xref: /freebsd/sys/kern/sysv_shm.c (revision 0d36d957d36f2e32ad9bf7fe44ad5a32fdc76b07)
1 /*	$NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $	*/
2 /*-
3  * Copyright (c) 1994 Adam Glass and Charles Hannum.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Adam Glass and Charles
16  *	Hannum.
17  * 4. The names of the authors may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 /*-
32  * Copyright (c) 2003-2005 McAfee, Inc.
33  * All rights reserved.
34  *
35  * This software was developed for the FreeBSD Project in part by McAfee
36  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
37  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
38  * program.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  */
61 
62 #include <sys/cdefs.h>
63 __FBSDID("$FreeBSD$");
64 
65 #include "opt_compat.h"
66 #include "opt_sysvipc.h"
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/limits.h>
72 #include <sys/lock.h>
73 #include <sys/sysctl.h>
74 #include <sys/shm.h>
75 #include <sys/proc.h>
76 #include <sys/malloc.h>
77 #include <sys/mman.h>
78 #include <sys/module.h>
79 #include <sys/mutex.h>
80 #include <sys/racct.h>
81 #include <sys/resourcevar.h>
82 #include <sys/rwlock.h>
83 #include <sys/stat.h>
84 #include <sys/syscall.h>
85 #include <sys/syscallsubr.h>
86 #include <sys/sysent.h>
87 #include <sys/sysproto.h>
88 #include <sys/jail.h>
89 
90 #include <security/mac/mac_framework.h>
91 
92 #include <vm/vm.h>
93 #include <vm/vm_param.h>
94 #include <vm/pmap.h>
95 #include <vm/vm_object.h>
96 #include <vm/vm_map.h>
97 #include <vm/vm_page.h>
98 #include <vm/vm_pager.h>
99 
100 FEATURE(sysv_shm, "System V shared memory segments support");
101 
102 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
103 
104 static int shmget_allocate_segment(struct thread *td,
105     struct shmget_args *uap, int mode);
106 static int shmget_existing(struct thread *td, struct shmget_args *uap,
107     int mode, int segnum);
108 
109 #define	SHMSEG_FREE     	0x0200
110 #define	SHMSEG_REMOVED  	0x0400
111 #define	SHMSEG_ALLOCATED	0x0800
112 #define	SHMSEG_WANTED		0x1000
113 
114 static int shm_last_free, shm_nused, shmalloced;
115 vm_size_t shm_committed;
116 static struct shmid_kernel	*shmsegs;
117 
118 struct shmmap_state {
119 	vm_offset_t va;
120 	int shmid;
121 };
122 
123 static void shm_deallocate_segment(struct shmid_kernel *);
124 static int shm_find_segment_by_key(key_t);
125 static struct shmid_kernel *shm_find_segment_by_shmid(int);
126 static struct shmid_kernel *shm_find_segment_by_shmidx(int);
127 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *);
128 static void shmrealloc(void);
129 static int shminit(void);
130 static int sysvshm_modload(struct module *, int, void *);
131 static int shmunload(void);
132 static void shmexit_myhook(struct vmspace *vm);
133 static void shmfork_myhook(struct proc *p1, struct proc *p2);
134 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS);
135 
136 /*
137  * Tuneable values.
138  */
139 #ifndef SHMMAXPGS
140 #define	SHMMAXPGS	131072	/* Note: sysv shared memory is swap backed. */
141 #endif
142 #ifndef SHMMAX
143 #define	SHMMAX	(SHMMAXPGS*PAGE_SIZE)
144 #endif
145 #ifndef SHMMIN
146 #define	SHMMIN	1
147 #endif
148 #ifndef SHMMNI
149 #define	SHMMNI	192
150 #endif
151 #ifndef SHMSEG
152 #define	SHMSEG	128
153 #endif
154 #ifndef SHMALL
155 #define	SHMALL	(SHMMAXPGS)
156 #endif
157 
158 struct	shminfo shminfo = {
159 	.shmmax = SHMMAX,
160 	.shmmin = SHMMIN,
161 	.shmmni = SHMMNI,
162 	.shmseg = SHMSEG,
163 	.shmall = SHMALL
164 };
165 
166 static int shm_use_phys;
167 static int shm_allow_removed;
168 
169 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RWTUN, &shminfo.shmmax, 0,
170     "Maximum shared memory segment size");
171 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RWTUN, &shminfo.shmmin, 0,
172     "Minimum shared memory segment size");
173 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0,
174     "Number of shared memory identifiers");
175 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0,
176     "Number of segments per process");
177 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RWTUN, &shminfo.shmall, 0,
178     "Maximum number of pages available for shared memory");
179 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RWTUN,
180     &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core");
181 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RWTUN,
182     &shm_allow_removed, 0,
183     "Enable/Disable attachment to attached segments marked for removal");
184 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLTYPE_OPAQUE | CTLFLAG_RD,
185     NULL, 0, sysctl_shmsegs, "",
186     "Current number of shared memory segments allocated");
187 
188 static int
189 shm_find_segment_by_key(key)
190 	key_t key;
191 {
192 	int i;
193 
194 	for (i = 0; i < shmalloced; i++)
195 		if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
196 		    shmsegs[i].u.shm_perm.key == key)
197 			return (i);
198 	return (-1);
199 }
200 
201 static struct shmid_kernel *
202 shm_find_segment_by_shmid(int shmid)
203 {
204 	int segnum;
205 	struct shmid_kernel *shmseg;
206 
207 	segnum = IPCID_TO_IX(shmid);
208 	if (segnum < 0 || segnum >= shmalloced)
209 		return (NULL);
210 	shmseg = &shmsegs[segnum];
211 	if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
212 	    (!shm_allow_removed &&
213 	     (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) ||
214 	    shmseg->u.shm_perm.seq != IPCID_TO_SEQ(shmid))
215 		return (NULL);
216 	return (shmseg);
217 }
218 
219 static struct shmid_kernel *
220 shm_find_segment_by_shmidx(int segnum)
221 {
222 	struct shmid_kernel *shmseg;
223 
224 	if (segnum < 0 || segnum >= shmalloced)
225 		return (NULL);
226 	shmseg = &shmsegs[segnum];
227 	if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
228 	    (!shm_allow_removed &&
229 	     (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0))
230 		return (NULL);
231 	return (shmseg);
232 }
233 
234 static void
235 shm_deallocate_segment(shmseg)
236 	struct shmid_kernel *shmseg;
237 {
238 	vm_size_t size;
239 
240 	GIANT_REQUIRED;
241 
242 	vm_object_deallocate(shmseg->object);
243 	shmseg->object = NULL;
244 	size = round_page(shmseg->u.shm_segsz);
245 	shm_committed -= btoc(size);
246 	shm_nused--;
247 	shmseg->u.shm_perm.mode = SHMSEG_FREE;
248 #ifdef MAC
249 	mac_sysvshm_cleanup(shmseg);
250 #endif
251 	racct_sub_cred(shmseg->cred, RACCT_NSHM, 1);
252 	racct_sub_cred(shmseg->cred, RACCT_SHMSIZE, size);
253 	crfree(shmseg->cred);
254 	shmseg->cred = NULL;
255 }
256 
257 static int
258 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s)
259 {
260 	struct shmid_kernel *shmseg;
261 	int segnum, result;
262 	vm_size_t size;
263 
264 	GIANT_REQUIRED;
265 
266 	segnum = IPCID_TO_IX(shmmap_s->shmid);
267 	shmseg = &shmsegs[segnum];
268 	size = round_page(shmseg->u.shm_segsz);
269 	result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size);
270 	if (result != KERN_SUCCESS)
271 		return (EINVAL);
272 	shmmap_s->shmid = -1;
273 	shmseg->u.shm_dtime = time_second;
274 	if ((--shmseg->u.shm_nattch <= 0) &&
275 	    (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
276 		shm_deallocate_segment(shmseg);
277 		shm_last_free = segnum;
278 	}
279 	return (0);
280 }
281 
282 #ifndef _SYS_SYSPROTO_H_
283 struct shmdt_args {
284 	const void *shmaddr;
285 };
286 #endif
287 int
288 sys_shmdt(td, uap)
289 	struct thread *td;
290 	struct shmdt_args *uap;
291 {
292 	struct proc *p = td->td_proc;
293 	struct shmmap_state *shmmap_s;
294 #ifdef MAC
295 	struct shmid_kernel *shmsegptr;
296 #endif
297 	int i;
298 	int error = 0;
299 
300 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
301 		return (ENOSYS);
302 	mtx_lock(&Giant);
303 	shmmap_s = p->p_vmspace->vm_shm;
304  	if (shmmap_s == NULL) {
305 		error = EINVAL;
306 		goto done2;
307 	}
308 	for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
309 		if (shmmap_s->shmid != -1 &&
310 		    shmmap_s->va == (vm_offset_t)uap->shmaddr) {
311 			break;
312 		}
313 	}
314 	if (i == shminfo.shmseg) {
315 		error = EINVAL;
316 		goto done2;
317 	}
318 #ifdef MAC
319 	shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
320 	error = mac_sysvshm_check_shmdt(td->td_ucred, shmsegptr);
321 	if (error != 0)
322 		goto done2;
323 #endif
324 	error = shm_delete_mapping(p->p_vmspace, shmmap_s);
325 done2:
326 	mtx_unlock(&Giant);
327 	return (error);
328 }
329 
330 #ifndef _SYS_SYSPROTO_H_
331 struct shmat_args {
332 	int shmid;
333 	const void *shmaddr;
334 	int shmflg;
335 };
336 #endif
337 int
338 kern_shmat(td, shmid, shmaddr, shmflg)
339 	struct thread *td;
340 	int shmid;
341 	const void *shmaddr;
342 	int shmflg;
343 {
344 	struct proc *p = td->td_proc;
345 	int i;
346 	struct shmid_kernel *shmseg;
347 	struct shmmap_state *shmmap_s = NULL;
348 	vm_offset_t attach_va;
349 	vm_prot_t prot;
350 	vm_size_t size;
351 	int rv;
352 	int error = 0;
353 
354 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
355 		return (ENOSYS);
356 	mtx_lock(&Giant);
357 	shmmap_s = p->p_vmspace->vm_shm;
358 	if (shmmap_s == NULL) {
359 		shmmap_s = malloc(shminfo.shmseg * sizeof(struct shmmap_state),
360 		    M_SHM, M_WAITOK);
361 
362 		/*
363 		 * If malloc() above sleeps, the Giant lock is
364 		 * temporarily dropped, which allows another thread to
365 		 * allocate shmmap_state and set vm_shm.  Recheck
366 		 * vm_shm and free the new shmmap_state if another one
367 		 * is already allocated.
368 		 */
369 		if (p->p_vmspace->vm_shm != NULL) {
370 			free(shmmap_s, M_SHM);
371 			shmmap_s = p->p_vmspace->vm_shm;
372 		} else {
373 			for (i = 0; i < shminfo.shmseg; i++)
374 				shmmap_s[i].shmid = -1;
375 			p->p_vmspace->vm_shm = shmmap_s;
376 		}
377 	}
378 	shmseg = shm_find_segment_by_shmid(shmid);
379 	if (shmseg == NULL) {
380 		error = EINVAL;
381 		goto done2;
382 	}
383 	error = ipcperm(td, &shmseg->u.shm_perm,
384 	    (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
385 	if (error)
386 		goto done2;
387 #ifdef MAC
388 	error = mac_sysvshm_check_shmat(td->td_ucred, shmseg, shmflg);
389 	if (error != 0)
390 		goto done2;
391 #endif
392 	for (i = 0; i < shminfo.shmseg; i++) {
393 		if (shmmap_s->shmid == -1)
394 			break;
395 		shmmap_s++;
396 	}
397 	if (i >= shminfo.shmseg) {
398 		error = EMFILE;
399 		goto done2;
400 	}
401 	size = round_page(shmseg->u.shm_segsz);
402 	prot = VM_PROT_READ;
403 	if ((shmflg & SHM_RDONLY) == 0)
404 		prot |= VM_PROT_WRITE;
405 	if (shmaddr) {
406 		if (shmflg & SHM_RND) {
407 			attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1);
408 		} else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) {
409 			attach_va = (vm_offset_t)shmaddr;
410 		} else {
411 			error = EINVAL;
412 			goto done2;
413 		}
414 	} else {
415 		/*
416 		 * This is just a hint to vm_map_find() about where to
417 		 * put it.
418 		 */
419 		PROC_LOCK(p);
420 		attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
421 		    lim_max(p, RLIMIT_DATA));
422 		PROC_UNLOCK(p);
423 	}
424 
425 	vm_object_reference(shmseg->object);
426 	rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->object, 0, &attach_va,
427 	    size, 0, shmaddr != NULL ? VMFS_NO_SPACE : VMFS_OPTIMAL_SPACE,
428 	    prot, prot, MAP_INHERIT_SHARE | MAP_PREFAULT_PARTIAL);
429 	if (rv != KERN_SUCCESS) {
430 		vm_object_deallocate(shmseg->object);
431 		error = ENOMEM;
432 		goto done2;
433 	}
434 
435 	shmmap_s->va = attach_va;
436 	shmmap_s->shmid = shmid;
437 	shmseg->u.shm_lpid = p->p_pid;
438 	shmseg->u.shm_atime = time_second;
439 	shmseg->u.shm_nattch++;
440 	td->td_retval[0] = attach_va;
441 done2:
442 	mtx_unlock(&Giant);
443 	return (error);
444 }
445 
446 int
447 sys_shmat(td, uap)
448 	struct thread *td;
449 	struct shmat_args *uap;
450 {
451 	return kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg);
452 }
453 
454 int
455 kern_shmctl(td, shmid, cmd, buf, bufsz)
456 	struct thread *td;
457 	int shmid;
458 	int cmd;
459 	void *buf;
460 	size_t *bufsz;
461 {
462 	int error = 0;
463 	struct shmid_kernel *shmseg;
464 
465 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
466 		return (ENOSYS);
467 
468 	mtx_lock(&Giant);
469 	switch (cmd) {
470 	/*
471 	 * It is possible that kern_shmctl is being called from the Linux ABI
472 	 * layer, in which case, we will need to implement IPC_INFO.  It should
473 	 * be noted that other shmctl calls will be funneled through here for
474 	 * Linix binaries as well.
475 	 *
476 	 * NB: The Linux ABI layer will convert this data to structure(s) more
477 	 * consistent with the Linux ABI.
478 	 */
479 	case IPC_INFO:
480 		memcpy(buf, &shminfo, sizeof(shminfo));
481 		if (bufsz)
482 			*bufsz = sizeof(shminfo);
483 		td->td_retval[0] = shmalloced;
484 		goto done2;
485 	case SHM_INFO: {
486 		struct shm_info shm_info;
487 		shm_info.used_ids = shm_nused;
488 		shm_info.shm_rss = 0;	/*XXX where to get from ? */
489 		shm_info.shm_tot = 0;	/*XXX where to get from ? */
490 		shm_info.shm_swp = 0;	/*XXX where to get from ? */
491 		shm_info.swap_attempts = 0;	/*XXX where to get from ? */
492 		shm_info.swap_successes = 0;	/*XXX where to get from ? */
493 		memcpy(buf, &shm_info, sizeof(shm_info));
494 		if (bufsz)
495 			*bufsz = sizeof(shm_info);
496 		td->td_retval[0] = shmalloced;
497 		goto done2;
498 	}
499 	}
500 	if (cmd == SHM_STAT)
501 		shmseg = shm_find_segment_by_shmidx(shmid);
502 	else
503 		shmseg = shm_find_segment_by_shmid(shmid);
504 	if (shmseg == NULL) {
505 		error = EINVAL;
506 		goto done2;
507 	}
508 #ifdef MAC
509 	error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, cmd);
510 	if (error != 0)
511 		goto done2;
512 #endif
513 	switch (cmd) {
514 	case SHM_STAT:
515 	case IPC_STAT:
516 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
517 		if (error)
518 			goto done2;
519 		memcpy(buf, &shmseg->u, sizeof(struct shmid_ds));
520 		if (bufsz)
521 			*bufsz = sizeof(struct shmid_ds);
522 		if (cmd == SHM_STAT)
523 			td->td_retval[0] = IXSEQ_TO_IPCID(shmid, shmseg->u.shm_perm);
524 		break;
525 	case IPC_SET: {
526 		struct shmid_ds *shmid;
527 
528 		shmid = (struct shmid_ds *)buf;
529 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
530 		if (error)
531 			goto done2;
532 		shmseg->u.shm_perm.uid = shmid->shm_perm.uid;
533 		shmseg->u.shm_perm.gid = shmid->shm_perm.gid;
534 		shmseg->u.shm_perm.mode =
535 		    (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
536 		    (shmid->shm_perm.mode & ACCESSPERMS);
537 		shmseg->u.shm_ctime = time_second;
538 		break;
539 	}
540 	case IPC_RMID:
541 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
542 		if (error)
543 			goto done2;
544 		shmseg->u.shm_perm.key = IPC_PRIVATE;
545 		shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
546 		if (shmseg->u.shm_nattch <= 0) {
547 			shm_deallocate_segment(shmseg);
548 			shm_last_free = IPCID_TO_IX(shmid);
549 		}
550 		break;
551 #if 0
552 	case SHM_LOCK:
553 	case SHM_UNLOCK:
554 #endif
555 	default:
556 		error = EINVAL;
557 		break;
558 	}
559 done2:
560 	mtx_unlock(&Giant);
561 	return (error);
562 }
563 
564 #ifndef _SYS_SYSPROTO_H_
565 struct shmctl_args {
566 	int shmid;
567 	int cmd;
568 	struct shmid_ds *buf;
569 };
570 #endif
571 int
572 sys_shmctl(td, uap)
573 	struct thread *td;
574 	struct shmctl_args *uap;
575 {
576 	int error = 0;
577 	struct shmid_ds buf;
578 	size_t bufsz;
579 
580 	/*
581 	 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support
582 	 * Linux binaries.  If we see the call come through the FreeBSD ABI,
583 	 * return an error back to the user since we do not to support this.
584 	 */
585 	if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO ||
586 	    uap->cmd == SHM_STAT)
587 		return (EINVAL);
588 
589 	/* IPC_SET needs to copyin the buffer before calling kern_shmctl */
590 	if (uap->cmd == IPC_SET) {
591 		if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds))))
592 			goto done;
593 	}
594 
595 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
596 	if (error)
597 		goto done;
598 
599 	/* Cases in which we need to copyout */
600 	switch (uap->cmd) {
601 	case IPC_STAT:
602 		error = copyout(&buf, uap->buf, bufsz);
603 		break;
604 	}
605 
606 done:
607 	if (error) {
608 		/* Invalidate the return value */
609 		td->td_retval[0] = -1;
610 	}
611 	return (error);
612 }
613 
614 
615 static int
616 shmget_existing(td, uap, mode, segnum)
617 	struct thread *td;
618 	struct shmget_args *uap;
619 	int mode;
620 	int segnum;
621 {
622 	struct shmid_kernel *shmseg;
623 	int error;
624 
625 	shmseg = &shmsegs[segnum];
626 	if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
627 		/*
628 		 * This segment is in the process of being allocated.  Wait
629 		 * until it's done, and look the key up again (in case the
630 		 * allocation failed or it was freed).
631 		 */
632 		shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
633 		error = tsleep(shmseg, PLOCK | PCATCH, "shmget", 0);
634 		if (error)
635 			return (error);
636 		return (EAGAIN);
637 	}
638 	if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
639 		return (EEXIST);
640 #ifdef MAC
641 	error = mac_sysvshm_check_shmget(td->td_ucred, shmseg, uap->shmflg);
642 	if (error != 0)
643 		return (error);
644 #endif
645 	if (uap->size != 0 && uap->size > shmseg->u.shm_segsz)
646 		return (EINVAL);
647 	td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
648 	return (0);
649 }
650 
651 static int
652 shmget_allocate_segment(td, uap, mode)
653 	struct thread *td;
654 	struct shmget_args *uap;
655 	int mode;
656 {
657 	int i, segnum, shmid;
658 	size_t size;
659 	struct ucred *cred = td->td_ucred;
660 	struct shmid_kernel *shmseg;
661 	vm_object_t shm_object;
662 
663 	GIANT_REQUIRED;
664 
665 	if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax)
666 		return (EINVAL);
667 	if (shm_nused >= shminfo.shmmni) /* Any shmids left? */
668 		return (ENOSPC);
669 	size = round_page(uap->size);
670 	if (shm_committed + btoc(size) > shminfo.shmall)
671 		return (ENOMEM);
672 	if (shm_last_free < 0) {
673 		shmrealloc();	/* Maybe expand the shmsegs[] array. */
674 		for (i = 0; i < shmalloced; i++)
675 			if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
676 				break;
677 		if (i == shmalloced)
678 			return (ENOSPC);
679 		segnum = i;
680 	} else  {
681 		segnum = shm_last_free;
682 		shm_last_free = -1;
683 	}
684 	shmseg = &shmsegs[segnum];
685 #ifdef RACCT
686 	PROC_LOCK(td->td_proc);
687 	if (racct_add(td->td_proc, RACCT_NSHM, 1)) {
688 		PROC_UNLOCK(td->td_proc);
689 		return (ENOSPC);
690 	}
691 	if (racct_add(td->td_proc, RACCT_SHMSIZE, size)) {
692 		racct_sub(td->td_proc, RACCT_NSHM, 1);
693 		PROC_UNLOCK(td->td_proc);
694 		return (ENOMEM);
695 	}
696 	PROC_UNLOCK(td->td_proc);
697 #endif
698 	/*
699 	 * In case we sleep in malloc(), mark the segment present but deleted
700 	 * so that noone else tries to create the same key.
701 	 */
702 	shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
703 	shmseg->u.shm_perm.key = uap->key;
704 	shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff;
705 	shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
706 
707 	/*
708 	 * We make sure that we have allocated a pager before we need
709 	 * to.
710 	 */
711 	shm_object = vm_pager_allocate(shm_use_phys ? OBJT_PHYS : OBJT_SWAP,
712 	    0, size, VM_PROT_DEFAULT, 0, cred);
713 	if (shm_object == NULL) {
714 #ifdef RACCT
715 		PROC_LOCK(td->td_proc);
716 		racct_sub(td->td_proc, RACCT_NSHM, 1);
717 		racct_sub(td->td_proc, RACCT_SHMSIZE, size);
718 		PROC_UNLOCK(td->td_proc);
719 #endif
720 		return (ENOMEM);
721 	}
722 	shm_object->pg_color = 0;
723 	VM_OBJECT_WLOCK(shm_object);
724 	vm_object_clear_flag(shm_object, OBJ_ONEMAPPING);
725 	vm_object_set_flag(shm_object, OBJ_COLORED | OBJ_NOSPLIT);
726 	VM_OBJECT_WUNLOCK(shm_object);
727 
728 	shmseg->object = shm_object;
729 	shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid;
730 	shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid;
731 	shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
732 	    (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
733 	shmseg->cred = crhold(cred);
734 	shmseg->u.shm_segsz = uap->size;
735 	shmseg->u.shm_cpid = td->td_proc->p_pid;
736 	shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
737 	shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
738 #ifdef MAC
739 	mac_sysvshm_create(cred, shmseg);
740 #endif
741 	shmseg->u.shm_ctime = time_second;
742 	shm_committed += btoc(size);
743 	shm_nused++;
744 	if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
745 		/*
746 		 * Somebody else wanted this key while we were asleep.  Wake
747 		 * them up now.
748 		 */
749 		shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
750 		wakeup(shmseg);
751 	}
752 	td->td_retval[0] = shmid;
753 	return (0);
754 }
755 
756 #ifndef _SYS_SYSPROTO_H_
757 struct shmget_args {
758 	key_t key;
759 	size_t size;
760 	int shmflg;
761 };
762 #endif
763 int
764 sys_shmget(td, uap)
765 	struct thread *td;
766 	struct shmget_args *uap;
767 {
768 	int segnum, mode;
769 	int error;
770 
771 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
772 		return (ENOSYS);
773 	mtx_lock(&Giant);
774 	mode = uap->shmflg & ACCESSPERMS;
775 	if (uap->key != IPC_PRIVATE) {
776 	again:
777 		segnum = shm_find_segment_by_key(uap->key);
778 		if (segnum >= 0) {
779 			error = shmget_existing(td, uap, mode, segnum);
780 			if (error == EAGAIN)
781 				goto again;
782 			goto done2;
783 		}
784 		if ((uap->shmflg & IPC_CREAT) == 0) {
785 			error = ENOENT;
786 			goto done2;
787 		}
788 	}
789 	error = shmget_allocate_segment(td, uap, mode);
790 done2:
791 	mtx_unlock(&Giant);
792 	return (error);
793 }
794 
795 static void
796 shmfork_myhook(p1, p2)
797 	struct proc *p1, *p2;
798 {
799 	struct shmmap_state *shmmap_s;
800 	size_t size;
801 	int i;
802 
803 	mtx_lock(&Giant);
804 	size = shminfo.shmseg * sizeof(struct shmmap_state);
805 	shmmap_s = malloc(size, M_SHM, M_WAITOK);
806 	bcopy(p1->p_vmspace->vm_shm, shmmap_s, size);
807 	p2->p_vmspace->vm_shm = shmmap_s;
808 	for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
809 		if (shmmap_s->shmid != -1)
810 			shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
811 	mtx_unlock(&Giant);
812 }
813 
814 static void
815 shmexit_myhook(struct vmspace *vm)
816 {
817 	struct shmmap_state *base, *shm;
818 	int i;
819 
820 	if ((base = vm->vm_shm) != NULL) {
821 		vm->vm_shm = NULL;
822 		mtx_lock(&Giant);
823 		for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) {
824 			if (shm->shmid != -1)
825 				shm_delete_mapping(vm, shm);
826 		}
827 		mtx_unlock(&Giant);
828 		free(base, M_SHM);
829 	}
830 }
831 
832 static void
833 shmrealloc(void)
834 {
835 	int i;
836 	struct shmid_kernel *newsegs;
837 
838 	if (shmalloced >= shminfo.shmmni)
839 		return;
840 
841 	newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK);
842 	for (i = 0; i < shmalloced; i++)
843 		bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0]));
844 	for (; i < shminfo.shmmni; i++) {
845 		shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
846 		shmsegs[i].u.shm_perm.seq = 0;
847 #ifdef MAC
848 		mac_sysvshm_init(&shmsegs[i]);
849 #endif
850 	}
851 	free(shmsegs, M_SHM);
852 	shmsegs = newsegs;
853 	shmalloced = shminfo.shmmni;
854 }
855 
856 static struct syscall_helper_data shm_syscalls[] = {
857 	SYSCALL_INIT_HELPER(shmat),
858 	SYSCALL_INIT_HELPER(shmctl),
859 	SYSCALL_INIT_HELPER(shmdt),
860 	SYSCALL_INIT_HELPER(shmget),
861 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
862     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
863 	SYSCALL_INIT_HELPER_COMPAT(freebsd7_shmctl),
864 #endif
865 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
866 	SYSCALL_INIT_HELPER(shmsys),
867 #endif
868 	SYSCALL_INIT_LAST
869 };
870 
871 #ifdef COMPAT_FREEBSD32
872 #include <compat/freebsd32/freebsd32.h>
873 #include <compat/freebsd32/freebsd32_ipc.h>
874 #include <compat/freebsd32/freebsd32_proto.h>
875 #include <compat/freebsd32/freebsd32_signal.h>
876 #include <compat/freebsd32/freebsd32_syscall.h>
877 #include <compat/freebsd32/freebsd32_util.h>
878 
879 static struct syscall_helper_data shm32_syscalls[] = {
880 	SYSCALL32_INIT_HELPER_COMPAT(shmat),
881 	SYSCALL32_INIT_HELPER_COMPAT(shmdt),
882 	SYSCALL32_INIT_HELPER_COMPAT(shmget),
883 	SYSCALL32_INIT_HELPER(freebsd32_shmsys),
884 	SYSCALL32_INIT_HELPER(freebsd32_shmctl),
885 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
886     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
887 	SYSCALL32_INIT_HELPER(freebsd7_freebsd32_shmctl),
888 #endif
889 	SYSCALL_INIT_LAST
890 };
891 #endif
892 
893 static int
894 shminit()
895 {
896 	int i, error;
897 
898 #ifndef BURN_BRIDGES
899 	if (TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall) != 0)
900 		printf("kern.ipc.shmmaxpgs is now called kern.ipc.shmall!\n");
901 #endif
902 	if (shminfo.shmmax == SHMMAX) {
903 		/* Initialize shmmax dealing with possible overflow. */
904 		for (i = PAGE_SIZE; i != 0; i--) {
905 			shminfo.shmmax = shminfo.shmall * i;
906 			if ((shminfo.shmmax / shminfo.shmall) == (u_long)i)
907 				break;
908 		}
909 	}
910 	shmalloced = shminfo.shmmni;
911 	shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK);
912 	for (i = 0; i < shmalloced; i++) {
913 		shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
914 		shmsegs[i].u.shm_perm.seq = 0;
915 #ifdef MAC
916 		mac_sysvshm_init(&shmsegs[i]);
917 #endif
918 	}
919 	shm_last_free = 0;
920 	shm_nused = 0;
921 	shm_committed = 0;
922 	shmexit_hook = &shmexit_myhook;
923 	shmfork_hook = &shmfork_myhook;
924 
925 	error = syscall_helper_register(shm_syscalls, SY_THR_STATIC_KLD);
926 	if (error != 0)
927 		return (error);
928 #ifdef COMPAT_FREEBSD32
929 	error = syscall32_helper_register(shm32_syscalls, SY_THR_STATIC_KLD);
930 	if (error != 0)
931 		return (error);
932 #endif
933 	return (0);
934 }
935 
936 static int
937 shmunload()
938 {
939 	int i;
940 
941 	if (shm_nused > 0)
942 		return (EBUSY);
943 
944 #ifdef COMPAT_FREEBSD32
945 	syscall32_helper_unregister(shm32_syscalls);
946 #endif
947 	syscall_helper_unregister(shm_syscalls);
948 
949 	for (i = 0; i < shmalloced; i++) {
950 #ifdef MAC
951 		mac_sysvshm_destroy(&shmsegs[i]);
952 #endif
953 		/*
954 		 * Objects might be still mapped into the processes
955 		 * address spaces.  Actual free would happen on the
956 		 * last mapping destruction.
957 		 */
958 		if (shmsegs[i].u.shm_perm.mode != SHMSEG_FREE)
959 			vm_object_deallocate(shmsegs[i].object);
960 	}
961 	free(shmsegs, M_SHM);
962 	shmexit_hook = NULL;
963 	shmfork_hook = NULL;
964 	return (0);
965 }
966 
967 static int
968 sysctl_shmsegs(SYSCTL_HANDLER_ARGS)
969 {
970 
971 	return (SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0])));
972 }
973 
974 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
975 struct oshmid_ds {
976 	struct	ipc_perm_old shm_perm;	/* operation perms */
977 	int	shm_segsz;		/* size of segment (bytes) */
978 	u_short	shm_cpid;		/* pid, creator */
979 	u_short	shm_lpid;		/* pid, last operation */
980 	short	shm_nattch;		/* no. of current attaches */
981 	time_t	shm_atime;		/* last attach time */
982 	time_t	shm_dtime;		/* last detach time */
983 	time_t	shm_ctime;		/* last change time */
984 	void	*shm_handle;		/* internal handle for shm segment */
985 };
986 
987 struct oshmctl_args {
988 	int shmid;
989 	int cmd;
990 	struct oshmid_ds *ubuf;
991 };
992 
993 static int
994 oshmctl(struct thread *td, struct oshmctl_args *uap)
995 {
996 #ifdef COMPAT_43
997 	int error = 0;
998 	struct shmid_kernel *shmseg;
999 	struct oshmid_ds outbuf;
1000 
1001 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
1002 		return (ENOSYS);
1003 	mtx_lock(&Giant);
1004 	shmseg = shm_find_segment_by_shmid(uap->shmid);
1005 	if (shmseg == NULL) {
1006 		error = EINVAL;
1007 		goto done2;
1008 	}
1009 	switch (uap->cmd) {
1010 	case IPC_STAT:
1011 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
1012 		if (error)
1013 			goto done2;
1014 #ifdef MAC
1015 		error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, uap->cmd);
1016 		if (error != 0)
1017 			goto done2;
1018 #endif
1019 		ipcperm_new2old(&shmseg->u.shm_perm, &outbuf.shm_perm);
1020 		outbuf.shm_segsz = shmseg->u.shm_segsz;
1021 		outbuf.shm_cpid = shmseg->u.shm_cpid;
1022 		outbuf.shm_lpid = shmseg->u.shm_lpid;
1023 		outbuf.shm_nattch = shmseg->u.shm_nattch;
1024 		outbuf.shm_atime = shmseg->u.shm_atime;
1025 		outbuf.shm_dtime = shmseg->u.shm_dtime;
1026 		outbuf.shm_ctime = shmseg->u.shm_ctime;
1027 		outbuf.shm_handle = shmseg->object;
1028 		error = copyout(&outbuf, uap->ubuf, sizeof(outbuf));
1029 		if (error)
1030 			goto done2;
1031 		break;
1032 	default:
1033 		error = freebsd7_shmctl(td, (struct freebsd7_shmctl_args *)uap);
1034 		break;
1035 	}
1036 done2:
1037 	mtx_unlock(&Giant);
1038 	return (error);
1039 #else
1040 	return (EINVAL);
1041 #endif
1042 }
1043 
1044 /* XXX casting to (sy_call_t *) is bogus, as usual. */
1045 static sy_call_t *shmcalls[] = {
1046 	(sy_call_t *)sys_shmat, (sy_call_t *)oshmctl,
1047 	(sy_call_t *)sys_shmdt, (sy_call_t *)sys_shmget,
1048 	(sy_call_t *)freebsd7_shmctl
1049 };
1050 
1051 int
1052 sys_shmsys(td, uap)
1053 	struct thread *td;
1054 	/* XXX actually varargs. */
1055 	struct shmsys_args /* {
1056 		int	which;
1057 		int	a2;
1058 		int	a3;
1059 		int	a4;
1060 	} */ *uap;
1061 {
1062 	int error;
1063 
1064 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
1065 		return (ENOSYS);
1066 	if (uap->which < 0 ||
1067 	    uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0]))
1068 		return (EINVAL);
1069 	mtx_lock(&Giant);
1070 	error = (*shmcalls[uap->which])(td, &uap->a2);
1071 	mtx_unlock(&Giant);
1072 	return (error);
1073 }
1074 
1075 #endif	/* i386 && (COMPAT_FREEBSD4 || COMPAT_43) */
1076 
1077 #ifdef COMPAT_FREEBSD32
1078 
1079 int
1080 freebsd32_shmsys(struct thread *td, struct freebsd32_shmsys_args *uap)
1081 {
1082 
1083 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1084     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1085 	switch (uap->which) {
1086 	case 0:	{	/* shmat */
1087 		struct shmat_args ap;
1088 
1089 		ap.shmid = uap->a2;
1090 		ap.shmaddr = PTRIN(uap->a3);
1091 		ap.shmflg = uap->a4;
1092 		return (sysent[SYS_shmat].sy_call(td, &ap));
1093 	}
1094 	case 2: {	/* shmdt */
1095 		struct shmdt_args ap;
1096 
1097 		ap.shmaddr = PTRIN(uap->a2);
1098 		return (sysent[SYS_shmdt].sy_call(td, &ap));
1099 	}
1100 	case 3: {	/* shmget */
1101 		struct shmget_args ap;
1102 
1103 		ap.key = uap->a2;
1104 		ap.size = uap->a3;
1105 		ap.shmflg = uap->a4;
1106 		return (sysent[SYS_shmget].sy_call(td, &ap));
1107 	}
1108 	case 4: {	/* shmctl */
1109 		struct freebsd7_freebsd32_shmctl_args ap;
1110 
1111 		ap.shmid = uap->a2;
1112 		ap.cmd = uap->a3;
1113 		ap.buf = PTRIN(uap->a4);
1114 		return (freebsd7_freebsd32_shmctl(td, &ap));
1115 	}
1116 	case 1:		/* oshmctl */
1117 	default:
1118 		return (EINVAL);
1119 	}
1120 #else
1121 	return (nosys(td, NULL));
1122 #endif
1123 }
1124 
1125 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1126     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1127 int
1128 freebsd7_freebsd32_shmctl(struct thread *td,
1129     struct freebsd7_freebsd32_shmctl_args *uap)
1130 {
1131 	int error = 0;
1132 	union {
1133 		struct shmid_ds shmid_ds;
1134 		struct shm_info shm_info;
1135 		struct shminfo shminfo;
1136 	} u;
1137 	union {
1138 		struct shmid_ds32_old shmid_ds32;
1139 		struct shm_info32 shm_info32;
1140 		struct shminfo32 shminfo32;
1141 	} u32;
1142 	size_t sz;
1143 
1144 	if (uap->cmd == IPC_SET) {
1145 		if ((error = copyin(uap->buf, &u32.shmid_ds32,
1146 		    sizeof(u32.shmid_ds32))))
1147 			goto done;
1148 		freebsd32_ipcperm_old_in(&u32.shmid_ds32.shm_perm,
1149 		    &u.shmid_ds.shm_perm);
1150 		CP(u32.shmid_ds32, u.shmid_ds, shm_segsz);
1151 		CP(u32.shmid_ds32, u.shmid_ds, shm_lpid);
1152 		CP(u32.shmid_ds32, u.shmid_ds, shm_cpid);
1153 		CP(u32.shmid_ds32, u.shmid_ds, shm_nattch);
1154 		CP(u32.shmid_ds32, u.shmid_ds, shm_atime);
1155 		CP(u32.shmid_ds32, u.shmid_ds, shm_dtime);
1156 		CP(u32.shmid_ds32, u.shmid_ds, shm_ctime);
1157 	}
1158 
1159 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz);
1160 	if (error)
1161 		goto done;
1162 
1163 	/* Cases in which we need to copyout */
1164 	switch (uap->cmd) {
1165 	case IPC_INFO:
1166 		CP(u.shminfo, u32.shminfo32, shmmax);
1167 		CP(u.shminfo, u32.shminfo32, shmmin);
1168 		CP(u.shminfo, u32.shminfo32, shmmni);
1169 		CP(u.shminfo, u32.shminfo32, shmseg);
1170 		CP(u.shminfo, u32.shminfo32, shmall);
1171 		error = copyout(&u32.shminfo32, uap->buf,
1172 		    sizeof(u32.shminfo32));
1173 		break;
1174 	case SHM_INFO:
1175 		CP(u.shm_info, u32.shm_info32, used_ids);
1176 		CP(u.shm_info, u32.shm_info32, shm_rss);
1177 		CP(u.shm_info, u32.shm_info32, shm_tot);
1178 		CP(u.shm_info, u32.shm_info32, shm_swp);
1179 		CP(u.shm_info, u32.shm_info32, swap_attempts);
1180 		CP(u.shm_info, u32.shm_info32, swap_successes);
1181 		error = copyout(&u32.shm_info32, uap->buf,
1182 		    sizeof(u32.shm_info32));
1183 		break;
1184 	case SHM_STAT:
1185 	case IPC_STAT:
1186 		freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm,
1187 		    &u32.shmid_ds32.shm_perm);
1188 		if (u.shmid_ds.shm_segsz > INT32_MAX)
1189 			u32.shmid_ds32.shm_segsz = INT32_MAX;
1190 		else
1191 			CP(u.shmid_ds, u32.shmid_ds32, shm_segsz);
1192 		CP(u.shmid_ds, u32.shmid_ds32, shm_lpid);
1193 		CP(u.shmid_ds, u32.shmid_ds32, shm_cpid);
1194 		CP(u.shmid_ds, u32.shmid_ds32, shm_nattch);
1195 		CP(u.shmid_ds, u32.shmid_ds32, shm_atime);
1196 		CP(u.shmid_ds, u32.shmid_ds32, shm_dtime);
1197 		CP(u.shmid_ds, u32.shmid_ds32, shm_ctime);
1198 		u32.shmid_ds32.shm_internal = 0;
1199 		error = copyout(&u32.shmid_ds32, uap->buf,
1200 		    sizeof(u32.shmid_ds32));
1201 		break;
1202 	}
1203 
1204 done:
1205 	if (error) {
1206 		/* Invalidate the return value */
1207 		td->td_retval[0] = -1;
1208 	}
1209 	return (error);
1210 }
1211 #endif
1212 
1213 int
1214 freebsd32_shmctl(struct thread *td, struct freebsd32_shmctl_args *uap)
1215 {
1216 	int error = 0;
1217 	union {
1218 		struct shmid_ds shmid_ds;
1219 		struct shm_info shm_info;
1220 		struct shminfo shminfo;
1221 	} u;
1222 	union {
1223 		struct shmid_ds32 shmid_ds32;
1224 		struct shm_info32 shm_info32;
1225 		struct shminfo32 shminfo32;
1226 	} u32;
1227 	size_t sz;
1228 
1229 	if (uap->cmd == IPC_SET) {
1230 		if ((error = copyin(uap->buf, &u32.shmid_ds32,
1231 		    sizeof(u32.shmid_ds32))))
1232 			goto done;
1233 		freebsd32_ipcperm_in(&u32.shmid_ds32.shm_perm,
1234 		    &u.shmid_ds.shm_perm);
1235 		CP(u32.shmid_ds32, u.shmid_ds, shm_segsz);
1236 		CP(u32.shmid_ds32, u.shmid_ds, shm_lpid);
1237 		CP(u32.shmid_ds32, u.shmid_ds, shm_cpid);
1238 		CP(u32.shmid_ds32, u.shmid_ds, shm_nattch);
1239 		CP(u32.shmid_ds32, u.shmid_ds, shm_atime);
1240 		CP(u32.shmid_ds32, u.shmid_ds, shm_dtime);
1241 		CP(u32.shmid_ds32, u.shmid_ds, shm_ctime);
1242 	}
1243 
1244 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz);
1245 	if (error)
1246 		goto done;
1247 
1248 	/* Cases in which we need to copyout */
1249 	switch (uap->cmd) {
1250 	case IPC_INFO:
1251 		CP(u.shminfo, u32.shminfo32, shmmax);
1252 		CP(u.shminfo, u32.shminfo32, shmmin);
1253 		CP(u.shminfo, u32.shminfo32, shmmni);
1254 		CP(u.shminfo, u32.shminfo32, shmseg);
1255 		CP(u.shminfo, u32.shminfo32, shmall);
1256 		error = copyout(&u32.shminfo32, uap->buf,
1257 		    sizeof(u32.shminfo32));
1258 		break;
1259 	case SHM_INFO:
1260 		CP(u.shm_info, u32.shm_info32, used_ids);
1261 		CP(u.shm_info, u32.shm_info32, shm_rss);
1262 		CP(u.shm_info, u32.shm_info32, shm_tot);
1263 		CP(u.shm_info, u32.shm_info32, shm_swp);
1264 		CP(u.shm_info, u32.shm_info32, swap_attempts);
1265 		CP(u.shm_info, u32.shm_info32, swap_successes);
1266 		error = copyout(&u32.shm_info32, uap->buf,
1267 		    sizeof(u32.shm_info32));
1268 		break;
1269 	case SHM_STAT:
1270 	case IPC_STAT:
1271 		freebsd32_ipcperm_out(&u.shmid_ds.shm_perm,
1272 		    &u32.shmid_ds32.shm_perm);
1273 		if (u.shmid_ds.shm_segsz > INT32_MAX)
1274 			u32.shmid_ds32.shm_segsz = INT32_MAX;
1275 		else
1276 			CP(u.shmid_ds, u32.shmid_ds32, shm_segsz);
1277 		CP(u.shmid_ds, u32.shmid_ds32, shm_lpid);
1278 		CP(u.shmid_ds, u32.shmid_ds32, shm_cpid);
1279 		CP(u.shmid_ds, u32.shmid_ds32, shm_nattch);
1280 		CP(u.shmid_ds, u32.shmid_ds32, shm_atime);
1281 		CP(u.shmid_ds, u32.shmid_ds32, shm_dtime);
1282 		CP(u.shmid_ds, u32.shmid_ds32, shm_ctime);
1283 		error = copyout(&u32.shmid_ds32, uap->buf,
1284 		    sizeof(u32.shmid_ds32));
1285 		break;
1286 	}
1287 
1288 done:
1289 	if (error) {
1290 		/* Invalidate the return value */
1291 		td->td_retval[0] = -1;
1292 	}
1293 	return (error);
1294 }
1295 #endif
1296 
1297 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1298     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1299 
1300 #ifndef CP
1301 #define CP(src, dst, fld)	do { (dst).fld = (src).fld; } while (0)
1302 #endif
1303 
1304 #ifndef _SYS_SYSPROTO_H_
1305 struct freebsd7_shmctl_args {
1306 	int shmid;
1307 	int cmd;
1308 	struct shmid_ds_old *buf;
1309 };
1310 #endif
1311 int
1312 freebsd7_shmctl(td, uap)
1313 	struct thread *td;
1314 	struct freebsd7_shmctl_args *uap;
1315 {
1316 	int error = 0;
1317 	struct shmid_ds_old old;
1318 	struct shmid_ds buf;
1319 	size_t bufsz;
1320 
1321 	/*
1322 	 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support
1323 	 * Linux binaries.  If we see the call come through the FreeBSD ABI,
1324 	 * return an error back to the user since we do not to support this.
1325 	 */
1326 	if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO ||
1327 	    uap->cmd == SHM_STAT)
1328 		return (EINVAL);
1329 
1330 	/* IPC_SET needs to copyin the buffer before calling kern_shmctl */
1331 	if (uap->cmd == IPC_SET) {
1332 		if ((error = copyin(uap->buf, &old, sizeof(old))))
1333 			goto done;
1334 		ipcperm_old2new(&old.shm_perm, &buf.shm_perm);
1335 		CP(old, buf, shm_segsz);
1336 		CP(old, buf, shm_lpid);
1337 		CP(old, buf, shm_cpid);
1338 		CP(old, buf, shm_nattch);
1339 		CP(old, buf, shm_atime);
1340 		CP(old, buf, shm_dtime);
1341 		CP(old, buf, shm_ctime);
1342 	}
1343 
1344 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
1345 	if (error)
1346 		goto done;
1347 
1348 	/* Cases in which we need to copyout */
1349 	switch (uap->cmd) {
1350 	case IPC_STAT:
1351 		ipcperm_new2old(&buf.shm_perm, &old.shm_perm);
1352 		if (buf.shm_segsz > INT_MAX)
1353 			old.shm_segsz = INT_MAX;
1354 		else
1355 			CP(buf, old, shm_segsz);
1356 		CP(buf, old, shm_lpid);
1357 		CP(buf, old, shm_cpid);
1358 		if (buf.shm_nattch > SHRT_MAX)
1359 			old.shm_nattch = SHRT_MAX;
1360 		else
1361 			CP(buf, old, shm_nattch);
1362 		CP(buf, old, shm_atime);
1363 		CP(buf, old, shm_dtime);
1364 		CP(buf, old, shm_ctime);
1365 		old.shm_internal = NULL;
1366 		error = copyout(&old, uap->buf, sizeof(old));
1367 		break;
1368 	}
1369 
1370 done:
1371 	if (error) {
1372 		/* Invalidate the return value */
1373 		td->td_retval[0] = -1;
1374 	}
1375 	return (error);
1376 }
1377 
1378 #endif	/* COMPAT_FREEBSD4 || COMPAT_FREEBSD5 || COMPAT_FREEBSD6 ||
1379 	   COMPAT_FREEBSD7 */
1380 
1381 static int
1382 sysvshm_modload(struct module *module, int cmd, void *arg)
1383 {
1384 	int error = 0;
1385 
1386 	switch (cmd) {
1387 	case MOD_LOAD:
1388 		error = shminit();
1389 		if (error != 0)
1390 			shmunload();
1391 		break;
1392 	case MOD_UNLOAD:
1393 		error = shmunload();
1394 		break;
1395 	case MOD_SHUTDOWN:
1396 		break;
1397 	default:
1398 		error = EINVAL;
1399 		break;
1400 	}
1401 	return (error);
1402 }
1403 
1404 static moduledata_t sysvshm_mod = {
1405 	"sysvshm",
1406 	&sysvshm_modload,
1407 	NULL
1408 };
1409 
1410 DECLARE_MODULE(sysvshm, sysvshm_mod, SI_SUB_SYSV_SHM, SI_ORDER_FIRST);
1411 MODULE_VERSION(sysvshm, 1);
1412