3 * Copyright (C) 1992, 1993 Krishna Balasubramanian
4 * Many improvements/fixes by Bruno Haible.
5 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
8 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9 * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11 * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
18 #include <linux/config.h>
19 #include <linux/slab.h>
21 #include <linux/hugetlb.h>
22 #include <linux/shm.h>
23 #include <linux/init.h>
24 #include <linux/file.h>
25 #include <linux/mman.h>
26 #include <linux/proc_fs.h>
27 #include <linux/shmem_fs.h>
28 #include <linux/security.h>
29 #include <linux/syscalls.h>
30 #include <asm/uaccess.h>
34 #define shm_flags shm_perm.mode
36 static struct file_operations shm_file_operations
;
37 static struct vm_operations_struct shm_vm_ops
;
39 static struct ipc_ids shm_ids
;
41 #define shm_lock(id) ((struct shmid_kernel*)ipc_lock(&shm_ids,id))
42 #define shm_unlock(shp) ipc_unlock(&(shp)->shm_perm)
43 #define shm_get(id) ((struct shmid_kernel*)ipc_get(&shm_ids,id))
44 #define shm_buildid(id, seq) \
45 ipc_buildid(&shm_ids, id, seq)
47 static int newseg (key_t key
, int shmflg
, size_t size
);
48 static void shm_open (struct vm_area_struct
*shmd
);
49 static void shm_close (struct vm_area_struct
*shmd
);
51 static int sysvipc_shm_read_proc(char *buffer
, char **start
, off_t offset
, int length
, int *eof
, void *data
);
54 size_t shm_ctlmax
= SHMMAX
;
55 size_t shm_ctlall
= SHMALL
;
56 int shm_ctlmni
= SHMMNI
;
58 static int shm_tot
; /* total number of shared memory pages */
60 void __init
shm_init (void)
62 ipc_init_ids(&shm_ids
, 1);
64 create_proc_read_entry("sysvipc/shm", 0, NULL
, sysvipc_shm_read_proc
, NULL
);
68 static inline int shm_checkid(struct shmid_kernel
*s
, int id
)
70 if (ipc_checkid(&shm_ids
,&s
->shm_perm
,id
))
75 static inline struct shmid_kernel
*shm_rmid(int id
)
77 return (struct shmid_kernel
*)ipc_rmid(&shm_ids
,id
);
80 static inline int shm_addid(struct shmid_kernel
*shp
)
82 return ipc_addid(&shm_ids
, &shp
->shm_perm
, shm_ctlmni
);
87 static inline void shm_inc (int id
) {
88 struct shmid_kernel
*shp
;
90 if(!(shp
= shm_lock(id
)))
92 shp
->shm_atim
= get_seconds();
93 shp
->shm_lprid
= current
->tgid
;
98 /* This is called by fork, once for every shm attach. */
99 static void shm_open (struct vm_area_struct
*shmd
)
101 shm_inc (shmd
->vm_file
->f_dentry
->d_inode
->i_ino
);
105 * shm_destroy - free the struct shmid_kernel
107 * @shp: struct to free
109 * It has to be called with shp and shm_ids.sem locked,
110 * but returns with shp unlocked and freed.
112 static void shm_destroy (struct shmid_kernel
*shp
)
114 shm_tot
-= (shp
->shm_segsz
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
117 if (!is_file_hugepages(shp
->shm_file
))
118 shmem_lock(shp
->shm_file
, 0, shp
->mlock_user
);
120 user_shm_unlock(shp
->shm_file
->f_dentry
->d_inode
->i_size
,
122 fput (shp
->shm_file
);
123 security_shm_free(shp
);
128 * remove the attach descriptor shmd.
129 * free memory for segment if it is marked destroyed.
130 * The descriptor has already been removed from the current->mm->mmap list
131 * and will later be kfree()d.
133 static void shm_close (struct vm_area_struct
*shmd
)
135 struct file
* file
= shmd
->vm_file
;
136 int id
= file
->f_dentry
->d_inode
->i_ino
;
137 struct shmid_kernel
*shp
;
140 /* remove from the list of attaches of the shm segment */
141 if(!(shp
= shm_lock(id
)))
143 shp
->shm_lprid
= current
->tgid
;
144 shp
->shm_dtim
= get_seconds();
146 if(shp
->shm_nattch
== 0 &&
147 shp
->shm_flags
& SHM_DEST
)
154 static int shm_mmap(struct file
* file
, struct vm_area_struct
* vma
)
157 vma
->vm_ops
= &shm_vm_ops
;
158 shm_inc(file
->f_dentry
->d_inode
->i_ino
);
162 static struct file_operations shm_file_operations
= {
166 static struct vm_operations_struct shm_vm_ops
= {
167 .open
= shm_open
, /* callback for a new vm-area open */
168 .close
= shm_close
, /* callback for when the vm-area is released */
169 .nopage
= shmem_nopage
,
171 .set_policy
= shmem_set_policy
,
172 .get_policy
= shmem_get_policy
,
176 static int newseg (key_t key
, int shmflg
, size_t size
)
179 struct shmid_kernel
*shp
;
180 int numpages
= (size
+ PAGE_SIZE
-1) >> PAGE_SHIFT
;
185 if (size
< SHMMIN
|| size
> shm_ctlmax
)
188 if (shm_tot
+ numpages
>= shm_ctlall
)
191 shp
= ipc_rcu_alloc(sizeof(*shp
));
195 shp
->shm_perm
.key
= key
;
196 shp
->shm_flags
= (shmflg
& S_IRWXUGO
);
197 shp
->mlock_user
= NULL
;
199 shp
->shm_perm
.security
= NULL
;
200 error
= security_shm_alloc(shp
);
206 if (shmflg
& SHM_HUGETLB
) {
207 /* hugetlb_zero_setup takes care of mlock user accounting */
208 file
= hugetlb_zero_setup(size
);
209 shp
->mlock_user
= current
->user
;
211 sprintf (name
, "SYSV%08x", key
);
212 file
= shmem_file_setup(name
, size
, VM_ACCOUNT
);
214 error
= PTR_ERR(file
);
223 shp
->shm_cprid
= current
->tgid
;
225 shp
->shm_atim
= shp
->shm_dtim
= 0;
226 shp
->shm_ctim
= get_seconds();
227 shp
->shm_segsz
= size
;
229 shp
->id
= shm_buildid(id
,shp
->shm_perm
.seq
);
230 shp
->shm_file
= file
;
231 file
->f_dentry
->d_inode
->i_ino
= shp
->id
;
232 if (shmflg
& SHM_HUGETLB
)
233 set_file_hugepages(file
);
235 file
->f_op
= &shm_file_operations
;
243 security_shm_free(shp
);
248 asmlinkage
long sys_shmget (key_t key
, size_t size
, int shmflg
)
250 struct shmid_kernel
*shp
;
254 if (key
== IPC_PRIVATE
) {
255 err
= newseg(key
, shmflg
, size
);
256 } else if ((id
= ipc_findkey(&shm_ids
, key
)) == -1) {
257 if (!(shmflg
& IPC_CREAT
))
260 err
= newseg(key
, shmflg
, size
);
261 } else if ((shmflg
& IPC_CREAT
) && (shmflg
& IPC_EXCL
)) {
267 if (shp
->shm_segsz
< size
)
269 else if (ipcperms(&shp
->shm_perm
, shmflg
))
272 int shmid
= shm_buildid(id
, shp
->shm_perm
.seq
);
273 err
= security_shm_associate(shp
, shmflg
);
284 static inline unsigned long copy_shmid_to_user(void __user
*buf
, struct shmid64_ds
*in
, int version
)
288 return copy_to_user(buf
, in
, sizeof(*in
));
293 ipc64_perm_to_ipc_perm(&in
->shm_perm
, &out
.shm_perm
);
294 out
.shm_segsz
= in
->shm_segsz
;
295 out
.shm_atime
= in
->shm_atime
;
296 out
.shm_dtime
= in
->shm_dtime
;
297 out
.shm_ctime
= in
->shm_ctime
;
298 out
.shm_cpid
= in
->shm_cpid
;
299 out
.shm_lpid
= in
->shm_lpid
;
300 out
.shm_nattch
= in
->shm_nattch
;
302 return copy_to_user(buf
, &out
, sizeof(out
));
315 static inline unsigned long copy_shmid_from_user(struct shm_setbuf
*out
, void __user
*buf
, int version
)
320 struct shmid64_ds tbuf
;
322 if (copy_from_user(&tbuf
, buf
, sizeof(tbuf
)))
325 out
->uid
= tbuf
.shm_perm
.uid
;
326 out
->gid
= tbuf
.shm_perm
.gid
;
327 out
->mode
= tbuf
.shm_flags
;
333 struct shmid_ds tbuf_old
;
335 if (copy_from_user(&tbuf_old
, buf
, sizeof(tbuf_old
)))
338 out
->uid
= tbuf_old
.shm_perm
.uid
;
339 out
->gid
= tbuf_old
.shm_perm
.gid
;
340 out
->mode
= tbuf_old
.shm_flags
;
349 static inline unsigned long copy_shminfo_to_user(void __user
*buf
, struct shminfo64
*in
, int version
)
353 return copy_to_user(buf
, in
, sizeof(*in
));
358 if(in
->shmmax
> INT_MAX
)
359 out
.shmmax
= INT_MAX
;
361 out
.shmmax
= (int)in
->shmmax
;
363 out
.shmmin
= in
->shmmin
;
364 out
.shmmni
= in
->shmmni
;
365 out
.shmseg
= in
->shmseg
;
366 out
.shmall
= in
->shmall
;
368 return copy_to_user(buf
, &out
, sizeof(out
));
375 static void shm_get_stat(unsigned long *rss
, unsigned long *swp
)
382 for (i
= 0; i
<= shm_ids
.max_id
; i
++) {
383 struct shmid_kernel
*shp
;
390 inode
= shp
->shm_file
->f_dentry
->d_inode
;
392 if (is_file_hugepages(shp
->shm_file
)) {
393 struct address_space
*mapping
= inode
->i_mapping
;
394 *rss
+= (HPAGE_SIZE
/PAGE_SIZE
)*mapping
->nrpages
;
396 struct shmem_inode_info
*info
= SHMEM_I(inode
);
397 spin_lock(&info
->lock
);
398 *rss
+= inode
->i_mapping
->nrpages
;
399 *swp
+= info
->swapped
;
400 spin_unlock(&info
->lock
);
405 asmlinkage
long sys_shmctl (int shmid
, int cmd
, struct shmid_ds __user
*buf
)
407 struct shm_setbuf setbuf
;
408 struct shmid_kernel
*shp
;
411 if (cmd
< 0 || shmid
< 0) {
416 version
= ipc_parse_version(&cmd
);
418 switch (cmd
) { /* replace with proc interface ? */
421 struct shminfo64 shminfo
;
423 err
= security_shm_shmctl(NULL
, cmd
);
427 memset(&shminfo
,0,sizeof(shminfo
));
428 shminfo
.shmmni
= shminfo
.shmseg
= shm_ctlmni
;
429 shminfo
.shmmax
= shm_ctlmax
;
430 shminfo
.shmall
= shm_ctlall
;
432 shminfo
.shmmin
= SHMMIN
;
433 if(copy_shminfo_to_user (buf
, &shminfo
, version
))
435 /* reading a integer is always atomic */
443 struct shm_info shm_info
;
445 err
= security_shm_shmctl(NULL
, cmd
);
449 memset(&shm_info
,0,sizeof(shm_info
));
451 shm_info
.used_ids
= shm_ids
.in_use
;
452 shm_get_stat (&shm_info
.shm_rss
, &shm_info
.shm_swp
);
453 shm_info
.shm_tot
= shm_tot
;
454 shm_info
.swap_attempts
= 0;
455 shm_info
.swap_successes
= 0;
456 err
= shm_ids
.max_id
;
458 if(copy_to_user (buf
, &shm_info
, sizeof(shm_info
))) {
463 err
= err
< 0 ? 0 : err
;
469 struct shmid64_ds tbuf
;
471 memset(&tbuf
, 0, sizeof(tbuf
));
472 shp
= shm_lock(shmid
);
476 } else if(cmd
==SHM_STAT
) {
478 if (shmid
> shm_ids
.max_id
)
480 result
= shm_buildid(shmid
, shp
->shm_perm
.seq
);
482 err
= shm_checkid(shp
,shmid
);
488 if (ipcperms (&shp
->shm_perm
, S_IRUGO
))
490 err
= security_shm_shmctl(shp
, cmd
);
493 kernel_to_ipc64_perm(&shp
->shm_perm
, &tbuf
.shm_perm
);
494 tbuf
.shm_segsz
= shp
->shm_segsz
;
495 tbuf
.shm_atime
= shp
->shm_atim
;
496 tbuf
.shm_dtime
= shp
->shm_dtim
;
497 tbuf
.shm_ctime
= shp
->shm_ctim
;
498 tbuf
.shm_cpid
= shp
->shm_cprid
;
499 tbuf
.shm_lpid
= shp
->shm_lprid
;
500 if (!is_file_hugepages(shp
->shm_file
))
501 tbuf
.shm_nattch
= shp
->shm_nattch
;
503 tbuf
.shm_nattch
= file_count(shp
->shm_file
) - 1;
505 if(copy_shmid_to_user (buf
, &tbuf
, version
))
514 /* Allow superuser to lock segment in memory */
515 if (!can_do_mlock() && cmd
== SHM_LOCK
) {
519 shp
= shm_lock(shmid
);
524 err
= shm_checkid(shp
,shmid
);
528 err
= security_shm_shmctl(shp
, cmd
);
533 struct user_struct
* user
= current
->user
;
534 if (!is_file_hugepages(shp
->shm_file
)) {
535 err
= shmem_lock(shp
->shm_file
, 1, user
);
537 shp
->shm_flags
|= SHM_LOCKED
;
538 shp
->mlock_user
= user
;
541 } else if (!is_file_hugepages(shp
->shm_file
)) {
542 shmem_lock(shp
->shm_file
, 0, shp
->mlock_user
);
543 shp
->shm_flags
&= ~SHM_LOCKED
;
544 shp
->mlock_user
= NULL
;
552 * We cannot simply remove the file. The SVID states
553 * that the block remains until the last person
554 * detaches from it, then is deleted. A shmat() on
555 * an RMID segment is legal in older Linux and if
556 * we change it apps break...
558 * Instead we set a destroyed flag, and then blow
559 * the name away when the usage hits zero.
562 shp
= shm_lock(shmid
);
566 err
= shm_checkid(shp
, shmid
);
570 if (current
->euid
!= shp
->shm_perm
.uid
&&
571 current
->euid
!= shp
->shm_perm
.cuid
&&
572 !capable(CAP_SYS_ADMIN
)) {
577 err
= security_shm_shmctl(shp
, cmd
);
581 if (shp
->shm_nattch
){
582 shp
->shm_flags
|= SHM_DEST
;
583 /* Do not find it any more */
584 shp
->shm_perm
.key
= IPC_PRIVATE
;
594 if (copy_shmid_from_user (&setbuf
, buf
, version
)) {
599 shp
= shm_lock(shmid
);
603 err
= shm_checkid(shp
,shmid
);
607 if (current
->euid
!= shp
->shm_perm
.uid
&&
608 current
->euid
!= shp
->shm_perm
.cuid
&&
609 !capable(CAP_SYS_ADMIN
)) {
613 err
= security_shm_shmctl(shp
, cmd
);
617 shp
->shm_perm
.uid
= setbuf
.uid
;
618 shp
->shm_perm
.gid
= setbuf
.gid
;
619 shp
->shm_flags
= (shp
->shm_flags
& ~S_IRWXUGO
)
620 | (setbuf
.mode
& S_IRWXUGO
);
621 shp
->shm_ctim
= get_seconds();
643 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
645 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
646 * "raddr" thing points to kernel space, and there has to be a wrapper around
649 long do_shmat(int shmid
, char __user
*shmaddr
, int shmflg
, ulong
*raddr
)
651 struct shmid_kernel
*shp
;
658 unsigned long o_flags
;
665 } else if ((addr
= (ulong
)shmaddr
)) {
666 if (addr
& (SHMLBA
-1)) {
667 if (shmflg
& SHM_RND
)
668 addr
&= ~(SHMLBA
-1); /* round down */
670 #ifndef __ARCH_FORCE_SHMLBA
671 if (addr
& ~PAGE_MASK
)
675 flags
= MAP_SHARED
| MAP_FIXED
;
677 if ((shmflg
& SHM_REMAP
))
683 if (shmflg
& SHM_RDONLY
) {
688 prot
= PROT_READ
| PROT_WRITE
;
690 acc_mode
= S_IRUGO
| S_IWUGO
;
692 if (shmflg
& SHM_EXEC
) {
698 * We cannot rely on the fs check since SYSV IPC does have an
699 * additional creator id...
701 shp
= shm_lock(shmid
);
706 err
= shm_checkid(shp
,shmid
);
711 if (ipcperms(&shp
->shm_perm
, acc_mode
)) {
717 err
= security_shm_shmat(shp
, shmaddr
, shmflg
);
723 file
= shp
->shm_file
;
724 size
= i_size_read(file
->f_dentry
->d_inode
);
728 down_write(¤t
->mm
->mmap_sem
);
729 if (addr
&& !(shmflg
& SHM_REMAP
)) {
730 user_addr
= ERR_PTR(-EINVAL
);
731 if (find_vma_intersection(current
->mm
, addr
, addr
+ size
))
734 * If shm segment goes below stack, make sure there is some
735 * space left for the stack to grow (at least 4 pages).
737 if (addr
< current
->mm
->start_stack
&&
738 addr
> current
->mm
->start_stack
- size
- PAGE_SIZE
* 5)
742 user_addr
= (void*) do_mmap (file
, addr
, size
, prot
, flags
, 0);
745 up_write(¤t
->mm
->mmap_sem
);
748 if(!(shp
= shm_lock(shmid
)))
751 if(shp
->shm_nattch
== 0 &&
752 shp
->shm_flags
& SHM_DEST
)
758 *raddr
= (unsigned long) user_addr
;
760 if (IS_ERR(user_addr
))
761 err
= PTR_ERR(user_addr
);
767 * detach and kill segment if marked destroyed.
768 * The work is done in shm_close.
770 asmlinkage
long sys_shmdt(char __user
*shmaddr
)
772 struct mm_struct
*mm
= current
->mm
;
773 struct vm_area_struct
*vma
, *next
;
774 unsigned long addr
= (unsigned long)shmaddr
;
776 int retval
= -EINVAL
;
778 down_write(&mm
->mmap_sem
);
781 * This function tries to be smart and unmap shm segments that
782 * were modified by partial mlock or munmap calls:
783 * - It first determines the size of the shm segment that should be
784 * unmapped: It searches for a vma that is backed by shm and that
785 * started at address shmaddr. It records it's size and then unmaps
787 * - Then it unmaps all shm vmas that started at shmaddr and that
788 * are within the initially determined size.
789 * Errors from do_munmap are ignored: the function only fails if
790 * it's called with invalid parameters or if it's called to unmap
791 * a part of a vma. Both calls in this function are for full vmas,
792 * the parameters are directly copied from the vma itself and always
793 * valid - therefore do_munmap cannot fail. (famous last words?)
796 * If it had been mremap()'d, the starting address would not
797 * match the usual checks anyway. So assume all vma's are
798 * above the starting address given.
800 vma
= find_vma(mm
, addr
);
806 * Check if the starting address would match, i.e. it's
807 * a fragment created by mprotect() and/or munmap(), or it
808 * otherwise it starts at this address with no hassles.
810 if ((vma
->vm_ops
== &shm_vm_ops
|| is_vm_hugetlb_page(vma
)) &&
811 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
) {
814 size
= vma
->vm_file
->f_dentry
->d_inode
->i_size
;
815 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
817 * We discovered the size of the shm segment, so
818 * break out of here and fall through to the next
819 * loop that uses the size information to stop
820 * searching for matching vma's.
830 * We need look no further than the maximum address a fragment
831 * could possibly have landed at. Also cast things to loff_t to
832 * prevent overflows and make comparisions vs. equal-width types.
834 while (vma
&& (loff_t
)(vma
->vm_end
- addr
) <= size
) {
837 /* finding a matching vma now does not alter retval */
838 if ((vma
->vm_ops
== &shm_vm_ops
|| is_vm_hugetlb_page(vma
)) &&
839 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
)
841 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
845 up_write(&mm
->mmap_sem
);
849 #ifdef CONFIG_PROC_FS
850 static int sysvipc_shm_read_proc(char *buffer
, char **start
, off_t offset
, int length
, int *eof
, void *data
)
857 len
+= sprintf(buffer
, " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n");
859 for(i
= 0; i
<= shm_ids
.max_id
; i
++) {
860 struct shmid_kernel
* shp
;
864 #define SMALL_STRING "%10d %10d %4o %10u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
865 #define BIG_STRING "%10d %10d %4o %21u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
868 if (sizeof(size_t) <= sizeof(int))
869 format
= SMALL_STRING
;
872 len
+= sprintf(buffer
+ len
, format
,
874 shm_buildid(i
, shp
->shm_perm
.seq
),
879 is_file_hugepages(shp
->shm_file
) ? (file_count(shp
->shm_file
) - 1) : shp
->shm_nattch
,
894 if(pos
> offset
+ length
)
901 *start
= buffer
+ (offset
- begin
);
902 len
-= (offset
- begin
);