xref: /netbsd-src/sys/uvm/uvm_mmap.c (revision b1c86f5f087524e68db12794ee9c3e3da1ab17a0)
1 /*	$NetBSD: uvm_mmap.c,v 1.133 2010/06/24 13:03:20 hannken Exp $	*/
2 
3 /*
4  * Copyright (c) 1997 Charles D. Cranor and Washington University.
5  * Copyright (c) 1991, 1993 The Regents of the University of California.
6  * Copyright (c) 1988 University of Utah.
7  *
8  * All rights reserved.
9  *
10  * This code is derived from software contributed to Berkeley by
11  * the Systems Programming Group of the University of Utah Computer
12  * Science Department.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. All advertising materials mentioning features or use of this software
23  *    must display the following acknowledgement:
24  *      This product includes software developed by the Charles D. Cranor,
25  *	Washington University, University of California, Berkeley and
26  *	its contributors.
27  * 4. Neither the name of the University nor the names of its contributors
28  *    may be used to endorse or promote products derived from this software
29  *    without specific prior written permission.
30  *
31  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
32  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
33  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
34  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
35  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
36  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
37  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
38  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
39  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
40  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
41  * SUCH DAMAGE.
42  *
43  * from: Utah $Hdr: vm_mmap.c 1.6 91/10/21$
44  *      @(#)vm_mmap.c   8.5 (Berkeley) 5/19/94
45  * from: Id: uvm_mmap.c,v 1.1.2.14 1998/01/05 21:04:26 chuck Exp
46  */
47 
48 /*
49  * uvm_mmap.c: system call interface into VM system, plus kernel vm_mmap
50  * function.
51  */
52 
53 #include <sys/cdefs.h>
54 __KERNEL_RCSID(0, "$NetBSD: uvm_mmap.c,v 1.133 2010/06/24 13:03:20 hannken Exp $");
55 
56 #include "opt_compat_netbsd.h"
57 #include "opt_pax.h"
58 #include "veriexec.h"
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/file.h>
63 #include <sys/filedesc.h>
64 #include <sys/resourcevar.h>
65 #include <sys/mman.h>
66 #include <sys/mount.h>
67 #include <sys/proc.h>
68 #include <sys/malloc.h>
69 #include <sys/vnode.h>
70 #include <sys/conf.h>
71 #include <sys/stat.h>
72 
73 #if NVERIEXEC > 0
74 #include <sys/verified_exec.h>
75 #endif /* NVERIEXEC > 0 */
76 
77 #ifdef PAX_MPROTECT
78 #include <sys/pax.h>
79 #endif /* PAX_MPROTECT */
80 
81 #include <miscfs/specfs/specdev.h>
82 
83 #include <sys/syscallargs.h>
84 
85 #include <uvm/uvm.h>
86 #include <uvm/uvm_device.h>
87 
88 #ifndef COMPAT_ZERODEV
89 #define COMPAT_ZERODEV(dev)	(0)
90 #endif
91 
92 static int
93 range_test(vaddr_t addr, vsize_t size, bool ismmap)
94 {
95 	vaddr_t vm_min_address = VM_MIN_ADDRESS;
96 	vaddr_t vm_max_address = VM_MAXUSER_ADDRESS;
97 	vaddr_t eaddr = addr + size;
98 
99 	if (addr < vm_min_address)
100 		return EINVAL;
101 	if (eaddr > vm_max_address)
102 		return ismmap ? EFBIG : EINVAL;
103 	if (addr > eaddr) /* no wrapping! */
104 		return ismmap ? EOVERFLOW : EINVAL;
105 	return 0;
106 }
107 
108 /*
109  * unimplemented VM system calls:
110  */
111 
112 /*
113  * sys_sbrk: sbrk system call.
114  */
115 
116 /* ARGSUSED */
117 int
118 sys_sbrk(struct lwp *l, const struct sys_sbrk_args *uap, register_t *retval)
119 {
120 	/* {
121 		syscallarg(intptr_t) incr;
122 	} */
123 
124 	return (ENOSYS);
125 }
126 
127 /*
128  * sys_sstk: sstk system call.
129  */
130 
131 /* ARGSUSED */
132 int
133 sys_sstk(struct lwp *l, const struct sys_sstk_args *uap, register_t *retval)
134 {
135 	/* {
136 		syscallarg(int) incr;
137 	} */
138 
139 	return (ENOSYS);
140 }
141 
142 /*
143  * sys_mincore: determine if pages are in core or not.
144  */
145 
146 /* ARGSUSED */
147 int
148 sys_mincore(struct lwp *l, const struct sys_mincore_args *uap,
149     register_t *retval)
150 {
151 	/* {
152 		syscallarg(void *) addr;
153 		syscallarg(size_t) len;
154 		syscallarg(char *) vec;
155 	} */
156 	struct proc *p = l->l_proc;
157 	struct vm_page *pg;
158 	char *vec, pgi;
159 	struct uvm_object *uobj;
160 	struct vm_amap *amap;
161 	struct vm_anon *anon;
162 	struct vm_map_entry *entry;
163 	vaddr_t start, end, lim;
164 	struct vm_map *map;
165 	vsize_t len;
166 	int error = 0, npgs;
167 
168 	map = &p->p_vmspace->vm_map;
169 
170 	start = (vaddr_t)SCARG(uap, addr);
171 	len = SCARG(uap, len);
172 	vec = SCARG(uap, vec);
173 
174 	if (start & PAGE_MASK)
175 		return (EINVAL);
176 	len = round_page(len);
177 	end = start + len;
178 	if (end <= start)
179 		return (EINVAL);
180 
181 	/*
182 	 * Lock down vec, so our returned status isn't outdated by
183 	 * storing the status byte for a page.
184 	 */
185 
186 	npgs = len >> PAGE_SHIFT;
187 	error = uvm_vslock(p->p_vmspace, vec, npgs, VM_PROT_WRITE);
188 	if (error) {
189 		return error;
190 	}
191 	vm_map_lock_read(map);
192 
193 	if (uvm_map_lookup_entry(map, start, &entry) == false) {
194 		error = ENOMEM;
195 		goto out;
196 	}
197 
198 	for (/* nothing */;
199 	     entry != &map->header && entry->start < end;
200 	     entry = entry->next) {
201 		KASSERT(!UVM_ET_ISSUBMAP(entry));
202 		KASSERT(start >= entry->start);
203 
204 		/* Make sure there are no holes. */
205 		if (entry->end < end &&
206 		     (entry->next == &map->header ||
207 		      entry->next->start > entry->end)) {
208 			error = ENOMEM;
209 			goto out;
210 		}
211 
212 		lim = end < entry->end ? end : entry->end;
213 
214 		/*
215 		 * Special case for objects with no "real" pages.  Those
216 		 * are always considered resident (mapped devices).
217 		 */
218 
219 		if (UVM_ET_ISOBJ(entry)) {
220 			KASSERT(!UVM_OBJ_IS_KERN_OBJECT(entry->object.uvm_obj));
221 			if (UVM_OBJ_IS_DEVICE(entry->object.uvm_obj)) {
222 				for (/* nothing */; start < lim;
223 				     start += PAGE_SIZE, vec++)
224 					subyte(vec, 1);
225 				continue;
226 			}
227 		}
228 
229 		amap = entry->aref.ar_amap;	/* upper layer */
230 		uobj = entry->object.uvm_obj;	/* lower layer */
231 
232 		if (amap != NULL)
233 			amap_lock(amap);
234 		if (uobj != NULL)
235 			mutex_enter(&uobj->vmobjlock);
236 
237 		for (/* nothing */; start < lim; start += PAGE_SIZE, vec++) {
238 			pgi = 0;
239 			if (amap != NULL) {
240 				/* Check the upper layer first. */
241 				anon = amap_lookup(&entry->aref,
242 				    start - entry->start);
243 				/* Don't need to lock anon here. */
244 				if (anon != NULL && anon->an_page != NULL) {
245 
246 					/*
247 					 * Anon has the page for this entry
248 					 * offset.
249 					 */
250 
251 					pgi = 1;
252 				}
253 			}
254 			if (uobj != NULL && pgi == 0) {
255 				/* Check the lower layer. */
256 				pg = uvm_pagelookup(uobj,
257 				    entry->offset + (start - entry->start));
258 				if (pg != NULL) {
259 
260 					/*
261 					 * Object has the page for this entry
262 					 * offset.
263 					 */
264 
265 					pgi = 1;
266 				}
267 			}
268 			(void) subyte(vec, pgi);
269 		}
270 		if (uobj != NULL)
271 			mutex_exit(&uobj->vmobjlock);
272 		if (amap != NULL)
273 			amap_unlock(amap);
274 	}
275 
276  out:
277 	vm_map_unlock_read(map);
278 	uvm_vsunlock(p->p_vmspace, SCARG(uap, vec), npgs);
279 	return (error);
280 }
281 
282 /*
283  * sys_mmap: mmap system call.
284  *
285  * => file offset and address may not be page aligned
286  *    - if MAP_FIXED, offset and address must have remainder mod PAGE_SIZE
287  *    - if address isn't page aligned the mapping starts at trunc_page(addr)
288  *      and the return value is adjusted up by the page offset.
289  */
290 
291 int
292 sys_mmap(struct lwp *l, const struct sys_mmap_args *uap, register_t *retval)
293 {
294 	/* {
295 		syscallarg(void *) addr;
296 		syscallarg(size_t) len;
297 		syscallarg(int) prot;
298 		syscallarg(int) flags;
299 		syscallarg(int) fd;
300 		syscallarg(long) pad;
301 		syscallarg(off_t) pos;
302 	} */
303 	struct proc *p = l->l_proc;
304 	vaddr_t addr;
305 	struct vattr va;
306 	off_t pos;
307 	vsize_t size, pageoff;
308 	vm_prot_t prot, maxprot;
309 	int flags, fd;
310 	vaddr_t defaddr;
311 	struct file *fp = NULL;
312 	struct vnode *vp;
313 	void *handle;
314 	int error;
315 #ifdef PAX_ASLR
316 	vaddr_t orig_addr;
317 #endif /* PAX_ASLR */
318 
319 	/*
320 	 * first, extract syscall args from the uap.
321 	 */
322 
323 	addr = (vaddr_t)SCARG(uap, addr);
324 	size = (vsize_t)SCARG(uap, len);
325 	prot = SCARG(uap, prot) & VM_PROT_ALL;
326 	flags = SCARG(uap, flags);
327 	fd = SCARG(uap, fd);
328 	pos = SCARG(uap, pos);
329 
330 #ifdef PAX_ASLR
331 	orig_addr = addr;
332 #endif /* PAX_ASLR */
333 
334 	/*
335 	 * Fixup the old deprecated MAP_COPY into MAP_PRIVATE, and
336 	 * validate the flags.
337 	 */
338 	if (flags & MAP_COPY)
339 		flags = (flags & ~MAP_COPY) | MAP_PRIVATE;
340 	if ((flags & (MAP_SHARED|MAP_PRIVATE)) == (MAP_SHARED|MAP_PRIVATE))
341 		return (EINVAL);
342 
343 	/*
344 	 * align file position and save offset.  adjust size.
345 	 */
346 
347 	pageoff = (pos & PAGE_MASK);
348 	pos  -= pageoff;
349 	size += pageoff;			/* add offset */
350 	size = (vsize_t)round_page(size);	/* round up */
351 
352 	/*
353 	 * now check (MAP_FIXED) or get (!MAP_FIXED) the "addr"
354 	 */
355 	if (flags & MAP_FIXED) {
356 
357 		/* ensure address and file offset are aligned properly */
358 		addr -= pageoff;
359 		if (addr & PAGE_MASK)
360 			return (EINVAL);
361 
362 		error = range_test(addr, size, true);
363 		if (error)
364 			return error;
365 	} else if (addr == 0 || !(flags & MAP_TRYFIXED)) {
366 
367 		/*
368 		 * not fixed: make sure we skip over the largest
369 		 * possible heap for non-topdown mapping arrangements.
370 		 * we will refine our guess later (e.g. to account for
371 		 * VAC, etc)
372 		 */
373 
374 		defaddr = p->p_emul->e_vm_default_addr(p,
375 		    (vaddr_t)p->p_vmspace->vm_daddr, size);
376 
377 		if (addr == 0 ||
378 		    !(p->p_vmspace->vm_map.flags & VM_MAP_TOPDOWN))
379 			addr = MAX(addr, defaddr);
380 		else
381 			addr = MIN(addr, defaddr);
382 	}
383 
384 	/*
385 	 * check for file mappings (i.e. not anonymous) and verify file.
386 	 */
387 
388 	if ((flags & MAP_ANON) == 0) {
389 		if ((fp = fd_getfile(fd)) == NULL)
390 			return (EBADF);
391 		if (fp->f_type != DTYPE_VNODE) {
392 			fd_putfile(fd);
393 			return (ENODEV);		/* only mmap vnodes! */
394 		}
395 		vp = fp->f_data;		/* convert to vnode */
396 		if (vp->v_type != VREG && vp->v_type != VCHR &&
397 		    vp->v_type != VBLK) {
398 			fd_putfile(fd);
399 			return (ENODEV);  /* only REG/CHR/BLK support mmap */
400 		}
401 		if (vp->v_type != VCHR && pos < 0) {
402 			fd_putfile(fd);
403 			return (EINVAL);
404 		}
405 		if (vp->v_type != VCHR && (pos + size) < pos) {
406 			fd_putfile(fd);
407 			return (EOVERFLOW);		/* no offset wrapping */
408 		}
409 
410 		/* special case: catch SunOS style /dev/zero */
411 		if (vp->v_type == VCHR
412 		    && (vp->v_rdev == zerodev || COMPAT_ZERODEV(vp->v_rdev))) {
413 			flags |= MAP_ANON;
414 			fd_putfile(fd);
415 			fp = NULL;
416 			goto is_anon;
417 		}
418 
419 		/*
420 		 * Old programs may not select a specific sharing type, so
421 		 * default to an appropriate one.
422 		 *
423 		 * XXX: how does MAP_ANON fit in the picture?
424 		 */
425 		if ((flags & (MAP_SHARED|MAP_PRIVATE)) == 0) {
426 #if defined(DEBUG)
427 			printf("WARNING: defaulted mmap() share type to "
428 			   "%s (pid %d command %s)\n", vp->v_type == VCHR ?
429 			   "MAP_SHARED" : "MAP_PRIVATE", p->p_pid,
430 			    p->p_comm);
431 #endif
432 			if (vp->v_type == VCHR)
433 				flags |= MAP_SHARED;	/* for a device */
434 			else
435 				flags |= MAP_PRIVATE;	/* for a file */
436 		}
437 
438 		/*
439 		 * MAP_PRIVATE device mappings don't make sense (and aren't
440 		 * supported anyway).  However, some programs rely on this,
441 		 * so just change it to MAP_SHARED.
442 		 */
443 		if (vp->v_type == VCHR && (flags & MAP_PRIVATE) != 0) {
444 			flags = (flags & ~MAP_PRIVATE) | MAP_SHARED;
445 		}
446 
447 		/*
448 		 * now check protection
449 		 */
450 
451 		maxprot = VM_PROT_EXECUTE;
452 
453 		/* check read access */
454 		if (fp->f_flag & FREAD)
455 			maxprot |= VM_PROT_READ;
456 		else if (prot & PROT_READ) {
457 			fd_putfile(fd);
458 			return (EACCES);
459 		}
460 
461 		/* check write access, shared case first */
462 		if (flags & MAP_SHARED) {
463 			/*
464 			 * if the file is writable, only add PROT_WRITE to
465 			 * maxprot if the file is not immutable, append-only.
466 			 * otherwise, if we have asked for PROT_WRITE, return
467 			 * EPERM.
468 			 */
469 			if (fp->f_flag & FWRITE) {
470 				if ((error =
471 				    VOP_GETATTR(vp, &va, l->l_cred))) {
472 					fd_putfile(fd);
473 					return (error);
474 				}
475 				if ((va.va_flags &
476 				    (SF_SNAPSHOT|IMMUTABLE|APPEND)) == 0)
477 					maxprot |= VM_PROT_WRITE;
478 				else if (prot & PROT_WRITE) {
479 					fd_putfile(fd);
480 					return (EPERM);
481 				}
482 			}
483 			else if (prot & PROT_WRITE) {
484 				fd_putfile(fd);
485 				return (EACCES);
486 			}
487 		} else {
488 			/* MAP_PRIVATE mappings can always write to */
489 			maxprot |= VM_PROT_WRITE;
490 		}
491 		handle = vp;
492 
493 	} else {		/* MAP_ANON case */
494 		/*
495 		 * XXX What do we do about (MAP_SHARED|MAP_PRIVATE) == 0?
496 		 */
497 		if (fd != -1)
498 			return (EINVAL);
499 
500  is_anon:		/* label for SunOS style /dev/zero */
501 		handle = NULL;
502 		maxprot = VM_PROT_ALL;
503 		pos = 0;
504 	}
505 
506 #if NVERIEXEC > 0
507 	if (handle != NULL) {
508 		/*
509 		 * Check if the file can be executed indirectly.
510 		 *
511 		 * XXX: This gives false warnings about "Incorrect access type"
512 		 * XXX: if the mapping is not executable. Harmless, but will be
513 		 * XXX: fixed as part of other changes.
514 		 */
515 		if (veriexec_verify(l, handle, "(mmap)", VERIEXEC_INDIRECT,
516 		    NULL)) {
517 			/*
518 			 * Don't allow executable mappings if we can't
519 			 * indirectly execute the file.
520 			 */
521 			if (prot & VM_PROT_EXECUTE) {
522 			     	if (fp != NULL)
523 					fd_putfile(fd);
524 				return (EPERM);
525 			}
526 
527 			/*
528 			 * Strip the executable bit from 'maxprot' to make sure
529 			 * it can't be made executable later.
530 			 */
531 			maxprot &= ~VM_PROT_EXECUTE;
532 		}
533 	}
534 #endif /* NVERIEXEC > 0 */
535 
536 #ifdef PAX_MPROTECT
537 	pax_mprotect(l, &prot, &maxprot);
538 #endif /* PAX_MPROTECT */
539 
540 #ifdef PAX_ASLR
541 	pax_aslr(l, &addr, orig_addr, flags);
542 #endif /* PAX_ASLR */
543 
544 	/*
545 	 * now let kernel internal function uvm_mmap do the work.
546 	 */
547 
548 	error = uvm_mmap(&p->p_vmspace->vm_map, &addr, size, prot, maxprot,
549 	    flags, handle, pos, p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur);
550 
551 	if (error == 0)
552 		/* remember to add offset */
553 		*retval = (register_t)(addr + pageoff);
554 
555      	if (fp != NULL)
556 		fd_putfile(fd);
557 
558 	return (error);
559 }
560 
561 /*
562  * sys___msync13: the msync system call (a front-end for flush)
563  */
564 
565 int
566 sys___msync13(struct lwp *l, const struct sys___msync13_args *uap,
567     register_t *retval)
568 {
569 	/* {
570 		syscallarg(void *) addr;
571 		syscallarg(size_t) len;
572 		syscallarg(int) flags;
573 	} */
574 	struct proc *p = l->l_proc;
575 	vaddr_t addr;
576 	vsize_t size, pageoff;
577 	struct vm_map *map;
578 	int error, rv, flags, uvmflags;
579 
580 	/*
581 	 * extract syscall args from the uap
582 	 */
583 
584 	addr = (vaddr_t)SCARG(uap, addr);
585 	size = (vsize_t)SCARG(uap, len);
586 	flags = SCARG(uap, flags);
587 
588 	/* sanity check flags */
589 	if ((flags & ~(MS_ASYNC | MS_SYNC | MS_INVALIDATE)) != 0 ||
590 	    (flags & (MS_ASYNC | MS_SYNC | MS_INVALIDATE)) == 0 ||
591 	    (flags & (MS_ASYNC | MS_SYNC)) == (MS_ASYNC | MS_SYNC))
592 		return (EINVAL);
593 	if ((flags & (MS_ASYNC | MS_SYNC)) == 0)
594 		flags |= MS_SYNC;
595 
596 	/*
597 	 * align the address to a page boundary and adjust the size accordingly.
598 	 */
599 
600 	pageoff = (addr & PAGE_MASK);
601 	addr -= pageoff;
602 	size += pageoff;
603 	size = (vsize_t)round_page(size);
604 
605 	error = range_test(addr, size, false);
606 	if (error)
607 		return error;
608 
609 	/*
610 	 * get map
611 	 */
612 
613 	map = &p->p_vmspace->vm_map;
614 
615 	/*
616 	 * XXXCDC: do we really need this semantic?
617 	 *
618 	 * XXX Gak!  If size is zero we are supposed to sync "all modified
619 	 * pages with the region containing addr".  Unfortunately, we
620 	 * don't really keep track of individual mmaps so we approximate
621 	 * by flushing the range of the map entry containing addr.
622 	 * This can be incorrect if the region splits or is coalesced
623 	 * with a neighbor.
624 	 */
625 
626 	if (size == 0) {
627 		struct vm_map_entry *entry;
628 
629 		vm_map_lock_read(map);
630 		rv = uvm_map_lookup_entry(map, addr, &entry);
631 		if (rv == true) {
632 			addr = entry->start;
633 			size = entry->end - entry->start;
634 		}
635 		vm_map_unlock_read(map);
636 		if (rv == false)
637 			return (EINVAL);
638 	}
639 
640 	/*
641 	 * translate MS_ flags into PGO_ flags
642 	 */
643 
644 	uvmflags = PGO_CLEANIT;
645 	if (flags & MS_INVALIDATE)
646 		uvmflags |= PGO_FREE;
647 	if (flags & MS_SYNC)
648 		uvmflags |= PGO_SYNCIO;
649 
650 	error = uvm_map_clean(map, addr, addr+size, uvmflags);
651 	return error;
652 }
653 
654 /*
655  * sys_munmap: unmap a users memory
656  */
657 
658 int
659 sys_munmap(struct lwp *l, const struct sys_munmap_args *uap, register_t *retval)
660 {
661 	/* {
662 		syscallarg(void *) addr;
663 		syscallarg(size_t) len;
664 	} */
665 	struct proc *p = l->l_proc;
666 	vaddr_t addr;
667 	vsize_t size, pageoff;
668 	struct vm_map *map;
669 	struct vm_map_entry *dead_entries;
670 	int error;
671 
672 	/*
673 	 * get syscall args.
674 	 */
675 
676 	addr = (vaddr_t)SCARG(uap, addr);
677 	size = (vsize_t)SCARG(uap, len);
678 
679 	/*
680 	 * align the address to a page boundary and adjust the size accordingly.
681 	 */
682 
683 	pageoff = (addr & PAGE_MASK);
684 	addr -= pageoff;
685 	size += pageoff;
686 	size = (vsize_t)round_page(size);
687 
688 	if (size == 0)
689 		return (0);
690 
691 	error = range_test(addr, size, false);
692 	if (error)
693 		return error;
694 
695 	map = &p->p_vmspace->vm_map;
696 
697 	/*
698 	 * interesting system call semantic: make sure entire range is
699 	 * allocated before allowing an unmap.
700 	 */
701 
702 	vm_map_lock(map);
703 #if 0
704 	if (!uvm_map_checkprot(map, addr, addr + size, VM_PROT_NONE)) {
705 		vm_map_unlock(map);
706 		return (EINVAL);
707 	}
708 #endif
709 	uvm_unmap_remove(map, addr, addr + size, &dead_entries, NULL, 0);
710 	vm_map_unlock(map);
711 	if (dead_entries != NULL)
712 		uvm_unmap_detach(dead_entries, 0);
713 	return (0);
714 }
715 
716 /*
717  * sys_mprotect: the mprotect system call
718  */
719 
720 int
721 sys_mprotect(struct lwp *l, const struct sys_mprotect_args *uap,
722     register_t *retval)
723 {
724 	/* {
725 		syscallarg(void *) addr;
726 		syscallarg(size_t) len;
727 		syscallarg(int) prot;
728 	} */
729 	struct proc *p = l->l_proc;
730 	vaddr_t addr;
731 	vsize_t size, pageoff;
732 	vm_prot_t prot;
733 	int error;
734 
735 	/*
736 	 * extract syscall args from uap
737 	 */
738 
739 	addr = (vaddr_t)SCARG(uap, addr);
740 	size = (vsize_t)SCARG(uap, len);
741 	prot = SCARG(uap, prot) & VM_PROT_ALL;
742 
743 	/*
744 	 * align the address to a page boundary and adjust the size accordingly.
745 	 */
746 
747 	pageoff = (addr & PAGE_MASK);
748 	addr -= pageoff;
749 	size += pageoff;
750 	size = round_page(size);
751 
752 	error = range_test(addr, size, false);
753 	if (error)
754 		return error;
755 
756 	error = uvm_map_protect(&p->p_vmspace->vm_map, addr, addr + size, prot,
757 				false);
758 	return error;
759 }
760 
761 /*
762  * sys_minherit: the minherit system call
763  */
764 
765 int
766 sys_minherit(struct lwp *l, const struct sys_minherit_args *uap,
767    register_t *retval)
768 {
769 	/* {
770 		syscallarg(void *) addr;
771 		syscallarg(int) len;
772 		syscallarg(int) inherit;
773 	} */
774 	struct proc *p = l->l_proc;
775 	vaddr_t addr;
776 	vsize_t size, pageoff;
777 	vm_inherit_t inherit;
778 	int error;
779 
780 	addr = (vaddr_t)SCARG(uap, addr);
781 	size = (vsize_t)SCARG(uap, len);
782 	inherit = SCARG(uap, inherit);
783 
784 	/*
785 	 * align the address to a page boundary and adjust the size accordingly.
786 	 */
787 
788 	pageoff = (addr & PAGE_MASK);
789 	addr -= pageoff;
790 	size += pageoff;
791 	size = (vsize_t)round_page(size);
792 
793 	error = range_test(addr, size, false);
794 	if (error)
795 		return error;
796 
797 	error = uvm_map_inherit(&p->p_vmspace->vm_map, addr, addr + size,
798 				inherit);
799 	return error;
800 }
801 
802 /*
803  * sys_madvise: give advice about memory usage.
804  */
805 
806 /* ARGSUSED */
807 int
808 sys_madvise(struct lwp *l, const struct sys_madvise_args *uap,
809    register_t *retval)
810 {
811 	/* {
812 		syscallarg(void *) addr;
813 		syscallarg(size_t) len;
814 		syscallarg(int) behav;
815 	} */
816 	struct proc *p = l->l_proc;
817 	vaddr_t addr;
818 	vsize_t size, pageoff;
819 	int advice, error;
820 
821 	addr = (vaddr_t)SCARG(uap, addr);
822 	size = (vsize_t)SCARG(uap, len);
823 	advice = SCARG(uap, behav);
824 
825 	/*
826 	 * align the address to a page boundary, and adjust the size accordingly
827 	 */
828 
829 	pageoff = (addr & PAGE_MASK);
830 	addr -= pageoff;
831 	size += pageoff;
832 	size = (vsize_t)round_page(size);
833 
834 	error = range_test(addr, size, false);
835 	if (error)
836 		return error;
837 
838 	switch (advice) {
839 	case MADV_NORMAL:
840 	case MADV_RANDOM:
841 	case MADV_SEQUENTIAL:
842 		error = uvm_map_advice(&p->p_vmspace->vm_map, addr, addr + size,
843 		    advice);
844 		break;
845 
846 	case MADV_WILLNEED:
847 
848 		/*
849 		 * Activate all these pages, pre-faulting them in if
850 		 * necessary.
851 		 */
852 		error = uvm_map_willneed(&p->p_vmspace->vm_map,
853 		    addr, addr + size);
854 		break;
855 
856 	case MADV_DONTNEED:
857 
858 		/*
859 		 * Deactivate all these pages.  We don't need them
860 		 * any more.  We don't, however, toss the data in
861 		 * the pages.
862 		 */
863 
864 		error = uvm_map_clean(&p->p_vmspace->vm_map, addr, addr + size,
865 		    PGO_DEACTIVATE);
866 		break;
867 
868 	case MADV_FREE:
869 
870 		/*
871 		 * These pages contain no valid data, and may be
872 		 * garbage-collected.  Toss all resources, including
873 		 * any swap space in use.
874 		 */
875 
876 		error = uvm_map_clean(&p->p_vmspace->vm_map, addr, addr + size,
877 		    PGO_FREE);
878 		break;
879 
880 	case MADV_SPACEAVAIL:
881 
882 		/*
883 		 * XXXMRG What is this?  I think it's:
884 		 *
885 		 *	Ensure that we have allocated backing-store
886 		 *	for these pages.
887 		 *
888 		 * This is going to require changes to the page daemon,
889 		 * as it will free swap space allocated to pages in core.
890 		 * There's also what to do for device/file/anonymous memory.
891 		 */
892 
893 		return (EINVAL);
894 
895 	default:
896 		return (EINVAL);
897 	}
898 
899 	return error;
900 }
901 
902 /*
903  * sys_mlock: memory lock
904  */
905 
906 int
907 sys_mlock(struct lwp *l, const struct sys_mlock_args *uap, register_t *retval)
908 {
909 	/* {
910 		syscallarg(const void *) addr;
911 		syscallarg(size_t) len;
912 	} */
913 	struct proc *p = l->l_proc;
914 	vaddr_t addr;
915 	vsize_t size, pageoff;
916 	int error;
917 
918 	/*
919 	 * extract syscall args from uap
920 	 */
921 
922 	addr = (vaddr_t)SCARG(uap, addr);
923 	size = (vsize_t)SCARG(uap, len);
924 
925 	/*
926 	 * align the address to a page boundary and adjust the size accordingly
927 	 */
928 
929 	pageoff = (addr & PAGE_MASK);
930 	addr -= pageoff;
931 	size += pageoff;
932 	size = (vsize_t)round_page(size);
933 
934 	error = range_test(addr, size, false);
935 	if (error)
936 		return error;
937 
938 	if (atop(size) + uvmexp.wired > uvmexp.wiredmax)
939 		return (EAGAIN);
940 
941 	if (size + ptoa(pmap_wired_count(vm_map_pmap(&p->p_vmspace->vm_map))) >
942 			p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur)
943 		return (EAGAIN);
944 
945 	error = uvm_map_pageable(&p->p_vmspace->vm_map, addr, addr+size, false,
946 	    0);
947 	if (error == EFAULT)
948 		error = ENOMEM;
949 	return error;
950 }
951 
952 /*
953  * sys_munlock: unlock wired pages
954  */
955 
956 int
957 sys_munlock(struct lwp *l, const struct sys_munlock_args *uap,
958     register_t *retval)
959 {
960 	/* {
961 		syscallarg(const void *) addr;
962 		syscallarg(size_t) len;
963 	} */
964 	struct proc *p = l->l_proc;
965 	vaddr_t addr;
966 	vsize_t size, pageoff;
967 	int error;
968 
969 	/*
970 	 * extract syscall args from uap
971 	 */
972 
973 	addr = (vaddr_t)SCARG(uap, addr);
974 	size = (vsize_t)SCARG(uap, len);
975 
976 	/*
977 	 * align the address to a page boundary, and adjust the size accordingly
978 	 */
979 
980 	pageoff = (addr & PAGE_MASK);
981 	addr -= pageoff;
982 	size += pageoff;
983 	size = (vsize_t)round_page(size);
984 
985 	error = range_test(addr, size, false);
986 	if (error)
987 		return error;
988 
989 	error = uvm_map_pageable(&p->p_vmspace->vm_map, addr, addr+size, true,
990 	    0);
991 	if (error == EFAULT)
992 		error = ENOMEM;
993 	return error;
994 }
995 
996 /*
997  * sys_mlockall: lock all pages mapped into an address space.
998  */
999 
1000 int
1001 sys_mlockall(struct lwp *l, const struct sys_mlockall_args *uap,
1002     register_t *retval)
1003 {
1004 	/* {
1005 		syscallarg(int) flags;
1006 	} */
1007 	struct proc *p = l->l_proc;
1008 	int error, flags;
1009 
1010 	flags = SCARG(uap, flags);
1011 
1012 	if (flags == 0 ||
1013 	    (flags & ~(MCL_CURRENT|MCL_FUTURE)) != 0)
1014 		return (EINVAL);
1015 
1016 	error = uvm_map_pageable_all(&p->p_vmspace->vm_map, flags,
1017 	    p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur);
1018 	return (error);
1019 }
1020 
1021 /*
1022  * sys_munlockall: unlock all pages mapped into an address space.
1023  */
1024 
1025 int
1026 sys_munlockall(struct lwp *l, const void *v, register_t *retval)
1027 {
1028 	struct proc *p = l->l_proc;
1029 
1030 	(void) uvm_map_pageable_all(&p->p_vmspace->vm_map, 0, 0);
1031 	return (0);
1032 }
1033 
1034 /*
1035  * uvm_mmap: internal version of mmap
1036  *
1037  * - used by sys_mmap and various framebuffers
1038  * - handle is a vnode pointer or NULL for MAP_ANON
1039  * - caller must page-align the file offset
1040  */
1041 
1042 int
1043 uvm_mmap(struct vm_map *map, vaddr_t *addr, vsize_t size, vm_prot_t prot,
1044     vm_prot_t maxprot, int flags, void *handle, voff_t foff, vsize_t locklimit)
1045 {
1046 	struct uvm_object *uobj;
1047 	struct vnode *vp;
1048 	vaddr_t align = 0;
1049 	int error;
1050 	int advice = UVM_ADV_NORMAL;
1051 	uvm_flag_t uvmflag = 0;
1052 	bool needwritemap;
1053 
1054 	/*
1055 	 * check params
1056 	 */
1057 
1058 	if (size == 0)
1059 		return(0);
1060 	if (foff & PAGE_MASK)
1061 		return(EINVAL);
1062 	if ((prot & maxprot) != prot)
1063 		return(EINVAL);
1064 
1065 	/*
1066 	 * for non-fixed mappings, round off the suggested address.
1067 	 * for fixed mappings, check alignment and zap old mappings.
1068 	 */
1069 
1070 	if ((flags & MAP_FIXED) == 0) {
1071 		*addr = round_page(*addr);
1072 	} else {
1073 		if (*addr & PAGE_MASK)
1074 			return(EINVAL);
1075 		uvmflag |= UVM_FLAG_FIXED;
1076 		(void) uvm_unmap(map, *addr, *addr + size);
1077 	}
1078 
1079 	/*
1080 	 * Try to see if any requested alignment can even be attemped.
1081 	 * Make sure we can express the alignment (asking for a >= 4GB
1082 	 * alignment on an ILP32 architecure make no sense) and the
1083 	 * alignment is at least for a page sized quanitiy.  If the
1084 	 * request was for a fixed mapping, make sure supplied address
1085 	 * adheres to the request alignment.
1086 	 */
1087 	align = (flags & MAP_ALIGNMENT_MASK) >> MAP_ALIGNMENT_SHIFT;
1088 	if (align) {
1089 		if (align >= sizeof(vaddr_t) * NBBY)
1090 			return(EINVAL);
1091 		align = 1L << align;
1092 		if (align < PAGE_SIZE)
1093 			return(EINVAL);
1094 		if (align >= vm_map_max(map))
1095 			return(ENOMEM);
1096 		if (flags & MAP_FIXED) {
1097 			if ((*addr & (align-1)) != 0)
1098 				return(EINVAL);
1099 			align = 0;
1100 		}
1101 	}
1102 
1103 	/*
1104 	 * check resource limits
1105 	 */
1106 
1107 	if (!VM_MAP_IS_KERNEL(map) &&
1108 	    (((rlim_t)curproc->p_vmspace->vm_map.size + (rlim_t)size) >
1109 	    curproc->p_rlimit[RLIMIT_AS].rlim_cur))
1110 		return ENOMEM;
1111 
1112 	/*
1113 	 * handle anon vs. non-anon mappings.   for non-anon mappings attach
1114 	 * to underlying vm object.
1115 	 */
1116 
1117 	if (flags & MAP_ANON) {
1118 		KASSERT(handle == NULL);
1119 		foff = UVM_UNKNOWN_OFFSET;
1120 		uobj = NULL;
1121 		if ((flags & MAP_SHARED) == 0)
1122 			/* XXX: defer amap create */
1123 			uvmflag |= UVM_FLAG_COPYONW;
1124 		else
1125 			/* shared: create amap now */
1126 			uvmflag |= UVM_FLAG_OVERLAY;
1127 
1128 	} else {
1129 		KASSERT(handle != NULL);
1130 		vp = (struct vnode *)handle;
1131 
1132 		/*
1133 		 * Don't allow mmap for EXEC if the file system
1134 		 * is mounted NOEXEC.
1135 		 */
1136 		if ((prot & PROT_EXEC) != 0 &&
1137 		    (vp->v_mount->mnt_flag & MNT_NOEXEC) != 0)
1138 			return (EACCES);
1139 
1140 		if (vp->v_type != VCHR) {
1141 			error = VOP_MMAP(vp, prot, curlwp->l_cred);
1142 			if (error) {
1143 				return error;
1144 			}
1145 			vref(vp);
1146 			uobj = &vp->v_uobj;
1147 
1148 			/*
1149 			 * If the vnode is being mapped with PROT_EXEC,
1150 			 * then mark it as text.
1151 			 */
1152 			if (prot & PROT_EXEC) {
1153 				vn_markexec(vp);
1154 			}
1155 		} else {
1156 			int i = maxprot;
1157 
1158 			/*
1159 			 * XXX Some devices don't like to be mapped with
1160 			 * XXX PROT_EXEC or PROT_WRITE, but we don't really
1161 			 * XXX have a better way of handling this, right now
1162 			 */
1163 			do {
1164 				uobj = udv_attach((void *) &vp->v_rdev,
1165 				    (flags & MAP_SHARED) ? i :
1166 				    (i & ~VM_PROT_WRITE), foff, size);
1167 				i--;
1168 			} while ((uobj == NULL) && (i > 0));
1169 			if (uobj == NULL)
1170 				return EINVAL;
1171 			advice = UVM_ADV_RANDOM;
1172 		}
1173 		if ((flags & MAP_SHARED) == 0) {
1174 			uvmflag |= UVM_FLAG_COPYONW;
1175 		}
1176 
1177 		/*
1178 		 * Set vnode flags to indicate the new kinds of mapping.
1179 		 * We take the vnode lock in exclusive mode here to serialize
1180 		 * with direct I/O.
1181 		 *
1182 		 * Safe to check for these flag values without a lock, as
1183 		 * long as a reference to the vnode is held.
1184 		 */
1185 		needwritemap = (vp->v_iflag & VI_WRMAP) == 0 &&
1186 			(flags & MAP_SHARED) != 0 &&
1187 			(maxprot & VM_PROT_WRITE) != 0;
1188 		if ((vp->v_vflag & VV_MAPPED) == 0 || needwritemap) {
1189 			vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1190 			vp->v_vflag |= VV_MAPPED;
1191 			if (needwritemap) {
1192 				mutex_enter(&vp->v_interlock);
1193 				vp->v_iflag |= VI_WRMAP;
1194 				mutex_exit(&vp->v_interlock);
1195 			}
1196 			VOP_UNLOCK(vp);
1197 		}
1198 	}
1199 
1200 	uvmflag = UVM_MAPFLAG(prot, maxprot,
1201 			(flags & MAP_SHARED) ? UVM_INH_SHARE : UVM_INH_COPY,
1202 			advice, uvmflag);
1203 	error = uvm_map(map, addr, size, uobj, foff, align, uvmflag);
1204 	if (error) {
1205 		if (uobj)
1206 			uobj->pgops->pgo_detach(uobj);
1207 		return error;
1208 	}
1209 
1210 	/*
1211 	 * POSIX 1003.1b -- if our address space was configured
1212 	 * to lock all future mappings, wire the one we just made.
1213 	 *
1214 	 * Also handle the MAP_WIRED flag here.
1215 	 */
1216 
1217 	if (prot == VM_PROT_NONE) {
1218 
1219 		/*
1220 		 * No more work to do in this case.
1221 		 */
1222 
1223 		return (0);
1224 	}
1225 	if ((flags & MAP_WIRED) != 0 || (map->flags & VM_MAP_WIREFUTURE) != 0) {
1226 		vm_map_lock(map);
1227 		if (atop(size) + uvmexp.wired > uvmexp.wiredmax ||
1228 		    (locklimit != 0 &&
1229 		     size + ptoa(pmap_wired_count(vm_map_pmap(map))) >
1230 		     locklimit)) {
1231 			vm_map_unlock(map);
1232 			uvm_unmap(map, *addr, *addr + size);
1233 			return ENOMEM;
1234 		}
1235 
1236 		/*
1237 		 * uvm_map_pageable() always returns the map unlocked.
1238 		 */
1239 
1240 		error = uvm_map_pageable(map, *addr, *addr + size,
1241 					 false, UVM_LK_ENTER);
1242 		if (error) {
1243 			uvm_unmap(map, *addr, *addr + size);
1244 			return error;
1245 		}
1246 		return (0);
1247 	}
1248 	return 0;
1249 }
1250 
1251 vaddr_t
1252 uvm_default_mapaddr(struct proc *p, vaddr_t base, vsize_t sz)
1253 {
1254 
1255 	return VM_DEFAULT_ADDRESS(base, sz);
1256 }
1257