xref: /titanic_51/usr/src/uts/common/os/shm.c (revision 37714ae43602c675f9dc59b070bfdf9fa702872c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
28 /*	  All Rights Reserved	*/
29 
30 /*
31  * University Copyright- Copyright (c) 1982, 1986, 1988
32  * The Regents of the University of California
33  * All Rights Reserved
34  *
35  * University Acknowledgment- Portions of this document are derived from
36  * software developed by the University of California, Berkeley, and its
37  * contributors.
38  */
39 
40 /*
41  * Inter-Process Communication Shared Memory Facility.
42  *
43  * See os/ipc.c for a description of common IPC functionality.
44  *
45  * Resource controls
46  * -----------------
47  *
48  * Control:      zone.max-shm-ids (rc_zone_shmmni)
49  * Description:  Maximum number of shared memory ids allowed a zone.
50  *
51  *   When shmget() is used to allocate a shared memory segment, one id
52  *   is allocated.  If the id allocation doesn't succeed, shmget()
53  *   fails and errno is set to ENOSPC.  Upon successful shmctl(,
54  *   IPC_RMID) the id is deallocated.
55  *
56  * Control:      project.max-shm-ids (rc_project_shmmni)
57  * Description:  Maximum number of shared memory ids allowed a project.
58  *
59  *   When shmget() is used to allocate a shared memory segment, one id
60  *   is allocated.  If the id allocation doesn't succeed, shmget()
61  *   fails and errno is set to ENOSPC.  Upon successful shmctl(,
62  *   IPC_RMID) the id is deallocated.
63  *
64  * Control:      zone.max-shm-memory (rc_zone_shmmax)
65  * Description:  Total amount of shared memory allowed a zone.
66  *
67  *   When shmget() is used to allocate a shared memory segment, the
68  *   segment's size is allocated against this limit.  If the space
69  *   allocation doesn't succeed, shmget() fails and errno is set to
70  *   EINVAL.  The size will be deallocated once the last process has
71  *   detached the segment and the segment has been successfully
72  *   shmctl(, IPC_RMID)ed.
73  *
74  * Control:      project.max-shm-memory (rc_project_shmmax)
75  * Description:  Total amount of shared memory allowed a project.
76  *
77  *   When shmget() is used to allocate a shared memory segment, the
78  *   segment's size is allocated against this limit.  If the space
79  *   allocation doesn't succeed, shmget() fails and errno is set to
80  *   EINVAL.  The size will be deallocated once the last process has
81  *   detached the segment and the segment has been successfully
82  *   shmctl(, IPC_RMID)ed.
83  */
84 
85 #include <sys/types.h>
86 #include <sys/param.h>
87 #include <sys/cred.h>
88 #include <sys/errno.h>
89 #include <sys/time.h>
90 #include <sys/kmem.h>
91 #include <sys/user.h>
92 #include <sys/proc.h>
93 #include <sys/systm.h>
94 #include <sys/prsystm.h>
95 #include <sys/sysmacros.h>
96 #include <sys/tuneable.h>
97 #include <sys/vm.h>
98 #include <sys/mman.h>
99 #include <sys/swap.h>
100 #include <sys/cmn_err.h>
101 #include <sys/debug.h>
102 #include <sys/lwpchan_impl.h>
103 #include <sys/avl.h>
104 #include <sys/modctl.h>
105 #include <sys/syscall.h>
106 #include <sys/task.h>
107 #include <sys/project.h>
108 #include <sys/policy.h>
109 #include <sys/zone.h>
110 #include <sys/rctl.h>
111 
112 #include <sys/ipc.h>
113 #include <sys/ipc_impl.h>
114 #include <sys/shm.h>
115 #include <sys/shm_impl.h>
116 
117 #include <vm/hat.h>
118 #include <vm/seg.h>
119 #include <vm/as.h>
120 #include <vm/seg_vn.h>
121 #include <vm/anon.h>
122 #include <vm/page.h>
123 #include <vm/vpage.h>
124 #include <vm/seg_spt.h>
125 
126 #include <c2/audit.h>
127 
128 static int shmem_lock(kshmid_t *sp, struct anon_map *amp);
129 static void shmem_unlock(kshmid_t *sp, struct anon_map *amp);
130 static void sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags,
131 	kshmid_t *id);
132 static void shm_rm_amp(kshmid_t *sp);
133 static void shm_dtor(kipc_perm_t *);
134 static void shm_rmid(kipc_perm_t *);
135 static void shm_remove_zone(zoneid_t, void *);
136 
137 /*
138  * Semantics for share_page_table and ism_off:
139  *
140  * These are hooks in /etc/system - only for internal testing purpose.
141  *
142  * Setting share_page_table automatically turns on the SHM_SHARE_MMU (ISM) flag
143  * in a call to shmat(2). In other words, with share_page_table set, you always
144  * get ISM, even if say, DISM is specified. It should really be called "ism_on".
145  *
146  * Setting ism_off turns off the SHM_SHARE_MMU flag from the flags passed to
147  * shmat(2).
148  *
149  * If both share_page_table and ism_off are set, share_page_table prevails.
150  *
151  * Although these tunables should probably be removed, they do have some
152  * external exposure; as long as they exist, they should at least work sensibly.
153  */
154 
155 int share_page_table;
156 int ism_off;
157 
158 /*
159  * The following tunables are obsolete.  Though for compatibility we
160  * still read and interpret shminfo_shmmax and shminfo_shmmni (see
161  * os/project.c), the preferred mechanism for administrating the IPC
162  * Shared Memory facility is through the resource controls described at
163  * the top of this file.
164  */
165 size_t	shminfo_shmmax = 0x800000;	/* (obsolete) */
166 int	shminfo_shmmni = 100;		/* (obsolete) */
167 size_t	shminfo_shmmin = 1;		/* (obsolete) */
168 int	shminfo_shmseg = 6;		/* (obsolete) */
169 
170 extern rctl_hndl_t rc_zone_shmmax;
171 extern rctl_hndl_t rc_zone_shmmni;
172 extern rctl_hndl_t rc_project_shmmax;
173 extern rctl_hndl_t rc_project_shmmni;
174 static ipc_service_t *shm_svc;
175 static zone_key_t shm_zone_key;
176 
177 /*
178  * Module linkage information for the kernel.
179  */
180 static uintptr_t shmsys(int, uintptr_t, uintptr_t, uintptr_t);
181 
182 static struct sysent ipcshm_sysent = {
183 	4,
184 #ifdef	_SYSCALL32_IMPL
185 	SE_ARGC | SE_NOUNLOAD | SE_64RVAL,
186 #else	/* _SYSCALL32_IMPL */
187 	SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,
188 #endif	/* _SYSCALL32_IMPL */
189 	(int (*)())shmsys
190 };
191 
192 #ifdef	_SYSCALL32_IMPL
193 static struct sysent ipcshm_sysent32 = {
194 	4,
195 	SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,
196 	(int (*)())shmsys
197 };
198 #endif	/* _SYSCALL32_IMPL */
199 
200 static struct modlsys modlsys = {
201 	&mod_syscallops, "System V shared memory", &ipcshm_sysent
202 };
203 
204 #ifdef	_SYSCALL32_IMPL
205 static struct modlsys modlsys32 = {
206 	&mod_syscallops32, "32-bit System V shared memory", &ipcshm_sysent32
207 };
208 #endif	/* _SYSCALL32_IMPL */
209 
210 static struct modlinkage modlinkage = {
211 	MODREV_1,
212 	&modlsys,
213 #ifdef	_SYSCALL32_IMPL
214 	&modlsys32,
215 #endif
216 	NULL
217 };
218 
219 
220 int
221 _init(void)
222 {
223 	int result;
224 
225 	shm_svc = ipcs_create("shmids", rc_project_shmmni, rc_zone_shmmni,
226 	    sizeof (kshmid_t), shm_dtor, shm_rmid, AT_IPC_SHM,
227 	    offsetof(ipc_rqty_t, ipcq_shmmni));
228 	zone_key_create(&shm_zone_key, NULL, shm_remove_zone, NULL);
229 
230 	if ((result = mod_install(&modlinkage)) == 0)
231 		return (0);
232 
233 	(void) zone_key_delete(shm_zone_key);
234 	ipcs_destroy(shm_svc);
235 
236 	return (result);
237 }
238 
239 int
240 _fini(void)
241 {
242 	return (EBUSY);
243 }
244 
245 int
246 _info(struct modinfo *modinfop)
247 {
248 	return (mod_info(&modlinkage, modinfop));
249 }
250 
251 /*
252  * Shmat (attach shared segment) system call.
253  */
254 static int
255 shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp)
256 {
257 	kshmid_t *sp;	/* shared memory header ptr */
258 	size_t	size;
259 	int	error = 0;
260 	proc_t *pp = curproc;
261 	struct as *as = pp->p_as;
262 	struct segvn_crargs	crargs;	/* segvn create arguments */
263 	kmutex_t	*lock;
264 	struct seg 	*segspt = NULL;
265 	caddr_t		addr = uaddr;
266 	int		flags = (uflags & SHMAT_VALID_FLAGS_MASK);
267 	int		useISM;
268 	uchar_t		prot = PROT_ALL;
269 	int result;
270 
271 	if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL)
272 		return (EINVAL);
273 	if (error = ipcperm_access(&sp->shm_perm, SHM_R, CRED()))
274 		goto errret;
275 	if ((flags & SHM_RDONLY) == 0 &&
276 	    (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED())))
277 		goto errret;
278 	if (spt_invalid(flags)) {
279 		error = EINVAL;
280 		goto errret;
281 	}
282 	if (ism_off)
283 		flags = flags & ~SHM_SHARE_MMU;
284 	if (share_page_table) {
285 		flags = flags & ~SHM_PAGEABLE;
286 		flags = flags | SHM_SHARE_MMU;
287 	}
288 	useISM = (spt_locked(flags) || spt_pageable(flags));
289 	if (useISM && (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED())))
290 		goto errret;
291 	if (useISM && isspt(sp)) {
292 		uint_t newsptflags = flags | spt_flags(sp->shm_sptseg);
293 		/*
294 		 * If trying to change an existing {D}ISM segment from ISM
295 		 * to DISM or vice versa, return error. Note that this
296 		 * validation of flags needs to be done after the effect of
297 		 * tunables such as ism_off and share_page_table, for
298 		 * semantics that are consistent with the tunables' settings.
299 		 */
300 		if (spt_invalid(newsptflags)) {
301 			error = EINVAL;
302 			goto errret;
303 		}
304 	}
305 	ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER);
306 	size = sp->shm_amp->size;
307 	ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
308 
309 	/* somewhere to record spt info for final detach */
310 	if (sp->shm_sptinfo == NULL)
311 		sp->shm_sptinfo = kmem_zalloc(sizeof (sptinfo_t), KM_SLEEP);
312 
313 	as_rangelock(as);
314 
315 	if (useISM) {
316 		/*
317 		 * Handle ISM
318 		 */
319 		uint_t	share_szc;
320 		size_t	share_size;
321 		struct	shm_data ssd;
322 		uintptr_t align_hint;
323 
324 		/*
325 		 * Pick a share pagesize to use, if (!isspt(sp)).
326 		 * Otherwise use the already chosen page size.
327 		 *
328 		 * For the initial shmat (!isspt(sp)), where sptcreate is
329 		 * called, map_pgsz is called to recommend a [D]ISM pagesize,
330 		 * important for systems which offer more than one potential
331 		 * [D]ISM pagesize.
332 		 * If the shmat is just to attach to an already created
333 		 * [D]ISM segment, then use the previously selected page size.
334 		 */
335 		if (!isspt(sp)) {
336 			share_size = map_pgsz(MAPPGSZ_ISM, pp, addr, size, 0);
337 			if (share_size == 0) {
338 				as_rangeunlock(as);
339 				error = EINVAL;
340 				goto errret;
341 			}
342 			share_szc = page_szc(share_size);
343 		} else {
344 			share_szc = sp->shm_sptseg->s_szc;
345 			share_size = page_get_pagesize(share_szc);
346 		}
347 		size = P2ROUNDUP(size, share_size);
348 
349 		align_hint = share_size;
350 #if defined(__i386) || defined(__amd64)
351 		/*
352 		 * For x86, we want to share as much of the page table tree
353 		 * as possible. We use a large align_hint at first, but
354 		 * if that fails, then the code below retries with align_hint
355 		 * set to share_size.
356 		 *
357 		 * The explicit extern here is due to the difficulties
358 		 * of getting to platform dependent includes. When/if the
359 		 * platform dependent bits of this function are cleaned up,
360 		 * another way of doing this should found.
361 		 */
362 		{
363 			extern uint_t ptes_per_table;
364 
365 			while (size >= ptes_per_table * (uint64_t)align_hint)
366 				align_hint *= ptes_per_table;
367 		}
368 #endif /* __i386 || __amd64 */
369 
370 #if defined(__sparcv9)
371 		if (addr == 0 &&
372 		    pp->p_model == DATAMODEL_LP64 && AS_TYPE_64BIT(as)) {
373 			/*
374 			 * If no address has been passed in, and this is a
375 			 * 64-bit process, we'll try to find an address
376 			 * in the predict-ISM zone.
377 			 */
378 			caddr_t predbase = (caddr_t)PREDISM_1T_BASE;
379 			size_t len = PREDISM_BOUND - PREDISM_1T_BASE;
380 
381 			as_purge(as);
382 			if (as_gap(as, size + share_size, &predbase, &len,
383 			    AH_LO, (caddr_t)NULL) != -1) {
384 				/*
385 				 * We found an address which looks like a
386 				 * candidate.  We want to round it up, and
387 				 * then check that it's a valid user range.
388 				 * This assures that we won't fail below.
389 				 */
390 				addr = (caddr_t)P2ROUNDUP((uintptr_t)predbase,
391 				    share_size);
392 
393 				if (valid_usr_range(addr, size, prot,
394 				    as, as->a_userlimit) != RANGE_OKAY) {
395 					addr = 0;
396 				}
397 			}
398 		}
399 #endif /* __sparcv9 */
400 
401 		if (addr == 0) {
402 			for (;;) {
403 				addr = (caddr_t)align_hint;
404 				map_addr(&addr, size, 0ll, 1, MAP_ALIGN);
405 				if (addr != NULL || align_hint == share_size)
406 					break;
407 				align_hint = share_size;
408 			}
409 			if (addr == NULL) {
410 				as_rangeunlock(as);
411 				error = ENOMEM;
412 				goto errret;
413 			}
414 			ASSERT(((uintptr_t)addr & (align_hint - 1)) == 0);
415 		} else {
416 			/* Use the user-supplied attach address */
417 			caddr_t base;
418 			size_t len;
419 
420 			/*
421 			 * Check that the address range
422 			 *  1) is properly aligned
423 			 *  2) is correct in unix terms
424 			 *  3) is within an unmapped address segment
425 			 */
426 			base = addr;
427 			len = size;		/* use spt aligned size */
428 			/* XXX - in SunOS, is sp->shm_segsz */
429 			if ((uintptr_t)base & (share_size - 1)) {
430 				error = EINVAL;
431 				as_rangeunlock(as);
432 				goto errret;
433 			}
434 			result = valid_usr_range(base, len, prot, as,
435 			    as->a_userlimit);
436 			if (result == RANGE_BADPROT) {
437 				/*
438 				 * We try to accomodate processors which
439 				 * may not support execute permissions on
440 				 * all ISM segments by trying the check
441 				 * again but without PROT_EXEC.
442 				 */
443 				prot &= ~PROT_EXEC;
444 				result = valid_usr_range(base, len, prot, as,
445 				    as->a_userlimit);
446 			}
447 			as_purge(as);
448 			if (result != RANGE_OKAY ||
449 			    as_gap(as, len, &base, &len, AH_LO,
450 			    (caddr_t)NULL) != 0) {
451 				error = EINVAL;
452 				as_rangeunlock(as);
453 				goto errret;
454 			}
455 		}
456 
457 		if (!isspt(sp)) {
458 			error = sptcreate(size, &segspt, sp->shm_amp, prot,
459 			    flags, share_szc);
460 			if (error) {
461 				as_rangeunlock(as);
462 				goto errret;
463 			}
464 			sp->shm_sptinfo->sptas = segspt->s_as;
465 			sp->shm_sptseg = segspt;
466 			sp->shm_sptprot = prot;
467 		} else if ((prot & sp->shm_sptprot) != sp->shm_sptprot) {
468 			/*
469 			 * Ensure we're attaching to an ISM segment with
470 			 * fewer or equal permissions than what we're
471 			 * allowed.  Fail if the segment has more
472 			 * permissions than what we're allowed.
473 			 */
474 			error = EACCES;
475 			as_rangeunlock(as);
476 			goto errret;
477 		}
478 
479 		ssd.shm_sptseg = sp->shm_sptseg;
480 		ssd.shm_sptas = sp->shm_sptinfo->sptas;
481 		ssd.shm_amp = sp->shm_amp;
482 		error = as_map(as, addr, size, segspt_shmattach, &ssd);
483 		if (error == 0)
484 			sp->shm_ismattch++; /* keep count of ISM attaches */
485 	} else {
486 
487 		/*
488 		 * Normal case.
489 		 */
490 		if (flags & SHM_RDONLY)
491 			prot &= ~PROT_WRITE;
492 
493 		if (addr == 0) {
494 			/* Let the system pick the attach address */
495 			map_addr(&addr, size, 0ll, 1, 0);
496 			if (addr == NULL) {
497 				as_rangeunlock(as);
498 				error = ENOMEM;
499 				goto errret;
500 			}
501 		} else {
502 			/* Use the user-supplied attach address */
503 			caddr_t base;
504 			size_t len;
505 
506 			if (flags & SHM_RND)
507 				addr = (caddr_t)((uintptr_t)addr &
508 				    ~(SHMLBA - 1));
509 			/*
510 			 * Check that the address range
511 			 *  1) is properly aligned
512 			 *  2) is correct in unix terms
513 			 *  3) is within an unmapped address segment
514 			 */
515 			base = addr;
516 			len = size;		/* use aligned size */
517 			/* XXX - in SunOS, is sp->shm_segsz */
518 			if ((uintptr_t)base & PAGEOFFSET) {
519 				error = EINVAL;
520 				as_rangeunlock(as);
521 				goto errret;
522 			}
523 			result = valid_usr_range(base, len, prot, as,
524 			    as->a_userlimit);
525 			if (result == RANGE_BADPROT) {
526 				prot &= ~PROT_EXEC;
527 				result = valid_usr_range(base, len, prot, as,
528 				    as->a_userlimit);
529 			}
530 			as_purge(as);
531 			if (result != RANGE_OKAY ||
532 			    as_gap(as, len, &base, &len,
533 			    AH_LO, (caddr_t)NULL) != 0) {
534 				error = EINVAL;
535 				as_rangeunlock(as);
536 				goto errret;
537 			}
538 		}
539 
540 		/* Initialize the create arguments and map the segment */
541 		crargs = *(struct segvn_crargs *)zfod_argsp;
542 		crargs.offset = 0;
543 		crargs.type = MAP_SHARED;
544 		crargs.amp = sp->shm_amp;
545 		crargs.prot = prot;
546 		crargs.maxprot = crargs.prot;
547 		crargs.flags = 0;
548 
549 		error = as_map(as, addr, size, segvn_create, &crargs);
550 	}
551 
552 	as_rangeunlock(as);
553 	if (error)
554 		goto errret;
555 
556 	/* record shmem range for the detach */
557 	sa_add(pp, addr, (size_t)size, useISM ? SHMSA_ISM : 0, sp);
558 	*rvp = (uintptr_t)addr;
559 
560 	sp->shm_atime = gethrestime_sec();
561 	sp->shm_lpid = pp->p_pid;
562 	ipc_hold(shm_svc, (kipc_perm_t *)sp);
563 
564 	/*
565 	 * Tell machine specific code that lwp has mapped shared memory
566 	 */
567 	LWP_MMODEL_SHARED_AS(addr, size);
568 
569 errret:
570 	mutex_exit(lock);
571 	return (error);
572 }
573 
574 static void
575 shm_dtor(kipc_perm_t *perm)
576 {
577 	kshmid_t *sp = (kshmid_t *)perm;
578 	uint_t cnt;
579 	size_t rsize;
580 
581 	if (sp->shm_sptinfo) {
582 		if (isspt(sp)) {
583 			sptdestroy(sp->shm_sptinfo->sptas, sp->shm_amp);
584 			sp->shm_lkcnt = 0;
585 		}
586 		kmem_free(sp->shm_sptinfo, sizeof (sptinfo_t));
587 	}
588 
589 	if (sp->shm_lkcnt > 0) {
590 		shmem_unlock(sp, sp->shm_amp);
591 		sp->shm_lkcnt = 0;
592 	}
593 
594 	ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER);
595 	cnt = --sp->shm_amp->refcnt;
596 	ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
597 	ASSERT(cnt == 0);
598 	shm_rm_amp(sp);
599 
600 	if (sp->shm_perm.ipc_id != IPC_ID_INVAL) {
601 		rsize = ptob(btopr(sp->shm_segsz));
602 		ipcs_lock(shm_svc);
603 		sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax -= rsize;
604 		sp->shm_perm.ipc_zone->zone_shmmax -= rsize;
605 		ipcs_unlock(shm_svc);
606 	}
607 }
608 
609 /* ARGSUSED */
610 static void
611 shm_rmid(kipc_perm_t *perm)
612 {
613 	/* nothing to do */
614 }
615 
616 /*
617  * Shmctl system call.
618  */
619 /* ARGSUSED */
620 static int
621 shmctl(int shmid, int cmd, void *arg)
622 {
623 	kshmid_t		*sp;	/* shared memory header ptr */
624 	STRUCT_DECL(shmid_ds, ds);	/* for SVR4 IPC_SET */
625 	int			error = 0;
626 	struct cred 		*cr = CRED();
627 	kmutex_t		*lock;
628 	model_t			mdl = get_udatamodel();
629 	struct shmid_ds64	ds64;
630 	shmatt_t		nattch;
631 
632 	STRUCT_INIT(ds, mdl);
633 
634 	/*
635 	 * Perform pre- or non-lookup actions (e.g. copyins, RMID).
636 	 */
637 	switch (cmd) {
638 	case IPC_SET:
639 		if (copyin(arg, STRUCT_BUF(ds), STRUCT_SIZE(ds)))
640 			return (EFAULT);
641 		break;
642 
643 	case IPC_SET64:
644 		if (copyin(arg, &ds64, sizeof (struct shmid_ds64)))
645 			return (EFAULT);
646 		break;
647 
648 	case IPC_RMID:
649 		return (ipc_rmid(shm_svc, shmid, cr));
650 	}
651 
652 	if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL)
653 		return (EINVAL);
654 
655 	switch (cmd) {
656 	/* Set ownership and permissions. */
657 	case IPC_SET:
658 		if (error = ipcperm_set(shm_svc, cr, &sp->shm_perm,
659 		    &STRUCT_BUF(ds)->shm_perm, mdl))
660 				break;
661 		sp->shm_ctime = gethrestime_sec();
662 		break;
663 
664 	case IPC_STAT:
665 		if (error = ipcperm_access(&sp->shm_perm, SHM_R, cr))
666 			break;
667 
668 		nattch = sp->shm_perm.ipc_ref - 1;
669 
670 		ipcperm_stat(&STRUCT_BUF(ds)->shm_perm, &sp->shm_perm, mdl);
671 		STRUCT_FSET(ds, shm_segsz, sp->shm_segsz);
672 		STRUCT_FSETP(ds, shm_amp, NULL);	/* kernel addr */
673 		STRUCT_FSET(ds, shm_lkcnt, sp->shm_lkcnt);
674 		STRUCT_FSET(ds, shm_lpid, sp->shm_lpid);
675 		STRUCT_FSET(ds, shm_cpid, sp->shm_cpid);
676 		STRUCT_FSET(ds, shm_nattch, nattch);
677 		STRUCT_FSET(ds, shm_cnattch, sp->shm_ismattch);
678 		STRUCT_FSET(ds, shm_atime, sp->shm_atime);
679 		STRUCT_FSET(ds, shm_dtime, sp->shm_dtime);
680 		STRUCT_FSET(ds, shm_ctime, sp->shm_ctime);
681 
682 		mutex_exit(lock);
683 		if (copyout(STRUCT_BUF(ds), arg, STRUCT_SIZE(ds)))
684 			return (EFAULT);
685 
686 		return (0);
687 
688 	case IPC_SET64:
689 		if (error = ipcperm_set64(shm_svc, cr,
690 		    &sp->shm_perm, &ds64.shmx_perm))
691 			break;
692 		sp->shm_ctime = gethrestime_sec();
693 		break;
694 
695 	case IPC_STAT64:
696 		nattch = sp->shm_perm.ipc_ref - 1;
697 
698 		ipcperm_stat64(&ds64.shmx_perm, &sp->shm_perm);
699 		ds64.shmx_segsz = sp->shm_segsz;
700 		ds64.shmx_lkcnt = sp->shm_lkcnt;
701 		ds64.shmx_lpid = sp->shm_lpid;
702 		ds64.shmx_cpid = sp->shm_cpid;
703 		ds64.shmx_nattch = nattch;
704 		ds64.shmx_cnattch = sp->shm_ismattch;
705 		ds64.shmx_atime = sp->shm_atime;
706 		ds64.shmx_dtime = sp->shm_dtime;
707 		ds64.shmx_ctime = sp->shm_ctime;
708 
709 		mutex_exit(lock);
710 		if (copyout(&ds64, arg, sizeof (struct shmid_ds64)))
711 			return (EFAULT);
712 
713 		return (0);
714 
715 	/* Lock segment in memory */
716 	case SHM_LOCK:
717 		if ((error = secpolicy_lock_memory(cr)) != 0)
718 			break;
719 
720 		/* protect against overflow */
721 		if (sp->shm_lkcnt >= USHRT_MAX) {
722 			error = ENOMEM;
723 			break;
724 		}
725 		if (!isspt(sp) && (sp->shm_lkcnt++ == 0)) {
726 			if (error = shmem_lock(sp, sp->shm_amp)) {
727 				ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock,
728 				    RW_WRITER);
729 				cmn_err(CE_NOTE, "shmctl - couldn't lock %ld"
730 				    " pages into memory", sp->shm_amp->size);
731 				ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
732 				error = ENOMEM;
733 				sp->shm_lkcnt--;
734 			}
735 		}
736 		break;
737 
738 	/* Unlock segment */
739 	case SHM_UNLOCK:
740 		if ((error = secpolicy_lock_memory(cr)) != 0)
741 			break;
742 
743 		if (sp->shm_lkcnt && (--sp->shm_lkcnt == 0)) {
744 			shmem_unlock(sp, sp->shm_amp);
745 		}
746 		break;
747 
748 	default:
749 		error = EINVAL;
750 		break;
751 	}
752 	mutex_exit(lock);
753 	return (error);
754 }
755 
756 static void
757 shm_detach(proc_t *pp, segacct_t *sap)
758 {
759 	kshmid_t	*sp = sap->sa_id;
760 	size_t		len = sap->sa_len;
761 	caddr_t		addr = sap->sa_addr;
762 
763 	/*
764 	 * Discard lwpchan mappings.
765 	 */
766 	if (pp->p_lcp != NULL)
767 		lwpchan_delete_mapping(pp, addr, addr + len);
768 	(void) as_unmap(pp->p_as, addr, len);
769 
770 	/*
771 	 * Perform some detach-time accounting.
772 	 */
773 	(void) ipc_lock(shm_svc, sp->shm_perm.ipc_id);
774 	if (sap->sa_flags & SHMSA_ISM)
775 		sp->shm_ismattch--;
776 	sp->shm_dtime = gethrestime_sec();
777 	sp->shm_lpid = pp->p_pid;
778 	ipc_rele(shm_svc, (kipc_perm_t *)sp);	/* Drops lock */
779 
780 	kmem_free(sap, sizeof (segacct_t));
781 }
782 
783 static int
784 shmdt(caddr_t addr)
785 {
786 	proc_t *pp = curproc;
787 	segacct_t *sap, template;
788 
789 	mutex_enter(&pp->p_lock);
790 	prbarrier(pp);			/* block /proc.  See shmgetid(). */
791 
792 	template.sa_addr = addr;
793 	template.sa_len = 0;
794 	if ((pp->p_segacct == NULL) ||
795 	    ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL)) {
796 		mutex_exit(&pp->p_lock);
797 		return (EINVAL);
798 	}
799 	if (sap->sa_addr != addr) {
800 		mutex_exit(&pp->p_lock);
801 		return (EINVAL);
802 	}
803 	avl_remove(pp->p_segacct, sap);
804 	mutex_exit(&pp->p_lock);
805 
806 	shm_detach(pp, sap);
807 
808 	return (0);
809 }
810 
811 /*
812  * Remove all shared memory segments associated with a given zone.
813  * Called by zone_shutdown when the zone is halted.
814  */
815 /*ARGSUSED1*/
816 static void
817 shm_remove_zone(zoneid_t zoneid, void *arg)
818 {
819 	ipc_remove_zone(shm_svc, zoneid);
820 }
821 
822 /*
823  * Shmget (create new shmem) system call.
824  */
825 static int
826 shmget(key_t key, size_t size, int shmflg, uintptr_t *rvp)
827 {
828 	proc_t		*pp = curproc;
829 	kshmid_t	*sp;
830 	kmutex_t	*lock;
831 	int		error;
832 
833 top:
834 	if (error = ipc_get(shm_svc, key, shmflg, (kipc_perm_t **)&sp, &lock))
835 		return (error);
836 
837 	if (!IPC_FREE(&sp->shm_perm)) {
838 		/*
839 		 * A segment with the requested key exists.
840 		 */
841 		if (size > sp->shm_segsz) {
842 			mutex_exit(lock);
843 			return (EINVAL);
844 		}
845 	} else {
846 		/*
847 		 * A new segment should be created.
848 		 */
849 		size_t npages = btopr(size);
850 		size_t rsize = ptob(npages);
851 
852 		/*
853 		 * Check rsize and the per-project and per-zone limit on
854 		 * shared memory.  Checking rsize handles both the size == 0
855 		 * case and the size < ULONG_MAX & PAGEMASK case (i.e.
856 		 * rounding up wraps a size_t).
857 		 */
858 		if (rsize == 0 ||
859 		    (rctl_test(rc_project_shmmax,
860 		    pp->p_task->tk_proj->kpj_rctls, pp, rsize,
861 		    RCA_SAFE) & RCT_DENY) ||
862 		    (rctl_test(rc_zone_shmmax,
863 		    pp->p_zone->zone_rctls, pp, rsize,
864 		    RCA_SAFE) & RCT_DENY)) {
865 
866 			mutex_exit(&pp->p_lock);
867 			mutex_exit(lock);
868 			ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
869 			return (EINVAL);
870 		}
871 		mutex_exit(&pp->p_lock);
872 		mutex_exit(lock);
873 
874 		if (anon_resv(rsize) == 0) {
875 			ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
876 			return (ENOMEM);
877 		}
878 
879 		/*
880 		 * If any new failure points are introduced between the
881 		 * the above anon_resv() and the below ipc_commit_begin(),
882 		 * these failure points will need to unreserve the anon
883 		 * reserved using anon_unresv().
884 		 *
885 		 * Once ipc_commit_begin() is called, the anon reserved
886 		 * above will be automatically unreserved by future calls to
887 		 * ipcs_cleanup() -> shm_dtor() -> shm_rm_amp().  If
888 		 * ipc_commit_begin() fails, it internally calls shm_dtor(),
889 		 * unreserving the above anon, and freeing the below amp.
890 		 */
891 
892 		sp->shm_amp = anonmap_alloc(rsize, rsize, ANON_SLEEP);
893 		sp->shm_amp->a_sp = sp;
894 		/*
895 		 * Store the original user's requested size, in bytes,
896 		 * rather than the page-aligned size.  The former is
897 		 * used for IPC_STAT and shmget() lookups.  The latter
898 		 * is saved in the anon_map structure and is used for
899 		 * calls to the vm layer.
900 		 */
901 		sp->shm_segsz = size;
902 		sp->shm_atime = sp->shm_dtime = 0;
903 		sp->shm_ctime = gethrestime_sec();
904 		sp->shm_lpid = (pid_t)0;
905 		sp->shm_cpid = curproc->p_pid;
906 		sp->shm_ismattch = 0;
907 		sp->shm_sptinfo = NULL;
908 		/*
909 		 * Check limits one last time, push id into global
910 		 * visibility, and update resource usage counts.
911 		 */
912 		if (error = ipc_commit_begin(shm_svc, key, shmflg,
913 		    (kipc_perm_t *)sp)) {
914 			if (error == EAGAIN)
915 				goto top;
916 			return (error);
917 		}
918 
919 		if ((rctl_test(rc_project_shmmax,
920 		    sp->shm_perm.ipc_proj->kpj_rctls, pp, rsize,
921 		    RCA_SAFE) & RCT_DENY) ||
922 		    (rctl_test(rc_zone_shmmax,
923 		    sp->shm_perm.ipc_zone->zone_rctls, pp, rsize,
924 		    RCA_SAFE) & RCT_DENY)) {
925 			ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
926 			return (EINVAL);
927 		}
928 		sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax += rsize;
929 		sp->shm_perm.ipc_zone->zone_shmmax += rsize;
930 
931 		lock = ipc_commit_end(shm_svc, &sp->shm_perm);
932 	}
933 
934 	if (audit_active)
935 		audit_ipcget(AT_IPC_SHM, (void *)sp);
936 
937 	*rvp = (uintptr_t)(sp->shm_perm.ipc_id);
938 
939 	mutex_exit(lock);
940 	return (0);
941 }
942 
943 /*
944  * shmids system call.
945  */
946 static int
947 shmids(int *buf, uint_t nids, uint_t *pnids)
948 {
949 	return (ipc_ids(shm_svc, buf, nids, pnids));
950 }
951 
952 /*
953  * System entry point for shmat, shmctl, shmdt, and shmget system calls.
954  */
955 static uintptr_t
956 shmsys(int opcode, uintptr_t a0, uintptr_t a1, uintptr_t a2)
957 {
958 	int	error;
959 	uintptr_t r_val = 0;
960 
961 	switch (opcode) {
962 	case SHMAT:
963 		error = shmat((int)a0, (caddr_t)a1, (int)a2, &r_val);
964 		break;
965 	case SHMCTL:
966 		error = shmctl((int)a0, (int)a1, (void *)a2);
967 		break;
968 	case SHMDT:
969 		error = shmdt((caddr_t)a0);
970 		break;
971 	case SHMGET:
972 		error = shmget((key_t)a0, (size_t)a1, (int)a2, &r_val);
973 		break;
974 	case SHMIDS:
975 		error = shmids((int *)a0, (uint_t)a1, (uint_t *)a2);
976 		break;
977 	default:
978 		error = EINVAL;
979 		break;
980 	}
981 
982 	if (error)
983 		return ((uintptr_t)set_errno(error));
984 
985 	return (r_val);
986 }
987 
988 /*
989  * segacct_t comparator
990  * This works as expected, with one minor change: the first of two real
991  * segments with equal addresses is considered to be 'greater than' the
992  * second.  We only return equal when searching using a template, in
993  * which case we explicitly set the template segment's length to 0
994  * (which is invalid for a real segment).
995  */
996 static int
997 shm_sacompar(const void *x, const void *y)
998 {
999 	segacct_t *sa1 = (segacct_t *)x;
1000 	segacct_t *sa2 = (segacct_t *)y;
1001 
1002 	if (sa1->sa_addr < sa2->sa_addr) {
1003 		return (-1);
1004 	} else if (sa2->sa_len != 0) {
1005 		if (sa1->sa_addr >= sa2->sa_addr + sa2->sa_len) {
1006 			return (1);
1007 		} else if (sa1->sa_len != 0) {
1008 			return (1);
1009 		} else {
1010 			return (0);
1011 		}
1012 	} else if (sa1->sa_addr > sa2->sa_addr) {
1013 		return (1);
1014 	} else {
1015 		return (0);
1016 	}
1017 }
1018 
1019 /*
1020  * add this record to the segacct list.
1021  */
1022 static void
1023 sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags, kshmid_t *id)
1024 {
1025 	segacct_t *nsap;
1026 	avl_tree_t *tree = NULL;
1027 	avl_index_t where;
1028 
1029 	nsap = kmem_alloc(sizeof (segacct_t), KM_SLEEP);
1030 	nsap->sa_addr = addr;
1031 	nsap->sa_len  = len;
1032 	nsap->sa_flags = flags;
1033 	nsap->sa_id = id;
1034 
1035 	if (pp->p_segacct == NULL)
1036 		tree = kmem_alloc(sizeof (avl_tree_t), KM_SLEEP);
1037 
1038 	mutex_enter(&pp->p_lock);
1039 	prbarrier(pp);			/* block /proc.  See shmgetid(). */
1040 
1041 	if (pp->p_segacct == NULL) {
1042 		avl_create(tree, shm_sacompar, sizeof (segacct_t),
1043 		    offsetof(segacct_t, sa_tree));
1044 		pp->p_segacct = tree;
1045 	} else if (tree) {
1046 		kmem_free(tree, sizeof (avl_tree_t));
1047 	}
1048 
1049 	/*
1050 	 * We can ignore the result of avl_find, as the comparator will
1051 	 * never return equal for segments with non-zero length.  This
1052 	 * is a necessary hack to get around the fact that we do, in
1053 	 * fact, have duplicate keys.
1054 	 */
1055 	(void) avl_find(pp->p_segacct, nsap, &where);
1056 	avl_insert(pp->p_segacct, nsap, where);
1057 
1058 	mutex_exit(&pp->p_lock);
1059 }
1060 
1061 /*
1062  * Duplicate parent's segacct records in child.
1063  */
1064 void
1065 shmfork(struct proc *ppp, struct proc *cpp)
1066 {
1067 	segacct_t *sap;
1068 	kshmid_t *sp;
1069 	kmutex_t *mp;
1070 
1071 	ASSERT(ppp->p_segacct != NULL);
1072 
1073 	/*
1074 	 * We are the only lwp running in the parent so nobody can
1075 	 * mess with our p_segacct list.  Thus it is safe to traverse
1076 	 * the list without holding p_lock.  This is essential because
1077 	 * we can't hold p_lock during a KM_SLEEP allocation.
1078 	 */
1079 	for (sap = (segacct_t *)avl_first(ppp->p_segacct); sap != NULL;
1080 	    sap = (segacct_t *)AVL_NEXT(ppp->p_segacct, sap)) {
1081 		sa_add(cpp, sap->sa_addr, sap->sa_len, sap->sa_flags,
1082 		    sap->sa_id);
1083 		sp = sap->sa_id;
1084 		mp = ipc_lock(shm_svc, sp->shm_perm.ipc_id);
1085 		if (sap->sa_flags & SHMSA_ISM)
1086 			sp->shm_ismattch++;
1087 		ipc_hold(shm_svc, (kipc_perm_t *)sp);
1088 		mutex_exit(mp);
1089 	}
1090 }
1091 
1092 /*
1093  * Detach shared memory segments from exiting process.
1094  */
1095 void
1096 shmexit(struct proc *pp)
1097 {
1098 	segacct_t *sap;
1099 	avl_tree_t *tree;
1100 	void *cookie = NULL;
1101 
1102 	ASSERT(pp->p_segacct != NULL);
1103 
1104 	mutex_enter(&pp->p_lock);
1105 	prbarrier(pp);
1106 	tree = pp->p_segacct;
1107 	pp->p_segacct = NULL;
1108 	mutex_exit(&pp->p_lock);
1109 
1110 	while ((sap = avl_destroy_nodes(tree, &cookie)) != NULL)
1111 		(void) shm_detach(pp, sap);
1112 
1113 	avl_destroy(tree);
1114 	kmem_free(tree, sizeof (avl_tree_t));
1115 }
1116 
1117 /*
1118  * At this time pages should be in memory, so just lock them.
1119  */
1120 static void
1121 lock_again(size_t npages, kshmid_t *sp, struct anon_map *amp)
1122 {
1123 	struct anon *ap;
1124 	struct page *pp;
1125 	struct vnode *vp;
1126 	u_offset_t off;
1127 	ulong_t anon_idx;
1128 	anon_sync_obj_t cookie;
1129 
1130 	mutex_enter(&sp->shm_mlock);
1131 	ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
1132 	for (anon_idx = 0; npages != 0; anon_idx++, npages--) {
1133 
1134 		anon_array_enter(amp, anon_idx, &cookie);
1135 		ap = anon_get_ptr(amp->ahp, anon_idx);
1136 		ASSERT(ap != NULL);
1137 		swap_xlate(ap, &vp, &off);
1138 		anon_array_exit(&cookie);
1139 
1140 		pp = page_lookup(vp, off, SE_SHARED);
1141 		if (pp == NULL) {
1142 			panic("lock_again: page not in the system");
1143 			/*NOTREACHED*/
1144 		}
1145 		/* page should already be locked by caller */
1146 		ASSERT(pp->p_lckcnt > 0);
1147 		(void) page_pp_lock(pp, 0, 0);
1148 		page_unlock(pp);
1149 	}
1150 	ANON_LOCK_EXIT(&amp->a_rwlock);
1151 	mutex_exit(&sp->shm_mlock);
1152 }
1153 
1154 /*
1155  * Attach the shared memory segment to the process
1156  * address space and lock the pages.
1157  */
1158 static int
1159 shmem_lock(kshmid_t *sp, struct anon_map *amp)
1160 {
1161 	size_t npages = btopr(amp->size);
1162 	struct as *as;
1163 	struct segvn_crargs crargs;
1164 	uint_t error;
1165 
1166 	/*
1167 	 * A later ISM/DISM attach may increase the size of the amp, so
1168 	 * cache the number of pages locked for the future shmem_unlock()
1169 	 */
1170 	sp->shm_lkpages = npages;
1171 
1172 	as = as_alloc();
1173 	/* Initialize the create arguments and map the segment */
1174 	crargs = *(struct segvn_crargs *)zfod_argsp;	/* structure copy */
1175 	crargs.offset = (u_offset_t)0;
1176 	crargs.type = MAP_SHARED;
1177 	crargs.amp = amp;
1178 	crargs.prot = PROT_ALL;
1179 	crargs.maxprot = crargs.prot;
1180 	crargs.flags = 0;
1181 	error = as_map(as, 0x0, amp->size, segvn_create, &crargs);
1182 	if (!error) {
1183 		if ((error = as_ctl(as, 0x0, amp->size, MC_LOCK, 0, 0,
1184 		    NULL, 0)) == 0) {
1185 			lock_again(npages, sp, amp);
1186 		}
1187 		(void) as_unmap(as, 0x0, amp->size);
1188 	}
1189 	as_free(as);
1190 	return (error);
1191 }
1192 
1193 
1194 /*
1195  * Unlock shared memory
1196  */
1197 static void
1198 shmem_unlock(kshmid_t *sp, struct anon_map *amp)
1199 {
1200 	struct anon *ap;
1201 	pgcnt_t npages = sp->shm_lkpages;
1202 	struct vnode *vp;
1203 	struct page *pp;
1204 	u_offset_t off;
1205 	ulong_t anon_idx;
1206 	size_t unlocked_bytes = 0;
1207 	kproject_t	*proj;
1208 	anon_sync_obj_t cookie;
1209 
1210 	proj = sp->shm_perm.ipc_proj;
1211 	mutex_enter(&sp->shm_mlock);
1212 	ANON_LOCK_ENTER(&amp->a_rwlock, RW_READER);
1213 	for (anon_idx = 0; anon_idx < npages; anon_idx++) {
1214 
1215 		anon_array_enter(amp, anon_idx, &cookie);
1216 		if ((ap = anon_get_ptr(amp->ahp, anon_idx)) == NULL) {
1217 			panic("shmem_unlock: null app");
1218 			/*NOTREACHED*/
1219 		}
1220 		swap_xlate(ap, &vp, &off);
1221 		anon_array_exit(&cookie);
1222 		pp = page_lookup(vp, off, SE_SHARED);
1223 		if (pp == NULL) {
1224 			panic("shmem_unlock: page not in the system");
1225 			/*NOTREACHED*/
1226 		}
1227 		/*
1228 		 * Page should at least have once lock from previous
1229 		 * shmem_lock
1230 		 */
1231 		ASSERT(pp->p_lckcnt > 0);
1232 		page_pp_unlock(pp, 0, 0);
1233 		if (pp->p_lckcnt == 0)
1234 			unlocked_bytes += PAGESIZE;
1235 
1236 		page_unlock(pp);
1237 	}
1238 
1239 	if (unlocked_bytes > 0) {
1240 		rctl_decr_locked_mem(NULL, proj, unlocked_bytes, 0);
1241 	}
1242 
1243 	ANON_LOCK_EXIT(&amp->a_rwlock);
1244 	mutex_exit(&sp->shm_mlock);
1245 }
1246 
1247 /*
1248  * We call this routine when we have removed all references to this
1249  * amp.  This means all shmdt()s and the IPC_RMID have been done.
1250  */
1251 static void
1252 shm_rm_amp(kshmid_t *sp)
1253 {
1254 	struct anon_map *amp = sp->shm_amp;
1255 	zone_t *zone;
1256 
1257 	zone = sp->shm_perm.ipc_zone;
1258 	ASSERT(zone != NULL);
1259 	/*
1260 	 * Free up the anon_map.
1261 	 */
1262 	lgrp_shm_policy_fini(amp, NULL);
1263 	ANON_LOCK_ENTER(&amp->a_rwlock, RW_WRITER);
1264 	anonmap_purge(amp);
1265 	if (amp->a_szc != 0) {
1266 		anon_shmap_free_pages(amp, 0, amp->size);
1267 	} else {
1268 		anon_free(amp->ahp, 0, amp->size);
1269 	}
1270 	ANON_LOCK_EXIT(&amp->a_rwlock);
1271 	anon_unresv_zone(amp->swresv, zone);
1272 	anonmap_free(amp);
1273 }
1274 
1275 /*
1276  * Return the shared memory id for the process's virtual address.
1277  * Return SHMID_NONE if addr is not within a SysV shared memory segment.
1278  * Return SHMID_FREE if addr's SysV shared memory segment's id has been freed.
1279  *
1280  * shmgetid() is called from code in /proc with the process locked but
1281  * with pp->p_lock not held.  The address space lock is held, so we
1282  * cannot grab pp->p_lock here due to lock-ordering constraints.
1283  * Because of all this, modifications to the p_segacct list must only
1284  * be made after calling prbarrier() to ensure the process is not locked.
1285  * See shmdt() and sa_add(), above. shmgetid() may also be called on a
1286  * thread's own process without the process locked.
1287  */
1288 int
1289 shmgetid(proc_t *pp, caddr_t addr)
1290 {
1291 	segacct_t *sap, template;
1292 
1293 	ASSERT(MUTEX_NOT_HELD(&pp->p_lock));
1294 	ASSERT((pp->p_proc_flag & P_PR_LOCK) || pp == curproc);
1295 
1296 	if (pp->p_segacct == NULL)
1297 		return (SHMID_NONE);
1298 
1299 	template.sa_addr = addr;
1300 	template.sa_len = 0;
1301 	if ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL)
1302 		return (SHMID_NONE);
1303 
1304 	if (IPC_FREE(&sap->sa_id->shm_perm))
1305 		return (SHMID_FREE);
1306 
1307 	return (sap->sa_id->shm_perm.ipc_id);
1308 }
1309