xref: /dragonfly/sys/vm/vm_mmap.c (revision 0212bfce)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 1988 University of Utah.
5  * Copyright (c) 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * This code is derived from software contributed to Berkeley by
9  * the Systems Programming Group of the University of Utah Computer
10  * Science Department.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  * from: Utah $Hdr: vm_mmap.c 1.6 91/10/21$
37  *
38  *	@(#)vm_mmap.c	8.4 (Berkeley) 1/12/94
39  * $FreeBSD: src/sys/vm/vm_mmap.c,v 1.108.2.6 2002/07/02 20:06:19 dillon Exp $
40  */
41 
42 /*
43  * Mapped file (mmap) interface to VM
44  */
45 
46 #include <sys/param.h>
47 #include <sys/kernel.h>
48 #include <sys/systm.h>
49 #include <sys/sysproto.h>
50 #include <sys/filedesc.h>
51 #include <sys/kern_syscall.h>
52 #include <sys/proc.h>
53 #include <sys/priv.h>
54 #include <sys/resource.h>
55 #include <sys/resourcevar.h>
56 #include <sys/vnode.h>
57 #include <sys/fcntl.h>
58 #include <sys/file.h>
59 #include <sys/mman.h>
60 #include <sys/conf.h>
61 #include <sys/stat.h>
62 #include <sys/vmmeter.h>
63 #include <sys/sysctl.h>
64 
65 #include <vm/vm.h>
66 #include <vm/vm_param.h>
67 #include <sys/lock.h>
68 #include <vm/pmap.h>
69 #include <vm/vm_map.h>
70 #include <vm/vm_object.h>
71 #include <vm/vm_page.h>
72 #include <vm/vm_pager.h>
73 #include <vm/vm_pageout.h>
74 #include <vm/vm_extern.h>
75 #include <vm/vm_kern.h>
76 
77 #include <sys/file2.h>
78 #include <sys/thread.h>
79 #include <vm/vm_page2.h>
80 
81 static int max_proc_mmap = 1000000;
82 SYSCTL_INT(_vm, OID_AUTO, max_proc_mmap, CTLFLAG_RW, &max_proc_mmap, 0, "");
83 int vkernel_enable;
84 SYSCTL_INT(_vm, OID_AUTO, vkernel_enable, CTLFLAG_RW, &vkernel_enable, 0, "");
85 
86 /*
87  * sstk_args(int incr)
88  *
89  * MPSAFE
90  */
91 int
92 sys_sstk(struct sstk_args *uap)
93 {
94 	/* Not yet implemented */
95 	return (EOPNOTSUPP);
96 }
97 
98 /*
99  * mmap_args(void *addr, size_t len, int prot, int flags, int fd,
100  *		long pad, off_t pos)
101  *
102  * Memory Map (mmap) system call.  Note that the file offset
103  * and address are allowed to be NOT page aligned, though if
104  * the MAP_FIXED flag it set, both must have the same remainder
105  * modulo the PAGE_SIZE (POSIX 1003.1b).  If the address is not
106  * page-aligned, the actual mapping starts at trunc_page(addr)
107  * and the return value is adjusted up by the page offset.
108  *
109  * Generally speaking, only character devices which are themselves
110  * memory-based, such as a video framebuffer, can be mmap'd.  Otherwise
111  * there would be no cache coherency between a descriptor and a VM mapping
112  * both to the same character device.
113  *
114  * Block devices can be mmap'd no matter what they represent.  Cache coherency
115  * is maintained as long as you do not write directly to the underlying
116  * character device.
117  *
118  * No requirements
119  */
120 int
121 kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen,
122 	  int uprot, int uflags, int fd, off_t upos, void **res)
123 {
124 	struct thread *td = curthread;
125  	struct proc *p = td->td_proc;
126 	struct file *fp = NULL;
127 	struct vnode *vp;
128 	vm_offset_t addr;
129 	vm_offset_t tmpaddr;
130 	vm_size_t size, pageoff;
131 	vm_prot_t prot, maxprot;
132 	void *handle;
133 	int flags, error;
134 	off_t pos;
135 	vm_object_t obj;
136 
137 	KKASSERT(p);
138 
139 	addr = (vm_offset_t) uaddr;
140 	size = ulen;
141 	prot = uprot & VM_PROT_ALL;
142 	flags = uflags;
143 	pos = upos;
144 
145 	/*
146 	 * Make sure mapping fits into numeric range etc.
147 	 *
148 	 * NOTE: We support the full unsigned range for size now.
149 	 */
150 	if (((flags & MAP_ANON) && (fd != -1 || pos != 0)))
151 		return (EINVAL);
152 
153 	if (size == 0)
154 		return (EINVAL);
155 
156 	if (flags & MAP_STACK) {
157 		if (fd != -1)
158 			return (EINVAL);
159 		if ((prot & (PROT_READ|PROT_WRITE)) != (PROT_READ|PROT_WRITE))
160 			return (EINVAL);
161 		flags |= MAP_ANON;
162 		pos = 0;
163 	}
164 
165 	/*
166 	 * Virtual page tables cannot be used with MAP_STACK.  Apart from
167 	 * it not making any sense, the aux union is used by both
168 	 * types.
169 	 *
170 	 * Because the virtual page table is stored in the backing object
171 	 * and might be updated by the kernel, the mapping must be R+W.
172 	 */
173 	if (flags & MAP_VPAGETABLE) {
174 		if (vkernel_enable == 0)
175 			return (EOPNOTSUPP);
176 		if (flags & MAP_STACK)
177 			return (EINVAL);
178 		if ((prot & (PROT_READ|PROT_WRITE)) != (PROT_READ|PROT_WRITE))
179 			return (EINVAL);
180 	}
181 
182 	/*
183 	 * Align the file position to a page boundary,
184 	 * and save its page offset component.
185 	 */
186 	pageoff = (pos & PAGE_MASK);
187 	pos -= pageoff;
188 
189 	/* Adjust size for rounding (on both ends). */
190 	size += pageoff;			/* low end... */
191 	size = (vm_size_t) round_page(size);	/* hi end */
192 	if (size < ulen)			/* wrap */
193 		return(EINVAL);
194 
195 	/*
196 	 * Check for illegal addresses.  Watch out for address wrap... Note
197 	 * that VM_*_ADDRESS are not constants due to casts (argh).
198 	 */
199 	if (flags & (MAP_FIXED | MAP_TRYFIXED)) {
200 		/*
201 		 * The specified address must have the same remainder
202 		 * as the file offset taken modulo PAGE_SIZE, so it
203 		 * should be aligned after adjustment by pageoff.
204 		 */
205 		addr -= pageoff;
206 		if (addr & PAGE_MASK)
207 			return (EINVAL);
208 
209 		/*
210 		 * Address range must be all in user VM space and not wrap.
211 		 */
212 		tmpaddr = addr + size;
213 		if (tmpaddr < addr)
214 			return (EINVAL);
215 		if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS)
216 			return (EINVAL);
217 		if (VM_MIN_USER_ADDRESS > 0 && addr < VM_MIN_USER_ADDRESS)
218 			return (EINVAL);
219 	} else {
220 		/*
221 		 * Get a hint of where to map. It also provides mmap offset
222 		 * randomization if enabled.
223 		 */
224 		addr = vm_map_hint(p, addr, prot);
225 	}
226 
227 	if (flags & MAP_ANON) {
228 		/*
229 		 * Mapping blank space is trivial.
230 		 */
231 		handle = NULL;
232 		maxprot = VM_PROT_ALL;
233 	} else {
234 		/*
235 		 * Mapping file, get fp for validation. Obtain vnode and make
236 		 * sure it is of appropriate type.
237 		 */
238 		fp = holdfp(td, fd, -1);
239 		if (fp == NULL)
240 			return (EBADF);
241 		if (fp->f_type != DTYPE_VNODE) {
242 			error = EINVAL;
243 			goto done;
244 		}
245 		/*
246 		 * POSIX shared-memory objects are defined to have
247 		 * kernel persistence, and are not defined to support
248 		 * read(2)/write(2) -- or even open(2).  Thus, we can
249 		 * use MAP_ASYNC to trade on-disk coherence for speed.
250 		 * The shm_open(3) library routine turns on the FPOSIXSHM
251 		 * flag to request this behavior.
252 		 */
253 		if (fp->f_flag & FPOSIXSHM)
254 			flags |= MAP_NOSYNC;
255 		vp = (struct vnode *) fp->f_data;
256 
257 		/*
258 		 * Validate the vnode for the operation.
259 		 */
260 		switch(vp->v_type) {
261 		case VREG:
262 			/*
263 			 * Get the proper underlying object
264 			 */
265 			if ((obj = vp->v_object) == NULL) {
266 				error = EINVAL;
267 				goto done;
268 			}
269 			KKASSERT((struct vnode *)obj->handle == vp);
270 			break;
271 		case VCHR:
272 			/*
273 			 * Make sure a device has not been revoked.
274 			 * Mappability is handled by the device layer.
275 			 */
276 			if (vp->v_rdev == NULL) {
277 				error = EBADF;
278 				goto done;
279 			}
280 			break;
281 		default:
282 			/*
283 			 * Nothing else is mappable.
284 			 */
285 			error = EINVAL;
286 			goto done;
287 		}
288 
289 		/*
290 		 * XXX hack to handle use of /dev/zero to map anon memory (ala
291 		 * SunOS).
292 		 */
293 		if (vp->v_type == VCHR && iszerodev(vp->v_rdev)) {
294 			handle = NULL;
295 			maxprot = VM_PROT_ALL;
296 			flags |= MAP_ANON;
297 			pos = 0;
298 		} else {
299 			/*
300 			 * cdevs does not provide private mappings of any kind.
301 			 */
302 			if (vp->v_type == VCHR &&
303 			    (flags & (MAP_PRIVATE|MAP_COPY))) {
304 				error = EINVAL;
305 				goto done;
306 			}
307 			/*
308 			 * Ensure that file and memory protections are
309 			 * compatible.  Note that we only worry about
310 			 * writability if mapping is shared; in this case,
311 			 * current and max prot are dictated by the open file.
312 			 * XXX use the vnode instead?  Problem is: what
313 			 * credentials do we use for determination? What if
314 			 * proc does a setuid?
315 			 */
316 			maxprot = VM_PROT_EXECUTE;
317 			if (fp->f_flag & FREAD) {
318 				maxprot |= VM_PROT_READ;
319 			} else if (prot & PROT_READ) {
320 				error = EACCES;
321 				goto done;
322 			}
323 			/*
324 			 * If we are sharing potential changes (either via
325 			 * MAP_SHARED or via the implicit sharing of character
326 			 * device mappings), and we are trying to get write
327 			 * permission although we opened it without asking
328 			 * for it, bail out.  Check for superuser, only if
329 			 * we're at securelevel < 1, to allow the XIG X server
330 			 * to continue to work.
331 			 *
332 			 * PROT_WRITE + MAP_SHARED
333 			 */
334 			if ((flags & MAP_SHARED) != 0 || vp->v_type == VCHR) {
335 				if ((fp->f_flag & FWRITE) != 0) {
336 					struct vattr va;
337 					if ((error = VOP_GETATTR(vp, &va))) {
338 						goto done;
339 					}
340 					if ((va.va_flags &
341 					    (IMMUTABLE|APPEND)) == 0) {
342 						maxprot |= VM_PROT_WRITE;
343 
344 						/*
345 						 * SHARED+RW file mmap()
346 						 * updates v_lastwrite_ts.
347 						 */
348 						if ((prot & PROT_WRITE) &&
349 						    vn_lock(vp, LK_EXCLUSIVE | LK_RETRY) == 0) {
350 							vfs_timestamp(&vp->v_lastwrite_ts);
351 							vsetflags(vp, VLASTWRITETS);
352 							vn_unlock(vp);
353 						}
354 					} else if (prot & PROT_WRITE) {
355 						error = EPERM;
356 						goto done;
357 					}
358 				} else if ((prot & PROT_WRITE) != 0) {
359 					error = EACCES;
360 					goto done;
361 				}
362 			} else {
363 				maxprot |= VM_PROT_WRITE;
364 			}
365 			handle = (void *)vp;
366 		}
367 	}
368 
369 	lwkt_gettoken(&vms->vm_map.token);
370 
371 	/*
372 	 * Do not allow more then a certain number of vm_map_entry structures
373 	 * per process.  0 to disable.
374 	 */
375 	if (max_proc_mmap && vms->vm_map.nentries >= max_proc_mmap) {
376 		error = ENOMEM;
377 		lwkt_reltoken(&vms->vm_map.token);
378 		goto done;
379 	}
380 
381 	error = vm_mmap(&vms->vm_map, &addr, size, prot, maxprot,
382 			flags, handle, pos);
383 	if (error == 0)
384 		*res = (void *)(addr + pageoff);
385 
386 	lwkt_reltoken(&vms->vm_map.token);
387 done:
388 	if (fp)
389 		dropfp(td, fd, fp);
390 
391 	return (error);
392 }
393 
394 /*
395  * mmap system call handler
396  *
397  * No requirements.
398  */
399 int
400 sys_mmap(struct mmap_args *uap)
401 {
402 	int error;
403 	int flags = uap->flags;
404 	off_t upos = uap->pos;
405 
406 	/*
407 	 * Work around fairly serious problems with trying to have an
408 	 * auto-grow stack segment related to other unrelated calls to
409 	 * mmap() potentially getting addresses within such segments.
410 	 *
411 	 * Our attempt to use TRYFIXED to mediate the problem basically
412 	 * failed.  For example, rtld-elf uses it to try to optimize
413 	 * shlib placement, but could run afoul of this issue.
414 	 *
415 	 * The only remaining true MAP_STACK we allow is the user stack as
416 	 * created by the exec code.  All userland MAP_STACK's are converted
417 	 * to normal mmap()s right here.
418 	 */
419 	if (flags & MAP_STACK) {
420 		if (uap->fd != -1)
421 			return (EINVAL);
422 		if ((uap->prot & (PROT_READ|PROT_WRITE)) !=
423 		    (PROT_READ|PROT_WRITE)) {
424 			return (EINVAL);
425 		}
426 		flags &= ~MAP_STACK;
427 		flags |= MAP_ANON;
428 		upos = 0;
429 	}
430 
431 	error = kern_mmap(curproc->p_vmspace, uap->addr, uap->len,
432 			  uap->prot, flags,
433 			  uap->fd, upos, &uap->sysmsg_resultp);
434 
435 	return (error);
436 }
437 
438 /*
439  * msync system call handler
440  *
441  * msync_args(void *addr, size_t len, int flags)
442  *
443  * No requirements
444  */
445 int
446 sys_msync(struct msync_args *uap)
447 {
448 	struct proc *p = curproc;
449 	vm_offset_t addr;
450 	vm_offset_t tmpaddr;
451 	vm_size_t size, pageoff;
452 	int flags;
453 	vm_map_t map;
454 	int rv;
455 
456 	addr = (vm_offset_t) uap->addr;
457 	size = uap->len;
458 	flags = uap->flags;
459 
460 	pageoff = (addr & PAGE_MASK);
461 	addr -= pageoff;
462 	size += pageoff;
463 	size = (vm_size_t) round_page(size);
464 	if (size < uap->len)		/* wrap */
465 		return(EINVAL);
466 	tmpaddr = addr + size;		/* workaround gcc4 opt */
467 	if (tmpaddr < addr)		/* wrap */
468 		return(EINVAL);
469 
470 	if ((flags & (MS_ASYNC|MS_INVALIDATE)) == (MS_ASYNC|MS_INVALIDATE))
471 		return (EINVAL);
472 
473 	map = &p->p_vmspace->vm_map;
474 
475 	/*
476 	 * map->token serializes extracting the address range for size == 0
477 	 * msyncs with the vm_map_clean call; if the token were not held
478 	 * across the two calls, an intervening munmap/mmap pair, for example,
479 	 * could cause msync to occur on a wrong region.
480 	 */
481 	lwkt_gettoken(&map->token);
482 
483 	/*
484 	 * XXX Gak!  If size is zero we are supposed to sync "all modified
485 	 * pages with the region containing addr".  Unfortunately, we don't
486 	 * really keep track of individual mmaps so we approximate by flushing
487 	 * the range of the map entry containing addr. This can be incorrect
488 	 * if the region splits or is coalesced with a neighbor.
489 	 */
490 	if (size == 0) {
491 		vm_map_entry_t entry;
492 
493 		vm_map_lock_read(map);
494 		rv = vm_map_lookup_entry(map, addr, &entry);
495 		if (rv == FALSE) {
496 			vm_map_unlock_read(map);
497 			rv = KERN_INVALID_ADDRESS;
498 			goto done;
499 		}
500 		addr = entry->ba.start;
501 		size = entry->ba.end - entry->ba.start;
502 		vm_map_unlock_read(map);
503 	}
504 
505 	/*
506 	 * Clean the pages and interpret the return value.
507 	 */
508 	rv = vm_map_clean(map, addr, addr + size, (flags & MS_ASYNC) == 0,
509 			  (flags & MS_INVALIDATE) != 0);
510 done:
511 	lwkt_reltoken(&map->token);
512 
513 	switch (rv) {
514 	case KERN_SUCCESS:
515 		break;
516 	case KERN_INVALID_ADDRESS:
517 		return (EINVAL);	/* Sun returns ENOMEM? */
518 	case KERN_FAILURE:
519 		return (EIO);
520 	default:
521 		return (EINVAL);
522 	}
523 
524 	return (0);
525 }
526 
527 /*
528  * munmap system call handler
529  *
530  * munmap_args(void *addr, size_t len)
531  *
532  * No requirements
533  */
534 int
535 sys_munmap(struct munmap_args *uap)
536 {
537 	struct proc *p = curproc;
538 	vm_offset_t addr;
539 	vm_offset_t tmpaddr;
540 	vm_size_t size, pageoff;
541 	vm_map_t map;
542 
543 	addr = (vm_offset_t) uap->addr;
544 	size = uap->len;
545 
546 	pageoff = (addr & PAGE_MASK);
547 	addr -= pageoff;
548 	size += pageoff;
549 	size = (vm_size_t) round_page(size);
550 	if (size < uap->len)		/* wrap */
551 		return(EINVAL);
552 	tmpaddr = addr + size;		/* workaround gcc4 opt */
553 	if (tmpaddr < addr)		/* wrap */
554 		return(EINVAL);
555 
556 	if (size == 0)
557 		return (0);
558 
559 	/*
560 	 * Check for illegal addresses.  Watch out for address wrap... Note
561 	 * that VM_*_ADDRESS are not constants due to casts (argh).
562 	 */
563 	if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS)
564 		return (EINVAL);
565 	if (VM_MIN_USER_ADDRESS > 0 && addr < VM_MIN_USER_ADDRESS)
566 		return (EINVAL);
567 
568 	map = &p->p_vmspace->vm_map;
569 
570 	/* map->token serializes between the map check and the actual unmap */
571 	lwkt_gettoken(&map->token);
572 
573 	/*
574 	 * Make sure entire range is allocated.
575 	 */
576 	if (!vm_map_check_protection(map, addr, addr + size,
577 				     VM_PROT_NONE, FALSE)) {
578 		lwkt_reltoken(&map->token);
579 		return (EINVAL);
580 	}
581 	/* returns nothing but KERN_SUCCESS anyway */
582 	vm_map_remove(map, addr, addr + size);
583 	lwkt_reltoken(&map->token);
584 	return (0);
585 }
586 
587 /*
588  * mprotect_args(const void *addr, size_t len, int prot)
589  *
590  * No requirements.
591  */
592 int
593 sys_mprotect(struct mprotect_args *uap)
594 {
595 	struct proc *p = curproc;
596 	vm_offset_t addr;
597 	vm_offset_t tmpaddr;
598 	vm_size_t size, pageoff;
599 	vm_prot_t prot;
600 	int error;
601 
602 	addr = (vm_offset_t) uap->addr;
603 	size = uap->len;
604 	prot = uap->prot & VM_PROT_ALL;
605 
606 	pageoff = (addr & PAGE_MASK);
607 	addr -= pageoff;
608 	size += pageoff;
609 	size = (vm_size_t) round_page(size);
610 	if (size < uap->len)		/* wrap */
611 		return(EINVAL);
612 	tmpaddr = addr + size;		/* workaround gcc4 opt */
613 	if (tmpaddr < addr)		/* wrap */
614 		return(EINVAL);
615 
616 	switch (vm_map_protect(&p->p_vmspace->vm_map, addr, addr + size,
617 			       prot, FALSE)) {
618 	case KERN_SUCCESS:
619 		error = 0;
620 		break;
621 	case KERN_PROTECTION_FAILURE:
622 		error = EACCES;
623 		break;
624 	default:
625 		error = EINVAL;
626 		break;
627 	}
628 	return (error);
629 }
630 
631 /*
632  * minherit system call handler
633  *
634  * minherit_args(void *addr, size_t len, int inherit)
635  *
636  * No requirements.
637  */
638 int
639 sys_minherit(struct minherit_args *uap)
640 {
641 	struct proc *p = curproc;
642 	vm_offset_t addr;
643 	vm_offset_t tmpaddr;
644 	vm_size_t size, pageoff;
645 	vm_inherit_t inherit;
646 	int error;
647 
648 	addr = (vm_offset_t)uap->addr;
649 	size = uap->len;
650 	inherit = uap->inherit;
651 
652 	pageoff = (addr & PAGE_MASK);
653 	addr -= pageoff;
654 	size += pageoff;
655 	size = (vm_size_t) round_page(size);
656 	if (size < uap->len)		/* wrap */
657 		return(EINVAL);
658 	tmpaddr = addr + size;		/* workaround gcc4 opt */
659 	if (tmpaddr < addr)		/* wrap */
660 		return(EINVAL);
661 
662 	switch (vm_map_inherit(&p->p_vmspace->vm_map, addr,
663 			       addr + size, inherit)) {
664 	case KERN_SUCCESS:
665 		error = 0;
666 		break;
667 	case KERN_PROTECTION_FAILURE:
668 		error = EACCES;
669 		break;
670 	default:
671 		error = EINVAL;
672 		break;
673 	}
674 	return (error);
675 }
676 
677 /*
678  * madvise system call handler
679  *
680  * madvise_args(void *addr, size_t len, int behav)
681  *
682  * No requirements.
683  */
684 int
685 sys_madvise(struct madvise_args *uap)
686 {
687 	struct proc *p = curproc;
688 	vm_offset_t start, end;
689 	vm_offset_t tmpaddr = (vm_offset_t)uap->addr + uap->len;
690 	int error;
691 
692 	/*
693 	 * Check for illegal behavior
694 	 */
695 	if (uap->behav < 0 || uap->behav >= MADV_CONTROL_END)
696 		return (EINVAL);
697 	/*
698 	 * Check for illegal addresses.  Watch out for address wrap... Note
699 	 * that VM_*_ADDRESS are not constants due to casts (argh).
700 	 */
701 	if (tmpaddr < (vm_offset_t)uap->addr)
702 		return (EINVAL);
703 	if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS)
704 		return (EINVAL);
705 	if (VM_MIN_USER_ADDRESS > 0 && uap->addr < VM_MIN_USER_ADDRESS)
706 		return (EINVAL);
707 
708 	/*
709 	 * Since this routine is only advisory, we default to conservative
710 	 * behavior.
711 	 */
712 	start = trunc_page((vm_offset_t)uap->addr);
713 	end = round_page(tmpaddr);
714 
715 	error = vm_map_madvise(&p->p_vmspace->vm_map, start, end,
716 			       uap->behav, 0);
717 	return (error);
718 }
719 
720 /*
721  * mcontrol system call handler
722  *
723  * mcontrol_args(void *addr, size_t len, int behav, off_t value)
724  *
725  * No requirements
726  */
727 int
728 sys_mcontrol(struct mcontrol_args *uap)
729 {
730 	struct proc *p = curproc;
731 	vm_offset_t start, end;
732 	vm_offset_t tmpaddr = (vm_offset_t)uap->addr + uap->len;
733 	int error;
734 
735 	/*
736 	 * Check for illegal behavior
737 	 */
738 	if (uap->behav < 0 || uap->behav > MADV_CONTROL_END)
739 		return (EINVAL);
740 	/*
741 	 * Check for illegal addresses.  Watch out for address wrap... Note
742 	 * that VM_*_ADDRESS are not constants due to casts (argh).
743 	 */
744 	if (tmpaddr < (vm_offset_t) uap->addr)
745 		return (EINVAL);
746 	if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS)
747 		return (EINVAL);
748 	if (VM_MIN_USER_ADDRESS > 0 && uap->addr < VM_MIN_USER_ADDRESS)
749 		return (EINVAL);
750 
751 	/*
752 	 * Since this routine is only advisory, we default to conservative
753 	 * behavior.
754 	 */
755 	start = trunc_page((vm_offset_t)uap->addr);
756 	end = round_page(tmpaddr);
757 
758 	error = vm_map_madvise(&p->p_vmspace->vm_map, start, end,
759 			       uap->behav, uap->value);
760 	return (error);
761 }
762 
763 
764 /*
765  * mincore system call handler
766  *
767  * mincore_args(const void *addr, size_t len, char *vec)
768  *
769  * No requirements
770  */
771 int
772 sys_mincore(struct mincore_args *uap)
773 {
774 	struct proc *p = curproc;
775 	vm_offset_t addr, first_addr;
776 	vm_offset_t end, cend;
777 	pmap_t pmap;
778 	vm_map_t map;
779 	char *vec;
780 	int error;
781 	int vecindex, lastvecindex;
782 	vm_map_entry_t current;
783 	vm_map_entry_t entry;
784 	int mincoreinfo;
785 	unsigned int timestamp;
786 
787 	/*
788 	 * Make sure that the addresses presented are valid for user
789 	 * mode.
790 	 */
791 	first_addr = addr = trunc_page((vm_offset_t) uap->addr);
792 	end = addr + (vm_size_t)round_page(uap->len);
793 	if (end < addr)
794 		return (EINVAL);
795 	if (VM_MAX_USER_ADDRESS > 0 && end > VM_MAX_USER_ADDRESS)
796 		return (EINVAL);
797 
798 	/*
799 	 * Address of byte vector
800 	 */
801 	vec = uap->vec;
802 
803 	map = &p->p_vmspace->vm_map;
804 	pmap = vmspace_pmap(p->p_vmspace);
805 
806 	lwkt_gettoken(&map->token);
807 	vm_map_lock_read(map);
808 RestartScan:
809 	timestamp = map->timestamp;
810 
811 	if (!vm_map_lookup_entry(map, addr, &entry))
812 		entry = RB_MIN(vm_map_rb_tree, &map->rb_root);
813 
814 	/*
815 	 * Do this on a map entry basis so that if the pages are not
816 	 * in the current processes address space, we can easily look
817 	 * up the pages elsewhere.
818 	 */
819 	lastvecindex = -1;
820 	for (current = entry;
821 	     current && current->ba.start < end;
822 	     current = vm_map_rb_tree_RB_NEXT(current)) {
823 		/*
824 		 * ignore submaps (for now) or null objects
825 		 */
826 		if (current->maptype != VM_MAPTYPE_NORMAL &&
827 		    current->maptype != VM_MAPTYPE_VPAGETABLE) {
828 			continue;
829 		}
830 		if (current->ba.object == NULL)
831 			continue;
832 
833 		/*
834 		 * limit this scan to the current map entry and the
835 		 * limits for the mincore call
836 		 */
837 		if (addr < current->ba.start)
838 			addr = current->ba.start;
839 		cend = current->ba.end;
840 		if (cend > end)
841 			cend = end;
842 
843 		/*
844 		 * scan this entry one page at a time
845 		 */
846 		while (addr < cend) {
847 			/*
848 			 * Check pmap first, it is likely faster, also
849 			 * it can provide info as to whether we are the
850 			 * one referencing or modifying the page.
851 			 *
852 			 * If we have to check the VM object, only mess
853 			 * around with normal maps.  Do not mess around
854 			 * with virtual page tables (XXX).
855 			 */
856 			mincoreinfo = pmap_mincore(pmap, addr);
857 			if (mincoreinfo == 0 &&
858 			    current->maptype == VM_MAPTYPE_NORMAL) {
859 				vm_pindex_t pindex;
860 				vm_ooffset_t offset;
861 				vm_page_t m;
862 
863 				/*
864 				 * calculate the page index into the object
865 				 */
866 				offset = current->ba.offset +
867 					 (addr - current->ba.start);
868 				pindex = OFF_TO_IDX(offset);
869 
870 				/*
871 				 * if the page is resident, then gather
872 				 * information about it.  spl protection is
873 				 * required to maintain the object
874 				 * association.  And XXX what if the page is
875 				 * busy?  What's the deal with that?
876 				 *
877 				 * XXX vm_token - legacy for pmap_ts_referenced
878 				 *     in x86 and vkernel pmap code.
879 				 */
880 				lwkt_gettoken(&vm_token);
881 				vm_object_hold(current->ba.object);
882 				m = vm_page_lookup(current->ba.object, pindex);
883 				if (m && m->valid) {
884 					mincoreinfo = MINCORE_INCORE;
885 					if (m->dirty || pmap_is_modified(m))
886 						mincoreinfo |= MINCORE_MODIFIED_OTHER;
887 					if ((m->flags & PG_REFERENCED) ||
888 						pmap_ts_referenced(m)) {
889 						vm_page_flag_set(m, PG_REFERENCED);
890 						mincoreinfo |= MINCORE_REFERENCED_OTHER;
891 					}
892 				}
893 				vm_object_drop(current->ba.object);
894 				lwkt_reltoken(&vm_token);
895 			}
896 
897 			/*
898 			 * subyte may page fault.  In case it needs to modify
899 			 * the map, we release the lock.
900 			 */
901 			vm_map_unlock_read(map);
902 
903 			/*
904 			 * calculate index into user supplied byte vector
905 			 */
906 			vecindex = OFF_TO_IDX(addr - first_addr);
907 
908 			/*
909 			 * If we have skipped map entries, we need to make sure that
910 			 * the byte vector is zeroed for those skipped entries.
911 			 */
912 			while((lastvecindex + 1) < vecindex) {
913 				error = subyte( vec + lastvecindex, 0);
914 				if (error) {
915 					error = EFAULT;
916 					goto done;
917 				}
918 				++lastvecindex;
919 			}
920 
921 			/*
922 			 * Pass the page information to the user
923 			 */
924 			error = subyte(vec + vecindex, mincoreinfo);
925 			if (error) {
926 				error = EFAULT;
927 				goto done;
928 			}
929 
930 			/*
931 			 * If the map has changed, due to the subyte,
932 			 * the previous output may be invalid.
933 			 */
934 			vm_map_lock_read(map);
935 			if (timestamp != map->timestamp)
936 				goto RestartScan;
937 
938 			lastvecindex = vecindex;
939 			addr += PAGE_SIZE;
940 		}
941 	}
942 
943 	/*
944 	 * subyte may page fault.  In case it needs to modify
945 	 * the map, we release the lock.
946 	 */
947 	vm_map_unlock_read(map);
948 
949 	/*
950 	 * Zero the last entries in the byte vector.
951 	 */
952 	vecindex = OFF_TO_IDX(end - first_addr);
953 	while((lastvecindex + 1) < vecindex) {
954 		error = subyte( vec + lastvecindex, 0);
955 		if (error) {
956 			error = EFAULT;
957 			goto done;
958 		}
959 		++lastvecindex;
960 	}
961 
962 	/*
963 	 * If the map has changed, due to the subyte, the previous
964 	 * output may be invalid.
965 	 */
966 	vm_map_lock_read(map);
967 	if (timestamp != map->timestamp)
968 		goto RestartScan;
969 	vm_map_unlock_read(map);
970 
971 	error = 0;
972 done:
973 	lwkt_reltoken(&map->token);
974 	return (error);
975 }
976 
977 /*
978  * mlock system call handler
979  *
980  * mlock_args(const void *addr, size_t len)
981  *
982  * No requirements
983  */
984 int
985 sys_mlock(struct mlock_args *uap)
986 {
987 	vm_offset_t addr;
988 	vm_offset_t tmpaddr;
989 	vm_size_t size, pageoff;
990 	struct thread *td = curthread;
991 	struct proc *p = td->td_proc;
992 	int error;
993 
994 	addr = (vm_offset_t) uap->addr;
995 	size = uap->len;
996 
997 	pageoff = (addr & PAGE_MASK);
998 	addr -= pageoff;
999 	size += pageoff;
1000 	size = (vm_size_t) round_page(size);
1001 	if (size < uap->len)		/* wrap */
1002 		return (EINVAL);
1003 	if (size == 0)			/* silently allow 0 size */
1004 		return (0);
1005 	tmpaddr = addr + size;		/* workaround gcc4 opt */
1006 	if (tmpaddr < addr)		/* wrap */
1007 		return (EINVAL);
1008 
1009 	if (atop(size) + vmstats.v_wire_count > vm_page_max_wired)
1010 		return (EAGAIN);
1011 
1012 	/*
1013 	 * We do not need to synchronize against other threads updating ucred;
1014 	 * they update p->ucred, which is synchronized into td_ucred ourselves.
1015 	 */
1016 #ifdef pmap_wired_count
1017 	if (size + ptoa(pmap_wired_count(vm_map_pmap(&p->p_vmspace->vm_map))) >
1018 	    p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur) {
1019 		return (ENOMEM);
1020 	}
1021 #else
1022 	error = priv_check_cred(td->td_ucred, PRIV_ROOT, 0);
1023 	if (error) {
1024 		return (error);
1025 	}
1026 #endif
1027 	error = vm_map_unwire(&p->p_vmspace->vm_map, addr, addr + size, FALSE);
1028 	return (error == KERN_SUCCESS ? 0 : ENOMEM);
1029 }
1030 
1031 /*
1032  * mlockall(int how)
1033  *
1034  * No requirements
1035  */
1036 int
1037 sys_mlockall(struct mlockall_args *uap)
1038 {
1039 	struct thread *td = curthread;
1040 	struct proc *p = td->td_proc;
1041 	vm_map_t map = &p->p_vmspace->vm_map;
1042 	vm_map_entry_t entry;
1043 	int how = uap->how;
1044 	int rc = KERN_SUCCESS;
1045 
1046 	if (((how & MCL_CURRENT) == 0) && ((how & MCL_FUTURE) == 0))
1047 		return (EINVAL);
1048 
1049 	rc = priv_check_cred(td->td_ucred, PRIV_ROOT, 0);
1050 	if (rc)
1051 		return (rc);
1052 
1053 	vm_map_lock(map);
1054 	do {
1055 		if (how & MCL_CURRENT) {
1056 			RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) {
1057 				; /* NOT IMPLEMENTED YET */
1058 			}
1059 			rc = ENOSYS;
1060 			break;
1061 		}
1062 		if (how & MCL_FUTURE)
1063 			map->flags |= MAP_WIREFUTURE;
1064 	} while(0);
1065 	vm_map_unlock(map);
1066 
1067 	return (rc);
1068 }
1069 
1070 /*
1071  * munlockall(void)
1072  *
1073  *	Unwire all user-wired map entries, cancel MCL_FUTURE.
1074  *
1075  * No requirements
1076  */
1077 int
1078 sys_munlockall(struct munlockall_args *uap)
1079 {
1080 	struct thread *td = curthread;
1081 	struct proc *p = td->td_proc;
1082 	vm_map_t map = &p->p_vmspace->vm_map;
1083 	vm_map_entry_t entry;
1084 	int rc = KERN_SUCCESS;
1085 
1086 	vm_map_lock(map);
1087 
1088 	/* Clear MAP_WIREFUTURE to cancel mlockall(MCL_FUTURE) */
1089 	map->flags &= ~MAP_WIREFUTURE;
1090 
1091 retry:
1092 	RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) {
1093 		if ((entry->eflags & MAP_ENTRY_USER_WIRED) == 0)
1094 			continue;
1095 
1096 		/*
1097 		 * If we encounter an in-transition entry, we release the
1098 		 * map lock and retry the scan; we do not decrement any
1099 		 * wired_count more than once because we do not touch
1100 		 * any entries with MAP_ENTRY_USER_WIRED not set.
1101 		 *
1102  		 * There is a potential interleaving with concurrent
1103 		 * mlockall()s here -- if we abort a scan, an mlockall()
1104 		 * could start, wire a number of entries before our
1105 		 * current position in, and then stall itself on this
1106 		 * or any other in-transition entry. If that occurs, when
1107 		 * we resume, we will unwire those entries.
1108  		 */
1109 		if (entry->eflags & MAP_ENTRY_IN_TRANSITION) {
1110 			entry->eflags |= MAP_ENTRY_NEEDS_WAKEUP;
1111 			++mycpu->gd_cnt.v_intrans_coll;
1112 			++mycpu->gd_cnt.v_intrans_wait;
1113 			vm_map_transition_wait(map, 1);
1114 			goto retry;
1115 		}
1116 
1117 		KASSERT(entry->wired_count > 0,
1118 			("wired_count was 0 with USER_WIRED set! %p", entry));
1119 
1120 		/* Drop wired count, if it hits zero, unwire the entry */
1121 		entry->eflags &= ~MAP_ENTRY_USER_WIRED;
1122 		entry->wired_count--;
1123 		if (entry->wired_count == 0)
1124 			vm_fault_unwire(map, entry);
1125 	}
1126 
1127 	vm_map_unlock(map);
1128 
1129 	return (rc);
1130 }
1131 
1132 /*
1133  * munlock system call handler
1134  *
1135  * munlock_args(const void *addr, size_t len)
1136  *
1137  * No requirements
1138  */
1139 int
1140 sys_munlock(struct munlock_args *uap)
1141 {
1142 	struct thread *td = curthread;
1143 	struct proc *p = td->td_proc;
1144 	vm_offset_t addr;
1145 	vm_offset_t tmpaddr;
1146 	vm_size_t size, pageoff;
1147 	int error;
1148 
1149 	addr = (vm_offset_t) uap->addr;
1150 	size = uap->len;
1151 
1152 	pageoff = (addr & PAGE_MASK);
1153 	addr -= pageoff;
1154 	size += pageoff;
1155 	size = (vm_size_t) round_page(size);
1156 
1157 	tmpaddr = addr + size;
1158 	if (tmpaddr < addr)		/* wrap */
1159 		return (EINVAL);
1160 	if (size == 0)			/* silently allow 0 size */
1161 		return (0);
1162 
1163 #ifndef pmap_wired_count
1164 	error = priv_check(td, PRIV_ROOT);
1165 	if (error)
1166 		return (error);
1167 #endif
1168 
1169 	error = vm_map_unwire(&p->p_vmspace->vm_map, addr, addr + size, TRUE);
1170 	return (error == KERN_SUCCESS ? 0 : ENOMEM);
1171 }
1172 
1173 /*
1174  * Internal version of mmap.
1175  * Currently used by mmap, exec, and sys5 shared memory.
1176  * Handle is either a vnode pointer or NULL for MAP_ANON.
1177  *
1178  * No requirements
1179  */
1180 int
1181 vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot,
1182 	vm_prot_t maxprot, int flags, void *handle, vm_ooffset_t foff)
1183 {
1184 	boolean_t fitit;
1185 	vm_object_t object;
1186 	vm_offset_t eaddr;
1187 	vm_size_t   esize;
1188 	vm_size_t   align;
1189 	int (*uksmap)(vm_map_backing_t ba, int op, cdev_t dev, vm_page_t fake);
1190 	struct vnode *vp;
1191 	struct thread *td = curthread;
1192 	struct proc *p;
1193 	int rv = KERN_SUCCESS;
1194 	off_t objsize;
1195 	int docow;
1196 	int error;
1197 
1198 	if (size == 0)
1199 		return (0);
1200 
1201 	objsize = round_page(size);
1202 	if (objsize < size)
1203 		return (EINVAL);
1204 	size = objsize;
1205 
1206 	lwkt_gettoken(&map->token);
1207 
1208 	/*
1209 	 * XXX messy code, fixme
1210 	 *
1211 	 * NOTE: Overflow checks require discrete statements or GCC4
1212 	 * will optimize it out.
1213 	 */
1214 	if ((p = curproc) != NULL && map == &p->p_vmspace->vm_map) {
1215 		esize = map->size + size;	/* workaround gcc4 opt */
1216 		if (esize < map->size ||
1217 		    esize > p->p_rlimit[RLIMIT_VMEM].rlim_cur) {
1218 			lwkt_reltoken(&map->token);
1219 			return(ENOMEM);
1220 		}
1221 	}
1222 
1223 	/*
1224 	 * We currently can only deal with page aligned file offsets.
1225 	 * The check is here rather than in the syscall because the
1226 	 * kernel calls this function internally for other mmaping
1227 	 * operations (such as in exec) and non-aligned offsets will
1228 	 * cause pmap inconsistencies...so we want to be sure to
1229 	 * disallow this in all cases.
1230 	 *
1231 	 * NOTE: Overflow checks require discrete statements or GCC4
1232 	 * will optimize it out.
1233 	 */
1234 	if (foff & PAGE_MASK) {
1235 		lwkt_reltoken(&map->token);
1236 		return (EINVAL);
1237 	}
1238 
1239 	/*
1240 	 * Handle alignment.  For large memory maps it is possible
1241 	 * that the MMU can optimize the page table so align anything
1242 	 * that is a multiple of SEG_SIZE to SEG_SIZE.
1243 	 *
1244 	 * Also align any large mapping (bigger than 16x SG_SIZE) to a
1245 	 * SEG_SIZE address boundary.
1246 	 */
1247 	if (flags & MAP_SIZEALIGN) {
1248 		align = size;
1249 		if ((align ^ (align - 1)) != (align << 1) - 1) {
1250 			lwkt_reltoken(&map->token);
1251 			return (EINVAL);
1252 		}
1253 	} else if ((flags & MAP_FIXED) == 0 &&
1254 		   ((size & SEG_MASK) == 0 || size > SEG_SIZE * 16)) {
1255 		align = SEG_SIZE;
1256 	} else {
1257 		align = PAGE_SIZE;
1258 	}
1259 
1260 	if ((flags & (MAP_FIXED | MAP_TRYFIXED)) == 0) {
1261 		fitit = TRUE;
1262 		*addr = round_page(*addr);
1263 	} else {
1264 		if (*addr != trunc_page(*addr)) {
1265 			lwkt_reltoken(&map->token);
1266 			return (EINVAL);
1267 		}
1268 		eaddr = *addr + size;
1269 		if (eaddr < *addr) {
1270 			lwkt_reltoken(&map->token);
1271 			return (EINVAL);
1272 		}
1273 		fitit = FALSE;
1274 		if ((flags & MAP_TRYFIXED) == 0)
1275 			vm_map_remove(map, *addr, *addr + size);
1276 	}
1277 
1278 	uksmap = NULL;
1279 
1280 	/*
1281 	 * Lookup/allocate object.
1282 	 */
1283 	if (flags & MAP_ANON) {
1284 		/*
1285 		 * Unnamed anonymous regions always start at 0.
1286 		 */
1287 		if (handle) {
1288 			/*
1289 			 * Default memory object
1290 			 */
1291 			object = default_pager_alloc(handle, objsize,
1292 						     prot, foff);
1293 			if (object == NULL) {
1294 				lwkt_reltoken(&map->token);
1295 				return(ENOMEM);
1296 			}
1297 			docow = MAP_PREFAULT_PARTIAL;
1298 		} else {
1299 			/*
1300 			 * Implicit single instance of a default memory
1301 			 * object, so we don't need a VM object yet.
1302 			 */
1303 			foff = 0;
1304 			object = NULL;
1305 			docow = 0;
1306 		}
1307 		vp = NULL;
1308 	} else {
1309 		vp = (struct vnode *)handle;
1310 
1311 		/*
1312 		 * Non-anonymous mappings of VCHR (aka not /dev/zero)
1313 		 * cannot specify MAP_STACK or MAP_VPAGETABLE.
1314 		 */
1315 		if (vp->v_type == VCHR) {
1316 			if (flags & (MAP_STACK | MAP_VPAGETABLE)) {
1317 				lwkt_reltoken(&map->token);
1318 				return(EINVAL);
1319 			}
1320 		}
1321 
1322 		if (vp->v_type == VCHR && vp->v_rdev->si_ops->d_uksmap) {
1323 			/*
1324 			 * Device mappings without a VM object, typically
1325 			 * sharing permanently allocated kernel memory or
1326 			 * process-context-specific (per-process) data.
1327 			 *
1328 			 * The object offset for uksmap represents the
1329 			 * lwp_tid that did the mapping.
1330 			 *
1331 			 * Force them to be shared.
1332 			 */
1333 			uksmap = vp->v_rdev->si_ops->d_uksmap;
1334 			object = NULL;
1335 			docow = MAP_PREFAULT_PARTIAL;
1336 			flags &= ~(MAP_PRIVATE|MAP_COPY);
1337 			flags |= MAP_SHARED;
1338 		} else if (vp->v_type == VCHR) {
1339 			/*
1340 			 * Device mappings (device size unknown?).
1341 			 * Force them to be shared.
1342 			 */
1343 			error = dev_dmmap_single(vp->v_rdev, &foff, objsize,
1344 						&object, prot, NULL);
1345 
1346 			if (error == ENODEV) {
1347 				handle = (void *)(intptr_t)vp->v_rdev;
1348 				object = dev_pager_alloc(handle, objsize, prot, foff);
1349 				if (object == NULL) {
1350 					lwkt_reltoken(&map->token);
1351 					return(EINVAL);
1352 				}
1353 			} else if (error) {
1354 				lwkt_reltoken(&map->token);
1355 				return(error);
1356 			}
1357 
1358 			docow = MAP_PREFAULT_PARTIAL;
1359 			flags &= ~(MAP_PRIVATE|MAP_COPY);
1360 			flags |= MAP_SHARED;
1361 		} else {
1362 			/*
1363 			 * Regular file mapping (typically).  The attribute
1364 			 * check is for the link count test only.  mmapable
1365 			 * vnodes must already have a VM object assigned.
1366 			 */
1367 			struct vattr vat;
1368 			int error;
1369 
1370 			error = VOP_GETATTR(vp, &vat);
1371 			if (error) {
1372 				lwkt_reltoken(&map->token);
1373 				return (error);
1374 			}
1375 			docow = MAP_PREFAULT_PARTIAL;
1376 			object = vnode_pager_reference(vp);
1377 			if (object == NULL && vp->v_type == VREG) {
1378 				lwkt_reltoken(&map->token);
1379 				kprintf("Warning: cannot mmap vnode %p, no "
1380 					"object\n", vp);
1381 				return(EINVAL);
1382 			}
1383 
1384 			/*
1385 			 * If it is a regular file without any references
1386 			 * we do not need to sync it.
1387 			 */
1388 			if (vp->v_type == VREG && vat.va_nlink == 0) {
1389 				flags |= MAP_NOSYNC;
1390 			}
1391 		}
1392 	}
1393 
1394 	/*
1395 	 * Deal with the adjusted flags
1396 	 */
1397 	if ((flags & (MAP_ANON|MAP_SHARED)) == 0)
1398 		docow |= MAP_COPY_ON_WRITE;
1399 	if (flags & MAP_NOSYNC)
1400 		docow |= MAP_DISABLE_SYNCER;
1401 	if (flags & MAP_NOCORE)
1402 		docow |= MAP_DISABLE_COREDUMP;
1403 
1404 	/*
1405 	 * This may place the area in its own page directory if (size) is
1406 	 * large enough, otherwise it typically returns its argument.
1407 	 *
1408 	 * (object can be NULL)
1409 	 */
1410 	if (fitit) {
1411 		*addr = pmap_addr_hint(object, *addr, size);
1412 	}
1413 
1414 	/*
1415 	 * Stack mappings need special attention.
1416 	 *
1417 	 * Mappings that use virtual page tables will default to storing
1418 	 * the page table at offset 0.
1419 	 */
1420 	if (uksmap) {
1421 		rv = vm_map_find(map, uksmap, vp->v_rdev,
1422 				 foff, addr, size,
1423 				 align, fitit,
1424 				 VM_MAPTYPE_UKSMAP, VM_SUBSYS_MMAP,
1425 				 prot, maxprot, docow);
1426 	} else if (flags & MAP_STACK) {
1427 		rv = vm_map_stack(map, addr, size, flags,
1428 				  prot, maxprot, docow);
1429 	} else if (flags & MAP_VPAGETABLE) {
1430 		rv = vm_map_find(map, object, NULL,
1431 				 foff, addr, size,
1432 				 align, fitit,
1433 				 VM_MAPTYPE_VPAGETABLE, VM_SUBSYS_MMAP,
1434 				 prot, maxprot, docow);
1435 	} else {
1436 		rv = vm_map_find(map, object, NULL,
1437 				 foff, addr, size,
1438 				 align, fitit,
1439 				 VM_MAPTYPE_NORMAL, VM_SUBSYS_MMAP,
1440 				 prot, maxprot, docow);
1441 	}
1442 
1443 	if (rv != KERN_SUCCESS) {
1444 		/*
1445 		 * Lose the object reference. Will destroy the
1446 		 * object if it's an unnamed anonymous mapping
1447 		 * or named anonymous without other references.
1448 		 *
1449 		 * (NOTE: object can be NULL)
1450 		 */
1451 		vm_object_deallocate(object);
1452 		goto out;
1453 	}
1454 
1455 	/*
1456 	 * Shared memory is also shared with children.
1457 	 */
1458 	if (flags & (MAP_SHARED|MAP_INHERIT)) {
1459 		rv = vm_map_inherit(map, *addr, *addr + size, VM_INHERIT_SHARE);
1460 		if (rv != KERN_SUCCESS) {
1461 			vm_map_remove(map, *addr, *addr + size);
1462 			goto out;
1463 		}
1464 	}
1465 
1466 	/* If a process has marked all future mappings for wiring, do so */
1467 	if ((rv == KERN_SUCCESS) && (map->flags & MAP_WIREFUTURE))
1468 		vm_map_unwire(map, *addr, *addr + size, FALSE);
1469 
1470 	/*
1471 	 * Set the access time on the vnode
1472 	 */
1473 	if (vp != NULL)
1474 		vn_mark_atime(vp, td);
1475 out:
1476 	lwkt_reltoken(&map->token);
1477 
1478 	switch (rv) {
1479 	case KERN_SUCCESS:
1480 		return (0);
1481 	case KERN_INVALID_ADDRESS:
1482 	case KERN_NO_SPACE:
1483 		return (ENOMEM);
1484 	case KERN_PROTECTION_FAILURE:
1485 		return (EACCES);
1486 	default:
1487 		return (EINVAL);
1488 	}
1489 }
1490 
1491 /*
1492  * Translate a Mach VM return code to zero on success or the appropriate errno
1493  * on failure.
1494  */
1495 int
1496 vm_mmap_to_errno(int rv)
1497 {
1498 
1499 	switch (rv) {
1500 	case KERN_SUCCESS:
1501 		return (0);
1502 	case KERN_INVALID_ADDRESS:
1503 	case KERN_NO_SPACE:
1504 		return (ENOMEM);
1505 	case KERN_PROTECTION_FAILURE:
1506 		return (EACCES);
1507 	default:
1508 		return (EINVAL);
1509 	}
1510 }
1511