xref: /netbsd-src/sys/uvm/uvm_mmap.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: uvm_mmap.c,v 1.118 2007/11/26 19:02:35 pooka Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Charles D. Cranor and Washington University.
5  * Copyright (c) 1991, 1993 The Regents of the University of California.
6  * Copyright (c) 1988 University of Utah.
7  *
8  * All rights reserved.
9  *
10  * This code is derived from software contributed to Berkeley by
11  * the Systems Programming Group of the University of Utah Computer
12  * Science Department.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. All advertising materials mentioning features or use of this software
23  *    must display the following acknowledgement:
24  *      This product includes software developed by the Charles D. Cranor,
25  *	Washington University, University of California, Berkeley and
26  *	its contributors.
27  * 4. Neither the name of the University nor the names of its contributors
28  *    may be used to endorse or promote products derived from this software
29  *    without specific prior written permission.
30  *
31  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
32  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
33  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
34  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
35  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
37  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
38  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
39  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
40  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
41  * SUCH DAMAGE.
42  *
43  * from: Utah $Hdr: vm_mmap.c 1.6 91/10/21$
44  *      @(#)vm_mmap.c   8.5 (Berkeley) 5/19/94
45  * from: Id: uvm_mmap.c,v 1.1.2.14 1998/01/05 21:04:26 chuck Exp
46  */
47 
48 /*
49  * uvm_mmap.c: system call interface into VM system, plus kernel vm_mmap
50  * function.
51  */
52 
53 #include <sys/cdefs.h>
54 __KERNEL_RCSID(0, "$NetBSD: uvm_mmap.c,v 1.118 2007/11/26 19:02:35 pooka Exp $");
55 
56 #include "opt_compat_netbsd.h"
57 #include "opt_pax.h"
58 #include "veriexec.h"
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/file.h>
63 #include <sys/filedesc.h>
64 #include <sys/resourcevar.h>
65 #include <sys/mman.h>
66 #include <sys/mount.h>
67 #include <sys/proc.h>
68 #include <sys/malloc.h>
69 #include <sys/vnode.h>
70 #include <sys/conf.h>
71 #include <sys/stat.h>
72 
73 #if NVERIEXEC > 0
74 #include <sys/verified_exec.h>
75 #endif /* NVERIEXEC > 0 */
76 
77 #ifdef PAX_MPROTECT
78 #include <sys/pax.h>
79 #endif /* PAX_MPROTECT */
80 
81 #include <miscfs/specfs/specdev.h>
82 
83 #include <sys/syscallargs.h>
84 
85 #include <uvm/uvm.h>
86 #include <uvm/uvm_device.h>
87 
88 #ifndef COMPAT_ZERODEV
89 #define COMPAT_ZERODEV(dev)	(0)
90 #endif
91 
92 static int
93 range_test(vaddr_t addr, vsize_t size, bool ismmap)
94 {
95 	vaddr_t vm_min_address = VM_MIN_ADDRESS;
96 	vaddr_t vm_max_address = VM_MAXUSER_ADDRESS;
97 	vaddr_t eaddr = addr + size;
98 
99 	if (addr < vm_min_address)
100 		return EINVAL;
101 	if (eaddr > vm_max_address)
102 		return ismmap ? EFBIG : EINVAL;
103 	if (addr > eaddr) /* no wrapping! */
104 		return ismmap ? EOVERFLOW : EINVAL;
105 	return 0;
106 }
107 
108 /*
109  * unimplemented VM system calls:
110  */
111 
112 /*
113  * sys_sbrk: sbrk system call.
114  */
115 
116 /* ARGSUSED */
117 int
118 sys_sbrk(struct lwp *l, void *v, register_t *retval)
119 {
120 #if 0
121 	struct sys_sbrk_args /* {
122 		syscallarg(intptr_t) incr;
123 	} */ *uap = v;
124 #endif
125 
126 	return (ENOSYS);
127 }
128 
129 /*
130  * sys_sstk: sstk system call.
131  */
132 
133 /* ARGSUSED */
134 int
135 sys_sstk(struct lwp *l, void *v, register_t *retval)
136 {
137 #if 0
138 	struct sys_sstk_args /* {
139 		syscallarg(int) incr;
140 	} */ *uap = v;
141 #endif
142 
143 	return (ENOSYS);
144 }
145 
146 /*
147  * sys_mincore: determine if pages are in core or not.
148  */
149 
150 /* ARGSUSED */
151 int
152 sys_mincore(struct lwp *l, void *v, register_t *retval)
153 {
154 	struct sys_mincore_args /* {
155 		syscallarg(void *) addr;
156 		syscallarg(size_t) len;
157 		syscallarg(char *) vec;
158 	} */ *uap = v;
159 	struct proc *p = l->l_proc;
160 	struct vm_page *pg;
161 	char *vec, pgi;
162 	struct uvm_object *uobj;
163 	struct vm_amap *amap;
164 	struct vm_anon *anon;
165 	struct vm_map_entry *entry;
166 	vaddr_t start, end, lim;
167 	struct vm_map *map;
168 	vsize_t len;
169 	int error = 0, npgs;
170 
171 	map = &p->p_vmspace->vm_map;
172 
173 	start = (vaddr_t)SCARG(uap, addr);
174 	len = SCARG(uap, len);
175 	vec = SCARG(uap, vec);
176 
177 	if (start & PAGE_MASK)
178 		return (EINVAL);
179 	len = round_page(len);
180 	end = start + len;
181 	if (end <= start)
182 		return (EINVAL);
183 
184 	/*
185 	 * Lock down vec, so our returned status isn't outdated by
186 	 * storing the status byte for a page.
187 	 */
188 
189 	npgs = len >> PAGE_SHIFT;
190 	error = uvm_vslock(p->p_vmspace, vec, npgs, VM_PROT_WRITE);
191 	if (error) {
192 		return error;
193 	}
194 	vm_map_lock_read(map);
195 
196 	if (uvm_map_lookup_entry(map, start, &entry) == false) {
197 		error = ENOMEM;
198 		goto out;
199 	}
200 
201 	for (/* nothing */;
202 	     entry != &map->header && entry->start < end;
203 	     entry = entry->next) {
204 		KASSERT(!UVM_ET_ISSUBMAP(entry));
205 		KASSERT(start >= entry->start);
206 
207 		/* Make sure there are no holes. */
208 		if (entry->end < end &&
209 		     (entry->next == &map->header ||
210 		      entry->next->start > entry->end)) {
211 			error = ENOMEM;
212 			goto out;
213 		}
214 
215 		lim = end < entry->end ? end : entry->end;
216 
217 		/*
218 		 * Special case for objects with no "real" pages.  Those
219 		 * are always considered resident (mapped devices).
220 		 */
221 
222 		if (UVM_ET_ISOBJ(entry)) {
223 			KASSERT(!UVM_OBJ_IS_KERN_OBJECT(entry->object.uvm_obj));
224 			if (UVM_OBJ_IS_DEVICE(entry->object.uvm_obj)) {
225 				for (/* nothing */; start < lim;
226 				     start += PAGE_SIZE, vec++)
227 					subyte(vec, 1);
228 				continue;
229 			}
230 		}
231 
232 		amap = entry->aref.ar_amap;	/* top layer */
233 		uobj = entry->object.uvm_obj;	/* bottom layer */
234 
235 		if (amap != NULL)
236 			amap_lock(amap);
237 		if (uobj != NULL)
238 			simple_lock(&uobj->vmobjlock);
239 
240 		for (/* nothing */; start < lim; start += PAGE_SIZE, vec++) {
241 			pgi = 0;
242 			if (amap != NULL) {
243 				/* Check the top layer first. */
244 				anon = amap_lookup(&entry->aref,
245 				    start - entry->start);
246 				/* Don't need to lock anon here. */
247 				if (anon != NULL && anon->an_page != NULL) {
248 
249 					/*
250 					 * Anon has the page for this entry
251 					 * offset.
252 					 */
253 
254 					pgi = 1;
255 				}
256 			}
257 			if (uobj != NULL && pgi == 0) {
258 				/* Check the bottom layer. */
259 				pg = uvm_pagelookup(uobj,
260 				    entry->offset + (start - entry->start));
261 				if (pg != NULL) {
262 
263 					/*
264 					 * Object has the page for this entry
265 					 * offset.
266 					 */
267 
268 					pgi = 1;
269 				}
270 			}
271 			(void) subyte(vec, pgi);
272 		}
273 		if (uobj != NULL)
274 			simple_unlock(&uobj->vmobjlock);
275 		if (amap != NULL)
276 			amap_unlock(amap);
277 	}
278 
279  out:
280 	vm_map_unlock_read(map);
281 	uvm_vsunlock(p->p_vmspace, SCARG(uap, vec), npgs);
282 	return (error);
283 }
284 
285 /*
286  * sys_mmap: mmap system call.
287  *
288  * => file offset and address may not be page aligned
289  *    - if MAP_FIXED, offset and address must have remainder mod PAGE_SIZE
290  *    - if address isn't page aligned the mapping starts at trunc_page(addr)
291  *      and the return value is adjusted up by the page offset.
292  */
293 
294 int
295 sys_mmap(l, v, retval)
296 	struct lwp *l;
297 	void *v;
298 	register_t *retval;
299 {
300 	struct sys_mmap_args /* {
301 		syscallarg(void *) addr;
302 		syscallarg(size_t) len;
303 		syscallarg(int) prot;
304 		syscallarg(int) flags;
305 		syscallarg(int) fd;
306 		syscallarg(long) pad;
307 		syscallarg(off_t) pos;
308 	} */ *uap = v;
309 	struct proc *p = l->l_proc;
310 	vaddr_t addr;
311 	struct vattr va;
312 	off_t pos;
313 	vsize_t size, pageoff;
314 	vm_prot_t prot, maxprot;
315 	int flags, fd;
316 	vaddr_t defaddr;
317 	struct filedesc *fdp = p->p_fd;
318 	struct file *fp = NULL;
319 	struct vnode *vp;
320 	void *handle;
321 	int error;
322 
323 	/*
324 	 * first, extract syscall args from the uap.
325 	 */
326 
327 	addr = (vaddr_t)SCARG(uap, addr);
328 	size = (vsize_t)SCARG(uap, len);
329 	prot = SCARG(uap, prot) & VM_PROT_ALL;
330 	flags = SCARG(uap, flags);
331 	fd = SCARG(uap, fd);
332 	pos = SCARG(uap, pos);
333 
334 	/*
335 	 * Fixup the old deprecated MAP_COPY into MAP_PRIVATE, and
336 	 * validate the flags.
337 	 */
338 	if (flags & MAP_COPY)
339 		flags = (flags & ~MAP_COPY) | MAP_PRIVATE;
340 	if ((flags & (MAP_SHARED|MAP_PRIVATE)) == (MAP_SHARED|MAP_PRIVATE))
341 		return (EINVAL);
342 
343 	/*
344 	 * align file position and save offset.  adjust size.
345 	 */
346 
347 	pageoff = (pos & PAGE_MASK);
348 	pos  -= pageoff;
349 	size += pageoff;			/* add offset */
350 	size = (vsize_t)round_page(size);	/* round up */
351 
352 	/*
353 	 * now check (MAP_FIXED) or get (!MAP_FIXED) the "addr"
354 	 */
355 	if (flags & MAP_FIXED) {
356 
357 		/* ensure address and file offset are aligned properly */
358 		addr -= pageoff;
359 		if (addr & PAGE_MASK)
360 			return (EINVAL);
361 
362 		error = range_test(addr, size, true);
363 		if (error)
364 			return error;
365 	} else if (addr == 0 || !(flags & MAP_TRYFIXED)) {
366 
367 		/*
368 		 * not fixed: make sure we skip over the largest
369 		 * possible heap for non-topdown mapping arrangements.
370 		 * we will refine our guess later (e.g. to account for
371 		 * VAC, etc)
372 		 */
373 
374 		defaddr = p->p_emul->e_vm_default_addr(p,
375 		    (vaddr_t)p->p_vmspace->vm_daddr, size);
376 
377 		if (addr == 0 ||
378 		    !(p->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN))
379 			addr = MAX(addr, defaddr);
380 		else
381 			addr = MIN(addr, defaddr);
382 	}
383 
384 	/*
385 	 * check for file mappings (i.e. not anonymous) and verify file.
386 	 */
387 
388 	if ((flags & MAP_ANON) == 0) {
389 
390 		if ((fp = fd_getfile(fdp, fd)) == NULL)
391 			return (EBADF);
392 		if (fp->f_type != DTYPE_VNODE) {
393 			mutex_exit(&fp->f_lock);
394 			return (ENODEV);		/* only mmap vnodes! */
395 		}
396 		vp = (struct vnode *)fp->f_data;	/* convert to vnode */
397 
398 		if (vp->v_type != VREG && vp->v_type != VCHR &&
399 		    vp->v_type != VBLK) {
400 			mutex_exit(&fp->f_lock);
401 			return (ENODEV);  /* only REG/CHR/BLK support mmap */
402 		}
403 		if (vp->v_type != VCHR && pos < 0) {
404 			mutex_exit(&fp->f_lock);
405 			return (EINVAL);
406 		}
407 		if (vp->v_type != VCHR && (pos + size) < pos) {
408 			mutex_exit(&fp->f_lock);
409 			return (EOVERFLOW);		/* no offset wrapping */
410 		}
411 
412 		/* special case: catch SunOS style /dev/zero */
413 		if (vp->v_type == VCHR
414 		    && (vp->v_rdev == zerodev || COMPAT_ZERODEV(vp->v_rdev))) {
415 			flags |= MAP_ANON;
416 			mutex_exit(&fp->f_lock);
417 			fp = NULL;
418 			goto is_anon;
419 		}
420 
421 		/*
422 		 * Old programs may not select a specific sharing type, so
423 		 * default to an appropriate one.
424 		 *
425 		 * XXX: how does MAP_ANON fit in the picture?
426 		 */
427 		if ((flags & (MAP_SHARED|MAP_PRIVATE)) == 0) {
428 #if defined(DEBUG)
429 			printf("WARNING: defaulted mmap() share type to "
430 			   "%s (pid %d command %s)\n", vp->v_type == VCHR ?
431 			   "MAP_SHARED" : "MAP_PRIVATE", p->p_pid,
432 			    p->p_comm);
433 #endif
434 			if (vp->v_type == VCHR)
435 				flags |= MAP_SHARED;	/* for a device */
436 			else
437 				flags |= MAP_PRIVATE;	/* for a file */
438 		}
439 
440 		/*
441 		 * MAP_PRIVATE device mappings don't make sense (and aren't
442 		 * supported anyway).  However, some programs rely on this,
443 		 * so just change it to MAP_SHARED.
444 		 */
445 		if (vp->v_type == VCHR && (flags & MAP_PRIVATE) != 0) {
446 			flags = (flags & ~MAP_PRIVATE) | MAP_SHARED;
447 		}
448 
449 		/*
450 		 * now check protection
451 		 */
452 
453 		maxprot = VM_PROT_EXECUTE;
454 
455 		/* check read access */
456 		if (fp->f_flag & FREAD)
457 			maxprot |= VM_PROT_READ;
458 		else if (prot & PROT_READ) {
459 			mutex_exit(&fp->f_lock);
460 			return (EACCES);
461 		}
462 		FILE_USE(fp);
463 
464 		/* check write access, shared case first */
465 		if (flags & MAP_SHARED) {
466 			/*
467 			 * if the file is writable, only add PROT_WRITE to
468 			 * maxprot if the file is not immutable, append-only.
469 			 * otherwise, if we have asked for PROT_WRITE, return
470 			 * EPERM.
471 			 */
472 			if (fp->f_flag & FWRITE) {
473 				if ((error =
474 				    VOP_GETATTR(vp, &va, l->l_cred))) {
475 				    	FILE_UNUSE(fp, l);
476 					return (error);
477 				}
478 				if ((va.va_flags &
479 				    (SF_SNAPSHOT|IMMUTABLE|APPEND)) == 0)
480 					maxprot |= VM_PROT_WRITE;
481 				else if (prot & PROT_WRITE) {
482 				    	FILE_UNUSE(fp, l);
483 					return (EPERM);
484 				}
485 			}
486 			else if (prot & PROT_WRITE) {
487 			    	FILE_UNUSE(fp, l);
488 				return (EACCES);
489 			}
490 		} else {
491 			/* MAP_PRIVATE mappings can always write to */
492 			maxprot |= VM_PROT_WRITE;
493 		}
494 		handle = vp;
495 
496 	} else {		/* MAP_ANON case */
497 		/*
498 		 * XXX What do we do about (MAP_SHARED|MAP_PRIVATE) == 0?
499 		 */
500 		if (fd != -1)
501 			return (EINVAL);
502 
503  is_anon:		/* label for SunOS style /dev/zero */
504 		handle = NULL;
505 		maxprot = VM_PROT_ALL;
506 		pos = 0;
507 	}
508 
509 	/*
510 	 * XXX (in)sanity check.  We don't do proper datasize checking
511 	 * XXX for anonymous (or private writable) mmap().  However,
512 	 * XXX know that if we're trying to allocate more than the amount
513 	 * XXX remaining under our current data size limit, _that_ should
514 	 * XXX be disallowed.
515 	 */
516 	if ((flags & MAP_ANON) != 0 ||
517 	    ((flags & MAP_PRIVATE) != 0 && (prot & PROT_WRITE) != 0)) {
518 		if (size >
519 		    (p->p_rlimit[RLIMIT_DATA].rlim_cur -
520 		     ctob(p->p_vmspace->vm_dsize))) {
521 		     	if (fp != NULL)
522 			    	FILE_UNUSE(fp, l);
523 			return (ENOMEM);
524 		}
525 	}
526 
527 #if NVERIEXEC > 0
528 	if (handle != NULL) {
529 		/*
530 		 * Check if the file can be executed indirectly.
531 		 *
532 		 * XXX: This gives false warnings about "Incorrect access type"
533 		 * XXX: if the mapping is not executable. Harmless, but will be
534 		 * XXX: fixed as part of other changes.
535 		 */
536 		if (veriexec_verify(l, handle, "(mmap)", VERIEXEC_INDIRECT,
537 		    NULL)) {
538 			/*
539 			 * Don't allow executable mappings if we can't
540 			 * indirectly execute the file.
541 			 */
542 			if (prot & VM_PROT_EXECUTE) {
543 			     	if (fp != NULL)
544 				    	FILE_UNUSE(fp, l);
545 				return (EPERM);
546 			}
547 
548 			/*
549 			 * Strip the executable bit from 'maxprot' to make sure
550 			 * it can't be made executable later.
551 			 */
552 			maxprot &= ~VM_PROT_EXECUTE;
553 		}
554 	}
555 #endif /* NVERIEXEC > 0 */
556 
557 #ifdef PAX_MPROTECT
558 	pax_mprotect(l, &prot, &maxprot);
559 #endif /* PAX_MPROTECT */
560 
561 	/*
562 	 * now let kernel internal function uvm_mmap do the work.
563 	 */
564 
565 	error = uvm_mmap(&p->p_vmspace->vm_map, &addr, size, prot, maxprot,
566 	    flags, handle, pos, p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur);
567 
568 	if (error == 0)
569 		/* remember to add offset */
570 		*retval = (register_t)(addr + pageoff);
571 
572      	if (fp != NULL)
573 	    	FILE_UNUSE(fp, l);
574 
575 	return (error);
576 }
577 
578 /*
579  * sys___msync13: the msync system call (a front-end for flush)
580  */
581 
582 int
583 sys___msync13(struct lwp *l, void *v, register_t *retval)
584 {
585 	struct sys___msync13_args /* {
586 		syscallarg(void *) addr;
587 		syscallarg(size_t) len;
588 		syscallarg(int) flags;
589 	} */ *uap = v;
590 	struct proc *p = l->l_proc;
591 	vaddr_t addr;
592 	vsize_t size, pageoff;
593 	struct vm_map *map;
594 	int error, rv, flags, uvmflags;
595 
596 	/*
597 	 * extract syscall args from the uap
598 	 */
599 
600 	addr = (vaddr_t)SCARG(uap, addr);
601 	size = (vsize_t)SCARG(uap, len);
602 	flags = SCARG(uap, flags);
603 
604 	/* sanity check flags */
605 	if ((flags & ~(MS_ASYNC | MS_SYNC | MS_INVALIDATE)) != 0 ||
606 	    (flags & (MS_ASYNC | MS_SYNC | MS_INVALIDATE)) == 0 ||
607 	    (flags & (MS_ASYNC | MS_SYNC)) == (MS_ASYNC | MS_SYNC))
608 		return (EINVAL);
609 	if ((flags & (MS_ASYNC | MS_SYNC)) == 0)
610 		flags |= MS_SYNC;
611 
612 	/*
613 	 * align the address to a page boundary and adjust the size accordingly.
614 	 */
615 
616 	pageoff = (addr & PAGE_MASK);
617 	addr -= pageoff;
618 	size += pageoff;
619 	size = (vsize_t)round_page(size);
620 
621 	error = range_test(addr, size, false);
622 	if (error)
623 		return error;
624 
625 	/*
626 	 * get map
627 	 */
628 
629 	map = &p->p_vmspace->vm_map;
630 
631 	/*
632 	 * XXXCDC: do we really need this semantic?
633 	 *
634 	 * XXX Gak!  If size is zero we are supposed to sync "all modified
635 	 * pages with the region containing addr".  Unfortunately, we
636 	 * don't really keep track of individual mmaps so we approximate
637 	 * by flushing the range of the map entry containing addr.
638 	 * This can be incorrect if the region splits or is coalesced
639 	 * with a neighbor.
640 	 */
641 
642 	if (size == 0) {
643 		struct vm_map_entry *entry;
644 
645 		vm_map_lock_read(map);
646 		rv = uvm_map_lookup_entry(map, addr, &entry);
647 		if (rv == true) {
648 			addr = entry->start;
649 			size = entry->end - entry->start;
650 		}
651 		vm_map_unlock_read(map);
652 		if (rv == false)
653 			return (EINVAL);
654 	}
655 
656 	/*
657 	 * translate MS_ flags into PGO_ flags
658 	 */
659 
660 	uvmflags = PGO_CLEANIT;
661 	if (flags & MS_INVALIDATE)
662 		uvmflags |= PGO_FREE;
663 	if (flags & MS_SYNC)
664 		uvmflags |= PGO_SYNCIO;
665 
666 	error = uvm_map_clean(map, addr, addr+size, uvmflags);
667 	return error;
668 }
669 
670 /*
671  * sys_munmap: unmap a users memory
672  */
673 
674 int
675 sys_munmap(struct lwp *l, void *v, register_t *retval)
676 {
677 	struct sys_munmap_args /* {
678 		syscallarg(void *) addr;
679 		syscallarg(size_t) len;
680 	} */ *uap = v;
681 	struct proc *p = l->l_proc;
682 	vaddr_t addr;
683 	vsize_t size, pageoff;
684 	struct vm_map *map;
685 	struct vm_map_entry *dead_entries;
686 	int error;
687 
688 	/*
689 	 * get syscall args.
690 	 */
691 
692 	addr = (vaddr_t)SCARG(uap, addr);
693 	size = (vsize_t)SCARG(uap, len);
694 
695 	/*
696 	 * align the address to a page boundary and adjust the size accordingly.
697 	 */
698 
699 	pageoff = (addr & PAGE_MASK);
700 	addr -= pageoff;
701 	size += pageoff;
702 	size = (vsize_t)round_page(size);
703 
704 	if (size == 0)
705 		return (0);
706 
707 	error = range_test(addr, size, false);
708 	if (error)
709 		return error;
710 
711 	map = &p->p_vmspace->vm_map;
712 
713 	/*
714 	 * interesting system call semantic: make sure entire range is
715 	 * allocated before allowing an unmap.
716 	 */
717 
718 	vm_map_lock(map);
719 #if 0
720 	if (!uvm_map_checkprot(map, addr, addr + size, VM_PROT_NONE)) {
721 		vm_map_unlock(map);
722 		return (EINVAL);
723 	}
724 #endif
725 	uvm_unmap_remove(map, addr, addr + size, &dead_entries, NULL, 0);
726 	vm_map_unlock(map);
727 	if (dead_entries != NULL)
728 		uvm_unmap_detach(dead_entries, 0);
729 	return (0);
730 }
731 
732 /*
733  * sys_mprotect: the mprotect system call
734  */
735 
736 int
737 sys_mprotect(struct lwp *l, void *v, register_t *retval)
738 {
739 	struct sys_mprotect_args /* {
740 		syscallarg(void *) addr;
741 		syscallarg(size_t) len;
742 		syscallarg(int) prot;
743 	} */ *uap = v;
744 	struct proc *p = l->l_proc;
745 	vaddr_t addr;
746 	vsize_t size, pageoff;
747 	vm_prot_t prot;
748 	int error;
749 
750 	/*
751 	 * extract syscall args from uap
752 	 */
753 
754 	addr = (vaddr_t)SCARG(uap, addr);
755 	size = (vsize_t)SCARG(uap, len);
756 	prot = SCARG(uap, prot) & VM_PROT_ALL;
757 
758 	/*
759 	 * align the address to a page boundary and adjust the size accordingly.
760 	 */
761 
762 	pageoff = (addr & PAGE_MASK);
763 	addr -= pageoff;
764 	size += pageoff;
765 	size = round_page(size);
766 
767 	error = range_test(addr, size, false);
768 	if (error)
769 		return error;
770 
771 	error = uvm_map_protect(&p->p_vmspace->vm_map, addr, addr + size, prot,
772 				false);
773 	return error;
774 }
775 
776 /*
777  * sys_minherit: the minherit system call
778  */
779 
780 int
781 sys_minherit(struct lwp *l, void *v, register_t *retval)
782 {
783 	struct sys_minherit_args /* {
784 		syscallarg(void *) addr;
785 		syscallarg(int) len;
786 		syscallarg(int) inherit;
787 	} */ *uap = v;
788 	struct proc *p = l->l_proc;
789 	vaddr_t addr;
790 	vsize_t size, pageoff;
791 	vm_inherit_t inherit;
792 	int error;
793 
794 	addr = (vaddr_t)SCARG(uap, addr);
795 	size = (vsize_t)SCARG(uap, len);
796 	inherit = SCARG(uap, inherit);
797 
798 	/*
799 	 * align the address to a page boundary and adjust the size accordingly.
800 	 */
801 
802 	pageoff = (addr & PAGE_MASK);
803 	addr -= pageoff;
804 	size += pageoff;
805 	size = (vsize_t)round_page(size);
806 
807 	error = range_test(addr, size, false);
808 	if (error)
809 		return error;
810 
811 	error = uvm_map_inherit(&p->p_vmspace->vm_map, addr, addr + size,
812 				inherit);
813 	return error;
814 }
815 
816 /*
817  * sys_madvise: give advice about memory usage.
818  */
819 
820 /* ARGSUSED */
821 int
822 sys_madvise(struct lwp *l, void *v, register_t *retval)
823 {
824 	struct sys_madvise_args /* {
825 		syscallarg(void *) addr;
826 		syscallarg(size_t) len;
827 		syscallarg(int) behav;
828 	} */ *uap = v;
829 	struct proc *p = l->l_proc;
830 	vaddr_t addr;
831 	vsize_t size, pageoff;
832 	int advice, error;
833 
834 	addr = (vaddr_t)SCARG(uap, addr);
835 	size = (vsize_t)SCARG(uap, len);
836 	advice = SCARG(uap, behav);
837 
838 	/*
839 	 * align the address to a page boundary, and adjust the size accordingly
840 	 */
841 
842 	pageoff = (addr & PAGE_MASK);
843 	addr -= pageoff;
844 	size += pageoff;
845 	size = (vsize_t)round_page(size);
846 
847 	error = range_test(addr, size, false);
848 	if (error)
849 		return error;
850 
851 	switch (advice) {
852 	case MADV_NORMAL:
853 	case MADV_RANDOM:
854 	case MADV_SEQUENTIAL:
855 		error = uvm_map_advice(&p->p_vmspace->vm_map, addr, addr + size,
856 		    advice);
857 		break;
858 
859 	case MADV_WILLNEED:
860 
861 		/*
862 		 * Activate all these pages, pre-faulting them in if
863 		 * necessary.
864 		 */
865 		/*
866 		 * XXX IMPLEMENT ME.
867 		 * Should invent a "weak" mode for uvm_fault()
868 		 * which would only do the PGO_LOCKED pgo_get().
869 		 */
870 
871 		return (0);
872 
873 	case MADV_DONTNEED:
874 
875 		/*
876 		 * Deactivate all these pages.  We don't need them
877 		 * any more.  We don't, however, toss the data in
878 		 * the pages.
879 		 */
880 
881 		error = uvm_map_clean(&p->p_vmspace->vm_map, addr, addr + size,
882 		    PGO_DEACTIVATE);
883 		break;
884 
885 	case MADV_FREE:
886 
887 		/*
888 		 * These pages contain no valid data, and may be
889 		 * garbage-collected.  Toss all resources, including
890 		 * any swap space in use.
891 		 */
892 
893 		error = uvm_map_clean(&p->p_vmspace->vm_map, addr, addr + size,
894 		    PGO_FREE);
895 		break;
896 
897 	case MADV_SPACEAVAIL:
898 
899 		/*
900 		 * XXXMRG What is this?  I think it's:
901 		 *
902 		 *	Ensure that we have allocated backing-store
903 		 *	for these pages.
904 		 *
905 		 * This is going to require changes to the page daemon,
906 		 * as it will free swap space allocated to pages in core.
907 		 * There's also what to do for device/file/anonymous memory.
908 		 */
909 
910 		return (EINVAL);
911 
912 	default:
913 		return (EINVAL);
914 	}
915 
916 	return error;
917 }
918 
919 /*
920  * sys_mlock: memory lock
921  */
922 
923 int
924 sys_mlock(struct lwp *l, void *v, register_t *retval)
925 {
926 	struct sys_mlock_args /* {
927 		syscallarg(const void *) addr;
928 		syscallarg(size_t) len;
929 	} */ *uap = v;
930 	struct proc *p = l->l_proc;
931 	vaddr_t addr;
932 	vsize_t size, pageoff;
933 	int error;
934 
935 	/*
936 	 * extract syscall args from uap
937 	 */
938 
939 	addr = (vaddr_t)SCARG(uap, addr);
940 	size = (vsize_t)SCARG(uap, len);
941 
942 	/*
943 	 * align the address to a page boundary and adjust the size accordingly
944 	 */
945 
946 	pageoff = (addr & PAGE_MASK);
947 	addr -= pageoff;
948 	size += pageoff;
949 	size = (vsize_t)round_page(size);
950 
951 	error = range_test(addr, size, false);
952 	if (error)
953 		return error;
954 
955 	if (atop(size) + uvmexp.wired > uvmexp.wiredmax)
956 		return (EAGAIN);
957 
958 	if (size + ptoa(pmap_wired_count(vm_map_pmap(&p->p_vmspace->vm_map))) >
959 			p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur)
960 		return (EAGAIN);
961 
962 	error = uvm_map_pageable(&p->p_vmspace->vm_map, addr, addr+size, false,
963 	    0);
964 	if (error == EFAULT)
965 		error = ENOMEM;
966 	return error;
967 }
968 
969 /*
970  * sys_munlock: unlock wired pages
971  */
972 
973 int
974 sys_munlock(struct lwp *l, void *v, register_t *retval)
975 {
976 	struct sys_munlock_args /* {
977 		syscallarg(const void *) addr;
978 		syscallarg(size_t) len;
979 	} */ *uap = v;
980 	struct proc *p = l->l_proc;
981 	vaddr_t addr;
982 	vsize_t size, pageoff;
983 	int error;
984 
985 	/*
986 	 * extract syscall args from uap
987 	 */
988 
989 	addr = (vaddr_t)SCARG(uap, addr);
990 	size = (vsize_t)SCARG(uap, len);
991 
992 	/*
993 	 * align the address to a page boundary, and adjust the size accordingly
994 	 */
995 
996 	pageoff = (addr & PAGE_MASK);
997 	addr -= pageoff;
998 	size += pageoff;
999 	size = (vsize_t)round_page(size);
1000 
1001 	error = range_test(addr, size, false);
1002 	if (error)
1003 		return error;
1004 
1005 	error = uvm_map_pageable(&p->p_vmspace->vm_map, addr, addr+size, true,
1006 	    0);
1007 	if (error == EFAULT)
1008 		error = ENOMEM;
1009 	return error;
1010 }
1011 
1012 /*
1013  * sys_mlockall: lock all pages mapped into an address space.
1014  */
1015 
1016 int
1017 sys_mlockall(struct lwp *l, void *v, register_t *retval)
1018 {
1019 	struct sys_mlockall_args /* {
1020 		syscallarg(int) flags;
1021 	} */ *uap = v;
1022 	struct proc *p = l->l_proc;
1023 	int error, flags;
1024 
1025 	flags = SCARG(uap, flags);
1026 
1027 	if (flags == 0 ||
1028 	    (flags & ~(MCL_CURRENT|MCL_FUTURE)) != 0)
1029 		return (EINVAL);
1030 
1031 	error = uvm_map_pageable_all(&p->p_vmspace->vm_map, flags,
1032 	    p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur);
1033 	return (error);
1034 }
1035 
1036 /*
1037  * sys_munlockall: unlock all pages mapped into an address space.
1038  */
1039 
1040 int
1041 sys_munlockall(struct lwp *l, void *v, register_t *retval)
1042 {
1043 	struct proc *p = l->l_proc;
1044 
1045 	(void) uvm_map_pageable_all(&p->p_vmspace->vm_map, 0, 0);
1046 	return (0);
1047 }
1048 
1049 /*
1050  * uvm_mmap: internal version of mmap
1051  *
1052  * - used by sys_mmap and various framebuffers
1053  * - handle is a vnode pointer or NULL for MAP_ANON
1054  * - caller must page-align the file offset
1055  */
1056 
1057 int
1058 uvm_mmap(map, addr, size, prot, maxprot, flags, handle, foff, locklimit)
1059 	struct vm_map *map;
1060 	vaddr_t *addr;
1061 	vsize_t size;
1062 	vm_prot_t prot, maxprot;
1063 	int flags;
1064 	void *handle;
1065 	voff_t foff;
1066 	vsize_t locklimit;
1067 {
1068 	struct uvm_object *uobj;
1069 	struct vnode *vp;
1070 	vaddr_t align = 0;
1071 	int error;
1072 	int advice = UVM_ADV_NORMAL;
1073 	uvm_flag_t uvmflag = 0;
1074 	bool needwritemap;
1075 
1076 	/*
1077 	 * check params
1078 	 */
1079 
1080 	if (size == 0)
1081 		return(0);
1082 	if (foff & PAGE_MASK)
1083 		return(EINVAL);
1084 	if ((prot & maxprot) != prot)
1085 		return(EINVAL);
1086 
1087 	/*
1088 	 * for non-fixed mappings, round off the suggested address.
1089 	 * for fixed mappings, check alignment and zap old mappings.
1090 	 */
1091 
1092 	if ((flags & MAP_FIXED) == 0) {
1093 		*addr = round_page(*addr);
1094 	} else {
1095 		if (*addr & PAGE_MASK)
1096 			return(EINVAL);
1097 		uvmflag |= UVM_FLAG_FIXED;
1098 		(void) uvm_unmap(map, *addr, *addr + size);
1099 	}
1100 
1101 	/*
1102 	 * Try to see if any requested alignment can even be attemped.
1103 	 * Make sure we can express the alignment (asking for a >= 4GB
1104 	 * alignment on an ILP32 architecure make no sense) and the
1105 	 * alignment is at least for a page sized quanitiy.  If the
1106 	 * request was for a fixed mapping, make sure supplied address
1107 	 * adheres to the request alignment.
1108 	 */
1109 	align = (flags & MAP_ALIGNMENT_MASK) >> MAP_ALIGNMENT_SHIFT;
1110 	if (align) {
1111 		if (align >= sizeof(vaddr_t) * NBBY)
1112 			return(EINVAL);
1113 		align = 1L << align;
1114 		if (align < PAGE_SIZE)
1115 			return(EINVAL);
1116 		if (align >= vm_map_max(map))
1117 			return(ENOMEM);
1118 		if (flags & MAP_FIXED) {
1119 			if ((*addr & (align-1)) != 0)
1120 				return(EINVAL);
1121 			align = 0;
1122 		}
1123 	}
1124 
1125 	/*
1126 	 * handle anon vs. non-anon mappings.   for non-anon mappings attach
1127 	 * to underlying vm object.
1128 	 */
1129 
1130 	if (flags & MAP_ANON) {
1131 		KASSERT(handle == NULL);
1132 		foff = UVM_UNKNOWN_OFFSET;
1133 		uobj = NULL;
1134 		if ((flags & MAP_SHARED) == 0)
1135 			/* XXX: defer amap create */
1136 			uvmflag |= UVM_FLAG_COPYONW;
1137 		else
1138 			/* shared: create amap now */
1139 			uvmflag |= UVM_FLAG_OVERLAY;
1140 
1141 	} else {
1142 		KASSERT(handle != NULL);
1143 		vp = (struct vnode *)handle;
1144 
1145 		/*
1146 		 * Don't allow mmap for EXEC if the file system
1147 		 * is mounted NOEXEC.
1148 		 */
1149 		if ((prot & PROT_EXEC) != 0 &&
1150 		    (vp->v_mount->mnt_flag & MNT_NOEXEC) != 0)
1151 			return (EACCES);
1152 
1153 		if (vp->v_type != VCHR) {
1154 			error = VOP_MMAP(vp, prot, curlwp->l_cred);
1155 			if (error) {
1156 				return error;
1157 			}
1158 			vref(vp);
1159 			uobj = &vp->v_uobj;
1160 
1161 			/*
1162 			 * If the vnode is being mapped with PROT_EXEC,
1163 			 * then mark it as text.
1164 			 */
1165 			if (prot & PROT_EXEC) {
1166 				simple_lock(&uobj->vmobjlock);
1167 				vn_markexec(vp);
1168 				simple_unlock(&uobj->vmobjlock);
1169 			}
1170 		} else {
1171 			int i = maxprot;
1172 
1173 			/*
1174 			 * XXX Some devices don't like to be mapped with
1175 			 * XXX PROT_EXEC or PROT_WRITE, but we don't really
1176 			 * XXX have a better way of handling this, right now
1177 			 */
1178 			do {
1179 				uobj = udv_attach((void *) &vp->v_rdev,
1180 				    (flags & MAP_SHARED) ? i :
1181 				    (i & ~VM_PROT_WRITE), foff, size);
1182 				i--;
1183 			} while ((uobj == NULL) && (i > 0));
1184 			advice = UVM_ADV_RANDOM;
1185 		}
1186 		if (uobj == NULL)
1187 			return((vp->v_type == VREG) ? ENOMEM : EINVAL);
1188 		if ((flags & MAP_SHARED) == 0) {
1189 			uvmflag |= UVM_FLAG_COPYONW;
1190 		}
1191 
1192 		/*
1193 		 * Set vnode flags to indicate the new kinds of mapping.
1194 		 * We take the vnode lock in exclusive mode here to serialize
1195 		 * with direct I/O.
1196 		 */
1197 
1198 		simple_lock(&vp->v_interlock);
1199 		needwritemap = (vp->v_iflag & VI_WRMAP) == 0 &&
1200 			(flags & MAP_SHARED) != 0 &&
1201 			(maxprot & VM_PROT_WRITE) != 0;
1202 		if ((vp->v_iflag & VI_MAPPED) == 0 || needwritemap) {
1203 			vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_INTERLOCK);
1204 			simple_lock(&vp->v_interlock);
1205 			vp->v_iflag |= VI_MAPPED;
1206 			vp->v_vflag |= VV_MAPPED;
1207 			if (needwritemap) {
1208 				vp->v_iflag |= VI_WRMAP;
1209 			}
1210 			simple_unlock(&vp->v_interlock);
1211 			VOP_UNLOCK(vp, 0);
1212 		} else
1213 			simple_unlock(&vp->v_interlock);
1214 	}
1215 
1216 	uvmflag = UVM_MAPFLAG(prot, maxprot,
1217 			(flags & MAP_SHARED) ? UVM_INH_SHARE : UVM_INH_COPY,
1218 			advice, uvmflag);
1219 	error = uvm_map(map, addr, size, uobj, foff, align, uvmflag);
1220 	if (error) {
1221 		if (uobj)
1222 			uobj->pgops->pgo_detach(uobj);
1223 		return error;
1224 	}
1225 
1226 	/*
1227 	 * POSIX 1003.1b -- if our address space was configured
1228 	 * to lock all future mappings, wire the one we just made.
1229 	 *
1230 	 * Also handle the MAP_WIRED flag here.
1231 	 */
1232 
1233 	if (prot == VM_PROT_NONE) {
1234 
1235 		/*
1236 		 * No more work to do in this case.
1237 		 */
1238 
1239 		return (0);
1240 	}
1241 	vm_map_lock(map);
1242 	if ((flags & MAP_WIRED) != 0 || (map->flags & VM_MAP_WIREFUTURE) != 0) {
1243 		if (atop(size) + uvmexp.wired > uvmexp.wiredmax ||
1244 		    (locklimit != 0 &&
1245 		     size + ptoa(pmap_wired_count(vm_map_pmap(map))) >
1246 		     locklimit)) {
1247 			vm_map_unlock(map);
1248 			uvm_unmap(map, *addr, *addr + size);
1249 			return ENOMEM;
1250 		}
1251 
1252 		/*
1253 		 * uvm_map_pageable() always returns the map unlocked.
1254 		 */
1255 
1256 		error = uvm_map_pageable(map, *addr, *addr + size,
1257 					 false, UVM_LK_ENTER);
1258 		if (error) {
1259 			uvm_unmap(map, *addr, *addr + size);
1260 			return error;
1261 		}
1262 		return (0);
1263 	}
1264 	vm_map_unlock(map);
1265 	return 0;
1266 }
1267 
1268 vaddr_t
1269 uvm_default_mapaddr(struct proc *p, vaddr_t base, vsize_t sz)
1270 {
1271 
1272 	return VM_DEFAULT_ADDRESS(base, sz);
1273 }
1274