sys/kern/sysv_shm.c

   1 /*      $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $      */
   2 /*-
   3  * Copyright (c) 1994 Adam Glass and Charles Hannum.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Adam Glass and Charles
  16  *      Hannum.
  17  * 4. The names of the authors may not be used to endorse or promote products
  18  *    derived from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
  21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  23  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  30  */
  31 /*-
  32  * Copyright (c) 2003-2005 McAfee, Inc.
  33  * All rights reserved.
  34  *
  35  * This software was developed for the FreeBSD Project in part by McAfee
  36  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
  37  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
  38  * program.
  39  *
  40  * Redistribution and use in source and binary forms, with or without
  41  * modification, are permitted provided that the following conditions
  42  * are met:
  43  * 1. Redistributions of source code must retain the above copyright
  44  *    notice, this list of conditions and the following disclaimer.
  45  * 2. Redistributions in binary form must reproduce the above copyright
  46  *    notice, this list of conditions and the following disclaimer in the
  47  *    documentation and/or other materials provided with the distribution.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  59  * SUCH DAMAGE.
  60  */
  61
  62 #include <sys/cdefs.h>
  63 __FBSDID("$FreeBSD$");
  64
  65 #include "opt_compat.h"
  66 #include "opt_sysvipc.h"
  67 #include "opt_mac.h"
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/kernel.h>
  72 #include <sys/lock.h>
  73 #include <sys/sysctl.h>
  74 #include <sys/shm.h>
  75 #include <sys/proc.h>
  76 #include <sys/malloc.h>
  77 #include <sys/mman.h>
  78 #include <sys/module.h>
  79 #include <sys/mutex.h>
  80 #include <sys/resourcevar.h>
  81 #include <sys/stat.h>
  82 #include <sys/syscall.h>
  83 #include <sys/syscallsubr.h>
  84 #include <sys/sysent.h>
  85 #include <sys/sysproto.h>
  86 #include <sys/jail.h>
  87
  88 #include <security/mac/mac_framework.h>
  89
  90 #include <vm/vm.h>
  91 #include <vm/vm_param.h>
  92 #include <vm/pmap.h>
  93 #include <vm/vm_object.h>
  94 #include <vm/vm_map.h>
  95 #include <vm/vm_page.h>
  96 #include <vm/vm_pager.h>
  97
  98 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
  99
 100 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 101 struct oshmctl_args;
 102 static int oshmctl(struct thread *td, struct oshmctl_args *uap);
 103 #endif
 104
 105 static int shmget_allocate_segment(struct thread *td,
 106     struct shmget_args *uap, int mode);
 107 static int shmget_existing(struct thread *td, struct shmget_args *uap,
 108     int mode, int segnum);
 109
 110 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 111 /* XXX casting to (sy_call_t *) is bogus, as usual. */
 112 static sy_call_t *shmcalls[] = {
 113         (sy_call_t *)shmat, (sy_call_t *)oshmctl,
 114         (sy_call_t *)shmdt, (sy_call_t *)shmget,
 115         (sy_call_t *)shmctl
 116 };
 117 #endif
 118
 119 #define SHMSEG_FREE             0x0200
 120 #define SHMSEG_REMOVED          0x0400
 121 #define SHMSEG_ALLOCATED        0x0800
 122 #define SHMSEG_WANTED           0x1000
 123
 124 static int shm_last_free, shm_nused, shmalloced;
 125 vm_size_t shm_committed;
 126 static struct shmid_kernel      *shmsegs;
 127
 128 struct shmmap_state {
 129         vm_offset_t va;
 130         int shmid;
 131 };
 132
 133 static void shm_deallocate_segment(struct shmid_kernel *);
 134 static int shm_find_segment_by_key(key_t);
 135 static struct shmid_kernel *shm_find_segment_by_shmid(int);
 136 static struct shmid_kernel *shm_find_segment_by_shmidx(int);
 137 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *);
 138 static void shmrealloc(void);
 139 static void shminit(void);
 140 static int sysvshm_modload(struct module *, int, void *);
 141 static int shmunload(void);
 142 static void shmexit_myhook(struct vmspace *vm);
 143 static void shmfork_myhook(struct proc *p1, struct proc *p2);
 144 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS);
 145
 146 /*
 147  * Tuneable values.
 148  */
 149 #ifndef SHMMAXPGS
 150 #define SHMMAXPGS       8192    /* Note: sysv shared memory is swap backed. */
 151 #endif
 152 #ifndef SHMMAX
 153 #define SHMMAX  (SHMMAXPGS*PAGE_SIZE)
 154 #endif
 155 #ifndef SHMMIN
 156 #define SHMMIN  1
 157 #endif
 158 #ifndef SHMMNI
 159 #define SHMMNI  192
 160 #endif
 161 #ifndef SHMSEG
 162 #define SHMSEG  128
 163 #endif
 164 #ifndef SHMALL
 165 #define SHMALL  (SHMMAXPGS)
 166 #endif
 167
 168 struct  shminfo shminfo = {
 169         SHMMAX,
 170         SHMMIN,
 171         SHMMNI,
 172         SHMSEG,
 173         SHMALL
 174 };
 175
 176 static int shm_use_phys;
 177 static int shm_allow_removed;
 178
 179 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RW, &shminfo.shmmax, 0,
 180     "Maximum shared memory segment size");
 181 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RW, &shminfo.shmmin, 0,
 182     "Minimum shared memory segment size");
 183 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0,
 184     "Number of shared memory identifiers");
 185 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0,
 186     "Number of segments per process");
 187 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RW, &shminfo.shmall, 0,
 188     "Maximum number of pages available for shared memory");
 189 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RW,
 190     &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core");
 191 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RW,
 192     &shm_allow_removed, 0,
 193     "Enable/Disable attachment to attached segments marked for removal");
 194 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLFLAG_RD,
 195     NULL, 0, sysctl_shmsegs, "",
 196     "Current number of shared memory segments allocated");
 197
 198 static int
 199 shm_find_segment_by_key(key)
 200         key_t key;
 201 {
 202         int i;
 203
 204         for (i = 0; i < shmalloced; i++)
 205                 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
 206                     shmsegs[i].u.shm_perm.key == key)
 207                         return (i);
 208         return (-1);
 209 }
 210
 211 static struct shmid_kernel *
 212 shm_find_segment_by_shmid(int shmid)
 213 {
 214         int segnum;
 215         struct shmid_kernel *shmseg;
 216
 217         segnum = IPCID_TO_IX(shmid);
 218         if (segnum < 0 || segnum >= shmalloced)
 219                 return (NULL);
 220         shmseg = &shmsegs[segnum];
 221         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 222             (!shm_allow_removed &&
 223              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) ||
 224             shmseg->u.shm_perm.seq != IPCID_TO_SEQ(shmid))
 225                 return (NULL);
 226         return (shmseg);
 227 }
 228
 229 static struct shmid_kernel *
 230 shm_find_segment_by_shmidx(int segnum)
 231 {
 232         struct shmid_kernel *shmseg;
 233
 234         if (segnum < 0 || segnum >= shmalloced)
 235                 return (NULL);
 236         shmseg = &shmsegs[segnum];
 237         if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
 238             (!shm_allow_removed &&
 239              (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0))
 240                 return (NULL);
 241         return (shmseg);
 242 }
 243
 244 static void
 245 shm_deallocate_segment(shmseg)
 246         struct shmid_kernel *shmseg;
 247 {
 248         vm_size_t size;
 249
 250         GIANT_REQUIRED;
 251
 252         vm_object_deallocate(shmseg->u.shm_internal);
 253         shmseg->u.shm_internal = NULL;
 254         size = round_page(shmseg->shm_bsegsz);
 255         shm_committed -= btoc(size);
 256         shm_nused--;
 257         shmseg->u.shm_perm.mode = SHMSEG_FREE;
 258 #ifdef MAC
 259         mac_cleanup_sysv_shm(shmseg);
 260 #endif
 261 }
 262
 263 static int
 264 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s)
 265 {
 266         struct shmid_kernel *shmseg;
 267         int segnum, result;
 268         vm_size_t size;
 269
 270         GIANT_REQUIRED;
 271
 272         segnum = IPCID_TO_IX(shmmap_s->shmid);
 273         shmseg = &shmsegs[segnum];
 274         size = round_page(shmseg->shm_bsegsz);
 275         result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size);
 276         if (result != KERN_SUCCESS)
 277                 return (EINVAL);
 278         shmmap_s->shmid = -1;
 279         shmseg->u.shm_dtime = time_second;
 280         if ((--shmseg->u.shm_nattch <= 0) &&
 281             (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
 282                 shm_deallocate_segment(shmseg);
 283                 shm_last_free = segnum;
 284         }
 285         return (0);
 286 }
 287
 288 #ifndef _SYS_SYSPROTO_H_
 289 struct shmdt_args {
 290         const void *shmaddr;
 291 };
 292 #endif
 293 int
 294 shmdt(td, uap)
 295         struct thread *td;
 296         struct shmdt_args *uap;
 297 {
 298         struct proc *p = td->td_proc;
 299         struct shmmap_state *shmmap_s;
 300 #ifdef MAC
 301         struct shmid_kernel *shmsegptr;
 302 #endif
 303         int i;
 304         int error = 0;
 305
 306         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 307                 return (ENOSYS);
 308         mtx_lock(&Giant);
 309         shmmap_s = p->p_vmspace->vm_shm;
 310         if (shmmap_s == NULL) {
 311                 error = EINVAL;
 312                 goto done2;
 313         }
 314         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
 315                 if (shmmap_s->shmid != -1 &&
 316                     shmmap_s->va == (vm_offset_t)uap->shmaddr) {
 317                         break;
 318                 }
 319         }
 320         if (i == shminfo.shmseg) {
 321                 error = EINVAL;
 322                 goto done2;
 323         }
 324 #ifdef MAC
 325         shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
 326         error = mac_check_sysv_shmdt(td->td_ucred, shmsegptr);
 327         if (error != 0)
 328                 goto done2;
 329 #endif
 330         error = shm_delete_mapping(p->p_vmspace, shmmap_s);
 331 done2:
 332         mtx_unlock(&Giant);
 333         return (error);
 334 }
 335
 336 #ifndef _SYS_SYSPROTO_H_
 337 struct shmat_args {
 338         int shmid;
 339         const void *shmaddr;
 340         int shmflg;
 341 };
 342 #endif
 343 int
 344 kern_shmat(td, shmid, shmaddr, shmflg)
 345         struct thread *td;
 346         int shmid;
 347         const void *shmaddr;
 348         int shmflg;
 349 {
 350         struct proc *p = td->td_proc;
 351         int i, flags;
 352         struct shmid_kernel *shmseg;
 353         struct shmmap_state *shmmap_s = NULL;
 354         vm_offset_t attach_va;
 355         vm_prot_t prot;
 356         vm_size_t size;
 357         int rv;
 358         int error = 0;
 359
 360         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 361                 return (ENOSYS);
 362         mtx_lock(&Giant);
 363         shmmap_s = p->p_vmspace->vm_shm;
 364         if (shmmap_s == NULL) {
 365                 shmmap_s = malloc(shminfo.shmseg * sizeof(struct shmmap_state),
 366                     M_SHM, M_WAITOK);
 367                 for (i = 0; i < shminfo.shmseg; i++)
 368                         shmmap_s[i].shmid = -1;
 369                 p->p_vmspace->vm_shm = shmmap_s;
 370         }
 371         shmseg = shm_find_segment_by_shmid(shmid);
 372         if (shmseg == NULL) {
 373                 error = EINVAL;
 374                 goto done2;
 375         }
 376         error = ipcperm(td, &shmseg->u.shm_perm,
 377             (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
 378         if (error)
 379                 goto done2;
 380 #ifdef MAC
 381         error = mac_check_sysv_shmat(td->td_ucred, shmseg, shmflg);
 382         if (error != 0)
 383                 goto done2;
 384 #endif
 385         for (i = 0; i < shminfo.shmseg; i++) {
 386                 if (shmmap_s->shmid == -1)
 387                         break;
 388                 shmmap_s++;
 389         }
 390         if (i >= shminfo.shmseg) {
 391                 error = EMFILE;
 392                 goto done2;
 393         }
 394         size = round_page(shmseg->shm_bsegsz);
 395 #ifdef VM_PROT_READ_IS_EXEC
 396         prot = VM_PROT_READ | VM_PROT_EXECUTE;
 397 #else
 398         prot = VM_PROT_READ;
 399 #endif
 400         if ((shmflg & SHM_RDONLY) == 0)
 401                 prot |= VM_PROT_WRITE;
 402         flags = MAP_ANON | MAP_SHARED;
 403         if (shmaddr) {
 404                 flags |= MAP_FIXED;
 405                 if (shmflg & SHM_RND) {
 406                         attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1);
 407                 } else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) {
 408                         attach_va = (vm_offset_t)shmaddr;
 409                 } else {
 410                         error = EINVAL;
 411                         goto done2;
 412                 }
 413         } else {
 414                 /*
 415                  * This is just a hint to vm_map_find() about where to
 416                  * put it.
 417                  */
 418                 PROC_LOCK(p);
 419                 attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
 420                     lim_max(p, RLIMIT_DATA));
 421                 PROC_UNLOCK(p);
 422         }
 423
 424         vm_object_reference(shmseg->u.shm_internal);
 425         rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->u.shm_internal,
 426             0, &attach_va, size, (flags & MAP_FIXED) ? VMFS_NO_SPACE :
 427             VMFS_ANY_SPACE, prot, prot, 0);
 428         if (rv != KERN_SUCCESS) {
 429                 vm_object_deallocate(shmseg->u.shm_internal);
 430                 error = ENOMEM;
 431                 goto done2;
 432         }
 433         vm_map_inherit(&p->p_vmspace->vm_map,
 434                 attach_va, attach_va + size, VM_INHERIT_SHARE);
 435
 436         shmmap_s->va = attach_va;
 437         shmmap_s->shmid = shmid;
 438         shmseg->u.shm_lpid = p->p_pid;
 439         shmseg->u.shm_atime = time_second;
 440         shmseg->u.shm_nattch++;
 441         td->td_retval[0] = attach_va;
 442 done2:
 443         mtx_unlock(&Giant);
 444         return (error);
 445 }
 446
 447 int
 448 shmat(td, uap)
 449         struct thread *td;
 450         struct shmat_args *uap;
 451 {
 452         return kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg);
 453 }
 454
 455 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 456 struct oshmid_ds {
 457         struct  ipc_perm shm_perm;      /* operation perms */
 458         int     shm_segsz;              /* size of segment (bytes) */
 459         u_short shm_cpid;               /* pid, creator */
 460         u_short shm_lpid;               /* pid, last operation */
 461         short   shm_nattch;             /* no. of current attaches */
 462         time_t  shm_atime;              /* last attach time */
 463         time_t  shm_dtime;              /* last detach time */
 464         time_t  shm_ctime;              /* last change time */
 465         void    *shm_handle;            /* internal handle for shm segment */
 466 };
 467
 468 struct oshmctl_args {
 469         int shmid;
 470         int cmd;
 471         struct oshmid_ds *ubuf;
 472 };
 473 static int
 474 oshmctl(td, uap)
 475         struct thread *td;
 476         struct oshmctl_args *uap;
 477 {
 478 #ifdef COMPAT_43
 479         int error = 0;
 480         struct shmid_kernel *shmseg;
 481         struct oshmid_ds outbuf;
 482
 483         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 484                 return (ENOSYS);
 485         mtx_lock(&Giant);
 486         shmseg = shm_find_segment_by_shmid(uap->shmid);
 487         if (shmseg == NULL) {
 488                 error = EINVAL;
 489                 goto done2;
 490         }
 491         switch (uap->cmd) {
 492         case IPC_STAT:
 493                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 494                 if (error)
 495                         goto done2;
 496 #ifdef MAC
 497                 error = mac_check_sysv_shmctl(td->td_ucred, shmseg, uap->cmd);
 498                 if (error != 0)
 499                         goto done2;
 500 #endif
 501                 outbuf.shm_perm = shmseg->u.shm_perm;
 502                 outbuf.shm_segsz = shmseg->u.shm_segsz;
 503                 outbuf.shm_cpid = shmseg->u.shm_cpid;
 504                 outbuf.shm_lpid = shmseg->u.shm_lpid;
 505                 outbuf.shm_nattch = shmseg->u.shm_nattch;
 506                 outbuf.shm_atime = shmseg->u.shm_atime;
 507                 outbuf.shm_dtime = shmseg->u.shm_dtime;
 508                 outbuf.shm_ctime = shmseg->u.shm_ctime;
 509                 outbuf.shm_handle = shmseg->u.shm_internal;
 510                 error = copyout(&outbuf, uap->ubuf, sizeof(outbuf));
 511                 if (error)
 512                         goto done2;
 513                 break;
 514         default:
 515                 error = shmctl(td, (struct shmctl_args *)uap);
 516                 break;
 517         }
 518 done2:
 519         mtx_unlock(&Giant);
 520         return (error);
 521 #else
 522         return (EINVAL);
 523 #endif
 524 }
 525 #endif
 526
 527 #ifndef _SYS_SYSPROTO_H_
 528 struct shmctl_args {
 529         int shmid;
 530         int cmd;
 531         struct shmid_ds *buf;
 532 };
 533 #endif
 534 int
 535 kern_shmctl(td, shmid, cmd, buf, bufsz)
 536         struct thread *td;
 537         int shmid;
 538         int cmd;
 539         void *buf;
 540         size_t *bufsz;
 541 {
 542         int error = 0;
 543         struct shmid_kernel *shmseg;
 544
 545         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 546                 return (ENOSYS);
 547
 548         mtx_lock(&Giant);
 549         switch (cmd) {
 550         case IPC_INFO:
 551                 memcpy(buf, &shminfo, sizeof(shminfo));
 552                 if (bufsz)
 553                         *bufsz = sizeof(shminfo);
 554                 td->td_retval[0] = shmalloced;
 555                 goto done2;
 556         case SHM_INFO: {
 557                 struct shm_info shm_info;
 558                 shm_info.used_ids = shm_nused;
 559                 shm_info.shm_rss = 0;   /*XXX where to get from ? */
 560                 shm_info.shm_tot = 0;   /*XXX where to get from ? */
 561                 shm_info.shm_swp = 0;   /*XXX where to get from ? */
 562                 shm_info.swap_attempts = 0;     /*XXX where to get from ? */
 563                 shm_info.swap_successes = 0;    /*XXX where to get from ? */
 564                 memcpy(buf, &shm_info, sizeof(shm_info));
 565                 if (bufsz)
 566                         *bufsz = sizeof(shm_info);
 567                 td->td_retval[0] = shmalloced;
 568                 goto done2;
 569         }
 570         }
 571         if (cmd == SHM_STAT)
 572                 shmseg = shm_find_segment_by_shmidx(shmid);
 573         else
 574                 shmseg = shm_find_segment_by_shmid(shmid);
 575         if (shmseg == NULL) {
 576                 error = EINVAL;
 577                 goto done2;
 578         }
 579 #ifdef MAC
 580         error = mac_check_sysv_shmctl(td->td_ucred, shmseg, cmd);
 581         if (error != 0)
 582                 goto done2;
 583 #endif
 584         switch (cmd) {
 585         case SHM_STAT:
 586         case IPC_STAT:
 587                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
 588                 if (error)
 589                         goto done2;
 590                 memcpy(buf, &shmseg->u, sizeof(struct shmid_ds));
 591                 if (bufsz)
 592                         *bufsz = sizeof(struct shmid_ds);
 593                 if (cmd == SHM_STAT)
 594                         td->td_retval[0] = IXSEQ_TO_IPCID(shmid, shmseg->u.shm_perm);
 595                 break;
 596         case IPC_SET: {
 597                 struct shmid_ds *shmid;
 598
 599                 shmid = (struct shmid_ds *)buf;
 600                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 601                 if (error)
 602                         goto done2;
 603                 shmseg->u.shm_perm.uid = shmid->shm_perm.uid;
 604                 shmseg->u.shm_perm.gid = shmid->shm_perm.gid;
 605                 shmseg->u.shm_perm.mode =
 606                     (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
 607                     (shmid->shm_perm.mode & ACCESSPERMS);
 608                 shmseg->u.shm_ctime = time_second;
 609                 break;
 610         }
 611         case IPC_RMID:
 612                 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
 613                 if (error)
 614                         goto done2;
 615                 shmseg->u.shm_perm.key = IPC_PRIVATE;
 616                 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
 617                 if (shmseg->u.shm_nattch <= 0) {
 618                         shm_deallocate_segment(shmseg);
 619                         shm_last_free = IPCID_TO_IX(shmid);
 620                 }
 621                 break;
 622 #if 0
 623         case SHM_LOCK:
 624         case SHM_UNLOCK:
 625 #endif
 626         default:
 627                 error = EINVAL;
 628                 break;
 629         }
 630 done2:
 631         mtx_unlock(&Giant);
 632         return (error);
 633 }
 634
 635 int
 636 shmctl(td, uap)
 637         struct thread *td;
 638         struct shmctl_args *uap;
 639 {
 640         int error = 0;
 641         struct shmid_ds buf;
 642         size_t bufsz;
 643
 644         /* IPC_SET needs to copyin the buffer before calling kern_shmctl */
 645         if (uap->cmd == IPC_SET) {
 646                 if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds))))
 647                         goto done;
 648         }
 649
 650         error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
 651         if (error)
 652                 goto done;
 653
 654         /* Cases in which we need to copyout */
 655         switch (uap->cmd) {
 656         case IPC_INFO:
 657         case SHM_INFO:
 658         case SHM_STAT:
 659         case IPC_STAT:
 660                 error = copyout(&buf, uap->buf, bufsz);
 661                 break;
 662         }
 663
 664 done:
 665         if (error) {
 666                 /* Invalidate the return value */
 667                 td->td_retval[0] = -1;
 668         }
 669         return (error);
 670 }
 671
 672
 673 #ifndef _SYS_SYSPROTO_H_
 674 struct shmget_args {
 675         key_t key;
 676         size_t size;
 677         int shmflg;
 678 };
 679 #endif
 680 static int
 681 shmget_existing(td, uap, mode, segnum)
 682         struct thread *td;
 683         struct shmget_args *uap;
 684         int mode;
 685         int segnum;
 686 {
 687         struct shmid_kernel *shmseg;
 688         int error;
 689
 690         shmseg = &shmsegs[segnum];
 691         if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
 692                 /*
 693                  * This segment is in the process of being allocated.  Wait
 694                  * until it's done, and look the key up again (in case the
 695                  * allocation failed or it was freed).
 696                  */
 697                 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
 698                 error = tsleep(shmseg, PLOCK | PCATCH, "shmget", 0);
 699                 if (error)
 700                         return (error);
 701                 return (EAGAIN);
 702         }
 703         if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
 704                 return (EEXIST);
 705 #ifdef MAC
 706         error = mac_check_sysv_shmget(td->td_ucred, shmseg, uap->shmflg);
 707         if (error != 0)
 708                 return (error);
 709 #endif
 710         if (uap->size != 0 && uap->size > shmseg->shm_bsegsz)
 711                 return (EINVAL);
 712         td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 713         return (0);
 714 }
 715
 716 static int
 717 shmget_allocate_segment(td, uap, mode)
 718         struct thread *td;
 719         struct shmget_args *uap;
 720         int mode;
 721 {
 722         int i, segnum, shmid;
 723         size_t size;
 724         struct ucred *cred = td->td_ucred;
 725         struct shmid_kernel *shmseg;
 726         vm_object_t shm_object;
 727
 728         GIANT_REQUIRED;
 729
 730         if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax)
 731                 return (EINVAL);
 732         if (shm_nused >= shminfo.shmmni) /* Any shmids left? */
 733                 return (ENOSPC);
 734         size = round_page(uap->size);
 735         if (shm_committed + btoc(size) > shminfo.shmall)
 736                 return (ENOMEM);
 737         if (shm_last_free < 0) {
 738                 shmrealloc();   /* Maybe expand the shmsegs[] array. */
 739                 for (i = 0; i < shmalloced; i++)
 740                         if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
 741                                 break;
 742                 if (i == shmalloced)
 743                         return (ENOSPC);
 744                 segnum = i;
 745         } else  {
 746                 segnum = shm_last_free;
 747                 shm_last_free = -1;
 748         }
 749         shmseg = &shmsegs[segnum];
 750         /*
 751          * In case we sleep in malloc(), mark the segment present but deleted
 752          * so that noone else tries to create the same key.
 753          */
 754         shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
 755         shmseg->u.shm_perm.key = uap->key;
 756         shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff;
 757         shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
 758
 759         /*
 760          * We make sure that we have allocated a pager before we need
 761          * to.
 762          */
 763         if (shm_use_phys) {
 764                 shm_object =
 765                     vm_pager_allocate(OBJT_PHYS, 0, size, VM_PROT_DEFAULT, 0);
 766         } else {
 767                 shm_object =
 768                     vm_pager_allocate(OBJT_SWAP, 0, size, VM_PROT_DEFAULT, 0);
 769         }
 770         VM_OBJECT_LOCK(shm_object);
 771         vm_object_clear_flag(shm_object, OBJ_ONEMAPPING);
 772         vm_object_set_flag(shm_object, OBJ_NOSPLIT);
 773         VM_OBJECT_UNLOCK(shm_object);
 774
 775         shmseg->u.shm_internal = shm_object;
 776         shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid;
 777         shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid;
 778         shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
 779             (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
 780         shmseg->u.shm_segsz = uap->size;
 781         shmseg->shm_bsegsz = uap->size;
 782         shmseg->u.shm_cpid = td->td_proc->p_pid;
 783         shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
 784         shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
 785 #ifdef MAC
 786         mac_create_sysv_shm(cred, shmseg);
 787 #endif
 788         shmseg->u.shm_ctime = time_second;
 789         shm_committed += btoc(size);
 790         shm_nused++;
 791         if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
 792                 /*
 793                  * Somebody else wanted this key while we were asleep.  Wake
 794                  * them up now.
 795                  */
 796                 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
 797                 wakeup(shmseg);
 798         }
 799         td->td_retval[0] = shmid;
 800         return (0);
 801 }
 802
 803 int
 804 shmget(td, uap)
 805         struct thread *td;
 806         struct shmget_args *uap;
 807 {
 808         int segnum, mode;
 809         int error;
 810
 811         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 812                 return (ENOSYS);
 813         mtx_lock(&Giant);
 814         mode = uap->shmflg & ACCESSPERMS;
 815         if (uap->key != IPC_PRIVATE) {
 816         again:
 817                 segnum = shm_find_segment_by_key(uap->key);
 818                 if (segnum >= 0) {
 819                         error = shmget_existing(td, uap, mode, segnum);
 820                         if (error == EAGAIN)
 821                                 goto again;
 822                         goto done2;
 823                 }
 824                 if ((uap->shmflg & IPC_CREAT) == 0) {
 825                         error = ENOENT;
 826                         goto done2;
 827                 }
 828         }
 829         error = shmget_allocate_segment(td, uap, mode);
 830 done2:
 831         mtx_unlock(&Giant);
 832         return (error);
 833 }
 834
 835 int
 836 shmsys(td, uap)
 837         struct thread *td;
 838         /* XXX actually varargs. */
 839         struct shmsys_args /* {
 840                 int     which;
 841                 int     a2;
 842                 int     a3;
 843                 int     a4;
 844         } */ *uap;
 845 {
 846 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
 847         int error;
 848
 849         if (!jail_sysvipc_allowed && jailed(td->td_ucred))
 850                 return (ENOSYS);
 851         if (uap->which < 0 ||
 852             uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0]))
 853                 return (EINVAL);
 854         mtx_lock(&Giant);
 855         error = (*shmcalls[uap->which])(td, &uap->a2);
 856         mtx_unlock(&Giant);
 857         return (error);
 858 #else
 859         return (nosys(td, NULL));
 860 #endif
 861 }
 862
 863 static void
 864 shmfork_myhook(p1, p2)
 865         struct proc *p1, *p2;
 866 {
 867         struct shmmap_state *shmmap_s;
 868         size_t size;
 869         int i;
 870
 871         mtx_lock(&Giant);
 872         size = shminfo.shmseg * sizeof(struct shmmap_state);
 873         shmmap_s = malloc(size, M_SHM, M_WAITOK);
 874         bcopy(p1->p_vmspace->vm_shm, shmmap_s, size);
 875         p2->p_vmspace->vm_shm = shmmap_s;
 876         for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
 877                 if (shmmap_s->shmid != -1)
 878                         shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
 879         mtx_unlock(&Giant);
 880 }
 881
 882 static void
 883 shmexit_myhook(struct vmspace *vm)
 884 {
 885         struct shmmap_state *base, *shm;
 886         int i;
 887
 888         if ((base = vm->vm_shm) != NULL) {
 889                 vm->vm_shm = NULL;
 890                 mtx_lock(&Giant);
 891                 for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) {
 892                         if (shm->shmid != -1)
 893                                 shm_delete_mapping(vm, shm);
 894                 }
 895                 mtx_unlock(&Giant);
 896                 free(base, M_SHM);
 897         }
 898 }
 899
 900 static void
 901 shmrealloc(void)
 902 {
 903         int i;
 904         struct shmid_kernel *newsegs;
 905
 906         if (shmalloced >= shminfo.shmmni)
 907                 return;
 908
 909         newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK);
 910         if (newsegs == NULL)
 911                 return;
 912         for (i = 0; i < shmalloced; i++)
 913                 bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0]));
 914         for (; i < shminfo.shmmni; i++) {
 915                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 916                 shmsegs[i].u.shm_perm.seq = 0;
 917 #ifdef MAC
 918                 mac_init_sysv_shm(&shmsegs[i]);
 919 #endif
 920         }
 921         free(shmsegs, M_SHM);
 922         shmsegs = newsegs;
 923         shmalloced = shminfo.shmmni;
 924 }
 925
 926 static void
 927 shminit()
 928 {
 929         int i;
 930
 931         TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall);
 932         for (i = PAGE_SIZE; i > 0; i--) {
 933                 shminfo.shmmax = shminfo.shmall * i;
 934                 if (shminfo.shmmax >= shminfo.shmall)
 935                         break;
 936         }
 937         TUNABLE_ULONG_FETCH("kern.ipc.shmmin", &shminfo.shmmin);
 938         TUNABLE_ULONG_FETCH("kern.ipc.shmmni", &shminfo.shmmni);
 939         TUNABLE_ULONG_FETCH("kern.ipc.shmseg", &shminfo.shmseg);
 940         TUNABLE_INT_FETCH("kern.ipc.shm_use_phys", &shm_use_phys);
 941
 942         shmalloced = shminfo.shmmni;
 943         shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK);
 944         if (shmsegs == NULL)
 945                 panic("cannot allocate initial memory for sysvshm");
 946         for (i = 0; i < shmalloced; i++) {
 947                 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
 948                 shmsegs[i].u.shm_perm.seq = 0;
 949 #ifdef MAC
 950                 mac_init_sysv_shm(&shmsegs[i]);
 951 #endif
 952         }
 953         shm_last_free = 0;
 954         shm_nused = 0;
 955         shm_committed = 0;
 956         shmexit_hook = &shmexit_myhook;
 957         shmfork_hook = &shmfork_myhook;
 958 }
 959
 960 static int
 961 shmunload()
 962 {
 963 #ifdef MAC
 964         int i;
 965 #endif
 966
 967         if (shm_nused > 0)
 968                 return (EBUSY);
 969
 970 #ifdef MAC
 971         for (i = 0; i < shmalloced; i++)
 972                 mac_destroy_sysv_shm(&shmsegs[i]);
 973 #endif
 974         free(shmsegs, M_SHM);
 975         shmexit_hook = NULL;
 976         shmfork_hook = NULL;
 977         return (0);
 978 }
 979
 980 static int
 981 sysctl_shmsegs(SYSCTL_HANDLER_ARGS)
 982 {
 983
 984         return (SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0])));
 985 }
 986
 987 static int
 988 sysvshm_modload(struct module *module, int cmd, void *arg)
 989 {
 990         int error = 0;
 991
 992         switch (cmd) {
 993         case MOD_LOAD:
 994                 shminit();
 995                 break;
 996         case MOD_UNLOAD:
 997                 error = shmunload();
 998                 break;
 999         case MOD_SHUTDOWN:
1000                 break;
1001         default:
1002                 error = EINVAL;
1003                 break;
1004         }
1005         return (error);
1006 }
1007
1008 static moduledata_t sysvshm_mod = {
1009         "sysvshm",
1010         &sysvshm_modload,
1011         NULL
1012 };
1013
1014 SYSCALL_MODULE_HELPER(shmsys);
1015 SYSCALL_MODULE_HELPER(shmat);
1016 SYSCALL_MODULE_HELPER(shmctl);
1017 SYSCALL_MODULE_HELPER(shmdt);
1018 SYSCALL_MODULE_HELPER(shmget);
1019
1020 DECLARE_MODULE(sysvshm, sysvshm_mod,
1021         SI_SUB_SYSV_SHM, SI_ORDER_FIRST);
1022 MODULE_VERSION(sysvshm, 1);