages;
5266 		if (UVM_OBJ_IS_VNODE(uobj)) {
5267 			struct vattr va;
5268 			struct vnode *vp = (struct vnode *)uobj;
5269 			vn_lock(vp, LK_SHARED | LK_RETRY);
5270 			error = VOP_GETATTR(vp, &va, l->l_cred);
5271 			VOP_UNLOCK(vp);
5272 			kve->kve_type = KVME_TYPE_VNODE;
5273 			if (error == 0) {
5274 				kve->kve_vn_size = vp->v_size;
5275 				kve->kve_vn_type = (int)vp->v_type;
5276 				kve->kve_vn_mode = va.va_mode;
5277 				kve->kve_vn_rdev = va.va_rdev;
5278 				kve->kve_vn_fileid = va.va_fileid;
5279 				kve->kve_vn_fsid = va.va_fsid;
5280 				error = vnode_to_path(kve->kve_path,
5281 				    sizeof(kve->kve_path) / 2, vp, l, p);
5282 			}
5283 		} else if (UVM_OBJ_IS_KERN_OBJECT(uobj)) {
5284 			kve->kve_type = KVME_TYPE_KERN;
5285 		} else if (UVM_OBJ_IS_DEVICE(uobj)) {
5286 			kve->kve_type = KVME_TYPE_DEVICE;
5287 		} else if (UVM_OBJ_IS_AOBJ(uobj)) {
5288 			kve->kve_type = KVME_TYPE_ANON;
5289 		} else {
5290 			kve->kve_type = KVME_TYPE_OBJECT;
5291 		}
5292 	} else if (UVM_ET_ISSUBMAP(e)) {
5293 		struct vm_map *map = e->object.sub_map;
5294 		KASSERT(map != NULL);
5295 		kve->kve_ref_count = map->ref_count;
5296 		kve->kve_count = map->nentries;
5297 		kve->kve_type = KVME_TYPE_SUBMAP;
5298 	} else
5299 		kve->kve_type = KVME_TYPE_UNKNOWN;
5300 
5301 	kve->kve_start = e->start;
5302 	kve->kve_end = e->end;
5303 	kve->kve_offset = e->offset;
5304 	kve->kve_wired_count = e->wired_count;
5305 	kve->kve_inheritance = e->inheritance;
5306 	kve->kve_attributes = 0; /* unused */
5307 	kve->kve_advice = e->advice;
5308 #define PROT(p) (((p) & VM_PROT_READ) ? KVME_PROT_READ : 0) | \
5309 	(((p) & VM_PROT_WRITE) ? KVME_PROT_WRITE : 0) | \
5310 	(((p) & VM_PROT_EXECUTE) ? KVME_PROT_EXEC : 0)
5311 	kve->kve_protection = PROT(e->protection);
5312 	kve->kve_max_protection = PROT(e->max_protection);
5313 	kve->kve_flags |= (e->etype & UVM_ET_COPYONWRITE)
5314 	    ? KVME_FLAG_COW : 0;
5315 	kve->kve_flags |= (e->etype & UVM_ET_NEEDSCOPY)
5316 	    ? KVME_FLAG_NEEDS_COPY : 0;
5317 	kve->kve_flags |= (m->flags & VM_MAP_TOPDOWN)
5318 	    ? KVME_FLAG_GROWS_DOWN : KVME_FLAG_GROWS_UP;
5319 	kve->kve_flags |= (m->flags & VM_MAP_PAGEABLE)
5320 	    ? KVME_FLAG_PAGEABLE : 0;
5321 #endif
5322 	return 0;
5323 }
5324 
5325 static int
5326 fill_vmentries(struct lwp *l, pid_t pid, u_int elem_size, void *oldp,
5327     size_t *oldlenp)
5328 {
5329 	int error;
5330 	struct proc *p;
5331 	struct kinfo_vmentry *vme;
5332 	struct vmspace *vm;
5333 	struct vm_map *map;
5334 	struct vm_map_entry *entry;
5335 	char *dp;
5336 	size_t count, vmesize;
5337 
5338 	if (elem_size == 0 || elem_size > 2 * sizeof(*vme))
5339 		return EINVAL;
5340 
5341 	if (oldp) {
5342 		if (*oldlenp > 10UL * 1024UL * 1024UL)
5343 			return E2BIG;
5344 		count = *oldlenp / elem_size;
5345 		if (count == 0)
5346 			return ENOMEM;
5347 		vmesize = count * sizeof(*vme);
5348 	} else
5349 		vmesize = 0;
5350 
5351 	if ((error = proc_find_locked(l, &p, pid)) != 0)
5352 		return error;
5353 
5354 	vme = NULL;
5355 	count = 0;
5356 
5357 	if ((error = proc_vmspace_getref(p, &vm)) != 0)
5358 		goto out;
5359 
5360 	map = &vm->vm_map;
5361 	vm_map_lock_read(map);
5362 
5363 	dp = oldp;
5364 	if (oldp)
5365 		vme = kmem_alloc(vmesize, KM_SLEEP);
5366 	for (entry = map->header.next; entry != &map->header;
5367 	    entry = entry->next) {
5368 		if (oldp && (dp - (char *)oldp) < vmesize) {
5369 			error = fill_vmentry(l, p, &vme[count], map, entry);
5370 			if (error)
5371 				goto out;
5372 			dp += elem_size;
5373 		}
5374 		count++;
5375 	}
5376 	vm_map_unlock_read(map);
5377 	uvmspace_free(vm);
5378 
5379 out:
5380 	if (pid != -1)
5381 		mutex_exit(p->p_lock);
5382 	if (error == 0) {
5383 		const u_int esize = uimin(sizeof(*vme), elem_size);
5384 		dp = oldp;
5385 		for (size_t i = 0; i < count; i++) {
5386 			if (oldp && (dp - (char *)oldp) < vmesize) {
5387 				error = sysctl_copyout(l, &vme[i], dp, esize);
5388 				if (error)
5389 					break;
5390 				dp += elem_size;
5391 			} else
5392 				break;
5393 		}
5394 		count *= elem_size;
5395 		if (oldp != NULL && *oldlenp < count)
5396 			error = ENOSPC;
5397 		*oldlenp = count;
5398 	}
5399 	if (vme)
5400 		kmem_free(vme, vmesize);
5401 	return error;
5402 }
5403 
5404 static int
5405 sysctl_vmproc(SYSCTLFN_ARGS)
5406 {
5407 	int error;
5408 
5409 	if (namelen == 1 && name[0] == CTL_QUERY)
5410 		return (sysctl_query(SYSCTLFN_CALL(rnode)));
5411 
5412 	if (namelen == 0)
5413 		return EINVAL;
5414 
5415 	switch (name[0]) {
5416 	case VM_PROC_MAP:
5417 		if (namelen != 3)
5418 			return EINVAL;
5419 		sysctl_unlock();
5420 		error = fill_vmentries(l, name[1], name[2], oldp, oldlenp);
5421 		sysctl_relock();
5422 		return error;
5423 	default:
5424 		return EINVAL;
5425 	}
5426 }
5427 
5428 SYSCTL_SETUP(sysctl_uvmmap_setup, "sysctl uvmmap setup")
5429 {
5430 
5431 	sysctl_createv(clog, 0, NULL, NULL,
5432 		       CTLFLAG_PERMANENT,
5433 		       CTLTYPE_STRUCT, "proc",
5434 		       SYSCTL_DESCR("Process vm information"),
5435 		       sysctl_vmproc, 0, NULL, 0,
5436 		       CTL_VM, VM_PROC, CTL_EOL);
5437 #ifndef __USER_VA0_IS_SAFE
5438         sysctl_createv(clog, 0, NULL, NULL,
5439                        CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
5440                        CTLTYPE_INT, "user_va0_disable",
5441                        SYSCTL_DESCR("Disable VA 0"),
5442                        sysctl_user_va0_disable, 0, &user_va0_disable, 0,
5443                        CTL_VM, CTL_CREATE, CTL_EOL);
5444 #endif
5445 }
5446