> 	mmap((void *)0x50000000, 4096, PROT_READ, 0, fd, 0);
> 	mmap((void *)0x50000000, 4096, PROT_READ, MAP_FIXED, fd, 0);
> 	mmap((void *)0x50000000, 4096, PROT_READ, 0, fd, 0);
> 	mmap((void *)0x50000000, 4096, PROT_READ, MAP_FIXED, fd, 0);

> Here I expected the second and the fourth mmap()'s would fail, since
> there was a mapping already done at 0x50000000 by the first mmap.
> Even if the second succeeded, I expected at least the fourth would
> fail.  The result was that they _all_ succeded.

mmap(2) - at least on my machines - says, in part,

A successful
.Fa mmap
deletes any previous mapping in the allocated address range.

This seems to me to be a fairly clear statement that if you mmap
something on top of something else, the previous mapping is, to the
extent that it conflicts with the new one, unmapped and replaced.

> (I don't understand why it also says "If the specified address cannot
> be used, mmap will fail" even though it returns success for the
> address that can't be used as the above)

But that address _can_ be used.  On some architectures, there are
addresses that _cannot_ be used even though they're page-aligned; for
example, on the VAX, nothing the OS can do can create a mapping between
0xc0000000 and 0xffffffff.  (It could be faked, but only by having
every access fault and get emulated.)  (Actually, that should be
qualified.  On at least some VAXen, that's how it is; newer machines
have rewritten parts of the architecture reference manual in some ways,
and there may be some that have redone the VM stuff enough to allow
references to the top quarter-moby.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       mouse@rodents.montreal.qc.ca
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B