mmap() - Unix, Linux System Call
mmap, munmap - map or unmap files or devices into memory
void *mmap(void *start, size_t length, int prot, int flags,
int fd, off_t offset);
int munmap(void *start, size_t length);
mmap() function asks to map
length bytes starting at offset
offset from the file (or other object) specified by the file descriptor
fd into memory, preferably at address
start. This latter address is a hint only, and is usually specified as 0.
The actual place where the object is mapped is returned by
prot argument describes the desired memory protection (and must not
conflict with the open mode of the file). It is either
PROT_NONE or is the bitwise OR of one or more of the other PROT_* flags.
flags parameter specifies the type of the mapped object, mapping options and
whether modifications made to the mapped copy of the page are private to
the process or are to be shared with other references.
It has bits
Pages may be executed.
Pages may be read.
Pages may be written.
Pages may not be accessed.
You must specify exactly one of
Do not select a different address than the one specified.
If the memory region specified by
len overlaps pages of any existing mapping(s), then the overlapped
part of the existing mapping(s) will be discarded.
If the specified address cannot be used,
mmap() will fail.
MAP_FIXED is specified,
start must be a multiple of the page size.
Use of this option is discouraged.
Share this mapping with all other processes that map this object.
Storing to the region is equivalent to writing to the file.
The file may not actually be updated until
Create a private copy-on-write mapping.
Stores to the region do not affect the original file.
It is unspecified whether changes made to the file after the
mmap() call are visible in the mapped region.
The above three flags are described in POSIX.1-2001.
Linux also knows about the following non-standard flags:
Some systems document the additional flags MAP_AUTOGROW, MAP_AUTORESRV,
MAP_COPY, and MAP_LOCAL.
This flag is ignored.
(Long ago, it signalled that attempts to write to the underlying file
should fail with
ETXTBUSY. But this was a source of denial-of-service attacks.)
This flag is ignored.
Do not reserve swap space for this mapping.
When swap space is reserved, one has the guarantee
that it is possible to modify the mapping.
When swap space is not reserved one might get SIGSEGV upon a write
if no physical memory is available.
See also the discussion of the file
In kernels before 2.6, this flag only had effect for
private writable mappings.
MAP_LOCKED (since Linux 2.5.37) |
Lock the pages of the mapped region into memory in the manner of
mlock(). This flag is ignored in older kernels.
Used for stacks. Indicates to the kernel VM system that the mapping
should extend downwards in memory.
The mapping is not backed by any file; the
offset arguments are ignored.
The use of this flag in conjunction with
MAP_SHARED is only supported on Linux since kernel 2.4.
Compatibility flag. Ignored.
Put the mapping into the first 2GB of the process address space.
MAP_FIXED is set.
This flag is currently only supported on x86-64 for 64bit programs.
MAP_POPULATE (since Linux 2.5.46) |
Populate (prefault) page tables for a file mapping,
by performing read-ahead on the file.
Later accesses to the mapping will not be bocked by page faults.
MAP_NONBLOCK (since Linux 2.5.46) |
Only meaningful in conjunction with
MAP_POPULATE. Dont perform read-ahead:
only create page tables entries for pages
that are already present in RAM.
fd should be a valid file descriptor, unless
MAP_ANONYMOUS is set.
MAP_ANONYMOUS is set, then
fd is ignored on Linux.
However, some implementations require
fd to be -1 if
MAP_ANON) is specified,
and portable applications should ensure this.
offset should be a multiple of the page size as returned by
Memory mapped by
mmap() is preserved across
with the same attributes.
A file is mapped in multiples of the page size. For a file that is not
a multiple of the page size, the remaining memory is zeroed when mapped,
and writes to that region are not written out to the file. The effect of
changing the size of the underlying file of a mapping on the pages that
correspond to added or removed regions of the file is unspecified.
munmap() system call deletes the mappings for the specified address range, and
causes further references to addresses within the range to generate
invalid memory references. The region is also automatically unmapped
when the process is terminated. On the other hand, closing the file
descriptor does not unmap the region.
start must be a multiple of the page size. All pages containing a part
of the indicated range are unmapped, and subsequent references
to these pages will generate SIGSEGV. It is not an error if the
indicated range does not contain any mapped pages.
For file-backed mappings, the
st_atime field for the mapped file may be updated at any time between the
mmap() and the corresponding unmapping; the first reference to a mapped
page will update the field if it has not been already.
st_mtime field for a file mapped with
MAP_SHARED will be updated after
a write to the mapped region, and before a subsequent
msync() with the
MS_ASYNC flag, if one occurs.
mmap() returns a pointer to the mapped area.
On error, the value
MAP_FAILED (that is, (void *) -1) is returned, and
errno is set appropriately.
munmap() returns 0, on failure -1, and
errno is set (probably to
It is architecture dependent whether
PROT_EXEC or not. Portable programs should always set
PROT_EXEC if they intend to execute code in the new mapping.
A file descriptor refers to a non-regular file.
MAP_PRIVATE was requested, but
fd is not open for reading.
MAP_SHARED was requested and
PROT_WRITE is set, but
fd is not open in read/write (O_RDWR) mode.
PROT_WRITE is set, but the file is append-only.
The file has been locked, or too much memory has been locked (see
fd is not a valid file descriptor (and
MAP_ANONYMOUS was not set).
We dont like
offset. (E.g., they are too large, or not aligned on a page boundary.)
The system limit on the total number of open files has been reached.
The underlying filesystem of the specified file does not support
No memory is available, or the processs maximum number of mappings would
have been exceeded.
prot argument asks for
PROT_EXEC but the mapped area belongs to a file on a filesystem that
was mounted no-exec.
MAP_DENYWRITE was set but the object specified by
fd is open for writing.
Use of a mapped region can result in these signals:
Attempted write into a region mapped as read-only.
Attempted access to a portion of the buffer that does not correspond
to the file (for example, beyond the end of the file, including the
case where another process has truncated the file).
On POSIX systems on which
mmap(), msync() and
munmap() are available,
_POSIX_MAPPED_FILES is defined in <unistd.h> to a value greater than 0. (See also
SVr4, 4.4BSD, POSIX.1-2001.
On Linux there are no guarantees like those suggested above under
MAP_NORESERVE. By default, any process can be killed
at any moment when the system runs out of memory.
In kernels before 2.6.7, the
MAP_POPULATE flag only has effect if
prot is specified as
B.O. Gallmeister, POSIX.4, OReilly, pp. 128-129 and 389-391.