do_mmap(9)

💅 do_mmap — the Kernel API Manual, bestie edition 🎀

okay so you're looking at do_mmap(9) from the Kernel API Manual and honestly? iconic function, slightly scary responsibilities, we'll get through it together fr fr 🫶

---

✨ NAME ✨

do_mmap — perform a userland memory mapping into the current process address space 🗺️

So like, the mapping is len long, protection bits are prot, mmap flags are flags (and yes, the VMA flags get inferred from those), plus any extra VMA flags you wanna slap on go in vma_flags. And if this is a file-backed mapping? The file itself is file, and the page offset into that file is pgoff. Periodt. 💅

---

🌸 SYNOPSIS 🌸

unsigned long do_mmap (struct file *file , unsigned long addr , unsigned
long len , unsigned long prot , unsigned long flags , vma_flags_t
vma_flags , unsigned long pgoff , unsigned long *populate , struct
list_head *uf );

look at all those parameters. main character energy honestly 👑

---

🦋 ARGUMENTS 🦋

• file — an optional struct file pointer describing the file that's getting mapped, but only if this is a file-backed mapping. no file, no problem 💖
• addr — if it's non-zero, this hints at the address for the mapping — or, if flags has MAP_FIXED set, it straight up specifies it. see mmap (2) for the details. must be page-aligned ⚠️
• len — how long the mapping is. it'll get page-aligned, and it must be at least 1 page in size. no tiny mappings, sorry babe 🙈
• prot — protection bits describing the access the mapping needs. see mmap (2) for details ✨
• flags — flags saying how the mapping should be performed. see mmap (2) for details ✨
• vma_flags — VMA flags that should be set by default, or EMPTY_VMA_FLAGS if there aren't any 🫙
• pgoff — page offset into the file if it's file-backed. otherwise it should be 0 🍩
• populate — pointer to a value that gets set to 0 if no population of the range is needed, or to the number of bytes to populate if it is needed. must be non-NULL. see mmap (2) for when population of the range actually happens 👀
• uf — an optional pointer to a list head for tracking userfaultfd unmap events, in case unmap events arise. if you provide it, managing it is on you, the caller 🫵

---

🔥 DESCRIPTION 🔥

okay real talk, this function does not do security checks on the file. and if uf is non-NULL, it just assumes the caller already handed over a list head to track unmap events for userfaultfd uf. trust falls, but make it kernel 💀

It also doesn't actually do the populating — it just indicates whether memory population is required by setting populate (which must be non-NULL), and expects the caller to go do that task itself if appropriate. it's giving delegating queen 👑

If it's not MAP_FIXED, this function invokes architecture-specific logic — and if provided and relevant, file system-specific logic too — to figure out the most appropriate unmapped area to place the mapping in. cozy little spot-finding mission 🧚

Callers that want the full userland mmap behaviour should invoke vm_mmap, which is also exported for module use. that's the deluxe version ✨

Callers that want this behaviour minus the security checks, userfaultfd and populate behaviour — and who handle the mmap write lock themselves — should call this function. DIY vibes 🔧

⚠️ heads up: the returned address may live inside a merged VMA if an appropriate merge happens. so it doesn't necessarily mark the start of a VMA — it's only the start of a valid mapped range of len bytes, rounded down to the nearest page size. don't @ me 😭

🔒 The caller must write-lock current->mm->mmap_lock. no cap, this is not optional, lock it or flop it.

---

⭐ RETURN ⭐

Either an error, or the address at which the requested mapping has been performed. like, one of those two. that's the whole range, bestie 🌈

---

🐚 SEE ALSO 🐚

Kernel file ./mm/mmap.c, find_vma_intersection(9), find_vma(9), find_vma_prev(9)

---

and that's the page!! 🎀 from ./mm, dated October 2026, and it's do_mmap(9) the whole way through — slay, go map some memory responsibly bestie 💜✨