feat: extend mmap with Vma

include/paging.h

@@ -7,8 +7,82 @@
 #define pageWrite   0x2
 #define pageUser    0x4
 
+/* Real x86_64 PTE bit 63 (XD/NX) -- refuses instruction fetch against a
+   page that has it set, enforced by the CPU itself once
+   pagingNxSupported() is true (boot.S enables IA32_EFER.NXE at boot,
+   gated on CPUID.80000001H:EDX.NX so this never sets a reserved bit on
+   hardware/hypervisors that predate it). pagingMap silently drops this
+   bit from the leaf entry it writes when NX is not supported -- the page
+   stays executable rather than risk a reserved-bit #PF, an honest
+   best-effort rather than a promise this bit is always enforced. */
+#define pageNoExecute 0x8000000000000000ull
+
+/* True once boot.S has confirmed both that the CPU reports
+   CPUID.80000001H:EDX.NX and that IA32_EFER.NXE was actually set --
+   callers that care whether pageNoExecute is real hardware enforcement
+   (as opposed to a bit pagingMap quietly ignored) check this. */
+bool pagingNxSupported(void);
+
 bool pagingMap(uint64 virtualAddr, uint64 physicalAddr, uint64 flags);
 uint64 pagingResolve(uint64 virtualAddr);
+
+/* True if virtualAddr is currently mapped AND executable (present, and
+   either pageNoExecute was never asked for or the CPU cannot enforce it
+   -- see pagingNxSupported). False for an unmapped address or one mapped
+   with pageNoExecute successfully applied. Introspection only, used by
+   pagingTest.c/mmapTest.c to verify pagingMap/pagingMapUserRangeFlags
+   actually wrote the bit they were asked to, without needing a live
+   instruction-fetch fault to prove it indirectly. */
+bool pagingIsExecutable(uint64 virtualAddr);
+
+/* Same shape as pagingIsExecutable, for pageWrite instead of pageNoExecute:
+   true if virtualAddr is currently mapped AND writable, false for an
+   unmapped address or one mapped without pageWrite. Introspection only,
+   added alongside pagingMapUserRangeExact so pagingTest.c can prove a
+   range came back genuinely read-only (e.g. an ELF binary's own .text/
+   .rodata, elf.c's elfLoad) directly, without needing a live user-mode
+   write fault to prove it indirectly the way user/elfwritevictim.c's
+   SIGSEGV does. */
+bool pagingIsWritable(uint64 virtualAddr);
+
 bool pagingMapUserRange(uint64 virtualAddr, uint64 size);
 
+/* Same as pagingMapUserRange, plus extraFlags (pageNoExecute, currently
+   the only bit worth passing here) OR'd into every leaf PTE this call
+   creates -- pagingMapUserRange itself is a thin wrapper passing 0.
+   Callers that want a non-executable range (a stack, a brk-grown heap --
+   see kmain.c/syscall.c/jobctl.c's stack setup and sched.c's
+   currentThreadSbrk) pass pageNoExecute. A thin wrapper itself, over
+   pagingMapUserRangeExact below, that always forces pageWrite on --
+   every caller of this entry point (the ones just named, plus
+   pagingMapUserRange) wants a writable range and only ever varies whether
+   it is also executable. elf.c's own per-ELF-segment loader is the one
+   caller in this kernel that needs a range which may be READ-ONLY too (a
+   binary's own .text/.rodata), so it calls pagingMapUserRangeExact
+   directly instead. */
+bool pagingMapUserRangeFlags(uint64 virtualAddr, uint64 size, uint64 extraFlags);
+
+/* Lowest-level of the three pagingMapUserRange* entry points: flags is
+   the exact set of extra leaf PTE bits (pageWrite, pageNoExecute) OR'd
+   onto pageUser for every page in the range -- unlike
+   pagingMapUserRangeFlags, pageWrite is NOT forced on, so a caller that
+   omits it gets a genuinely read-only mapping. elf.c's elfLoad is the
+   only caller today: each ELF program header's own p_flags (via
+   elfSegmentPagingFlags) decides per-segment whether the range this call
+   maps is writable, executable, both, or (read-only, non-executable)
+   neither -- real per-segment W^X instead of one blanket writable+
+   executable range for a whole binary's image. */
+bool pagingMapUserRangeExact(uint64 virtualAddr, uint64 size, uint64 flags);
+
+/* Inverse of pagingMapUserRange: walks [virtualAddr, virtualAddr+size) one
+   frame at a time and, for every page that is actually present, gives its
+   physical frame back to the pmm and clears the PTE (present bit gone,
+   TLB invalidated). Pages that were never mapped -- including whole page-
+   table levels that were never allocated -- are silently skipped rather
+   than treated as an error: callers (threadReap/threadDiscard in sched.c,
+   doExec in syscall.c) always unmap a thread's whole elfSlotSize-sized
+   slot, most of which a typical small user program never touches. Safe to
+   call on a range that overlaps no mapping at all (a no-op). */
+void pagingUnmapUserRange(uint64 virtualAddr, uint64 size);
+
 #endif