1 /* 2 * (MPSAFE) 3 * 4 * Copyright (c) 1988 University of Utah. 5 * Copyright (c) 1991, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * This code is derived from software contributed to Berkeley by 9 * the Systems Programming Group of the University of Utah Computer 10 * Science Department. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * from: Utah $Hdr: vm_mmap.c 1.6 91/10/21$ 37 * 38 * @(#)vm_mmap.c 8.4 (Berkeley) 1/12/94 39 * $FreeBSD: src/sys/vm/vm_mmap.c,v 1.108.2.6 2002/07/02 20:06:19 dillon Exp $ 40 */ 41 42 /* 43 * Mapped file (mmap) interface to VM 44 */ 45 46 #include <sys/param.h> 47 #include <sys/kernel.h> 48 #include <sys/systm.h> 49 #include <sys/sysproto.h> 50 #include <sys/filedesc.h> 51 #include <sys/kern_syscall.h> 52 #include <sys/proc.h> 53 #include <sys/priv.h> 54 #include <sys/resource.h> 55 #include <sys/resourcevar.h> 56 #include <sys/vnode.h> 57 #include <sys/fcntl.h> 58 #include <sys/file.h> 59 #include <sys/mman.h> 60 #include <sys/conf.h> 61 #include <sys/stat.h> 62 #include <sys/vmmeter.h> 63 #include <sys/sysctl.h> 64 65 #include <vm/vm.h> 66 #include <vm/vm_param.h> 67 #include <sys/lock.h> 68 #include <vm/pmap.h> 69 #include <vm/vm_map.h> 70 #include <vm/vm_object.h> 71 #include <vm/vm_page.h> 72 #include <vm/vm_pager.h> 73 #include <vm/vm_pageout.h> 74 #include <vm/vm_extern.h> 75 #include <vm/vm_kern.h> 76 77 #include <sys/file2.h> 78 #include <sys/thread.h> 79 #include <vm/vm_page2.h> 80 81 static int max_proc_mmap = 1000000; 82 SYSCTL_INT(_vm, OID_AUTO, max_proc_mmap, CTLFLAG_RW, &max_proc_mmap, 0, ""); 83 int vkernel_enable; 84 SYSCTL_INT(_vm, OID_AUTO, vkernel_enable, CTLFLAG_RW, &vkernel_enable, 0, ""); 85 86 /* 87 * sstk_args(int incr) 88 * 89 * MPSAFE 90 */ 91 int 92 sys_sstk(struct sstk_args *uap) 93 { 94 /* Not yet implemented */ 95 return (EOPNOTSUPP); 96 } 97 98 /* 99 * mmap_args(void *addr, size_t len, int prot, int flags, int fd, 100 * long pad, off_t pos) 101 * 102 * Memory Map (mmap) system call. Note that the file offset 103 * and address are allowed to be NOT page aligned, though if 104 * the MAP_FIXED flag it set, both must have the same remainder 105 * modulo the PAGE_SIZE (POSIX 1003.1b). If the address is not 106 * page-aligned, the actual mapping starts at trunc_page(addr) 107 * and the return value is adjusted up by the page offset. 108 * 109 * Generally speaking, only character devices which are themselves 110 * memory-based, such as a video framebuffer, can be mmap'd. Otherwise 111 * there would be no cache coherency between a descriptor and a VM mapping 112 * both to the same character device. 113 * 114 * Block devices can be mmap'd no matter what they represent. Cache coherency 115 * is maintained as long as you do not write directly to the underlying 116 * character device. 117 * 118 * No requirements 119 */ 120 int 121 kern_mmap(struct vmspace *vms, caddr_t uaddr, size_t ulen, 122 int uprot, int uflags, int fd, off_t upos, void **res) 123 { 124 struct thread *td = curthread; 125 struct proc *p = td->td_proc; 126 struct file *fp = NULL; 127 struct vnode *vp; 128 vm_offset_t addr; 129 vm_offset_t tmpaddr; 130 vm_size_t size, pageoff; 131 vm_prot_t prot, maxprot; 132 void *handle; 133 int flags, error; 134 off_t pos; 135 vm_object_t obj; 136 137 KKASSERT(p); 138 139 addr = (vm_offset_t) uaddr; 140 size = ulen; 141 prot = uprot & VM_PROT_ALL; 142 flags = uflags; 143 pos = upos; 144 145 /* 146 * Make sure mapping fits into numeric range etc. 147 * 148 * NOTE: We support the full unsigned range for size now. 149 */ 150 if (((flags & MAP_ANON) && (fd != -1 || pos != 0))) 151 return (EINVAL); 152 153 if (size == 0) 154 return (EINVAL); 155 156 if (flags & MAP_STACK) { 157 if (fd != -1) 158 return (EINVAL); 159 if ((prot & (PROT_READ|PROT_WRITE)) != (PROT_READ|PROT_WRITE)) 160 return (EINVAL); 161 flags |= MAP_ANON; 162 pos = 0; 163 } 164 165 /* 166 * Virtual page tables cannot be used with MAP_STACK. Apart from 167 * it not making any sense, the aux union is used by both 168 * types. 169 * 170 * Because the virtual page table is stored in the backing object 171 * and might be updated by the kernel, the mapping must be R+W. 172 */ 173 if (flags & MAP_VPAGETABLE) { 174 if (vkernel_enable == 0) 175 return (EOPNOTSUPP); 176 if (flags & MAP_STACK) 177 return (EINVAL); 178 if ((prot & (PROT_READ|PROT_WRITE)) != (PROT_READ|PROT_WRITE)) 179 return (EINVAL); 180 } 181 182 /* 183 * Align the file position to a page boundary, 184 * and save its page offset component. 185 */ 186 pageoff = (pos & PAGE_MASK); 187 pos -= pageoff; 188 189 /* Adjust size for rounding (on both ends). */ 190 size += pageoff; /* low end... */ 191 size = (vm_size_t) round_page(size); /* hi end */ 192 if (size < ulen) /* wrap */ 193 return(EINVAL); 194 195 /* 196 * Check for illegal addresses. Watch out for address wrap... Note 197 * that VM_*_ADDRESS are not constants due to casts (argh). 198 */ 199 if (flags & (MAP_FIXED | MAP_TRYFIXED)) { 200 /* 201 * The specified address must have the same remainder 202 * as the file offset taken modulo PAGE_SIZE, so it 203 * should be aligned after adjustment by pageoff. 204 */ 205 addr -= pageoff; 206 if (addr & PAGE_MASK) 207 return (EINVAL); 208 209 /* 210 * Address range must be all in user VM space and not wrap. 211 */ 212 tmpaddr = addr + size; 213 if (tmpaddr < addr) 214 return (EINVAL); 215 if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS) 216 return (EINVAL); 217 if (VM_MIN_USER_ADDRESS > 0 && addr < VM_MIN_USER_ADDRESS) 218 return (EINVAL); 219 } else { 220 /* 221 * Get a hint of where to map. It also provides mmap offset 222 * randomization if enabled. 223 */ 224 addr = vm_map_hint(p, addr, prot); 225 } 226 227 if (flags & MAP_ANON) { 228 /* 229 * Mapping blank space is trivial. 230 */ 231 handle = NULL; 232 maxprot = VM_PROT_ALL; 233 } else { 234 /* 235 * Mapping file, get fp for validation. Obtain vnode and make 236 * sure it is of appropriate type. 237 */ 238 fp = holdfp(td, fd, -1); 239 if (fp == NULL) 240 return (EBADF); 241 if (fp->f_type != DTYPE_VNODE) { 242 error = EINVAL; 243 goto done; 244 } 245 /* 246 * POSIX shared-memory objects are defined to have 247 * kernel persistence, and are not defined to support 248 * read(2)/write(2) -- or even open(2). Thus, we can 249 * use MAP_ASYNC to trade on-disk coherence for speed. 250 * The shm_open(3) library routine turns on the FPOSIXSHM 251 * flag to request this behavior. 252 */ 253 if (fp->f_flag & FPOSIXSHM) 254 flags |= MAP_NOSYNC; 255 vp = (struct vnode *) fp->f_data; 256 257 /* 258 * Validate the vnode for the operation. 259 */ 260 switch(vp->v_type) { 261 case VREG: 262 /* 263 * Get the proper underlying object 264 */ 265 if ((obj = vp->v_object) == NULL) { 266 error = EINVAL; 267 goto done; 268 } 269 KKASSERT((struct vnode *)obj->handle == vp); 270 break; 271 case VCHR: 272 /* 273 * Make sure a device has not been revoked. 274 * Mappability is handled by the device layer. 275 */ 276 if (vp->v_rdev == NULL) { 277 error = EBADF; 278 goto done; 279 } 280 break; 281 default: 282 /* 283 * Nothing else is mappable. 284 */ 285 error = EINVAL; 286 goto done; 287 } 288 289 /* 290 * XXX hack to handle use of /dev/zero to map anon memory (ala 291 * SunOS). 292 */ 293 if (vp->v_type == VCHR && iszerodev(vp->v_rdev)) { 294 handle = NULL; 295 maxprot = VM_PROT_ALL; 296 flags |= MAP_ANON; 297 pos = 0; 298 } else { 299 /* 300 * cdevs does not provide private mappings of any kind. 301 */ 302 if (vp->v_type == VCHR && 303 (flags & (MAP_PRIVATE|MAP_COPY))) { 304 error = EINVAL; 305 goto done; 306 } 307 /* 308 * Ensure that file and memory protections are 309 * compatible. Note that we only worry about 310 * writability if mapping is shared; in this case, 311 * current and max prot are dictated by the open file. 312 * XXX use the vnode instead? Problem is: what 313 * credentials do we use for determination? What if 314 * proc does a setuid? 315 */ 316 maxprot = VM_PROT_EXECUTE; 317 if (fp->f_flag & FREAD) { 318 maxprot |= VM_PROT_READ; 319 } else if (prot & PROT_READ) { 320 error = EACCES; 321 goto done; 322 } 323 /* 324 * If we are sharing potential changes (either via 325 * MAP_SHARED or via the implicit sharing of character 326 * device mappings), and we are trying to get write 327 * permission although we opened it without asking 328 * for it, bail out. Check for superuser, only if 329 * we're at securelevel < 1, to allow the XIG X server 330 * to continue to work. 331 * 332 * PROT_WRITE + MAP_SHARED 333 */ 334 if ((flags & MAP_SHARED) != 0 || vp->v_type == VCHR) { 335 if ((fp->f_flag & FWRITE) != 0) { 336 struct vattr va; 337 if ((error = VOP_GETATTR(vp, &va))) { 338 goto done; 339 } 340 if ((va.va_flags & 341 (IMMUTABLE|APPEND)) == 0) { 342 maxprot |= VM_PROT_WRITE; 343 344 /* 345 * SHARED+RW file mmap() 346 * updates v_lastwrite_ts. 347 */ 348 if ((prot & PROT_WRITE) && 349 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY) == 0) { 350 vfs_timestamp(&vp->v_lastwrite_ts); 351 vsetflags(vp, VLASTWRITETS); 352 vn_unlock(vp); 353 } 354 } else if (prot & PROT_WRITE) { 355 error = EPERM; 356 goto done; 357 } 358 } else if ((prot & PROT_WRITE) != 0) { 359 error = EACCES; 360 goto done; 361 } 362 } else { 363 maxprot |= VM_PROT_WRITE; 364 } 365 handle = (void *)vp; 366 } 367 } 368 369 lwkt_gettoken(&vms->vm_map.token); 370 371 /* 372 * Do not allow more then a certain number of vm_map_entry structures 373 * per process. 0 to disable. 374 */ 375 if (max_proc_mmap && vms->vm_map.nentries >= max_proc_mmap) { 376 error = ENOMEM; 377 lwkt_reltoken(&vms->vm_map.token); 378 goto done; 379 } 380 381 error = vm_mmap(&vms->vm_map, &addr, size, prot, maxprot, 382 flags, handle, pos); 383 if (error == 0) 384 *res = (void *)(addr + pageoff); 385 386 lwkt_reltoken(&vms->vm_map.token); 387 done: 388 if (fp) 389 dropfp(td, fd, fp); 390 391 return (error); 392 } 393 394 /* 395 * mmap system call handler 396 * 397 * No requirements. 398 */ 399 int 400 sys_mmap(struct mmap_args *uap) 401 { 402 int error; 403 404 error = kern_mmap(curproc->p_vmspace, uap->addr, uap->len, 405 uap->prot, uap->flags, 406 uap->fd, uap->pos, &uap->sysmsg_resultp); 407 408 return (error); 409 } 410 411 /* 412 * msync system call handler 413 * 414 * msync_args(void *addr, size_t len, int flags) 415 * 416 * No requirements 417 */ 418 int 419 sys_msync(struct msync_args *uap) 420 { 421 struct proc *p = curproc; 422 vm_offset_t addr; 423 vm_offset_t tmpaddr; 424 vm_size_t size, pageoff; 425 int flags; 426 vm_map_t map; 427 int rv; 428 429 addr = (vm_offset_t) uap->addr; 430 size = uap->len; 431 flags = uap->flags; 432 433 pageoff = (addr & PAGE_MASK); 434 addr -= pageoff; 435 size += pageoff; 436 size = (vm_size_t) round_page(size); 437 if (size < uap->len) /* wrap */ 438 return(EINVAL); 439 tmpaddr = addr + size; /* workaround gcc4 opt */ 440 if (tmpaddr < addr) /* wrap */ 441 return(EINVAL); 442 443 if ((flags & (MS_ASYNC|MS_INVALIDATE)) == (MS_ASYNC|MS_INVALIDATE)) 444 return (EINVAL); 445 446 map = &p->p_vmspace->vm_map; 447 448 /* 449 * map->token serializes extracting the address range for size == 0 450 * msyncs with the vm_map_clean call; if the token were not held 451 * across the two calls, an intervening munmap/mmap pair, for example, 452 * could cause msync to occur on a wrong region. 453 */ 454 lwkt_gettoken(&map->token); 455 456 /* 457 * XXX Gak! If size is zero we are supposed to sync "all modified 458 * pages with the region containing addr". Unfortunately, we don't 459 * really keep track of individual mmaps so we approximate by flushing 460 * the range of the map entry containing addr. This can be incorrect 461 * if the region splits or is coalesced with a neighbor. 462 */ 463 if (size == 0) { 464 vm_map_entry_t entry; 465 466 vm_map_lock_read(map); 467 rv = vm_map_lookup_entry(map, addr, &entry); 468 if (rv == FALSE) { 469 vm_map_unlock_read(map); 470 rv = KERN_INVALID_ADDRESS; 471 goto done; 472 } 473 addr = entry->start; 474 size = entry->end - entry->start; 475 vm_map_unlock_read(map); 476 } 477 478 /* 479 * Clean the pages and interpret the return value. 480 */ 481 rv = vm_map_clean(map, addr, addr + size, (flags & MS_ASYNC) == 0, 482 (flags & MS_INVALIDATE) != 0); 483 done: 484 lwkt_reltoken(&map->token); 485 486 switch (rv) { 487 case KERN_SUCCESS: 488 break; 489 case KERN_INVALID_ADDRESS: 490 return (EINVAL); /* Sun returns ENOMEM? */ 491 case KERN_FAILURE: 492 return (EIO); 493 default: 494 return (EINVAL); 495 } 496 497 return (0); 498 } 499 500 /* 501 * munmap system call handler 502 * 503 * munmap_args(void *addr, size_t len) 504 * 505 * No requirements 506 */ 507 int 508 sys_munmap(struct munmap_args *uap) 509 { 510 struct proc *p = curproc; 511 vm_offset_t addr; 512 vm_offset_t tmpaddr; 513 vm_size_t size, pageoff; 514 vm_map_t map; 515 516 addr = (vm_offset_t) uap->addr; 517 size = uap->len; 518 519 pageoff = (addr & PAGE_MASK); 520 addr -= pageoff; 521 size += pageoff; 522 size = (vm_size_t) round_page(size); 523 if (size < uap->len) /* wrap */ 524 return(EINVAL); 525 tmpaddr = addr + size; /* workaround gcc4 opt */ 526 if (tmpaddr < addr) /* wrap */ 527 return(EINVAL); 528 529 if (size == 0) 530 return (0); 531 532 /* 533 * Check for illegal addresses. Watch out for address wrap... Note 534 * that VM_*_ADDRESS are not constants due to casts (argh). 535 */ 536 if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS) 537 return (EINVAL); 538 if (VM_MIN_USER_ADDRESS > 0 && addr < VM_MIN_USER_ADDRESS) 539 return (EINVAL); 540 541 map = &p->p_vmspace->vm_map; 542 543 /* map->token serializes between the map check and the actual unmap */ 544 lwkt_gettoken(&map->token); 545 546 /* 547 * Make sure entire range is allocated. 548 */ 549 if (!vm_map_check_protection(map, addr, addr + size, 550 VM_PROT_NONE, FALSE)) { 551 lwkt_reltoken(&map->token); 552 return (EINVAL); 553 } 554 /* returns nothing but KERN_SUCCESS anyway */ 555 vm_map_remove(map, addr, addr + size); 556 lwkt_reltoken(&map->token); 557 return (0); 558 } 559 560 /* 561 * mprotect_args(const void *addr, size_t len, int prot) 562 * 563 * No requirements. 564 */ 565 int 566 sys_mprotect(struct mprotect_args *uap) 567 { 568 struct proc *p = curproc; 569 vm_offset_t addr; 570 vm_offset_t tmpaddr; 571 vm_size_t size, pageoff; 572 vm_prot_t prot; 573 int error; 574 575 addr = (vm_offset_t) uap->addr; 576 size = uap->len; 577 prot = uap->prot & VM_PROT_ALL; 578 579 pageoff = (addr & PAGE_MASK); 580 addr -= pageoff; 581 size += pageoff; 582 size = (vm_size_t) round_page(size); 583 if (size < uap->len) /* wrap */ 584 return(EINVAL); 585 tmpaddr = addr + size; /* workaround gcc4 opt */ 586 if (tmpaddr < addr) /* wrap */ 587 return(EINVAL); 588 589 switch (vm_map_protect(&p->p_vmspace->vm_map, addr, addr + size, 590 prot, FALSE)) { 591 case KERN_SUCCESS: 592 error = 0; 593 break; 594 case KERN_PROTECTION_FAILURE: 595 error = EACCES; 596 break; 597 default: 598 error = EINVAL; 599 break; 600 } 601 return (error); 602 } 603 604 /* 605 * minherit system call handler 606 * 607 * minherit_args(void *addr, size_t len, int inherit) 608 * 609 * No requirements. 610 */ 611 int 612 sys_minherit(struct minherit_args *uap) 613 { 614 struct proc *p = curproc; 615 vm_offset_t addr; 616 vm_offset_t tmpaddr; 617 vm_size_t size, pageoff; 618 vm_inherit_t inherit; 619 int error; 620 621 addr = (vm_offset_t)uap->addr; 622 size = uap->len; 623 inherit = uap->inherit; 624 625 pageoff = (addr & PAGE_MASK); 626 addr -= pageoff; 627 size += pageoff; 628 size = (vm_size_t) round_page(size); 629 if (size < uap->len) /* wrap */ 630 return(EINVAL); 631 tmpaddr = addr + size; /* workaround gcc4 opt */ 632 if (tmpaddr < addr) /* wrap */ 633 return(EINVAL); 634 635 switch (vm_map_inherit(&p->p_vmspace->vm_map, addr, 636 addr + size, inherit)) { 637 case KERN_SUCCESS: 638 error = 0; 639 break; 640 case KERN_PROTECTION_FAILURE: 641 error = EACCES; 642 break; 643 default: 644 error = EINVAL; 645 break; 646 } 647 return (error); 648 } 649 650 /* 651 * madvise system call handler 652 * 653 * madvise_args(void *addr, size_t len, int behav) 654 * 655 * No requirements. 656 */ 657 int 658 sys_madvise(struct madvise_args *uap) 659 { 660 struct proc *p = curproc; 661 vm_offset_t start, end; 662 vm_offset_t tmpaddr = (vm_offset_t)uap->addr + uap->len; 663 int error; 664 665 /* 666 * Check for illegal behavior 667 */ 668 if (uap->behav < 0 || uap->behav >= MADV_CONTROL_END) 669 return (EINVAL); 670 /* 671 * Check for illegal addresses. Watch out for address wrap... Note 672 * that VM_*_ADDRESS are not constants due to casts (argh). 673 */ 674 if (tmpaddr < (vm_offset_t)uap->addr) 675 return (EINVAL); 676 if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS) 677 return (EINVAL); 678 if (VM_MIN_USER_ADDRESS > 0 && uap->addr < VM_MIN_USER_ADDRESS) 679 return (EINVAL); 680 681 /* 682 * Since this routine is only advisory, we default to conservative 683 * behavior. 684 */ 685 start = trunc_page((vm_offset_t)uap->addr); 686 end = round_page(tmpaddr); 687 688 error = vm_map_madvise(&p->p_vmspace->vm_map, start, end, 689 uap->behav, 0); 690 return (error); 691 } 692 693 /* 694 * mcontrol system call handler 695 * 696 * mcontrol_args(void *addr, size_t len, int behav, off_t value) 697 * 698 * No requirements 699 */ 700 int 701 sys_mcontrol(struct mcontrol_args *uap) 702 { 703 struct proc *p = curproc; 704 vm_offset_t start, end; 705 vm_offset_t tmpaddr = (vm_offset_t)uap->addr + uap->len; 706 int error; 707 708 /* 709 * Check for illegal behavior 710 */ 711 if (uap->behav < 0 || uap->behav > MADV_CONTROL_END) 712 return (EINVAL); 713 /* 714 * Check for illegal addresses. Watch out for address wrap... Note 715 * that VM_*_ADDRESS are not constants due to casts (argh). 716 */ 717 if (tmpaddr < (vm_offset_t) uap->addr) 718 return (EINVAL); 719 if (VM_MAX_USER_ADDRESS > 0 && tmpaddr > VM_MAX_USER_ADDRESS) 720 return (EINVAL); 721 if (VM_MIN_USER_ADDRESS > 0 && uap->addr < VM_MIN_USER_ADDRESS) 722 return (EINVAL); 723 724 /* 725 * Since this routine is only advisory, we default to conservative 726 * behavior. 727 */ 728 start = trunc_page((vm_offset_t)uap->addr); 729 end = round_page(tmpaddr); 730 731 error = vm_map_madvise(&p->p_vmspace->vm_map, start, end, 732 uap->behav, uap->value); 733 return (error); 734 } 735 736 737 /* 738 * mincore system call handler 739 * 740 * mincore_args(const void *addr, size_t len, char *vec) 741 * 742 * No requirements 743 */ 744 int 745 sys_mincore(struct mincore_args *uap) 746 { 747 struct proc *p = curproc; 748 vm_offset_t addr, first_addr; 749 vm_offset_t end, cend; 750 pmap_t pmap; 751 vm_map_t map; 752 char *vec; 753 int error; 754 int vecindex, lastvecindex; 755 vm_map_entry_t current; 756 vm_map_entry_t entry; 757 int mincoreinfo; 758 unsigned int timestamp; 759 760 /* 761 * Make sure that the addresses presented are valid for user 762 * mode. 763 */ 764 first_addr = addr = trunc_page((vm_offset_t) uap->addr); 765 end = addr + (vm_size_t)round_page(uap->len); 766 if (end < addr) 767 return (EINVAL); 768 if (VM_MAX_USER_ADDRESS > 0 && end > VM_MAX_USER_ADDRESS) 769 return (EINVAL); 770 771 /* 772 * Address of byte vector 773 */ 774 vec = uap->vec; 775 776 map = &p->p_vmspace->vm_map; 777 pmap = vmspace_pmap(p->p_vmspace); 778 779 lwkt_gettoken(&map->token); 780 vm_map_lock_read(map); 781 RestartScan: 782 timestamp = map->timestamp; 783 784 if (!vm_map_lookup_entry(map, addr, &entry)) 785 entry = RB_MIN(vm_map_rb_tree, &map->rb_root); 786 787 /* 788 * Do this on a map entry basis so that if the pages are not 789 * in the current processes address space, we can easily look 790 * up the pages elsewhere. 791 */ 792 lastvecindex = -1; 793 for (current = entry; 794 current && current->start < end; 795 current = vm_map_rb_tree_RB_NEXT(current)) { 796 /* 797 * ignore submaps (for now) or null objects 798 */ 799 if (current->maptype != VM_MAPTYPE_NORMAL && 800 current->maptype != VM_MAPTYPE_VPAGETABLE) { 801 continue; 802 } 803 if (current->object.vm_object == NULL) 804 continue; 805 806 /* 807 * limit this scan to the current map entry and the 808 * limits for the mincore call 809 */ 810 if (addr < current->start) 811 addr = current->start; 812 cend = current->end; 813 if (cend > end) 814 cend = end; 815 816 /* 817 * scan this entry one page at a time 818 */ 819 while (addr < cend) { 820 /* 821 * Check pmap first, it is likely faster, also 822 * it can provide info as to whether we are the 823 * one referencing or modifying the page. 824 * 825 * If we have to check the VM object, only mess 826 * around with normal maps. Do not mess around 827 * with virtual page tables (XXX). 828 */ 829 mincoreinfo = pmap_mincore(pmap, addr); 830 if (mincoreinfo == 0 && 831 current->maptype == VM_MAPTYPE_NORMAL) { 832 vm_pindex_t pindex; 833 vm_ooffset_t offset; 834 vm_page_t m; 835 836 /* 837 * calculate the page index into the object 838 */ 839 offset = current->offset + (addr - current->start); 840 pindex = OFF_TO_IDX(offset); 841 842 /* 843 * if the page is resident, then gather 844 * information about it. spl protection is 845 * required to maintain the object 846 * association. And XXX what if the page is 847 * busy? What's the deal with that? 848 * 849 * XXX vm_token - legacy for pmap_ts_referenced 850 * in x86 and vkernel pmap code. 851 */ 852 lwkt_gettoken(&vm_token); 853 vm_object_hold(current->object.vm_object); 854 m = vm_page_lookup(current->object.vm_object, 855 pindex); 856 if (m && m->valid) { 857 mincoreinfo = MINCORE_INCORE; 858 if (m->dirty || pmap_is_modified(m)) 859 mincoreinfo |= MINCORE_MODIFIED_OTHER; 860 if ((m->flags & PG_REFERENCED) || 861 pmap_ts_referenced(m)) { 862 vm_page_flag_set(m, PG_REFERENCED); 863 mincoreinfo |= MINCORE_REFERENCED_OTHER; 864 } 865 } 866 vm_object_drop(current->object.vm_object); 867 lwkt_reltoken(&vm_token); 868 } 869 870 /* 871 * subyte may page fault. In case it needs to modify 872 * the map, we release the lock. 873 */ 874 vm_map_unlock_read(map); 875 876 /* 877 * calculate index into user supplied byte vector 878 */ 879 vecindex = OFF_TO_IDX(addr - first_addr); 880 881 /* 882 * If we have skipped map entries, we need to make sure that 883 * the byte vector is zeroed for those skipped entries. 884 */ 885 while((lastvecindex + 1) < vecindex) { 886 error = subyte( vec + lastvecindex, 0); 887 if (error) { 888 error = EFAULT; 889 goto done; 890 } 891 ++lastvecindex; 892 } 893 894 /* 895 * Pass the page information to the user 896 */ 897 error = subyte(vec + vecindex, mincoreinfo); 898 if (error) { 899 error = EFAULT; 900 goto done; 901 } 902 903 /* 904 * If the map has changed, due to the subyte, 905 * the previous output may be invalid. 906 */ 907 vm_map_lock_read(map); 908 if (timestamp != map->timestamp) 909 goto RestartScan; 910 911 lastvecindex = vecindex; 912 addr += PAGE_SIZE; 913 } 914 } 915 916 /* 917 * subyte may page fault. In case it needs to modify 918 * the map, we release the lock. 919 */ 920 vm_map_unlock_read(map); 921 922 /* 923 * Zero the last entries in the byte vector. 924 */ 925 vecindex = OFF_TO_IDX(end - first_addr); 926 while((lastvecindex + 1) < vecindex) { 927 error = subyte( vec + lastvecindex, 0); 928 if (error) { 929 error = EFAULT; 930 goto done; 931 } 932 ++lastvecindex; 933 } 934 935 /* 936 * If the map has changed, due to the subyte, the previous 937 * output may be invalid. 938 */ 939 vm_map_lock_read(map); 940 if (timestamp != map->timestamp) 941 goto RestartScan; 942 vm_map_unlock_read(map); 943 944 error = 0; 945 done: 946 lwkt_reltoken(&map->token); 947 return (error); 948 } 949 950 /* 951 * mlock system call handler 952 * 953 * mlock_args(const void *addr, size_t len) 954 * 955 * No requirements 956 */ 957 int 958 sys_mlock(struct mlock_args *uap) 959 { 960 vm_offset_t addr; 961 vm_offset_t tmpaddr; 962 vm_size_t size, pageoff; 963 struct thread *td = curthread; 964 struct proc *p = td->td_proc; 965 int error; 966 967 addr = (vm_offset_t) uap->addr; 968 size = uap->len; 969 970 pageoff = (addr & PAGE_MASK); 971 addr -= pageoff; 972 size += pageoff; 973 size = (vm_size_t) round_page(size); 974 if (size < uap->len) /* wrap */ 975 return (EINVAL); 976 if (size == 0) /* silently allow 0 size */ 977 return (0); 978 tmpaddr = addr + size; /* workaround gcc4 opt */ 979 if (tmpaddr < addr) /* wrap */ 980 return (EINVAL); 981 982 if (atop(size) + vmstats.v_wire_count > vm_page_max_wired) 983 return (EAGAIN); 984 985 /* 986 * We do not need to synchronize against other threads updating ucred; 987 * they update p->ucred, which is synchronized into td_ucred ourselves. 988 */ 989 #ifdef pmap_wired_count 990 if (size + ptoa(pmap_wired_count(vm_map_pmap(&p->p_vmspace->vm_map))) > 991 p->p_rlimit[RLIMIT_MEMLOCK].rlim_cur) { 992 return (ENOMEM); 993 } 994 #else 995 error = priv_check_cred(td->td_ucred, PRIV_ROOT, 0); 996 if (error) { 997 return (error); 998 } 999 #endif 1000 error = vm_map_unwire(&p->p_vmspace->vm_map, addr, addr + size, FALSE); 1001 return (error == KERN_SUCCESS ? 0 : ENOMEM); 1002 } 1003 1004 /* 1005 * mlockall(int how) 1006 * 1007 * No requirements 1008 */ 1009 int 1010 sys_mlockall(struct mlockall_args *uap) 1011 { 1012 struct thread *td = curthread; 1013 struct proc *p = td->td_proc; 1014 vm_map_t map = &p->p_vmspace->vm_map; 1015 vm_map_entry_t entry; 1016 int how = uap->how; 1017 int rc = KERN_SUCCESS; 1018 1019 if (((how & MCL_CURRENT) == 0) && ((how & MCL_FUTURE) == 0)) 1020 return (EINVAL); 1021 1022 rc = priv_check_cred(td->td_ucred, PRIV_ROOT, 0); 1023 if (rc) 1024 return (rc); 1025 1026 vm_map_lock(map); 1027 do { 1028 if (how & MCL_CURRENT) { 1029 RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) { 1030 ; /* NOT IMPLEMENTED YET */ 1031 } 1032 rc = ENOSYS; 1033 break; 1034 } 1035 if (how & MCL_FUTURE) 1036 map->flags |= MAP_WIREFUTURE; 1037 } while(0); 1038 vm_map_unlock(map); 1039 1040 return (rc); 1041 } 1042 1043 /* 1044 * munlockall(void) 1045 * 1046 * Unwire all user-wired map entries, cancel MCL_FUTURE. 1047 * 1048 * No requirements 1049 */ 1050 int 1051 sys_munlockall(struct munlockall_args *uap) 1052 { 1053 struct thread *td = curthread; 1054 struct proc *p = td->td_proc; 1055 vm_map_t map = &p->p_vmspace->vm_map; 1056 vm_map_entry_t entry; 1057 int rc = KERN_SUCCESS; 1058 1059 vm_map_lock(map); 1060 1061 /* Clear MAP_WIREFUTURE to cancel mlockall(MCL_FUTURE) */ 1062 map->flags &= ~MAP_WIREFUTURE; 1063 1064 retry: 1065 RB_FOREACH(entry, vm_map_rb_tree, &map->rb_root) { 1066 if ((entry->eflags & MAP_ENTRY_USER_WIRED) == 0) 1067 continue; 1068 1069 /* 1070 * If we encounter an in-transition entry, we release the 1071 * map lock and retry the scan; we do not decrement any 1072 * wired_count more than once because we do not touch 1073 * any entries with MAP_ENTRY_USER_WIRED not set. 1074 * 1075 * There is a potential interleaving with concurrent 1076 * mlockall()s here -- if we abort a scan, an mlockall() 1077 * could start, wire a number of entries before our 1078 * current position in, and then stall itself on this 1079 * or any other in-transition entry. If that occurs, when 1080 * we resume, we will unwire those entries. 1081 */ 1082 if (entry->eflags & MAP_ENTRY_IN_TRANSITION) { 1083 entry->eflags |= MAP_ENTRY_NEEDS_WAKEUP; 1084 ++mycpu->gd_cnt.v_intrans_coll; 1085 ++mycpu->gd_cnt.v_intrans_wait; 1086 vm_map_transition_wait(map, 1); 1087 goto retry; 1088 } 1089 1090 KASSERT(entry->wired_count > 0, 1091 ("wired_count was 0 with USER_WIRED set! %p", entry)); 1092 1093 /* Drop wired count, if it hits zero, unwire the entry */ 1094 entry->eflags &= ~MAP_ENTRY_USER_WIRED; 1095 entry->wired_count--; 1096 if (entry->wired_count == 0) 1097 vm_fault_unwire(map, entry); 1098 } 1099 1100 vm_map_unlock(map); 1101 1102 return (rc); 1103 } 1104 1105 /* 1106 * munlock system call handler 1107 * 1108 * munlock_args(const void *addr, size_t len) 1109 * 1110 * No requirements 1111 */ 1112 int 1113 sys_munlock(struct munlock_args *uap) 1114 { 1115 struct thread *td = curthread; 1116 struct proc *p = td->td_proc; 1117 vm_offset_t addr; 1118 vm_offset_t tmpaddr; 1119 vm_size_t size, pageoff; 1120 int error; 1121 1122 addr = (vm_offset_t) uap->addr; 1123 size = uap->len; 1124 1125 pageoff = (addr & PAGE_MASK); 1126 addr -= pageoff; 1127 size += pageoff; 1128 size = (vm_size_t) round_page(size); 1129 1130 tmpaddr = addr + size; 1131 if (tmpaddr < addr) /* wrap */ 1132 return (EINVAL); 1133 if (size == 0) /* silently allow 0 size */ 1134 return (0); 1135 1136 #ifndef pmap_wired_count 1137 error = priv_check(td, PRIV_ROOT); 1138 if (error) 1139 return (error); 1140 #endif 1141 1142 error = vm_map_unwire(&p->p_vmspace->vm_map, addr, addr + size, TRUE); 1143 return (error == KERN_SUCCESS ? 0 : ENOMEM); 1144 } 1145 1146 /* 1147 * Internal version of mmap. 1148 * Currently used by mmap, exec, and sys5 shared memory. 1149 * Handle is either a vnode pointer or NULL for MAP_ANON. 1150 * 1151 * No requirements 1152 */ 1153 int 1154 vm_mmap(vm_map_t map, vm_offset_t *addr, vm_size_t size, vm_prot_t prot, 1155 vm_prot_t maxprot, int flags, void *handle, vm_ooffset_t foff) 1156 { 1157 boolean_t fitit; 1158 vm_object_t object; 1159 vm_offset_t eaddr; 1160 vm_size_t esize; 1161 vm_size_t align; 1162 int (*uksmap)(cdev_t dev, vm_page_t fake); 1163 struct vnode *vp; 1164 struct thread *td = curthread; 1165 struct proc *p; 1166 int rv = KERN_SUCCESS; 1167 off_t objsize; 1168 int docow; 1169 int error; 1170 1171 if (size == 0) 1172 return (0); 1173 1174 objsize = round_page(size); 1175 if (objsize < size) 1176 return (EINVAL); 1177 size = objsize; 1178 1179 lwkt_gettoken(&map->token); 1180 1181 /* 1182 * XXX messy code, fixme 1183 * 1184 * NOTE: Overflow checks require discrete statements or GCC4 1185 * will optimize it out. 1186 */ 1187 if ((p = curproc) != NULL && map == &p->p_vmspace->vm_map) { 1188 esize = map->size + size; /* workaround gcc4 opt */ 1189 if (esize < map->size || 1190 esize > p->p_rlimit[RLIMIT_VMEM].rlim_cur) { 1191 lwkt_reltoken(&map->token); 1192 return(ENOMEM); 1193 } 1194 } 1195 1196 /* 1197 * We currently can only deal with page aligned file offsets. 1198 * The check is here rather than in the syscall because the 1199 * kernel calls this function internally for other mmaping 1200 * operations (such as in exec) and non-aligned offsets will 1201 * cause pmap inconsistencies...so we want to be sure to 1202 * disallow this in all cases. 1203 * 1204 * NOTE: Overflow checks require discrete statements or GCC4 1205 * will optimize it out. 1206 */ 1207 if (foff & PAGE_MASK) { 1208 lwkt_reltoken(&map->token); 1209 return (EINVAL); 1210 } 1211 1212 /* 1213 * Handle alignment. For large memory maps it is possible 1214 * that the MMU can optimize the page table so align anything 1215 * that is a multiple of SEG_SIZE to SEG_SIZE. 1216 * 1217 * Also align any large mapping (bigger than 16x SG_SIZE) to a 1218 * SEG_SIZE address boundary. 1219 */ 1220 if (flags & MAP_SIZEALIGN) { 1221 align = size; 1222 if ((align ^ (align - 1)) != (align << 1) - 1) { 1223 lwkt_reltoken(&map->token); 1224 return (EINVAL); 1225 } 1226 } else if ((flags & MAP_FIXED) == 0 && 1227 ((size & SEG_MASK) == 0 || size > SEG_SIZE * 16)) { 1228 align = SEG_SIZE; 1229 } else { 1230 align = PAGE_SIZE; 1231 } 1232 1233 if ((flags & (MAP_FIXED | MAP_TRYFIXED)) == 0) { 1234 fitit = TRUE; 1235 *addr = round_page(*addr); 1236 } else { 1237 if (*addr != trunc_page(*addr)) { 1238 lwkt_reltoken(&map->token); 1239 return (EINVAL); 1240 } 1241 eaddr = *addr + size; 1242 if (eaddr < *addr) { 1243 lwkt_reltoken(&map->token); 1244 return (EINVAL); 1245 } 1246 fitit = FALSE; 1247 if ((flags & MAP_TRYFIXED) == 0) 1248 vm_map_remove(map, *addr, *addr + size); 1249 } 1250 1251 uksmap = NULL; 1252 1253 /* 1254 * Lookup/allocate object. 1255 */ 1256 if (flags & MAP_ANON) { 1257 /* 1258 * Unnamed anonymous regions always start at 0. 1259 */ 1260 if (handle) { 1261 /* 1262 * Default memory object 1263 */ 1264 object = default_pager_alloc(handle, objsize, 1265 prot, foff); 1266 if (object == NULL) { 1267 lwkt_reltoken(&map->token); 1268 return(ENOMEM); 1269 } 1270 docow = MAP_PREFAULT_PARTIAL; 1271 } else { 1272 /* 1273 * Implicit single instance of a default memory 1274 * object, so we don't need a VM object yet. 1275 */ 1276 foff = 0; 1277 object = NULL; 1278 docow = 0; 1279 } 1280 vp = NULL; 1281 } else { 1282 vp = (struct vnode *)handle; 1283 1284 /* 1285 * Non-anonymous mappings of VCHR (aka not /dev/zero) 1286 * cannot specify MAP_STACK or MAP_VPAGETABLE. 1287 */ 1288 if (vp->v_type == VCHR) { 1289 if (flags & (MAP_STACK | MAP_VPAGETABLE)) { 1290 lwkt_reltoken(&map->token); 1291 return(EINVAL); 1292 } 1293 } 1294 1295 if (vp->v_type == VCHR && vp->v_rdev->si_ops->d_uksmap) { 1296 /* 1297 * Device mappings without a VM object, typically 1298 * sharing permanently allocated kernel memory or 1299 * process-context-specific (per-process) data. 1300 * 1301 * Force them to be shared. 1302 */ 1303 uksmap = vp->v_rdev->si_ops->d_uksmap; 1304 object = NULL; 1305 docow = MAP_PREFAULT_PARTIAL; 1306 flags &= ~(MAP_PRIVATE|MAP_COPY); 1307 flags |= MAP_SHARED; 1308 } else if (vp->v_type == VCHR) { 1309 /* 1310 * Device mappings (device size unknown?). 1311 * Force them to be shared. 1312 */ 1313 error = dev_dmmap_single(vp->v_rdev, &foff, objsize, 1314 &object, prot, NULL); 1315 1316 if (error == ENODEV) { 1317 handle = (void *)(intptr_t)vp->v_rdev; 1318 object = dev_pager_alloc(handle, objsize, prot, foff); 1319 if (object == NULL) { 1320 lwkt_reltoken(&map->token); 1321 return(EINVAL); 1322 } 1323 } else if (error) { 1324 lwkt_reltoken(&map->token); 1325 return(error); 1326 } 1327 1328 docow = MAP_PREFAULT_PARTIAL; 1329 flags &= ~(MAP_PRIVATE|MAP_COPY); 1330 flags |= MAP_SHARED; 1331 } else { 1332 /* 1333 * Regular file mapping (typically). The attribute 1334 * check is for the link count test only. mmapable 1335 * vnodes must already have a VM object assigned. 1336 */ 1337 struct vattr vat; 1338 int error; 1339 1340 error = VOP_GETATTR(vp, &vat); 1341 if (error) { 1342 lwkt_reltoken(&map->token); 1343 return (error); 1344 } 1345 docow = MAP_PREFAULT_PARTIAL; 1346 object = vnode_pager_reference(vp); 1347 if (object == NULL && vp->v_type == VREG) { 1348 lwkt_reltoken(&map->token); 1349 kprintf("Warning: cannot mmap vnode %p, no " 1350 "object\n", vp); 1351 return(EINVAL); 1352 } 1353 1354 /* 1355 * If it is a regular file without any references 1356 * we do not need to sync it. 1357 */ 1358 if (vp->v_type == VREG && vat.va_nlink == 0) { 1359 flags |= MAP_NOSYNC; 1360 } 1361 } 1362 } 1363 1364 /* 1365 * Deal with the adjusted flags 1366 */ 1367 if ((flags & (MAP_ANON|MAP_SHARED)) == 0) 1368 docow |= MAP_COPY_ON_WRITE; 1369 if (flags & MAP_NOSYNC) 1370 docow |= MAP_DISABLE_SYNCER; 1371 if (flags & MAP_NOCORE) 1372 docow |= MAP_DISABLE_COREDUMP; 1373 1374 /* 1375 * This may place the area in its own page directory if (size) is 1376 * large enough, otherwise it typically returns its argument. 1377 * 1378 * (object can be NULL) 1379 */ 1380 if (fitit) { 1381 *addr = pmap_addr_hint(object, *addr, size); 1382 } 1383 1384 /* 1385 * Stack mappings need special attention. 1386 * 1387 * Mappings that use virtual page tables will default to storing 1388 * the page table at offset 0. 1389 */ 1390 if (uksmap) { 1391 rv = vm_map_find(map, uksmap, vp->v_rdev, 1392 foff, addr, size, 1393 align, fitit, 1394 VM_MAPTYPE_UKSMAP, VM_SUBSYS_MMAP, 1395 prot, maxprot, docow); 1396 } else if (flags & MAP_STACK) { 1397 rv = vm_map_stack(map, *addr, size, flags, 1398 prot, maxprot, docow); 1399 } else if (flags & MAP_VPAGETABLE) { 1400 rv = vm_map_find(map, object, NULL, 1401 foff, addr, size, 1402 align, fitit, 1403 VM_MAPTYPE_VPAGETABLE, VM_SUBSYS_MMAP, 1404 prot, maxprot, docow); 1405 } else { 1406 rv = vm_map_find(map, object, NULL, 1407 foff, addr, size, 1408 align, fitit, 1409 VM_MAPTYPE_NORMAL, VM_SUBSYS_MMAP, 1410 prot, maxprot, docow); 1411 } 1412 1413 if (rv != KERN_SUCCESS) { 1414 /* 1415 * Lose the object reference. Will destroy the 1416 * object if it's an unnamed anonymous mapping 1417 * or named anonymous without other references. 1418 * 1419 * (NOTE: object can be NULL) 1420 */ 1421 vm_object_deallocate(object); 1422 goto out; 1423 } 1424 1425 /* 1426 * Shared memory is also shared with children. 1427 */ 1428 if (flags & (MAP_SHARED|MAP_INHERIT)) { 1429 rv = vm_map_inherit(map, *addr, *addr + size, VM_INHERIT_SHARE); 1430 if (rv != KERN_SUCCESS) { 1431 vm_map_remove(map, *addr, *addr + size); 1432 goto out; 1433 } 1434 } 1435 1436 /* If a process has marked all future mappings for wiring, do so */ 1437 if ((rv == KERN_SUCCESS) && (map->flags & MAP_WIREFUTURE)) 1438 vm_map_unwire(map, *addr, *addr + size, FALSE); 1439 1440 /* 1441 * Set the access time on the vnode 1442 */ 1443 if (vp != NULL) 1444 vn_mark_atime(vp, td); 1445 out: 1446 lwkt_reltoken(&map->token); 1447 1448 switch (rv) { 1449 case KERN_SUCCESS: 1450 return (0); 1451 case KERN_INVALID_ADDRESS: 1452 case KERN_NO_SPACE: 1453 return (ENOMEM); 1454 case KERN_PROTECTION_FAILURE: 1455 return (EACCES); 1456 default: 1457 return (EINVAL); 1458 } 1459 } 1460 1461 /* 1462 * Translate a Mach VM return code to zero on success or the appropriate errno 1463 * on failure. 1464 */ 1465 int 1466 vm_mmap_to_errno(int rv) 1467 { 1468 1469 switch (rv) { 1470 case KERN_SUCCESS: 1471 return (0); 1472 case KERN_INVALID_ADDRESS: 1473 case KERN_NO_SPACE: 1474 return (ENOMEM); 1475 case KERN_PROTECTION_FAILURE: 1476 return (EACCES); 1477 default: 1478 return (EINVAL); 1479 } 1480 } 1481