3 * Copyright (C) 1992, 1993 Krishna Balasubramanian
4 * Many improvements/fixes by Bruno Haible.
5 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
6 * Fixed the shm swap deallocation (shm_unuse()), August 1998 Andrea Arcangeli.
8 * /proc/sysvipc/shm support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
9 * BIGMEM support, Andrea Arcangeli <andrea@suse.de>
10 * SMP thread shm, Jean-Luc Boyard <jean-luc.boyard@siemens.fr>
11 * HIGHMEM support, Ingo Molnar <mingo@redhat.com>
12 * Make shmmax, shmall, shmmni sysctl'able, Christoph Rohland <cr@sap.com>
13 * Shared /dev/zero support, Kanoj Sarcar <kanoj@sgi.com>
14 * Move the mm functionality over to mm/shmem.c, Christoph Rohland <cr@sap.com>
18 #include <linux/config.h>
19 #include <linux/slab.h>
21 #include <linux/hugetlb.h>
22 #include <linux/shm.h>
23 #include <linux/init.h>
24 #include <linux/file.h>
25 #include <linux/mman.h>
26 #include <linux/shmem_fs.h>
27 #include <linux/security.h>
28 #include <linux/syscalls.h>
29 #include <linux/audit.h>
30 #include <linux/ptrace.h>
31 #include <linux/seq_file.h>
33 #include <asm/uaccess.h>
37 #define shm_flags shm_perm.mode
39 static struct file_operations shm_file_operations
;
40 static struct vm_operations_struct shm_vm_ops
;
42 static struct ipc_ids shm_ids
;
44 #define shm_lock(id) ((struct shmid_kernel*)ipc_lock(&shm_ids,id))
45 #define shm_unlock(shp) ipc_unlock(&(shp)->shm_perm)
46 #define shm_get(id) ((struct shmid_kernel*)ipc_get(&shm_ids,id))
47 #define shm_buildid(id, seq) \
48 ipc_buildid(&shm_ids, id, seq)
50 static int newseg (key_t key
, int shmflg
, size_t size
);
51 static void shm_open (struct vm_area_struct
*shmd
);
52 static void shm_close (struct vm_area_struct
*shmd
);
54 static int sysvipc_shm_proc_show(struct seq_file
*s
, void *it
);
57 size_t shm_ctlmax
= SHMMAX
;
58 size_t shm_ctlall
= SHMALL
;
59 int shm_ctlmni
= SHMMNI
;
61 static int shm_tot
; /* total number of shared memory pages */
63 void __init
shm_init (void)
65 ipc_init_ids(&shm_ids
, 1);
66 ipc_init_proc_interface("sysvipc/shm",
67 " key shmid perms size cpid lpid nattch uid gid cuid cgid atime dtime ctime\n",
69 sysvipc_shm_proc_show
);
72 static inline int shm_checkid(struct shmid_kernel
*s
, int id
)
74 if (ipc_checkid(&shm_ids
,&s
->shm_perm
,id
))
79 static inline struct shmid_kernel
*shm_rmid(int id
)
81 return (struct shmid_kernel
*)ipc_rmid(&shm_ids
,id
);
84 static inline int shm_addid(struct shmid_kernel
*shp
)
86 return ipc_addid(&shm_ids
, &shp
->shm_perm
, shm_ctlmni
);
91 static inline void shm_inc (int id
) {
92 struct shmid_kernel
*shp
;
94 if(!(shp
= shm_lock(id
)))
96 shp
->shm_atim
= get_seconds();
97 shp
->shm_lprid
= current
->tgid
;
102 /* This is called by fork, once for every shm attach. */
103 static void shm_open (struct vm_area_struct
*shmd
)
105 shm_inc (shmd
->vm_file
->f_dentry
->d_inode
->i_ino
);
109 * shm_destroy - free the struct shmid_kernel
111 * @shp: struct to free
113 * It has to be called with shp and shm_ids.sem locked,
114 * but returns with shp unlocked and freed.
116 static void shm_destroy (struct shmid_kernel
*shp
)
118 shm_tot
-= (shp
->shm_segsz
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
121 if (!is_file_hugepages(shp
->shm_file
))
122 shmem_lock(shp
->shm_file
, 0, shp
->mlock_user
);
124 user_shm_unlock(shp
->shm_file
->f_dentry
->d_inode
->i_size
,
126 fput (shp
->shm_file
);
127 security_shm_free(shp
);
132 * remove the attach descriptor shmd.
133 * free memory for segment if it is marked destroyed.
134 * The descriptor has already been removed from the current->mm->mmap list
135 * and will later be kfree()d.
137 static void shm_close (struct vm_area_struct
*shmd
)
139 struct file
* file
= shmd
->vm_file
;
140 int id
= file
->f_dentry
->d_inode
->i_ino
;
141 struct shmid_kernel
*shp
;
144 /* remove from the list of attaches of the shm segment */
145 if(!(shp
= shm_lock(id
)))
147 shp
->shm_lprid
= current
->tgid
;
148 shp
->shm_dtim
= get_seconds();
150 if(shp
->shm_nattch
== 0 &&
151 shp
->shm_flags
& SHM_DEST
)
158 static int shm_mmap(struct file
* file
, struct vm_area_struct
* vma
)
161 vma
->vm_ops
= &shm_vm_ops
;
162 shm_inc(file
->f_dentry
->d_inode
->i_ino
);
166 static struct file_operations shm_file_operations
= {
170 static struct vm_operations_struct shm_vm_ops
= {
171 .open
= shm_open
, /* callback for a new vm-area open */
172 .close
= shm_close
, /* callback for when the vm-area is released */
173 .nopage
= shmem_nopage
,
174 #if defined(CONFIG_NUMA) && defined(CONFIG_SHMEM)
175 .set_policy
= shmem_set_policy
,
176 .get_policy
= shmem_get_policy
,
180 static int newseg (key_t key
, int shmflg
, size_t size
)
183 struct shmid_kernel
*shp
;
184 int numpages
= (size
+ PAGE_SIZE
-1) >> PAGE_SHIFT
;
189 if (size
< SHMMIN
|| size
> shm_ctlmax
)
192 if (shm_tot
+ numpages
>= shm_ctlall
)
195 shp
= ipc_rcu_alloc(sizeof(*shp
));
199 shp
->shm_perm
.key
= key
;
200 shp
->shm_flags
= (shmflg
& S_IRWXUGO
);
201 shp
->mlock_user
= NULL
;
203 shp
->shm_perm
.security
= NULL
;
204 error
= security_shm_alloc(shp
);
210 if (shmflg
& SHM_HUGETLB
) {
211 /* hugetlb_zero_setup takes care of mlock user accounting */
212 file
= hugetlb_zero_setup(size
);
213 shp
->mlock_user
= current
->user
;
215 sprintf (name
, "SYSV%08x", key
);
216 file
= shmem_file_setup(name
, size
, VM_ACCOUNT
);
218 error
= PTR_ERR(file
);
227 shp
->shm_cprid
= current
->tgid
;
229 shp
->shm_atim
= shp
->shm_dtim
= 0;
230 shp
->shm_ctim
= get_seconds();
231 shp
->shm_segsz
= size
;
233 shp
->id
= shm_buildid(id
,shp
->shm_perm
.seq
);
234 shp
->shm_file
= file
;
235 file
->f_dentry
->d_inode
->i_ino
= shp
->id
;
237 /* Hugetlb ops would have already been assigned. */
238 if (!(shmflg
& SHM_HUGETLB
))
239 file
->f_op
= &shm_file_operations
;
248 security_shm_free(shp
);
253 asmlinkage
long sys_shmget (key_t key
, size_t size
, int shmflg
)
255 struct shmid_kernel
*shp
;
259 if (key
== IPC_PRIVATE
) {
260 err
= newseg(key
, shmflg
, size
);
261 } else if ((id
= ipc_findkey(&shm_ids
, key
)) == -1) {
262 if (!(shmflg
& IPC_CREAT
))
265 err
= newseg(key
, shmflg
, size
);
266 } else if ((shmflg
& IPC_CREAT
) && (shmflg
& IPC_EXCL
)) {
272 if (shp
->shm_segsz
< size
)
274 else if (ipcperms(&shp
->shm_perm
, shmflg
))
277 int shmid
= shm_buildid(id
, shp
->shm_perm
.seq
);
278 err
= security_shm_associate(shp
, shmflg
);
289 static inline unsigned long copy_shmid_to_user(void __user
*buf
, struct shmid64_ds
*in
, int version
)
293 return copy_to_user(buf
, in
, sizeof(*in
));
298 ipc64_perm_to_ipc_perm(&in
->shm_perm
, &out
.shm_perm
);
299 out
.shm_segsz
= in
->shm_segsz
;
300 out
.shm_atime
= in
->shm_atime
;
301 out
.shm_dtime
= in
->shm_dtime
;
302 out
.shm_ctime
= in
->shm_ctime
;
303 out
.shm_cpid
= in
->shm_cpid
;
304 out
.shm_lpid
= in
->shm_lpid
;
305 out
.shm_nattch
= in
->shm_nattch
;
307 return copy_to_user(buf
, &out
, sizeof(out
));
320 static inline unsigned long copy_shmid_from_user(struct shm_setbuf
*out
, void __user
*buf
, int version
)
325 struct shmid64_ds tbuf
;
327 if (copy_from_user(&tbuf
, buf
, sizeof(tbuf
)))
330 out
->uid
= tbuf
.shm_perm
.uid
;
331 out
->gid
= tbuf
.shm_perm
.gid
;
332 out
->mode
= tbuf
.shm_flags
;
338 struct shmid_ds tbuf_old
;
340 if (copy_from_user(&tbuf_old
, buf
, sizeof(tbuf_old
)))
343 out
->uid
= tbuf_old
.shm_perm
.uid
;
344 out
->gid
= tbuf_old
.shm_perm
.gid
;
345 out
->mode
= tbuf_old
.shm_flags
;
354 static inline unsigned long copy_shminfo_to_user(void __user
*buf
, struct shminfo64
*in
, int version
)
358 return copy_to_user(buf
, in
, sizeof(*in
));
363 if(in
->shmmax
> INT_MAX
)
364 out
.shmmax
= INT_MAX
;
366 out
.shmmax
= (int)in
->shmmax
;
368 out
.shmmin
= in
->shmmin
;
369 out
.shmmni
= in
->shmmni
;
370 out
.shmseg
= in
->shmseg
;
371 out
.shmall
= in
->shmall
;
373 return copy_to_user(buf
, &out
, sizeof(out
));
380 static void shm_get_stat(unsigned long *rss
, unsigned long *swp
)
387 for (i
= 0; i
<= shm_ids
.max_id
; i
++) {
388 struct shmid_kernel
*shp
;
395 inode
= shp
->shm_file
->f_dentry
->d_inode
;
397 if (is_file_hugepages(shp
->shm_file
)) {
398 struct address_space
*mapping
= inode
->i_mapping
;
399 *rss
+= (HPAGE_SIZE
/PAGE_SIZE
)*mapping
->nrpages
;
401 struct shmem_inode_info
*info
= SHMEM_I(inode
);
402 spin_lock(&info
->lock
);
403 *rss
+= inode
->i_mapping
->nrpages
;
404 *swp
+= info
->swapped
;
405 spin_unlock(&info
->lock
);
410 asmlinkage
long sys_shmctl (int shmid
, int cmd
, struct shmid_ds __user
*buf
)
412 struct shm_setbuf setbuf
;
413 struct shmid_kernel
*shp
;
416 if (cmd
< 0 || shmid
< 0) {
421 version
= ipc_parse_version(&cmd
);
423 switch (cmd
) { /* replace with proc interface ? */
426 struct shminfo64 shminfo
;
428 err
= security_shm_shmctl(NULL
, cmd
);
432 memset(&shminfo
,0,sizeof(shminfo
));
433 shminfo
.shmmni
= shminfo
.shmseg
= shm_ctlmni
;
434 shminfo
.shmmax
= shm_ctlmax
;
435 shminfo
.shmall
= shm_ctlall
;
437 shminfo
.shmmin
= SHMMIN
;
438 if(copy_shminfo_to_user (buf
, &shminfo
, version
))
440 /* reading a integer is always atomic */
448 struct shm_info shm_info
;
450 err
= security_shm_shmctl(NULL
, cmd
);
454 memset(&shm_info
,0,sizeof(shm_info
));
456 shm_info
.used_ids
= shm_ids
.in_use
;
457 shm_get_stat (&shm_info
.shm_rss
, &shm_info
.shm_swp
);
458 shm_info
.shm_tot
= shm_tot
;
459 shm_info
.swap_attempts
= 0;
460 shm_info
.swap_successes
= 0;
461 err
= shm_ids
.max_id
;
463 if(copy_to_user (buf
, &shm_info
, sizeof(shm_info
))) {
468 err
= err
< 0 ? 0 : err
;
474 struct shmid64_ds tbuf
;
476 memset(&tbuf
, 0, sizeof(tbuf
));
477 shp
= shm_lock(shmid
);
481 } else if(cmd
==SHM_STAT
) {
483 if (shmid
> shm_ids
.max_id
)
485 result
= shm_buildid(shmid
, shp
->shm_perm
.seq
);
487 err
= shm_checkid(shp
,shmid
);
493 if (ipcperms (&shp
->shm_perm
, S_IRUGO
))
495 err
= security_shm_shmctl(shp
, cmd
);
498 kernel_to_ipc64_perm(&shp
->shm_perm
, &tbuf
.shm_perm
);
499 tbuf
.shm_segsz
= shp
->shm_segsz
;
500 tbuf
.shm_atime
= shp
->shm_atim
;
501 tbuf
.shm_dtime
= shp
->shm_dtim
;
502 tbuf
.shm_ctime
= shp
->shm_ctim
;
503 tbuf
.shm_cpid
= shp
->shm_cprid
;
504 tbuf
.shm_lpid
= shp
->shm_lprid
;
505 if (!is_file_hugepages(shp
->shm_file
))
506 tbuf
.shm_nattch
= shp
->shm_nattch
;
508 tbuf
.shm_nattch
= file_count(shp
->shm_file
) - 1;
510 if(copy_shmid_to_user (buf
, &tbuf
, version
))
519 shp
= shm_lock(shmid
);
524 err
= shm_checkid(shp
,shmid
);
528 if (!capable(CAP_IPC_LOCK
)) {
530 if (current
->euid
!= shp
->shm_perm
.uid
&&
531 current
->euid
!= shp
->shm_perm
.cuid
)
533 if (cmd
== SHM_LOCK
&&
534 !current
->signal
->rlim
[RLIMIT_MEMLOCK
].rlim_cur
)
538 err
= security_shm_shmctl(shp
, cmd
);
543 struct user_struct
* user
= current
->user
;
544 if (!is_file_hugepages(shp
->shm_file
)) {
545 err
= shmem_lock(shp
->shm_file
, 1, user
);
547 shp
->shm_flags
|= SHM_LOCKED
;
548 shp
->mlock_user
= user
;
551 } else if (!is_file_hugepages(shp
->shm_file
)) {
552 shmem_lock(shp
->shm_file
, 0, shp
->mlock_user
);
553 shp
->shm_flags
&= ~SHM_LOCKED
;
554 shp
->mlock_user
= NULL
;
562 * We cannot simply remove the file. The SVID states
563 * that the block remains until the last person
564 * detaches from it, then is deleted. A shmat() on
565 * an RMID segment is legal in older Linux and if
566 * we change it apps break...
568 * Instead we set a destroyed flag, and then blow
569 * the name away when the usage hits zero.
572 shp
= shm_lock(shmid
);
576 err
= shm_checkid(shp
, shmid
);
580 if (current
->euid
!= shp
->shm_perm
.uid
&&
581 current
->euid
!= shp
->shm_perm
.cuid
&&
582 !capable(CAP_SYS_ADMIN
)) {
587 err
= security_shm_shmctl(shp
, cmd
);
591 if (shp
->shm_nattch
){
592 shp
->shm_flags
|= SHM_DEST
;
593 /* Do not find it any more */
594 shp
->shm_perm
.key
= IPC_PRIVATE
;
604 if (copy_shmid_from_user (&setbuf
, buf
, version
)) {
608 if ((err
= audit_ipc_perms(0, setbuf
.uid
, setbuf
.gid
, setbuf
.mode
)))
611 shp
= shm_lock(shmid
);
615 err
= shm_checkid(shp
,shmid
);
619 if (current
->euid
!= shp
->shm_perm
.uid
&&
620 current
->euid
!= shp
->shm_perm
.cuid
&&
621 !capable(CAP_SYS_ADMIN
)) {
625 err
= security_shm_shmctl(shp
, cmd
);
629 shp
->shm_perm
.uid
= setbuf
.uid
;
630 shp
->shm_perm
.gid
= setbuf
.gid
;
631 shp
->shm_flags
= (shp
->shm_flags
& ~S_IRWXUGO
)
632 | (setbuf
.mode
& S_IRWXUGO
);
633 shp
->shm_ctim
= get_seconds();
655 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
657 * NOTE! Despite the name, this is NOT a direct system call entrypoint. The
658 * "raddr" thing points to kernel space, and there has to be a wrapper around
661 long do_shmat(int shmid
, char __user
*shmaddr
, int shmflg
, ulong
*raddr
)
663 struct shmid_kernel
*shp
;
670 unsigned long o_flags
;
677 } else if ((addr
= (ulong
)shmaddr
)) {
678 if (addr
& (SHMLBA
-1)) {
679 if (shmflg
& SHM_RND
)
680 addr
&= ~(SHMLBA
-1); /* round down */
682 #ifndef __ARCH_FORCE_SHMLBA
683 if (addr
& ~PAGE_MASK
)
687 flags
= MAP_SHARED
| MAP_FIXED
;
689 if ((shmflg
& SHM_REMAP
))
695 if (shmflg
& SHM_RDONLY
) {
700 prot
= PROT_READ
| PROT_WRITE
;
702 acc_mode
= S_IRUGO
| S_IWUGO
;
704 if (shmflg
& SHM_EXEC
) {
710 * We cannot rely on the fs check since SYSV IPC does have an
711 * additional creator id...
713 shp
= shm_lock(shmid
);
718 err
= shm_checkid(shp
,shmid
);
723 if (ipcperms(&shp
->shm_perm
, acc_mode
)) {
729 err
= security_shm_shmat(shp
, shmaddr
, shmflg
);
735 file
= shp
->shm_file
;
736 size
= i_size_read(file
->f_dentry
->d_inode
);
740 down_write(¤t
->mm
->mmap_sem
);
741 if (addr
&& !(shmflg
& SHM_REMAP
)) {
742 user_addr
= ERR_PTR(-EINVAL
);
743 if (find_vma_intersection(current
->mm
, addr
, addr
+ size
))
746 * If shm segment goes below stack, make sure there is some
747 * space left for the stack to grow (at least 4 pages).
749 if (addr
< current
->mm
->start_stack
&&
750 addr
> current
->mm
->start_stack
- size
- PAGE_SIZE
* 5)
754 user_addr
= (void*) do_mmap (file
, addr
, size
, prot
, flags
, 0);
757 up_write(¤t
->mm
->mmap_sem
);
760 if(!(shp
= shm_lock(shmid
)))
763 if(shp
->shm_nattch
== 0 &&
764 shp
->shm_flags
& SHM_DEST
)
770 *raddr
= (unsigned long) user_addr
;
772 if (IS_ERR(user_addr
))
773 err
= PTR_ERR(user_addr
);
778 asmlinkage
long sys_shmat(int shmid
, char __user
*shmaddr
, int shmflg
)
783 err
= do_shmat(shmid
, shmaddr
, shmflg
, &ret
);
786 force_successful_syscall_return();
791 * detach and kill segment if marked destroyed.
792 * The work is done in shm_close.
794 asmlinkage
long sys_shmdt(char __user
*shmaddr
)
796 struct mm_struct
*mm
= current
->mm
;
797 struct vm_area_struct
*vma
, *next
;
798 unsigned long addr
= (unsigned long)shmaddr
;
800 int retval
= -EINVAL
;
802 down_write(&mm
->mmap_sem
);
805 * This function tries to be smart and unmap shm segments that
806 * were modified by partial mlock or munmap calls:
807 * - It first determines the size of the shm segment that should be
808 * unmapped: It searches for a vma that is backed by shm and that
809 * started at address shmaddr. It records it's size and then unmaps
811 * - Then it unmaps all shm vmas that started at shmaddr and that
812 * are within the initially determined size.
813 * Errors from do_munmap are ignored: the function only fails if
814 * it's called with invalid parameters or if it's called to unmap
815 * a part of a vma. Both calls in this function are for full vmas,
816 * the parameters are directly copied from the vma itself and always
817 * valid - therefore do_munmap cannot fail. (famous last words?)
820 * If it had been mremap()'d, the starting address would not
821 * match the usual checks anyway. So assume all vma's are
822 * above the starting address given.
824 vma
= find_vma(mm
, addr
);
830 * Check if the starting address would match, i.e. it's
831 * a fragment created by mprotect() and/or munmap(), or it
832 * otherwise it starts at this address with no hassles.
834 if ((vma
->vm_ops
== &shm_vm_ops
|| is_vm_hugetlb_page(vma
)) &&
835 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
) {
838 size
= vma
->vm_file
->f_dentry
->d_inode
->i_size
;
839 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
841 * We discovered the size of the shm segment, so
842 * break out of here and fall through to the next
843 * loop that uses the size information to stop
844 * searching for matching vma's.
854 * We need look no further than the maximum address a fragment
855 * could possibly have landed at. Also cast things to loff_t to
856 * prevent overflows and make comparisions vs. equal-width types.
858 while (vma
&& (loff_t
)(vma
->vm_end
- addr
) <= size
) {
861 /* finding a matching vma now does not alter retval */
862 if ((vma
->vm_ops
== &shm_vm_ops
|| is_vm_hugetlb_page(vma
)) &&
863 (vma
->vm_start
- addr
)/PAGE_SIZE
== vma
->vm_pgoff
)
865 do_munmap(mm
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
);
869 up_write(&mm
->mmap_sem
);
873 #ifdef CONFIG_PROC_FS
874 static int sysvipc_shm_proc_show(struct seq_file
*s
, void *it
)
876 struct shmid_kernel
*shp
= it
;
879 #define SMALL_STRING "%10d %10d %4o %10u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
880 #define BIG_STRING "%10d %10d %4o %21u %5u %5u %5d %5u %5u %5u %5u %10lu %10lu %10lu\n"
882 if (sizeof(size_t) <= sizeof(int))
883 format
= SMALL_STRING
;
886 return seq_printf(s
, format
,
893 is_file_hugepages(shp
->shm_file
) ? (file_count(shp
->shm_file
) - 1) : shp
->shm_nattch
,