]> git.saurik.com Git - apple/xnu.git/blame - bsd/kern/sysv_shm.c
xnu-3248.60.10.tar.gz
[apple/xnu.git] / bsd / kern / sysv_shm.c
CommitLineData
1c79356b 1/*
2d21ac55 2 * Copyright (c) 2000-2007 Apple Inc. All rights reserved.
5d5c5d0d 3 *
2d21ac55 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
1c79356b 5 *
2d21ac55
A
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
8f6c56a5 14 *
2d21ac55
A
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
8f6c56a5
A
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
2d21ac55
A
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
8f6c56a5 25 *
2d21ac55 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
1c79356b
A
27 */
28/* $NetBSD: sysv_shm.c,v 1.23 1994/07/04 23:25:12 glass Exp $ */
29
30/*
31 * Copyright (c) 1994 Adam Glass and Charles Hannum. All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. All advertising materials mentioning features or use of this software
42 * must display the following acknowledgement:
43 * This product includes software developed by Adam Glass and Charles
44 * Hannum.
45 * 4. The names of the authors may not be used to endorse or promote products
46 * derived from this software without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
49 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
50 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
51 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
52 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
53 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
54 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
55 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
56 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
57 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
58 */
2d21ac55
A
59/*
60 * NOTICE: This file was modified by McAfee Research in 2004 to introduce
61 * support for mandatory and extensible security protections. This notice
62 * is included in support of clause 2.2 (b) of the Apple Public License,
63 * Version 2.0.
64 * Copyright (c) 2005-2006 SPARTA, Inc.
65*/
1c79356b
A
66
67
9bccf70c 68#include <sys/appleapiopts.h>
1c79356b
A
69#include <sys/param.h>
70#include <sys/systm.h>
71#include <sys/kernel.h>
91447636
A
72#include <sys/shm_internal.h>
73#include <sys/proc_internal.h>
74#include <sys/kauth.h>
1c79356b
A
75#include <sys/malloc.h>
76#include <sys/mman.h>
77#include <sys/stat.h>
9bccf70c 78#include <sys/sysctl.h>
91447636
A
79#include <sys/ipcs.h>
80#include <sys/sysent.h>
81#include <sys/sysproto.h>
2d21ac55
A
82#if CONFIG_MACF
83#include <security/mac_framework.h>
84#endif
e5568f75 85
b0d623f7 86#include <security/audit/audit.h>
1c79356b
A
87
88#include <mach/mach_types.h>
89#include <mach/vm_inherit.h>
91447636
A
90#include <mach/vm_map.h>
91
92#include <mach/mach_vm.h>
93
1c79356b 94#include <vm/vm_map.h>
91447636 95#include <vm/vm_protos.h>
3e170ce0 96#include <vm/vm_kern.h>
1c79356b 97
91447636 98#include <kern/locks.h>
1c79356b 99
2d21ac55
A
100/* Uncomment this line to see MAC debugging output. */
101/* #define MAC_DEBUG */
102#if CONFIG_MACF_DEBUG
103#define MPRINTF(a) printf a
104#else
105#define MPRINTF(a)
106#endif
107
108#if SYSV_SHM
91447636 109static void shminit(void *);
1c79356b 110#if 0
1c79356b 111SYSINIT(sysv_shm, SI_SUB_SYSV_SHM, SI_ORDER_FIRST, shminit, NULL)
b0d623f7 112#endif
1c79356b 113
91447636
A
114static lck_grp_t *sysv_shm_subsys_lck_grp;
115static lck_grp_attr_t *sysv_shm_subsys_lck_grp_attr;
116static lck_attr_t *sysv_shm_subsys_lck_attr;
117static lck_mtx_t sysv_shm_subsys_mutex;
1c79356b 118
91447636
A
119#define SYSV_SHM_SUBSYS_LOCK() lck_mtx_lock(&sysv_shm_subsys_mutex)
120#define SYSV_SHM_SUBSYS_UNLOCK() lck_mtx_unlock(&sysv_shm_subsys_mutex)
121
122static int oshmctl(void *p, void *uap, void *retval);
123static int shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode, int * retval);
124static int shmget_existing(struct shmget_args *uap, int mode, int segnum, int * retval);
b0d623f7
A
125static void shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out);
126static void shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out);
1c79356b
A
127
128/* XXX casting to (sy_call_t *) is bogus, as usual. */
129static sy_call_t *shmcalls[] = {
130 (sy_call_t *)shmat, (sy_call_t *)oshmctl,
131 (sy_call_t *)shmdt, (sy_call_t *)shmget,
132 (sy_call_t *)shmctl
133};
134
135#define SHMSEG_FREE 0x0200
136#define SHMSEG_REMOVED 0x0400
137#define SHMSEG_ALLOCATED 0x0800
138#define SHMSEG_WANTED 0x1000
139
140static int shm_last_free, shm_nused, shm_committed;
2d21ac55 141struct shmid_kernel *shmsegs; /* 64 bit version */
9bccf70c 142static int shm_inited = 0;
1c79356b 143
b0d623f7
A
144/*
145 * Since anonymous memory chunks are limited to ANON_MAX_SIZE bytes,
146 * we have to keep a list of chunks when we want to handle a shared memory
147 * segment bigger than ANON_MAX_SIZE.
148 * Each chunk points to a VM named entry of up to ANON_MAX_SIZE bytes
149 * of anonymous memory.
150 */
1c79356b 151struct shm_handle {
b0d623f7
A
152 void * shm_object; /* named entry for this chunk*/
153 memory_object_size_t shm_handle_size; /* size of this chunk */
154 struct shm_handle *shm_handle_next; /* next chunk */
1c79356b
A
155};
156
157struct shmmap_state {
91447636
A
158 mach_vm_address_t va; /* user address */
159 int shmid; /* segment id */
1c79356b
A
160};
161
2d21ac55 162static void shm_deallocate_segment(struct shmid_kernel *);
91447636 163static int shm_find_segment_by_key(key_t);
2d21ac55 164static struct shmid_kernel *shm_find_segment_by_shmid(int);
91447636 165static int shm_delete_mapping(struct proc *, struct shmmap_state *, int);
1c79356b 166
9bccf70c 167#ifdef __APPLE_API_PRIVATE
2d21ac55
A
168#define DEFAULT_SHMMAX (4 * 1024 * 1024)
169#define DEFAULT_SHMMIN 1
170#define DEFAULT_SHMMNI 32
171#define DEFAULT_SHMSEG 8
172#define DEFAULT_SHMALL 1024
3e170ce0 173
9bccf70c 174struct shminfo shminfo = {
2d21ac55
A
175 DEFAULT_SHMMAX,
176 DEFAULT_SHMMIN,
177 DEFAULT_SHMMNI,
178 DEFAULT_SHMSEG,
179 DEFAULT_SHMALL
9bccf70c
A
180};
181#endif /* __APPLE_API_PRIVATE */
182
91447636
A
183void sysv_shm_lock_init(void);
184
185static __inline__ time_t
186sysv_shmtime(void)
187{
188 struct timeval tv;
189 microtime(&tv);
190 return (tv.tv_sec);
191}
192
193/*
194 * This conversion is safe, since if we are converting for a 32 bit process,
195 * then it's value of (struct shmid_ds)->shm_segsz will never exceed 4G.
196 *
197 * NOTE: Source and target may *NOT* overlap! (target is smaller)
198 */
199static void
b0d623f7 200shmid_ds_64to32(struct user_shmid_ds *in, struct user32_shmid_ds *out)
91447636
A
201{
202 out->shm_perm = in->shm_perm;
b0d623f7 203 out->shm_segsz = in->shm_segsz;
91447636
A
204 out->shm_lpid = in->shm_lpid;
205 out->shm_cpid = in->shm_cpid;
206 out->shm_nattch = in->shm_nattch;
207 out->shm_atime = in->shm_atime;
208 out->shm_dtime = in->shm_dtime;
209 out->shm_ctime = in->shm_ctime;
b0d623f7 210 out->shm_internal = CAST_DOWN_EXPLICIT(int,in->shm_internal);
91447636
A
211}
212
213/*
214 * NOTE: Source and target may are permitted to overlap! (source is smaller);
215 * this works because we copy fields in order from the end of the struct to
216 * the beginning.
217 */
218static void
b0d623f7 219shmid_ds_32to64(struct user32_shmid_ds *in, struct user_shmid_ds *out)
91447636 220{
b0d623f7 221 out->shm_internal = in->shm_internal;
91447636
A
222 out->shm_ctime = in->shm_ctime;
223 out->shm_dtime = in->shm_dtime;
224 out->shm_atime = in->shm_atime;
225 out->shm_nattch = in->shm_nattch;
226 out->shm_cpid = in->shm_cpid;
227 out->shm_lpid = in->shm_lpid;
b0d623f7 228 out->shm_segsz = in->shm_segsz;
91447636
A
229 out->shm_perm = in->shm_perm;
230}
231
232
1c79356b 233static int
91447636 234shm_find_segment_by_key(key_t key)
1c79356b
A
235{
236 int i;
237
238 for (i = 0; i < shminfo.shmmni; i++)
2d21ac55
A
239 if ((shmsegs[i].u.shm_perm.mode & SHMSEG_ALLOCATED) &&
240 shmsegs[i].u.shm_perm._key == key)
1c79356b
A
241 return i;
242 return -1;
243}
244
2d21ac55 245static struct shmid_kernel *
91447636 246shm_find_segment_by_shmid(int shmid)
1c79356b
A
247{
248 int segnum;
2d21ac55 249 struct shmid_kernel *shmseg;
1c79356b
A
250
251 segnum = IPCID_TO_IX(shmid);
252 if (segnum < 0 || segnum >= shminfo.shmmni)
253 return NULL;
254 shmseg = &shmsegs[segnum];
2d21ac55 255 if ((shmseg->u.shm_perm.mode & (SHMSEG_ALLOCATED | SHMSEG_REMOVED))
1c79356b 256 != SHMSEG_ALLOCATED ||
2d21ac55 257 shmseg->u.shm_perm._seq != IPCID_TO_SEQ(shmid))
1c79356b
A
258 return NULL;
259 return shmseg;
260}
261
262static void
2d21ac55 263shm_deallocate_segment(struct shmid_kernel *shmseg)
1c79356b 264{
b0d623f7 265 struct shm_handle *shm_handle, *shm_handle_next;
91447636 266 mach_vm_size_t size;
1c79356b 267
b0d623f7
A
268 for (shm_handle = CAST_DOWN(void *,shmseg->u.shm_internal); /* tunnel */
269 shm_handle != NULL;
270 shm_handle = shm_handle_next) {
271 shm_handle_next = shm_handle->shm_handle_next;
272 mach_memory_entry_port_release(shm_handle->shm_object);
273 FREE((caddr_t) shm_handle, M_SHM);
274 }
2d21ac55 275 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
b0d623f7 276 size = mach_vm_round_page(shmseg->u.shm_segsz);
1c79356b
A
277 shm_committed -= btoc(size);
278 shm_nused--;
2d21ac55
A
279 shmseg->u.shm_perm.mode = SHMSEG_FREE;
280#if CONFIG_MACF
281 /* Reset the MAC label */
282 mac_sysvshm_label_recycle(shmseg);
283#endif
1c79356b
A
284}
285
286static int
91447636
A
287shm_delete_mapping(__unused struct proc *p, struct shmmap_state *shmmap_s,
288 int deallocate)
1c79356b 289{
2d21ac55 290 struct shmid_kernel *shmseg;
1c79356b 291 int segnum, result;
91447636 292 mach_vm_size_t size;
1c79356b
A
293
294 segnum = IPCID_TO_IX(shmmap_s->shmid);
295 shmseg = &shmsegs[segnum];
2d21ac55 296 size = mach_vm_round_page(shmseg->u.shm_segsz); /* XXX done for us? */
55e303ae 297 if (deallocate) {
91447636 298 result = mach_vm_deallocate(current_map(), shmmap_s->va, size);
1c79356b
A
299 if (result != KERN_SUCCESS)
300 return EINVAL;
55e303ae 301 }
1c79356b 302 shmmap_s->shmid = -1;
2d21ac55
A
303 shmseg->u.shm_dtime = sysv_shmtime();
304 if ((--shmseg->u.shm_nattch <= 0) &&
305 (shmseg->u.shm_perm.mode & SHMSEG_REMOVED)) {
1c79356b
A
306 shm_deallocate_segment(shmseg);
307 shm_last_free = segnum;
308 }
309 return 0;
310}
311
1c79356b 312int
b0d623f7 313shmdt(struct proc *p, struct shmdt_args *uap, int32_t *retval)
1c79356b 314{
2d21ac55
A
315#if CONFIG_MACF
316 struct shmid_kernel *shmsegptr;
317#endif
1c79356b
A
318 struct shmmap_state *shmmap_s;
319 int i;
91447636
A
320 int shmdtret = 0;
321
2d21ac55 322 AUDIT_ARG(svipc_addr, uap->shmaddr);
91447636
A
323
324 SYSV_SHM_SUBSYS_LOCK();
1c79356b 325
91447636 326 if (!shm_inited) {
2d21ac55 327 shminit(NULL);
91447636 328 }
1c79356b 329 shmmap_s = (struct shmmap_state *)p->vm_shm;
91447636
A
330 if (shmmap_s == NULL) {
331 shmdtret = EINVAL;
332 goto shmdt_out;
333 }
334
1c79356b
A
335 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
336 if (shmmap_s->shmid != -1 &&
91447636 337 shmmap_s->va == (mach_vm_offset_t)uap->shmaddr)
1c79356b 338 break;
91447636
A
339 if (i == shminfo.shmseg) {
340 shmdtret = EINVAL;
341 goto shmdt_out;
342 }
2d21ac55
A
343#if CONFIG_MACF
344 /*
345 * XXX: It might be useful to move this into the shm_delete_mapping
346 * function
347 */
348 shmsegptr = &shmsegs[IPCID_TO_IX(shmmap_s->shmid)];
349 shmdtret = mac_sysvshm_check_shmdt(kauth_cred_get(), shmsegptr);
350 if (shmdtret)
351 goto shmdt_out;
352#endif
91447636
A
353 i = shm_delete_mapping(p, shmmap_s, 1);
354
355 if (i == 0)
356 *retval = 0;
357 shmdtret = i;
358shmdt_out:
359 SYSV_SHM_SUBSYS_UNLOCK();
360 return shmdtret;
1c79356b
A
361}
362
1c79356b 363int
2d21ac55 364shmat(struct proc *p, struct shmat_args *uap, user_addr_t *retval)
1c79356b
A
365{
366 int error, i, flags;
2d21ac55 367 struct shmid_kernel *shmseg;
91447636
A
368 struct shmmap_state *shmmap_s = NULL;
369 struct shm_handle *shm_handle;
370 mach_vm_address_t attach_va; /* attach address in/out */
371 mach_vm_size_t map_size; /* size of map entry */
b0d623f7 372 mach_vm_size_t mapped_size;
3e170ce0
A
373 vm_prot_t prot;
374 size_t size;
91447636 375 kern_return_t rv;
b0d623f7
A
376 int shmat_ret;
377 int vm_flags;
378
379 shmat_ret = 0;
1c79356b 380
55e303ae 381 AUDIT_ARG(svipc_id, uap->shmid);
2d21ac55 382 AUDIT_ARG(svipc_addr, uap->shmaddr);
91447636
A
383
384 SYSV_SHM_SUBSYS_LOCK();
385
386 if (!shm_inited) {
2d21ac55 387 shminit(NULL);
91447636
A
388 }
389
1c79356b 390 shmmap_s = (struct shmmap_state *)p->vm_shm;
91447636 391
1c79356b
A
392 if (shmmap_s == NULL) {
393 size = shminfo.shmseg * sizeof(struct shmmap_state);
3e170ce0
A
394 if (size == 0 || size / shminfo.shmseg != sizeof(struct shmmap_state)) {
395 /* overflow */
396 shmat_ret = ENOMEM;
397 goto shmat_out;
398 }
91447636
A
399 MALLOC(shmmap_s, struct shmmap_state *, size, M_SHM, M_WAITOK);
400 if (shmmap_s == NULL) {
401 shmat_ret = ENOMEM;
402 goto shmat_out;
403 }
1c79356b
A
404 for (i = 0; i < shminfo.shmseg; i++)
405 shmmap_s[i].shmid = -1;
406 p->vm_shm = (caddr_t)shmmap_s;
407 }
408 shmseg = shm_find_segment_by_shmid(uap->shmid);
91447636
A
409 if (shmseg == NULL) {
410 shmat_ret = EINVAL;
411 goto shmat_out;
412 }
55e303ae 413
2d21ac55
A
414 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
415 error = ipcperm(kauth_cred_get(), &shmseg->u.shm_perm,
1c79356b 416 (uap->shmflg & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
91447636
A
417 if (error) {
418 shmat_ret = error;
419 goto shmat_out;
420 }
421
2d21ac55
A
422#if CONFIG_MACF
423 error = mac_sysvshm_check_shmat(kauth_cred_get(), shmseg, uap->shmflg);
424 if (error) {
425 shmat_ret = error;
426 goto shmat_out;
427 }
428#endif
1c79356b
A
429 for (i = 0; i < shminfo.shmseg; i++) {
430 if (shmmap_s->shmid == -1)
431 break;
432 shmmap_s++;
433 }
91447636
A
434 if (i >= shminfo.shmseg) {
435 shmat_ret = EMFILE;
436 goto shmat_out;
437 }
438
2d21ac55 439 map_size = mach_vm_round_page(shmseg->u.shm_segsz);
1c79356b
A
440 prot = VM_PROT_READ;
441 if ((uap->shmflg & SHM_RDONLY) == 0)
442 prot |= VM_PROT_WRITE;
443 flags = MAP_ANON | MAP_SHARED;
91447636 444 if (uap->shmaddr)
1c79356b 445 flags |= MAP_FIXED;
91447636
A
446
447 attach_va = (mach_vm_address_t)uap->shmaddr;
448 if (uap->shmflg & SHM_RND)
449 attach_va &= ~(SHMLBA-1);
450 else if ((attach_va & (SHMLBA-1)) != 0) {
451 shmat_ret = EINVAL;
452 goto shmat_out;
453 }
454
b0d623f7
A
455 if (flags & MAP_FIXED) {
456 vm_flags = VM_FLAGS_FIXED;
457 } else {
458 vm_flags = VM_FLAGS_ANYWHERE;
459 }
460
461 mapped_size = 0;
462
463 /* first reserve enough space... */
464 rv = mach_vm_map(current_map(),
465 &attach_va,
466 map_size,
467 0,
468 vm_flags,
469 IPC_PORT_NULL,
470 0,
471 FALSE,
472 VM_PROT_NONE,
473 VM_PROT_NONE,
474 VM_INHERIT_NONE);
475 if (rv != KERN_SUCCESS) {
476 goto out;
477 }
91447636 478
b0d623f7
A
479 shmmap_s->va = attach_va;
480
481 /* ... then map the shared memory over the reserved space */
482 for (shm_handle = CAST_DOWN(void *, shmseg->u.shm_internal);/* tunnel */
483 shm_handle != NULL;
484 shm_handle = shm_handle->shm_handle_next) {
485
486 rv = vm_map_enter_mem_object(
487 current_map(), /* process map */
488 &attach_va, /* attach address */
489 shm_handle->shm_handle_size, /* segment size */
490 (mach_vm_offset_t)0, /* alignment mask */
491 VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
91447636
A
492 shm_handle->shm_object,
493 (mach_vm_offset_t)0,
494 FALSE,
495 prot,
496 prot,
b0d623f7
A
497 VM_INHERIT_SHARE);
498 if (rv != KERN_SUCCESS)
1c79356b 499 goto out;
91447636 500
b0d623f7
A
501 mapped_size += shm_handle->shm_handle_size;
502 attach_va = attach_va + shm_handle->shm_handle_size;
1c79356b
A
503 }
504
1c79356b 505 shmmap_s->shmid = uap->shmid;
2d21ac55
A
506 shmseg->u.shm_lpid = p->p_pid;
507 shmseg->u.shm_atime = sysv_shmtime();
508 shmseg->u.shm_nattch++;
b0d623f7 509 *retval = shmmap_s->va; /* XXX return -1 on error */
91447636
A
510 shmat_ret = 0;
511 goto shmat_out;
1c79356b 512out:
b0d623f7
A
513 if (mapped_size > 0) {
514 (void) mach_vm_deallocate(current_map(),
515 shmmap_s->va,
516 mapped_size);
517 }
1c79356b
A
518 switch (rv) {
519 case KERN_INVALID_ADDRESS:
520 case KERN_NO_SPACE:
91447636 521 shmat_ret = ENOMEM;
b0d623f7 522 break;
1c79356b 523 case KERN_PROTECTION_FAILURE:
91447636 524 shmat_ret = EACCES;
b0d623f7 525 break;
1c79356b 526 default:
91447636 527 shmat_ret = EINVAL;
b0d623f7 528 break;
1c79356b 529 }
91447636
A
530shmat_out:
531 SYSV_SHM_SUBSYS_UNLOCK();
532 return shmat_ret;
1c79356b
A
533}
534
1c79356b 535static int
91447636 536oshmctl(__unused void *p, __unused void *uap, __unused void *retval)
1c79356b 537{
1c79356b 538 return EINVAL;
1c79356b
A
539}
540
2d21ac55
A
541/*
542 * Returns: 0 Success
543 * EINVAL
544 * copyout:EFAULT
545 * copyin:EFAULT
546 * ipcperm:EPERM
547 * ipcperm:EACCES
548 */
1c79356b 549int
b0d623f7 550shmctl(__unused struct proc *p, struct shmctl_args *uap, int32_t *retval)
1c79356b
A
551{
552 int error;
91447636
A
553 kauth_cred_t cred = kauth_cred_get();
554 struct user_shmid_ds inbuf;
2d21ac55 555 struct shmid_kernel *shmseg;
91447636
A
556
557 int shmctl_ret = 0;
1c79356b 558
55e303ae
A
559 AUDIT_ARG(svipc_cmd, uap->cmd);
560 AUDIT_ARG(svipc_id, uap->shmid);
91447636
A
561
562 SYSV_SHM_SUBSYS_LOCK();
563
564 if (!shm_inited) {
2d21ac55 565 shminit(NULL);
91447636
A
566 }
567
1c79356b 568 shmseg = shm_find_segment_by_shmid(uap->shmid);
91447636
A
569 if (shmseg == NULL) {
570 shmctl_ret = EINVAL;
571 goto shmctl_out;
572 }
573
55e303ae
A
574 /* XXAUDIT: This is the perms BEFORE any change by this call. This
575 * may not be what is desired.
576 */
2d21ac55 577 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
55e303ae 578
2d21ac55
A
579#if CONFIG_MACF
580 error = mac_sysvshm_check_shmctl(cred, shmseg, uap->cmd);
581 if (error) {
582 shmctl_ret = error;
583 goto shmctl_out;
584 }
585#endif
1c79356b
A
586 switch (uap->cmd) {
587 case IPC_STAT:
2d21ac55 588 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_R);
91447636
A
589 if (error) {
590 shmctl_ret = error;
591 goto shmctl_out;
592 }
593
594 if (IS_64BIT_PROCESS(p)) {
22ba694c
A
595 struct user_shmid_ds shmid_ds;
596 memcpy(&shmid_ds, &shmseg->u, sizeof(struct user_shmid_ds));
597
598 /* Clear kernel reserved pointer before copying to user space */
599 shmid_ds.shm_internal = USER_ADDR_NULL;
600
601 error = copyout(&shmid_ds, uap->buf, sizeof(shmid_ds));
91447636 602 } else {
b0d623f7 603 struct user32_shmid_ds shmid_ds32;
2d21ac55 604 shmid_ds_64to32(&shmseg->u, &shmid_ds32);
22ba694c
A
605
606 /* Clear kernel reserved pointer before copying to user space */
607 shmid_ds32.shm_internal = (user32_addr_t)0;
608
b0d623f7 609 error = copyout(&shmid_ds32, uap->buf, sizeof(shmid_ds32));
91447636
A
610 }
611 if (error) {
612 shmctl_ret = error;
613 goto shmctl_out;
614 }
1c79356b
A
615 break;
616 case IPC_SET:
2d21ac55 617 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
91447636
A
618 if (error) {
619 shmctl_ret = error;
620 goto shmctl_out;
621 }
622 if (IS_64BIT_PROCESS(p)) {
623 error = copyin(uap->buf, &inbuf, sizeof(struct user_shmid_ds));
624 } else {
b0d623f7
A
625 struct user32_shmid_ds shmid_ds32;
626 error = copyin(uap->buf, &shmid_ds32, sizeof(shmid_ds32));
91447636 627 /* convert in place; ugly, but safe */
b0d623f7 628 shmid_ds_32to64(&shmid_ds32, &inbuf);
91447636
A
629 }
630 if (error) {
631 shmctl_ret = error;
632 goto shmctl_out;
633 }
2d21ac55
A
634 shmseg->u.shm_perm.uid = inbuf.shm_perm.uid;
635 shmseg->u.shm_perm.gid = inbuf.shm_perm.gid;
636 shmseg->u.shm_perm.mode =
637 (shmseg->u.shm_perm.mode & ~ACCESSPERMS) |
1c79356b 638 (inbuf.shm_perm.mode & ACCESSPERMS);
2d21ac55 639 shmseg->u.shm_ctime = sysv_shmtime();
1c79356b
A
640 break;
641 case IPC_RMID:
2d21ac55 642 error = ipcperm(cred, &shmseg->u.shm_perm, IPC_M);
91447636
A
643 if (error) {
644 shmctl_ret = error;
645 goto shmctl_out;
646 }
2d21ac55
A
647 shmseg->u.shm_perm._key = IPC_PRIVATE;
648 shmseg->u.shm_perm.mode |= SHMSEG_REMOVED;
649 if (shmseg->u.shm_nattch <= 0) {
1c79356b
A
650 shm_deallocate_segment(shmseg);
651 shm_last_free = IPCID_TO_IX(uap->shmid);
652 }
653 break;
654#if 0
655 case SHM_LOCK:
656 case SHM_UNLOCK:
657#endif
658 default:
91447636
A
659 shmctl_ret = EINVAL;
660 goto shmctl_out;
1c79356b 661 }
91447636
A
662 *retval = 0;
663 shmctl_ret = 0;
664shmctl_out:
665 SYSV_SHM_SUBSYS_UNLOCK();
666 return shmctl_ret;
1c79356b
A
667}
668
1c79356b 669static int
91447636 670shmget_existing(struct shmget_args *uap, int mode, int segnum, int *retval)
1c79356b 671{
2d21ac55
A
672 struct shmid_kernel *shmseg;
673 int error = 0;
1c79356b
A
674
675 shmseg = &shmsegs[segnum];
2d21ac55 676 if (shmseg->u.shm_perm.mode & SHMSEG_REMOVED) {
1c79356b
A
677 /*
678 * This segment is in the process of being allocated. Wait
679 * until it's done, and look the key up again (in case the
680 * allocation failed or it was freed).
681 */
2d21ac55 682 shmseg->u.shm_perm.mode |= SHMSEG_WANTED;
1c79356b
A
683 error = tsleep((caddr_t)shmseg, PLOCK | PCATCH, "shmget", 0);
684 if (error)
685 return error;
686 return EAGAIN;
687 }
2d21ac55
A
688
689 /*
690 * The low 9 bits of shmflag are the mode bits being requested, which
691 * are the actual mode bits desired on the segment, and not in IPC_R
692 * form; therefore it would be incorrect to call ipcperm() to validate
693 * them; instead, we AND the existing mode with the requested mode, and
694 * verify that it matches the requested mode; otherwise, we fail with
695 * EACCES (access denied).
696 */
697 if ((shmseg->u.shm_perm.mode & mode) != mode)
698 return EACCES;
699
700#if CONFIG_MACF
701 error = mac_sysvshm_check_shmget(kauth_cred_get(), shmseg, uap->shmflg);
702 if (error)
703 return (error);
704#endif
705
706 if (uap->size && uap->size > shmseg->u.shm_segsz)
1c79356b 707 return EINVAL;
2d21ac55 708
1c79356b
A
709 if ((uap->shmflg & (IPC_CREAT | IPC_EXCL)) == (IPC_CREAT | IPC_EXCL))
710 return EEXIST;
2d21ac55
A
711
712 *retval = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
1c79356b
A
713 return 0;
714}
715
716static int
91447636
A
717shmget_allocate_segment(struct proc *p, struct shmget_args *uap, int mode,
718 int *retval)
1c79356b 719{
2d21ac55 720 int i, segnum, shmid;
91447636 721 kauth_cred_t cred = kauth_cred_get();
2d21ac55 722 struct shmid_kernel *shmseg;
1c79356b
A
723 struct shm_handle *shm_handle;
724 kern_return_t kret;
b0d623f7 725 mach_vm_size_t total_size, size, alloc_size;
1c79356b 726 void * mem_object;
b0d623f7 727 struct shm_handle *shm_handle_next, **shm_handle_next_p;
1c79356b 728
91447636
A
729 if (uap->size < (user_size_t)shminfo.shmmin ||
730 uap->size > (user_size_t)shminfo.shmmax)
1c79356b
A
731 return EINVAL;
732 if (shm_nused >= shminfo.shmmni) /* any shmids left? */
733 return ENOSPC;
b0d623f7
A
734 total_size = mach_vm_round_page(uap->size);
735 if ((user_ssize_t)(shm_committed + btoc(total_size)) > shminfo.shmall)
1c79356b
A
736 return ENOMEM;
737 if (shm_last_free < 0) {
738 for (i = 0; i < shminfo.shmmni; i++)
2d21ac55 739 if (shmsegs[i].u.shm_perm.mode & SHMSEG_FREE)
1c79356b
A
740 break;
741 if (i == shminfo.shmmni)
742 panic("shmseg free count inconsistent");
743 segnum = i;
744 } else {
745 segnum = shm_last_free;
746 shm_last_free = -1;
747 }
748 shmseg = &shmsegs[segnum];
b0d623f7 749
1c79356b
A
750 /*
751 * In case we sleep in malloc(), mark the segment present but deleted
752 * so that noone else tries to create the same key.
b0d623f7 753 * XXX but we don't release the global lock !?
1c79356b 754 */
2d21ac55
A
755 shmseg->u.shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
756 shmseg->u.shm_perm._key = uap->key;
757 shmseg->u.shm_perm._seq = (shmseg->u.shm_perm._seq + 1) & 0x7fff;
b0d623f7
A
758
759 shm_handle_next_p = NULL;
760 for (alloc_size = 0;
761 alloc_size < total_size;
762 alloc_size += size) {
763 size = MIN(total_size - alloc_size, ANON_MAX_SIZE);
764 kret = mach_make_memory_entry_64(
765 VM_MAP_NULL,
766 (memory_object_size_t *) &size,
767 (memory_object_offset_t) 0,
768 MAP_MEM_NAMED_CREATE | VM_PROT_DEFAULT,
769 (ipc_port_t *) &mem_object, 0);
770 if (kret != KERN_SUCCESS)
771 goto out;
772
773 MALLOC(shm_handle, struct shm_handle *, sizeof(struct shm_handle), M_SHM, M_WAITOK);
774 if (shm_handle == NULL) {
775 kret = KERN_NO_SPACE;
776 mach_memory_entry_port_release(mem_object);
777 mem_object = NULL;
778 goto out;
779 }
780 shm_handle->shm_object = mem_object;
781 shm_handle->shm_handle_size = size;
782 shm_handle->shm_handle_next = NULL;
783 if (shm_handle_next_p == NULL) {
784 shmseg->u.shm_internal = CAST_USER_ADDR_T(shm_handle);/* tunnel */
785 } else {
786 *shm_handle_next_p = shm_handle;
787 }
788 shm_handle_next_p = &shm_handle->shm_handle_next;
91447636 789 }
b0d623f7 790
2d21ac55 791 shmid = IXSEQ_TO_IPCID(segnum, shmseg->u.shm_perm);
1c79356b 792
2d21ac55 793 shmseg->u.shm_perm.cuid = shmseg->u.shm_perm.uid = kauth_cred_getuid(cred);
6d2010ae 794 shmseg->u.shm_perm.cgid = shmseg->u.shm_perm.gid = kauth_cred_getgid(cred);
2d21ac55 795 shmseg->u.shm_perm.mode = (shmseg->u.shm_perm.mode & SHMSEG_WANTED) |
1c79356b 796 (mode & ACCESSPERMS) | SHMSEG_ALLOCATED;
2d21ac55
A
797 shmseg->u.shm_segsz = uap->size;
798 shmseg->u.shm_cpid = p->p_pid;
799 shmseg->u.shm_lpid = shmseg->u.shm_nattch = 0;
800 shmseg->u.shm_atime = shmseg->u.shm_dtime = 0;
801#if CONFIG_MACF
802 mac_sysvshm_label_associate(cred, shmseg);
803#endif
804 shmseg->u.shm_ctime = sysv_shmtime();
1c79356b
A
805 shm_committed += btoc(size);
806 shm_nused++;
2d21ac55
A
807 AUDIT_ARG(svipc_perm, &shmseg->u.shm_perm);
808 if (shmseg->u.shm_perm.mode & SHMSEG_WANTED) {
1c79356b
A
809 /*
810 * Somebody else wanted this key while we were asleep. Wake
811 * them up now.
812 */
2d21ac55 813 shmseg->u.shm_perm.mode &= ~SHMSEG_WANTED;
1c79356b
A
814 wakeup((caddr_t)shmseg);
815 }
816 *retval = shmid;
55e303ae 817 AUDIT_ARG(svipc_id, shmid);
1c79356b
A
818 return 0;
819out:
b0d623f7
A
820 if (kret != KERN_SUCCESS) {
821 for (shm_handle = CAST_DOWN(void *,shmseg->u.shm_internal); /* tunnel */
822 shm_handle != NULL;
823 shm_handle = shm_handle_next) {
824 shm_handle_next = shm_handle->shm_handle_next;
825 mach_memory_entry_port_release(shm_handle->shm_object);
826 FREE((caddr_t) shm_handle, M_SHM);
827 }
828 shmseg->u.shm_internal = USER_ADDR_NULL; /* tunnel */
829 }
830
1c79356b
A
831 switch (kret) {
832 case KERN_INVALID_ADDRESS:
833 case KERN_NO_SPACE:
834 return (ENOMEM);
835 case KERN_PROTECTION_FAILURE:
836 return (EACCES);
837 default:
838 return (EINVAL);
839 }
840
841}
842
843int
b0d623f7 844shmget(struct proc *p, struct shmget_args *uap, int32_t *retval)
1c79356b
A
845{
846 int segnum, mode, error;
91447636
A
847 int shmget_ret = 0;
848
55e303ae 849 /* Auditing is actually done in shmget_allocate_segment() */
91447636
A
850
851 SYSV_SHM_SUBSYS_LOCK();
852
853 if (!shm_inited) {
2d21ac55 854 shminit(NULL);
91447636 855 }
9bccf70c 856
1c79356b
A
857 mode = uap->shmflg & ACCESSPERMS;
858 if (uap->key != IPC_PRIVATE) {
859 again:
860 segnum = shm_find_segment_by_key(uap->key);
861 if (segnum >= 0) {
91447636 862 error = shmget_existing(uap, mode, segnum, retval);
1c79356b
A
863 if (error == EAGAIN)
864 goto again;
91447636
A
865 shmget_ret = error;
866 goto shmget_out;
867 }
868 if ((uap->shmflg & IPC_CREAT) == 0) {
869 shmget_ret = ENOENT;
870 goto shmget_out;
1c79356b 871 }
1c79356b 872 }
91447636
A
873 shmget_ret = shmget_allocate_segment(p, uap, mode, retval);
874shmget_out:
875 SYSV_SHM_SUBSYS_UNLOCK();
876 return shmget_ret;
1c79356b
A
877 /*NOTREACHED*/
878
879}
880
b0d623f7
A
881/*
882 * shmsys
883 *
884 * Entry point for all SHM calls: shmat, oshmctl, shmdt, shmget, shmctl
885 *
886 * Parameters: p Process requesting the call
887 * uap User argument descriptor (see below)
888 * retval Return value of the selected shm call
889 *
890 * Indirect parameters: uap->which msg call to invoke (index in array of shm calls)
891 * uap->a2 User argument descriptor
892 *
893 * Returns: 0 Success
894 * !0 Not success
895 *
896 * Implicit returns: retval Return value of the selected shm call
897 *
898 * DEPRECATED: This interface should not be used to call the other SHM
899 * functions (shmat, oshmctl, shmdt, shmget, shmctl). The correct
900 * usage is to call the other SHM functions directly.
901 */
1c79356b 902int
b0d623f7 903shmsys(struct proc *p, struct shmsys_args *uap, int32_t *retval)
1c79356b
A
904{
905
91447636 906 /* The routine that we are dispatching already does this */
9bccf70c 907
1c79356b
A
908 if (uap->which >= sizeof(shmcalls)/sizeof(shmcalls[0]))
909 return EINVAL;
910 return ((*shmcalls[uap->which])(p, &uap->a2, retval));
911}
912
91447636
A
913/*
914 * Return 0 on success, 1 on failure.
915 */
916int
917shmfork(struct proc *p1, struct proc *p2)
1c79356b
A
918{
919 struct shmmap_state *shmmap_s;
3e170ce0 920 size_t size;
1c79356b 921 int i;
91447636 922 int shmfork_ret = 0;
1c79356b 923
91447636
A
924 SYSV_SHM_SUBSYS_LOCK();
925
926 if (!shm_inited) {
2d21ac55 927 shminit(NULL);
91447636 928 }
3e170ce0
A
929 size = shminfo.shmseg * sizeof(struct shmmap_state);
930 if (size == 0 || size / shminfo.shmseg != sizeof(struct shmmap_state)) {
931 /* overflow */
932 shmfork_ret = 1;
933 goto shmfork_out;
934 }
91447636
A
935 MALLOC(shmmap_s, struct shmmap_state *, size, M_SHM, M_WAITOK);
936 if (shmmap_s != NULL) {
937 bcopy((caddr_t)p1->vm_shm, (caddr_t)shmmap_s, size);
938 p2->vm_shm = (caddr_t)shmmap_s;
939 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
940 if (shmmap_s->shmid != -1)
2d21ac55 941 shmsegs[IPCID_TO_IX(shmmap_s->shmid)].u.shm_nattch++;
91447636
A
942 shmfork_ret = 0;
943 goto shmfork_out;
944 }
945
946 shmfork_ret = 1; /* failed to copy to child - ENOMEM */
947shmfork_out:
948 SYSV_SHM_SUBSYS_UNLOCK();
949 return shmfork_ret;
1c79356b
A
950}
951
952void
91447636 953shmexit(struct proc *p)
1c79356b
A
954{
955 struct shmmap_state *shmmap_s;
956 int i;
957
958 shmmap_s = (struct shmmap_state *)p->vm_shm;
91447636
A
959
960 SYSV_SHM_SUBSYS_LOCK();
1c79356b
A
961 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
962 if (shmmap_s->shmid != -1)
2d21ac55
A
963 /*
964 * XXX: Should the MAC framework enforce
965 * check here as well.
966 */
55e303ae
A
967 shm_delete_mapping(p, shmmap_s, 1);
968 FREE((caddr_t)p->vm_shm, M_SHM);
969 p->vm_shm = NULL;
91447636 970 SYSV_SHM_SUBSYS_UNLOCK();
55e303ae
A
971}
972
973/*
974 * shmexec() is like shmexit(), only it doesn't delete the mappings,
975 * since the old address space has already been destroyed and the new
976 * one instantiated. Instead, it just does the housekeeping work we
977 * need to do to keep the System V shared memory subsystem sane.
978 */
979__private_extern__ void
91447636 980shmexec(struct proc *p)
55e303ae
A
981{
982 struct shmmap_state *shmmap_s;
983 int i;
984
985 shmmap_s = (struct shmmap_state *)p->vm_shm;
91447636 986 SYSV_SHM_SUBSYS_LOCK();
55e303ae
A
987 for (i = 0; i < shminfo.shmseg; i++, shmmap_s++)
988 if (shmmap_s->shmid != -1)
989 shm_delete_mapping(p, shmmap_s, 0);
1c79356b
A
990 FREE((caddr_t)p->vm_shm, M_SHM);
991 p->vm_shm = NULL;
91447636 992 SYSV_SHM_SUBSYS_UNLOCK();
1c79356b
A
993}
994
995void
91447636 996shminit(__unused void *dummy)
1c79356b
A
997{
998 int i;
999 int s;
1000
9bccf70c 1001 if (!shm_inited) {
91447636
A
1002 /*
1003 * we store internally 64 bit, since if we didn't, we would
1004 * be unable to represent a segment size in excess of 32 bits
1005 * with the (struct shmid_ds)->shm_segsz field; also, POSIX
1006 * dictates this filed be a size_t, which is 64 bits when
1007 * running 64 bit binaries.
1008 */
2d21ac55 1009 s = sizeof(struct shmid_kernel) * shminfo.shmmni;
9bccf70c 1010
2d21ac55 1011 MALLOC(shmsegs, struct shmid_kernel *, s, M_SHM, M_WAITOK);
91447636
A
1012 if (shmsegs == NULL) {
1013 /* XXX fail safely: leave shared memory uninited */
1014 return;
1015 }
9bccf70c 1016 for (i = 0; i < shminfo.shmmni; i++) {
2d21ac55
A
1017 shmsegs[i].u.shm_perm.mode = SHMSEG_FREE;
1018 shmsegs[i].u.shm_perm._seq = 0;
1019#if CONFIG_MACF
1020 mac_sysvshm_label_init(&shmsegs[i]);
1021#endif
9bccf70c
A
1022 }
1023 shm_last_free = 0;
1024 shm_nused = 0;
1025 shm_committed = 0;
1026 shm_inited = 1;
1027 }
1028}
91447636
A
1029/* Initialize the mutex governing access to the SysV shm subsystem */
1030__private_extern__ void
1031sysv_shm_lock_init( void )
1032{
1033
1034 sysv_shm_subsys_lck_grp_attr = lck_grp_attr_alloc_init();
91447636
A
1035
1036 sysv_shm_subsys_lck_grp = lck_grp_alloc_init("sysv_shm_subsys_lock", sysv_shm_subsys_lck_grp_attr);
1037
1038 sysv_shm_subsys_lck_attr = lck_attr_alloc_init();
91447636
A
1039 lck_mtx_init(&sysv_shm_subsys_mutex, sysv_shm_subsys_lck_grp, sysv_shm_subsys_lck_attr);
1040}
9bccf70c
A
1041
1042/* (struct sysctl_oid *oidp, void *arg1, int arg2, \
1043 struct sysctl_req *req) */
1044static int
91447636
A
1045sysctl_shminfo(__unused struct sysctl_oid *oidp, void *arg1,
1046 __unused int arg2, struct sysctl_req *req)
9bccf70c
A
1047{
1048 int error = 0;
91447636 1049 int sysctl_shminfo_ret = 0;
2d21ac55 1050 uint64_t saved_shmmax;
3e170ce0
A
1051 uint64_t saved_shmseg;
1052 uint64_t saved_shmmni;
1053 uint64_t saved_shmall;
9bccf70c 1054
0c530ab8 1055 error = SYSCTL_OUT(req, arg1, sizeof(int64_t));
91447636 1056 if (error || req->newptr == USER_ADDR_NULL)
9bccf70c 1057 return(error);
1c79356b 1058
91447636 1059 SYSV_SHM_SUBSYS_LOCK();
91447636 1060
2d21ac55
A
1061 /* shmmni can not be changed after SysV SHM has been initialized */
1062 if (shm_inited && arg1 == &shminfo.shmmni) {
1063 sysctl_shminfo_ret = EPERM;
1064 goto sysctl_shminfo_out;
1065 }
3e170ce0
A
1066 saved_shmmax = shminfo.shmmax;
1067 saved_shmseg = shminfo.shmseg;
1068 saved_shmmni = shminfo.shmmni;
1069 saved_shmall = shminfo.shmall;
9bccf70c 1070
2d21ac55
A
1071 if ((error = SYSCTL_IN(req, arg1, sizeof(int64_t))) != 0) {
1072 sysctl_shminfo_ret = error;
1073 goto sysctl_shminfo_out;
1074 }
1075
1076 if (arg1 == &shminfo.shmmax) {
1077 /* shmmax needs to be page-aligned */
1078 if (shminfo.shmmax & PAGE_MASK_64) {
1079 shminfo.shmmax = saved_shmmax;
1080 sysctl_shminfo_ret = EINVAL;
1081 goto sysctl_shminfo_out;
9bccf70c 1082 }
1c79356b 1083 }
3e170ce0
A
1084 else if (arg1 == &shminfo.shmseg) {
1085 /* add a sanity check - 20847256 */
1086 if (shminfo.shmseg > INT32_MAX || shminfo.shmseg < 0) {
1087 shminfo.shmseg = saved_shmseg;
1088 sysctl_shminfo_ret = EINVAL;
1089 goto sysctl_shminfo_out;
1090 }
1091 }
1092 else if (arg1 == &shminfo.shmmni) {
1093 /* add a sanity check - 20847256 */
1094 if (shminfo.shmmni > INT32_MAX || shminfo.shmmni < 0) {
1095 shminfo.shmmni = saved_shmmni;
1096 sysctl_shminfo_ret = EINVAL;
1097 goto sysctl_shminfo_out;
1098 }
1099 }
1100 else if (arg1 == &shminfo.shmall) {
1101 /* add a sanity check - 20847256 */
1102 if (shminfo.shmall > INT32_MAX || shminfo.shmall < 0) {
1103 shminfo.shmall = saved_shmall;
1104 sysctl_shminfo_ret = EINVAL;
1105 goto sysctl_shminfo_out;
1106 }
1107 }
91447636
A
1108 sysctl_shminfo_ret = 0;
1109sysctl_shminfo_out:
1110 SYSV_SHM_SUBSYS_UNLOCK();
1111 return sysctl_shminfo_ret;
1112}
1113
1114static int
1115IPCS_shm_sysctl(__unused struct sysctl_oid *oidp, __unused void *arg1,
1116 __unused int arg2, struct sysctl_req *req)
1117{
1118 int error;
1119 int cursor;
1120 union {
b0d623f7 1121 struct user32_IPCS_command u32;
91447636
A
1122 struct user_IPCS_command u64;
1123 } ipcs;
b0d623f7 1124 struct user32_shmid_ds shmid_ds32; /* post conversion, 32 bit version */
22ba694c 1125 struct user_shmid_ds shmid_ds; /* 64 bit version */
91447636
A
1126 void *shmid_dsp;
1127 size_t ipcs_sz = sizeof(struct user_IPCS_command);
1128 size_t shmid_ds_sz = sizeof(struct user_shmid_ds);
1129 struct proc *p = current_proc();
1130
91447636
A
1131 SYSV_SHM_SUBSYS_LOCK();
1132
1133 if (!shm_inited) {
2d21ac55 1134 shminit(NULL);
91447636
A
1135 }
1136
1137 if (!IS_64BIT_PROCESS(p)) {
b0d623f7
A
1138 ipcs_sz = sizeof(struct user32_IPCS_command);
1139 shmid_ds_sz = sizeof(struct user32_shmid_ds);
91447636
A
1140 }
1141
1142 /* Copy in the command structure */
1143 if ((error = SYSCTL_IN(req, &ipcs, ipcs_sz)) != 0) {
1144 goto ipcs_shm_sysctl_out;
1145 }
1146
1147 if (!IS_64BIT_PROCESS(p)) /* convert in place */
1148 ipcs.u64.ipcs_data = CAST_USER_ADDR_T(ipcs.u32.ipcs_data);
1149
1150 /* Let us version this interface... */
1151 if (ipcs.u64.ipcs_magic != IPCS_MAGIC) {
1152 error = EINVAL;
1153 goto ipcs_shm_sysctl_out;
1154 }
1155
1156 switch(ipcs.u64.ipcs_op) {
1157 case IPCS_SHM_CONF: /* Obtain global configuration data */
1158 if (ipcs.u64.ipcs_datalen != sizeof(struct shminfo)) {
1159 if (ipcs.u64.ipcs_cursor != 0) { /* fwd. compat. */
1160 error = ENOMEM;
1161 break;
1162 }
1163 error = ERANGE;
1164 break;
1165 }
1166 error = copyout(&shminfo, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1167 break;
1168
1169 case IPCS_SHM_ITER: /* Iterate over existing segments */
1170 cursor = ipcs.u64.ipcs_cursor;
1171 if (cursor < 0 || cursor >= shminfo.shmmni) {
1172 error = ERANGE;
1173 break;
1174 }
1175 if (ipcs.u64.ipcs_datalen != (int)shmid_ds_sz) {
2d21ac55 1176 error = EINVAL;
91447636
A
1177 break;
1178 }
1179 for( ; cursor < shminfo.shmmni; cursor++) {
2d21ac55 1180 if (shmsegs[cursor].u.shm_perm.mode & SHMSEG_ALLOCATED)
91447636
A
1181 break;
1182 continue;
1183 }
1184 if (cursor == shminfo.shmmni) {
1185 error = ENOENT;
1186 break;
1187 }
1188
1189 shmid_dsp = &shmsegs[cursor]; /* default: 64 bit */
1190
1191 /*
1192 * If necessary, convert the 64 bit kernel segment
1193 * descriptor to a 32 bit user one.
1194 */
1195 if (!IS_64BIT_PROCESS(p)) {
1196 shmid_ds_64to32(shmid_dsp, &shmid_ds32);
22ba694c
A
1197
1198 /* Clear kernel reserved pointer before copying to user space */
1199 shmid_ds32.shm_internal = (user32_addr_t)0;
1200
91447636 1201 shmid_dsp = &shmid_ds32;
22ba694c
A
1202 } else {
1203 memcpy(&shmid_ds, shmid_dsp, sizeof(shmid_ds));
1204
1205 /* Clear kernel reserved pointer before copying to user space */
1206 shmid_ds.shm_internal = USER_ADDR_NULL;
1207
1208 shmid_dsp = &shmid_ds;
91447636
A
1209 }
1210 error = copyout(shmid_dsp, ipcs.u64.ipcs_data, ipcs.u64.ipcs_datalen);
1211 if (!error) {
1212 /* update cursor */
1213 ipcs.u64.ipcs_cursor = cursor + 1;
1214
1215 if (!IS_64BIT_PROCESS(p)) /* convert in place */
b0d623f7
A
1216 ipcs.u32.ipcs_data = CAST_DOWN_EXPLICIT(user32_addr_t,ipcs.u64.ipcs_data);
1217
1218 error = SYSCTL_OUT(req, &ipcs, ipcs_sz);
91447636
A
1219 }
1220 break;
1221
1222 default:
1223 error = EINVAL;
1224 break;
1225 }
1226ipcs_shm_sysctl_out:
1227 SYSV_SHM_SUBSYS_UNLOCK();
1228 return(error);
1c79356b 1229}
9bccf70c 1230
6d2010ae 1231SYSCTL_NODE(_kern, KERN_SYSV, sysv, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSV");
9bccf70c 1232
6d2010ae 1233SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmax, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
91447636 1234 &shminfo.shmmax, 0, &sysctl_shminfo ,"Q","shmmax");
9bccf70c 1235
6d2010ae 1236SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmin, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
91447636 1237 &shminfo.shmmin, 0, &sysctl_shminfo ,"Q","shmmin");
9bccf70c 1238
6d2010ae 1239SYSCTL_PROC(_kern_sysv, OID_AUTO, shmmni, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
91447636 1240 &shminfo.shmmni, 0, &sysctl_shminfo ,"Q","shmmni");
9bccf70c 1241
6d2010ae 1242SYSCTL_PROC(_kern_sysv, OID_AUTO, shmseg, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
91447636 1243 &shminfo.shmseg, 0, &sysctl_shminfo ,"Q","shmseg");
9bccf70c 1244
6d2010ae 1245SYSCTL_PROC(_kern_sysv, OID_AUTO, shmall, CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED,
91447636 1246 &shminfo.shmall, 0, &sysctl_shminfo ,"Q","shmall");
9bccf70c 1247
6d2010ae 1248SYSCTL_NODE(_kern_sysv, OID_AUTO, ipcs, CTLFLAG_RW | CTLFLAG_LOCKED | CTLFLAG_ANYBODY, 0, "SYSVIPCS");
9bccf70c 1249
6d2010ae 1250SYSCTL_PROC(_kern_sysv_ipcs, OID_AUTO, shm, CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_LOCKED,
91447636
A
1251 0, 0, IPCS_shm_sysctl,
1252 "S,IPCS_shm_command",
1253 "ipcs shm command interface");
2d21ac55
A
1254#endif /* SYSV_SHM */
1255
1256/* DSEP Review Done pl-20051108-v02 @2743,@2908,@2913,@3009 */