sys/kern/sysv_shm.c

   1 /*      $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $      */
   2 /*-
   3  * Copyright (c) 1994 Adam Glass and Charles Hannum.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Adam Glass and Charles
  16  *      Hannum.
  17  * 4. The names of the authors may not be used to endorse or promote products
  18  *    derived from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
  21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  23  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  */
  31 /*-
  32  * Copyright (c) 2003-2005 McAfee, Inc.
  33  * All rights reserved.
  34  *
  35  * This software was developed for the FreeBSD Project in part by McAfee
  36  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
  37  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
  38  * program.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  59  * SUCH DAMAGE.
  60  */
  61
  62 #include <sys/cdefs.h>
  63 __FBSDID("$FreeBSD$");
  64
  65 #include "opt_compat.h"
  66 #include "opt_sysvipc.h"
  67 #include "opt_mac.h"
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/kernel.h>
  72 #include <sys/lock.h>
  73 #include <sys/sysctl.h>
  74 #include <sys/shm.h>
  75 #include <sys/proc.h>
  76 #include <sys/malloc.h>
  77 #include <sys/mman.h>
  78 #include <sys/module.h>
  79 #include <sys/mutex.h>
  80 #include <sys/resourcevar.h>
  81 #include <sys/stat.h>
  82 #include <sys/syscall.h>
  83 #include <sys/syscallsubr.h>
  84 #include <sys/sysent.h>
  85 #include <sys/sysproto.h>
  86 #include <sys/jail.h>
  87
  88 #include <security/mac/mac_framework.h>
  89
  90 #include <vm/vm.h>
  91 #include <vm/vm_param.h>
  92 #include <vm/pmap.h>
  93 #include <vm/vm_object.h>
  94 #include <vm/vm_map.h>
  95 #include <vm/vm_page.h>
  96 #include <vm/vm_pager.h>
  97
  98 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
  99
 100 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 101 struct oshmctl_args;
 102 static int oshmctl(struct thread *td, struct oshmctl_args *uap);
 103 #endif
 104
 105 static int shmget_allocate_segment(struct thread *td,
 106     struct shmget_args *uap, int mode);
 107 static int shmget_existing(struct thread *td, struct shmget_args *uap,
 108     int mode, int segnum);
 109
 110 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 111 /* XXX casting to (sy_call_t *) is bogus, as usual. */
 112 static sy_call_t *shmcalls[] = {
 113         (sy_call_t *)shmat, (sy_call_t *)oshmctl,
 114         (sy_call_t *)shmdt, (sy_call_t *)shmget,
 115         (sy_call_t *)shmctl
 116 };
 117 #endif
 118
 119 #define SHMSEG_FREE             0x0200
 120 #define SHMSEG_REMOVED          0x0400
 121 #define SHMSEG_ALLOCATED        0x0800
 122 #define SHMSEG_WANTED           0x1000
 123
 124 static int shm_last_free, shm_nused, shm_committed, shmalloced;
 125 static struct shmid_kernel      *shmsegs;
 126
 127 struct shmmap_state {
 128         vm_offset_t va;
 129         int shmid;
 130 };
 131
 132 static void shm_deallocate_segment(struct shmid_kernel *);
 133 static int shm_find_segment_by_key(key_t);
 134 static struct shmid_kernel *shm_find_segment_by_shmid(int);
 135 static struct shmid_kernel *shm_find_segment_by_shmidx(int);
 136 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *);
 137 static void shmrealloc(void);
 138 static void shminit(void);
 139 static int sysvshm_modload(struct module *, int, void *);
 140 static int shmunload(void);
 141 static void shmexit_myhook(struct vmspace *vm);
 142 static void shmfork_myhook(struct proc *p1, struct proc *p2);
 143 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS);
 144
 145 /*
 146  * Tuneable values.
 147  */
 148 #ifndef SHMMAXPGS
 149 #define SHMMAXPGS       8192    /* Note: sysv shared memory is swap backed. */
 150 #endif
 151 #ifndef SHMMAX
 152 #define SHMMAX  (SHMMAXPGS*PAGE_SIZE)
 153 #endif
 154 #ifndef SHMMIN
 155 #define SHMMIN  1
 156 #endif
 157 #ifndef SHMMNI
 158 #define SHMMNI  192
 159 #endif
 160 #ifndef SHMSEG
 161 #define SHMSEG  128
 162 #endif
 163 #ifndef SHMALL
 164 #define SHMALL  (SHMMAXPGS)
 165 #endif
 166
 167 struct  shminfo shminfo = {
 168         SHMMAX,
 169         SHMMIN,
 170         SHMMNI,
 171         SHMSEG,
 172         SHMALL
 173 };
 174
 175 static int shm_use_phys;
 176 static int shm_allow_removed;
 177
 178 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RW, &shminfo.shmmax, 0,
 179     "Maximum shared memory segment size");
 180 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RW, &shminfo.shmmin, 0,
 181     "Minimum shared memory segment size");
 182 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0,
 183     "Number of shared memory identifiers");
 184 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0,
 185     "Number of segments per process");
 186 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RW, &shminfo.shmall, 0,
 187     "Maximum number of pages available for shared memory");
 188 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RW,
 189     &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core");
 190 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RW,
 191     &shm_allow_removed, 0,
 192     "Enable/Disable attachment to attached segments marked for removal");
 193 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLFLAG_RD,
 194     NULL, 0, sysctl_shmsegs, "",
 195     "Current number of shared memory segments allocated");
 196
 197 static int
 198 shm_find_segment_by_key(key)
 199         key_t key;
 200 {
 201         int i;
 202
 203         for (i = 0; i < shmalloced; i++)
 204                 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
 205                     shmsegs[i].u.shm_perm.key == key)
 206                         return (i);
 207         return (-1);
 208 }
 209
 210 static struct shmid_kernel *
 211 shm_find_segment_by_shmid(int shmid)
 212 {
 213         int segnum;
 214         struct shmid_kernel *shmseg;
 215
 216         segnum = IPCID_TO_IX(shmid);
 217         if (segnum < 0 || segnum >= shmalloced)
 218                 return (NULL);
 219         shmseg = &shmsegs[segnum];
 220         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 221             (!shm_allow_removed &&
 222              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) ||
 223             shmseg->u.shm_perm.seq != IPCID_TO_SEQ(shmid))
 224                 return (NULL);
 225         return (shmseg);
 226 }
 227
 228 static struct shmid_kernel *
 229 shm_find_segment_by_shmidx(int segnum)
 230 {
 231         struct shmid_kernel *shmseg;
 232
 233         if (segnum < 0 || segnum >= shmalloced)
 234                 return (NULL);
 235         shmseg = &shmsegs[segnum];
 236         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 237             (!shm_allow_removed &&
 238              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0))
 239                 return (NULL);
 240         return (shmseg);
 241 }
 242
 243 static void
 244 shm_deallocate_segment(shmseg)
 245         struct shmid_kernel *shmseg;
 246 {
 247         size_t size;
 248
 249         GIANT_REQUIRED;
 250
 251         vm_object_deallocate(shmseg->u.shm_internal);
 252         shmseg->u.shm_internal = NULL;
 253         size = round_page(shmseg->u.shm_segsz);
 254         shm_committed -= btoc(size);
 255         shm_nused--;
 256         shmseg->u.shm_perm.mode = SHMSEG_FREE;
 257 #ifdef MAC
 258         mac_cleanup_sysv_shm(shmseg);
 259 #endif
 260 }
 261
 262 static int
 263 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s)
 264 {
 265         struct shmid_kernel *shmseg;
 266         int segnum, result;
 267         size_t size;
 268
 269         GIANT_REQUIRED;
 270
 271         segnum = IPCID_TO_IX(shmmap_s->shmid);
 272         shmseg = &shmsegs[segnum];
 273         size = round_page(shmseg->u.shm_segsz);
 274         result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size);
 275         if (result != KERN_SUCCESS)
 276                 return (EINVAL);
 277         shmmap_s->shmid = -1;
 278         shmseg->u.shm_dtime = time_second;
 279         if ((--shmseg->u.shm_nattch <= 0) &&
 280             (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
 281                 shm_deallocate_segment(shmseg);
 282                 shm_last_free = segnum;
 283         }
 284         return (0);
 285 }
 286
 287 #ifndef _SYS_SYSPROTO_H_
 288 struct shmdt_args {
 289         const void *shmaddr;
 290 };
 291 #endif
 292
 293 /*
 294  * MPSAFE
 295  */
 296 int
 297 shmdt(td, uap)
 298         struct thread *td;
 299         struct shmdt_args *uap;
 300 {
 301         struct proc *p = td->td_proc;
 302         struct shmmap_state *shmmap_s;
 303 #ifdef MAC
 304         struct shmid_kernel *shmsegptr;
 305 #endif
 306         int i;
 307         int error = 0;
 308
 309         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 310                 return (ENOSYS);
 311         mtx_lock(&Giant);
 312         shmmap_s = p->p_vmspace->vm_shm;
 313         if (shmmap_s == NULL) {
 314                 error = EINVAL;
 315                 goto done2;
 316         }
 317         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
 318                 if (shmmap_s->shmid != -1 &&
 319                     shmmap_s->va == (vm_offset_t)uap->shmaddr) {
 320                         break;
 321                 }
 322         }
 323         if (i == shminfo.shmseg) {
 324                 error = EINVAL;
 325                 goto done2;
 326         }
 327 #ifdef MAC
 328         shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
 329         error = mac_check_sysv_shmdt(td->td_ucred, shmsegptr);
 330         if (error != 0)
 331                 goto done2;
 332 #endif
 333         error = shm_delete_mapping(p->p_vmspace, shmmap_s);
 334 done2:
 335         mtx_unlock(&Giant);
 336         return (error);
 337 }
 338
 339 #ifndef _SYS_SYSPROTO_H_
 340 struct shmat_args {
 341         int shmid;
 342         const void *shmaddr;
 343         int shmflg;
 344 };
 345 #endif
 346
 347 /*
 348  * MPSAFE
 349  */
 350 int
 351 kern_shmat(td, shmid, shmaddr, shmflg)
 352         struct thread *td;
 353         int shmid;
 354         const void *shmaddr;
 355         int shmflg;
 356 {
 357         struct proc *p = td->td_proc;
 358         int i, flags;
 359         struct shmid_kernel *shmseg;
 360         struct shmmap_state *shmmap_s = NULL;
 361         vm_offset_t attach_va;
 362         vm_prot_t prot;
 363         vm_size_t size;
 364         int rv;
 365         int error = 0;
 366
 367         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 368                 return (ENOSYS);
 369         mtx_lock(&Giant);
 370         shmmap_s = p->p_vmspace->vm_shm;
 371         if (shmmap_s == NULL) {
 372                 size = shminfo.shmseg * sizeof(struct shmmap_state);
 373                 shmmap_s = malloc(size, M_SHM, M_WAITOK);
 374                 for (i = 0; i < shminfo.shmseg; i++)
 375                         shmmap_s[i].shmid = -1;
 376                 p->p_vmspace->vm_shm = shmmap_s;
 377         }
 378         shmseg = shm_find_segment_by_shmid(shmid);
 379         if (shmseg == NULL) {
 380                 error = EINVAL;
 381                 goto done2;
 382         }
 383         error = ipcperm(td, &shmseg->u.shm_perm,
 384             (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
 385         if (error)
 386                 goto done2;
 387 #ifdef MAC
 388         error = mac_check_sysv_shmat(td->td_ucred, shmseg, shmflg);
 389         if (error != 0)
 390                 goto done2;
 391 #endif
 392         for (i = 0; i < shminfo.shmseg; i++) {
 393                 if (shmmap_s->shmid == -1)
 394                         break;
 395                 shmmap_s++;
 396         }
 397         if (i >= shminfo.shmseg) {
 398                 error = EMFILE;
 399                 goto done2;
 400         }
 401         size = round_page(shmseg->u.shm_segsz);
 402 #ifdef VM_PROT_READ_IS_EXEC
 403         prot = VM_PROT_READ | VM_PROT_EXECUTE;
 404 #else
 405         prot = VM_PROT_READ;
 406 #endif
 407         if ((shmflg & SHM_RDONLY) == 0)
 408                 prot |= VM_PROT_WRITE;
 409         flags = MAP_ANON | MAP_SHARED;
 410         if (shmaddr) {
 411                 flags |= MAP_FIXED;
 412                 if (shmflg & SHM_RND) {
 413                         attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1);
 414                 } else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) {
 415                         attach_va = (vm_offset_t)shmaddr;
 416                 } else {
 417                         error = EINVAL;
 418                         goto done2;
 419                 }
 420         } else {
 421                 /*
 422                  * This is just a hint to vm_map_find() about where to
 423                  * put it.
 424                  */
 425                 PROC_LOCK(p);
 426                 attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
 427                     lim_max(p, RLIMIT_DATA));
 428                 PROC_UNLOCK(p);
 429         }
 430
 431         vm_object_reference(shmseg->u.shm_internal);
 432         rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->u.shm_internal,
 433                 0, &attach_va, size, (flags & MAP_FIXED)?0:1, prot, prot, 0);
 434         if (rv != KERN_SUCCESS) {
 435                 vm_object_deallocate(shmseg->u.shm_internal);
 436                 error = ENOMEM;
 437                 goto done2;
 438         }
 439         vm_map_inherit(&p->p_vmspace->vm_map,
 440                 attach_va, attach_va + size, VM_INHERIT_SHARE);
 441
 442         shmmap_s->va = attach_va;
 443         shmmap_s->shmid = shmid;
 444         shmseg->u.shm_lpid = p->p_pid;
 445         shmseg->u.shm_atime = time_second;
 446         shmseg->u.shm_nattch++;
 447         td->td_retval[0] = attach_va;
 448 done2:
 449         mtx_unlock(&Giant);
 450         return (error);
 451 }
 452
 453 int
 454 shmat(td, uap)
 455         struct thread *td;
 456         struct shmat_args *uap;
 457 {
 458         return kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg);
 459 }
 460
 461 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 462 struct oshmid_ds {
 463         struct  ipc_perm shm_perm;      /* operation perms */
 464         int     shm_segsz;              /* size of segment (bytes) */
 465         u_short shm_cpid;               /* pid, creator */
 466         u_short shm_lpid;               /* pid, last operation */
 467         short   shm_nattch;             /* no. of current attaches */
 468         time_t  shm_atime;              /* last attach time */
 469         time_t  shm_dtime;              /* last detach time */
 470         time_t  shm_ctime;              /* last change time */
 471         void    *shm_handle;            /* internal handle for shm segment */
 472 };
 473
 474 struct oshmctl_args {
 475         int shmid;
 476         int cmd;
 477         struct oshmid_ds *ubuf;
 478 };
 479
 480 /*
 481  * MPSAFE
 482  */
 483 static int
 484 oshmctl(td, uap)
 485         struct thread *td;
 486         struct oshmctl_args *uap;
 487 {
 488 #ifdef COMPAT_43
 489         int error = 0;
 490         struct shmid_kernel *shmseg;
 491         struct oshmid_ds outbuf;
 492
 493         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 494                 return (ENOSYS);
 495         mtx_lock(&Giant);
 496         shmseg = shm_find_segment_by_shmid(uap->shmid);
 497         if (shmseg == NULL) {
 498                 error = EINVAL;
 499                 goto done2;
 500         }
 501         switch (uap->cmd) {
 502         case IPC_STAT:
 503                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 504                 if (error)
 505                         goto done2;
 506 #ifdef MAC
 507                 error = mac_check_sysv_shmctl(td->td_ucred, shmseg, uap->cmd);
 508                 if (error != 0)
 509                         goto done2;
 510 #endif
 511                 outbuf.shm_perm = shmseg->u.shm_perm;
 512                 outbuf.shm_segsz = shmseg->u.shm_segsz;
 513                 outbuf.shm_cpid = shmseg->u.shm_cpid;
 514                 outbuf.shm_lpid = shmseg->u.shm_lpid;
 515                 outbuf.shm_nattch = shmseg->u.shm_nattch;
 516                 outbuf.shm_atime = shmseg->u.shm_atime;
 517                 outbuf.shm_dtime = shmseg->u.shm_dtime;
 518                 outbuf.shm_ctime = shmseg->u.shm_ctime;
 519                 outbuf.shm_handle = shmseg->u.shm_internal;
 520                 error = copyout(&outbuf, uap->ubuf, sizeof(outbuf));
 521                 if (error)
 522                         goto done2;
 523                 break;
 524         default:
 525                 error = shmctl(td, (struct shmctl_args *)uap);
 526                 break;
 527         }
 528 done2:
 529         mtx_unlock(&Giant);
 530         return (error);
 531 #else
 532         return (EINVAL);
 533 #endif
 534 }
 535 #endif
 536
 537 #ifndef _SYS_SYSPROTO_H_
 538 struct shmctl_args {
 539         int shmid;
 540         int cmd;
 541         struct shmid_ds *buf;
 542 };
 543 #endif
 544
 545 /*
 546  * MPSAFE
 547  */
 548 int
 549 kern_shmctl(td, shmid, cmd, buf, bufsz)
 550         struct thread *td;
 551         int shmid;
 552         int cmd;
 553         void *buf;
 554         size_t *bufsz;
 555 {
 556         int error = 0;
 557         struct shmid_kernel *shmseg;
 558
 559         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 560                 return (ENOSYS);
 561
 562         mtx_lock(&Giant);
 563         switch (cmd) {
 564         case IPC_INFO:
 565                 memcpy(buf, &shminfo, sizeof(shminfo));
 566                 if (bufsz)
 567                         *bufsz = sizeof(shminfo);
 568                 td->td_retval[0] = shmalloced;
 569                 goto done2;
 570         case SHM_INFO: {
 571                 struct shm_info shm_info;
 572                 shm_info.used_ids = shm_nused;
 573                 shm_info.shm_rss = 0;   /*XXX where to get from ? */
 574                 shm_info.shm_tot = 0;   /*XXX where to get from ? */
 575                 shm_info.shm_swp = 0;   /*XXX where to get from ? */
 576                 shm_info.swap_attempts = 0;     /*XXX where to get from ? */
 577                 shm_info.swap_successes = 0;    /*XXX where to get from ? */
 578                 memcpy(buf, &shm_info, sizeof(shm_info));
 579                 if (bufsz)
 580                         *bufsz = sizeof(shm_info);
 581                 td->td_retval[0] = shmalloced;
 582                 goto done2;
 583         }
 584         }
 585         if (cmd == SHM_STAT)
 586                 shmseg = shm_find_segment_by_shmidx(shmid);
 587         else
 588                 shmseg = shm_find_segment_by_shmid(shmid);
 589         if (shmseg == NULL) {
 590                 error = EINVAL;
 591                 goto done2;
 592         }
 593 #ifdef MAC
 594         error = mac_check_sysv_shmctl(td->td_ucred, shmseg, cmd);
 595         if (error != 0)
 596                 goto done2;
 597 #endif
 598         switch (cmd) {
 599         case SHM_STAT:
 600         case IPC_STAT:
 601                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 602                 if (error)
 603                         goto done2;
 604                 memcpy(buf, &shmseg->u, sizeof(struct shmid_ds));
 605                 if (bufsz)
 606                         *bufsz = sizeof(struct shmid_ds);
 607                 if (cmd == SHM_STAT)
 608                         td->td_retval[0] = IXSEQ_TO_IPCID(shmid, shmseg->u.shm_perm);
 609                 break;
 610         case IPC_SET: {
 611                 struct shmid_ds *shmid;
 612
 613                 shmid = (struct shmid_ds *)buf;
 614                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 615                 if (error)
 616                         goto done2;
 617                 shmseg->u.shm_perm.uid = shmid->shm_perm.uid;
 618                 shmseg->u.shm_perm.gid = shmid->shm_perm.gid;
 619                 shmseg->u.shm_perm.mode =
 620                     (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
 621                     (shmid->shm_perm.mode & ACCESSPERMS);
 622                 shmseg->u.shm_ctime = time_second;
 623                 break;
 624         }
 625         case IPC_RMID:
 626                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 627                 if (error)
 628                         goto done2;
 629                 shmseg->u.shm_perm.key = IPC_PRIVATE;
 630                 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
 631                 if (shmseg->u.shm_nattch <= 0) {
 632                         shm_deallocate_segment(shmseg);
 633                         shm_last_free = IPCID_TO_IX(shmid);
 634                 }
 635                 break;
 636 #if 0
 637         case SHM_LOCK:
 638         case SHM_UNLOCK:
 639 #endif
 640         default:
 641                 error = EINVAL;
 642                 break;
 643         }
 644 done2:
 645         mtx_unlock(&Giant);
 646         return (error);
 647 }
 648
 649 int
 650 shmctl(td, uap)
 651         struct thread *td;
 652         struct shmctl_args *uap;
 653 {
 654         int error = 0;
 655         struct shmid_ds buf;
 656         size_t bufsz;
 657
 658         /* IPC_SET needs to copyin the buffer before calling kern_shmctl */
 659         if (uap->cmd == IPC_SET) {
 660                 if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds))))
 661                         goto done;
 662         }
 663
 664         error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
 665         if (error)
 666                 goto done;
 667
 668         /* Cases in which we need to copyout */
 669         switch (uap->cmd) {
 670         case IPC_INFO:
 671         case SHM_INFO:
 672         case SHM_STAT:
 673         case IPC_STAT:
 674                 error = copyout(&buf, uap->buf, bufsz);
 675                 break;
 676         }
 677
 678 done:
 679         if (error) {
 680                 /* Invalidate the return value */
 681                 td->td_retval[0] = -1;
 682         }
 683         return (error);
 684 }
 685
 686
 687 #ifndef _SYS_SYSPROTO_H_
 688 struct shmget_args {
 689         key_t key;
 690         size_t size;
 691         int shmflg;
 692 };
 693 #endif
 694
 695 static int
 696 shmget_existing(td, uap, mode, segnum)
 697         struct thread *td;
 698         struct shmget_args *uap;
 699         int mode;
 700         int segnum;
 701 {
 702         struct shmid_kernel *shmseg;
 703         int error;
 704
 705         shmseg = &shmsegs[segnum];
 706         if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
 707                 /*
 708                  * This segment is in the process of being allocated.  Wait
 709                  * until it's done, and look the key up again (in case the
 710                  * allocation failed or it was freed).
 711                  */
 712                 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
 713                 error = tsleep(shmseg, PLOCK | PCATCH, "shmget", 0);
 714                 if (error)
 715                         return (error);
 716                 return (EAGAIN);
 717         }
 718         if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
 719                 return (EEXIST);
 720 #ifdef MAC
 721         error = mac_check_sysv_shmget(td->td_ucred, shmseg, uap->shmflg);
 722         if (error != 0)
 723                 return (error);
 724 #endif
 725         error = ipcperm(td, &shmseg->u.shm_perm, mode);
 726         if (error)
 727                 return (error);
 728         if (uap->size && uap->size > shmseg->u.shm_segsz)
 729                 return (EINVAL);
 730         td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 731         return (0);
 732 }
 733
 734 static int
 735 shmget_allocate_segment(td, uap, mode)
 736         struct thread *td;
 737         struct shmget_args *uap;
 738         int mode;
 739 {
 740         int i, segnum, shmid, size;
 741         struct ucred *cred = td->td_ucred;
 742         struct shmid_kernel *shmseg;
 743         vm_object_t shm_object;
 744
 745         GIANT_REQUIRED;
 746
 747         if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax)
 748                 return (EINVAL);
 749         if (shm_nused >= shminfo.shmmni) /* Any shmids left? */
 750                 return (ENOSPC);
 751         size = round_page(uap->size);
 752         if (shm_committed + btoc(size) > shminfo.shmall)
 753                 return (ENOMEM);
 754         if (shm_last_free < 0) {
 755                 shmrealloc();   /* Maybe expand the shmsegs[] array. */
 756                 for (i = 0; i < shmalloced; i++)
 757                         if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
 758                                 break;
 759                 if (i == shmalloced)
 760                         return (ENOSPC);
 761                 segnum = i;
 762         } else  {
 763                 segnum = shm_last_free;
 764                 shm_last_free = -1;
 765         }
 766         shmseg = &shmsegs[segnum];
 767         /*
 768          * In case we sleep in malloc(), mark the segment present but deleted
 769          * so that noone else tries to create the same key.
 770          */
 771         shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
 772         shmseg->u.shm_perm.key = uap->key;
 773         shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff;
 774         shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 775
 776         /*
 777          * We make sure that we have allocated a pager before we need
 778          * to.
 779          */
 780         if (shm_use_phys) {
 781                 shm_object =
 782                     vm_pager_allocate(OBJT_PHYS, 0, size, VM_PROT_DEFAULT, 0);
 783         } else {
 784                 shm_object =
 785                     vm_pager_allocate(OBJT_SWAP, 0, size, VM_PROT_DEFAULT, 0);
 786         }
 787         VM_OBJECT_LOCK(shm_object);
 788         vm_object_clear_flag(shm_object, OBJ_ONEMAPPING);
 789         vm_object_set_flag(shm_object, OBJ_NOSPLIT);
 790         VM_OBJECT_UNLOCK(shm_object);
 791
 792         shmseg->u.shm_internal = shm_object;
 793         shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid;
 794         shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid;
 795         shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
 796             (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
 797         shmseg->u.shm_segsz = uap->size;
 798         shmseg->u.shm_cpid = td->td_proc->p_pid;
 799         shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
 800         shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
 801 #ifdef MAC
 802         mac_create_sysv_shm(cred, shmseg);
 803 #endif
 804         shmseg->u.shm_ctime = time_second;
 805         shm_committed += btoc(size);
 806         shm_nused++;
 807         if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
 808                 /*
 809                  * Somebody else wanted this key while we were asleep.  Wake
 810                  * them up now.
 811                  */
 812                 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
 813                 wakeup(shmseg);
 814         }
 815         td->td_retval[0] = shmid;
 816         return (0);
 817 }
 818
 819 /*
 820  * MPSAFE
 821  */
 822 int
 823 shmget(td, uap)
 824         struct thread *td;
 825         struct shmget_args *uap;
 826 {
 827         int segnum, mode;
 828         int error;
 829
 830         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 831                 return (ENOSYS);
 832         mtx_lock(&Giant);
 833         mode = uap->shmflg & ACCESSPERMS;
 834         if (uap->key != IPC_PRIVATE) {
 835         again:
 836                 segnum = shm_find_segment_by_key(uap->key);
 837                 if (segnum >= 0) {
 838                         error = shmget_existing(td, uap, mode, segnum);
 839                         if (error == EAGAIN)
 840                                 goto again;
 841                         goto done2;
 842                 }
 843                 if ((uap->shmflg & IPC_CREAT) == 0) {
 844                         error = ENOENT;
 845                         goto done2;
 846                 }
 847         }
 848         error = shmget_allocate_segment(td, uap, mode);
 849 done2:
 850         mtx_unlock(&Giant);
 851         return (error);
 852 }
 853
 854 /*
 855  * MPSAFE
 856  */
 857 int
 858 shmsys(td, uap)
 859         struct thread *td;
 860         /* XXX actually varargs. */
 861         struct shmsys_args /* {
 862                 int     which;
 863                 int     a2;
 864                 int     a3;
 865                 int     a4;
 866         } */ *uap;
 867 {
 868 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 869         int error;
 870
 871         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 872                 return (ENOSYS);
 873         if (uap->which < 0 ||
 874             uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0]))
 875                 return (EINVAL);
 876         mtx_lock(&Giant);
 877         error = (*shmcalls[uap->which])(td, &uap->a2);
 878         mtx_unlock(&Giant);
 879         return (error);
 880 #else
 881         return (nosys(td, NULL));
 882 #endif
 883 }
 884
 885 static void
 886 shmfork_myhook(p1, p2)
 887         struct proc *p1, *p2;
 888 {
 889         struct shmmap_state *shmmap_s;
 890         size_t size;
 891         int i;
 892
 893         mtx_lock(&Giant);
 894         size = shminfo.shmseg * sizeof(struct shmmap_state);
 895         shmmap_s = malloc(size, M_SHM, M_WAITOK);
 896         bcopy(p1->p_vmspace->vm_shm, shmmap_s, size);
 897         p2->p_vmspace->vm_shm = shmmap_s;
 898         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
 899                 if (shmmap_s->shmid != -1)
 900                         shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
 901         mtx_unlock(&Giant);
 902 }
 903
 904 static void
 905 shmexit_myhook(struct vmspace *vm)
 906 {
 907         struct shmmap_state *base, *shm;
 908         int i;
 909
 910         if ((base = vm->vm_shm) != NULL) {
 911                 vm->vm_shm = NULL;
 912                 mtx_lock(&Giant);
 913                 for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) {
 914                         if (shm->shmid != -1)
 915                                 shm_delete_mapping(vm, shm);
 916                 }
 917                 mtx_unlock(&Giant);
 918                 free(base, M_SHM);
 919         }
 920 }
 921
 922 static void
 923 shmrealloc(void)
 924 {
 925         int i;
 926         struct shmid_kernel *newsegs;
 927
 928         if (shmalloced >= shminfo.shmmni)
 929                 return;
 930
 931         newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK);
 932         if (newsegs == NULL)
 933                 return;
 934         for (i = 0; i < shmalloced; i++)
 935                 bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0]));
 936         for (; i < shminfo.shmmni; i++) {
 937                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 938                 shmsegs[i].u.shm_perm.seq = 0;
 939 #ifdef MAC
 940                 mac_init_sysv_shm(&shmsegs[i]);
 941 #endif
 942         }
 943         free(shmsegs, M_SHM);
 944         shmsegs = newsegs;
 945         shmalloced = shminfo.shmmni;
 946 }
 947
 948 static void
 949 shminit()
 950 {
 951         int i;
 952
 953         TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall);
 954         for (i = PAGE_SIZE; i > 0; i--) {
 955                 shminfo.shmmax = shminfo.shmall * i;
 956                 if (shminfo.shmmax >= shminfo.shmall)
 957                         break;
 958         }
 959         TUNABLE_ULONG_FETCH("kern.ipc.shmmin", &shminfo.shmmin);
 960         TUNABLE_ULONG_FETCH("kern.ipc.shmmni", &shminfo.shmmni);
 961         TUNABLE_ULONG_FETCH("kern.ipc.shmseg", &shminfo.shmseg);
 962         TUNABLE_INT_FETCH("kern.ipc.shm_use_phys", &shm_use_phys);
 963
 964         shmalloced = shminfo.shmmni;
 965         shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK);
 966         if (shmsegs == NULL)
 967                 panic("cannot allocate initial memory for sysvshm");
 968         for (i = 0; i < shmalloced; i++) {
 969                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 970                 shmsegs[i].u.shm_perm.seq = 0;
 971 #ifdef MAC
 972                 mac_init_sysv_shm(&shmsegs[i]);
 973 #endif
 974         }
 975         shm_last_free = 0;
 976         shm_nused = 0;
 977         shm_committed = 0;
 978         shmexit_hook = &shmexit_myhook;
 979         shmfork_hook = &shmfork_myhook;
 980 }
 981
 982 static int
 983 shmunload()
 984 {
 985 #ifdef MAC
 986         int i;
 987 #endif
 988
 989         if (shm_nused > 0)
 990                 return (EBUSY);
 991
 992 #ifdef MAC
 993         for (i = 0; i < shmalloced; i++)
 994                 mac_destroy_sysv_shm(&shmsegs[i]);
 995 #endif
 996         free(shmsegs, M_SHM);
 997         shmexit_hook = NULL;
 998         shmfork_hook = NULL;
 999         return (0);
1000 }
1001
1002 static int
1003 sysctl_shmsegs(SYSCTL_HANDLER_ARGS)
1004 {
1005
1006         return (SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0])));
1007 }
1008
1009 static int
1010 sysvshm_modload(struct module *module, int cmd, void *arg)
1011 {
1012         int error = 0;
1013
1014         switch (cmd) {
1015         case MOD_LOAD:
1016                 shminit();
1017                 break;
1018         case MOD_UNLOAD:
1019                 error = shmunload();
1020                 break;
1021         case MOD_SHUTDOWN:
1022                 break;
1023         default:
1024                 error = EINVAL;
1025                 break;
1026         }
1027         return (error);
1028 }
1029
1030 static moduledata_t sysvshm_mod = {
1031         "sysvshm",
1032         &sysvshm_modload,
1033         NULL
1034 };
1035
1036 SYSCALL_MODULE_HELPER(shmsys);
1037 SYSCALL_MODULE_HELPER(shmat);
1038 SYSCALL_MODULE_HELPER(shmctl);
1039 SYSCALL_MODULE_HELPER(shmdt);
1040 SYSCALL_MODULE_HELPER(shmget);
1041
1042 DECLARE_MODULE(sysvshm, sysvshm_mod,
1043         SI_SUB_SYSV_SHM, SI_ORDER_FIRST);
1044 MODULE_VERSION(sysvshm, 1);