1 /* $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $ */ 2 /*- 3 * Copyright (c) 1994 Adam Glass and Charles Hannum. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by Adam Glass and Charles 16 * Hannum. 17 * 4. The names of the authors may not be used to endorse or promote products 18 * derived from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 /*- 32 * Copyright (c) 2003-2005 McAfee, Inc. 33 * All rights reserved. 34 * 35 * This software was developed for the FreeBSD Project in part by McAfee 36 * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR 37 * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 38 * program. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 52 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 59 * SUCH DAMAGE. 60 */ 61 62 #include <sys/cdefs.h> 63 __FBSDID("$FreeBSD$"); 64 65 #include "opt_compat.h" 66 #include "opt_sysvipc.h" 67 68 #include <sys/param.h> 69 #include <sys/systm.h> 70 #include <sys/kernel.h> 71 #include <sys/limits.h> 72 #include <sys/lock.h> 73 #include <sys/sysctl.h> 74 #include <sys/shm.h> 75 #include <sys/proc.h> 76 #include <sys/malloc.h> 77 #include <sys/mman.h> 78 #include <sys/module.h> 79 #include <sys/mutex.h> 80 #include <sys/racct.h> 81 #include <sys/resourcevar.h> 82 #include <sys/rwlock.h> 83 #include <sys/stat.h> 84 #include <sys/syscall.h> 85 #include <sys/syscallsubr.h> 86 #include <sys/sysent.h> 87 #include <sys/sysproto.h> 88 #include <sys/jail.h> 89 90 #include <security/mac/mac_framework.h> 91 92 #include <vm/vm.h> 93 #include <vm/vm_param.h> 94 #include <vm/pmap.h> 95 #include <vm/vm_object.h> 96 #include <vm/vm_map.h> 97 #include <vm/vm_page.h> 98 #include <vm/vm_pager.h> 99 100 FEATURE(sysv_shm, "System V shared memory segments support"); 101 102 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments"); 103 104 static int shmget_allocate_segment(struct thread *td, 105 struct shmget_args *uap, int mode); 106 static int shmget_existing(struct thread *td, struct shmget_args *uap, 107 int mode, int segnum); 108 109 #define SHMSEG_FREE 0x0200 110 #define SHMSEG_REMOVED 0x0400 111 #define SHMSEG_ALLOCATED 0x0800 112 #define SHMSEG_WANTED 0x1000 113 114 static int shm_last_free, shm_nused, shmalloced; 115 vm_size_t shm_committed; 116 static struct shmid_kernel *shmsegs; 117 118 struct shmmap_state { 119 vm_offset_t va; 120 int shmid; 121 }; 122 123 static void shm_deallocate_segment(struct shmid_kernel *); 124 static int shm_find_segment_by_key(key_t); 125 static struct shmid_kernel *shm_find_segment_by_shmid(int); 126 static struct shmid_kernel *shm_find_segment_by_shmidx(int); 127 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *); 128 static void shmrealloc(void); 129 static int shminit(void); 130 static int sysvshm_modload(struct module *, int, void *); 131 static int shmunload(void); 132 static void shmexit_myhook(struct vmspace *vm); 133 static void shmfork_myhook(struct proc *p1, struct proc *p2); 134 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS); 135 136 /* 137 * Tuneable values. 138 */ 139 #ifndef SHMMAXPGS 140 #define SHMMAXPGS 131072 /* Note: sysv shared memory is swap backed. */ 141 #endif 142 #ifndef SHMMAX 143 #define SHMMAX (SHMMAXPGS*PAGE_SIZE) 144 #endif 145 #ifndef SHMMIN 146 #define SHMMIN 1 147 #endif 148 #ifndef SHMMNI 149 #define SHMMNI 192 150 #endif 151 #ifndef SHMSEG 152 #define SHMSEG 128 153 #endif 154 #ifndef SHMALL 155 #define SHMALL (SHMMAXPGS) 156 #endif 157 158 struct shminfo shminfo = { 159 .shmmax = SHMMAX, 160 .shmmin = SHMMIN, 161 .shmmni = SHMMNI, 162 .shmseg = SHMSEG, 163 .shmall = SHMALL 164 }; 165 166 static int shm_use_phys; 167 static int shm_allow_removed; 168 169 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RWTUN, &shminfo.shmmax, 0, 170 "Maximum shared memory segment size"); 171 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RWTUN, &shminfo.shmmin, 0, 172 "Minimum shared memory segment size"); 173 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0, 174 "Number of shared memory identifiers"); 175 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0, 176 "Number of segments per process"); 177 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RWTUN, &shminfo.shmall, 0, 178 "Maximum number of pages available for shared memory"); 179 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RWTUN, 180 &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core"); 181 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RWTUN, 182 &shm_allow_removed, 0, 183 "Enable/Disable attachment to attached segments marked for removal"); 184 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLTYPE_OPAQUE | CTLFLAG_RD, 185 NULL, 0, sysctl_shmsegs, "", 186 "Current number of shared memory segments allocated"); 187 188 static int 189 shm_find_segment_by_key(key) 190 key_t key; 191 { 192 int i; 193 194 for (i = 0; i < shmalloced; i++) 195 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) && 196 shmsegs[i].u.shm_perm.key == key) 197 return (i); 198 return (-1); 199 } 200 201 static struct shmid_kernel * 202 shm_find_segment_by_shmid(int shmid) 203 { 204 int segnum; 205 struct shmid_kernel *shmseg; 206 207 segnum = IPCID_TO_IX(shmid); 208 if (segnum < 0 || segnum >= shmalloced) 209 return (NULL); 210 shmseg = &shmsegs[segnum]; 211 if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 || 212 (!shm_allow_removed && 213 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) || 214 shmseg->u.shm_perm.seq != IPCID_TO_SEQ(shmid)) 215 return (NULL); 216 return (shmseg); 217 } 218 219 static struct shmid_kernel * 220 shm_find_segment_by_shmidx(int segnum) 221 { 222 struct shmid_kernel *shmseg; 223 224 if (segnum < 0 || segnum >= shmalloced) 225 return (NULL); 226 shmseg = &shmsegs[segnum]; 227 if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 || 228 (!shm_allow_removed && 229 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0)) 230 return (NULL); 231 return (shmseg); 232 } 233 234 static void 235 shm_deallocate_segment(shmseg) 236 struct shmid_kernel *shmseg; 237 { 238 vm_size_t size; 239 240 GIANT_REQUIRED; 241 242 vm_object_deallocate(shmseg->object); 243 shmseg->object = NULL; 244 size = round_page(shmseg->u.shm_segsz); 245 shm_committed -= btoc(size); 246 shm_nused--; 247 shmseg->u.shm_perm.mode = SHMSEG_FREE; 248 #ifdef MAC 249 mac_sysvshm_cleanup(shmseg); 250 #endif 251 racct_sub_cred(shmseg->cred, RACCT_NSHM, 1); 252 racct_sub_cred(shmseg->cred, RACCT_SHMSIZE, size); 253 crfree(shmseg->cred); 254 shmseg->cred = NULL; 255 } 256 257 static int 258 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s) 259 { 260 struct shmid_kernel *shmseg; 261 int segnum, result; 262 vm_size_t size; 263 264 GIANT_REQUIRED; 265 266 segnum = IPCID_TO_IX(shmmap_s->shmid); 267 shmseg = &shmsegs[segnum]; 268 size = round_page(shmseg->u.shm_segsz); 269 result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size); 270 if (result != KERN_SUCCESS) 271 return (EINVAL); 272 shmmap_s->shmid = -1; 273 shmseg->u.shm_dtime = time_second; 274 if ((--shmseg->u.shm_nattch <= 0) && 275 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) { 276 shm_deallocate_segment(shmseg); 277 shm_last_free = segnum; 278 } 279 return (0); 280 } 281 282 #ifndef _SYS_SYSPROTO_H_ 283 struct shmdt_args { 284 const void *shmaddr; 285 }; 286 #endif 287 int 288 sys_shmdt(td, uap) 289 struct thread *td; 290 struct shmdt_args *uap; 291 { 292 struct proc *p = td->td_proc; 293 struct shmmap_state *shmmap_s; 294 #ifdef MAC 295 struct shmid_kernel *shmsegptr; 296 #endif 297 int i; 298 int error = 0; 299 300 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 301 return (ENOSYS); 302 mtx_lock(&Giant); 303 shmmap_s = p->p_vmspace->vm_shm; 304 if (shmmap_s == NULL) { 305 error = EINVAL; 306 goto done2; 307 } 308 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) { 309 if (shmmap_s->shmid != -1 && 310 shmmap_s->va == (vm_offset_t)uap->shmaddr) { 311 break; 312 } 313 } 314 if (i == shminfo.shmseg) { 315 error = EINVAL; 316 goto done2; 317 } 318 #ifdef MAC 319 shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)]; 320 error = mac_sysvshm_check_shmdt(td->td_ucred, shmsegptr); 321 if (error != 0) 322 goto done2; 323 #endif 324 error = shm_delete_mapping(p->p_vmspace, shmmap_s); 325 done2: 326 mtx_unlock(&Giant); 327 return (error); 328 } 329 330 #ifndef _SYS_SYSPROTO_H_ 331 struct shmat_args { 332 int shmid; 333 const void *shmaddr; 334 int shmflg; 335 }; 336 #endif 337 int 338 kern_shmat(td, shmid, shmaddr, shmflg) 339 struct thread *td; 340 int shmid; 341 const void *shmaddr; 342 int shmflg; 343 { 344 struct proc *p = td->td_proc; 345 int i; 346 struct shmid_kernel *shmseg; 347 struct shmmap_state *shmmap_s = NULL; 348 vm_offset_t attach_va; 349 vm_prot_t prot; 350 vm_size_t size; 351 int rv; 352 int error = 0; 353 354 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 355 return (ENOSYS); 356 mtx_lock(&Giant); 357 shmmap_s = p->p_vmspace->vm_shm; 358 if (shmmap_s == NULL) { 359 shmmap_s = malloc(shminfo.shmseg * sizeof(struct shmmap_state), 360 M_SHM, M_WAITOK); 361 362 /* 363 * If malloc() above sleeps, the Giant lock is 364 * temporarily dropped, which allows another thread to 365 * allocate shmmap_state and set vm_shm. Recheck 366 * vm_shm and free the new shmmap_state if another one 367 * is already allocated. 368 */ 369 if (p->p_vmspace->vm_shm != NULL) { 370 free(shmmap_s, M_SHM); 371 shmmap_s = p->p_vmspace->vm_shm; 372 } else { 373 for (i = 0; i < shminfo.shmseg; i++) 374 shmmap_s[i].shmid = -1; 375 p->p_vmspace->vm_shm = shmmap_s; 376 } 377 } 378 shmseg = shm_find_segment_by_shmid(shmid); 379 if (shmseg == NULL) { 380 error = EINVAL; 381 goto done2; 382 } 383 error = ipcperm(td, &shmseg->u.shm_perm, 384 (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W); 385 if (error) 386 goto done2; 387 #ifdef MAC 388 error = mac_sysvshm_check_shmat(td->td_ucred, shmseg, shmflg); 389 if (error != 0) 390 goto done2; 391 #endif 392 for (i = 0; i < shminfo.shmseg; i++) { 393 if (shmmap_s->shmid == -1) 394 break; 395 shmmap_s++; 396 } 397 if (i >= shminfo.shmseg) { 398 error = EMFILE; 399 goto done2; 400 } 401 size = round_page(shmseg->u.shm_segsz); 402 prot = VM_PROT_READ; 403 if ((shmflg & SHM_RDONLY) == 0) 404 prot |= VM_PROT_WRITE; 405 if (shmaddr) { 406 if (shmflg & SHM_RND) { 407 attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1); 408 } else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) { 409 attach_va = (vm_offset_t)shmaddr; 410 } else { 411 error = EINVAL; 412 goto done2; 413 } 414 } else { 415 /* 416 * This is just a hint to vm_map_find() about where to 417 * put it. 418 */ 419 PROC_LOCK(p); 420 attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr + 421 lim_max(p, RLIMIT_DATA)); 422 PROC_UNLOCK(p); 423 } 424 425 vm_object_reference(shmseg->object); 426 rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->object, 0, &attach_va, 427 size, 0, shmaddr != NULL ? VMFS_NO_SPACE : VMFS_OPTIMAL_SPACE, 428 prot, prot, MAP_INHERIT_SHARE | MAP_PREFAULT_PARTIAL); 429 if (rv != KERN_SUCCESS) { 430 vm_object_deallocate(shmseg->object); 431 error = ENOMEM; 432 goto done2; 433 } 434 435 shmmap_s->va = attach_va; 436 shmmap_s->shmid = shmid; 437 shmseg->u.shm_lpid = p->p_pid; 438 shmseg->u.shm_atime = time_second; 439 shmseg->u.shm_nattch++; 440 td->td_retval[0] = attach_va; 441 done2: 442 mtx_unlock(&Giant); 443 return (error); 444 } 445 446 int 447 sys_shmat(td, uap) 448 struct thread *td; 449 struct shmat_args *uap; 450 { 451 return kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg); 452 } 453 454 int 455 kern_shmctl(td, shmid, cmd, buf, bufsz) 456 struct thread *td; 457 int shmid; 458 int cmd; 459 void *buf; 460 size_t *bufsz; 461 { 462 int error = 0; 463 struct shmid_kernel *shmseg; 464 465 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 466 return (ENOSYS); 467 468 mtx_lock(&Giant); 469 switch (cmd) { 470 /* 471 * It is possible that kern_shmctl is being called from the Linux ABI 472 * layer, in which case, we will need to implement IPC_INFO. It should 473 * be noted that other shmctl calls will be funneled through here for 474 * Linix binaries as well. 475 * 476 * NB: The Linux ABI layer will convert this data to structure(s) more 477 * consistent with the Linux ABI. 478 */ 479 case IPC_INFO: 480 memcpy(buf, &shminfo, sizeof(shminfo)); 481 if (bufsz) 482 *bufsz = sizeof(shminfo); 483 td->td_retval[0] = shmalloced; 484 goto done2; 485 case SHM_INFO: { 486 struct shm_info shm_info; 487 shm_info.used_ids = shm_nused; 488 shm_info.shm_rss = 0; /*XXX where to get from ? */ 489 shm_info.shm_tot = 0; /*XXX where to get from ? */ 490 shm_info.shm_swp = 0; /*XXX where to get from ? */ 491 shm_info.swap_attempts = 0; /*XXX where to get from ? */ 492 shm_info.swap_successes = 0; /*XXX where to get from ? */ 493 memcpy(buf, &shm_info, sizeof(shm_info)); 494 if (bufsz) 495 *bufsz = sizeof(shm_info); 496 td->td_retval[0] = shmalloced; 497 goto done2; 498 } 499 } 500 if (cmd == SHM_STAT) 501 shmseg = shm_find_segment_by_shmidx(shmid); 502 else 503 shmseg = shm_find_segment_by_shmid(shmid); 504 if (shmseg == NULL) { 505 error = EINVAL; 506 goto done2; 507 } 508 #ifdef MAC 509 error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, cmd); 510 if (error != 0) 511 goto done2; 512 #endif 513 switch (cmd) { 514 case SHM_STAT: 515 case IPC_STAT: 516 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R); 517 if (error) 518 goto done2; 519 memcpy(buf, &shmseg->u, sizeof(struct shmid_ds)); 520 if (bufsz) 521 *bufsz = sizeof(struct shmid_ds); 522 if (cmd == SHM_STAT) 523 td->td_retval[0] = IXSEQ_TO_IPCID(shmid, shmseg->u.shm_perm); 524 break; 525 case IPC_SET: { 526 struct shmid_ds *shmid; 527 528 shmid = (struct shmid_ds *)buf; 529 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M); 530 if (error) 531 goto done2; 532 shmseg->u.shm_perm.uid = shmid->shm_perm.uid; 533 shmseg->u.shm_perm.gid = shmid->shm_perm.gid; 534 shmseg->u.shm_perm.mode = 535 (shmseg->u.shm_perm.mode & ~ACCESSPERMS) | 536 (shmid->shm_perm.mode & ACCESSPERMS); 537 shmseg->u.shm_ctime = time_second; 538 break; 539 } 540 case IPC_RMID: 541 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M); 542 if (error) 543 goto done2; 544 shmseg->u.shm_perm.key = IPC_PRIVATE; 545 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED; 546 if (shmseg->u.shm_nattch <= 0) { 547 shm_deallocate_segment(shmseg); 548 shm_last_free = IPCID_TO_IX(shmid); 549 } 550 break; 551 #if 0 552 case SHM_LOCK: 553 case SHM_UNLOCK: 554 #endif 555 default: 556 error = EINVAL; 557 break; 558 } 559 done2: 560 mtx_unlock(&Giant); 561 return (error); 562 } 563 564 #ifndef _SYS_SYSPROTO_H_ 565 struct shmctl_args { 566 int shmid; 567 int cmd; 568 struct shmid_ds *buf; 569 }; 570 #endif 571 int 572 sys_shmctl(td, uap) 573 struct thread *td; 574 struct shmctl_args *uap; 575 { 576 int error = 0; 577 struct shmid_ds buf; 578 size_t bufsz; 579 580 /* 581 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support 582 * Linux binaries. If we see the call come through the FreeBSD ABI, 583 * return an error back to the user since we do not to support this. 584 */ 585 if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO || 586 uap->cmd == SHM_STAT) 587 return (EINVAL); 588 589 /* IPC_SET needs to copyin the buffer before calling kern_shmctl */ 590 if (uap->cmd == IPC_SET) { 591 if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds)))) 592 goto done; 593 } 594 595 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz); 596 if (error) 597 goto done; 598 599 /* Cases in which we need to copyout */ 600 switch (uap->cmd) { 601 case IPC_STAT: 602 error = copyout(&buf, uap->buf, bufsz); 603 break; 604 } 605 606 done: 607 if (error) { 608 /* Invalidate the return value */ 609 td->td_retval[0] = -1; 610 } 611 return (error); 612 } 613 614 615 static int 616 shmget_existing(td, uap, mode, segnum) 617 struct thread *td; 618 struct shmget_args *uap; 619 int mode; 620 int segnum; 621 { 622 struct shmid_kernel *shmseg; 623 int error; 624 625 shmseg = &shmsegs[segnum]; 626 if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) { 627 /* 628 * This segment is in the process of being allocated. Wait 629 * until it's done, and look the key up again (in case the 630 * allocation failed or it was freed). 631 */ 632 shmseg->u.shm_perm.mode |= SHMSEG_WANTED; 633 error = tsleep(shmseg, PLOCK | PCATCH, "shmget", 0); 634 if (error) 635 return (error); 636 return (EAGAIN); 637 } 638 if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL)) 639 return (EEXIST); 640 #ifdef MAC 641 error = mac_sysvshm_check_shmget(td->td_ucred, shmseg, uap->shmflg); 642 if (error != 0) 643 return (error); 644 #endif 645 if (uap->size != 0 && uap->size > shmseg->u.shm_segsz) 646 return (EINVAL); 647 td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm); 648 return (0); 649 } 650 651 static int 652 shmget_allocate_segment(td, uap, mode) 653 struct thread *td; 654 struct shmget_args *uap; 655 int mode; 656 { 657 int i, segnum, shmid; 658 size_t size; 659 struct ucred *cred = td->td_ucred; 660 struct shmid_kernel *shmseg; 661 vm_object_t shm_object; 662 663 GIANT_REQUIRED; 664 665 if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax) 666 return (EINVAL); 667 if (shm_nused >= shminfo.shmmni) /* Any shmids left? */ 668 return (ENOSPC); 669 size = round_page(uap->size); 670 if (shm_committed + btoc(size) > shminfo.shmall) 671 return (ENOMEM); 672 if (shm_last_free < 0) { 673 shmrealloc(); /* Maybe expand the shmsegs[] array. */ 674 for (i = 0; i < shmalloced; i++) 675 if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE) 676 break; 677 if (i == shmalloced) 678 return (ENOSPC); 679 segnum = i; 680 } else { 681 segnum = shm_last_free; 682 shm_last_free = -1; 683 } 684 shmseg = &shmsegs[segnum]; 685 #ifdef RACCT 686 PROC_LOCK(td->td_proc); 687 if (racct_add(td->td_proc, RACCT_NSHM, 1)) { 688 PROC_UNLOCK(td->td_proc); 689 return (ENOSPC); 690 } 691 if (racct_add(td->td_proc, RACCT_SHMSIZE, size)) { 692 racct_sub(td->td_proc, RACCT_NSHM, 1); 693 PROC_UNLOCK(td->td_proc); 694 return (ENOMEM); 695 } 696 PROC_UNLOCK(td->td_proc); 697 #endif 698 /* 699 * In case we sleep in malloc(), mark the segment present but deleted 700 * so that noone else tries to create the same key. 701 */ 702 shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED; 703 shmseg->u.shm_perm.key = uap->key; 704 shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff; 705 shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm); 706 707 /* 708 * We make sure that we have allocated a pager before we need 709 * to. 710 */ 711 shm_object = vm_pager_allocate(shm_use_phys ? OBJT_PHYS : OBJT_SWAP, 712 0, size, VM_PROT_DEFAULT, 0, cred); 713 if (shm_object == NULL) { 714 #ifdef RACCT 715 PROC_LOCK(td->td_proc); 716 racct_sub(td->td_proc, RACCT_NSHM, 1); 717 racct_sub(td->td_proc, RACCT_SHMSIZE, size); 718 PROC_UNLOCK(td->td_proc); 719 #endif 720 return (ENOMEM); 721 } 722 shm_object->pg_color = 0; 723 VM_OBJECT_WLOCK(shm_object); 724 vm_object_clear_flag(shm_object, OBJ_ONEMAPPING); 725 vm_object_set_flag(shm_object, OBJ_COLORED | OBJ_NOSPLIT); 726 VM_OBJECT_WUNLOCK(shm_object); 727 728 shmseg->object = shm_object; 729 shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid; 730 shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid; 731 shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) | 732 (mode & ACCESSPERMS) | SHMSEG_ALLOCATED; 733 shmseg->cred = crhold(cred); 734 shmseg->u.shm_segsz = uap->size; 735 shmseg->u.shm_cpid = td->td_proc->p_pid; 736 shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0; 737 shmseg->u.shm_atime = shmseg->u.shm_dtime = 0; 738 #ifdef MAC 739 mac_sysvshm_create(cred, shmseg); 740 #endif 741 shmseg->u.shm_ctime = time_second; 742 shm_committed += btoc(size); 743 shm_nused++; 744 if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) { 745 /* 746 * Somebody else wanted this key while we were asleep. Wake 747 * them up now. 748 */ 749 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED; 750 wakeup(shmseg); 751 } 752 td->td_retval[0] = shmid; 753 return (0); 754 } 755 756 #ifndef _SYS_SYSPROTO_H_ 757 struct shmget_args { 758 key_t key; 759 size_t size; 760 int shmflg; 761 }; 762 #endif 763 int 764 sys_shmget(td, uap) 765 struct thread *td; 766 struct shmget_args *uap; 767 { 768 int segnum, mode; 769 int error; 770 771 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 772 return (ENOSYS); 773 mtx_lock(&Giant); 774 mode = uap->shmflg & ACCESSPERMS; 775 if (uap->key != IPC_PRIVATE) { 776 again: 777 segnum = shm_find_segment_by_key(uap->key); 778 if (segnum >= 0) { 779 error = shmget_existing(td, uap, mode, segnum); 780 if (error == EAGAIN) 781 goto again; 782 goto done2; 783 } 784 if ((uap->shmflg & IPC_CREAT) == 0) { 785 error = ENOENT; 786 goto done2; 787 } 788 } 789 error = shmget_allocate_segment(td, uap, mode); 790 done2: 791 mtx_unlock(&Giant); 792 return (error); 793 } 794 795 static void 796 shmfork_myhook(p1, p2) 797 struct proc *p1, *p2; 798 { 799 struct shmmap_state *shmmap_s; 800 size_t size; 801 int i; 802 803 mtx_lock(&Giant); 804 size = shminfo.shmseg * sizeof(struct shmmap_state); 805 shmmap_s = malloc(size, M_SHM, M_WAITOK); 806 bcopy(p1->p_vmspace->vm_shm, shmmap_s, size); 807 p2->p_vmspace->vm_shm = shmmap_s; 808 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) 809 if (shmmap_s->shmid != -1) 810 shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++; 811 mtx_unlock(&Giant); 812 } 813 814 static void 815 shmexit_myhook(struct vmspace *vm) 816 { 817 struct shmmap_state *base, *shm; 818 int i; 819 820 if ((base = vm->vm_shm) != NULL) { 821 vm->vm_shm = NULL; 822 mtx_lock(&Giant); 823 for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) { 824 if (shm->shmid != -1) 825 shm_delete_mapping(vm, shm); 826 } 827 mtx_unlock(&Giant); 828 free(base, M_SHM); 829 } 830 } 831 832 static void 833 shmrealloc(void) 834 { 835 int i; 836 struct shmid_kernel *newsegs; 837 838 if (shmalloced >= shminfo.shmmni) 839 return; 840 841 newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK); 842 for (i = 0; i < shmalloced; i++) 843 bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0])); 844 for (; i < shminfo.shmmni; i++) { 845 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE; 846 shmsegs[i].u.shm_perm.seq = 0; 847 #ifdef MAC 848 mac_sysvshm_init(&shmsegs[i]); 849 #endif 850 } 851 free(shmsegs, M_SHM); 852 shmsegs = newsegs; 853 shmalloced = shminfo.shmmni; 854 } 855 856 static struct syscall_helper_data shm_syscalls[] = { 857 SYSCALL_INIT_HELPER(shmat), 858 SYSCALL_INIT_HELPER(shmctl), 859 SYSCALL_INIT_HELPER(shmdt), 860 SYSCALL_INIT_HELPER(shmget), 861 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 862 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 863 SYSCALL_INIT_HELPER_COMPAT(freebsd7_shmctl), 864 #endif 865 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43)) 866 SYSCALL_INIT_HELPER(shmsys), 867 #endif 868 SYSCALL_INIT_LAST 869 }; 870 871 #ifdef COMPAT_FREEBSD32 872 #include <compat/freebsd32/freebsd32.h> 873 #include <compat/freebsd32/freebsd32_ipc.h> 874 #include <compat/freebsd32/freebsd32_proto.h> 875 #include <compat/freebsd32/freebsd32_signal.h> 876 #include <compat/freebsd32/freebsd32_syscall.h> 877 #include <compat/freebsd32/freebsd32_util.h> 878 879 static struct syscall_helper_data shm32_syscalls[] = { 880 SYSCALL32_INIT_HELPER_COMPAT(shmat), 881 SYSCALL32_INIT_HELPER_COMPAT(shmdt), 882 SYSCALL32_INIT_HELPER_COMPAT(shmget), 883 SYSCALL32_INIT_HELPER(freebsd32_shmsys), 884 SYSCALL32_INIT_HELPER(freebsd32_shmctl), 885 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 886 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 887 SYSCALL32_INIT_HELPER(freebsd7_freebsd32_shmctl), 888 #endif 889 SYSCALL_INIT_LAST 890 }; 891 #endif 892 893 static int 894 shminit() 895 { 896 int i, error; 897 898 #ifndef BURN_BRIDGES 899 if (TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall) != 0) 900 printf("kern.ipc.shmmaxpgs is now called kern.ipc.shmall!\n"); 901 #endif 902 if (shminfo.shmmax == SHMMAX) { 903 /* Initialize shmmax dealing with possible overflow. */ 904 for (i = PAGE_SIZE; i != 0; i--) { 905 shminfo.shmmax = shminfo.shmall * i; 906 if ((shminfo.shmmax / shminfo.shmall) == (u_long)i) 907 break; 908 } 909 } 910 shmalloced = shminfo.shmmni; 911 shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK); 912 for (i = 0; i < shmalloced; i++) { 913 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE; 914 shmsegs[i].u.shm_perm.seq = 0; 915 #ifdef MAC 916 mac_sysvshm_init(&shmsegs[i]); 917 #endif 918 } 919 shm_last_free = 0; 920 shm_nused = 0; 921 shm_committed = 0; 922 shmexit_hook = &shmexit_myhook; 923 shmfork_hook = &shmfork_myhook; 924 925 error = syscall_helper_register(shm_syscalls, SY_THR_STATIC_KLD); 926 if (error != 0) 927 return (error); 928 #ifdef COMPAT_FREEBSD32 929 error = syscall32_helper_register(shm32_syscalls, SY_THR_STATIC_KLD); 930 if (error != 0) 931 return (error); 932 #endif 933 return (0); 934 } 935 936 static int 937 shmunload() 938 { 939 int i; 940 941 if (shm_nused > 0) 942 return (EBUSY); 943 944 #ifdef COMPAT_FREEBSD32 945 syscall32_helper_unregister(shm32_syscalls); 946 #endif 947 syscall_helper_unregister(shm_syscalls); 948 949 for (i = 0; i < shmalloced; i++) { 950 #ifdef MAC 951 mac_sysvshm_destroy(&shmsegs[i]); 952 #endif 953 /* 954 * Objects might be still mapped into the processes 955 * address spaces. Actual free would happen on the 956 * last mapping destruction. 957 */ 958 if (shmsegs[i].u.shm_perm.mode != SHMSEG_FREE) 959 vm_object_deallocate(shmsegs[i].object); 960 } 961 free(shmsegs, M_SHM); 962 shmexit_hook = NULL; 963 shmfork_hook = NULL; 964 return (0); 965 } 966 967 static int 968 sysctl_shmsegs(SYSCTL_HANDLER_ARGS) 969 { 970 971 return (SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0]))); 972 } 973 974 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43)) 975 struct oshmid_ds { 976 struct ipc_perm_old shm_perm; /* operation perms */ 977 int shm_segsz; /* size of segment (bytes) */ 978 u_short shm_cpid; /* pid, creator */ 979 u_short shm_lpid; /* pid, last operation */ 980 short shm_nattch; /* no. of current attaches */ 981 time_t shm_atime; /* last attach time */ 982 time_t shm_dtime; /* last detach time */ 983 time_t shm_ctime; /* last change time */ 984 void *shm_handle; /* internal handle for shm segment */ 985 }; 986 987 struct oshmctl_args { 988 int shmid; 989 int cmd; 990 struct oshmid_ds *ubuf; 991 }; 992 993 static int 994 oshmctl(struct thread *td, struct oshmctl_args *uap) 995 { 996 #ifdef COMPAT_43 997 int error = 0; 998 struct shmid_kernel *shmseg; 999 struct oshmid_ds outbuf; 1000 1001 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 1002 return (ENOSYS); 1003 mtx_lock(&Giant); 1004 shmseg = shm_find_segment_by_shmid(uap->shmid); 1005 if (shmseg == NULL) { 1006 error = EINVAL; 1007 goto done2; 1008 } 1009 switch (uap->cmd) { 1010 case IPC_STAT: 1011 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R); 1012 if (error) 1013 goto done2; 1014 #ifdef MAC 1015 error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, uap->cmd); 1016 if (error != 0) 1017 goto done2; 1018 #endif 1019 ipcperm_new2old(&shmseg->u.shm_perm, &outbuf.shm_perm); 1020 outbuf.shm_segsz = shmseg->u.shm_segsz; 1021 outbuf.shm_cpid = shmseg->u.shm_cpid; 1022 outbuf.shm_lpid = shmseg->u.shm_lpid; 1023 outbuf.shm_nattch = shmseg->u.shm_nattch; 1024 outbuf.shm_atime = shmseg->u.shm_atime; 1025 outbuf.shm_dtime = shmseg->u.shm_dtime; 1026 outbuf.shm_ctime = shmseg->u.shm_ctime; 1027 outbuf.shm_handle = shmseg->object; 1028 error = copyout(&outbuf, uap->ubuf, sizeof(outbuf)); 1029 if (error) 1030 goto done2; 1031 break; 1032 default: 1033 error = freebsd7_shmctl(td, (struct freebsd7_shmctl_args *)uap); 1034 break; 1035 } 1036 done2: 1037 mtx_unlock(&Giant); 1038 return (error); 1039 #else 1040 return (EINVAL); 1041 #endif 1042 } 1043 1044 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 1045 static sy_call_t *shmcalls[] = { 1046 (sy_call_t *)sys_shmat, (sy_call_t *)oshmctl, 1047 (sy_call_t *)sys_shmdt, (sy_call_t *)sys_shmget, 1048 (sy_call_t *)freebsd7_shmctl 1049 }; 1050 1051 int 1052 sys_shmsys(td, uap) 1053 struct thread *td; 1054 /* XXX actually varargs. */ 1055 struct shmsys_args /* { 1056 int which; 1057 int a2; 1058 int a3; 1059 int a4; 1060 } */ *uap; 1061 { 1062 int error; 1063 1064 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 1065 return (ENOSYS); 1066 if (uap->which < 0 || 1067 uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0])) 1068 return (EINVAL); 1069 mtx_lock(&Giant); 1070 error = (*shmcalls[uap->which])(td, &uap->a2); 1071 mtx_unlock(&Giant); 1072 return (error); 1073 } 1074 1075 #endif /* i386 && (COMPAT_FREEBSD4 || COMPAT_43) */ 1076 1077 #ifdef COMPAT_FREEBSD32 1078 1079 int 1080 freebsd32_shmsys(struct thread *td, struct freebsd32_shmsys_args *uap) 1081 { 1082 1083 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1084 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1085 switch (uap->which) { 1086 case 0: { /* shmat */ 1087 struct shmat_args ap; 1088 1089 ap.shmid = uap->a2; 1090 ap.shmaddr = PTRIN(uap->a3); 1091 ap.shmflg = uap->a4; 1092 return (sysent[SYS_shmat].sy_call(td, &ap)); 1093 } 1094 case 2: { /* shmdt */ 1095 struct shmdt_args ap; 1096 1097 ap.shmaddr = PTRIN(uap->a2); 1098 return (sysent[SYS_shmdt].sy_call(td, &ap)); 1099 } 1100 case 3: { /* shmget */ 1101 struct shmget_args ap; 1102 1103 ap.key = uap->a2; 1104 ap.size = uap->a3; 1105 ap.shmflg = uap->a4; 1106 return (sysent[SYS_shmget].sy_call(td, &ap)); 1107 } 1108 case 4: { /* shmctl */ 1109 struct freebsd7_freebsd32_shmctl_args ap; 1110 1111 ap.shmid = uap->a2; 1112 ap.cmd = uap->a3; 1113 ap.buf = PTRIN(uap->a4); 1114 return (freebsd7_freebsd32_shmctl(td, &ap)); 1115 } 1116 case 1: /* oshmctl */ 1117 default: 1118 return (EINVAL); 1119 } 1120 #else 1121 return (nosys(td, NULL)); 1122 #endif 1123 } 1124 1125 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1126 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1127 int 1128 freebsd7_freebsd32_shmctl(struct thread *td, 1129 struct freebsd7_freebsd32_shmctl_args *uap) 1130 { 1131 int error = 0; 1132 union { 1133 struct shmid_ds shmid_ds; 1134 struct shm_info shm_info; 1135 struct shminfo shminfo; 1136 } u; 1137 union { 1138 struct shmid_ds32_old shmid_ds32; 1139 struct shm_info32 shm_info32; 1140 struct shminfo32 shminfo32; 1141 } u32; 1142 size_t sz; 1143 1144 if (uap->cmd == IPC_SET) { 1145 if ((error = copyin(uap->buf, &u32.shmid_ds32, 1146 sizeof(u32.shmid_ds32)))) 1147 goto done; 1148 freebsd32_ipcperm_old_in(&u32.shmid_ds32.shm_perm, 1149 &u.shmid_ds.shm_perm); 1150 CP(u32.shmid_ds32, u.shmid_ds, shm_segsz); 1151 CP(u32.shmid_ds32, u.shmid_ds, shm_lpid); 1152 CP(u32.shmid_ds32, u.shmid_ds, shm_cpid); 1153 CP(u32.shmid_ds32, u.shmid_ds, shm_nattch); 1154 CP(u32.shmid_ds32, u.shmid_ds, shm_atime); 1155 CP(u32.shmid_ds32, u.shmid_ds, shm_dtime); 1156 CP(u32.shmid_ds32, u.shmid_ds, shm_ctime); 1157 } 1158 1159 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz); 1160 if (error) 1161 goto done; 1162 1163 /* Cases in which we need to copyout */ 1164 switch (uap->cmd) { 1165 case IPC_INFO: 1166 CP(u.shminfo, u32.shminfo32, shmmax); 1167 CP(u.shminfo, u32.shminfo32, shmmin); 1168 CP(u.shminfo, u32.shminfo32, shmmni); 1169 CP(u.shminfo, u32.shminfo32, shmseg); 1170 CP(u.shminfo, u32.shminfo32, shmall); 1171 error = copyout(&u32.shminfo32, uap->buf, 1172 sizeof(u32.shminfo32)); 1173 break; 1174 case SHM_INFO: 1175 CP(u.shm_info, u32.shm_info32, used_ids); 1176 CP(u.shm_info, u32.shm_info32, shm_rss); 1177 CP(u.shm_info, u32.shm_info32, shm_tot); 1178 CP(u.shm_info, u32.shm_info32, shm_swp); 1179 CP(u.shm_info, u32.shm_info32, swap_attempts); 1180 CP(u.shm_info, u32.shm_info32, swap_successes); 1181 error = copyout(&u32.shm_info32, uap->buf, 1182 sizeof(u32.shm_info32)); 1183 break; 1184 case SHM_STAT: 1185 case IPC_STAT: 1186 freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm, 1187 &u32.shmid_ds32.shm_perm); 1188 if (u.shmid_ds.shm_segsz > INT32_MAX) 1189 u32.shmid_ds32.shm_segsz = INT32_MAX; 1190 else 1191 CP(u.shmid_ds, u32.shmid_ds32, shm_segsz); 1192 CP(u.shmid_ds, u32.shmid_ds32, shm_lpid); 1193 CP(u.shmid_ds, u32.shmid_ds32, shm_cpid); 1194 CP(u.shmid_ds, u32.shmid_ds32, shm_nattch); 1195 CP(u.shmid_ds, u32.shmid_ds32, shm_atime); 1196 CP(u.shmid_ds, u32.shmid_ds32, shm_dtime); 1197 CP(u.shmid_ds, u32.shmid_ds32, shm_ctime); 1198 u32.shmid_ds32.shm_internal = 0; 1199 error = copyout(&u32.shmid_ds32, uap->buf, 1200 sizeof(u32.shmid_ds32)); 1201 break; 1202 } 1203 1204 done: 1205 if (error) { 1206 /* Invalidate the return value */ 1207 td->td_retval[0] = -1; 1208 } 1209 return (error); 1210 } 1211 #endif 1212 1213 int 1214 freebsd32_shmctl(struct thread *td, struct freebsd32_shmctl_args *uap) 1215 { 1216 int error = 0; 1217 union { 1218 struct shmid_ds shmid_ds; 1219 struct shm_info shm_info; 1220 struct shminfo shminfo; 1221 } u; 1222 union { 1223 struct shmid_ds32 shmid_ds32; 1224 struct shm_info32 shm_info32; 1225 struct shminfo32 shminfo32; 1226 } u32; 1227 size_t sz; 1228 1229 if (uap->cmd == IPC_SET) { 1230 if ((error = copyin(uap->buf, &u32.shmid_ds32, 1231 sizeof(u32.shmid_ds32)))) 1232 goto done; 1233 freebsd32_ipcperm_in(&u32.shmid_ds32.shm_perm, 1234 &u.shmid_ds.shm_perm); 1235 CP(u32.shmid_ds32, u.shmid_ds, shm_segsz); 1236 CP(u32.shmid_ds32, u.shmid_ds, shm_lpid); 1237 CP(u32.shmid_ds32, u.shmid_ds, shm_cpid); 1238 CP(u32.shmid_ds32, u.shmid_ds, shm_nattch); 1239 CP(u32.shmid_ds32, u.shmid_ds, shm_atime); 1240 CP(u32.shmid_ds32, u.shmid_ds, shm_dtime); 1241 CP(u32.shmid_ds32, u.shmid_ds, shm_ctime); 1242 } 1243 1244 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz); 1245 if (error) 1246 goto done; 1247 1248 /* Cases in which we need to copyout */ 1249 switch (uap->cmd) { 1250 case IPC_INFO: 1251 CP(u.shminfo, u32.shminfo32, shmmax); 1252 CP(u.shminfo, u32.shminfo32, shmmin); 1253 CP(u.shminfo, u32.shminfo32, shmmni); 1254 CP(u.shminfo, u32.shminfo32, shmseg); 1255 CP(u.shminfo, u32.shminfo32, shmall); 1256 error = copyout(&u32.shminfo32, uap->buf, 1257 sizeof(u32.shminfo32)); 1258 break; 1259 case SHM_INFO: 1260 CP(u.shm_info, u32.shm_info32, used_ids); 1261 CP(u.shm_info, u32.shm_info32, shm_rss); 1262 CP(u.shm_info, u32.shm_info32, shm_tot); 1263 CP(u.shm_info, u32.shm_info32, shm_swp); 1264 CP(u.shm_info, u32.shm_info32, swap_attempts); 1265 CP(u.shm_info, u32.shm_info32, swap_successes); 1266 error = copyout(&u32.shm_info32, uap->buf, 1267 sizeof(u32.shm_info32)); 1268 break; 1269 case SHM_STAT: 1270 case IPC_STAT: 1271 freebsd32_ipcperm_out(&u.shmid_ds.shm_perm, 1272 &u32.shmid_ds32.shm_perm); 1273 if (u.shmid_ds.shm_segsz > INT32_MAX) 1274 u32.shmid_ds32.shm_segsz = INT32_MAX; 1275 else 1276 CP(u.shmid_ds, u32.shmid_ds32, shm_segsz); 1277 CP(u.shmid_ds, u32.shmid_ds32, shm_lpid); 1278 CP(u.shmid_ds, u32.shmid_ds32, shm_cpid); 1279 CP(u.shmid_ds, u32.shmid_ds32, shm_nattch); 1280 CP(u.shmid_ds, u32.shmid_ds32, shm_atime); 1281 CP(u.shmid_ds, u32.shmid_ds32, shm_dtime); 1282 CP(u.shmid_ds, u32.shmid_ds32, shm_ctime); 1283 error = copyout(&u32.shmid_ds32, uap->buf, 1284 sizeof(u32.shmid_ds32)); 1285 break; 1286 } 1287 1288 done: 1289 if (error) { 1290 /* Invalidate the return value */ 1291 td->td_retval[0] = -1; 1292 } 1293 return (error); 1294 } 1295 #endif 1296 1297 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1298 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1299 1300 #ifndef CP 1301 #define CP(src, dst, fld) do { (dst).fld = (src).fld; } while (0) 1302 #endif 1303 1304 #ifndef _SYS_SYSPROTO_H_ 1305 struct freebsd7_shmctl_args { 1306 int shmid; 1307 int cmd; 1308 struct shmid_ds_old *buf; 1309 }; 1310 #endif 1311 int 1312 freebsd7_shmctl(td, uap) 1313 struct thread *td; 1314 struct freebsd7_shmctl_args *uap; 1315 { 1316 int error = 0; 1317 struct shmid_ds_old old; 1318 struct shmid_ds buf; 1319 size_t bufsz; 1320 1321 /* 1322 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support 1323 * Linux binaries. If we see the call come through the FreeBSD ABI, 1324 * return an error back to the user since we do not to support this. 1325 */ 1326 if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO || 1327 uap->cmd == SHM_STAT) 1328 return (EINVAL); 1329 1330 /* IPC_SET needs to copyin the buffer before calling kern_shmctl */ 1331 if (uap->cmd == IPC_SET) { 1332 if ((error = copyin(uap->buf, &old, sizeof(old)))) 1333 goto done; 1334 ipcperm_old2new(&old.shm_perm, &buf.shm_perm); 1335 CP(old, buf, shm_segsz); 1336 CP(old, buf, shm_lpid); 1337 CP(old, buf, shm_cpid); 1338 CP(old, buf, shm_nattch); 1339 CP(old, buf, shm_atime); 1340 CP(old, buf, shm_dtime); 1341 CP(old, buf, shm_ctime); 1342 } 1343 1344 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz); 1345 if (error) 1346 goto done; 1347 1348 /* Cases in which we need to copyout */ 1349 switch (uap->cmd) { 1350 case IPC_STAT: 1351 ipcperm_new2old(&buf.shm_perm, &old.shm_perm); 1352 if (buf.shm_segsz > INT_MAX) 1353 old.shm_segsz = INT_MAX; 1354 else 1355 CP(buf, old, shm_segsz); 1356 CP(buf, old, shm_lpid); 1357 CP(buf, old, shm_cpid); 1358 if (buf.shm_nattch > SHRT_MAX) 1359 old.shm_nattch = SHRT_MAX; 1360 else 1361 CP(buf, old, shm_nattch); 1362 CP(buf, old, shm_atime); 1363 CP(buf, old, shm_dtime); 1364 CP(buf, old, shm_ctime); 1365 old.shm_internal = NULL; 1366 error = copyout(&old, uap->buf, sizeof(old)); 1367 break; 1368 } 1369 1370 done: 1371 if (error) { 1372 /* Invalidate the return value */ 1373 td->td_retval[0] = -1; 1374 } 1375 return (error); 1376 } 1377 1378 #endif /* COMPAT_FREEBSD4 || COMPAT_FREEBSD5 || COMPAT_FREEBSD6 || 1379 COMPAT_FREEBSD7 */ 1380 1381 static int 1382 sysvshm_modload(struct module *module, int cmd, void *arg) 1383 { 1384 int error = 0; 1385 1386 switch (cmd) { 1387 case MOD_LOAD: 1388 error = shminit(); 1389 if (error != 0) 1390 shmunload(); 1391 break; 1392 case MOD_UNLOAD: 1393 error = shmunload(); 1394 break; 1395 case MOD_SHUTDOWN: 1396 break; 1397 default: 1398 error = EINVAL; 1399 break; 1400 } 1401 return (error); 1402 } 1403 1404 static moduledata_t sysvshm_mod = { 1405 "sysvshm", 1406 &sysvshm_modload, 1407 NULL 1408 }; 1409 1410 DECLARE_MODULE(sysvshm, sysvshm_mod, SI_SUB_SYSV_SHM, SI_ORDER_FIRST); 1411 MODULE_VERSION(sysvshm, 1); 1412