1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22/* 23 * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26/* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27/* All Rights Reserved */ 28 29/* 30 * University Copyright- Copyright (c) 1982, 1986, 1988 31 * The Regents of the University of California 32 * All Rights Reserved 33 * 34 * University Acknowledgment- Portions of this document are derived from 35 * software developed by the University of California, Berkeley, and its 36 * contributors. 37 */ 38 39/* 40 * Inter-Process Communication Shared Memory Facility. 41 * 42 * See os/ipc.c for a description of common IPC functionality. 43 * 44 * Resource controls 45 * ----------------- 46 * 47 * Control: zone.max-shm-ids (rc_zone_shmmni) 48 * Description: Maximum number of shared memory ids allowed a zone. 49 * 50 * When shmget() is used to allocate a shared memory segment, one id 51 * is allocated. If the id allocation doesn't succeed, shmget() 52 * fails and errno is set to ENOSPC. Upon successful shmctl(, 53 * IPC_RMID) the id is deallocated. 54 * 55 * Control: project.max-shm-ids (rc_project_shmmni) 56 * Description: Maximum number of shared memory ids allowed a project. 57 * 58 * When shmget() is used to allocate a shared memory segment, one id 59 * is allocated. If the id allocation doesn't succeed, shmget() 60 * fails and errno is set to ENOSPC. Upon successful shmctl(, 61 * IPC_RMID) the id is deallocated. 62 * 63 * Control: zone.max-shm-memory (rc_zone_shmmax) 64 * Description: Total amount of shared memory allowed a zone. 65 * 66 * When shmget() is used to allocate a shared memory segment, the 67 * segment's size is allocated against this limit. If the space 68 * allocation doesn't succeed, shmget() fails and errno is set to 69 * EINVAL. The size will be deallocated once the last process has 70 * detached the segment and the segment has been successfully 71 * shmctl(, IPC_RMID)ed. 72 * 73 * Control: project.max-shm-memory (rc_project_shmmax) 74 * Description: Total amount of shared memory allowed a project. 75 * 76 * When shmget() is used to allocate a shared memory segment, the 77 * segment's size is allocated against this limit. If the space 78 * allocation doesn't succeed, shmget() fails and errno is set to 79 * EINVAL. The size will be deallocated once the last process has 80 * detached the segment and the segment has been successfully 81 * shmctl(, IPC_RMID)ed. 82 */ 83 84#include <sys/types.h> 85#include <sys/param.h> 86#include <sys/cred.h> 87#include <sys/errno.h> 88#include <sys/time.h> 89#include <sys/kmem.h> 90#include <sys/user.h> 91#include <sys/proc.h> 92#include <sys/systm.h> 93#include <sys/prsystm.h> 94#include <sys/sysmacros.h> 95#include <sys/tuneable.h> 96#include <sys/vm.h> 97#include <sys/mman.h> 98#include <sys/swap.h> 99#include <sys/cmn_err.h> 100#include <sys/debug.h> 101#include <sys/lwpchan_impl.h> 102#include <sys/avl.h> 103#include <sys/modctl.h> 104#include <sys/syscall.h> 105#include <sys/task.h> 106#include <sys/project.h> 107#include <sys/policy.h> 108#include <sys/zone.h> 109#include <sys/rctl.h> 110 111#include <sys/ipc.h> 112#include <sys/ipc_impl.h> 113#include <sys/shm.h> 114#include <sys/shm_impl.h> 115 116#include <vm/hat.h> 117#include <vm/seg.h> 118#include <vm/as.h> 119#include <vm/seg_vn.h> 120#include <vm/anon.h> 121#include <vm/page.h> 122#include <vm/vpage.h> 123#include <vm/seg_spt.h> 124 125#include <c2/audit.h> 126 127static int shmem_lock(kshmid_t *sp, struct anon_map *amp); 128static void shmem_unlock(kshmid_t *sp, struct anon_map *amp); 129static void sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags, 130 kshmid_t *id); 131static void shm_rm_amp(kshmid_t *sp); 132static void shm_dtor(kipc_perm_t *); 133static void shm_rmid(kipc_perm_t *); 134static void shm_remove_zone(zoneid_t, void *); 135 136/* 137 * Semantics for share_page_table and ism_off: 138 * 139 * These are hooks in /etc/system - only for internal testing purpose. 140 * 141 * Setting share_page_table automatically turns on the SHM_SHARE_MMU (ISM) flag 142 * in a call to shmat(2). In other words, with share_page_table set, you always 143 * get ISM, even if say, DISM is specified. It should really be called "ism_on". 144 * 145 * Setting ism_off turns off the SHM_SHARE_MMU flag from the flags passed to 146 * shmat(2). 147 * 148 * If both share_page_table and ism_off are set, share_page_table prevails. 149 * 150 * Although these tunables should probably be removed, they do have some 151 * external exposure; as long as they exist, they should at least work sensibly. 152 */ 153 154int share_page_table; 155int ism_off; 156 157/* 158 * The following tunables are obsolete. Though for compatibility we 159 * still read and interpret shminfo_shmmax and shminfo_shmmni (see 160 * os/project.c), the preferred mechanism for administrating the IPC 161 * Shared Memory facility is through the resource controls described at 162 * the top of this file. 163 */ 164size_t shminfo_shmmax = 0x800000; /* (obsolete) */ 165int shminfo_shmmni = 100; /* (obsolete) */ 166size_t shminfo_shmmin = 1; /* (obsolete) */ 167int shminfo_shmseg = 6; /* (obsolete) */ 168 169extern rctl_hndl_t rc_zone_shmmax; 170extern rctl_hndl_t rc_zone_shmmni; 171extern rctl_hndl_t rc_project_shmmax; 172extern rctl_hndl_t rc_project_shmmni; 173static ipc_service_t *shm_svc; 174static zone_key_t shm_zone_key; 175 176/* 177 * Module linkage information for the kernel. 178 */ 179static uintptr_t shmsys(int, uintptr_t, uintptr_t, uintptr_t); 180 181static struct sysent ipcshm_sysent = { 182 4, 183#ifdef _SYSCALL32_IMPL 184 SE_ARGC | SE_NOUNLOAD | SE_64RVAL, 185#else /* _SYSCALL32_IMPL */ 186 SE_ARGC | SE_NOUNLOAD | SE_32RVAL1, 187#endif /* _SYSCALL32_IMPL */ 188 (int (*)())shmsys 189}; 190 191#ifdef _SYSCALL32_IMPL 192static struct sysent ipcshm_sysent32 = { 193 4, 194 SE_ARGC | SE_NOUNLOAD | SE_32RVAL1, 195 (int (*)())shmsys 196}; 197#endif /* _SYSCALL32_IMPL */ 198 199static struct modlsys modlsys = { 200 &mod_syscallops, "System V shared memory", &ipcshm_sysent 201}; 202 203#ifdef _SYSCALL32_IMPL 204static struct modlsys modlsys32 = { 205 &mod_syscallops32, "32-bit System V shared memory", &ipcshm_sysent32 206}; 207#endif /* _SYSCALL32_IMPL */ 208 209static struct modlinkage modlinkage = { 210 MODREV_1, 211 &modlsys, 212#ifdef _SYSCALL32_IMPL 213 &modlsys32, 214#endif 215 NULL 216}; 217 218 219int 220_init(void) 221{ 222 int result; 223 224 shm_svc = ipcs_create("shmids", rc_project_shmmni, rc_zone_shmmni, 225 sizeof (kshmid_t), shm_dtor, shm_rmid, AT_IPC_SHM, 226 offsetof(ipc_rqty_t, ipcq_shmmni)); 227 zone_key_create(&shm_zone_key, NULL, shm_remove_zone, NULL); 228 229 if ((result = mod_install(&modlinkage)) == 0) 230 return (0); 231 232 (void) zone_key_delete(shm_zone_key); 233 ipcs_destroy(shm_svc); 234 235 return (result); 236} 237 238int 239_fini(void) 240{ 241 return (EBUSY); 242} 243 244int 245_info(struct modinfo *modinfop) 246{ 247 return (mod_info(&modlinkage, modinfop)); 248} 249 250/* 251 * Shmat (attach shared segment) system call. 252 */ 253static int 254shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp) 255{ 256 kshmid_t *sp; /* shared memory header ptr */ 257 size_t size; 258 int error = 0; 259 proc_t *pp = curproc; 260 struct as *as = pp->p_as; 261 struct segvn_crargs crargs; /* segvn create arguments */ 262 kmutex_t *lock; 263 struct seg *segspt = NULL; 264 caddr_t addr = uaddr; 265 int flags = (uflags & SHMAT_VALID_FLAGS_MASK); 266 int useISM; 267 uchar_t prot = PROT_ALL; 268 int result; 269 270 if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL) 271 return (EINVAL); 272 if (error = ipcperm_access(&sp->shm_perm, SHM_R, CRED())) 273 goto errret; 274 if ((flags & SHM_RDONLY) == 0 && 275 (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED()))) 276 goto errret; 277 if (spt_invalid(flags)) { 278 error = EINVAL; 279 goto errret; 280 } 281 if (ism_off) 282 flags = flags & ~SHM_SHARE_MMU; 283 if (share_page_table) { 284 flags = flags & ~SHM_PAGEABLE; 285 flags = flags | SHM_SHARE_MMU; 286 } 287 useISM = (spt_locked(flags) || spt_pageable(flags)); 288 if (useISM && (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED()))) 289 goto errret; 290 if (useISM && isspt(sp)) { 291 uint_t newsptflags = flags | spt_flags(sp->shm_sptseg); 292 /* 293 * If trying to change an existing {D}ISM segment from ISM 294 * to DISM or vice versa, return error. Note that this 295 * validation of flags needs to be done after the effect of 296 * tunables such as ism_off and share_page_table, for 297 * semantics that are consistent with the tunables' settings. 298 */ 299 if (spt_invalid(newsptflags)) { 300 error = EINVAL; 301 goto errret; 302 } 303 } 304 ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER); 305 size = sp->shm_amp->size; 306 ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock); 307 308 /* somewhere to record spt info for final detach */ 309 if (sp->shm_sptinfo == NULL) 310 sp->shm_sptinfo = kmem_zalloc(sizeof (sptinfo_t), KM_SLEEP); 311 312 as_rangelock(as); 313 314 if (useISM) { 315 /* 316 * Handle ISM 317 */ 318 uint_t share_szc; 319 size_t share_size; 320 struct shm_data ssd; 321 uintptr_t align_hint; 322 323 /* 324 * Pick a share pagesize to use, if (!isspt(sp)). 325 * Otherwise use the already chosen page size. 326 * 327 * For the initial shmat (!isspt(sp)), where sptcreate is 328 * called, map_pgsz is called to recommend a [D]ISM pagesize, 329 * important for systems which offer more than one potential 330 * [D]ISM pagesize. 331 * If the shmat is just to attach to an already created 332 * [D]ISM segment, then use the previously selected page size. 333 */ 334 if (!isspt(sp)) { 335 share_size = map_pgsz(MAPPGSZ_ISM, pp, addr, size, 0); 336 if (share_size == 0) { 337 as_rangeunlock(as); 338 error = EINVAL; 339 goto errret; 340 } 341 share_szc = page_szc(share_size); 342 } else { 343 share_szc = sp->shm_sptseg->s_szc; 344 share_size = page_get_pagesize(share_szc); 345 } 346 size = P2ROUNDUP(size, share_size); 347 348 align_hint = share_size; 349#if defined(__i386) || defined(__amd64) 350 /* 351 * For x86, we want to share as much of the page table tree 352 * as possible. We use a large align_hint at first, but 353 * if that fails, then the code below retries with align_hint 354 * set to share_size. 355 * 356 * The explicit extern here is due to the difficulties 357 * of getting to platform dependent includes. When/if the 358 * platform dependent bits of this function are cleaned up, 359 * another way of doing this should found. 360 */ 361 { 362 extern uint_t ptes_per_table; 363 364 while (size >= ptes_per_table * (uint64_t)align_hint) 365 align_hint *= ptes_per_table; 366 } 367#endif /* __i386 || __amd64 */ 368 369#if defined(__sparcv9) 370 if (addr == 0 && 371 pp->p_model == DATAMODEL_LP64 && AS_TYPE_64BIT(as)) { 372 /* 373 * If no address has been passed in, and this is a 374 * 64-bit process, we'll try to find an address 375 * in the predict-ISM zone. 376 */ 377 caddr_t predbase = (caddr_t)PREDISM_1T_BASE; 378 size_t len = PREDISM_BOUND - PREDISM_1T_BASE; 379 380 as_purge(as); 381 if (as_gap(as, size + share_size, &predbase, &len, 382 AH_LO, (caddr_t)NULL) != -1) { 383 /* 384 * We found an address which looks like a 385 * candidate. We want to round it up, and 386 * then check that it's a valid user range. 387 * This assures that we won't fail below. 388 */ 389 addr = (caddr_t)P2ROUNDUP((uintptr_t)predbase, 390 share_size); 391 392 if (valid_usr_range(addr, size, prot, 393 as, as->a_userlimit) != RANGE_OKAY) { 394 addr = 0; 395 } 396 } 397 } 398#endif /* __sparcv9 */ 399 400 if (addr == 0) { 401 for (;;) { 402 addr = (caddr_t)align_hint; 403 map_addr(&addr, size, 0ll, 1, MAP_ALIGN); 404 if (addr != NULL || align_hint == share_size) 405 break; 406 align_hint = share_size; 407 } 408 if (addr == NULL) { 409 as_rangeunlock(as); 410 error = ENOMEM; 411 goto errret; 412 } 413 ASSERT(((uintptr_t)addr & (align_hint - 1)) == 0); 414 } else { 415 /* Use the user-supplied attach address */ 416 caddr_t base; 417 size_t len; 418 419 /* 420 * Check that the address range 421 * 1) is properly aligned 422 * 2) is correct in unix terms 423 * 3) is within an unmapped address segment 424 */ 425 base = addr; 426 len = size; /* use spt aligned size */ 427 /* XXX - in SunOS, is sp->shm_segsz */ 428 if ((uintptr_t)base & (share_size - 1)) { 429 error = EINVAL; 430 as_rangeunlock(as); 431 goto errret; 432 } 433 result = valid_usr_range(base, len, prot, as, 434 as->a_userlimit); 435 if (result == RANGE_BADPROT) { 436 /* 437 * We try to accomodate processors which 438 * may not support execute permissions on 439 * all ISM segments by trying the check 440 * again but without PROT_EXEC. 441 */ 442 prot &= ~PROT_EXEC; 443 result = valid_usr_range(base, len, prot, as, 444 as->a_userlimit); 445 } 446 as_purge(as); 447 if (result != RANGE_OKAY || 448 as_gap(as, len, &base, &len, AH_LO, 449 (caddr_t)NULL) != 0) { 450 error = EINVAL; 451 as_rangeunlock(as); 452 goto errret; 453 } 454 } 455 456 if (!isspt(sp)) { 457 error = sptcreate(size, &segspt, sp->shm_amp, prot, 458 flags, share_szc); 459 if (error) { 460 as_rangeunlock(as); 461 goto errret; 462 } 463 sp->shm_sptinfo->sptas = segspt->s_as; 464 sp->shm_sptseg = segspt; 465 sp->shm_sptprot = prot; 466 } else if ((prot & sp->shm_sptprot) != sp->shm_sptprot) { 467 /* 468 * Ensure we're attaching to an ISM segment with 469 * fewer or equal permissions than what we're 470 * allowed. Fail if the segment has more 471 * permissions than what we're allowed. 472 */ 473 error = EACCES; 474 as_rangeunlock(as); 475 goto errret; 476 } 477 478 ssd.shm_sptseg = sp->shm_sptseg; 479 ssd.shm_sptas = sp->shm_sptinfo->sptas; 480 ssd.shm_amp = sp->shm_amp; 481 error = as_map(as, addr, size, segspt_shmattach, &ssd); 482 if (error == 0) 483 sp->shm_ismattch++; /* keep count of ISM attaches */ 484 } else { 485 486 /* 487 * Normal case. 488 */ 489 if (flags & SHM_RDONLY) 490 prot &= ~PROT_WRITE; 491 492 if (addr == 0) { 493 /* Let the system pick the attach address */ 494 map_addr(&addr, size, 0ll, 1, 0); 495 if (addr == NULL) { 496 as_rangeunlock(as); 497 error = ENOMEM; 498 goto errret; 499 } 500 } else { 501 /* Use the user-supplied attach address */ 502 caddr_t base; 503 size_t len; 504 505 if (flags & SHM_RND) 506 addr = (caddr_t)((uintptr_t)addr & 507 ~(SHMLBA - 1)); 508 /* 509 * Check that the address range 510 * 1) is properly aligned 511 * 2) is correct in unix terms 512 * 3) is within an unmapped address segment 513 */ 514 base = addr; 515 len = size; /* use aligned size */ 516 /* XXX - in SunOS, is sp->shm_segsz */ 517 if ((uintptr_t)base & PAGEOFFSET) { 518 error = EINVAL; 519 as_rangeunlock(as); 520 goto errret; 521 } 522 result = valid_usr_range(base, len, prot, as, 523 as->a_userlimit); 524 if (result == RANGE_BADPROT) { 525 prot &= ~PROT_EXEC; 526 result = valid_usr_range(base, len, prot, as, 527 as->a_userlimit); 528 } 529 as_purge(as); 530 if (result != RANGE_OKAY || 531 as_gap(as, len, &base, &len, 532 AH_LO, (caddr_t)NULL) != 0) { 533 error = EINVAL; 534 as_rangeunlock(as); 535 goto errret; 536 } 537 } 538 539 /* Initialize the create arguments and map the segment */ 540 crargs = *(struct segvn_crargs *)zfod_argsp; 541 crargs.offset = 0; 542 crargs.type = MAP_SHARED; 543 crargs.amp = sp->shm_amp; 544 crargs.prot = prot; 545 crargs.maxprot = crargs.prot; 546 crargs.flags = 0; 547 548 error = as_map(as, addr, size, segvn_create, &crargs); 549 } 550 551 as_rangeunlock(as); 552 if (error) 553 goto errret; 554 555 /* record shmem range for the detach */ 556 sa_add(pp, addr, (size_t)size, useISM ? SHMSA_ISM : 0, sp); 557 *rvp = (uintptr_t)addr; 558 559 sp->shm_atime = gethrestime_sec(); 560 sp->shm_lpid = pp->p_pid; 561 ipc_hold(shm_svc, (kipc_perm_t *)sp); 562 563 /* 564 * Tell machine specific code that lwp has mapped shared memory 565 */ 566 LWP_MMODEL_SHARED_AS(addr, size); 567 568errret: 569 mutex_exit(lock); 570 return (error); 571} 572 573static void 574shm_dtor(kipc_perm_t *perm) 575{ 576 kshmid_t *sp = (kshmid_t *)perm; 577 uint_t cnt; 578 size_t rsize; 579 580 ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER); 581 anonmap_purge(sp->shm_amp); 582 ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock); 583 584 if (sp->shm_sptinfo) { 585 if (isspt(sp)) { 586 sptdestroy(sp->shm_sptinfo->sptas, sp->shm_amp); 587 sp->shm_lkcnt = 0; 588 } 589 kmem_free(sp->shm_sptinfo, sizeof (sptinfo_t)); 590 } 591 592 if (sp->shm_lkcnt > 0) { 593 shmem_unlock(sp, sp->shm_amp); 594 sp->shm_lkcnt = 0; 595 } 596 597 ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER); 598 cnt = --sp->shm_amp->refcnt; 599 ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock); 600 ASSERT(cnt == 0); 601 shm_rm_amp(sp); 602 603 if (sp->shm_perm.ipc_id != IPC_ID_INVAL) { 604 rsize = ptob(btopr(sp->shm_segsz)); 605 ipcs_lock(shm_svc); 606 sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax -= rsize; 607 sp->shm_perm.ipc_zone_ref.zref_zone->zone_shmmax -= rsize; 608 ipcs_unlock(shm_svc); 609 } 610} 611 612/* ARGSUSED */ 613static void 614shm_rmid(kipc_perm_t *perm) 615{ 616 /* nothing to do */ 617} 618 619/* 620 * Shmctl system call. 621 */ 622/* ARGSUSED */ 623static int 624shmctl(int shmid, int cmd, void *arg) 625{ 626 kshmid_t *sp; /* shared memory header ptr */ 627 STRUCT_DECL(shmid_ds, ds); /* for SVR4 IPC_SET */ 628 int error = 0; 629 struct cred *cr = CRED(); 630 kmutex_t *lock; 631 model_t mdl = get_udatamodel(); 632 struct shmid_ds64 ds64; 633 shmatt_t nattch; 634 635 STRUCT_INIT(ds, mdl); 636 637 /* 638 * Perform pre- or non-lookup actions (e.g. copyins, RMID). 639 */ 640 switch (cmd) { 641 case IPC_SET: 642 if (copyin(arg, STRUCT_BUF(ds), STRUCT_SIZE(ds))) 643 return (EFAULT); 644 break; 645 646 case IPC_SET64: 647 if (copyin(arg, &ds64, sizeof (struct shmid_ds64))) 648 return (EFAULT); 649 break; 650 651 case IPC_RMID: 652 return (ipc_rmid(shm_svc, shmid, cr)); 653 } 654 655 if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL) 656 return (EINVAL); 657 658 switch (cmd) { 659 /* Set ownership and permissions. */ 660 case IPC_SET: 661 if (error = ipcperm_set(shm_svc, cr, &sp->shm_perm, 662 &STRUCT_BUF(ds)->shm_perm, mdl)) 663 break; 664 sp->shm_ctime = gethrestime_sec(); 665 break; 666 667 case IPC_STAT: 668 if (error = ipcperm_access(&sp->shm_perm, SHM_R, cr)) 669 break; 670 671 nattch = sp->shm_perm.ipc_ref - 1; 672 673 ipcperm_stat(&STRUCT_BUF(ds)->shm_perm, &sp->shm_perm, mdl); 674 STRUCT_FSET(ds, shm_segsz, sp->shm_segsz); 675 STRUCT_FSETP(ds, shm_amp, NULL); /* kernel addr */ 676 STRUCT_FSET(ds, shm_lkcnt, sp->shm_lkcnt); 677 STRUCT_FSET(ds, shm_lpid, sp->shm_lpid); 678 STRUCT_FSET(ds, shm_cpid, sp->shm_cpid); 679 STRUCT_FSET(ds, shm_nattch, nattch); 680 STRUCT_FSET(ds, shm_cnattch, sp->shm_ismattch); 681 STRUCT_FSET(ds, shm_atime, sp->shm_atime); 682 STRUCT_FSET(ds, shm_dtime, sp->shm_dtime); 683 STRUCT_FSET(ds, shm_ctime, sp->shm_ctime); 684 685 mutex_exit(lock); 686 if (copyout(STRUCT_BUF(ds), arg, STRUCT_SIZE(ds))) 687 return (EFAULT); 688 689 return (0); 690 691 case IPC_SET64: 692 if (error = ipcperm_set64(shm_svc, cr, 693 &sp->shm_perm, &ds64.shmx_perm)) 694 break; 695 sp->shm_ctime = gethrestime_sec(); 696 break; 697 698 case IPC_STAT64: 699 nattch = sp->shm_perm.ipc_ref - 1; 700 701 ipcperm_stat64(&ds64.shmx_perm, &sp->shm_perm); 702 ds64.shmx_segsz = sp->shm_segsz; 703 ds64.shmx_lkcnt = sp->shm_lkcnt; 704 ds64.shmx_lpid = sp->shm_lpid; 705 ds64.shmx_cpid = sp->shm_cpid; 706 ds64.shmx_nattch = nattch; 707 ds64.shmx_cnattch = sp->shm_ismattch; 708 ds64.shmx_atime = sp->shm_atime; 709 ds64.shmx_dtime = sp->shm_dtime; 710 ds64.shmx_ctime = sp->shm_ctime; 711 712 mutex_exit(lock); 713 if (copyout(&ds64, arg, sizeof (struct shmid_ds64))) 714 return (EFAULT); 715 716 return (0); 717 718 /* Lock segment in memory */ 719 case SHM_LOCK: 720 if ((error = secpolicy_lock_memory(cr)) != 0) 721 break; 722 723 /* protect against overflow */ 724 if (sp->shm_lkcnt >= USHRT_MAX) { 725 error = ENOMEM; 726 break; 727 } 728 if (!isspt(sp) && (sp->shm_lkcnt++ == 0)) { 729 if (error = shmem_lock(sp, sp->shm_amp)) { 730 ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, 731 RW_WRITER); 732 cmn_err(CE_NOTE, "shmctl - couldn't lock %ld" 733 " pages into memory", sp->shm_amp->size); 734 ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock); 735 error = ENOMEM; 736 sp->shm_lkcnt--; 737 } 738 } 739 break; 740 741 /* Unlock segment */ 742 case SHM_UNLOCK: 743 if ((error = secpolicy_lock_memory(cr)) != 0) 744 break; 745 746 if (sp->shm_lkcnt && (--sp->shm_lkcnt == 0)) { 747 shmem_unlock(sp, sp->shm_amp); 748 } 749 break; 750 751 default: 752 error = EINVAL; 753 break; 754 } 755 mutex_exit(lock); 756 return (error); 757} 758 759static void 760shm_detach(proc_t *pp, segacct_t *sap) 761{ 762 kshmid_t *sp = sap->sa_id; 763 size_t len = sap->sa_len; 764 caddr_t addr = sap->sa_addr; 765 766 /* 767 * Discard lwpchan mappings. 768 */ 769 if (pp->p_lcp != NULL) 770 lwpchan_delete_mapping(pp, addr, addr + len); 771 (void) as_unmap(pp->p_as, addr, len); 772 773 /* 774 * Perform some detach-time accounting. 775 */ 776 (void) ipc_lock(shm_svc, sp->shm_perm.ipc_id); 777 if (sap->sa_flags & SHMSA_ISM) 778 sp->shm_ismattch--; 779 sp->shm_dtime = gethrestime_sec(); 780 sp->shm_lpid = pp->p_pid; 781 ipc_rele(shm_svc, (kipc_perm_t *)sp); /* Drops lock */ 782 783 kmem_free(sap, sizeof (segacct_t)); 784} 785 786static int 787shmdt(caddr_t addr) 788{ 789 proc_t *pp = curproc; 790 segacct_t *sap, template; 791 792 mutex_enter(&pp->p_lock); 793 prbarrier(pp); /* block /proc. See shmgetid(). */ 794 795 template.sa_addr = addr; 796 template.sa_len = 0; 797 if ((pp->p_segacct == NULL) || 798 ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL)) { 799 mutex_exit(&pp->p_lock); 800 return (EINVAL); 801 } 802 if (sap->sa_addr != addr) { 803 mutex_exit(&pp->p_lock); 804 return (EINVAL); 805 } 806 avl_remove(pp->p_segacct, sap); 807 mutex_exit(&pp->p_lock); 808 809 shm_detach(pp, sap); 810 811 return (0); 812} 813 814/* 815 * Remove all shared memory segments associated with a given zone. 816 * Called by zone_shutdown when the zone is halted. 817 */ 818/*ARGSUSED1*/ 819static void 820shm_remove_zone(zoneid_t zoneid, void *arg) 821{ 822 ipc_remove_zone(shm_svc, zoneid); 823} 824 825/* 826 * Shmget (create new shmem) system call. 827 */ 828static int 829shmget(key_t key, size_t size, int shmflg, uintptr_t *rvp) 830{ 831 proc_t *pp = curproc; 832 kshmid_t *sp; 833 kmutex_t *lock; 834 int error; 835 836top: 837 if (error = ipc_get(shm_svc, key, shmflg, (kipc_perm_t **)&sp, &lock)) 838 return (error); 839 840 if (!IPC_FREE(&sp->shm_perm)) { 841 /* 842 * A segment with the requested key exists. 843 */ 844 if (size > sp->shm_segsz) { 845 mutex_exit(lock); 846 return (EINVAL); 847 } 848 } else { 849 /* 850 * A new segment should be created. 851 */ 852 size_t npages = btopr(size); 853 size_t rsize = ptob(npages); 854 855 /* 856 * Check rsize and the per-project and per-zone limit on 857 * shared memory. Checking rsize handles both the size == 0 858 * case and the size < ULONG_MAX & PAGEMASK case (i.e. 859 * rounding up wraps a size_t). 860 */ 861 if (rsize == 0 || 862 (rctl_test(rc_project_shmmax, 863 pp->p_task->tk_proj->kpj_rctls, pp, rsize, 864 RCA_SAFE) & RCT_DENY) || 865 (rctl_test(rc_zone_shmmax, 866 pp->p_zone->zone_rctls, pp, rsize, 867 RCA_SAFE) & RCT_DENY)) { 868 869 mutex_exit(&pp->p_lock); 870 mutex_exit(lock); 871 ipc_cleanup(shm_svc, (kipc_perm_t *)sp); 872 return (EINVAL); 873 } 874 mutex_exit(&pp->p_lock); 875 mutex_exit(lock); 876 877 if (anon_resv(rsize) == 0) { 878 ipc_cleanup(shm_svc, (kipc_perm_t *)sp); 879 return (ENOMEM); 880 } 881 882 /* 883 * If any new failure points are introduced between the 884 * the above anon_resv() and the below ipc_commit_begin(), 885 * these failure points will need to unreserve the anon 886 * reserved using anon_unresv(). 887 * 888 * Once ipc_commit_begin() is called, the anon reserved 889 * above will be automatically unreserved by future calls to 890 * ipcs_cleanup() -> shm_dtor() -> shm_rm_amp(). If 891 * ipc_commit_begin() fails, it internally calls shm_dtor(), 892 * unreserving the above anon, and freeing the below amp. 893 */ 894 895 sp->shm_amp = anonmap_alloc(rsize, rsize, ANON_SLEEP); 896 sp->shm_amp->a_sp = sp; 897 /* 898 * Store the original user's requested size, in bytes, 899 * rather than the page-aligned size. The former is 900 * used for IPC_STAT and shmget() lookups. The latter 901 * is saved in the anon_map structure and is used for 902 * calls to the vm layer. 903 */ 904 sp->shm_segsz = size; 905 sp->shm_atime = sp->shm_dtime = 0; 906 sp->shm_ctime = gethrestime_sec(); 907 sp->shm_lpid = (pid_t)0; 908 sp->shm_cpid = curproc->p_pid; 909 sp->shm_ismattch = 0; 910 sp->shm_sptinfo = NULL; 911 /* 912 * Check limits one last time, push id into global 913 * visibility, and update resource usage counts. 914 */ 915 if (error = ipc_commit_begin(shm_svc, key, shmflg, 916 (kipc_perm_t *)sp)) { 917 if (error == EAGAIN) 918 goto top; 919 return (error); 920 } 921 922 if ((rctl_test(rc_project_shmmax, 923 sp->shm_perm.ipc_proj->kpj_rctls, pp, rsize, 924 RCA_SAFE) & RCT_DENY) || 925 (rctl_test(rc_zone_shmmax, 926 sp->shm_perm.ipc_zone_ref.zref_zone->zone_rctls, pp, rsize, 927 RCA_SAFE) & RCT_DENY)) { 928 ipc_cleanup(shm_svc, (kipc_perm_t *)sp); 929 return (EINVAL); 930 } 931 sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax += rsize; 932 sp->shm_perm.ipc_zone_ref.zref_zone->zone_shmmax += rsize; 933 934 lock = ipc_commit_end(shm_svc, &sp->shm_perm); 935 } 936 937 if (AU_AUDITING()) 938 audit_ipcget(AT_IPC_SHM, (void *)sp); 939 940 *rvp = (uintptr_t)(sp->shm_perm.ipc_id); 941 942 mutex_exit(lock); 943 return (0); 944} 945 946/* 947 * shmids system call. 948 */ 949static int 950shmids(int *buf, uint_t nids, uint_t *pnids) 951{ 952 return (ipc_ids(shm_svc, buf, nids, pnids)); 953} 954 955/* 956 * System entry point for shmat, shmctl, shmdt, and shmget system calls. 957 */ 958static uintptr_t 959shmsys(int opcode, uintptr_t a0, uintptr_t a1, uintptr_t a2) 960{ 961 int error; 962 uintptr_t r_val = 0; 963 964 switch (opcode) { 965 case SHMAT: 966 error = shmat((int)a0, (caddr_t)a1, (int)a2, &r_val); 967 break; 968 case SHMCTL: 969 error = shmctl((int)a0, (int)a1, (void *)a2); 970 break; 971 case SHMDT: 972 error = shmdt((caddr_t)a0); 973 break; 974 case SHMGET: 975 error = shmget((key_t)a0, (size_t)a1, (int)a2, &r_val); 976 break; 977 case SHMIDS: 978 error = shmids((int *)a0, (uint_t)a1, (uint_t *)a2); 979 break; 980 default: 981 error = EINVAL; 982 break; 983 } 984 985 if (error) 986 return ((uintptr_t)set_errno(error)); 987 988 return (r_val); 989} 990 991/* 992 * segacct_t comparator 993 * This works as expected, with one minor change: the first of two real 994 * segments with equal addresses is considered to be 'greater than' the 995 * second. We only return equal when searching using a template, in 996 * which case we explicitly set the template segment's length to 0 997 * (which is invalid for a real segment). 998 */ 999static int 1000shm_sacompar(const void *x, const void *y) 1001{ 1002 segacct_t *sa1 = (segacct_t *)x; 1003 segacct_t *sa2 = (segacct_t *)y; 1004 1005 if (sa1->sa_addr < sa2->sa_addr) { 1006 return (-1); 1007 } else if (sa2->sa_len != 0) { 1008 if (sa1->sa_addr >= sa2->sa_addr + sa2->sa_len) { 1009 return (1); 1010 } else if (sa1->sa_len != 0) { 1011 return (1); 1012 } else { 1013 return (0); 1014 } 1015 } else if (sa1->sa_addr > sa2->sa_addr) { 1016 return (1); 1017 } else { 1018 return (0); 1019 } 1020} 1021 1022/* 1023 * add this record to the segacct list. 1024 */ 1025static void 1026sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags, kshmid_t *id) 1027{ 1028 segacct_t *nsap; 1029 avl_tree_t *tree = NULL; 1030 avl_index_t where; 1031 1032 nsap = kmem_alloc(sizeof (segacct_t), KM_SLEEP); 1033 nsap->sa_addr = addr; 1034 nsap->sa_len = len; 1035 nsap->sa_flags = flags; 1036 nsap->sa_id = id; 1037 1038 if (pp->p_segacct == NULL) 1039 tree = kmem_alloc(sizeof (avl_tree_t), KM_SLEEP); 1040 1041 mutex_enter(&pp->p_lock); 1042 prbarrier(pp); /* block /proc. See shmgetid(). */ 1043 1044 if (pp->p_segacct == NULL) { 1045 avl_create(tree, shm_sacompar, sizeof (segacct_t), 1046 offsetof(segacct_t, sa_tree)); 1047 pp->p_segacct = tree; 1048 } else if (tree) { 1049 kmem_free(tree, sizeof (avl_tree_t)); 1050 } 1051 1052 /* 1053 * We can ignore the result of avl_find, as the comparator will 1054 * never return equal for segments with non-zero length. This 1055 * is a necessary hack to get around the fact that we do, in 1056 * fact, have duplicate keys. 1057 */ 1058 (void) avl_find(pp->p_segacct, nsap, &where); 1059 avl_insert(pp->p_segacct, nsap, where); 1060 1061 mutex_exit(&pp->p_lock); 1062} 1063 1064/* 1065 * Duplicate parent's segacct records in child. 1066 */ 1067void 1068shmfork(struct proc *ppp, struct proc *cpp) 1069{ 1070 segacct_t *sap; 1071 kshmid_t *sp; 1072 kmutex_t *mp; 1073 1074 ASSERT(ppp->p_segacct != NULL); 1075 1076 /* 1077 * We are the only lwp running in the parent so nobody can 1078 * mess with our p_segacct list. Thus it is safe to traverse 1079 * the list without holding p_lock. This is essential because 1080 * we can't hold p_lock during a KM_SLEEP allocation. 1081 */ 1082 for (sap = (segacct_t *)avl_first(ppp->p_segacct); sap != NULL; 1083 sap = (segacct_t *)AVL_NEXT(ppp->p_segacct, sap)) { 1084 sa_add(cpp, sap->sa_addr, sap->sa_len, sap->sa_flags, 1085 sap->sa_id); 1086 sp = sap->sa_id; 1087 mp = ipc_lock(shm_svc, sp->shm_perm.ipc_id); 1088 if (sap->sa_flags & SHMSA_ISM) 1089 sp->shm_ismattch++; 1090 ipc_hold(shm_svc, (kipc_perm_t *)sp); 1091 mutex_exit(mp); 1092 } 1093} 1094 1095/* 1096 * Detach shared memory segments from exiting process. 1097 */ 1098void 1099shmexit(struct proc *pp) 1100{ 1101 segacct_t *sap; 1102 avl_tree_t *tree; 1103 void *cookie = NULL; 1104 1105 ASSERT(pp->p_segacct != NULL); 1106 1107 mutex_enter(&pp->p_lock); 1108 prbarrier(pp); 1109 tree = pp->p_segacct; 1110 pp->p_segacct = NULL; 1111 mutex_exit(&pp->p_lock); 1112 1113 while ((sap = avl_destroy_nodes(tree, &cookie)) != NULL) 1114 (void) shm_detach(pp, sap); 1115 1116 avl_destroy(tree); 1117 kmem_free(tree, sizeof (avl_tree_t)); 1118} 1119 1120/* 1121 * At this time pages should be in memory, so just lock them. 1122 */ 1123static void 1124lock_again(size_t npages, kshmid_t *sp, struct anon_map *amp) 1125{ 1126 struct anon *ap; 1127 struct page *pp; 1128 struct vnode *vp; 1129 u_offset_t off; 1130 ulong_t anon_idx; 1131 anon_sync_obj_t cookie; 1132 1133 mutex_enter(&sp->shm_mlock); 1134 ANON_LOCK_ENTER(&->a_rwlock, RW_READER); 1135 for (anon_idx = 0; npages != 0; anon_idx++, npages--) { 1136 1137 anon_array_enter(amp, anon_idx, &cookie); 1138 ap = anon_get_ptr(amp->ahp, anon_idx); 1139 ASSERT(ap != NULL); 1140 swap_xlate(ap, &vp, &off); 1141 anon_array_exit(&cookie); 1142 1143 pp = page_lookup(vp, off, SE_SHARED); 1144 if (pp == NULL) { 1145 panic("lock_again: page not in the system"); 1146 /*NOTREACHED*/ 1147 } 1148 /* page should already be locked by caller */ 1149 ASSERT(pp->p_lckcnt > 0); 1150 (void) page_pp_lock(pp, 0, 0); 1151 page_unlock(pp); 1152 } 1153 ANON_LOCK_EXIT(&->a_rwlock); 1154 mutex_exit(&sp->shm_mlock); 1155} 1156 1157/* 1158 * Attach the shared memory segment to the process 1159 * address space and lock the pages. 1160 */ 1161static int 1162shmem_lock(kshmid_t *sp, struct anon_map *amp) 1163{ 1164 size_t npages = btopr(amp->size); 1165 struct as *as; 1166 struct segvn_crargs crargs; 1167 uint_t error; 1168 1169 /* 1170 * A later ISM/DISM attach may increase the size of the amp, so 1171 * cache the number of pages locked for the future shmem_unlock() 1172 */ 1173 sp->shm_lkpages = npages; 1174 1175 as = as_alloc(); 1176 /* Initialize the create arguments and map the segment */ 1177 crargs = *(struct segvn_crargs *)zfod_argsp; /* structure copy */ 1178 crargs.offset = (u_offset_t)0; 1179 crargs.type = MAP_SHARED; 1180 crargs.amp = amp; 1181 crargs.prot = PROT_ALL; 1182 crargs.maxprot = crargs.prot; 1183 crargs.flags = 0; 1184 error = as_map(as, 0x0, amp->size, segvn_create, &crargs); 1185 if (!error) { 1186 if ((error = as_ctl(as, 0x0, amp->size, MC_LOCK, 0, 0, 1187 NULL, 0)) == 0) { 1188 lock_again(npages, sp, amp); 1189 } 1190 (void) as_unmap(as, 0x0, amp->size); 1191 } 1192 as_free(as); 1193 return (error); 1194} 1195 1196 1197/* 1198 * Unlock shared memory 1199 */ 1200static void 1201shmem_unlock(kshmid_t *sp, struct anon_map *amp) 1202{ 1203 struct anon *ap; 1204 pgcnt_t npages = sp->shm_lkpages; 1205 struct vnode *vp; 1206 struct page *pp; 1207 u_offset_t off; 1208 ulong_t anon_idx; 1209 size_t unlocked_bytes = 0; 1210 kproject_t *proj; 1211 anon_sync_obj_t cookie; 1212 1213 proj = sp->shm_perm.ipc_proj; 1214 mutex_enter(&sp->shm_mlock); 1215 ANON_LOCK_ENTER(&->a_rwlock, RW_READER); 1216 for (anon_idx = 0; anon_idx < npages; anon_idx++) { 1217 1218 anon_array_enter(amp, anon_idx, &cookie); 1219 if ((ap = anon_get_ptr(amp->ahp, anon_idx)) == NULL) { 1220 panic("shmem_unlock: null app"); 1221 /*NOTREACHED*/ 1222 } 1223 swap_xlate(ap, &vp, &off); 1224 anon_array_exit(&cookie); 1225 pp = page_lookup(vp, off, SE_SHARED); 1226 if (pp == NULL) { 1227 panic("shmem_unlock: page not in the system"); 1228 /*NOTREACHED*/ 1229 } 1230 /* 1231 * Page should at least have once lock from previous 1232 * shmem_lock 1233 */ 1234 ASSERT(pp->p_lckcnt > 0); 1235 page_pp_unlock(pp, 0, 0); 1236 if (pp->p_lckcnt == 0) 1237 unlocked_bytes += PAGESIZE; 1238 1239 page_unlock(pp); 1240 } 1241 1242 if (unlocked_bytes > 0) { 1243 rctl_decr_locked_mem(NULL, proj, unlocked_bytes, 0); 1244 } 1245 1246 ANON_LOCK_EXIT(&->a_rwlock); 1247 mutex_exit(&sp->shm_mlock); 1248} 1249 1250/* 1251 * We call this routine when we have removed all references to this 1252 * amp. This means all shmdt()s and the IPC_RMID have been done. 1253 */ 1254static void 1255shm_rm_amp(kshmid_t *sp) 1256{ 1257 struct anon_map *amp = sp->shm_amp; 1258 zone_t *zone; 1259 1260 zone = sp->shm_perm.ipc_zone_ref.zref_zone; 1261 ASSERT(zone != NULL); 1262 /* 1263 * Free up the anon_map. 1264 */ 1265 lgrp_shm_policy_fini(amp, NULL); 1266 ANON_LOCK_ENTER(&->a_rwlock, RW_WRITER); 1267 if (amp->a_szc != 0) { 1268 anon_shmap_free_pages(amp, 0, amp->size); 1269 } else { 1270 anon_free(amp->ahp, 0, amp->size); 1271 } 1272 ANON_LOCK_EXIT(&->a_rwlock); 1273 anon_unresv_zone(amp->swresv, zone); 1274 anonmap_free(amp); 1275} 1276 1277/* 1278 * Return the shared memory id for the process's virtual address. 1279 * Return SHMID_NONE if addr is not within a SysV shared memory segment. 1280 * Return SHMID_FREE if addr's SysV shared memory segment's id has been freed. 1281 * 1282 * shmgetid() is called from code in /proc with the process locked but 1283 * with pp->p_lock not held. The address space lock is held, so we 1284 * cannot grab pp->p_lock here due to lock-ordering constraints. 1285 * Because of all this, modifications to the p_segacct list must only 1286 * be made after calling prbarrier() to ensure the process is not locked. 1287 * See shmdt() and sa_add(), above. shmgetid() may also be called on a 1288 * thread's own process without the process locked. 1289 */ 1290int 1291shmgetid(proc_t *pp, caddr_t addr) 1292{ 1293 segacct_t *sap, template; 1294 1295 ASSERT(MUTEX_NOT_HELD(&pp->p_lock)); 1296 ASSERT((pp->p_proc_flag & P_PR_LOCK) || pp == curproc); 1297 1298 if (pp->p_segacct == NULL) 1299 return (SHMID_NONE); 1300 1301 template.sa_addr = addr; 1302 template.sa_len = 0; 1303 if ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL) 1304 return (SHMID_NONE); 1305 1306 if (IPC_FREE(&sap->sa_id->shm_perm)) 1307 return (SHMID_FREE); 1308 1309 return (sap->sa_id->shm_perm.ipc_id); 1310} 1311