xref: /freebsd/sys/vm/vm_mmap.c (revision d2387d42b8da231a5b95cbc313825fb2aadf26f6)
1 /*
2  * Copyright (c) 1988 University of Utah.
3  * Copyright (c) 1991, 1993
4  *	The Regents of the University of California.  All rights reserved.
5  *
6  * This code is derived from software contributed to Berkeley by
7  * the Systems Programming Group of the University of Utah Computer
8  * Science Department.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. All advertising materials mentioning features or use of this software
19  *    must display the following acknowledgement:
20  *	This product includes software developed by the University of
21  *	California, Berkeley and its contributors.
22  * 4. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  * from: Utah $Hdr: vm_mmap.c 1.6 91/10/21$
39  *
40  *	@(#)vm_mmap.c	8.4 (Berkeley) 1/12/94
41  */
42 
43 /*
44  * Mapped file (mmap) interface to VM
45  */
46 
47 #include <sys/cdefs.h>
48 __FBSDID("$FreeBSD$");
49 
50 #include "opt_compat.h"
51 #include "opt_mac.h"
52 
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/kernel.h>
56 #include <sys/lock.h>
57 #include <sys/mutex.h>
58 #include <sys/sysproto.h>
59 #include <sys/filedesc.h>
60 #include <sys/proc.h>
61 #include <sys/resource.h>
62 #include <sys/resourcevar.h>
63 #include <sys/vnode.h>
64 #include <sys/fcntl.h>
65 #include <sys/file.h>
66 #include <sys/mac.h>
67 #include <sys/mman.h>
68 #include <sys/mount.h>
69 #include <sys/conf.h>
70 #include <sys/stat.h>
71 #include <sys/vmmeter.h>
72 #include <sys/sysctl.h>
73 
74 #include <vm/vm.h>
75 #include <vm/vm_param.h>
76 #include <vm/pmap.h>
77 #include <vm/vm_map.h>
78 #include <vm/vm_object.h>
79 #include <vm/vm_page.h>
80 #include <vm/vm_pager.h>
81 #include <vm/vm_pageout.h>
82 #include <vm/vm_extern.h>
83 #include <vm/vm_page.h>
84 #include <vm/vm_kern.h>
85 
86 #ifndef _SYS_SYSPROTO_H_
87 struct sbrk_args {
88 	int incr;
89 };
90 #endif
91 
92 static int max_proc_mmap;
93 SYSCTL_INT(_vm, OID_AUTO, max_proc_mmap, CTLFLAG_RW, &max_proc_mmap, 0, "");
94 
95 /*
96  * Set the maximum number of vm_map_entry structures per process.  Roughly
97  * speaking vm_map_entry structures are tiny, so allowing them to eat 1/100
98  * of our KVM malloc space still results in generous limits.  We want a
99  * default that is good enough to prevent the kernel running out of resources
100  * if attacked from compromised user account but generous enough such that
101  * multi-threaded processes are not unduly inconvenienced.
102  */
103 static void vmmapentry_rsrc_init(void *);
104 SYSINIT(vmmersrc, SI_SUB_KVM_RSRC, SI_ORDER_FIRST, vmmapentry_rsrc_init, NULL)
105 
106 static void
107 vmmapentry_rsrc_init(dummy)
108         void *dummy;
109 {
110     max_proc_mmap = vm_kmem_size / sizeof(struct vm_map_entry);
111     max_proc_mmap /= 100;
112 }
113 
114 static int vm_mmap_vnode(struct thread *, vm_size_t, vm_prot_t, vm_prot_t *,
115     int *, struct vnode *, vm_ooffset_t, vm_object_t *);
116 
117 /*
118  * MPSAFE
119  */
120 /* ARGSUSED */
121 int
122 sbrk(td, uap)
123 	struct thread *td;
124 	struct sbrk_args *uap;
125 {
126 	/* Not yet implemented */
127 	/* mtx_lock(&Giant); */
128 	/* mtx_unlock(&Giant); */
129 	return (EOPNOTSUPP);
130 }
131 
132 #ifndef _SYS_SYSPROTO_H_
133 struct sstk_args {
134 	int incr;
135 };
136 #endif
137 
138 /*
139  * MPSAFE
140  */
141 /* ARGSUSED */
142 int
143 sstk(td, uap)
144 	struct thread *td;
145 	struct sstk_args *uap;
146 {
147 	/* Not yet implemented */
148 	/* mtx_lock(&Giant); */
149 	/* mtx_unlock(&Giant); */
150 	return (EOPNOTSUPP);
151 }
152 
153 #if defined(COMPAT_43) || defined(COMPAT_SUNOS)
154 #ifndef _SYS_SYSPROTO_H_
155 struct getpagesize_args {
156 	int dummy;
157 };
158 #endif
159 
160 /* ARGSUSED */
161 int
162 ogetpagesize(td, uap)
163 	struct thread *td;
164 	struct getpagesize_args *uap;
165 {
166 	/* MP SAFE */
167 	td->td_retval[0] = PAGE_SIZE;
168 	return (0);
169 }
170 #endif				/* COMPAT_43 || COMPAT_SUNOS */
171 
172 
173 /*
174  * Memory Map (mmap) system call.  Note that the file offset
175  * and address are allowed to be NOT page aligned, though if
176  * the MAP_FIXED flag it set, both must have the same remainder
177  * modulo the PAGE_SIZE (POSIX 1003.1b).  If the address is not
178  * page-aligned, the actual mapping starts at trunc_page(addr)
179  * and the return value is adjusted up by the page offset.
180  *
181  * Generally speaking, only character devices which are themselves
182  * memory-based, such as a video framebuffer, can be mmap'd.  Otherwise
183  * there would be no cache coherency between a descriptor and a VM mapping
184  * both to the same character device.
185  *
186  * Block devices can be mmap'd no matter what they represent.  Cache coherency
187  * is maintained as long as you do not write directly to the underlying
188  * character device.
189  */
190 #ifndef _SYS_SYSPROTO_H_
191 struct mmap_args {
192 	void *addr;
193 	size_t len;
194 	int prot;
195 	int flags;
196 	int fd;
197 	long pad;
198 	off_t pos;
199 };
200 #endif
201 
202 /*
203  * MPSAFE
204  */
205 int
206 mmap(td, uap)
207 	struct thread *td;
208 	struct mmap_args *uap;
209 {
210 	struct file *fp;
211 	struct vnode *vp;
212 	vm_offset_t addr;
213 	vm_size_t size, pageoff;
214 	vm_prot_t prot, maxprot;
215 	void *handle;
216 	int flags, error;
217 	off_t pos;
218 	struct vmspace *vms = td->td_proc->p_vmspace;
219 
220 	addr = (vm_offset_t) uap->addr;
221 	size = uap->len;
222 	prot = uap->prot & VM_PROT_ALL;
223 	flags = uap->flags;
224 	pos = uap->pos;
225 
226 	fp = NULL;
227 	/* make sure mapping fits into numeric range etc */
228 	if ((ssize_t) uap->len < 0 ||
229 	    ((flags & MAP_ANON) && uap->fd != -1))
230 		return (EINVAL);
231 
232 	if (flags & MAP_STACK) {
233 		if ((uap->fd != -1) ||
234 		    ((prot & (PROT_READ | PROT_WRITE)) != (PROT_READ | PROT_WRITE)))
235 			return (EINVAL);
236 		flags |= MAP_ANON;
237 		pos = 0;
238 	}
239 
240 	/*
241 	 * Align the file position to a page boundary,
242 	 * and save its page offset component.
243 	 */
244 	pageoff = (pos & PAGE_MASK);
245 	pos -= pageoff;
246 
247 	/* Adjust size for rounding (on both ends). */
248 	size += pageoff;			/* low end... */
249 	size = (vm_size_t) round_page(size);	/* hi end */
250 
251 	/*
252 	 * Check for illegal addresses.  Watch out for address wrap... Note
253 	 * that VM_*_ADDRESS are not constants due to casts (argh).
254 	 */
255 	if (flags & MAP_FIXED) {
256 		/*
257 		 * The specified address must have the same remainder
258 		 * as the file offset taken modulo PAGE_SIZE, so it
259 		 * should be aligned after adjustment by pageoff.
260 		 */
261 		addr -= pageoff;
262 		if (addr & PAGE_MASK)
263 			return (EINVAL);
264 		/* Address range must be all in user VM space. */
265 		if (addr < vm_map_min(&vms->vm_map) ||
266 		    addr + size > vm_map_max(&vms->vm_map))
267 			return (EINVAL);
268 		if (addr + size < addr)
269 			return (EINVAL);
270 	} else {
271 	/*
272 	 * XXX for non-fixed mappings where no hint is provided or
273 	 * the hint would fall in the potential heap space,
274 	 * place it after the end of the largest possible heap.
275 	 *
276 	 * There should really be a pmap call to determine a reasonable
277 	 * location.
278 	 */
279 		PROC_LOCK(td->td_proc);
280 		if (addr == 0 ||
281 		    (addr >= round_page((vm_offset_t)vms->vm_taddr) &&
282 		    addr < round_page((vm_offset_t)vms->vm_daddr +
283 		    lim_max(td->td_proc, RLIMIT_DATA))))
284 			addr = round_page((vm_offset_t)vms->vm_daddr +
285 			    lim_max(td->td_proc, RLIMIT_DATA));
286 		PROC_UNLOCK(td->td_proc);
287 	}
288 	if (flags & MAP_ANON) {
289 		/*
290 		 * Mapping blank space is trivial.
291 		 */
292 		handle = NULL;
293 		maxprot = VM_PROT_ALL;
294 		pos = 0;
295 	} else {
296 		/*
297 		 * Mapping file, get fp for validation. Obtain vnode and make
298 		 * sure it is of appropriate type.
299 		 * don't let the descriptor disappear on us if we block
300 		 */
301 		if ((error = fget(td, uap->fd, &fp)) != 0)
302 			goto done;
303 		if (fp->f_type != DTYPE_VNODE) {
304 			error = EINVAL;
305 			goto done;
306 		}
307 		/*
308 		 * POSIX shared-memory objects are defined to have
309 		 * kernel persistence, and are not defined to support
310 		 * read(2)/write(2) -- or even open(2).  Thus, we can
311 		 * use MAP_ASYNC to trade on-disk coherence for speed.
312 		 * The shm_open(3) library routine turns on the FPOSIXSHM
313 		 * flag to request this behavior.
314 		 */
315 		if (fp->f_flag & FPOSIXSHM)
316 			flags |= MAP_NOSYNC;
317 		vp = fp->f_vnode;
318 		/*
319 		 * Ensure that file and memory protections are
320 		 * compatible.  Note that we only worry about
321 		 * writability if mapping is shared; in this case,
322 		 * current and max prot are dictated by the open file.
323 		 * XXX use the vnode instead?  Problem is: what
324 		 * credentials do we use for determination? What if
325 		 * proc does a setuid?
326 		 */
327 		if (vp->v_mount->mnt_flag & MNT_NOEXEC)
328 			maxprot = VM_PROT_NONE;
329 		else
330 			maxprot = VM_PROT_EXECUTE;
331 		if (fp->f_flag & FREAD) {
332 			maxprot |= VM_PROT_READ;
333 		} else if (prot & PROT_READ) {
334 			error = EACCES;
335 			goto done;
336 		}
337 		/*
338 		 * If we are sharing potential changes (either via
339 		 * MAP_SHARED or via the implicit sharing of character
340 		 * device mappings), and we are trying to get write
341 		 * permission although we opened it without asking
342 		 * for it, bail out.
343 		 */
344 		if ((flags & MAP_SHARED) != 0 || vp->v_type == VCHR) {
345 			if ((fp->f_flag & FWRITE) != 0) {
346 				maxprot |= VM_PROT_WRITE;
347 			} else if ((prot & PROT_WRITE) != 0) {
348 				error = EACCES;
349 				goto done;
350 			}
351 		} else {
352 			maxprot |= VM_PROT_WRITE;
353 		}
354 		handle = (void *)vp;
355 	}
356 
357 	/*
358 	 * Do not allow more then a certain number of vm_map_entry structures
359 	 * per process.  Scale with the number of rforks sharing the map
360 	 * to make the limit reasonable for threads.
361 	 */
362 	if (max_proc_mmap &&
363 	    vms->vm_map.nentries >= max_proc_mmap * vms->vm_refcnt) {
364 		error = ENOMEM;
365 		goto done;
366 	}
367 
368 	error = vm_mmap(&vms->vm_map, &addr, size, prot, maxprot,
369 	    flags, handle, pos);
370 	if (error == 0)
371 		td->td_retval[0] = (register_t) (addr + pageoff);
372 done:
373 	if (fp)
374 		fdrop(fp, td);
375 
376 	return (error);
377 }
378 
379 #ifdef COMPAT_43
380 #ifndef _SYS_SYSPROTO_H_
381 struct ommap_args {
382 	caddr_t addr;
383 	int len;
384 	int prot;
385 	int flags;
386 	int fd;
387 	long pos;
388 };
389 #endif
390 int
391 ommap(td, uap)
392 	struct thread *td;
393 	struct ommap_args *uap;
394 {
395 	struct mmap_args nargs;
396 	static const char cvtbsdprot[8] = {
397 		0,
398 		PROT_EXEC,
399 		PROT_WRITE,
400 		PROT_EXEC | PROT_WRITE,
401 		PROT_READ,
402 		PROT_EXEC | PROT_READ,
403 		PROT_WRITE | PROT_READ,
404 		PROT_EXEC | PROT_WRITE | PROT_READ,
405 	};
406 
407 #define	OMAP_ANON	0x0002
408 #define	OMAP_COPY	0x0020
409 #define	OMAP_SHARED	0x0010
410 #define	OMAP_FIXED	0x0100
411 
412 	nargs.addr = uap->addr;
413 	nargs.len = uap->len;
414 	nargs.prot = cvtbsdprot[uap->prot & 0x7];
415 	nargs.flags = 0;
416 	if (uap->flags & OMAP_ANON)
417 		nargs.flags |= MAP_ANON;
418 	if (uap->flags & OMAP_COPY)
419 		nargs.flags |= MAP_COPY;
420 	if (uap->flags & OMAP_SHARED)
421 		nargs.flags |= MAP_SHARED;
422 	else
423 		nargs.flags |= MAP_PRIVATE;
424 	if (uap->flags & OMAP_FIXED)
425 		nargs.flags |= MAP_FIXED;
426 	nargs.fd = uap->fd;
427 	nargs.pos = uap->pos;
428 	return (mmap(td, &nargs));
429 }
430 #endif				/* COMPAT_43 */
431 
432 
433 #ifndef _SYS_SYSPROTO_H_
434 struct msync_args {
435 	void *addr;
436 	int len;
437 	int flags;
438 };
439 #endif
440 /*
441  * MPSAFE
442  */
443 int
444 msync(td, uap)
445 	struct thread *td;
446 	struct msync_args *uap;
447 {
448 	vm_offset_t addr;
449 	vm_size_t size, pageoff;
450 	int flags;
451 	vm_map_t map;
452 	int rv;
453 
454 	addr = (vm_offset_t) uap->addr;
455 	size = uap->len;
456 	flags = uap->flags;
457 
458 	pageoff = (addr & PAGE_MASK);
459 	addr -= pageoff;
460 	size += pageoff;
461 	size = (vm_size_t) round_page(size);
462 	if (addr + size < addr)
463 		return (EINVAL);
464 
465 	if ((flags & (MS_ASYNC|MS_INVALIDATE)) == (MS_ASYNC|MS_INVALIDATE))
466 		return (EINVAL);
467 
468 	map = &td->td_proc->p_vmspace->vm_map;
469 
470 	/*
471 	 * Clean the pages and interpret the return value.
472 	 */
473 	rv = vm_map_sync(map, addr, addr + size, (flags & MS_ASYNC) == 0,
474 	    (flags & MS_INVALIDATE) != 0);
475 	switch (rv) {
476 	case KERN_SUCCESS:
477 		return (0);
478 	case KERN_INVALID_ADDRESS:
479 		return (EINVAL);	/* Sun returns ENOMEM? */
480 	case KERN_INVALID_ARGUMENT:
481 		return (EBUSY);
482 	default:
483 		return (EINVAL);
484 	}
485 }
486 
487 #ifndef _SYS_SYSPROTO_H_
488 struct munmap_args {
489 	void *addr;
490 	size_t len;
491 };
492 #endif
493 /*
494  * MPSAFE
495  */
496 int
497 munmap(td, uap)
498 	struct thread *td;
499 	struct munmap_args *uap;
500 {
501 	vm_offset_t addr;
502 	vm_size_t size, pageoff;
503 	vm_map_t map;
504 
505 	addr = (vm_offset_t) uap->addr;
506 	size = uap->len;
507 	if (size == 0)
508 		return (EINVAL);
509 
510 	pageoff = (addr & PAGE_MASK);
511 	addr -= pageoff;
512 	size += pageoff;
513 	size = (vm_size_t) round_page(size);
514 	if (addr + size < addr)
515 		return (EINVAL);
516 
517 	/*
518 	 * Check for illegal addresses.  Watch out for address wrap...
519 	 */
520 	map = &td->td_proc->p_vmspace->vm_map;
521 	if (addr < vm_map_min(map) || addr + size > vm_map_max(map))
522 		return (EINVAL);
523 	vm_map_lock(map);
524 	/*
525 	 * Make sure entire range is allocated.
526 	 */
527 	if (!vm_map_check_protection(map, addr, addr + size, VM_PROT_NONE)) {
528 		vm_map_unlock(map);
529 		return (EINVAL);
530 	}
531 	/* returns nothing but KERN_SUCCESS anyway */
532 	vm_map_delete(map, addr, addr + size);
533 	vm_map_unlock(map);
534 	return (0);
535 }
536 
537 #ifndef _SYS_SYSPROTO_H_
538 struct mprotect_args {
539 	const void *addr;
540 	size_t len;
541 	int prot;
542 };
543 #endif
544 /*
545  * MPSAFE
546  */
547 int
548 mprotect(td, uap)
549 	struct thread *td;
550 	struct mprotect_args *uap;
551 {
552 	vm_offset_t addr;
553 	vm_size_t size, pageoff;
554 	vm_prot_t prot;
555 
556 	addr = (vm_offset_t) uap->addr;
557 	size = uap->len;
558 	prot = uap->prot & VM_PROT_ALL;
559 #if defined(VM_PROT_READ_IS_EXEC)
560 	if (prot & VM_PROT_READ)
561 		prot |= VM_PROT_EXECUTE;
562 #endif
563 
564 	pageoff = (addr & PAGE_MASK);
565 	addr -= pageoff;
566 	size += pageoff;
567 	size = (vm_size_t) round_page(size);
568 	if (addr + size < addr)
569 		return (EINVAL);
570 
571 	switch (vm_map_protect(&td->td_proc->p_vmspace->vm_map, addr,
572 	    addr + size, prot, FALSE)) {
573 	case KERN_SUCCESS:
574 		return (0);
575 	case KERN_PROTECTION_FAILURE:
576 		return (EACCES);
577 	}
578 	return (EINVAL);
579 }
580 
581 #ifndef _SYS_SYSPROTO_H_
582 struct minherit_args {
583 	void *addr;
584 	size_t len;
585 	int inherit;
586 };
587 #endif
588 /*
589  * MPSAFE
590  */
591 int
592 minherit(td, uap)
593 	struct thread *td;
594 	struct minherit_args *uap;
595 {
596 	vm_offset_t addr;
597 	vm_size_t size, pageoff;
598 	vm_inherit_t inherit;
599 
600 	addr = (vm_offset_t)uap->addr;
601 	size = uap->len;
602 	inherit = uap->inherit;
603 
604 	pageoff = (addr & PAGE_MASK);
605 	addr -= pageoff;
606 	size += pageoff;
607 	size = (vm_size_t) round_page(size);
608 	if (addr + size < addr)
609 		return (EINVAL);
610 
611 	switch (vm_map_inherit(&td->td_proc->p_vmspace->vm_map, addr,
612 	    addr + size, inherit)) {
613 	case KERN_SUCCESS:
614 		return (0);
615 	case KERN_PROTECTION_FAILURE:
616 		return (EACCES);
617 	}
618 	return (EINVAL);
619 }
620 
621 #ifndef _SYS_SYSPROTO_H_
622 struct madvise_args {
623 	void *addr;
624 	size_t len;
625 	int behav;
626 };
627 #endif
628 
629 /*
630  * MPSAFE
631  */
632 /* ARGSUSED */
633 int
634 madvise(td, uap)
635 	struct thread *td;
636 	struct madvise_args *uap;
637 {
638 	vm_offset_t start, end;
639 	vm_map_t map;
640 	struct proc *p;
641 	int error;
642 
643 	/*
644 	 * Check for our special case, advising the swap pager we are
645 	 * "immortal."
646 	 */
647 	if (uap->behav == MADV_PROTECT) {
648 		error = suser(td);
649 		if (error == 0) {
650 			p = td->td_proc;
651 			PROC_LOCK(p);
652 			p->p_flag |= P_PROTECTED;
653 			PROC_UNLOCK(p);
654 		}
655 		return (error);
656 	}
657 	/*
658 	 * Check for illegal behavior
659 	 */
660 	if (uap->behav < 0 || uap->behav > MADV_CORE)
661 		return (EINVAL);
662 	/*
663 	 * Check for illegal addresses.  Watch out for address wrap... Note
664 	 * that VM_*_ADDRESS are not constants due to casts (argh).
665 	 */
666 	map = &td->td_proc->p_vmspace->vm_map;
667 	if ((vm_offset_t)uap->addr < vm_map_min(map) ||
668 	    (vm_offset_t)uap->addr + uap->len > vm_map_max(map))
669 		return (EINVAL);
670 	if (((vm_offset_t) uap->addr + uap->len) < (vm_offset_t) uap->addr)
671 		return (EINVAL);
672 
673 	/*
674 	 * Since this routine is only advisory, we default to conservative
675 	 * behavior.
676 	 */
677 	start = trunc_page((vm_offset_t) uap->addr);
678 	end = round_page((vm_offset_t) uap->addr + uap->len);
679 
680 	if (vm_map_madvise(map, start, end, uap->behav))
681 		return (EINVAL);
682 	return (0);
683 }
684 
685 #ifndef _SYS_SYSPROTO_H_
686 struct mincore_args {
687 	const void *addr;
688 	size_t len;
689 	char *vec;
690 };
691 #endif
692 
693 /*
694  * MPSAFE
695  */
696 /* ARGSUSED */
697 int
698 mincore(td, uap)
699 	struct thread *td;
700 	struct mincore_args *uap;
701 {
702 	vm_offset_t addr, first_addr;
703 	vm_offset_t end, cend;
704 	pmap_t pmap;
705 	vm_map_t map;
706 	char *vec;
707 	int error = 0;
708 	int vecindex, lastvecindex;
709 	vm_map_entry_t current;
710 	vm_map_entry_t entry;
711 	int mincoreinfo;
712 	unsigned int timestamp;
713 
714 	/*
715 	 * Make sure that the addresses presented are valid for user
716 	 * mode.
717 	 */
718 	first_addr = addr = trunc_page((vm_offset_t) uap->addr);
719 	end = addr + (vm_size_t)round_page(uap->len);
720 	map = &td->td_proc->p_vmspace->vm_map;
721 	if (end > vm_map_max(map) || end < addr)
722 		return (EINVAL);
723 
724 	/*
725 	 * Address of byte vector
726 	 */
727 	vec = uap->vec;
728 
729 	pmap = vmspace_pmap(td->td_proc->p_vmspace);
730 
731 	vm_map_lock_read(map);
732 RestartScan:
733 	timestamp = map->timestamp;
734 
735 	if (!vm_map_lookup_entry(map, addr, &entry))
736 		entry = entry->next;
737 
738 	/*
739 	 * Do this on a map entry basis so that if the pages are not
740 	 * in the current processes address space, we can easily look
741 	 * up the pages elsewhere.
742 	 */
743 	lastvecindex = -1;
744 	for (current = entry;
745 	    (current != &map->header) && (current->start < end);
746 	    current = current->next) {
747 
748 		/*
749 		 * ignore submaps (for now) or null objects
750 		 */
751 		if ((current->eflags & MAP_ENTRY_IS_SUB_MAP) ||
752 			current->object.vm_object == NULL)
753 			continue;
754 
755 		/*
756 		 * limit this scan to the current map entry and the
757 		 * limits for the mincore call
758 		 */
759 		if (addr < current->start)
760 			addr = current->start;
761 		cend = current->end;
762 		if (cend > end)
763 			cend = end;
764 
765 		/*
766 		 * scan this entry one page at a time
767 		 */
768 		while (addr < cend) {
769 			/*
770 			 * Check pmap first, it is likely faster, also
771 			 * it can provide info as to whether we are the
772 			 * one referencing or modifying the page.
773 			 */
774 			mtx_lock(&Giant);
775 			mincoreinfo = pmap_mincore(pmap, addr);
776 			mtx_unlock(&Giant);
777 			if (!mincoreinfo) {
778 				vm_pindex_t pindex;
779 				vm_ooffset_t offset;
780 				vm_page_t m;
781 				/*
782 				 * calculate the page index into the object
783 				 */
784 				offset = current->offset + (addr - current->start);
785 				pindex = OFF_TO_IDX(offset);
786 				VM_OBJECT_LOCK(current->object.vm_object);
787 				m = vm_page_lookup(current->object.vm_object,
788 					pindex);
789 				/*
790 				 * if the page is resident, then gather information about
791 				 * it.
792 				 */
793 				if (m != NULL && m->valid != 0) {
794 					mincoreinfo = MINCORE_INCORE;
795 					vm_page_lock_queues();
796 					if (m->dirty ||
797 						pmap_is_modified(m))
798 						mincoreinfo |= MINCORE_MODIFIED_OTHER;
799 					if ((m->flags & PG_REFERENCED) ||
800 						pmap_ts_referenced(m)) {
801 						vm_page_flag_set(m, PG_REFERENCED);
802 						mincoreinfo |= MINCORE_REFERENCED_OTHER;
803 					}
804 					vm_page_unlock_queues();
805 				}
806 				VM_OBJECT_UNLOCK(current->object.vm_object);
807 			}
808 
809 			/*
810 			 * subyte may page fault.  In case it needs to modify
811 			 * the map, we release the lock.
812 			 */
813 			vm_map_unlock_read(map);
814 
815 			/*
816 			 * calculate index into user supplied byte vector
817 			 */
818 			vecindex = OFF_TO_IDX(addr - first_addr);
819 
820 			/*
821 			 * If we have skipped map entries, we need to make sure that
822 			 * the byte vector is zeroed for those skipped entries.
823 			 */
824 			while ((lastvecindex + 1) < vecindex) {
825 				error = subyte(vec + lastvecindex, 0);
826 				if (error) {
827 					error = EFAULT;
828 					goto done2;
829 				}
830 				++lastvecindex;
831 			}
832 
833 			/*
834 			 * Pass the page information to the user
835 			 */
836 			error = subyte(vec + vecindex, mincoreinfo);
837 			if (error) {
838 				error = EFAULT;
839 				goto done2;
840 			}
841 
842 			/*
843 			 * If the map has changed, due to the subyte, the previous
844 			 * output may be invalid.
845 			 */
846 			vm_map_lock_read(map);
847 			if (timestamp != map->timestamp)
848 				goto RestartScan;
849 
850 			lastvecindex = vecindex;
851 			addr += PAGE_SIZE;
852 		}
853 	}
854 
855 	/*
856 	 * subyte may page fault.  In case it needs to modify
857 	 * the map, we release the lock.
858 	 */
859 	vm_map_unlock_read(map);
860 
861 	/*
862 	 * Zero the last entries in the byte vector.
863 	 */
864 	vecindex = OFF_TO_IDX(end - first_addr);
865 	while ((lastvecindex + 1) < vecindex) {
866 		error = subyte(vec + lastvecindex, 0);
867 		if (error) {
868 			error = EFAULT;
869 			goto done2;
870 		}
871 		++lastvecindex;
872 	}
873 
874 	/*
875 	 * If the map has changed, due to the subyte, the previous
876 	 * output may be invalid.
877 	 */
878 	vm_map_lock_read(map);
879 	if (timestamp != map->timestamp)
880 		goto RestartScan;
881 	vm_map_unlock_read(map);
882 done2:
883 	return (error);
884 }
885 
886 #ifndef _SYS_SYSPROTO_H_
887 struct mlock_args {
888 	const void *addr;
889 	size_t len;
890 };
891 #endif
892 /*
893  * MPSAFE
894  */
895 int
896 mlock(td, uap)
897 	struct thread *td;
898 	struct mlock_args *uap;
899 {
900 	struct proc *proc;
901 	vm_offset_t addr, end, last, start;
902 	vm_size_t npages, size;
903 	int error;
904 
905 	error = suser(td);
906 	if (error)
907 		return (error);
908 	addr = (vm_offset_t)uap->addr;
909 	size = uap->len;
910 	last = addr + size;
911 	start = trunc_page(addr);
912 	end = round_page(last);
913 	if (last < addr || end < addr)
914 		return (EINVAL);
915 	npages = atop(end - start);
916 	if (npages > vm_page_max_wired)
917 		return (ENOMEM);
918 	proc = td->td_proc;
919 	PROC_LOCK(proc);
920 	if (ptoa(npages +
921 	    pmap_wired_count(vm_map_pmap(&proc->p_vmspace->vm_map))) >
922 	    lim_cur(proc, RLIMIT_MEMLOCK)) {
923 		PROC_UNLOCK(proc);
924 		return (ENOMEM);
925 	}
926 	PROC_UNLOCK(proc);
927 	if (npages + cnt.v_wire_count > vm_page_max_wired)
928 		return (EAGAIN);
929 	error = vm_map_wire(&proc->p_vmspace->vm_map, start, end,
930 	    VM_MAP_WIRE_USER | VM_MAP_WIRE_NOHOLES);
931 	return (error == KERN_SUCCESS ? 0 : ENOMEM);
932 }
933 
934 #ifndef _SYS_SYSPROTO_H_
935 struct mlockall_args {
936 	int	how;
937 };
938 #endif
939 
940 /*
941  * MPSAFE
942  */
943 int
944 mlockall(td, uap)
945 	struct thread *td;
946 	struct mlockall_args *uap;
947 {
948 	vm_map_t map;
949 	int error;
950 
951 	map = &td->td_proc->p_vmspace->vm_map;
952 	error = 0;
953 
954 	if ((uap->how == 0) || ((uap->how & ~(MCL_CURRENT|MCL_FUTURE)) != 0))
955 		return (EINVAL);
956 
957 #if 0
958 	/*
959 	 * If wiring all pages in the process would cause it to exceed
960 	 * a hard resource limit, return ENOMEM.
961 	 */
962 	PROC_LOCK(td->td_proc);
963 	if (map->size - ptoa(pmap_wired_count(vm_map_pmap(map)) >
964 		lim_cur(td->td_proc, RLIMIT_MEMLOCK))) {
965 		PROC_UNLOCK(td->td_proc);
966 		return (ENOMEM);
967 	}
968 	PROC_UNLOCK(td->td_proc);
969 #else
970 	error = suser(td);
971 	if (error)
972 		return (error);
973 #endif
974 
975 	if (uap->how & MCL_FUTURE) {
976 		vm_map_lock(map);
977 		vm_map_modflags(map, MAP_WIREFUTURE, 0);
978 		vm_map_unlock(map);
979 		error = 0;
980 	}
981 
982 	if (uap->how & MCL_CURRENT) {
983 		/*
984 		 * P1003.1-2001 mandates that all currently mapped pages
985 		 * will be memory resident and locked (wired) upon return
986 		 * from mlockall(). vm_map_wire() will wire pages, by
987 		 * calling vm_fault_wire() for each page in the region.
988 		 */
989 		error = vm_map_wire(map, vm_map_min(map), vm_map_max(map),
990 		    VM_MAP_WIRE_USER|VM_MAP_WIRE_HOLESOK);
991 		error = (error == KERN_SUCCESS ? 0 : EAGAIN);
992 	}
993 
994 	return (error);
995 }
996 
997 #ifndef _SYS_SYSPROTO_H_
998 struct munlockall_args {
999 	register_t dummy;
1000 };
1001 #endif
1002 
1003 /*
1004  * MPSAFE
1005  */
1006 int
1007 munlockall(td, uap)
1008 	struct thread *td;
1009 	struct munlockall_args *uap;
1010 {
1011 	vm_map_t map;
1012 	int error;
1013 
1014 	map = &td->td_proc->p_vmspace->vm_map;
1015 	error = suser(td);
1016 	if (error)
1017 		return (error);
1018 
1019 	/* Clear the MAP_WIREFUTURE flag from this vm_map. */
1020 	vm_map_lock(map);
1021 	vm_map_modflags(map, 0, MAP_WIREFUTURE);
1022 	vm_map_unlock(map);
1023 
1024 	/* Forcibly unwire all pages. */
1025 	error = vm_map_unwire(map, vm_map_min(map), vm_map_max(map),
1026 	    VM_MAP_WIRE_USER|VM_MAP_WIRE_HOLESOK);
1027 
1028 	return (error);
1029 }
1030 
1031 #ifndef _SYS_SYSPROTO_H_
1032 struct munlock_args {
1033 	const void *addr;
1034 	size_t len;
1035 };
1036 #endif
1037 /*
1038  * MPSAFE
1039  */
1040 int
1041 munlock(td, uap)
1042 	struct thread *td;
1043 	struct munlock_args *uap;
1044 {
1045 	vm_offset_t addr, end, last, start;
1046 	vm_size_t size;
1047 	int error;
1048 
1049 	error = suser(td);
1050 	if (error)
1051 		return (error);
1052 	addr = (vm_offset_t)uap->addr;
1053 	size = uap->len;
1054 	last = addr + size;
1055 	start = trunc_page(addr);
1056 	end = round_page(last);
1057 	if (last < addr || end < addr)
1058 		return (EINVAL);
1059 	error = vm_map_unwire(&td->td_proc->p_vmspace->vm_map, start, end,
1060 	    VM_MAP_WIRE_USER | VM_MAP_WIRE_NOHOLES);
1061 	return (error == KERN_SUCCESS ? 0 : ENOMEM);
1062 }
1063 
1064 /*
1065  * vm_mmap_vnode()
1066  *
1067  * MPSAFE
1068  *
1069  * Helper function for vm_mmap.  Perform sanity check specific for mmap
1070  * operations on vnodes.
1071  */
1072 int
1073 vm_mmap_vnode(struct thread *td, vm_size_t objsize,
1074     vm_prot_t prot, vm_prot_t *maxprotp, int *flagsp,
1075     struct vnode *vp, vm_ooffset_t foff, vm_object_t *objp)
1076 {
1077 	struct vattr va;
1078 	void *handle;
1079 	vm_object_t obj;
1080 	int disablexworkaround, error, flags, type;
1081 
1082 	mtx_lock(&Giant);
1083 	if ((error = vget(vp, LK_EXCLUSIVE, td)) != 0) {
1084 		mtx_unlock(&Giant);
1085 		return (error);
1086 	}
1087 	flags = *flagsp;
1088 	if (vp->v_type == VREG) {
1089 		/*
1090 		 * Get the proper underlying object
1091 		 */
1092 		if (VOP_GETVOBJECT(vp, &obj) != 0) {
1093 			error = EINVAL;
1094 			goto done;
1095 		}
1096 		if (obj->handle != vp) {
1097 			vput(vp);
1098 			vp = (struct vnode*)obj->handle;
1099 			vget(vp, LK_EXCLUSIVE, td);
1100 		}
1101 		type = OBJT_VNODE;
1102 		handle = vp;
1103 	} else if (vp->v_type == VCHR) {
1104 		type = OBJT_DEVICE;
1105 		handle = vp->v_rdev;
1106 
1107 		if(vp->v_rdev->si_devsw->d_flags & D_MMAP_ANON) {
1108 			*maxprotp = VM_PROT_ALL;
1109 			*flagsp |= MAP_ANON;
1110 			error = 0;
1111 			goto done;
1112 		}
1113 		/*
1114 		 * cdevs does not provide private mappings of any kind.
1115 		 */
1116 		/*
1117 		 * However, for XIG X server to continue to work,
1118 		 * we should allow the superuser to do it anyway.
1119 		 * We only allow it at securelevel < 1.
1120 		 * (Because the XIG X server writes directly to video
1121 		 * memory via /dev/mem, it should never work at any
1122 		 * other securelevel.
1123 		 * XXX this will have to go
1124 		 */
1125 		if (securelevel_ge(td->td_ucred, 1))
1126 			disablexworkaround = 1;
1127 		else
1128 			disablexworkaround = suser(td);
1129 		if (disablexworkaround && (flags & (MAP_PRIVATE|MAP_COPY))) {
1130 			error = EINVAL;
1131 			goto done;
1132 		}
1133 		/*
1134 		 * Force device mappings to be shared.
1135 		 */
1136 		flags &= ~(MAP_PRIVATE|MAP_COPY);
1137 		flags |= MAP_SHARED;
1138 	} else {
1139 		error = EINVAL;
1140 		goto done;
1141 	}
1142 	if ((error = VOP_GETATTR(vp, &va, td->td_ucred, td))) {
1143 		goto done;
1144 	}
1145 	if ((flags & MAP_SHARED) != 0) {
1146 		if ((va.va_flags & (SF_SNAPSHOT|IMMUTABLE|APPEND)) != 0) {
1147 			if (prot & PROT_WRITE) {
1148 				error = EPERM;
1149 				goto done;
1150 			}
1151 			*maxprotp &= ~VM_PROT_WRITE;
1152 		}
1153 #ifdef MAC
1154 		error = mac_check_vnode_mmap(td->td_ucred, vp, prot);
1155 		if (error != 0)
1156 			goto done;
1157 #endif
1158 	}
1159 	/*
1160 	 * If it is a regular file without any references
1161 	 * we do not need to sync it.
1162 	 * Adjust object size to be the size of actual file.
1163 	 */
1164 	if (vp->v_type == VREG) {
1165 		objsize = round_page(va.va_size);
1166 		if (va.va_nlink == 0)
1167 			flags |= MAP_NOSYNC;
1168 	}
1169 	obj = vm_pager_allocate(type, handle, objsize, prot, foff);
1170 	if (obj == NULL) {
1171 		error = (type == OBJT_DEVICE ? EINVAL : ENOMEM);
1172 		goto done;
1173 	}
1174 	*objp = obj;
1175 	*flagsp = flags;
1176 done:
1177 	vput(vp);
1178 	mtx_unlock(&Giant);
1179 	return (error);
1180 }
1181 
1182 /*
1183  * vm_mmap()
1184  *
1185  * MPSAFE
1186  *
1187  * Internal version of mmap.  Currently used by mmap, exec, and sys5
1188  * shared memory.  Handle is either a vnode pointer or NULL for MAP_ANON.
1189  */
1190 int
1191 vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot,
1192 	vm_prot_t maxprot, int flags,
1193 	void *handle,
1194 	vm_ooffset_t foff)
1195 {
1196 	boolean_t fitit;
1197 	vm_object_t object;
1198 	int rv = KERN_SUCCESS;
1199 	vm_ooffset_t objsize;
1200 	int docow, error;
1201 	struct thread *td = curthread;
1202 
1203 	if (size == 0)
1204 		return (0);
1205 
1206 	objsize = size = round_page(size);
1207 
1208 	PROC_LOCK(td->td_proc);
1209 	if (td->td_proc->p_vmspace->vm_map.size + size >
1210 	    lim_cur(td->td_proc, RLIMIT_VMEM)) {
1211 		PROC_UNLOCK(td->td_proc);
1212 		return(ENOMEM);
1213 	}
1214 	PROC_UNLOCK(td->td_proc);
1215 
1216 	/*
1217 	 * We currently can only deal with page aligned file offsets.
1218 	 * The check is here rather than in the syscall because the
1219 	 * kernel calls this function internally for other mmaping
1220 	 * operations (such as in exec) and non-aligned offsets will
1221 	 * cause pmap inconsistencies...so we want to be sure to
1222 	 * disallow this in all cases.
1223 	 */
1224 	if (foff & PAGE_MASK)
1225 		return (EINVAL);
1226 
1227 	if ((flags & MAP_FIXED) == 0) {
1228 		fitit = TRUE;
1229 		*addr = round_page(*addr);
1230 	} else {
1231 		if (*addr != trunc_page(*addr))
1232 			return (EINVAL);
1233 		fitit = FALSE;
1234 		(void) vm_map_remove(map, *addr, *addr + size);
1235 	}
1236 	/*
1237 	 * Lookup/allocate object.
1238 	 */
1239 	if (handle != NULL) {
1240 		error = vm_mmap_vnode(td, size, prot, &maxprot, &flags,
1241 		    handle, foff, &object);
1242 		if (error) {
1243 			return (error);
1244 		}
1245 	}
1246 	if (flags & MAP_ANON) {
1247 		object = NULL;
1248 		docow = 0;
1249 		/*
1250 		 * Unnamed anonymous regions always start at 0.
1251 		 */
1252 		if (handle == 0)
1253 			foff = 0;
1254 	} else {
1255 		docow = MAP_PREFAULT_PARTIAL;
1256 	}
1257 
1258 	if ((flags & (MAP_ANON|MAP_SHARED)) == 0)
1259 		docow |= MAP_COPY_ON_WRITE;
1260 	if (flags & MAP_NOSYNC)
1261 		docow |= MAP_DISABLE_SYNCER;
1262 	if (flags & MAP_NOCORE)
1263 		docow |= MAP_DISABLE_COREDUMP;
1264 
1265 #if defined(VM_PROT_READ_IS_EXEC)
1266 	if (prot & VM_PROT_READ)
1267 		prot |= VM_PROT_EXECUTE;
1268 
1269 	if (maxprot & VM_PROT_READ)
1270 		maxprot |= VM_PROT_EXECUTE;
1271 #endif
1272 
1273 	if (fitit)
1274 		*addr = pmap_addr_hint(object, *addr, size);
1275 
1276 	if (flags & MAP_STACK)
1277 		rv = vm_map_stack(map, *addr, size, prot, maxprot,
1278 		    docow | MAP_STACK_GROWS_DOWN);
1279 	else
1280 		rv = vm_map_find(map, object, foff, addr, size, fitit,
1281 				 prot, maxprot, docow);
1282 
1283 	if (rv != KERN_SUCCESS) {
1284 		/*
1285 		 * Lose the object reference. Will destroy the
1286 		 * object if it's an unnamed anonymous mapping
1287 		 * or named anonymous without other references.
1288 		 */
1289 		vm_object_deallocate(object);
1290 	} else if (flags & MAP_SHARED) {
1291 		/*
1292 		 * Shared memory is also shared with children.
1293 		 */
1294 		rv = vm_map_inherit(map, *addr, *addr + size, VM_INHERIT_SHARE);
1295 		if (rv != KERN_SUCCESS)
1296 			(void) vm_map_remove(map, *addr, *addr + size);
1297 	}
1298 
1299 	/*
1300 	 * If the process has requested that all future mappings
1301 	 * be wired, then heed this.
1302 	 */
1303 	if ((rv == KERN_SUCCESS) && (map->flags & MAP_WIREFUTURE))
1304 		vm_map_wire(map, *addr, *addr + size,
1305 		    VM_MAP_WIRE_USER|VM_MAP_WIRE_NOHOLES);
1306 
1307 	switch (rv) {
1308 	case KERN_SUCCESS:
1309 		return (0);
1310 	case KERN_INVALID_ADDRESS:
1311 	case KERN_NO_SPACE:
1312 		return (ENOMEM);
1313 	case KERN_PROTECTION_FAILURE:
1314 		return (EACCES);
1315 	default:
1316 		return (EINVAL);
1317 	}
1318 }
1319