1 /* $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $ */ 2 /*- 3 * Copyright (c) 1994 Adam Glass and Charles Hannum. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by Adam Glass and Charles 16 * Hannum. 17 * 4. The names of the authors may not be used to endorse or promote products 18 * derived from this software without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 21 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 22 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 23 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 25 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 26 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 27 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 28 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 29 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 */ 31 /*- 32 * Copyright (c) 2003-2005 McAfee, Inc. 33 * All rights reserved. 34 * 35 * This software was developed for the FreeBSD Project in part by McAfee 36 * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR 37 * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 38 * program. 39 * 40 * Redistribution and use in source and binary forms, with or without 41 * modification, are permitted provided that the following conditions 42 * are met: 43 * 1. Redistributions of source code must retain the above copyright 44 * notice, this list of conditions and the following disclaimer. 45 * 2. Redistributions in binary form must reproduce the above copyright 46 * notice, this list of conditions and the following disclaimer in the 47 * documentation and/or other materials provided with the distribution. 48 * 49 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 52 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 59 * SUCH DAMAGE. 60 */ 61 62 #include <sys/cdefs.h> 63 __FBSDID("$FreeBSD$"); 64 65 #include "opt_compat.h" 66 #include "opt_sysvipc.h" 67 68 #include <sys/param.h> 69 #include <sys/systm.h> 70 #include <sys/kernel.h> 71 #include <sys/limits.h> 72 #include <sys/lock.h> 73 #include <sys/sysctl.h> 74 #include <sys/shm.h> 75 #include <sys/proc.h> 76 #include <sys/malloc.h> 77 #include <sys/mman.h> 78 #include <sys/module.h> 79 #include <sys/mutex.h> 80 #include <sys/racct.h> 81 #include <sys/resourcevar.h> 82 #include <sys/rwlock.h> 83 #include <sys/stat.h> 84 #include <sys/syscall.h> 85 #include <sys/syscallsubr.h> 86 #include <sys/sysent.h> 87 #include <sys/sysproto.h> 88 #include <sys/jail.h> 89 90 #include <security/mac/mac_framework.h> 91 92 #include <vm/vm.h> 93 #include <vm/vm_param.h> 94 #include <vm/pmap.h> 95 #include <vm/vm_object.h> 96 #include <vm/vm_map.h> 97 #include <vm/vm_page.h> 98 #include <vm/vm_pager.h> 99 100 FEATURE(sysv_shm, "System V shared memory segments support"); 101 102 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments"); 103 104 static int shmget_allocate_segment(struct thread *td, 105 struct shmget_args *uap, int mode); 106 static int shmget_existing(struct thread *td, struct shmget_args *uap, 107 int mode, int segnum); 108 109 #define SHMSEG_FREE 0x0200 110 #define SHMSEG_REMOVED 0x0400 111 #define SHMSEG_ALLOCATED 0x0800 112 113 static int shm_last_free, shm_nused, shmalloced; 114 vm_size_t shm_committed; 115 static struct shmid_kernel *shmsegs; 116 117 struct shmmap_state { 118 vm_offset_t va; 119 int shmid; 120 }; 121 122 static void shm_deallocate_segment(struct shmid_kernel *); 123 static int shm_find_segment_by_key(key_t); 124 static struct shmid_kernel *shm_find_segment(int, bool); 125 static int shm_delete_mapping(struct vmspace *vm, struct shmmap_state *); 126 static void shmrealloc(void); 127 static int shminit(void); 128 static int sysvshm_modload(struct module *, int, void *); 129 static int shmunload(void); 130 static void shmexit_myhook(struct vmspace *vm); 131 static void shmfork_myhook(struct proc *p1, struct proc *p2); 132 static int sysctl_shmsegs(SYSCTL_HANDLER_ARGS); 133 134 /* 135 * Tuneable values. 136 */ 137 #ifndef SHMMAXPGS 138 #define SHMMAXPGS 131072 /* Note: sysv shared memory is swap backed. */ 139 #endif 140 #ifndef SHMMAX 141 #define SHMMAX (SHMMAXPGS*PAGE_SIZE) 142 #endif 143 #ifndef SHMMIN 144 #define SHMMIN 1 145 #endif 146 #ifndef SHMMNI 147 #define SHMMNI 192 148 #endif 149 #ifndef SHMSEG 150 #define SHMSEG 128 151 #endif 152 #ifndef SHMALL 153 #define SHMALL (SHMMAXPGS) 154 #endif 155 156 struct shminfo shminfo = { 157 .shmmax = SHMMAX, 158 .shmmin = SHMMIN, 159 .shmmni = SHMMNI, 160 .shmseg = SHMSEG, 161 .shmall = SHMALL 162 }; 163 164 static int shm_use_phys; 165 static int shm_allow_removed; 166 167 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmax, CTLFLAG_RWTUN, &shminfo.shmmax, 0, 168 "Maximum shared memory segment size"); 169 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmin, CTLFLAG_RWTUN, &shminfo.shmmin, 0, 170 "Minimum shared memory segment size"); 171 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmmni, CTLFLAG_RDTUN, &shminfo.shmmni, 0, 172 "Number of shared memory identifiers"); 173 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmseg, CTLFLAG_RDTUN, &shminfo.shmseg, 0, 174 "Number of segments per process"); 175 SYSCTL_ULONG(_kern_ipc, OID_AUTO, shmall, CTLFLAG_RWTUN, &shminfo.shmall, 0, 176 "Maximum number of pages available for shared memory"); 177 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_use_phys, CTLFLAG_RWTUN, 178 &shm_use_phys, 0, "Enable/Disable locking of shared memory pages in core"); 179 SYSCTL_INT(_kern_ipc, OID_AUTO, shm_allow_removed, CTLFLAG_RWTUN, 180 &shm_allow_removed, 0, 181 "Enable/Disable attachment to attached segments marked for removal"); 182 SYSCTL_PROC(_kern_ipc, OID_AUTO, shmsegs, CTLTYPE_OPAQUE | CTLFLAG_RD | 183 CTLFLAG_MPSAFE, NULL, 0, sysctl_shmsegs, "", 184 "Current number of shared memory segments allocated"); 185 186 static struct sx sysvshmsx; 187 #define SYSVSHM_LOCK() sx_xlock(&sysvshmsx) 188 #define SYSVSHM_UNLOCK() sx_xunlock(&sysvshmsx) 189 #define SYSVSHM_ASSERT_LOCKED() sx_assert(&sysvshmsx, SA_XLOCKED) 190 191 static int 192 shm_find_segment_by_key(key_t key) 193 { 194 int i; 195 196 for (i = 0; i < shmalloced; i++) 197 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) && 198 shmsegs[i].u.shm_perm.key == key) 199 return (i); 200 return (-1); 201 } 202 203 /* 204 * Finds segment either by shmid if is_shmid is true, or by segnum if 205 * is_shmid is false. 206 */ 207 static struct shmid_kernel * 208 shm_find_segment(int arg, bool is_shmid) 209 { 210 struct shmid_kernel *shmseg; 211 int segnum; 212 213 segnum = is_shmid ? IPCID_TO_IX(arg) : arg; 214 if (segnum < 0 || segnum >= shmalloced) 215 return (NULL); 216 shmseg = &shmsegs[segnum]; 217 if ((shmseg->u.shm_perm.mode & SHMSEG_ALLOCATED) == 0 || 218 (!shm_allow_removed && 219 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) != 0) || 220 (is_shmid && shmseg->u.shm_perm.seq != IPCID_TO_SEQ(arg))) 221 return (NULL); 222 return (shmseg); 223 } 224 225 static void 226 shm_deallocate_segment(struct shmid_kernel *shmseg) 227 { 228 vm_size_t size; 229 230 SYSVSHM_ASSERT_LOCKED(); 231 232 vm_object_deallocate(shmseg->object); 233 shmseg->object = NULL; 234 size = round_page(shmseg->u.shm_segsz); 235 shm_committed -= btoc(size); 236 shm_nused--; 237 shmseg->u.shm_perm.mode = SHMSEG_FREE; 238 #ifdef MAC 239 mac_sysvshm_cleanup(shmseg); 240 #endif 241 racct_sub_cred(shmseg->cred, RACCT_NSHM, 1); 242 racct_sub_cred(shmseg->cred, RACCT_SHMSIZE, size); 243 crfree(shmseg->cred); 244 shmseg->cred = NULL; 245 } 246 247 static int 248 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s) 249 { 250 struct shmid_kernel *shmseg; 251 int segnum, result; 252 vm_size_t size; 253 254 SYSVSHM_ASSERT_LOCKED(); 255 segnum = IPCID_TO_IX(shmmap_s->shmid); 256 KASSERT(segnum >= 0 && segnum < shmalloced, 257 ("segnum %d shmalloced %d", segnum, shmalloced)); 258 259 shmseg = &shmsegs[segnum]; 260 size = round_page(shmseg->u.shm_segsz); 261 result = vm_map_remove(&vm->vm_map, shmmap_s->va, shmmap_s->va + size); 262 if (result != KERN_SUCCESS) 263 return (EINVAL); 264 shmmap_s->shmid = -1; 265 shmseg->u.shm_dtime = time_second; 266 if ((--shmseg->u.shm_nattch <= 0) && 267 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) { 268 shm_deallocate_segment(shmseg); 269 shm_last_free = segnum; 270 } 271 return (0); 272 } 273 274 static int 275 kern_shmdt_locked(struct thread *td, const void *shmaddr) 276 { 277 struct proc *p = td->td_proc; 278 struct shmmap_state *shmmap_s; 279 #ifdef MAC 280 struct shmid_kernel *shmsegptr; 281 int error; 282 #endif 283 int i; 284 285 SYSVSHM_ASSERT_LOCKED(); 286 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 287 return (ENOSYS); 288 shmmap_s = p->p_vmspace->vm_shm; 289 if (shmmap_s == NULL) 290 return (EINVAL); 291 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) { 292 if (shmmap_s->shmid != -1 && 293 shmmap_s->va == (vm_offset_t)shmaddr) { 294 break; 295 } 296 } 297 if (i == shminfo.shmseg) 298 return (EINVAL); 299 #ifdef MAC 300 shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)]; 301 error = mac_sysvshm_check_shmdt(td->td_ucred, shmsegptr); 302 if (error != 0) 303 return (error); 304 #endif 305 return (shm_delete_mapping(p->p_vmspace, shmmap_s)); 306 } 307 308 #ifndef _SYS_SYSPROTO_H_ 309 struct shmdt_args { 310 const void *shmaddr; 311 }; 312 #endif 313 int 314 sys_shmdt(struct thread *td, struct shmdt_args *uap) 315 { 316 int error; 317 318 SYSVSHM_LOCK(); 319 error = kern_shmdt_locked(td, uap->shmaddr); 320 SYSVSHM_UNLOCK(); 321 return (error); 322 } 323 324 static int 325 kern_shmat_locked(struct thread *td, int shmid, const void *shmaddr, 326 int shmflg) 327 { 328 struct proc *p = td->td_proc; 329 struct shmid_kernel *shmseg; 330 struct shmmap_state *shmmap_s; 331 vm_offset_t attach_va; 332 vm_prot_t prot; 333 vm_size_t size; 334 int error, i, rv; 335 336 SYSVSHM_ASSERT_LOCKED(); 337 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 338 return (ENOSYS); 339 shmmap_s = p->p_vmspace->vm_shm; 340 if (shmmap_s == NULL) { 341 shmmap_s = malloc(shminfo.shmseg * sizeof(struct shmmap_state), 342 M_SHM, M_WAITOK); 343 for (i = 0; i < shminfo.shmseg; i++) 344 shmmap_s[i].shmid = -1; 345 KASSERT(p->p_vmspace->vm_shm == NULL, ("raced")); 346 p->p_vmspace->vm_shm = shmmap_s; 347 } 348 shmseg = shm_find_segment(shmid, true); 349 if (shmseg == NULL) 350 return (EINVAL); 351 error = ipcperm(td, &shmseg->u.shm_perm, 352 (shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W); 353 if (error != 0) 354 return (error); 355 #ifdef MAC 356 error = mac_sysvshm_check_shmat(td->td_ucred, shmseg, shmflg); 357 if (error != 0) 358 return (error); 359 #endif 360 for (i = 0; i < shminfo.shmseg; i++) { 361 if (shmmap_s->shmid == -1) 362 break; 363 shmmap_s++; 364 } 365 if (i >= shminfo.shmseg) 366 return (EMFILE); 367 size = round_page(shmseg->u.shm_segsz); 368 prot = VM_PROT_READ; 369 if ((shmflg & SHM_RDONLY) == 0) 370 prot |= VM_PROT_WRITE; 371 if (shmaddr != NULL) { 372 if ((shmflg & SHM_RND) != 0) 373 attach_va = (vm_offset_t)shmaddr & ~(SHMLBA-1); 374 else if (((vm_offset_t)shmaddr & (SHMLBA-1)) == 0) 375 attach_va = (vm_offset_t)shmaddr; 376 else 377 return (EINVAL); 378 } else { 379 /* 380 * This is just a hint to vm_map_find() about where to 381 * put it. 382 */ 383 attach_va = round_page((vm_offset_t)p->p_vmspace->vm_daddr + 384 lim_max(td, RLIMIT_DATA)); 385 } 386 387 vm_object_reference(shmseg->object); 388 rv = vm_map_find(&p->p_vmspace->vm_map, shmseg->object, 0, &attach_va, 389 size, 0, shmaddr != NULL ? VMFS_NO_SPACE : VMFS_OPTIMAL_SPACE, 390 prot, prot, MAP_INHERIT_SHARE | MAP_PREFAULT_PARTIAL); 391 if (rv != KERN_SUCCESS) { 392 vm_object_deallocate(shmseg->object); 393 return (ENOMEM); 394 } 395 396 shmmap_s->va = attach_va; 397 shmmap_s->shmid = shmid; 398 shmseg->u.shm_lpid = p->p_pid; 399 shmseg->u.shm_atime = time_second; 400 shmseg->u.shm_nattch++; 401 td->td_retval[0] = attach_va; 402 return (error); 403 } 404 405 int 406 kern_shmat(struct thread *td, int shmid, const void *shmaddr, int shmflg) 407 { 408 int error; 409 410 SYSVSHM_LOCK(); 411 error = kern_shmat_locked(td, shmid, shmaddr, shmflg); 412 SYSVSHM_UNLOCK(); 413 return (error); 414 } 415 416 #ifndef _SYS_SYSPROTO_H_ 417 struct shmat_args { 418 int shmid; 419 const void *shmaddr; 420 int shmflg; 421 }; 422 #endif 423 int 424 sys_shmat(struct thread *td, struct shmat_args *uap) 425 { 426 427 return (kern_shmat(td, uap->shmid, uap->shmaddr, uap->shmflg)); 428 } 429 430 static int 431 kern_shmctl_locked(struct thread *td, int shmid, int cmd, void *buf, 432 size_t *bufsz) 433 { 434 struct shmid_kernel *shmseg; 435 struct shmid_ds *shmidp; 436 struct shm_info shm_info; 437 int error; 438 439 SYSVSHM_ASSERT_LOCKED(); 440 441 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 442 return (ENOSYS); 443 444 switch (cmd) { 445 /* 446 * It is possible that kern_shmctl is being called from the Linux ABI 447 * layer, in which case, we will need to implement IPC_INFO. It should 448 * be noted that other shmctl calls will be funneled through here for 449 * Linix binaries as well. 450 * 451 * NB: The Linux ABI layer will convert this data to structure(s) more 452 * consistent with the Linux ABI. 453 */ 454 case IPC_INFO: 455 memcpy(buf, &shminfo, sizeof(shminfo)); 456 if (bufsz) 457 *bufsz = sizeof(shminfo); 458 td->td_retval[0] = shmalloced; 459 return (0); 460 case SHM_INFO: { 461 shm_info.used_ids = shm_nused; 462 shm_info.shm_rss = 0; /*XXX where to get from ? */ 463 shm_info.shm_tot = 0; /*XXX where to get from ? */ 464 shm_info.shm_swp = 0; /*XXX where to get from ? */ 465 shm_info.swap_attempts = 0; /*XXX where to get from ? */ 466 shm_info.swap_successes = 0; /*XXX where to get from ? */ 467 memcpy(buf, &shm_info, sizeof(shm_info)); 468 if (bufsz != NULL) 469 *bufsz = sizeof(shm_info); 470 td->td_retval[0] = shmalloced; 471 return (0); 472 } 473 } 474 shmseg = shm_find_segment(shmid, cmd != SHM_STAT); 475 if (shmseg == NULL) 476 return (EINVAL); 477 #ifdef MAC 478 error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, cmd); 479 if (error != 0) 480 return (error); 481 #endif 482 switch (cmd) { 483 case SHM_STAT: 484 case IPC_STAT: 485 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R); 486 if (error != 0) 487 return (error); 488 memcpy(buf, &shmseg->u, sizeof(struct shmid_ds)); 489 if (bufsz != NULL) 490 *bufsz = sizeof(struct shmid_ds); 491 if (cmd == SHM_STAT) { 492 td->td_retval[0] = IXSEQ_TO_IPCID(shmid, 493 shmseg->u.shm_perm); 494 } 495 break; 496 case IPC_SET: 497 shmidp = (struct shmid_ds *)buf; 498 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M); 499 if (error != 0) 500 return (error); 501 shmseg->u.shm_perm.uid = shmidp->shm_perm.uid; 502 shmseg->u.shm_perm.gid = shmidp->shm_perm.gid; 503 shmseg->u.shm_perm.mode = 504 (shmseg->u.shm_perm.mode & ~ACCESSPERMS) | 505 (shmidp->shm_perm.mode & ACCESSPERMS); 506 shmseg->u.shm_ctime = time_second; 507 break; 508 case IPC_RMID: 509 error = ipcperm(td, &shmseg->u.shm_perm, IPC_M); 510 if (error != 0) 511 return (error); 512 shmseg->u.shm_perm.key = IPC_PRIVATE; 513 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED; 514 if (shmseg->u.shm_nattch <= 0) { 515 shm_deallocate_segment(shmseg); 516 shm_last_free = IPCID_TO_IX(shmid); 517 } 518 break; 519 #if 0 520 case SHM_LOCK: 521 case SHM_UNLOCK: 522 #endif 523 default: 524 error = EINVAL; 525 break; 526 } 527 return (error); 528 } 529 530 int 531 kern_shmctl(struct thread *td, int shmid, int cmd, void *buf, size_t *bufsz) 532 { 533 int error; 534 535 SYSVSHM_LOCK(); 536 error = kern_shmctl_locked(td, shmid, cmd, buf, bufsz); 537 SYSVSHM_UNLOCK(); 538 return (error); 539 } 540 541 542 #ifndef _SYS_SYSPROTO_H_ 543 struct shmctl_args { 544 int shmid; 545 int cmd; 546 struct shmid_ds *buf; 547 }; 548 #endif 549 int 550 sys_shmctl(struct thread *td, struct shmctl_args *uap) 551 { 552 int error; 553 struct shmid_ds buf; 554 size_t bufsz; 555 556 /* 557 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support 558 * Linux binaries. If we see the call come through the FreeBSD ABI, 559 * return an error back to the user since we do not to support this. 560 */ 561 if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO || 562 uap->cmd == SHM_STAT) 563 return (EINVAL); 564 565 /* IPC_SET needs to copyin the buffer before calling kern_shmctl */ 566 if (uap->cmd == IPC_SET) { 567 if ((error = copyin(uap->buf, &buf, sizeof(struct shmid_ds)))) 568 goto done; 569 } 570 571 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz); 572 if (error) 573 goto done; 574 575 /* Cases in which we need to copyout */ 576 switch (uap->cmd) { 577 case IPC_STAT: 578 error = copyout(&buf, uap->buf, bufsz); 579 break; 580 } 581 582 done: 583 if (error) { 584 /* Invalidate the return value */ 585 td->td_retval[0] = -1; 586 } 587 return (error); 588 } 589 590 591 static int 592 shmget_existing(struct thread *td, struct shmget_args *uap, int mode, 593 int segnum) 594 { 595 struct shmid_kernel *shmseg; 596 #ifdef MAC 597 int error; 598 #endif 599 600 SYSVSHM_ASSERT_LOCKED(); 601 KASSERT(segnum >= 0 && segnum < shmalloced, 602 ("segnum %d shmalloced %d", segnum, shmalloced)); 603 shmseg = &shmsegs[segnum]; 604 if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL)) 605 return (EEXIST); 606 #ifdef MAC 607 error = mac_sysvshm_check_shmget(td->td_ucred, shmseg, uap->shmflg); 608 if (error != 0) 609 return (error); 610 #endif 611 if (uap->size != 0 && uap->size > shmseg->u.shm_segsz) 612 return (EINVAL); 613 td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm); 614 return (0); 615 } 616 617 static int 618 shmget_allocate_segment(struct thread *td, struct shmget_args *uap, int mode) 619 { 620 struct ucred *cred = td->td_ucred; 621 struct shmid_kernel *shmseg; 622 vm_object_t shm_object; 623 int i, segnum; 624 size_t size; 625 626 SYSVSHM_ASSERT_LOCKED(); 627 628 if (uap->size < shminfo.shmmin || uap->size > shminfo.shmmax) 629 return (EINVAL); 630 if (shm_nused >= shminfo.shmmni) /* Any shmids left? */ 631 return (ENOSPC); 632 size = round_page(uap->size); 633 if (shm_committed + btoc(size) > shminfo.shmall) 634 return (ENOMEM); 635 if (shm_last_free < 0) { 636 shmrealloc(); /* Maybe expand the shmsegs[] array. */ 637 for (i = 0; i < shmalloced; i++) 638 if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE) 639 break; 640 if (i == shmalloced) 641 return (ENOSPC); 642 segnum = i; 643 } else { 644 segnum = shm_last_free; 645 shm_last_free = -1; 646 } 647 KASSERT(segnum >= 0 && segnum < shmalloced, 648 ("segnum %d shmalloced %d", segnum, shmalloced)); 649 shmseg = &shmsegs[segnum]; 650 #ifdef RACCT 651 if (racct_enable) { 652 PROC_LOCK(td->td_proc); 653 if (racct_add(td->td_proc, RACCT_NSHM, 1)) { 654 PROC_UNLOCK(td->td_proc); 655 return (ENOSPC); 656 } 657 if (racct_add(td->td_proc, RACCT_SHMSIZE, size)) { 658 racct_sub(td->td_proc, RACCT_NSHM, 1); 659 PROC_UNLOCK(td->td_proc); 660 return (ENOMEM); 661 } 662 PROC_UNLOCK(td->td_proc); 663 } 664 #endif 665 666 /* 667 * We make sure that we have allocated a pager before we need 668 * to. 669 */ 670 shm_object = vm_pager_allocate(shm_use_phys ? OBJT_PHYS : OBJT_SWAP, 671 0, size, VM_PROT_DEFAULT, 0, cred); 672 if (shm_object == NULL) { 673 #ifdef RACCT 674 if (racct_enable) { 675 PROC_LOCK(td->td_proc); 676 racct_sub(td->td_proc, RACCT_NSHM, 1); 677 racct_sub(td->td_proc, RACCT_SHMSIZE, size); 678 PROC_UNLOCK(td->td_proc); 679 } 680 #endif 681 return (ENOMEM); 682 } 683 shm_object->pg_color = 0; 684 VM_OBJECT_WLOCK(shm_object); 685 vm_object_clear_flag(shm_object, OBJ_ONEMAPPING); 686 vm_object_set_flag(shm_object, OBJ_COLORED | OBJ_NOSPLIT); 687 VM_OBJECT_WUNLOCK(shm_object); 688 689 shmseg->object = shm_object; 690 shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = cred->cr_uid; 691 shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = cred->cr_gid; 692 shmseg->u.shm_perm.mode = (mode & ACCESSPERMS) | SHMSEG_ALLOCATED; 693 shmseg->u.shm_perm.key = uap->key; 694 shmseg->u.shm_perm.seq = (shmseg->u.shm_perm.seq + 1) & 0x7fff; 695 shmseg->cred = crhold(cred); 696 shmseg->u.shm_segsz = uap->size; 697 shmseg->u.shm_cpid = td->td_proc->p_pid; 698 shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0; 699 shmseg->u.shm_atime = shmseg->u.shm_dtime = 0; 700 #ifdef MAC 701 mac_sysvshm_create(cred, shmseg); 702 #endif 703 shmseg->u.shm_ctime = time_second; 704 shm_committed += btoc(size); 705 shm_nused++; 706 td->td_retval[0] = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm); 707 708 return (0); 709 } 710 711 #ifndef _SYS_SYSPROTO_H_ 712 struct shmget_args { 713 key_t key; 714 size_t size; 715 int shmflg; 716 }; 717 #endif 718 int 719 sys_shmget(struct thread *td, struct shmget_args *uap) 720 { 721 int segnum, mode; 722 int error; 723 724 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 725 return (ENOSYS); 726 mode = uap->shmflg & ACCESSPERMS; 727 SYSVSHM_LOCK(); 728 if (uap->key == IPC_PRIVATE) { 729 error = shmget_allocate_segment(td, uap, mode); 730 } else { 731 segnum = shm_find_segment_by_key(uap->key); 732 if (segnum >= 0) 733 error = shmget_existing(td, uap, mode, segnum); 734 else if ((uap->shmflg & IPC_CREAT) == 0) 735 error = ENOENT; 736 else 737 error = shmget_allocate_segment(td, uap, mode); 738 } 739 SYSVSHM_UNLOCK(); 740 return (error); 741 } 742 743 static void 744 shmfork_myhook(struct proc *p1, struct proc *p2) 745 { 746 struct shmmap_state *shmmap_s; 747 size_t size; 748 int i; 749 750 SYSVSHM_LOCK(); 751 size = shminfo.shmseg * sizeof(struct shmmap_state); 752 shmmap_s = malloc(size, M_SHM, M_WAITOK); 753 bcopy(p1->p_vmspace->vm_shm, shmmap_s, size); 754 p2->p_vmspace->vm_shm = shmmap_s; 755 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++) { 756 if (shmmap_s->shmid != -1) { 757 KASSERT(IPCID_TO_IX(shmmap_s->shmid) >= 0 && 758 IPCID_TO_IX(shmmap_s->shmid) < shmalloced, 759 ("segnum %d shmalloced %d", 760 IPCID_TO_IX(shmmap_s->shmid), shmalloced)); 761 shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++; 762 } 763 } 764 SYSVSHM_UNLOCK(); 765 } 766 767 static void 768 shmexit_myhook(struct vmspace *vm) 769 { 770 struct shmmap_state *base, *shm; 771 int i; 772 773 base = vm->vm_shm; 774 if (base != NULL) { 775 vm->vm_shm = NULL; 776 SYSVSHM_LOCK(); 777 for (i = 0, shm = base; i < shminfo.shmseg; i++, shm++) { 778 if (shm->shmid != -1) 779 shm_delete_mapping(vm, shm); 780 } 781 SYSVSHM_UNLOCK(); 782 free(base, M_SHM); 783 } 784 } 785 786 static void 787 shmrealloc(void) 788 { 789 struct shmid_kernel *newsegs; 790 int i; 791 792 SYSVSHM_ASSERT_LOCKED(); 793 794 if (shmalloced >= shminfo.shmmni) 795 return; 796 797 newsegs = malloc(shminfo.shmmni * sizeof(*newsegs), M_SHM, M_WAITOK); 798 for (i = 0; i < shmalloced; i++) 799 bcopy(&shmsegs[i], &newsegs[i], sizeof(newsegs[0])); 800 for (; i < shminfo.shmmni; i++) { 801 newsegs[i].u.shm_perm.mode = SHMSEG_FREE; 802 newsegs[i].u.shm_perm.seq = 0; 803 #ifdef MAC 804 mac_sysvshm_init(&newsegs[i]); 805 #endif 806 } 807 free(shmsegs, M_SHM); 808 shmsegs = newsegs; 809 shmalloced = shminfo.shmmni; 810 } 811 812 static struct syscall_helper_data shm_syscalls[] = { 813 SYSCALL_INIT_HELPER(shmat), 814 SYSCALL_INIT_HELPER(shmctl), 815 SYSCALL_INIT_HELPER(shmdt), 816 SYSCALL_INIT_HELPER(shmget), 817 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 818 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 819 SYSCALL_INIT_HELPER_COMPAT(freebsd7_shmctl), 820 #endif 821 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43)) 822 SYSCALL_INIT_HELPER(shmsys), 823 #endif 824 SYSCALL_INIT_LAST 825 }; 826 827 #ifdef COMPAT_FREEBSD32 828 #include <compat/freebsd32/freebsd32.h> 829 #include <compat/freebsd32/freebsd32_ipc.h> 830 #include <compat/freebsd32/freebsd32_proto.h> 831 #include <compat/freebsd32/freebsd32_signal.h> 832 #include <compat/freebsd32/freebsd32_syscall.h> 833 #include <compat/freebsd32/freebsd32_util.h> 834 835 static struct syscall_helper_data shm32_syscalls[] = { 836 SYSCALL32_INIT_HELPER_COMPAT(shmat), 837 SYSCALL32_INIT_HELPER_COMPAT(shmdt), 838 SYSCALL32_INIT_HELPER_COMPAT(shmget), 839 SYSCALL32_INIT_HELPER(freebsd32_shmsys), 840 SYSCALL32_INIT_HELPER(freebsd32_shmctl), 841 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 842 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 843 SYSCALL32_INIT_HELPER(freebsd7_freebsd32_shmctl), 844 #endif 845 SYSCALL_INIT_LAST 846 }; 847 #endif 848 849 static int 850 shminit(void) 851 { 852 int i, error; 853 854 #ifndef BURN_BRIDGES 855 if (TUNABLE_ULONG_FETCH("kern.ipc.shmmaxpgs", &shminfo.shmall) != 0) 856 printf("kern.ipc.shmmaxpgs is now called kern.ipc.shmall!\n"); 857 #endif 858 if (shminfo.shmmax == SHMMAX) { 859 /* Initialize shmmax dealing with possible overflow. */ 860 for (i = PAGE_SIZE; i != 0; i--) { 861 shminfo.shmmax = shminfo.shmall * i; 862 if ((shminfo.shmmax / shminfo.shmall) == (u_long)i) 863 break; 864 } 865 } 866 shmalloced = shminfo.shmmni; 867 shmsegs = malloc(shmalloced * sizeof(shmsegs[0]), M_SHM, M_WAITOK); 868 for (i = 0; i < shmalloced; i++) { 869 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE; 870 shmsegs[i].u.shm_perm.seq = 0; 871 #ifdef MAC 872 mac_sysvshm_init(&shmsegs[i]); 873 #endif 874 } 875 shm_last_free = 0; 876 shm_nused = 0; 877 shm_committed = 0; 878 sx_init(&sysvshmsx, "sysvshmsx"); 879 shmexit_hook = &shmexit_myhook; 880 shmfork_hook = &shmfork_myhook; 881 882 error = syscall_helper_register(shm_syscalls, SY_THR_STATIC_KLD); 883 if (error != 0) 884 return (error); 885 #ifdef COMPAT_FREEBSD32 886 error = syscall32_helper_register(shm32_syscalls, SY_THR_STATIC_KLD); 887 if (error != 0) 888 return (error); 889 #endif 890 return (0); 891 } 892 893 static int 894 shmunload(void) 895 { 896 int i; 897 898 if (shm_nused > 0) 899 return (EBUSY); 900 901 #ifdef COMPAT_FREEBSD32 902 syscall32_helper_unregister(shm32_syscalls); 903 #endif 904 syscall_helper_unregister(shm_syscalls); 905 906 for (i = 0; i < shmalloced; i++) { 907 #ifdef MAC 908 mac_sysvshm_destroy(&shmsegs[i]); 909 #endif 910 /* 911 * Objects might be still mapped into the processes 912 * address spaces. Actual free would happen on the 913 * last mapping destruction. 914 */ 915 if (shmsegs[i].u.shm_perm.mode != SHMSEG_FREE) 916 vm_object_deallocate(shmsegs[i].object); 917 } 918 free(shmsegs, M_SHM); 919 shmexit_hook = NULL; 920 shmfork_hook = NULL; 921 sx_destroy(&sysvshmsx); 922 return (0); 923 } 924 925 static int 926 sysctl_shmsegs(SYSCTL_HANDLER_ARGS) 927 { 928 int error; 929 930 SYSVSHM_LOCK(); 931 error = SYSCTL_OUT(req, shmsegs, shmalloced * sizeof(shmsegs[0])); 932 SYSVSHM_UNLOCK(); 933 return (error); 934 } 935 936 #if defined(__i386__) && (defined(COMPAT_FREEBSD4) || defined(COMPAT_43)) 937 struct oshmid_ds { 938 struct ipc_perm_old shm_perm; /* operation perms */ 939 int shm_segsz; /* size of segment (bytes) */ 940 u_short shm_cpid; /* pid, creator */ 941 u_short shm_lpid; /* pid, last operation */ 942 short shm_nattch; /* no. of current attaches */ 943 time_t shm_atime; /* last attach time */ 944 time_t shm_dtime; /* last detach time */ 945 time_t shm_ctime; /* last change time */ 946 void *shm_handle; /* internal handle for shm segment */ 947 }; 948 949 struct oshmctl_args { 950 int shmid; 951 int cmd; 952 struct oshmid_ds *ubuf; 953 }; 954 955 static int 956 oshmctl(struct thread *td, struct oshmctl_args *uap) 957 { 958 #ifdef COMPAT_43 959 int error = 0; 960 struct shmid_kernel *shmseg; 961 struct oshmid_ds outbuf; 962 963 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 964 return (ENOSYS); 965 if (uap->cmd != IPC_STAT) { 966 return (freebsd7_shmctl(td, 967 (struct freebsd7_shmctl_args *)uap)); 968 } 969 SYSVSHM_LOCK(); 970 shmseg = shm_find_segment(uap->shmid, true); 971 if (shmseg == NULL) { 972 SYSVSHM_UNLOCK(); 973 return (EINVAL); 974 } 975 error = ipcperm(td, &shmseg->u.shm_perm, IPC_R); 976 if (error != 0) { 977 SYSVSHM_UNLOCK(); 978 return (error); 979 } 980 #ifdef MAC 981 error = mac_sysvshm_check_shmctl(td->td_ucred, shmseg, uap->cmd); 982 if (error != 0) { 983 SYSVSHM_UNLOCK(); 984 return (error); 985 } 986 #endif 987 ipcperm_new2old(&shmseg->u.shm_perm, &outbuf.shm_perm); 988 outbuf.shm_segsz = shmseg->u.shm_segsz; 989 outbuf.shm_cpid = shmseg->u.shm_cpid; 990 outbuf.shm_lpid = shmseg->u.shm_lpid; 991 outbuf.shm_nattch = shmseg->u.shm_nattch; 992 outbuf.shm_atime = shmseg->u.shm_atime; 993 outbuf.shm_dtime = shmseg->u.shm_dtime; 994 outbuf.shm_ctime = shmseg->u.shm_ctime; 995 outbuf.shm_handle = shmseg->object; 996 SYSVSHM_UNLOCK(); 997 return (copyout(&outbuf, uap->ubuf, sizeof(outbuf))); 998 #else 999 return (EINVAL); 1000 #endif 1001 } 1002 1003 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 1004 static sy_call_t *shmcalls[] = { 1005 (sy_call_t *)sys_shmat, (sy_call_t *)oshmctl, 1006 (sy_call_t *)sys_shmdt, (sy_call_t *)sys_shmget, 1007 (sy_call_t *)freebsd7_shmctl 1008 }; 1009 1010 #ifndef _SYS_SYSPROTO_H_ 1011 /* XXX actually varargs. */ 1012 struct shmsys_args { 1013 int which; 1014 int a2; 1015 int a3; 1016 int a4; 1017 }; 1018 #endif 1019 int 1020 sys_shmsys(struct thread *td, struct shmsys_args *uap) 1021 { 1022 1023 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 1024 return (ENOSYS); 1025 if (uap->which < 0 || uap->which >= nitems(shmcalls)) 1026 return (EINVAL); 1027 return ((*shmcalls[uap->which])(td, &uap->a2)); 1028 } 1029 1030 #endif /* i386 && (COMPAT_FREEBSD4 || COMPAT_43) */ 1031 1032 #ifdef COMPAT_FREEBSD32 1033 1034 int 1035 freebsd32_shmsys(struct thread *td, struct freebsd32_shmsys_args *uap) 1036 { 1037 1038 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1039 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1040 switch (uap->which) { 1041 case 0: { /* shmat */ 1042 struct shmat_args ap; 1043 1044 ap.shmid = uap->a2; 1045 ap.shmaddr = PTRIN(uap->a3); 1046 ap.shmflg = uap->a4; 1047 return (sysent[SYS_shmat].sy_call(td, &ap)); 1048 } 1049 case 2: { /* shmdt */ 1050 struct shmdt_args ap; 1051 1052 ap.shmaddr = PTRIN(uap->a2); 1053 return (sysent[SYS_shmdt].sy_call(td, &ap)); 1054 } 1055 case 3: { /* shmget */ 1056 struct shmget_args ap; 1057 1058 ap.key = uap->a2; 1059 ap.size = uap->a3; 1060 ap.shmflg = uap->a4; 1061 return (sysent[SYS_shmget].sy_call(td, &ap)); 1062 } 1063 case 4: { /* shmctl */ 1064 struct freebsd7_freebsd32_shmctl_args ap; 1065 1066 ap.shmid = uap->a2; 1067 ap.cmd = uap->a3; 1068 ap.buf = PTRIN(uap->a4); 1069 return (freebsd7_freebsd32_shmctl(td, &ap)); 1070 } 1071 case 1: /* oshmctl */ 1072 default: 1073 return (EINVAL); 1074 } 1075 #else 1076 return (nosys(td, NULL)); 1077 #endif 1078 } 1079 1080 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1081 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1082 int 1083 freebsd7_freebsd32_shmctl(struct thread *td, 1084 struct freebsd7_freebsd32_shmctl_args *uap) 1085 { 1086 int error; 1087 union { 1088 struct shmid_ds shmid_ds; 1089 struct shm_info shm_info; 1090 struct shminfo shminfo; 1091 } u; 1092 union { 1093 struct shmid_ds32_old shmid_ds32; 1094 struct shm_info32 shm_info32; 1095 struct shminfo32 shminfo32; 1096 } u32; 1097 size_t sz; 1098 1099 if (uap->cmd == IPC_SET) { 1100 if ((error = copyin(uap->buf, &u32.shmid_ds32, 1101 sizeof(u32.shmid_ds32)))) 1102 goto done; 1103 freebsd32_ipcperm_old_in(&u32.shmid_ds32.shm_perm, 1104 &u.shmid_ds.shm_perm); 1105 CP(u32.shmid_ds32, u.shmid_ds, shm_segsz); 1106 CP(u32.shmid_ds32, u.shmid_ds, shm_lpid); 1107 CP(u32.shmid_ds32, u.shmid_ds, shm_cpid); 1108 CP(u32.shmid_ds32, u.shmid_ds, shm_nattch); 1109 CP(u32.shmid_ds32, u.shmid_ds, shm_atime); 1110 CP(u32.shmid_ds32, u.shmid_ds, shm_dtime); 1111 CP(u32.shmid_ds32, u.shmid_ds, shm_ctime); 1112 } 1113 1114 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz); 1115 if (error) 1116 goto done; 1117 1118 /* Cases in which we need to copyout */ 1119 switch (uap->cmd) { 1120 case IPC_INFO: 1121 CP(u.shminfo, u32.shminfo32, shmmax); 1122 CP(u.shminfo, u32.shminfo32, shmmin); 1123 CP(u.shminfo, u32.shminfo32, shmmni); 1124 CP(u.shminfo, u32.shminfo32, shmseg); 1125 CP(u.shminfo, u32.shminfo32, shmall); 1126 error = copyout(&u32.shminfo32, uap->buf, 1127 sizeof(u32.shminfo32)); 1128 break; 1129 case SHM_INFO: 1130 CP(u.shm_info, u32.shm_info32, used_ids); 1131 CP(u.shm_info, u32.shm_info32, shm_rss); 1132 CP(u.shm_info, u32.shm_info32, shm_tot); 1133 CP(u.shm_info, u32.shm_info32, shm_swp); 1134 CP(u.shm_info, u32.shm_info32, swap_attempts); 1135 CP(u.shm_info, u32.shm_info32, swap_successes); 1136 error = copyout(&u32.shm_info32, uap->buf, 1137 sizeof(u32.shm_info32)); 1138 break; 1139 case SHM_STAT: 1140 case IPC_STAT: 1141 freebsd32_ipcperm_old_out(&u.shmid_ds.shm_perm, 1142 &u32.shmid_ds32.shm_perm); 1143 if (u.shmid_ds.shm_segsz > INT32_MAX) 1144 u32.shmid_ds32.shm_segsz = INT32_MAX; 1145 else 1146 CP(u.shmid_ds, u32.shmid_ds32, shm_segsz); 1147 CP(u.shmid_ds, u32.shmid_ds32, shm_lpid); 1148 CP(u.shmid_ds, u32.shmid_ds32, shm_cpid); 1149 CP(u.shmid_ds, u32.shmid_ds32, shm_nattch); 1150 CP(u.shmid_ds, u32.shmid_ds32, shm_atime); 1151 CP(u.shmid_ds, u32.shmid_ds32, shm_dtime); 1152 CP(u.shmid_ds, u32.shmid_ds32, shm_ctime); 1153 u32.shmid_ds32.shm_internal = 0; 1154 error = copyout(&u32.shmid_ds32, uap->buf, 1155 sizeof(u32.shmid_ds32)); 1156 break; 1157 } 1158 1159 done: 1160 if (error) { 1161 /* Invalidate the return value */ 1162 td->td_retval[0] = -1; 1163 } 1164 return (error); 1165 } 1166 #endif 1167 1168 int 1169 freebsd32_shmctl(struct thread *td, struct freebsd32_shmctl_args *uap) 1170 { 1171 int error; 1172 union { 1173 struct shmid_ds shmid_ds; 1174 struct shm_info shm_info; 1175 struct shminfo shminfo; 1176 } u; 1177 union { 1178 struct shmid_ds32 shmid_ds32; 1179 struct shm_info32 shm_info32; 1180 struct shminfo32 shminfo32; 1181 } u32; 1182 size_t sz; 1183 1184 if (uap->cmd == IPC_SET) { 1185 if ((error = copyin(uap->buf, &u32.shmid_ds32, 1186 sizeof(u32.shmid_ds32)))) 1187 goto done; 1188 freebsd32_ipcperm_in(&u32.shmid_ds32.shm_perm, 1189 &u.shmid_ds.shm_perm); 1190 CP(u32.shmid_ds32, u.shmid_ds, shm_segsz); 1191 CP(u32.shmid_ds32, u.shmid_ds, shm_lpid); 1192 CP(u32.shmid_ds32, u.shmid_ds, shm_cpid); 1193 CP(u32.shmid_ds32, u.shmid_ds, shm_nattch); 1194 CP(u32.shmid_ds32, u.shmid_ds, shm_atime); 1195 CP(u32.shmid_ds32, u.shmid_ds, shm_dtime); 1196 CP(u32.shmid_ds32, u.shmid_ds, shm_ctime); 1197 } 1198 1199 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&u, &sz); 1200 if (error) 1201 goto done; 1202 1203 /* Cases in which we need to copyout */ 1204 switch (uap->cmd) { 1205 case IPC_INFO: 1206 CP(u.shminfo, u32.shminfo32, shmmax); 1207 CP(u.shminfo, u32.shminfo32, shmmin); 1208 CP(u.shminfo, u32.shminfo32, shmmni); 1209 CP(u.shminfo, u32.shminfo32, shmseg); 1210 CP(u.shminfo, u32.shminfo32, shmall); 1211 error = copyout(&u32.shminfo32, uap->buf, 1212 sizeof(u32.shminfo32)); 1213 break; 1214 case SHM_INFO: 1215 CP(u.shm_info, u32.shm_info32, used_ids); 1216 CP(u.shm_info, u32.shm_info32, shm_rss); 1217 CP(u.shm_info, u32.shm_info32, shm_tot); 1218 CP(u.shm_info, u32.shm_info32, shm_swp); 1219 CP(u.shm_info, u32.shm_info32, swap_attempts); 1220 CP(u.shm_info, u32.shm_info32, swap_successes); 1221 error = copyout(&u32.shm_info32, uap->buf, 1222 sizeof(u32.shm_info32)); 1223 break; 1224 case SHM_STAT: 1225 case IPC_STAT: 1226 freebsd32_ipcperm_out(&u.shmid_ds.shm_perm, 1227 &u32.shmid_ds32.shm_perm); 1228 if (u.shmid_ds.shm_segsz > INT32_MAX) 1229 u32.shmid_ds32.shm_segsz = INT32_MAX; 1230 else 1231 CP(u.shmid_ds, u32.shmid_ds32, shm_segsz); 1232 CP(u.shmid_ds, u32.shmid_ds32, shm_lpid); 1233 CP(u.shmid_ds, u32.shmid_ds32, shm_cpid); 1234 CP(u.shmid_ds, u32.shmid_ds32, shm_nattch); 1235 CP(u.shmid_ds, u32.shmid_ds32, shm_atime); 1236 CP(u.shmid_ds, u32.shmid_ds32, shm_dtime); 1237 CP(u.shmid_ds, u32.shmid_ds32, shm_ctime); 1238 error = copyout(&u32.shmid_ds32, uap->buf, 1239 sizeof(u32.shmid_ds32)); 1240 break; 1241 } 1242 1243 done: 1244 if (error) { 1245 /* Invalidate the return value */ 1246 td->td_retval[0] = -1; 1247 } 1248 return (error); 1249 } 1250 #endif 1251 1252 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1253 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1254 1255 #ifndef CP 1256 #define CP(src, dst, fld) do { (dst).fld = (src).fld; } while (0) 1257 #endif 1258 1259 #ifndef _SYS_SYSPROTO_H_ 1260 struct freebsd7_shmctl_args { 1261 int shmid; 1262 int cmd; 1263 struct shmid_ds_old *buf; 1264 }; 1265 #endif 1266 int 1267 freebsd7_shmctl(struct thread *td, struct freebsd7_shmctl_args *uap) 1268 { 1269 int error; 1270 struct shmid_ds_old old; 1271 struct shmid_ds buf; 1272 size_t bufsz; 1273 1274 /* 1275 * The only reason IPC_INFO, SHM_INFO, SHM_STAT exists is to support 1276 * Linux binaries. If we see the call come through the FreeBSD ABI, 1277 * return an error back to the user since we do not to support this. 1278 */ 1279 if (uap->cmd == IPC_INFO || uap->cmd == SHM_INFO || 1280 uap->cmd == SHM_STAT) 1281 return (EINVAL); 1282 1283 /* IPC_SET needs to copyin the buffer before calling kern_shmctl */ 1284 if (uap->cmd == IPC_SET) { 1285 if ((error = copyin(uap->buf, &old, sizeof(old)))) 1286 goto done; 1287 ipcperm_old2new(&old.shm_perm, &buf.shm_perm); 1288 CP(old, buf, shm_segsz); 1289 CP(old, buf, shm_lpid); 1290 CP(old, buf, shm_cpid); 1291 CP(old, buf, shm_nattch); 1292 CP(old, buf, shm_atime); 1293 CP(old, buf, shm_dtime); 1294 CP(old, buf, shm_ctime); 1295 } 1296 1297 error = kern_shmctl(td, uap->shmid, uap->cmd, (void *)&buf, &bufsz); 1298 if (error) 1299 goto done; 1300 1301 /* Cases in which we need to copyout */ 1302 switch (uap->cmd) { 1303 case IPC_STAT: 1304 ipcperm_new2old(&buf.shm_perm, &old.shm_perm); 1305 if (buf.shm_segsz > INT_MAX) 1306 old.shm_segsz = INT_MAX; 1307 else 1308 CP(buf, old, shm_segsz); 1309 CP(buf, old, shm_lpid); 1310 CP(buf, old, shm_cpid); 1311 if (buf.shm_nattch > SHRT_MAX) 1312 old.shm_nattch = SHRT_MAX; 1313 else 1314 CP(buf, old, shm_nattch); 1315 CP(buf, old, shm_atime); 1316 CP(buf, old, shm_dtime); 1317 CP(buf, old, shm_ctime); 1318 old.shm_internal = NULL; 1319 error = copyout(&old, uap->buf, sizeof(old)); 1320 break; 1321 } 1322 1323 done: 1324 if (error) { 1325 /* Invalidate the return value */ 1326 td->td_retval[0] = -1; 1327 } 1328 return (error); 1329 } 1330 1331 #endif /* COMPAT_FREEBSD4 || COMPAT_FREEBSD5 || COMPAT_FREEBSD6 || 1332 COMPAT_FREEBSD7 */ 1333 1334 static int 1335 sysvshm_modload(struct module *module, int cmd, void *arg) 1336 { 1337 int error = 0; 1338 1339 switch (cmd) { 1340 case MOD_LOAD: 1341 error = shminit(); 1342 if (error != 0) 1343 shmunload(); 1344 break; 1345 case MOD_UNLOAD: 1346 error = shmunload(); 1347 break; 1348 case MOD_SHUTDOWN: 1349 break; 1350 default: 1351 error = EINVAL; 1352 break; 1353 } 1354 return (error); 1355 } 1356 1357 static moduledata_t sysvshm_mod = { 1358 "sysvshm", 1359 &sysvshm_modload, 1360 NULL 1361 }; 1362 1363 DECLARE_MODULE(sysvshm, sysvshm_mod, SI_SUB_SYSV_SHM, SI_ORDER_FIRST); 1364 MODULE_VERSION(sysvshm, 1); 1365