xref: /freebsd/sys/kern/sysv_shm.c (revision de7df74b4855cd9bdd01583a12409d5b1e6da354)
1 /*	$NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $	*/
2 /*-
3  * Copyright (c) 1994 Adam Glass and Charles Hannum.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by Adam Glass and Charles
16  *	Hannum.
17  * 4. The names of the authors may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  */
31 /*-
32  * Copyright (c) 2003-2005 McAfee, Inc.
33  * All rights reserved.
34  *
35  * This software was developed for the FreeBSD Project in part by McAfee
36  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
37  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
38  * program.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  */
61 
62 #include <sys/cdefs.h>
63 __FBSDID("$FreeBSD$");
64 
65 #include "opt_compat.h"
66 #include "opt_sysvipc.h"
67 
68 #include <sys/param.h>
69 #include <sys/systm.h>
70 #include <sys/kernel.h>
71 #include <sys/limits.h>
72 #include <sys/lock.h>
73 #include <sys/sysctl.h>
74 #include <sys/shm.h>
75 #include <sys/proc.h>
76 #include <sys/malloc.h>
77 #include <sys/mman.h>
78 #include <sys/module.h>
79 #include <sys/mutex.h>
80 #include <sys/racct.h>
81 #include <sys/resourcevar.h>
82 #include <sys/rwlock.h>
83 #include <sys/stat.h>
84 #include <sys/syscall.h>
85 #include <sys/syscallsubr.h>
86 #include <sys/sysent.h>
87 #include <sys/sysproto.h>
88 #include <sys/jail.h>
89 
90 #include <security/mac/mac_framework.h>
91 
92 #include <vm/vm.h>
93 #include <vm/vm_param.h>
94 #include <vm/pmap.h>
95 #include <vm/vm_object.h>
96 #include <vm/vm_map.h>
97 #include <vm/vm_page.h>
98 #include <vm/vm_pager.h>
99 
100 FEATURE(sysv_shm, "System V shared memory segments support");
101 
102 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
103 
104 static int shmget_allocate_segment(struct thread *td,
105     struct shmget_args *uap, int mode);
106 static int shmget_existing(struct thread *td, struct shmget_args *uap,
107     int mode, int segnum);
108 
109 #define	SHMSEG_FREE     	0x0200
110 #define	SHMSEG_REMOVED  	0x0400
111 #define	SHMSEG_ALLOCATED	0x0800
112 
113 static int shm_last_free, shm_nused, shmalloced;
114 vm_size_t shm_committed;
115 static struct shmid_kernel	*shmsegs;
116 
117 struct shmmap_state {
118 	vm_offset_t va;
119 	int shmid;
120 };
121 
122 static void shm_deallocate_segment(struct shmid_kernel *);
123 static int shm_find_segment_by_key(key_t);
124 static struct shmid_kernel *shm_find_segment(int, bool);
125 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *);
126 static void shmrealloc(void);
127 static int shminit(void);
128 static int sysvshm_modload(struct module *, int, void *);
129 static int shmunload(void);
130 static void shmexit_myhook(struct vmspace *vm);
131 static void shmfork_myhook(struct proc *p1, struct proc *p2);
132 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS);
133 
134 /*
135  * Tuneable values.
136  */
137 #ifndef SHMMAXPGS
138 #define	SHMMAXPGS	131072	/* Note: sysv shared memory is swap backed. */
139 #endif
140 #ifndef SHMMAX
141 #define	SHMMAX	(SHMMAXPGS*PAGE_SIZE)
142 #endif
143 #ifndef SHMMIN
144 #define	SHMMIN	1
145 #endif
146 #ifndef SHMMNI
147 #define	SHMMNI	192
148 #endif
149 #ifndef SHMSEG
150 #define	SHMSEG	128
151 #endif
152 #ifndef SHMALL
153 #define	SHMALL	(SHMMAXPGS)
154 #endif
155 
156 struct	shminfo shminfo = {
157 	.shmmax = SHMMAX,
158 	.shmmin = SHMMIN,
159 	.shmmni = SHMMNI,
160 	.shmseg = SHMSEG,
161 	.shmall = SHMALL
162 };
163 
164 static int shm_use_phys;
165 static int shm_allow_removed;
166 
167 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RWTUN, &shminfo.shmmax, 0,
168     "Maximum shared memory segment size");
169 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RWTUN, &shminfo.shmmin, 0,
170     "Minimum shared memory segment size");
171 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0,
172     "Number of shared memory identifiers");
173 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0,
174     "Number of segments per process");
175 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RWTUN, &shminfo.shmall, 0,
176     "Maximum number of pages available for shared memory");
177 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RWTUN,
178     &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core");
179 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RWTUN,
180     &shm_allow_removed, 0,
181     "Enable/Disable attachment to attached segments marked for removal");
182 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLTYPE_OPAQUE | CTLFLAG_RD |
183     CTLFLAG_MPSAFE, NULL, 0, sysctl_shmsegs, "",
184     "Current number of shared memory segments allocated");
185 
186 static struct sx sysvshmsx;
187 #define	SYSVSHM_LOCK()		sx_xlock(&sysvshmsx)
188 #define	SYSVSHM_UNLOCK()	sx_xunlock(&sysvshmsx)
189 #define	SYSVSHM_ASSERT_LOCKED()	sx_assert(&sysvshmsx, SA_XLOCKED)
190 
191 static int
192 shm_find_segment_by_key(key_t key)
193 {
194 	int i;
195 
196 	for (i = 0; i < shmalloced; i++)
197 		if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
198 		    shmsegs[i].u.shm_perm.key == key)
199 			return (i);
200 	return (-1);
201 }
202 
203 /*
204  * Finds segment either by shmid if is_shmid is true, or by segnum if
205  * is_shmid is false.
206  */
207 static struct shmid_kernel *
208 shm_find_segment(int arg, bool is_shmid)
209 {
210 	struct shmid_kernel *shmseg;
211 	int segnum;
212 
213 	segnum = is_shmid ? IPCID_TO_IX(arg) : arg;
214 	if (segnum < 0 || segnum >= shmalloced)
215 		return (NULL);
216 	shmseg = &shmsegs[segnum];
217 	if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 ||
218 	    (!shm_allow_removed &&
219 	     (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) ||
220 	    (is_shmid && shmseg->u.shm_perm.seq != IPCID_TO_SEQ(arg)))
221 		return (NULL);
222 	return (shmseg);
223 }
224 
225 static void
226 shm_deallocate_segment(struct shmid_kernel *shmseg)
227 {
228 	vm_size_t size;
229 
230 	SYSVSHM_ASSERT_LOCKED();
231 
232 	vm_object_deallocate(shmseg->object);
233 	shmseg->object = NULL;
234 	size = round_page(shmseg->u.shm_segsz);
235 	shm_committed -= btoc(size);
236 	shm_nused--;
237 	shmseg->u.shm_perm.mode = SHMSEG_FREE;
238 #ifdef MAC
239 	mac_sysvshm_cleanup(shmseg);
240 #endif
241 	racct_sub_cred(shmseg->cred, RACCT_NSHM, 1);
242 	racct_sub_cred(shmseg->cred, RACCT_SHMSIZE, size);
243 	crfree(shmseg->cred);
244 	shmseg->cred = NULL;
245 }
246 
247 static int
248 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s)
249 {
250 	struct shmid_kernel *shmseg;
251 	int segnum, result;
252 	vm_size_t size;
253 
254 	SYSVSHM_ASSERT_LOCKED();
255 	segnum = IPCID_TO_IX(shmmap_s->shmid);
256 	KASSERT(segnum >= 0 && segnum < shmalloced,
257 	    ("segnum %d shmalloced %d", segnum, shmalloced));
258 
259 	shmseg = &shmsegs[segnum];
260 	size = round_page(shmseg->u.shm_segsz);
261 	result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size);
262 	if (result != KERN_SUCCESS)
263 		return (EINVAL);
264 	shmmap_s->shmid = -1;
265 	shmseg->u.shm_dtime = time_second;
266 	if ((--shmseg->u.shm_nattch <= 0) &&
267 	    (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
268 		shm_deallocate_segment(shmseg);
269 		shm_last_free = segnum;
270 	}
271 	return (0);
272 }
273 
274 static int
275 kern_shmdt_locked(struct thread *td, const void *shmaddr)
276 {
277 	struct proc *p = td->td_proc;
278 	struct shmmap_state *shmmap_s;
279 #ifdef MAC
280 	struct shmid_kernel *shmsegptr;
281 #endif
282 	int error, i;
283 
284 	SYSVSHM_ASSERT_LOCKED();
285 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
286 		return (ENOSYS);
287 	shmmap_s = p->p_vmspace->vm_shm;
288  	if (shmmap_s == NULL)
289 		return (EINVAL);
290 	for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
291 		if (shmmap_s->shmid != -1 &&
292 		    shmmap_s->va == (vm_offset_t)shmaddr) {
293 			break;
294 		}
295 	}
296 	if (i == shminfo.shmseg)
297 		return (EINVAL);
298 #ifdef MAC
299 	shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
300 	error = mac_sysvshm_check_shmdt(td->td_ucred, shmsegptr);
301 	if (error != 0)
302 		return (error);
303 #endif
304 	error = shm_delete_mapping(p->p_vmspace, shmmap_s);
305 	return (error);
306 }
307 
308 #ifndef _SYS_SYSPROTO_H_
309 struct shmdt_args {
310 	const void *shmaddr;
311 };
312 #endif
313 int
314 sys_shmdt(struct thread *td, struct shmdt_args *uap)
315 {
316 	int error;
317 
318 	SYSVSHM_LOCK();
319 	error = kern_shmdt_locked(td, uap->shmaddr);
320 	SYSVSHM_UNLOCK();
321 	return (error);
322 }
323 
324 static int
325 kern_shmat_locked(struct thread *td, int shmid, const void *shmaddr,
326     int shmflg)
327 {
328 	struct proc *p = td->td_proc;
329 	struct shmid_kernel *shmseg;
330 	struct shmmap_state *shmmap_s;
331 	vm_offset_t attach_va;
332 	vm_prot_t prot;
333 	vm_size_t size;
334 	int error, i, rv;
335 
336 	SYSVSHM_ASSERT_LOCKED();
337 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
338 		return (ENOSYS);
339 	shmmap_s = p->p_vmspace->vm_shm;
340 	if (shmmap_s == NULL) {
341 		shmmap_s = malloc(shminfo.shmseg * sizeof(struct shmmap_state),
342 		    M_SHM, M_WAITOK);
343 		for (i = 0; i < shminfo.shmseg; i++)
344 			shmmap_s[i].shmid = -1;
345 		KASSERT(p->p_vmspace->vm_shm == NULL, ("raced"));
346 		p->p_vmspace->vm_shm = shmmap_s;
347 	}
348 	shmseg = shm_find_segment(shmid, true);
349 	if (shmseg == NULL)
350 		return (EINVAL);
351 	error = ipcperm(td, &shmseg->u.shm_perm,
352 	    (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
353 	if (error != 0)
354 		return (error);
355 #ifdef MAC
356 	error = mac_sysvshm_check_shmat(td->td_ucred, shmseg, shmflg);
357 	if (error != 0)
358 		return (error);
359 #endif
360 	for (i = 0; i < shminfo.shmseg; i++) {
361 		if (shmmap_s->shmid == -1)
362 			break;
363 		shmmap_s++;
364 	}
365 	if (i >= shminfo.shmseg)
366 		return (EMFILE);
367 	size = round_page(shmseg->u.shm_segsz);
368 	prot = VM_PROT_READ;
369 	if ((shmflg & SHM_RDONLY) == 0)
370 		prot |= VM_PROT_WRITE;
371 	if (shmaddr != NULL) {
372 		if ((shmflg & SHM_RND) != 0)
373 			attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1);
374 		else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0)
375 			attach_va = (vm_offset_t)shmaddr;
376 		else
377 			return (EINVAL);
378 	} else {
379 		/*
380 		 * This is just a hint to vm_map_find() about where to
381 		 * put it.
382 		 */
383 		PROC_LOCK(p);
384 		attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr +
385 		    lim_max(p, RLIMIT_DATA));
386 		PROC_UNLOCK(p);
387 	}
388 
389 	vm_object_reference(shmseg->object);
390 	rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->object, 0, &attach_va,
391 	    size, 0, shmaddr != NULL ? VMFS_NO_SPACE : VMFS_OPTIMAL_SPACE,
392 	    prot, prot, MAP_INHERIT_SHARE | MAP_PREFAULT_PARTIAL);
393 	if (rv != KERN_SUCCESS) {
394 		vm_object_deallocate(shmseg->object);
395 		return (ENOMEM);
396 	}
397 
398 	shmmap_s->va = attach_va;
399 	shmmap_s->shmid = shmid;
400 	shmseg->u.shm_lpid = p->p_pid;
401 	shmseg->u.shm_atime = time_second;
402 	shmseg->u.shm_nattch++;
403 	td->td_retval[0] = attach_va;
404 	return (error);
405 }
406 
407 int
408 kern_shmat(struct thread *td, int shmid, const void *shmaddr, int shmflg)
409 {
410 	int error;
411 
412 	SYSVSHM_LOCK();
413 	error = kern_shmat_locked(td, shmid, shmaddr, shmflg);
414 	SYSVSHM_UNLOCK();
415 	return (error);
416 }
417 
418 #ifndef _SYS_SYSPROTO_H_
419 struct shmat_args {
420 	int shmid;
421 	const void *shmaddr;
422 	int shmflg;
423 };
424 #endif
425 int
426 sys_shmat(struct thread *td, struct shmat_args *uap)
427 {
428 
429 	return (kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg));
430 }
431 
432 static int
433 kern_shmctl_locked(struct thread *td, int shmid, int cmd, void *buf,
434     size_t *bufsz)
435 {
436 	struct shmid_kernel *shmseg;
437 	struct shmid_ds *shmidp;
438 	struct shm_info shm_info;
439 	int error;
440 
441 	SYSVSHM_ASSERT_LOCKED();
442 
443 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
444 		return (ENOSYS);
445 
446 	error = 0;
447 	switch (cmd) {
448 	/*
449 	 * It is possible that kern_shmctl is being called from the Linux ABI
450 	 * layer, in which case, we will need to implement IPC_INFO.  It should
451 	 * be noted that other shmctl calls will be funneled through here for
452 	 * Linix binaries as well.
453 	 *
454 	 * NB: The Linux ABI layer will convert this data to structure(s) more
455 	 * consistent with the Linux ABI.
456 	 */
457 	case IPC_INFO:
458 		memcpy(buf, &shminfo, sizeof(shminfo));
459 		if (bufsz)
460 			*bufsz = sizeof(shminfo);
461 		td->td_retval[0] = shmalloced;
462 		return (0);
463 	case SHM_INFO: {
464 		shm_info.used_ids = shm_nused;
465 		shm_info.shm_rss = 0;	/*XXX where to get from ? */
466 		shm_info.shm_tot = 0;	/*XXX where to get from ? */
467 		shm_info.shm_swp = 0;	/*XXX where to get from ? */
468 		shm_info.swap_attempts = 0;	/*XXX where to get from ? */
469 		shm_info.swap_successes = 0;	/*XXX where to get from ? */
470 		memcpy(buf, &shm_info, sizeof(shm_info));
471 		if (bufsz != NULL)
472 			*bufsz = sizeof(shm_info);
473 		td->td_retval[0] = shmalloced;
474 		return (0);
475 	}
476 	}
477 	shmseg = shm_find_segment(shmid, cmd != SHM_STAT);
478 	if (shmseg == NULL)
479 		return (EINVAL);
480 #ifdef MAC
481 	error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, cmd);
482 	if (error != 0)
483 		return (error);
484 #endif
485 	switch (cmd) {
486 	case SHM_STAT:
487 	case IPC_STAT:
488 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
489 		if (error != 0)
490 			return (error);
491 		memcpy(buf, &shmseg->u, sizeof(struct shmid_ds));
492 		if (bufsz != NULL)
493 			*bufsz = sizeof(struct shmid_ds);
494 		if (cmd == SHM_STAT) {
495 			td->td_retval[0] = IXSEQ_TO_IPCID(shmid,
496 			    shmseg->u.shm_perm);
497 		}
498 		break;
499 	case IPC_SET:
500 		shmidp = (struct shmid_ds *)buf;
501 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
502 		if (error != 0)
503 			return (error);
504 		shmseg->u.shm_perm.uid = shmidp->shm_perm.uid;
505 		shmseg->u.shm_perm.gid = shmidp->shm_perm.gid;
506 		shmseg->u.shm_perm.mode =
507 		    (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
508 		    (shmidp->shm_perm.mode & ACCESSPERMS);
509 		shmseg->u.shm_ctime = time_second;
510 		break;
511 	case IPC_RMID:
512 		error = ipcperm(td, &shmseg->u.shm_perm, IPC_M);
513 		if (error != 0)
514 			return (error);
515 		shmseg->u.shm_perm.key = IPC_PRIVATE;
516 		shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
517 		if (shmseg->u.shm_nattch <= 0) {
518 			shm_deallocate_segment(shmseg);
519 			shm_last_free = IPCID_TO_IX(shmid);
520 		}
521 		break;
522 #if 0
523 	case SHM_LOCK:
524 	case SHM_UNLOCK:
525 #endif
526 	default:
527 		error = EINVAL;
528 		break;
529 	}
530 	return (error);
531 }
532 
533 int
534 kern_shmctl(struct thread *td, int shmid, int cmd, void *buf, size_t *bufsz)
535 {
536 	int error;
537 
538 	SYSVSHM_LOCK();
539 	error = kern_shmctl_locked(td, shmid, cmd, buf, bufsz);
540 	SYSVSHM_UNLOCK();
541 	return (error);
542 }
543 
544 
545 #ifndef _SYS_SYSPROTO_H_
546 struct shmctl_args {
547 	int shmid;
548 	int cmd;
549 	struct shmid_ds *buf;
550 };
551 #endif
552 int
553 sys_shmctl(struct thread *td, struct shmctl_args *uap)
554 {
555 	int error = 0;
556 	struct shmid_ds buf;
557 	size_t bufsz;
558 
559 	/*
560 	 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support
561 	 * Linux binaries.  If we see the call come through the FreeBSD ABI,
562 	 * return an error back to the user since we do not to support this.
563 	 */
564 	if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO ||
565 	    uap->cmd == SHM_STAT)
566 		return (EINVAL);
567 
568 	/* IPC_SET needs to copyin the buffer before calling kern_shmctl */
569 	if (uap->cmd == IPC_SET) {
570 		if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds))))
571 			goto done;
572 	}
573 
574 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
575 	if (error)
576 		goto done;
577 
578 	/* Cases in which we need to copyout */
579 	switch (uap->cmd) {
580 	case IPC_STAT:
581 		error = copyout(&buf, uap->buf, bufsz);
582 		break;
583 	}
584 
585 done:
586 	if (error) {
587 		/* Invalidate the return value */
588 		td->td_retval[0] = -1;
589 	}
590 	return (error);
591 }
592 
593 
594 static int
595 shmget_existing(struct thread *td, struct shmget_args *uap, int mode,
596     int segnum)
597 {
598 	struct shmid_kernel *shmseg;
599 #ifdef MAC
600 	int error;
601 #endif
602 
603 	SYSVSHM_ASSERT_LOCKED();
604 	KASSERT(segnum >= 0 && segnum < shmalloced,
605 	    ("segnum %d shmalloced %d", segnum, shmalloced));
606 	shmseg = &shmsegs[segnum];
607 	if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
608 		return (EEXIST);
609 #ifdef MAC
610 	error = mac_sysvshm_check_shmget(td->td_ucred, shmseg, uap->shmflg);
611 	if (error != 0)
612 		return (error);
613 #endif
614 	if (uap->size != 0 && uap->size > shmseg->u.shm_segsz)
615 		return (EINVAL);
616 	td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
617 	return (0);
618 }
619 
620 static int
621 shmget_allocate_segment(struct thread *td, struct shmget_args *uap, int mode)
622 {
623 	struct ucred *cred = td->td_ucred;
624 	struct shmid_kernel *shmseg;
625 	vm_object_t shm_object;
626 	int i, segnum;
627 	size_t size;
628 
629 	SYSVSHM_ASSERT_LOCKED();
630 
631 	if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax)
632 		return (EINVAL);
633 	if (shm_nused >= shminfo.shmmni) /* Any shmids left? */
634 		return (ENOSPC);
635 	size = round_page(uap->size);
636 	if (shm_committed + btoc(size) > shminfo.shmall)
637 		return (ENOMEM);
638 	if (shm_last_free < 0) {
639 		shmrealloc();	/* Maybe expand the shmsegs[] array. */
640 		for (i = 0; i < shmalloced; i++)
641 			if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
642 				break;
643 		if (i == shmalloced)
644 			return (ENOSPC);
645 		segnum = i;
646 	} else  {
647 		segnum = shm_last_free;
648 		shm_last_free = -1;
649 	}
650 	KASSERT(segnum >= 0 && segnum < shmalloced,
651 	    ("segnum %d shmalloced %d", segnum, shmalloced));
652 	shmseg = &shmsegs[segnum];
653 #ifdef RACCT
654 	if (racct_enable) {
655 		PROC_LOCK(td->td_proc);
656 		if (racct_add(td->td_proc, RACCT_NSHM, 1)) {
657 			PROC_UNLOCK(td->td_proc);
658 			return (ENOSPC);
659 		}
660 		if (racct_add(td->td_proc, RACCT_SHMSIZE, size)) {
661 			racct_sub(td->td_proc, RACCT_NSHM, 1);
662 			PROC_UNLOCK(td->td_proc);
663 			return (ENOMEM);
664 		}
665 		PROC_UNLOCK(td->td_proc);
666 	}
667 #endif
668 
669 	/*
670 	 * We make sure that we have allocated a pager before we need
671 	 * to.
672 	 */
673 	shm_object = vm_pager_allocate(shm_use_phys ? OBJT_PHYS : OBJT_SWAP,
674 	    0, size, VM_PROT_DEFAULT, 0, cred);
675 	if (shm_object == NULL) {
676 #ifdef RACCT
677 		if (racct_enable) {
678 			PROC_LOCK(td->td_proc);
679 			racct_sub(td->td_proc, RACCT_NSHM, 1);
680 			racct_sub(td->td_proc, RACCT_SHMSIZE, size);
681 			PROC_UNLOCK(td->td_proc);
682 		}
683 #endif
684 		return (ENOMEM);
685 	}
686 	shm_object->pg_color = 0;
687 	VM_OBJECT_WLOCK(shm_object);
688 	vm_object_clear_flag(shm_object, OBJ_ONEMAPPING);
689 	vm_object_set_flag(shm_object, OBJ_COLORED | OBJ_NOSPLIT);
690 	VM_OBJECT_WUNLOCK(shm_object);
691 
692 	shmseg->object = shm_object;
693 	shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid;
694 	shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid;
695 	shmseg->u.shm_perm.mode = (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
696 	shmseg->u.shm_perm.key = uap->key;
697 	shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff;
698 	shmseg->cred = crhold(cred);
699 	shmseg->u.shm_segsz = uap->size;
700 	shmseg->u.shm_cpid = td->td_proc->p_pid;
701 	shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
702 	shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
703 #ifdef MAC
704 	mac_sysvshm_create(cred, shmseg);
705 #endif
706 	shmseg->u.shm_ctime = time_second;
707 	shm_committed += btoc(size);
708 	shm_nused++;
709 	td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
710 
711 	return (0);
712 }
713 
714 #ifndef _SYS_SYSPROTO_H_
715 struct shmget_args {
716 	key_t key;
717 	size_t size;
718 	int shmflg;
719 };
720 #endif
721 int
722 sys_shmget(struct thread *td, struct shmget_args *uap)
723 {
724 	int segnum, mode;
725 	int error;
726 
727 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
728 		return (ENOSYS);
729 	mode = uap->shmflg & ACCESSPERMS;
730 	SYSVSHM_LOCK();
731 	if (uap->key == IPC_PRIVATE) {
732 		error = shmget_allocate_segment(td, uap, mode);
733 	} else {
734 		segnum = shm_find_segment_by_key(uap->key);
735 		if (segnum >= 0)
736 			error = shmget_existing(td, uap, mode, segnum);
737 		else if ((uap->shmflg & IPC_CREAT) == 0)
738 			error = ENOENT;
739 		else
740 			error = shmget_allocate_segment(td, uap, mode);
741 	}
742 	SYSVSHM_UNLOCK();
743 	return (error);
744 }
745 
746 static void
747 shmfork_myhook(struct proc *p1, struct proc *p2)
748 {
749 	struct shmmap_state *shmmap_s;
750 	size_t size;
751 	int i;
752 
753 	SYSVSHM_LOCK();
754 	size = shminfo.shmseg * sizeof(struct shmmap_state);
755 	shmmap_s = malloc(size, M_SHM, M_WAITOK);
756 	bcopy(p1->p_vmspace->vm_shm, shmmap_s, size);
757 	p2->p_vmspace->vm_shm = shmmap_s;
758 	for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) {
759 		if (shmmap_s->shmid != -1) {
760 			KASSERT(IPCID_TO_IX(shmmap_s->shmid) >= 0 &&
761 			    IPCID_TO_IX(shmmap_s->shmid) < shmalloced,
762 			    ("segnum %d shmalloced %d",
763 			    IPCID_TO_IX(shmmap_s->shmid), shmalloced));
764 			shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
765 		}
766 	}
767 	SYSVSHM_UNLOCK();
768 }
769 
770 static void
771 shmexit_myhook(struct vmspace *vm)
772 {
773 	struct shmmap_state *base, *shm;
774 	int i;
775 
776 	base = vm->vm_shm;
777 	if (base != NULL) {
778 		vm->vm_shm = NULL;
779 		SYSVSHM_LOCK();
780 		for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) {
781 			if (shm->shmid != -1)
782 				shm_delete_mapping(vm, shm);
783 		}
784 		SYSVSHM_UNLOCK();
785 		free(base, M_SHM);
786 	}
787 }
788 
789 static void
790 shmrealloc(void)
791 {
792 	struct shmid_kernel *newsegs;
793 	int i;
794 
795 	SYSVSHM_ASSERT_LOCKED();
796 
797 	if (shmalloced >= shminfo.shmmni)
798 		return;
799 
800 	newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK);
801 	for (i = 0; i < shmalloced; i++)
802 		bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0]));
803 	for (; i < shminfo.shmmni; i++) {
804 		shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
805 		shmsegs[i].u.shm_perm.seq = 0;
806 #ifdef MAC
807 		mac_sysvshm_init(&shmsegs[i]);
808 #endif
809 	}
810 	free(shmsegs, M_SHM);
811 	shmsegs = newsegs;
812 	shmalloced = shminfo.shmmni;
813 }
814 
815 static struct syscall_helper_data shm_syscalls[] = {
816 	SYSCALL_INIT_HELPER(shmat),
817 	SYSCALL_INIT_HELPER(shmctl),
818 	SYSCALL_INIT_HELPER(shmdt),
819 	SYSCALL_INIT_HELPER(shmget),
820 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
821     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
822 	SYSCALL_INIT_HELPER_COMPAT(freebsd7_shmctl),
823 #endif
824 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
825 	SYSCALL_INIT_HELPER(shmsys),
826 #endif
827 	SYSCALL_INIT_LAST
828 };
829 
830 #ifdef COMPAT_FREEBSD32
831 #include <compat/freebsd32/freebsd32.h>
832 #include <compat/freebsd32/freebsd32_ipc.h>
833 #include <compat/freebsd32/freebsd32_proto.h>
834 #include <compat/freebsd32/freebsd32_signal.h>
835 #include <compat/freebsd32/freebsd32_syscall.h>
836 #include <compat/freebsd32/freebsd32_util.h>
837 
838 static struct syscall_helper_data shm32_syscalls[] = {
839 	SYSCALL32_INIT_HELPER_COMPAT(shmat),
840 	SYSCALL32_INIT_HELPER_COMPAT(shmdt),
841 	SYSCALL32_INIT_HELPER_COMPAT(shmget),
842 	SYSCALL32_INIT_HELPER(freebsd32_shmsys),
843 	SYSCALL32_INIT_HELPER(freebsd32_shmctl),
844 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
845     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
846 	SYSCALL32_INIT_HELPER(freebsd7_freebsd32_shmctl),
847 #endif
848 	SYSCALL_INIT_LAST
849 };
850 #endif
851 
852 static int
853 shminit(void)
854 {
855 	int i, error;
856 
857 #ifndef BURN_BRIDGES
858 	if (TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall) != 0)
859 		printf("kern.ipc.shmmaxpgs is now called kern.ipc.shmall!\n");
860 #endif
861 	if (shminfo.shmmax == SHMMAX) {
862 		/* Initialize shmmax dealing with possible overflow. */
863 		for (i = PAGE_SIZE; i != 0; i--) {
864 			shminfo.shmmax = shminfo.shmall * i;
865 			if ((shminfo.shmmax / shminfo.shmall) == (u_long)i)
866 				break;
867 		}
868 	}
869 	shmalloced = shminfo.shmmni;
870 	shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK);
871 	for (i = 0; i < shmalloced; i++) {
872 		shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
873 		shmsegs[i].u.shm_perm.seq = 0;
874 #ifdef MAC
875 		mac_sysvshm_init(&shmsegs[i]);
876 #endif
877 	}
878 	shm_last_free = 0;
879 	shm_nused = 0;
880 	shm_committed = 0;
881 	sx_init(&sysvshmsx, "sysvshmsx");
882 	shmexit_hook = &shmexit_myhook;
883 	shmfork_hook = &shmfork_myhook;
884 
885 	error = syscall_helper_register(shm_syscalls, SY_THR_STATIC_KLD);
886 	if (error != 0)
887 		return (error);
888 #ifdef COMPAT_FREEBSD32
889 	error = syscall32_helper_register(shm32_syscalls, SY_THR_STATIC_KLD);
890 	if (error != 0)
891 		return (error);
892 #endif
893 	return (0);
894 }
895 
896 static int
897 shmunload(void)
898 {
899 	int i;
900 
901 	if (shm_nused > 0)
902 		return (EBUSY);
903 
904 #ifdef COMPAT_FREEBSD32
905 	syscall32_helper_unregister(shm32_syscalls);
906 #endif
907 	syscall_helper_unregister(shm_syscalls);
908 
909 	for (i = 0; i < shmalloced; i++) {
910 #ifdef MAC
911 		mac_sysvshm_destroy(&shmsegs[i]);
912 #endif
913 		/*
914 		 * Objects might be still mapped into the processes
915 		 * address spaces.  Actual free would happen on the
916 		 * last mapping destruction.
917 		 */
918 		if (shmsegs[i].u.shm_perm.mode != SHMSEG_FREE)
919 			vm_object_deallocate(shmsegs[i].object);
920 	}
921 	free(shmsegs, M_SHM);
922 	shmexit_hook = NULL;
923 	shmfork_hook = NULL;
924 	sx_destroy(&sysvshmsx);
925 	return (0);
926 }
927 
928 static int
929 sysctl_shmsegs(SYSCTL_HANDLER_ARGS)
930 {
931 	int error;
932 
933 	SYSVSHM_LOCK();
934 	error = SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0]));
935 	SYSVSHM_UNLOCK();
936 	return (error);
937 }
938 
939 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43))
940 struct oshmid_ds {
941 	struct	ipc_perm_old shm_perm;	/* operation perms */
942 	int	shm_segsz;		/* size of segment (bytes) */
943 	u_short	shm_cpid;		/* pid, creator */
944 	u_short	shm_lpid;		/* pid, last operation */
945 	short	shm_nattch;		/* no. of current attaches */
946 	time_t	shm_atime;		/* last attach time */
947 	time_t	shm_dtime;		/* last detach time */
948 	time_t	shm_ctime;		/* last change time */
949 	void	*shm_handle;		/* internal handle for shm segment */
950 };
951 
952 struct oshmctl_args {
953 	int shmid;
954 	int cmd;
955 	struct oshmid_ds *ubuf;
956 };
957 
958 static int
959 oshmctl(struct thread *td, struct oshmctl_args *uap)
960 {
961 #ifdef COMPAT_43
962 	int error = 0;
963 	struct shmid_kernel *shmseg;
964 	struct oshmid_ds outbuf;
965 
966 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
967 		return (ENOSYS);
968 	if (uap->cmd != IPC_STAT) {
969 		return (freebsd7_shmctl(td,
970 		    (struct freebsd7_shmctl_args *)uap));
971 	}
972 	SYSVSHM_LOCK();
973 	shmseg = shm_find_segment(uap->shmid, true);
974 	if (shmseg == NULL) {
975 		SYSVSHM_UNLOCK();
976 		return (EINVAL);
977 	}
978 	error = ipcperm(td, &shmseg->u.shm_perm, IPC_R);
979 	if (error != 0) {
980 		SYSVSHM_UNLOCK();
981 		return (error);
982 	}
983 #ifdef MAC
984 	error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, uap->cmd);
985 	if (error != 0) {
986 		SYSVSHM_UNLOCK();
987 		return (error);
988 	}
989 #endif
990 	ipcperm_new2old(&shmseg->u.shm_perm, &outbuf.shm_perm);
991 	outbuf.shm_segsz = shmseg->u.shm_segsz;
992 	outbuf.shm_cpid = shmseg->u.shm_cpid;
993 	outbuf.shm_lpid = shmseg->u.shm_lpid;
994 	outbuf.shm_nattch = shmseg->u.shm_nattch;
995 	outbuf.shm_atime = shmseg->u.shm_atime;
996 	outbuf.shm_dtime = shmseg->u.shm_dtime;
997 	outbuf.shm_ctime = shmseg->u.shm_ctime;
998 	outbuf.shm_handle = shmseg->object;
999 	SYSVSHM_UNLOCK();
1000 	error = copyout(&outbuf, uap->ubuf, sizeof(outbuf));
1001 	return (error);
1002 #else
1003 	return (EINVAL);
1004 #endif
1005 }
1006 
1007 /* XXX casting to (sy_call_t *) is bogus, as usual. */
1008 static sy_call_t *shmcalls[] = {
1009 	(sy_call_t *)sys_shmat, (sy_call_t *)oshmctl,
1010 	(sy_call_t *)sys_shmdt, (sy_call_t *)sys_shmget,
1011 	(sy_call_t *)freebsd7_shmctl
1012 };
1013 
1014 #ifndef _SYS_SYSPROTO_H_
1015 /* XXX actually varargs. */
1016 struct shmsys_args {
1017 	int	which;
1018 	int	a2;
1019 	int	a3;
1020 	int	a4;
1021 };
1022 #endif
1023 int
1024 sys_shmsys(struct thread *td, struct shmsys_args *uap)
1025 {
1026 	int error;
1027 
1028 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
1029 		return (ENOSYS);
1030 	if (uap->which < 0 || uap->which >= nitems(shmcalls))
1031 		return (EINVAL);
1032 	error = (*shmcalls[uap->which])(td, &uap->a2);
1033 	return (error);
1034 }
1035 
1036 #endif	/* i386 && (COMPAT_FREEBSD4 || COMPAT_43) */
1037 
1038 #ifdef COMPAT_FREEBSD32
1039 
1040 int
1041 freebsd32_shmsys(struct thread *td, struct freebsd32_shmsys_args *uap)
1042 {
1043 
1044 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1045     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1046 	switch (uap->which) {
1047 	case 0:	{	/* shmat */
1048 		struct shmat_args ap;
1049 
1050 		ap.shmid = uap->a2;
1051 		ap.shmaddr = PTRIN(uap->a3);
1052 		ap.shmflg = uap->a4;
1053 		return (sysent[SYS_shmat].sy_call(td, &ap));
1054 	}
1055 	case 2: {	/* shmdt */
1056 		struct shmdt_args ap;
1057 
1058 		ap.shmaddr = PTRIN(uap->a2);
1059 		return (sysent[SYS_shmdt].sy_call(td, &ap));
1060 	}
1061 	case 3: {	/* shmget */
1062 		struct shmget_args ap;
1063 
1064 		ap.key = uap->a2;
1065 		ap.size = uap->a3;
1066 		ap.shmflg = uap->a4;
1067 		return (sysent[SYS_shmget].sy_call(td, &ap));
1068 	}
1069 	case 4: {	/* shmctl */
1070 		struct freebsd7_freebsd32_shmctl_args ap;
1071 
1072 		ap.shmid = uap->a2;
1073 		ap.cmd = uap->a3;
1074 		ap.buf = PTRIN(uap->a4);
1075 		return (freebsd7_freebsd32_shmctl(td, &ap));
1076 	}
1077 	case 1:		/* oshmctl */
1078 	default:
1079 		return (EINVAL);
1080 	}
1081 #else
1082 	return (nosys(td, NULL));
1083 #endif
1084 }
1085 
1086 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1087     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1088 int
1089 freebsd7_freebsd32_shmctl(struct thread *td,
1090     struct freebsd7_freebsd32_shmctl_args *uap)
1091 {
1092 	int error = 0;
1093 	union {
1094 		struct shmid_ds shmid_ds;
1095 		struct shm_info shm_info;
1096 		struct shminfo shminfo;
1097 	} u;
1098 	union {
1099 		struct shmid_ds32_old shmid_ds32;
1100 		struct shm_info32 shm_info32;
1101 		struct shminfo32 shminfo32;
1102 	} u32;
1103 	size_t sz;
1104 
1105 	if (uap->cmd == IPC_SET) {
1106 		if ((error = copyin(uap->buf, &u32.shmid_ds32,
1107 		    sizeof(u32.shmid_ds32))))
1108 			goto done;
1109 		freebsd32_ipcperm_old_in(&u32.shmid_ds32.shm_perm,
1110 		    &u.shmid_ds.shm_perm);
1111 		CP(u32.shmid_ds32, u.shmid_ds, shm_segsz);
1112 		CP(u32.shmid_ds32, u.shmid_ds, shm_lpid);
1113 		CP(u32.shmid_ds32, u.shmid_ds, shm_cpid);
1114 		CP(u32.shmid_ds32, u.shmid_ds, shm_nattch);
1115 		CP(u32.shmid_ds32, u.shmid_ds, shm_atime);
1116 		CP(u32.shmid_ds32, u.shmid_ds, shm_dtime);
1117 		CP(u32.shmid_ds32, u.shmid_ds, shm_ctime);
1118 	}
1119 
1120 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz);
1121 	if (error)
1122 		goto done;
1123 
1124 	/* Cases in which we need to copyout */
1125 	switch (uap->cmd) {
1126 	case IPC_INFO:
1127 		CP(u.shminfo, u32.shminfo32, shmmax);
1128 		CP(u.shminfo, u32.shminfo32, shmmin);
1129 		CP(u.shminfo, u32.shminfo32, shmmni);
1130 		CP(u.shminfo, u32.shminfo32, shmseg);
1131 		CP(u.shminfo, u32.shminfo32, shmall);
1132 		error = copyout(&u32.shminfo32, uap->buf,
1133 		    sizeof(u32.shminfo32));
1134 		break;
1135 	case SHM_INFO:
1136 		CP(u.shm_info, u32.shm_info32, used_ids);
1137 		CP(u.shm_info, u32.shm_info32, shm_rss);
1138 		CP(u.shm_info, u32.shm_info32, shm_tot);
1139 		CP(u.shm_info, u32.shm_info32, shm_swp);
1140 		CP(u.shm_info, u32.shm_info32, swap_attempts);
1141 		CP(u.shm_info, u32.shm_info32, swap_successes);
1142 		error = copyout(&u32.shm_info32, uap->buf,
1143 		    sizeof(u32.shm_info32));
1144 		break;
1145 	case SHM_STAT:
1146 	case IPC_STAT:
1147 		freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm,
1148 		    &u32.shmid_ds32.shm_perm);
1149 		if (u.shmid_ds.shm_segsz > INT32_MAX)
1150 			u32.shmid_ds32.shm_segsz = INT32_MAX;
1151 		else
1152 			CP(u.shmid_ds, u32.shmid_ds32, shm_segsz);
1153 		CP(u.shmid_ds, u32.shmid_ds32, shm_lpid);
1154 		CP(u.shmid_ds, u32.shmid_ds32, shm_cpid);
1155 		CP(u.shmid_ds, u32.shmid_ds32, shm_nattch);
1156 		CP(u.shmid_ds, u32.shmid_ds32, shm_atime);
1157 		CP(u.shmid_ds, u32.shmid_ds32, shm_dtime);
1158 		CP(u.shmid_ds, u32.shmid_ds32, shm_ctime);
1159 		u32.shmid_ds32.shm_internal = 0;
1160 		error = copyout(&u32.shmid_ds32, uap->buf,
1161 		    sizeof(u32.shmid_ds32));
1162 		break;
1163 	}
1164 
1165 done:
1166 	if (error) {
1167 		/* Invalidate the return value */
1168 		td->td_retval[0] = -1;
1169 	}
1170 	return (error);
1171 }
1172 #endif
1173 
1174 int
1175 freebsd32_shmctl(struct thread *td, struct freebsd32_shmctl_args *uap)
1176 {
1177 	int error = 0;
1178 	union {
1179 		struct shmid_ds shmid_ds;
1180 		struct shm_info shm_info;
1181 		struct shminfo shminfo;
1182 	} u;
1183 	union {
1184 		struct shmid_ds32 shmid_ds32;
1185 		struct shm_info32 shm_info32;
1186 		struct shminfo32 shminfo32;
1187 	} u32;
1188 	size_t sz;
1189 
1190 	if (uap->cmd == IPC_SET) {
1191 		if ((error = copyin(uap->buf, &u32.shmid_ds32,
1192 		    sizeof(u32.shmid_ds32))))
1193 			goto done;
1194 		freebsd32_ipcperm_in(&u32.shmid_ds32.shm_perm,
1195 		    &u.shmid_ds.shm_perm);
1196 		CP(u32.shmid_ds32, u.shmid_ds, shm_segsz);
1197 		CP(u32.shmid_ds32, u.shmid_ds, shm_lpid);
1198 		CP(u32.shmid_ds32, u.shmid_ds, shm_cpid);
1199 		CP(u32.shmid_ds32, u.shmid_ds, shm_nattch);
1200 		CP(u32.shmid_ds32, u.shmid_ds, shm_atime);
1201 		CP(u32.shmid_ds32, u.shmid_ds, shm_dtime);
1202 		CP(u32.shmid_ds32, u.shmid_ds, shm_ctime);
1203 	}
1204 
1205 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz);
1206 	if (error)
1207 		goto done;
1208 
1209 	/* Cases in which we need to copyout */
1210 	switch (uap->cmd) {
1211 	case IPC_INFO:
1212 		CP(u.shminfo, u32.shminfo32, shmmax);
1213 		CP(u.shminfo, u32.shminfo32, shmmin);
1214 		CP(u.shminfo, u32.shminfo32, shmmni);
1215 		CP(u.shminfo, u32.shminfo32, shmseg);
1216 		CP(u.shminfo, u32.shminfo32, shmall);
1217 		error = copyout(&u32.shminfo32, uap->buf,
1218 		    sizeof(u32.shminfo32));
1219 		break;
1220 	case SHM_INFO:
1221 		CP(u.shm_info, u32.shm_info32, used_ids);
1222 		CP(u.shm_info, u32.shm_info32, shm_rss);
1223 		CP(u.shm_info, u32.shm_info32, shm_tot);
1224 		CP(u.shm_info, u32.shm_info32, shm_swp);
1225 		CP(u.shm_info, u32.shm_info32, swap_attempts);
1226 		CP(u.shm_info, u32.shm_info32, swap_successes);
1227 		error = copyout(&u32.shm_info32, uap->buf,
1228 		    sizeof(u32.shm_info32));
1229 		break;
1230 	case SHM_STAT:
1231 	case IPC_STAT:
1232 		freebsd32_ipcperm_out(&u.shmid_ds.shm_perm,
1233 		    &u32.shmid_ds32.shm_perm);
1234 		if (u.shmid_ds.shm_segsz > INT32_MAX)
1235 			u32.shmid_ds32.shm_segsz = INT32_MAX;
1236 		else
1237 			CP(u.shmid_ds, u32.shmid_ds32, shm_segsz);
1238 		CP(u.shmid_ds, u32.shmid_ds32, shm_lpid);
1239 		CP(u.shmid_ds, u32.shmid_ds32, shm_cpid);
1240 		CP(u.shmid_ds, u32.shmid_ds32, shm_nattch);
1241 		CP(u.shmid_ds, u32.shmid_ds32, shm_atime);
1242 		CP(u.shmid_ds, u32.shmid_ds32, shm_dtime);
1243 		CP(u.shmid_ds, u32.shmid_ds32, shm_ctime);
1244 		error = copyout(&u32.shmid_ds32, uap->buf,
1245 		    sizeof(u32.shmid_ds32));
1246 		break;
1247 	}
1248 
1249 done:
1250 	if (error) {
1251 		/* Invalidate the return value */
1252 		td->td_retval[0] = -1;
1253 	}
1254 	return (error);
1255 }
1256 #endif
1257 
1258 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1259     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1260 
1261 #ifndef CP
1262 #define CP(src, dst, fld)	do { (dst).fld = (src).fld; } while (0)
1263 #endif
1264 
1265 #ifndef _SYS_SYSPROTO_H_
1266 struct freebsd7_shmctl_args {
1267 	int shmid;
1268 	int cmd;
1269 	struct shmid_ds_old *buf;
1270 };
1271 #endif
1272 int
1273 freebsd7_shmctl(struct thread *td, struct freebsd7_shmctl_args *uap)
1274 {
1275 	int error = 0;
1276 	struct shmid_ds_old old;
1277 	struct shmid_ds buf;
1278 	size_t bufsz;
1279 
1280 	/*
1281 	 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support
1282 	 * Linux binaries.  If we see the call come through the FreeBSD ABI,
1283 	 * return an error back to the user since we do not to support this.
1284 	 */
1285 	if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO ||
1286 	    uap->cmd == SHM_STAT)
1287 		return (EINVAL);
1288 
1289 	/* IPC_SET needs to copyin the buffer before calling kern_shmctl */
1290 	if (uap->cmd == IPC_SET) {
1291 		if ((error = copyin(uap->buf, &old, sizeof(old))))
1292 			goto done;
1293 		ipcperm_old2new(&old.shm_perm, &buf.shm_perm);
1294 		CP(old, buf, shm_segsz);
1295 		CP(old, buf, shm_lpid);
1296 		CP(old, buf, shm_cpid);
1297 		CP(old, buf, shm_nattch);
1298 		CP(old, buf, shm_atime);
1299 		CP(old, buf, shm_dtime);
1300 		CP(old, buf, shm_ctime);
1301 	}
1302 
1303 	error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz);
1304 	if (error)
1305 		goto done;
1306 
1307 	/* Cases in which we need to copyout */
1308 	switch (uap->cmd) {
1309 	case IPC_STAT:
1310 		ipcperm_new2old(&buf.shm_perm, &old.shm_perm);
1311 		if (buf.shm_segsz > INT_MAX)
1312 			old.shm_segsz = INT_MAX;
1313 		else
1314 			CP(buf, old, shm_segsz);
1315 		CP(buf, old, shm_lpid);
1316 		CP(buf, old, shm_cpid);
1317 		if (buf.shm_nattch > SHRT_MAX)
1318 			old.shm_nattch = SHRT_MAX;
1319 		else
1320 			CP(buf, old, shm_nattch);
1321 		CP(buf, old, shm_atime);
1322 		CP(buf, old, shm_dtime);
1323 		CP(buf, old, shm_ctime);
1324 		old.shm_internal = NULL;
1325 		error = copyout(&old, uap->buf, sizeof(old));
1326 		break;
1327 	}
1328 
1329 done:
1330 	if (error) {
1331 		/* Invalidate the return value */
1332 		td->td_retval[0] = -1;
1333 	}
1334 	return (error);
1335 }
1336 
1337 #endif	/* COMPAT_FREEBSD4 || COMPAT_FREEBSD5 || COMPAT_FREEBSD6 ||
1338 	   COMPAT_FREEBSD7 */
1339 
1340 static int
1341 sysvshm_modload(struct module *module, int cmd, void *arg)
1342 {
1343 	int error = 0;
1344 
1345 	switch (cmd) {
1346 	case MOD_LOAD:
1347 		error = shminit();
1348 		if (error != 0)
1349 			shmunload();
1350 		break;
1351 	case MOD_UNLOAD:
1352 		error = shmunload();
1353 		break;
1354 	case MOD_SHUTDOWN:
1355 		break;
1356 	default:
1357 		error = EINVAL;
1358 		break;
1359 	}
1360 	return (error);
1361 }
1362 
1363 static moduledata_t sysvshm_mod = {
1364 	"sysvshm",
1365 	&sysvshm_modload,
1366 	NULL
1367 };
1368 
1369 DECLARE_MODULE(sysvshm, sysvshm_mod, SI_SUB_SYSV_SHM, SI_ORDER_FIRST);
1370 MODULE_VERSION(sysvshm, 1);
1371