17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
507b65a64Saguzovsk * Common Development and Distribution License (the "License").
607b65a64Saguzovsk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
21a0de58d6SRoger A. Faulkner
227c478bd9Sstevel@tonic-gate /*
23a19609f8Sjv * Copyright (c) 1986, 2010, Oracle and/or its affiliates. All rights reserved.
247c478bd9Sstevel@tonic-gate */
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
277c478bd9Sstevel@tonic-gate /* All Rights Reserved */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate /*
307c478bd9Sstevel@tonic-gate * University Copyright- Copyright (c) 1982, 1986, 1988
317c478bd9Sstevel@tonic-gate * The Regents of the University of California
327c478bd9Sstevel@tonic-gate * All Rights Reserved
337c478bd9Sstevel@tonic-gate *
347c478bd9Sstevel@tonic-gate * University Acknowledgment- Portions of this document are derived from
357c478bd9Sstevel@tonic-gate * software developed by the University of California, Berkeley, and its
367c478bd9Sstevel@tonic-gate * contributors.
377c478bd9Sstevel@tonic-gate */
387c478bd9Sstevel@tonic-gate
397c478bd9Sstevel@tonic-gate /*
407c478bd9Sstevel@tonic-gate * Inter-Process Communication Shared Memory Facility.
417c478bd9Sstevel@tonic-gate *
427c478bd9Sstevel@tonic-gate * See os/ipc.c for a description of common IPC functionality.
437c478bd9Sstevel@tonic-gate *
447c478bd9Sstevel@tonic-gate * Resource controls
457c478bd9Sstevel@tonic-gate * -----------------
467c478bd9Sstevel@tonic-gate *
47824c205fSml * Control: zone.max-shm-ids (rc_zone_shmmni)
48824c205fSml * Description: Maximum number of shared memory ids allowed a zone.
49824c205fSml *
50824c205fSml * When shmget() is used to allocate a shared memory segment, one id
51824c205fSml * is allocated. If the id allocation doesn't succeed, shmget()
52824c205fSml * fails and errno is set to ENOSPC. Upon successful shmctl(,
53824c205fSml * IPC_RMID) the id is deallocated.
54824c205fSml *
557c478bd9Sstevel@tonic-gate * Control: project.max-shm-ids (rc_project_shmmni)
567c478bd9Sstevel@tonic-gate * Description: Maximum number of shared memory ids allowed a project.
577c478bd9Sstevel@tonic-gate *
587c478bd9Sstevel@tonic-gate * When shmget() is used to allocate a shared memory segment, one id
597c478bd9Sstevel@tonic-gate * is allocated. If the id allocation doesn't succeed, shmget()
607c478bd9Sstevel@tonic-gate * fails and errno is set to ENOSPC. Upon successful shmctl(,
617c478bd9Sstevel@tonic-gate * IPC_RMID) the id is deallocated.
627c478bd9Sstevel@tonic-gate *
63824c205fSml * Control: zone.max-shm-memory (rc_zone_shmmax)
64824c205fSml * Description: Total amount of shared memory allowed a zone.
65824c205fSml *
66824c205fSml * When shmget() is used to allocate a shared memory segment, the
67824c205fSml * segment's size is allocated against this limit. If the space
68824c205fSml * allocation doesn't succeed, shmget() fails and errno is set to
69824c205fSml * EINVAL. The size will be deallocated once the last process has
70824c205fSml * detached the segment and the segment has been successfully
71824c205fSml * shmctl(, IPC_RMID)ed.
72824c205fSml *
737c478bd9Sstevel@tonic-gate * Control: project.max-shm-memory (rc_project_shmmax)
747c478bd9Sstevel@tonic-gate * Description: Total amount of shared memory allowed a project.
757c478bd9Sstevel@tonic-gate *
767c478bd9Sstevel@tonic-gate * When shmget() is used to allocate a shared memory segment, the
777c478bd9Sstevel@tonic-gate * segment's size is allocated against this limit. If the space
787c478bd9Sstevel@tonic-gate * allocation doesn't succeed, shmget() fails and errno is set to
797c478bd9Sstevel@tonic-gate * EINVAL. The size will be deallocated once the last process has
807c478bd9Sstevel@tonic-gate * detached the segment and the segment has been successfully
817c478bd9Sstevel@tonic-gate * shmctl(, IPC_RMID)ed.
827c478bd9Sstevel@tonic-gate */
837c478bd9Sstevel@tonic-gate
847c478bd9Sstevel@tonic-gate #include <sys/types.h>
857c478bd9Sstevel@tonic-gate #include <sys/param.h>
867c478bd9Sstevel@tonic-gate #include <sys/cred.h>
877c478bd9Sstevel@tonic-gate #include <sys/errno.h>
887c478bd9Sstevel@tonic-gate #include <sys/time.h>
897c478bd9Sstevel@tonic-gate #include <sys/kmem.h>
907c478bd9Sstevel@tonic-gate #include <sys/user.h>
917c478bd9Sstevel@tonic-gate #include <sys/proc.h>
927c478bd9Sstevel@tonic-gate #include <sys/systm.h>
937c478bd9Sstevel@tonic-gate #include <sys/prsystm.h>
947c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
957c478bd9Sstevel@tonic-gate #include <sys/tuneable.h>
967c478bd9Sstevel@tonic-gate #include <sys/vm.h>
977c478bd9Sstevel@tonic-gate #include <sys/mman.h>
987c478bd9Sstevel@tonic-gate #include <sys/swap.h>
997c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h>
1007c478bd9Sstevel@tonic-gate #include <sys/debug.h>
1017c478bd9Sstevel@tonic-gate #include <sys/lwpchan_impl.h>
1027c478bd9Sstevel@tonic-gate #include <sys/avl.h>
1037c478bd9Sstevel@tonic-gate #include <sys/modctl.h>
1047c478bd9Sstevel@tonic-gate #include <sys/syscall.h>
1057c478bd9Sstevel@tonic-gate #include <sys/task.h>
1067c478bd9Sstevel@tonic-gate #include <sys/project.h>
1077c478bd9Sstevel@tonic-gate #include <sys/policy.h>
1087c478bd9Sstevel@tonic-gate #include <sys/zone.h>
109c6939658Ssl #include <sys/rctl.h>
1107c478bd9Sstevel@tonic-gate
1117c478bd9Sstevel@tonic-gate #include <sys/ipc.h>
1127c478bd9Sstevel@tonic-gate #include <sys/ipc_impl.h>
1137c478bd9Sstevel@tonic-gate #include <sys/shm.h>
1147c478bd9Sstevel@tonic-gate #include <sys/shm_impl.h>
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate #include <vm/hat.h>
1177c478bd9Sstevel@tonic-gate #include <vm/seg.h>
1187c478bd9Sstevel@tonic-gate #include <vm/as.h>
1197c478bd9Sstevel@tonic-gate #include <vm/seg_vn.h>
1207c478bd9Sstevel@tonic-gate #include <vm/anon.h>
1217c478bd9Sstevel@tonic-gate #include <vm/page.h>
1227c478bd9Sstevel@tonic-gate #include <vm/vpage.h>
1237c478bd9Sstevel@tonic-gate #include <vm/seg_spt.h>
1247c478bd9Sstevel@tonic-gate
1257c478bd9Sstevel@tonic-gate #include <c2/audit.h>
1267c478bd9Sstevel@tonic-gate
127c6939658Ssl static int shmem_lock(kshmid_t *sp, struct anon_map *amp);
128c6939658Ssl static void shmem_unlock(kshmid_t *sp, struct anon_map *amp);
1297c478bd9Sstevel@tonic-gate static void sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags,
1307c478bd9Sstevel@tonic-gate kshmid_t *id);
13168803f2dSsl static void shm_rm_amp(kshmid_t *sp);
1327c478bd9Sstevel@tonic-gate static void shm_dtor(kipc_perm_t *);
1337c478bd9Sstevel@tonic-gate static void shm_rmid(kipc_perm_t *);
1347c478bd9Sstevel@tonic-gate static void shm_remove_zone(zoneid_t, void *);
1357c478bd9Sstevel@tonic-gate
1367c478bd9Sstevel@tonic-gate /*
1377c478bd9Sstevel@tonic-gate * Semantics for share_page_table and ism_off:
1387c478bd9Sstevel@tonic-gate *
1397c478bd9Sstevel@tonic-gate * These are hooks in /etc/system - only for internal testing purpose.
1407c478bd9Sstevel@tonic-gate *
1417c478bd9Sstevel@tonic-gate * Setting share_page_table automatically turns on the SHM_SHARE_MMU (ISM) flag
1427c478bd9Sstevel@tonic-gate * in a call to shmat(2). In other words, with share_page_table set, you always
1437c478bd9Sstevel@tonic-gate * get ISM, even if say, DISM is specified. It should really be called "ism_on".
1447c478bd9Sstevel@tonic-gate *
1457c478bd9Sstevel@tonic-gate * Setting ism_off turns off the SHM_SHARE_MMU flag from the flags passed to
1467c478bd9Sstevel@tonic-gate * shmat(2).
1477c478bd9Sstevel@tonic-gate *
1487c478bd9Sstevel@tonic-gate * If both share_page_table and ism_off are set, share_page_table prevails.
1497c478bd9Sstevel@tonic-gate *
1507c478bd9Sstevel@tonic-gate * Although these tunables should probably be removed, they do have some
1517c478bd9Sstevel@tonic-gate * external exposure; as long as they exist, they should at least work sensibly.
1527c478bd9Sstevel@tonic-gate */
1537c478bd9Sstevel@tonic-gate
1547c478bd9Sstevel@tonic-gate int share_page_table;
1557c478bd9Sstevel@tonic-gate int ism_off;
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate /*
1587c478bd9Sstevel@tonic-gate * The following tunables are obsolete. Though for compatibility we
1597c478bd9Sstevel@tonic-gate * still read and interpret shminfo_shmmax and shminfo_shmmni (see
1607c478bd9Sstevel@tonic-gate * os/project.c), the preferred mechanism for administrating the IPC
1617c478bd9Sstevel@tonic-gate * Shared Memory facility is through the resource controls described at
1627c478bd9Sstevel@tonic-gate * the top of this file.
1637c478bd9Sstevel@tonic-gate */
1647c478bd9Sstevel@tonic-gate size_t shminfo_shmmax = 0x800000; /* (obsolete) */
1657c478bd9Sstevel@tonic-gate int shminfo_shmmni = 100; /* (obsolete) */
1667c478bd9Sstevel@tonic-gate size_t shminfo_shmmin = 1; /* (obsolete) */
1677c478bd9Sstevel@tonic-gate int shminfo_shmseg = 6; /* (obsolete) */
1687c478bd9Sstevel@tonic-gate
169824c205fSml extern rctl_hndl_t rc_zone_shmmax;
170824c205fSml extern rctl_hndl_t rc_zone_shmmni;
1717c478bd9Sstevel@tonic-gate extern rctl_hndl_t rc_project_shmmax;
1727c478bd9Sstevel@tonic-gate extern rctl_hndl_t rc_project_shmmni;
1737c478bd9Sstevel@tonic-gate static ipc_service_t *shm_svc;
1747c478bd9Sstevel@tonic-gate static zone_key_t shm_zone_key;
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate /*
1777c478bd9Sstevel@tonic-gate * Module linkage information for the kernel.
1787c478bd9Sstevel@tonic-gate */
1797c478bd9Sstevel@tonic-gate static uintptr_t shmsys(int, uintptr_t, uintptr_t, uintptr_t);
1807c478bd9Sstevel@tonic-gate
1817c478bd9Sstevel@tonic-gate static struct sysent ipcshm_sysent = {
1827c478bd9Sstevel@tonic-gate 4,
1837c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
1847c478bd9Sstevel@tonic-gate SE_ARGC | SE_NOUNLOAD | SE_64RVAL,
1857c478bd9Sstevel@tonic-gate #else /* _SYSCALL32_IMPL */
1867c478bd9Sstevel@tonic-gate SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,
1877c478bd9Sstevel@tonic-gate #endif /* _SYSCALL32_IMPL */
1889dd95169SToomas Soome (int (*)())(uintptr_t)shmsys
1897c478bd9Sstevel@tonic-gate };
1907c478bd9Sstevel@tonic-gate
1917c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
1927c478bd9Sstevel@tonic-gate static struct sysent ipcshm_sysent32 = {
1937c478bd9Sstevel@tonic-gate 4,
1947c478bd9Sstevel@tonic-gate SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,
1959dd95169SToomas Soome (int (*)())(uintptr_t)shmsys
1967c478bd9Sstevel@tonic-gate };
1977c478bd9Sstevel@tonic-gate #endif /* _SYSCALL32_IMPL */
1987c478bd9Sstevel@tonic-gate
1997c478bd9Sstevel@tonic-gate static struct modlsys modlsys = {
2007c478bd9Sstevel@tonic-gate &mod_syscallops, "System V shared memory", &ipcshm_sysent
2017c478bd9Sstevel@tonic-gate };
2027c478bd9Sstevel@tonic-gate
2037c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
2047c478bd9Sstevel@tonic-gate static struct modlsys modlsys32 = {
2057c478bd9Sstevel@tonic-gate &mod_syscallops32, "32-bit System V shared memory", &ipcshm_sysent32
2067c478bd9Sstevel@tonic-gate };
2077c478bd9Sstevel@tonic-gate #endif /* _SYSCALL32_IMPL */
2087c478bd9Sstevel@tonic-gate
2097c478bd9Sstevel@tonic-gate static struct modlinkage modlinkage = {
2107c478bd9Sstevel@tonic-gate MODREV_1,
2117c478bd9Sstevel@tonic-gate &modlsys,
2127c478bd9Sstevel@tonic-gate #ifdef _SYSCALL32_IMPL
2137c478bd9Sstevel@tonic-gate &modlsys32,
2147c478bd9Sstevel@tonic-gate #endif
2157c478bd9Sstevel@tonic-gate NULL
2167c478bd9Sstevel@tonic-gate };
2177c478bd9Sstevel@tonic-gate
2187c478bd9Sstevel@tonic-gate
2197c478bd9Sstevel@tonic-gate int
_init(void)2207c478bd9Sstevel@tonic-gate _init(void)
2217c478bd9Sstevel@tonic-gate {
2227c478bd9Sstevel@tonic-gate int result;
2237c478bd9Sstevel@tonic-gate
224824c205fSml shm_svc = ipcs_create("shmids", rc_project_shmmni, rc_zone_shmmni,
225824c205fSml sizeof (kshmid_t), shm_dtor, shm_rmid, AT_IPC_SHM,
226824c205fSml offsetof(ipc_rqty_t, ipcq_shmmni));
2277c478bd9Sstevel@tonic-gate zone_key_create(&shm_zone_key, NULL, shm_remove_zone, NULL);
2287c478bd9Sstevel@tonic-gate
2297c478bd9Sstevel@tonic-gate if ((result = mod_install(&modlinkage)) == 0)
2307c478bd9Sstevel@tonic-gate return (0);
2317c478bd9Sstevel@tonic-gate
2327c478bd9Sstevel@tonic-gate (void) zone_key_delete(shm_zone_key);
2337c478bd9Sstevel@tonic-gate ipcs_destroy(shm_svc);
2347c478bd9Sstevel@tonic-gate
2357c478bd9Sstevel@tonic-gate return (result);
2367c478bd9Sstevel@tonic-gate }
2377c478bd9Sstevel@tonic-gate
2387c478bd9Sstevel@tonic-gate int
_fini(void)2397c478bd9Sstevel@tonic-gate _fini(void)
2407c478bd9Sstevel@tonic-gate {
2417c478bd9Sstevel@tonic-gate return (EBUSY);
2427c478bd9Sstevel@tonic-gate }
2437c478bd9Sstevel@tonic-gate
2447c478bd9Sstevel@tonic-gate int
_info(struct modinfo * modinfop)2457c478bd9Sstevel@tonic-gate _info(struct modinfo *modinfop)
2467c478bd9Sstevel@tonic-gate {
2477c478bd9Sstevel@tonic-gate return (mod_info(&modlinkage, modinfop));
2487c478bd9Sstevel@tonic-gate }
2497c478bd9Sstevel@tonic-gate
2507c478bd9Sstevel@tonic-gate /*
2517c478bd9Sstevel@tonic-gate * Shmat (attach shared segment) system call.
2527c478bd9Sstevel@tonic-gate */
2537c478bd9Sstevel@tonic-gate static int
shmat(int shmid,caddr_t uaddr,int uflags,uintptr_t * rvp)2547c478bd9Sstevel@tonic-gate shmat(int shmid, caddr_t uaddr, int uflags, uintptr_t *rvp)
2557c478bd9Sstevel@tonic-gate {
2567c478bd9Sstevel@tonic-gate kshmid_t *sp; /* shared memory header ptr */
2577c478bd9Sstevel@tonic-gate size_t size;
2587c478bd9Sstevel@tonic-gate int error = 0;
2597c478bd9Sstevel@tonic-gate proc_t *pp = curproc;
2607c478bd9Sstevel@tonic-gate struct as *as = pp->p_as;
2617c478bd9Sstevel@tonic-gate struct segvn_crargs crargs; /* segvn create arguments */
2627c478bd9Sstevel@tonic-gate kmutex_t *lock;
2639dd95169SToomas Soome struct seg *segspt = NULL;
2647c478bd9Sstevel@tonic-gate caddr_t addr = uaddr;
2657c478bd9Sstevel@tonic-gate int flags = (uflags & SHMAT_VALID_FLAGS_MASK);
2667c478bd9Sstevel@tonic-gate int useISM;
2677c478bd9Sstevel@tonic-gate uchar_t prot = PROT_ALL;
2687c478bd9Sstevel@tonic-gate int result;
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gate if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL)
2717c478bd9Sstevel@tonic-gate return (EINVAL);
2727c478bd9Sstevel@tonic-gate if (error = ipcperm_access(&sp->shm_perm, SHM_R, CRED()))
2737c478bd9Sstevel@tonic-gate goto errret;
2747c478bd9Sstevel@tonic-gate if ((flags & SHM_RDONLY) == 0 &&
2757c478bd9Sstevel@tonic-gate (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED())))
2767c478bd9Sstevel@tonic-gate goto errret;
2777c478bd9Sstevel@tonic-gate if (spt_invalid(flags)) {
2787c478bd9Sstevel@tonic-gate error = EINVAL;
2797c478bd9Sstevel@tonic-gate goto errret;
2807c478bd9Sstevel@tonic-gate }
2817c478bd9Sstevel@tonic-gate if (ism_off)
2827c478bd9Sstevel@tonic-gate flags = flags & ~SHM_SHARE_MMU;
2837c478bd9Sstevel@tonic-gate if (share_page_table) {
2847c478bd9Sstevel@tonic-gate flags = flags & ~SHM_PAGEABLE;
2857c478bd9Sstevel@tonic-gate flags = flags | SHM_SHARE_MMU;
2867c478bd9Sstevel@tonic-gate }
2877c478bd9Sstevel@tonic-gate useISM = (spt_locked(flags) || spt_pageable(flags));
2887c478bd9Sstevel@tonic-gate if (useISM && (error = ipcperm_access(&sp->shm_perm, SHM_W, CRED())))
2897c478bd9Sstevel@tonic-gate goto errret;
2907c478bd9Sstevel@tonic-gate if (useISM && isspt(sp)) {
2917c478bd9Sstevel@tonic-gate uint_t newsptflags = flags | spt_flags(sp->shm_sptseg);
2927c478bd9Sstevel@tonic-gate /*
2937c478bd9Sstevel@tonic-gate * If trying to change an existing {D}ISM segment from ISM
2947c478bd9Sstevel@tonic-gate * to DISM or vice versa, return error. Note that this
2957c478bd9Sstevel@tonic-gate * validation of flags needs to be done after the effect of
2967c478bd9Sstevel@tonic-gate * tunables such as ism_off and share_page_table, for
2977c478bd9Sstevel@tonic-gate * semantics that are consistent with the tunables' settings.
2987c478bd9Sstevel@tonic-gate */
2997c478bd9Sstevel@tonic-gate if (spt_invalid(newsptflags)) {
3007c478bd9Sstevel@tonic-gate error = EINVAL;
3017c478bd9Sstevel@tonic-gate goto errret;
3027c478bd9Sstevel@tonic-gate }
3037c478bd9Sstevel@tonic-gate }
3047c478bd9Sstevel@tonic-gate ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER);
3057c478bd9Sstevel@tonic-gate size = sp->shm_amp->size;
3067c478bd9Sstevel@tonic-gate ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
3077c478bd9Sstevel@tonic-gate
3087c478bd9Sstevel@tonic-gate /* somewhere to record spt info for final detach */
3097c478bd9Sstevel@tonic-gate if (sp->shm_sptinfo == NULL)
3107c478bd9Sstevel@tonic-gate sp->shm_sptinfo = kmem_zalloc(sizeof (sptinfo_t), KM_SLEEP);
3117c478bd9Sstevel@tonic-gate
3127c478bd9Sstevel@tonic-gate as_rangelock(as);
3137c478bd9Sstevel@tonic-gate
3147c478bd9Sstevel@tonic-gate if (useISM) {
3157c478bd9Sstevel@tonic-gate /*
3167c478bd9Sstevel@tonic-gate * Handle ISM
3177c478bd9Sstevel@tonic-gate */
318ae115bc7Smrj uint_t share_szc;
3197c478bd9Sstevel@tonic-gate size_t share_size;
3207c478bd9Sstevel@tonic-gate struct shm_data ssd;
3217c478bd9Sstevel@tonic-gate uintptr_t align_hint;
3227c478bd9Sstevel@tonic-gate
3237c478bd9Sstevel@tonic-gate /*
3247c478bd9Sstevel@tonic-gate * Pick a share pagesize to use, if (!isspt(sp)).
3257c478bd9Sstevel@tonic-gate * Otherwise use the already chosen page size.
3267c478bd9Sstevel@tonic-gate *
3277c478bd9Sstevel@tonic-gate * For the initial shmat (!isspt(sp)), where sptcreate is
3287c478bd9Sstevel@tonic-gate * called, map_pgsz is called to recommend a [D]ISM pagesize,
3297c478bd9Sstevel@tonic-gate * important for systems which offer more than one potential
3307c478bd9Sstevel@tonic-gate * [D]ISM pagesize.
3317c478bd9Sstevel@tonic-gate * If the shmat is just to attach to an already created
3327c478bd9Sstevel@tonic-gate * [D]ISM segment, then use the previously selected page size.
3337c478bd9Sstevel@tonic-gate */
3347c478bd9Sstevel@tonic-gate if (!isspt(sp)) {
335ec25b48fSsusans share_size = map_pgsz(MAPPGSZ_ISM, pp, addr, size, 0);
3367c478bd9Sstevel@tonic-gate if (share_size == 0) {
3377c478bd9Sstevel@tonic-gate as_rangeunlock(as);
3387c478bd9Sstevel@tonic-gate error = EINVAL;
3397c478bd9Sstevel@tonic-gate goto errret;
3407c478bd9Sstevel@tonic-gate }
3417c478bd9Sstevel@tonic-gate share_szc = page_szc(share_size);
3427c478bd9Sstevel@tonic-gate } else {
3437c478bd9Sstevel@tonic-gate share_szc = sp->shm_sptseg->s_szc;
3447c478bd9Sstevel@tonic-gate share_size = page_get_pagesize(share_szc);
3457c478bd9Sstevel@tonic-gate }
3467c478bd9Sstevel@tonic-gate size = P2ROUNDUP(size, share_size);
3477c478bd9Sstevel@tonic-gate
3487c478bd9Sstevel@tonic-gate align_hint = share_size;
349*86ef0a63SRichard Lowe #if defined(__x86)
3507c478bd9Sstevel@tonic-gate /*
351ae115bc7Smrj * For x86, we want to share as much of the page table tree
352ae115bc7Smrj * as possible. We use a large align_hint at first, but
353ae115bc7Smrj * if that fails, then the code below retries with align_hint
354ae115bc7Smrj * set to share_size.
355ae115bc7Smrj *
356ae115bc7Smrj * The explicit extern here is due to the difficulties
357ae115bc7Smrj * of getting to platform dependent includes. When/if the
358ae115bc7Smrj * platform dependent bits of this function are cleaned up,
359ae115bc7Smrj * another way of doing this should found.
3607c478bd9Sstevel@tonic-gate */
361ae115bc7Smrj {
362ae115bc7Smrj extern uint_t ptes_per_table;
363ae115bc7Smrj
364ae115bc7Smrj while (size >= ptes_per_table * (uint64_t)align_hint)
365ae115bc7Smrj align_hint *= ptes_per_table;
366ae115bc7Smrj }
367*86ef0a63SRichard Lowe #endif /* __x86 */
3687c478bd9Sstevel@tonic-gate
3697c478bd9Sstevel@tonic-gate #if defined(__sparcv9)
370a0de58d6SRoger A. Faulkner if (addr == 0 &&
371a0de58d6SRoger A. Faulkner pp->p_model == DATAMODEL_LP64 && AS_TYPE_64BIT(as)) {
3727c478bd9Sstevel@tonic-gate /*
3737c478bd9Sstevel@tonic-gate * If no address has been passed in, and this is a
3747c478bd9Sstevel@tonic-gate * 64-bit process, we'll try to find an address
3757c478bd9Sstevel@tonic-gate * in the predict-ISM zone.
3767c478bd9Sstevel@tonic-gate */
3777c478bd9Sstevel@tonic-gate caddr_t predbase = (caddr_t)PREDISM_1T_BASE;
3787c478bd9Sstevel@tonic-gate size_t len = PREDISM_BOUND - PREDISM_1T_BASE;
3797c478bd9Sstevel@tonic-gate
3807c478bd9Sstevel@tonic-gate as_purge(as);
3817c478bd9Sstevel@tonic-gate if (as_gap(as, size + share_size, &predbase, &len,
3827c478bd9Sstevel@tonic-gate AH_LO, (caddr_t)NULL) != -1) {
3837c478bd9Sstevel@tonic-gate /*
3847c478bd9Sstevel@tonic-gate * We found an address which looks like a
3857c478bd9Sstevel@tonic-gate * candidate. We want to round it up, and
3867c478bd9Sstevel@tonic-gate * then check that it's a valid user range.
3877c478bd9Sstevel@tonic-gate * This assures that we won't fail below.
3887c478bd9Sstevel@tonic-gate */
3897c478bd9Sstevel@tonic-gate addr = (caddr_t)P2ROUNDUP((uintptr_t)predbase,
3907c478bd9Sstevel@tonic-gate share_size);
3917c478bd9Sstevel@tonic-gate
3927c478bd9Sstevel@tonic-gate if (valid_usr_range(addr, size, prot,
3937c478bd9Sstevel@tonic-gate as, as->a_userlimit) != RANGE_OKAY) {
3947c478bd9Sstevel@tonic-gate addr = 0;
3957c478bd9Sstevel@tonic-gate }
3967c478bd9Sstevel@tonic-gate }
3977c478bd9Sstevel@tonic-gate }
3987c478bd9Sstevel@tonic-gate #endif /* __sparcv9 */
3997c478bd9Sstevel@tonic-gate
4007c478bd9Sstevel@tonic-gate if (addr == 0) {
4017c478bd9Sstevel@tonic-gate for (;;) {
4027c478bd9Sstevel@tonic-gate addr = (caddr_t)align_hint;
4037c478bd9Sstevel@tonic-gate map_addr(&addr, size, 0ll, 1, MAP_ALIGN);
4047c478bd9Sstevel@tonic-gate if (addr != NULL || align_hint == share_size)
4057c478bd9Sstevel@tonic-gate break;
4067c478bd9Sstevel@tonic-gate align_hint = share_size;
4077c478bd9Sstevel@tonic-gate }
4087c478bd9Sstevel@tonic-gate if (addr == NULL) {
4097c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4107c478bd9Sstevel@tonic-gate error = ENOMEM;
4117c478bd9Sstevel@tonic-gate goto errret;
4127c478bd9Sstevel@tonic-gate }
4137c478bd9Sstevel@tonic-gate ASSERT(((uintptr_t)addr & (align_hint - 1)) == 0);
4147c478bd9Sstevel@tonic-gate } else {
4157c478bd9Sstevel@tonic-gate /* Use the user-supplied attach address */
4167c478bd9Sstevel@tonic-gate caddr_t base;
4177c478bd9Sstevel@tonic-gate size_t len;
4187c478bd9Sstevel@tonic-gate
4197c478bd9Sstevel@tonic-gate /*
4207c478bd9Sstevel@tonic-gate * Check that the address range
4217c478bd9Sstevel@tonic-gate * 1) is properly aligned
4227c478bd9Sstevel@tonic-gate * 2) is correct in unix terms
4237c478bd9Sstevel@tonic-gate * 3) is within an unmapped address segment
4247c478bd9Sstevel@tonic-gate */
4257c478bd9Sstevel@tonic-gate base = addr;
4267c478bd9Sstevel@tonic-gate len = size; /* use spt aligned size */
4277c478bd9Sstevel@tonic-gate /* XXX - in SunOS, is sp->shm_segsz */
4287c478bd9Sstevel@tonic-gate if ((uintptr_t)base & (share_size - 1)) {
4297c478bd9Sstevel@tonic-gate error = EINVAL;
4307c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4317c478bd9Sstevel@tonic-gate goto errret;
4327c478bd9Sstevel@tonic-gate }
4337c478bd9Sstevel@tonic-gate result = valid_usr_range(base, len, prot, as,
4347c478bd9Sstevel@tonic-gate as->a_userlimit);
4357c478bd9Sstevel@tonic-gate if (result == RANGE_BADPROT) {
4367c478bd9Sstevel@tonic-gate /*
4377c478bd9Sstevel@tonic-gate * We try to accomodate processors which
4387c478bd9Sstevel@tonic-gate * may not support execute permissions on
4397c478bd9Sstevel@tonic-gate * all ISM segments by trying the check
4407c478bd9Sstevel@tonic-gate * again but without PROT_EXEC.
4417c478bd9Sstevel@tonic-gate */
4427c478bd9Sstevel@tonic-gate prot &= ~PROT_EXEC;
4437c478bd9Sstevel@tonic-gate result = valid_usr_range(base, len, prot, as,
4447c478bd9Sstevel@tonic-gate as->a_userlimit);
4457c478bd9Sstevel@tonic-gate }
4467c478bd9Sstevel@tonic-gate as_purge(as);
4477c478bd9Sstevel@tonic-gate if (result != RANGE_OKAY ||
4487c478bd9Sstevel@tonic-gate as_gap(as, len, &base, &len, AH_LO,
4497c478bd9Sstevel@tonic-gate (caddr_t)NULL) != 0) {
4507c478bd9Sstevel@tonic-gate error = EINVAL;
4517c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4527c478bd9Sstevel@tonic-gate goto errret;
4537c478bd9Sstevel@tonic-gate }
4547c478bd9Sstevel@tonic-gate }
4557c478bd9Sstevel@tonic-gate
4567c478bd9Sstevel@tonic-gate if (!isspt(sp)) {
4577c478bd9Sstevel@tonic-gate error = sptcreate(size, &segspt, sp->shm_amp, prot,
4587c478bd9Sstevel@tonic-gate flags, share_szc);
4597c478bd9Sstevel@tonic-gate if (error) {
4607c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4617c478bd9Sstevel@tonic-gate goto errret;
4627c478bd9Sstevel@tonic-gate }
4637c478bd9Sstevel@tonic-gate sp->shm_sptinfo->sptas = segspt->s_as;
4647c478bd9Sstevel@tonic-gate sp->shm_sptseg = segspt;
4657c478bd9Sstevel@tonic-gate sp->shm_sptprot = prot;
4667c478bd9Sstevel@tonic-gate } else if ((prot & sp->shm_sptprot) != sp->shm_sptprot) {
4677c478bd9Sstevel@tonic-gate /*
4687c478bd9Sstevel@tonic-gate * Ensure we're attaching to an ISM segment with
4697c478bd9Sstevel@tonic-gate * fewer or equal permissions than what we're
4707c478bd9Sstevel@tonic-gate * allowed. Fail if the segment has more
4717c478bd9Sstevel@tonic-gate * permissions than what we're allowed.
4727c478bd9Sstevel@tonic-gate */
4737c478bd9Sstevel@tonic-gate error = EACCES;
4747c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4757c478bd9Sstevel@tonic-gate goto errret;
4767c478bd9Sstevel@tonic-gate }
4777c478bd9Sstevel@tonic-gate
4787c478bd9Sstevel@tonic-gate ssd.shm_sptseg = sp->shm_sptseg;
4797c478bd9Sstevel@tonic-gate ssd.shm_sptas = sp->shm_sptinfo->sptas;
4807c478bd9Sstevel@tonic-gate ssd.shm_amp = sp->shm_amp;
4817c478bd9Sstevel@tonic-gate error = as_map(as, addr, size, segspt_shmattach, &ssd);
4827c478bd9Sstevel@tonic-gate if (error == 0)
4837c478bd9Sstevel@tonic-gate sp->shm_ismattch++; /* keep count of ISM attaches */
4847c478bd9Sstevel@tonic-gate } else {
4857c478bd9Sstevel@tonic-gate
4867c478bd9Sstevel@tonic-gate /*
4877c478bd9Sstevel@tonic-gate * Normal case.
4887c478bd9Sstevel@tonic-gate */
4897c478bd9Sstevel@tonic-gate if (flags & SHM_RDONLY)
4907c478bd9Sstevel@tonic-gate prot &= ~PROT_WRITE;
4917c478bd9Sstevel@tonic-gate
4927c478bd9Sstevel@tonic-gate if (addr == 0) {
4937c478bd9Sstevel@tonic-gate /* Let the system pick the attach address */
4947c478bd9Sstevel@tonic-gate map_addr(&addr, size, 0ll, 1, 0);
4957c478bd9Sstevel@tonic-gate if (addr == NULL) {
4967c478bd9Sstevel@tonic-gate as_rangeunlock(as);
4977c478bd9Sstevel@tonic-gate error = ENOMEM;
4987c478bd9Sstevel@tonic-gate goto errret;
4997c478bd9Sstevel@tonic-gate }
5007c478bd9Sstevel@tonic-gate } else {
5017c478bd9Sstevel@tonic-gate /* Use the user-supplied attach address */
5027c478bd9Sstevel@tonic-gate caddr_t base;
5037c478bd9Sstevel@tonic-gate size_t len;
5047c478bd9Sstevel@tonic-gate
5057c478bd9Sstevel@tonic-gate if (flags & SHM_RND)
5067c478bd9Sstevel@tonic-gate addr = (caddr_t)((uintptr_t)addr &
5077c478bd9Sstevel@tonic-gate ~(SHMLBA - 1));
5087c478bd9Sstevel@tonic-gate /*
5097c478bd9Sstevel@tonic-gate * Check that the address range
5107c478bd9Sstevel@tonic-gate * 1) is properly aligned
5117c478bd9Sstevel@tonic-gate * 2) is correct in unix terms
5127c478bd9Sstevel@tonic-gate * 3) is within an unmapped address segment
5137c478bd9Sstevel@tonic-gate */
5147c478bd9Sstevel@tonic-gate base = addr;
5157c478bd9Sstevel@tonic-gate len = size; /* use aligned size */
5167c478bd9Sstevel@tonic-gate /* XXX - in SunOS, is sp->shm_segsz */
5177c478bd9Sstevel@tonic-gate if ((uintptr_t)base & PAGEOFFSET) {
5187c478bd9Sstevel@tonic-gate error = EINVAL;
5197c478bd9Sstevel@tonic-gate as_rangeunlock(as);
5207c478bd9Sstevel@tonic-gate goto errret;
5217c478bd9Sstevel@tonic-gate }
5227c478bd9Sstevel@tonic-gate result = valid_usr_range(base, len, prot, as,
5237c478bd9Sstevel@tonic-gate as->a_userlimit);
5247c478bd9Sstevel@tonic-gate if (result == RANGE_BADPROT) {
5257c478bd9Sstevel@tonic-gate prot &= ~PROT_EXEC;
5267c478bd9Sstevel@tonic-gate result = valid_usr_range(base, len, prot, as,
5277c478bd9Sstevel@tonic-gate as->a_userlimit);
5287c478bd9Sstevel@tonic-gate }
5297c478bd9Sstevel@tonic-gate as_purge(as);
5307c478bd9Sstevel@tonic-gate if (result != RANGE_OKAY ||
5317c478bd9Sstevel@tonic-gate as_gap(as, len, &base, &len,
5327c478bd9Sstevel@tonic-gate AH_LO, (caddr_t)NULL) != 0) {
5337c478bd9Sstevel@tonic-gate error = EINVAL;
5347c478bd9Sstevel@tonic-gate as_rangeunlock(as);
5357c478bd9Sstevel@tonic-gate goto errret;
5367c478bd9Sstevel@tonic-gate }
5377c478bd9Sstevel@tonic-gate }
5387c478bd9Sstevel@tonic-gate
5397c478bd9Sstevel@tonic-gate /* Initialize the create arguments and map the segment */
5407c478bd9Sstevel@tonic-gate crargs = *(struct segvn_crargs *)zfod_argsp;
5417c478bd9Sstevel@tonic-gate crargs.offset = 0;
5427c478bd9Sstevel@tonic-gate crargs.type = MAP_SHARED;
5437c478bd9Sstevel@tonic-gate crargs.amp = sp->shm_amp;
5447c478bd9Sstevel@tonic-gate crargs.prot = prot;
5457c478bd9Sstevel@tonic-gate crargs.maxprot = crargs.prot;
5467c478bd9Sstevel@tonic-gate crargs.flags = 0;
5477c478bd9Sstevel@tonic-gate
5487c478bd9Sstevel@tonic-gate error = as_map(as, addr, size, segvn_create, &crargs);
5497c478bd9Sstevel@tonic-gate }
5507c478bd9Sstevel@tonic-gate
5517c478bd9Sstevel@tonic-gate as_rangeunlock(as);
5527c478bd9Sstevel@tonic-gate if (error)
5537c478bd9Sstevel@tonic-gate goto errret;
5547c478bd9Sstevel@tonic-gate
5557c478bd9Sstevel@tonic-gate /* record shmem range for the detach */
5567c478bd9Sstevel@tonic-gate sa_add(pp, addr, (size_t)size, useISM ? SHMSA_ISM : 0, sp);
5577c478bd9Sstevel@tonic-gate *rvp = (uintptr_t)addr;
5587c478bd9Sstevel@tonic-gate
5597c478bd9Sstevel@tonic-gate sp->shm_atime = gethrestime_sec();
5607c478bd9Sstevel@tonic-gate sp->shm_lpid = pp->p_pid;
5617c478bd9Sstevel@tonic-gate ipc_hold(shm_svc, (kipc_perm_t *)sp);
5622c5124a1SPrashanth Sreenivasa
5632c5124a1SPrashanth Sreenivasa /*
5642c5124a1SPrashanth Sreenivasa * Tell machine specific code that lwp has mapped shared memory
5652c5124a1SPrashanth Sreenivasa */
5662c5124a1SPrashanth Sreenivasa LWP_MMODEL_SHARED_AS(addr, size);
5672c5124a1SPrashanth Sreenivasa
5687c478bd9Sstevel@tonic-gate errret:
5697c478bd9Sstevel@tonic-gate mutex_exit(lock);
5707c478bd9Sstevel@tonic-gate return (error);
5717c478bd9Sstevel@tonic-gate }
5727c478bd9Sstevel@tonic-gate
5737c478bd9Sstevel@tonic-gate static void
shm_dtor(kipc_perm_t * perm)5747c478bd9Sstevel@tonic-gate shm_dtor(kipc_perm_t *perm)
5757c478bd9Sstevel@tonic-gate {
5767c478bd9Sstevel@tonic-gate kshmid_t *sp = (kshmid_t *)perm;
5777c478bd9Sstevel@tonic-gate uint_t cnt;
578824c205fSml size_t rsize;
5797c478bd9Sstevel@tonic-gate
58057820e88SNick Todd ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER);
58157820e88SNick Todd anonmap_purge(sp->shm_amp);
58257820e88SNick Todd ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
58357820e88SNick Todd
5847c478bd9Sstevel@tonic-gate if (sp->shm_sptinfo) {
585552507c5SGangadhar Mylapuram if (isspt(sp)) {
5867c478bd9Sstevel@tonic-gate sptdestroy(sp->shm_sptinfo->sptas, sp->shm_amp);
587552507c5SGangadhar Mylapuram sp->shm_lkcnt = 0;
588552507c5SGangadhar Mylapuram }
5897c478bd9Sstevel@tonic-gate kmem_free(sp->shm_sptinfo, sizeof (sptinfo_t));
5907c478bd9Sstevel@tonic-gate }
5917c478bd9Sstevel@tonic-gate
592552507c5SGangadhar Mylapuram if (sp->shm_lkcnt > 0) {
593552507c5SGangadhar Mylapuram shmem_unlock(sp, sp->shm_amp);
594552507c5SGangadhar Mylapuram sp->shm_lkcnt = 0;
595552507c5SGangadhar Mylapuram }
596552507c5SGangadhar Mylapuram
5977c478bd9Sstevel@tonic-gate ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock, RW_WRITER);
5987c478bd9Sstevel@tonic-gate cnt = --sp->shm_amp->refcnt;
5997c478bd9Sstevel@tonic-gate ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
6007c478bd9Sstevel@tonic-gate ASSERT(cnt == 0);
60168803f2dSsl shm_rm_amp(sp);
6027c478bd9Sstevel@tonic-gate
6037c478bd9Sstevel@tonic-gate if (sp->shm_perm.ipc_id != IPC_ID_INVAL) {
604824c205fSml rsize = ptob(btopr(sp->shm_segsz));
6057c478bd9Sstevel@tonic-gate ipcs_lock(shm_svc);
606824c205fSml sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax -= rsize;
607a19609f8Sjv sp->shm_perm.ipc_zone_ref.zref_zone->zone_shmmax -= rsize;
6087c478bd9Sstevel@tonic-gate ipcs_unlock(shm_svc);
6097c478bd9Sstevel@tonic-gate }
6107c478bd9Sstevel@tonic-gate }
6117c478bd9Sstevel@tonic-gate
6127c478bd9Sstevel@tonic-gate /* ARGSUSED */
6137c478bd9Sstevel@tonic-gate static void
shm_rmid(kipc_perm_t * perm)6147c478bd9Sstevel@tonic-gate shm_rmid(kipc_perm_t *perm)
6157c478bd9Sstevel@tonic-gate {
6167c478bd9Sstevel@tonic-gate /* nothing to do */
6177c478bd9Sstevel@tonic-gate }
6187c478bd9Sstevel@tonic-gate
6197c478bd9Sstevel@tonic-gate /*
6207c478bd9Sstevel@tonic-gate * Shmctl system call.
6217c478bd9Sstevel@tonic-gate */
6227c478bd9Sstevel@tonic-gate /* ARGSUSED */
6237c478bd9Sstevel@tonic-gate static int
shmctl(int shmid,int cmd,void * arg)6247c478bd9Sstevel@tonic-gate shmctl(int shmid, int cmd, void *arg)
6257c478bd9Sstevel@tonic-gate {
6267c478bd9Sstevel@tonic-gate kshmid_t *sp; /* shared memory header ptr */
6277c478bd9Sstevel@tonic-gate STRUCT_DECL(shmid_ds, ds); /* for SVR4 IPC_SET */
6287c478bd9Sstevel@tonic-gate int error = 0;
6299dd95169SToomas Soome struct cred *cr = CRED();
6307c478bd9Sstevel@tonic-gate kmutex_t *lock;
6317c478bd9Sstevel@tonic-gate model_t mdl = get_udatamodel();
6327c478bd9Sstevel@tonic-gate struct shmid_ds64 ds64;
6337c478bd9Sstevel@tonic-gate shmatt_t nattch;
6347c478bd9Sstevel@tonic-gate
6357c478bd9Sstevel@tonic-gate STRUCT_INIT(ds, mdl);
6367c478bd9Sstevel@tonic-gate
6377c478bd9Sstevel@tonic-gate /*
6387c478bd9Sstevel@tonic-gate * Perform pre- or non-lookup actions (e.g. copyins, RMID).
6397c478bd9Sstevel@tonic-gate */
6407c478bd9Sstevel@tonic-gate switch (cmd) {
6417c478bd9Sstevel@tonic-gate case IPC_SET:
6427c478bd9Sstevel@tonic-gate if (copyin(arg, STRUCT_BUF(ds), STRUCT_SIZE(ds)))
6437c478bd9Sstevel@tonic-gate return (EFAULT);
6447c478bd9Sstevel@tonic-gate break;
6457c478bd9Sstevel@tonic-gate
6467c478bd9Sstevel@tonic-gate case IPC_SET64:
6477c478bd9Sstevel@tonic-gate if (copyin(arg, &ds64, sizeof (struct shmid_ds64)))
6487c478bd9Sstevel@tonic-gate return (EFAULT);
6497c478bd9Sstevel@tonic-gate break;
6507c478bd9Sstevel@tonic-gate
6517c478bd9Sstevel@tonic-gate case IPC_RMID:
6527c478bd9Sstevel@tonic-gate return (ipc_rmid(shm_svc, shmid, cr));
6537c478bd9Sstevel@tonic-gate }
6547c478bd9Sstevel@tonic-gate
6557c478bd9Sstevel@tonic-gate if ((lock = ipc_lookup(shm_svc, shmid, (kipc_perm_t **)&sp)) == NULL)
6567c478bd9Sstevel@tonic-gate return (EINVAL);
6577c478bd9Sstevel@tonic-gate
6587c478bd9Sstevel@tonic-gate switch (cmd) {
6597c478bd9Sstevel@tonic-gate /* Set ownership and permissions. */
6607c478bd9Sstevel@tonic-gate case IPC_SET:
6617c478bd9Sstevel@tonic-gate if (error = ipcperm_set(shm_svc, cr, &sp->shm_perm,
6627c478bd9Sstevel@tonic-gate &STRUCT_BUF(ds)->shm_perm, mdl))
6637c478bd9Sstevel@tonic-gate break;
6647c478bd9Sstevel@tonic-gate sp->shm_ctime = gethrestime_sec();
6657c478bd9Sstevel@tonic-gate break;
6667c478bd9Sstevel@tonic-gate
6677c478bd9Sstevel@tonic-gate case IPC_STAT:
6687c478bd9Sstevel@tonic-gate if (error = ipcperm_access(&sp->shm_perm, SHM_R, cr))
6697c478bd9Sstevel@tonic-gate break;
6707c478bd9Sstevel@tonic-gate
6717c478bd9Sstevel@tonic-gate nattch = sp->shm_perm.ipc_ref - 1;
6727c478bd9Sstevel@tonic-gate
6737c478bd9Sstevel@tonic-gate ipcperm_stat(&STRUCT_BUF(ds)->shm_perm, &sp->shm_perm, mdl);
6747c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_segsz, sp->shm_segsz);
6757c478bd9Sstevel@tonic-gate STRUCT_FSETP(ds, shm_amp, NULL); /* kernel addr */
6767c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_lkcnt, sp->shm_lkcnt);
6777c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_lpid, sp->shm_lpid);
6787c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_cpid, sp->shm_cpid);
6797c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_nattch, nattch);
6807c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_cnattch, sp->shm_ismattch);
6817c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_atime, sp->shm_atime);
6827c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_dtime, sp->shm_dtime);
6837c478bd9Sstevel@tonic-gate STRUCT_FSET(ds, shm_ctime, sp->shm_ctime);
6847c478bd9Sstevel@tonic-gate
6857c478bd9Sstevel@tonic-gate mutex_exit(lock);
6867c478bd9Sstevel@tonic-gate if (copyout(STRUCT_BUF(ds), arg, STRUCT_SIZE(ds)))
6877c478bd9Sstevel@tonic-gate return (EFAULT);
6887c478bd9Sstevel@tonic-gate
6897c478bd9Sstevel@tonic-gate return (0);
6907c478bd9Sstevel@tonic-gate
6917c478bd9Sstevel@tonic-gate case IPC_SET64:
6927c478bd9Sstevel@tonic-gate if (error = ipcperm_set64(shm_svc, cr,
6937c478bd9Sstevel@tonic-gate &sp->shm_perm, &ds64.shmx_perm))
6947c478bd9Sstevel@tonic-gate break;
6957c478bd9Sstevel@tonic-gate sp->shm_ctime = gethrestime_sec();
6967c478bd9Sstevel@tonic-gate break;
6977c478bd9Sstevel@tonic-gate
6987c478bd9Sstevel@tonic-gate case IPC_STAT64:
6997c478bd9Sstevel@tonic-gate nattch = sp->shm_perm.ipc_ref - 1;
7007c478bd9Sstevel@tonic-gate
7017c478bd9Sstevel@tonic-gate ipcperm_stat64(&ds64.shmx_perm, &sp->shm_perm);
7027c478bd9Sstevel@tonic-gate ds64.shmx_segsz = sp->shm_segsz;
7037c478bd9Sstevel@tonic-gate ds64.shmx_lkcnt = sp->shm_lkcnt;
7047c478bd9Sstevel@tonic-gate ds64.shmx_lpid = sp->shm_lpid;
7057c478bd9Sstevel@tonic-gate ds64.shmx_cpid = sp->shm_cpid;
7067c478bd9Sstevel@tonic-gate ds64.shmx_nattch = nattch;
7077c478bd9Sstevel@tonic-gate ds64.shmx_cnattch = sp->shm_ismattch;
7087c478bd9Sstevel@tonic-gate ds64.shmx_atime = sp->shm_atime;
7097c478bd9Sstevel@tonic-gate ds64.shmx_dtime = sp->shm_dtime;
7107c478bd9Sstevel@tonic-gate ds64.shmx_ctime = sp->shm_ctime;
7117c478bd9Sstevel@tonic-gate
7127c478bd9Sstevel@tonic-gate mutex_exit(lock);
7137c478bd9Sstevel@tonic-gate if (copyout(&ds64, arg, sizeof (struct shmid_ds64)))
7147c478bd9Sstevel@tonic-gate return (EFAULT);
7157c478bd9Sstevel@tonic-gate
7167c478bd9Sstevel@tonic-gate return (0);
7177c478bd9Sstevel@tonic-gate
7187c478bd9Sstevel@tonic-gate /* Lock segment in memory */
7197c478bd9Sstevel@tonic-gate case SHM_LOCK:
7207c478bd9Sstevel@tonic-gate if ((error = secpolicy_lock_memory(cr)) != 0)
7217c478bd9Sstevel@tonic-gate break;
7227c478bd9Sstevel@tonic-gate
723c6939658Ssl /* protect against overflow */
724c6939658Ssl if (sp->shm_lkcnt >= USHRT_MAX) {
725c6939658Ssl error = ENOMEM;
726c6939658Ssl break;
727c6939658Ssl }
7287c478bd9Sstevel@tonic-gate if (!isspt(sp) && (sp->shm_lkcnt++ == 0)) {
729c6939658Ssl if (error = shmem_lock(sp, sp->shm_amp)) {
730d3e55dcdSgww ANON_LOCK_ENTER(&sp->shm_amp->a_rwlock,
731d3e55dcdSgww RW_WRITER);
732a98e9dbfSaguzovsk cmn_err(CE_NOTE, "shmctl - couldn't lock %ld"
733a98e9dbfSaguzovsk " pages into memory", sp->shm_amp->size);
734d3e55dcdSgww ANON_LOCK_EXIT(&sp->shm_amp->a_rwlock);
735d3e55dcdSgww error = ENOMEM;
736d3e55dcdSgww sp->shm_lkcnt--;
7377c478bd9Sstevel@tonic-gate }
7387c478bd9Sstevel@tonic-gate }
7397c478bd9Sstevel@tonic-gate break;
7407c478bd9Sstevel@tonic-gate
7417c478bd9Sstevel@tonic-gate /* Unlock segment */
7427c478bd9Sstevel@tonic-gate case SHM_UNLOCK:
7437c478bd9Sstevel@tonic-gate if ((error = secpolicy_lock_memory(cr)) != 0)
7447c478bd9Sstevel@tonic-gate break;
7457c478bd9Sstevel@tonic-gate
746c6939658Ssl if (sp->shm_lkcnt && (--sp->shm_lkcnt == 0)) {
747c6939658Ssl shmem_unlock(sp, sp->shm_amp);
7487c478bd9Sstevel@tonic-gate }
7497c478bd9Sstevel@tonic-gate break;
7507c478bd9Sstevel@tonic-gate
7517c478bd9Sstevel@tonic-gate default:
7527c478bd9Sstevel@tonic-gate error = EINVAL;
7537c478bd9Sstevel@tonic-gate break;
7547c478bd9Sstevel@tonic-gate }
7557c478bd9Sstevel@tonic-gate mutex_exit(lock);
7567c478bd9Sstevel@tonic-gate return (error);
7577c478bd9Sstevel@tonic-gate }
7587c478bd9Sstevel@tonic-gate
7597c478bd9Sstevel@tonic-gate static void
shm_detach(proc_t * pp,segacct_t * sap)7607c478bd9Sstevel@tonic-gate shm_detach(proc_t *pp, segacct_t *sap)
7617c478bd9Sstevel@tonic-gate {
7627c478bd9Sstevel@tonic-gate kshmid_t *sp = sap->sa_id;
7637c478bd9Sstevel@tonic-gate size_t len = sap->sa_len;
7647c478bd9Sstevel@tonic-gate caddr_t addr = sap->sa_addr;
7657c478bd9Sstevel@tonic-gate
7667c478bd9Sstevel@tonic-gate /*
7677c478bd9Sstevel@tonic-gate * Discard lwpchan mappings.
7687c478bd9Sstevel@tonic-gate */
7697c478bd9Sstevel@tonic-gate if (pp->p_lcp != NULL)
7707c478bd9Sstevel@tonic-gate lwpchan_delete_mapping(pp, addr, addr + len);
7717c478bd9Sstevel@tonic-gate (void) as_unmap(pp->p_as, addr, len);
7727c478bd9Sstevel@tonic-gate
7737c478bd9Sstevel@tonic-gate /*
7747c478bd9Sstevel@tonic-gate * Perform some detach-time accounting.
7757c478bd9Sstevel@tonic-gate */
7767c478bd9Sstevel@tonic-gate (void) ipc_lock(shm_svc, sp->shm_perm.ipc_id);
7777c478bd9Sstevel@tonic-gate if (sap->sa_flags & SHMSA_ISM)
7787c478bd9Sstevel@tonic-gate sp->shm_ismattch--;
7797c478bd9Sstevel@tonic-gate sp->shm_dtime = gethrestime_sec();
7807c478bd9Sstevel@tonic-gate sp->shm_lpid = pp->p_pid;
7817c478bd9Sstevel@tonic-gate ipc_rele(shm_svc, (kipc_perm_t *)sp); /* Drops lock */
7827c478bd9Sstevel@tonic-gate
7837c478bd9Sstevel@tonic-gate kmem_free(sap, sizeof (segacct_t));
7847c478bd9Sstevel@tonic-gate }
7857c478bd9Sstevel@tonic-gate
7867c478bd9Sstevel@tonic-gate static int
shmdt(caddr_t addr)7877c478bd9Sstevel@tonic-gate shmdt(caddr_t addr)
7887c478bd9Sstevel@tonic-gate {
7897c478bd9Sstevel@tonic-gate proc_t *pp = curproc;
7907c478bd9Sstevel@tonic-gate segacct_t *sap, template;
7917c478bd9Sstevel@tonic-gate
7927c478bd9Sstevel@tonic-gate mutex_enter(&pp->p_lock);
7937c478bd9Sstevel@tonic-gate prbarrier(pp); /* block /proc. See shmgetid(). */
7947c478bd9Sstevel@tonic-gate
7957c478bd9Sstevel@tonic-gate template.sa_addr = addr;
7967c478bd9Sstevel@tonic-gate template.sa_len = 0;
7977c478bd9Sstevel@tonic-gate if ((pp->p_segacct == NULL) ||
7987c478bd9Sstevel@tonic-gate ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL)) {
7997c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
8007c478bd9Sstevel@tonic-gate return (EINVAL);
8017c478bd9Sstevel@tonic-gate }
80207b65a64Saguzovsk if (sap->sa_addr != addr) {
80307b65a64Saguzovsk mutex_exit(&pp->p_lock);
80407b65a64Saguzovsk return (EINVAL);
80507b65a64Saguzovsk }
8067c478bd9Sstevel@tonic-gate avl_remove(pp->p_segacct, sap);
8077c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
8087c478bd9Sstevel@tonic-gate
8097c478bd9Sstevel@tonic-gate shm_detach(pp, sap);
8107c478bd9Sstevel@tonic-gate
8117c478bd9Sstevel@tonic-gate return (0);
8127c478bd9Sstevel@tonic-gate }
8137c478bd9Sstevel@tonic-gate
8147c478bd9Sstevel@tonic-gate /*
8157c478bd9Sstevel@tonic-gate * Remove all shared memory segments associated with a given zone.
8167c478bd9Sstevel@tonic-gate * Called by zone_shutdown when the zone is halted.
8177c478bd9Sstevel@tonic-gate */
8187c478bd9Sstevel@tonic-gate /*ARGSUSED1*/
8197c478bd9Sstevel@tonic-gate static void
shm_remove_zone(zoneid_t zoneid,void * arg)8207c478bd9Sstevel@tonic-gate shm_remove_zone(zoneid_t zoneid, void *arg)
8217c478bd9Sstevel@tonic-gate {
8227c478bd9Sstevel@tonic-gate ipc_remove_zone(shm_svc, zoneid);
8237c478bd9Sstevel@tonic-gate }
8247c478bd9Sstevel@tonic-gate
8257c478bd9Sstevel@tonic-gate /*
8267c478bd9Sstevel@tonic-gate * Shmget (create new shmem) system call.
8277c478bd9Sstevel@tonic-gate */
8287c478bd9Sstevel@tonic-gate static int
shmget(key_t key,size_t size,int shmflg,uintptr_t * rvp)8297c478bd9Sstevel@tonic-gate shmget(key_t key, size_t size, int shmflg, uintptr_t *rvp)
8307c478bd9Sstevel@tonic-gate {
8317c478bd9Sstevel@tonic-gate proc_t *pp = curproc;
8327c478bd9Sstevel@tonic-gate kshmid_t *sp;
8337c478bd9Sstevel@tonic-gate kmutex_t *lock;
8347c478bd9Sstevel@tonic-gate int error;
8357c478bd9Sstevel@tonic-gate
8367c478bd9Sstevel@tonic-gate top:
8377c478bd9Sstevel@tonic-gate if (error = ipc_get(shm_svc, key, shmflg, (kipc_perm_t **)&sp, &lock))
8387c478bd9Sstevel@tonic-gate return (error);
8397c478bd9Sstevel@tonic-gate
8407c478bd9Sstevel@tonic-gate if (!IPC_FREE(&sp->shm_perm)) {
8417c478bd9Sstevel@tonic-gate /*
8427c478bd9Sstevel@tonic-gate * A segment with the requested key exists.
8437c478bd9Sstevel@tonic-gate */
8447c478bd9Sstevel@tonic-gate if (size > sp->shm_segsz) {
8457c478bd9Sstevel@tonic-gate mutex_exit(lock);
8467c478bd9Sstevel@tonic-gate return (EINVAL);
8477c478bd9Sstevel@tonic-gate }
8487c478bd9Sstevel@tonic-gate } else {
8497c478bd9Sstevel@tonic-gate /*
8507c478bd9Sstevel@tonic-gate * A new segment should be created.
8517c478bd9Sstevel@tonic-gate */
8527c478bd9Sstevel@tonic-gate size_t npages = btopr(size);
8537c478bd9Sstevel@tonic-gate size_t rsize = ptob(npages);
8547c478bd9Sstevel@tonic-gate
8557c478bd9Sstevel@tonic-gate /*
856824c205fSml * Check rsize and the per-project and per-zone limit on
857824c205fSml * shared memory. Checking rsize handles both the size == 0
8587c478bd9Sstevel@tonic-gate * case and the size < ULONG_MAX & PAGEMASK case (i.e.
8597c478bd9Sstevel@tonic-gate * rounding up wraps a size_t).
8607c478bd9Sstevel@tonic-gate */
861824c205fSml if (rsize == 0 ||
862824c205fSml (rctl_test(rc_project_shmmax,
8637c478bd9Sstevel@tonic-gate pp->p_task->tk_proj->kpj_rctls, pp, rsize,
864824c205fSml RCA_SAFE) & RCT_DENY) ||
865824c205fSml (rctl_test(rc_zone_shmmax,
866824c205fSml pp->p_zone->zone_rctls, pp, rsize,
8677c478bd9Sstevel@tonic-gate RCA_SAFE) & RCT_DENY)) {
8687c478bd9Sstevel@tonic-gate
8697c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
8707c478bd9Sstevel@tonic-gate mutex_exit(lock);
8717c478bd9Sstevel@tonic-gate ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
8727c478bd9Sstevel@tonic-gate return (EINVAL);
8737c478bd9Sstevel@tonic-gate }
8747c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
8757c478bd9Sstevel@tonic-gate mutex_exit(lock);
8767c478bd9Sstevel@tonic-gate
8777c478bd9Sstevel@tonic-gate if (anon_resv(rsize) == 0) {
8787c478bd9Sstevel@tonic-gate ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
8797c478bd9Sstevel@tonic-gate return (ENOMEM);
8807c478bd9Sstevel@tonic-gate }
8817c478bd9Sstevel@tonic-gate
88267253d2cSsl /*
88367253d2cSsl * If any new failure points are introduced between the
88467253d2cSsl * the above anon_resv() and the below ipc_commit_begin(),
88567253d2cSsl * these failure points will need to unreserve the anon
88667253d2cSsl * reserved using anon_unresv().
88767253d2cSsl *
88867253d2cSsl * Once ipc_commit_begin() is called, the anon reserved
88967253d2cSsl * above will be automatically unreserved by future calls to
89067253d2cSsl * ipcs_cleanup() -> shm_dtor() -> shm_rm_amp(). If
89167253d2cSsl * ipc_commit_begin() fails, it internally calls shm_dtor(),
89267253d2cSsl * unreserving the above anon, and freeing the below amp.
89367253d2cSsl */
89467253d2cSsl
8952cb27123Saguzovsk sp->shm_amp = anonmap_alloc(rsize, rsize, ANON_SLEEP);
896c6939658Ssl sp->shm_amp->a_sp = sp;
8977c478bd9Sstevel@tonic-gate /*
8987c478bd9Sstevel@tonic-gate * Store the original user's requested size, in bytes,
8997c478bd9Sstevel@tonic-gate * rather than the page-aligned size. The former is
9007c478bd9Sstevel@tonic-gate * used for IPC_STAT and shmget() lookups. The latter
9017c478bd9Sstevel@tonic-gate * is saved in the anon_map structure and is used for
9027c478bd9Sstevel@tonic-gate * calls to the vm layer.
9037c478bd9Sstevel@tonic-gate */
9047c478bd9Sstevel@tonic-gate sp->shm_segsz = size;
9057c478bd9Sstevel@tonic-gate sp->shm_atime = sp->shm_dtime = 0;
9067c478bd9Sstevel@tonic-gate sp->shm_ctime = gethrestime_sec();
9077c478bd9Sstevel@tonic-gate sp->shm_lpid = (pid_t)0;
9087c478bd9Sstevel@tonic-gate sp->shm_cpid = curproc->p_pid;
9097c478bd9Sstevel@tonic-gate sp->shm_ismattch = 0;
9107c478bd9Sstevel@tonic-gate sp->shm_sptinfo = NULL;
9117c478bd9Sstevel@tonic-gate /*
9127c478bd9Sstevel@tonic-gate * Check limits one last time, push id into global
9137c478bd9Sstevel@tonic-gate * visibility, and update resource usage counts.
9147c478bd9Sstevel@tonic-gate */
9157c478bd9Sstevel@tonic-gate if (error = ipc_commit_begin(shm_svc, key, shmflg,
9167c478bd9Sstevel@tonic-gate (kipc_perm_t *)sp)) {
9177c478bd9Sstevel@tonic-gate if (error == EAGAIN)
9187c478bd9Sstevel@tonic-gate goto top;
9197c478bd9Sstevel@tonic-gate return (error);
9207c478bd9Sstevel@tonic-gate }
9217c478bd9Sstevel@tonic-gate
922824c205fSml if ((rctl_test(rc_project_shmmax,
9237c478bd9Sstevel@tonic-gate sp->shm_perm.ipc_proj->kpj_rctls, pp, rsize,
924824c205fSml RCA_SAFE) & RCT_DENY) ||
925824c205fSml (rctl_test(rc_zone_shmmax,
926a19609f8Sjv sp->shm_perm.ipc_zone_ref.zref_zone->zone_rctls, pp, rsize,
927824c205fSml RCA_SAFE) & RCT_DENY)) {
9287c478bd9Sstevel@tonic-gate ipc_cleanup(shm_svc, (kipc_perm_t *)sp);
9297c478bd9Sstevel@tonic-gate return (EINVAL);
9307c478bd9Sstevel@tonic-gate }
9317c478bd9Sstevel@tonic-gate sp->shm_perm.ipc_proj->kpj_data.kpd_shmmax += rsize;
932a19609f8Sjv sp->shm_perm.ipc_zone_ref.zref_zone->zone_shmmax += rsize;
9337c478bd9Sstevel@tonic-gate
9347c478bd9Sstevel@tonic-gate lock = ipc_commit_end(shm_svc, &sp->shm_perm);
9357c478bd9Sstevel@tonic-gate }
9367c478bd9Sstevel@tonic-gate
937005d3febSMarek Pospisil if (AU_AUDITING())
9387c478bd9Sstevel@tonic-gate audit_ipcget(AT_IPC_SHM, (void *)sp);
9397c478bd9Sstevel@tonic-gate
9407c478bd9Sstevel@tonic-gate *rvp = (uintptr_t)(sp->shm_perm.ipc_id);
9417c478bd9Sstevel@tonic-gate
9427c478bd9Sstevel@tonic-gate mutex_exit(lock);
9437c478bd9Sstevel@tonic-gate return (0);
9447c478bd9Sstevel@tonic-gate }
9457c478bd9Sstevel@tonic-gate
9467c478bd9Sstevel@tonic-gate /*
9477c478bd9Sstevel@tonic-gate * shmids system call.
9487c478bd9Sstevel@tonic-gate */
9497c478bd9Sstevel@tonic-gate static int
shmids(int * buf,uint_t nids,uint_t * pnids)9507c478bd9Sstevel@tonic-gate shmids(int *buf, uint_t nids, uint_t *pnids)
9517c478bd9Sstevel@tonic-gate {
9527c478bd9Sstevel@tonic-gate return (ipc_ids(shm_svc, buf, nids, pnids));
9537c478bd9Sstevel@tonic-gate }
9547c478bd9Sstevel@tonic-gate
9557c478bd9Sstevel@tonic-gate /*
9567c478bd9Sstevel@tonic-gate * System entry point for shmat, shmctl, shmdt, and shmget system calls.
9577c478bd9Sstevel@tonic-gate */
9587c478bd9Sstevel@tonic-gate static uintptr_t
shmsys(int opcode,uintptr_t a0,uintptr_t a1,uintptr_t a2)9597c478bd9Sstevel@tonic-gate shmsys(int opcode, uintptr_t a0, uintptr_t a1, uintptr_t a2)
9607c478bd9Sstevel@tonic-gate {
9617c478bd9Sstevel@tonic-gate int error;
9627c478bd9Sstevel@tonic-gate uintptr_t r_val = 0;
9637c478bd9Sstevel@tonic-gate
9647c478bd9Sstevel@tonic-gate switch (opcode) {
9657c478bd9Sstevel@tonic-gate case SHMAT:
9667c478bd9Sstevel@tonic-gate error = shmat((int)a0, (caddr_t)a1, (int)a2, &r_val);
9677c478bd9Sstevel@tonic-gate break;
9687c478bd9Sstevel@tonic-gate case SHMCTL:
9697c478bd9Sstevel@tonic-gate error = shmctl((int)a0, (int)a1, (void *)a2);
9707c478bd9Sstevel@tonic-gate break;
9717c478bd9Sstevel@tonic-gate case SHMDT:
9727c478bd9Sstevel@tonic-gate error = shmdt((caddr_t)a0);
9737c478bd9Sstevel@tonic-gate break;
9747c478bd9Sstevel@tonic-gate case SHMGET:
9757c478bd9Sstevel@tonic-gate error = shmget((key_t)a0, (size_t)a1, (int)a2, &r_val);
9767c478bd9Sstevel@tonic-gate break;
9777c478bd9Sstevel@tonic-gate case SHMIDS:
9787c478bd9Sstevel@tonic-gate error = shmids((int *)a0, (uint_t)a1, (uint_t *)a2);
9797c478bd9Sstevel@tonic-gate break;
9807c478bd9Sstevel@tonic-gate default:
9817c478bd9Sstevel@tonic-gate error = EINVAL;
9827c478bd9Sstevel@tonic-gate break;
9837c478bd9Sstevel@tonic-gate }
9847c478bd9Sstevel@tonic-gate
9857c478bd9Sstevel@tonic-gate if (error)
9867c478bd9Sstevel@tonic-gate return ((uintptr_t)set_errno(error));
9877c478bd9Sstevel@tonic-gate
9887c478bd9Sstevel@tonic-gate return (r_val);
9897c478bd9Sstevel@tonic-gate }
9907c478bd9Sstevel@tonic-gate
9917c478bd9Sstevel@tonic-gate /*
9927c478bd9Sstevel@tonic-gate * segacct_t comparator
9937c478bd9Sstevel@tonic-gate * This works as expected, with one minor change: the first of two real
9947c478bd9Sstevel@tonic-gate * segments with equal addresses is considered to be 'greater than' the
9957c478bd9Sstevel@tonic-gate * second. We only return equal when searching using a template, in
9967c478bd9Sstevel@tonic-gate * which case we explicitly set the template segment's length to 0
9977c478bd9Sstevel@tonic-gate * (which is invalid for a real segment).
9987c478bd9Sstevel@tonic-gate */
9997c478bd9Sstevel@tonic-gate static int
shm_sacompar(const void * x,const void * y)10007c478bd9Sstevel@tonic-gate shm_sacompar(const void *x, const void *y)
10017c478bd9Sstevel@tonic-gate {
10027c478bd9Sstevel@tonic-gate segacct_t *sa1 = (segacct_t *)x;
10037c478bd9Sstevel@tonic-gate segacct_t *sa2 = (segacct_t *)y;
10047c478bd9Sstevel@tonic-gate
100507b65a64Saguzovsk if (sa1->sa_addr < sa2->sa_addr) {
10067c478bd9Sstevel@tonic-gate return (-1);
100707b65a64Saguzovsk } else if (sa2->sa_len != 0) {
100807b65a64Saguzovsk if (sa1->sa_addr >= sa2->sa_addr + sa2->sa_len) {
100907b65a64Saguzovsk return (1);
101007b65a64Saguzovsk } else if (sa1->sa_len != 0) {
101107b65a64Saguzovsk return (1);
101207b65a64Saguzovsk } else {
101307b65a64Saguzovsk return (0);
101407b65a64Saguzovsk }
101507b65a64Saguzovsk } else if (sa1->sa_addr > sa2->sa_addr) {
10167c478bd9Sstevel@tonic-gate return (1);
101707b65a64Saguzovsk } else {
10187c478bd9Sstevel@tonic-gate return (0);
101907b65a64Saguzovsk }
10207c478bd9Sstevel@tonic-gate }
10217c478bd9Sstevel@tonic-gate
10227c478bd9Sstevel@tonic-gate /*
10237c478bd9Sstevel@tonic-gate * add this record to the segacct list.
10247c478bd9Sstevel@tonic-gate */
10257c478bd9Sstevel@tonic-gate static void
sa_add(struct proc * pp,caddr_t addr,size_t len,ulong_t flags,kshmid_t * id)10267c478bd9Sstevel@tonic-gate sa_add(struct proc *pp, caddr_t addr, size_t len, ulong_t flags, kshmid_t *id)
10277c478bd9Sstevel@tonic-gate {
10287c478bd9Sstevel@tonic-gate segacct_t *nsap;
10297c478bd9Sstevel@tonic-gate avl_tree_t *tree = NULL;
10307c478bd9Sstevel@tonic-gate avl_index_t where;
10317c478bd9Sstevel@tonic-gate
10327c478bd9Sstevel@tonic-gate nsap = kmem_alloc(sizeof (segacct_t), KM_SLEEP);
10337c478bd9Sstevel@tonic-gate nsap->sa_addr = addr;
10347c478bd9Sstevel@tonic-gate nsap->sa_len = len;
10357c478bd9Sstevel@tonic-gate nsap->sa_flags = flags;
10367c478bd9Sstevel@tonic-gate nsap->sa_id = id;
10377c478bd9Sstevel@tonic-gate
10387c478bd9Sstevel@tonic-gate if (pp->p_segacct == NULL)
10397c478bd9Sstevel@tonic-gate tree = kmem_alloc(sizeof (avl_tree_t), KM_SLEEP);
10407c478bd9Sstevel@tonic-gate
10417c478bd9Sstevel@tonic-gate mutex_enter(&pp->p_lock);
10427c478bd9Sstevel@tonic-gate prbarrier(pp); /* block /proc. See shmgetid(). */
10437c478bd9Sstevel@tonic-gate
10447c478bd9Sstevel@tonic-gate if (pp->p_segacct == NULL) {
10457c478bd9Sstevel@tonic-gate avl_create(tree, shm_sacompar, sizeof (segacct_t),
10467c478bd9Sstevel@tonic-gate offsetof(segacct_t, sa_tree));
10477c478bd9Sstevel@tonic-gate pp->p_segacct = tree;
10487c478bd9Sstevel@tonic-gate } else if (tree) {
10497c478bd9Sstevel@tonic-gate kmem_free(tree, sizeof (avl_tree_t));
10507c478bd9Sstevel@tonic-gate }
10517c478bd9Sstevel@tonic-gate
10527c478bd9Sstevel@tonic-gate /*
10537c478bd9Sstevel@tonic-gate * We can ignore the result of avl_find, as the comparator will
10547c478bd9Sstevel@tonic-gate * never return equal for segments with non-zero length. This
10557c478bd9Sstevel@tonic-gate * is a necessary hack to get around the fact that we do, in
10567c478bd9Sstevel@tonic-gate * fact, have duplicate keys.
10577c478bd9Sstevel@tonic-gate */
10587c478bd9Sstevel@tonic-gate (void) avl_find(pp->p_segacct, nsap, &where);
10597c478bd9Sstevel@tonic-gate avl_insert(pp->p_segacct, nsap, where);
10607c478bd9Sstevel@tonic-gate
10617c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
10627c478bd9Sstevel@tonic-gate }
10637c478bd9Sstevel@tonic-gate
10647c478bd9Sstevel@tonic-gate /*
10657c478bd9Sstevel@tonic-gate * Duplicate parent's segacct records in child.
10667c478bd9Sstevel@tonic-gate */
10677c478bd9Sstevel@tonic-gate void
shmfork(struct proc * ppp,struct proc * cpp)10687c478bd9Sstevel@tonic-gate shmfork(struct proc *ppp, struct proc *cpp)
10697c478bd9Sstevel@tonic-gate {
10707c478bd9Sstevel@tonic-gate segacct_t *sap;
10717c478bd9Sstevel@tonic-gate kshmid_t *sp;
10727c478bd9Sstevel@tonic-gate kmutex_t *mp;
10737c478bd9Sstevel@tonic-gate
10747c478bd9Sstevel@tonic-gate ASSERT(ppp->p_segacct != NULL);
10757c478bd9Sstevel@tonic-gate
10767c478bd9Sstevel@tonic-gate /*
10777c478bd9Sstevel@tonic-gate * We are the only lwp running in the parent so nobody can
10787c478bd9Sstevel@tonic-gate * mess with our p_segacct list. Thus it is safe to traverse
10797c478bd9Sstevel@tonic-gate * the list without holding p_lock. This is essential because
10807c478bd9Sstevel@tonic-gate * we can't hold p_lock during a KM_SLEEP allocation.
10817c478bd9Sstevel@tonic-gate */
10827c478bd9Sstevel@tonic-gate for (sap = (segacct_t *)avl_first(ppp->p_segacct); sap != NULL;
10837c478bd9Sstevel@tonic-gate sap = (segacct_t *)AVL_NEXT(ppp->p_segacct, sap)) {
10847c478bd9Sstevel@tonic-gate sa_add(cpp, sap->sa_addr, sap->sa_len, sap->sa_flags,
10857c478bd9Sstevel@tonic-gate sap->sa_id);
10867c478bd9Sstevel@tonic-gate sp = sap->sa_id;
10877c478bd9Sstevel@tonic-gate mp = ipc_lock(shm_svc, sp->shm_perm.ipc_id);
10887c478bd9Sstevel@tonic-gate if (sap->sa_flags & SHMSA_ISM)
10897c478bd9Sstevel@tonic-gate sp->shm_ismattch++;
10907c478bd9Sstevel@tonic-gate ipc_hold(shm_svc, (kipc_perm_t *)sp);
10917c478bd9Sstevel@tonic-gate mutex_exit(mp);
10927c478bd9Sstevel@tonic-gate }
10937c478bd9Sstevel@tonic-gate }
10947c478bd9Sstevel@tonic-gate
10957c478bd9Sstevel@tonic-gate /*
10967c478bd9Sstevel@tonic-gate * Detach shared memory segments from exiting process.
10977c478bd9Sstevel@tonic-gate */
10987c478bd9Sstevel@tonic-gate void
shmexit(struct proc * pp)10997c478bd9Sstevel@tonic-gate shmexit(struct proc *pp)
11007c478bd9Sstevel@tonic-gate {
11017c478bd9Sstevel@tonic-gate segacct_t *sap;
11027c478bd9Sstevel@tonic-gate avl_tree_t *tree;
11037c478bd9Sstevel@tonic-gate void *cookie = NULL;
11047c478bd9Sstevel@tonic-gate
11057c478bd9Sstevel@tonic-gate ASSERT(pp->p_segacct != NULL);
11067c478bd9Sstevel@tonic-gate
11077c478bd9Sstevel@tonic-gate mutex_enter(&pp->p_lock);
11087c478bd9Sstevel@tonic-gate prbarrier(pp);
11097c478bd9Sstevel@tonic-gate tree = pp->p_segacct;
11107c478bd9Sstevel@tonic-gate pp->p_segacct = NULL;
11117c478bd9Sstevel@tonic-gate mutex_exit(&pp->p_lock);
11127c478bd9Sstevel@tonic-gate
11137c478bd9Sstevel@tonic-gate while ((sap = avl_destroy_nodes(tree, &cookie)) != NULL)
11147c478bd9Sstevel@tonic-gate (void) shm_detach(pp, sap);
11157c478bd9Sstevel@tonic-gate
11167c478bd9Sstevel@tonic-gate avl_destroy(tree);
11177c478bd9Sstevel@tonic-gate kmem_free(tree, sizeof (avl_tree_t));
11187c478bd9Sstevel@tonic-gate }
11197c478bd9Sstevel@tonic-gate
11207c478bd9Sstevel@tonic-gate /*
11217c478bd9Sstevel@tonic-gate * At this time pages should be in memory, so just lock them.
11227c478bd9Sstevel@tonic-gate */
11237c478bd9Sstevel@tonic-gate static void
lock_again(size_t npages,kshmid_t * sp,struct anon_map * amp)1124c6939658Ssl lock_again(size_t npages, kshmid_t *sp, struct anon_map *amp)
11257c478bd9Sstevel@tonic-gate {
11267c478bd9Sstevel@tonic-gate struct anon *ap;
11277c478bd9Sstevel@tonic-gate struct page *pp;
11287c478bd9Sstevel@tonic-gate struct vnode *vp;
1129c6939658Ssl u_offset_t off;
11307c478bd9Sstevel@tonic-gate ulong_t anon_idx;
11317c478bd9Sstevel@tonic-gate anon_sync_obj_t cookie;
11327c478bd9Sstevel@tonic-gate
1133c6939658Ssl mutex_enter(&sp->shm_mlock);
11347c478bd9Sstevel@tonic-gate ANON_LOCK_ENTER(&->a_rwlock, RW_READER);
11357c478bd9Sstevel@tonic-gate for (anon_idx = 0; npages != 0; anon_idx++, npages--) {
11367c478bd9Sstevel@tonic-gate
11377c478bd9Sstevel@tonic-gate anon_array_enter(amp, anon_idx, &cookie);
11387c478bd9Sstevel@tonic-gate ap = anon_get_ptr(amp->ahp, anon_idx);
1139c6939658Ssl ASSERT(ap != NULL);
11407c478bd9Sstevel@tonic-gate swap_xlate(ap, &vp, &off);
11417c478bd9Sstevel@tonic-gate anon_array_exit(&cookie);
11427c478bd9Sstevel@tonic-gate
1143c6939658Ssl pp = page_lookup(vp, off, SE_SHARED);
11447c478bd9Sstevel@tonic-gate if (pp == NULL) {
11457c478bd9Sstevel@tonic-gate panic("lock_again: page not in the system");
11467c478bd9Sstevel@tonic-gate /*NOTREACHED*/
11477c478bd9Sstevel@tonic-gate }
1148c6939658Ssl /* page should already be locked by caller */
1149c6939658Ssl ASSERT(pp->p_lckcnt > 0);
11507c478bd9Sstevel@tonic-gate (void) page_pp_lock(pp, 0, 0);
11517c478bd9Sstevel@tonic-gate page_unlock(pp);
11527c478bd9Sstevel@tonic-gate }
11537c478bd9Sstevel@tonic-gate ANON_LOCK_EXIT(&->a_rwlock);
1154c6939658Ssl mutex_exit(&sp->shm_mlock);
11557c478bd9Sstevel@tonic-gate }
11567c478bd9Sstevel@tonic-gate
11577c478bd9Sstevel@tonic-gate /*
11587c478bd9Sstevel@tonic-gate * Attach the shared memory segment to the process
11597c478bd9Sstevel@tonic-gate * address space and lock the pages.
11607c478bd9Sstevel@tonic-gate */
11617c478bd9Sstevel@tonic-gate static int
shmem_lock(kshmid_t * sp,struct anon_map * amp)1162c6939658Ssl shmem_lock(kshmid_t *sp, struct anon_map *amp)
11637c478bd9Sstevel@tonic-gate {
11647c478bd9Sstevel@tonic-gate size_t npages = btopr(amp->size);
11657c478bd9Sstevel@tonic-gate struct as *as;
11667c478bd9Sstevel@tonic-gate struct segvn_crargs crargs;
1167c6939658Ssl uint_t error;
11687c478bd9Sstevel@tonic-gate
1169c6939658Ssl /*
1170c6939658Ssl * A later ISM/DISM attach may increase the size of the amp, so
1171c6939658Ssl * cache the number of pages locked for the future shmem_unlock()
1172c6939658Ssl */
1173c6939658Ssl sp->shm_lkpages = npages;
11747c478bd9Sstevel@tonic-gate
1175c6939658Ssl as = as_alloc();
11767c478bd9Sstevel@tonic-gate /* Initialize the create arguments and map the segment */
11777c478bd9Sstevel@tonic-gate crargs = *(struct segvn_crargs *)zfod_argsp; /* structure copy */
11787c478bd9Sstevel@tonic-gate crargs.offset = (u_offset_t)0;
11797c478bd9Sstevel@tonic-gate crargs.type = MAP_SHARED;
11807c478bd9Sstevel@tonic-gate crargs.amp = amp;
11817c478bd9Sstevel@tonic-gate crargs.prot = PROT_ALL;
11827c478bd9Sstevel@tonic-gate crargs.maxprot = crargs.prot;
11837c478bd9Sstevel@tonic-gate crargs.flags = 0;
1184c6939658Ssl error = as_map(as, 0x0, amp->size, segvn_create, &crargs);
11857c478bd9Sstevel@tonic-gate if (!error) {
1186c6939658Ssl if ((error = as_ctl(as, 0x0, amp->size, MC_LOCK, 0, 0,
1187d3e55dcdSgww NULL, 0)) == 0) {
1188c6939658Ssl lock_again(npages, sp, amp);
11897c478bd9Sstevel@tonic-gate }
1190c6939658Ssl (void) as_unmap(as, 0x0, amp->size);
11917c478bd9Sstevel@tonic-gate }
1192c6939658Ssl as_free(as);
11937c478bd9Sstevel@tonic-gate return (error);
11947c478bd9Sstevel@tonic-gate }
11957c478bd9Sstevel@tonic-gate
11967c478bd9Sstevel@tonic-gate
11977c478bd9Sstevel@tonic-gate /*
11987c478bd9Sstevel@tonic-gate * Unlock shared memory
11997c478bd9Sstevel@tonic-gate */
12007c478bd9Sstevel@tonic-gate static void
shmem_unlock(kshmid_t * sp,struct anon_map * amp)1201c6939658Ssl shmem_unlock(kshmid_t *sp, struct anon_map *amp)
12027c478bd9Sstevel@tonic-gate {
12037c478bd9Sstevel@tonic-gate struct anon *ap;
1204c6939658Ssl pgcnt_t npages = sp->shm_lkpages;
12057c478bd9Sstevel@tonic-gate struct vnode *vp;
12067c478bd9Sstevel@tonic-gate struct page *pp;
1207c6939658Ssl u_offset_t off;
12087c478bd9Sstevel@tonic-gate ulong_t anon_idx;
1209c6939658Ssl size_t unlocked_bytes = 0;
1210c6939658Ssl kproject_t *proj;
1211c6939658Ssl anon_sync_obj_t cookie;
12127c478bd9Sstevel@tonic-gate
1213c6939658Ssl proj = sp->shm_perm.ipc_proj;
1214c6939658Ssl mutex_enter(&sp->shm_mlock);
1215c6939658Ssl ANON_LOCK_ENTER(&->a_rwlock, RW_READER);
12167c478bd9Sstevel@tonic-gate for (anon_idx = 0; anon_idx < npages; anon_idx++) {
12177c478bd9Sstevel@tonic-gate
1218c6939658Ssl anon_array_enter(amp, anon_idx, &cookie);
12197c478bd9Sstevel@tonic-gate if ((ap = anon_get_ptr(amp->ahp, anon_idx)) == NULL) {
1220c6939658Ssl panic("shmem_unlock: null app");
1221c6939658Ssl /*NOTREACHED*/
12227c478bd9Sstevel@tonic-gate }
12237c478bd9Sstevel@tonic-gate swap_xlate(ap, &vp, &off);
1224c6939658Ssl anon_array_exit(&cookie);
12257c478bd9Sstevel@tonic-gate pp = page_lookup(vp, off, SE_SHARED);
12267c478bd9Sstevel@tonic-gate if (pp == NULL) {
1227c6939658Ssl panic("shmem_unlock: page not in the system");
1228c6939658Ssl /*NOTREACHED*/
12297c478bd9Sstevel@tonic-gate }
1230c6939658Ssl /*
1231c6939658Ssl * Page should at least have once lock from previous
1232c6939658Ssl * shmem_lock
1233c6939658Ssl */
1234c6939658Ssl ASSERT(pp->p_lckcnt > 0);
1235c6939658Ssl page_pp_unlock(pp, 0, 0);
1236c6939658Ssl if (pp->p_lckcnt == 0)
1237c6939658Ssl unlocked_bytes += PAGESIZE;
1238c6939658Ssl
12397c478bd9Sstevel@tonic-gate page_unlock(pp);
12407c478bd9Sstevel@tonic-gate }
1241c6939658Ssl
1242c6939658Ssl if (unlocked_bytes > 0) {
1243c6939658Ssl rctl_decr_locked_mem(NULL, proj, unlocked_bytes, 0);
1244c6939658Ssl }
1245c6939658Ssl
1246c6939658Ssl ANON_LOCK_EXIT(&->a_rwlock);
1247c6939658Ssl mutex_exit(&sp->shm_mlock);
12487c478bd9Sstevel@tonic-gate }
12497c478bd9Sstevel@tonic-gate
12507c478bd9Sstevel@tonic-gate /*
12517c478bd9Sstevel@tonic-gate * We call this routine when we have removed all references to this
12527c478bd9Sstevel@tonic-gate * amp. This means all shmdt()s and the IPC_RMID have been done.
12537c478bd9Sstevel@tonic-gate */
12547c478bd9Sstevel@tonic-gate static void
shm_rm_amp(kshmid_t * sp)125568803f2dSsl shm_rm_amp(kshmid_t *sp)
12567c478bd9Sstevel@tonic-gate {
125768803f2dSsl struct anon_map *amp = sp->shm_amp;
125868803f2dSsl zone_t *zone;
125968803f2dSsl
1260a19609f8Sjv zone = sp->shm_perm.ipc_zone_ref.zref_zone;
126167253d2cSsl ASSERT(zone != NULL);
12627c478bd9Sstevel@tonic-gate /*
12637c478bd9Sstevel@tonic-gate * Free up the anon_map.
12647c478bd9Sstevel@tonic-gate */
12657c478bd9Sstevel@tonic-gate lgrp_shm_policy_fini(amp, NULL);
1266a98e9dbfSaguzovsk ANON_LOCK_ENTER(&->a_rwlock, RW_WRITER);
126707b65a64Saguzovsk if (amp->a_szc != 0) {
126807b65a64Saguzovsk anon_shmap_free_pages(amp, 0, amp->size);
126907b65a64Saguzovsk } else {
127007b65a64Saguzovsk anon_free(amp->ahp, 0, amp->size);
127107b65a64Saguzovsk }
1272a98e9dbfSaguzovsk ANON_LOCK_EXIT(&->a_rwlock);
127368803f2dSsl anon_unresv_zone(amp->swresv, zone);
12747c478bd9Sstevel@tonic-gate anonmap_free(amp);
12757c478bd9Sstevel@tonic-gate }
12767c478bd9Sstevel@tonic-gate
12777c478bd9Sstevel@tonic-gate /*
12787c478bd9Sstevel@tonic-gate * Return the shared memory id for the process's virtual address.
12797c478bd9Sstevel@tonic-gate * Return SHMID_NONE if addr is not within a SysV shared memory segment.
12807c478bd9Sstevel@tonic-gate * Return SHMID_FREE if addr's SysV shared memory segment's id has been freed.
12817c478bd9Sstevel@tonic-gate *
12827c478bd9Sstevel@tonic-gate * shmgetid() is called from code in /proc with the process locked but
12837c478bd9Sstevel@tonic-gate * with pp->p_lock not held. The address space lock is held, so we
12847c478bd9Sstevel@tonic-gate * cannot grab pp->p_lock here due to lock-ordering constraints.
12857c478bd9Sstevel@tonic-gate * Because of all this, modifications to the p_segacct list must only
12867c478bd9Sstevel@tonic-gate * be made after calling prbarrier() to ensure the process is not locked.
12877c478bd9Sstevel@tonic-gate * See shmdt() and sa_add(), above. shmgetid() may also be called on a
12887c478bd9Sstevel@tonic-gate * thread's own process without the process locked.
12897c478bd9Sstevel@tonic-gate */
12907c478bd9Sstevel@tonic-gate int
shmgetid(proc_t * pp,caddr_t addr)12917c478bd9Sstevel@tonic-gate shmgetid(proc_t *pp, caddr_t addr)
12927c478bd9Sstevel@tonic-gate {
12937c478bd9Sstevel@tonic-gate segacct_t *sap, template;
12947c478bd9Sstevel@tonic-gate
12957c478bd9Sstevel@tonic-gate ASSERT(MUTEX_NOT_HELD(&pp->p_lock));
12967c478bd9Sstevel@tonic-gate ASSERT((pp->p_proc_flag & P_PR_LOCK) || pp == curproc);
12977c478bd9Sstevel@tonic-gate
12987c478bd9Sstevel@tonic-gate if (pp->p_segacct == NULL)
12997c478bd9Sstevel@tonic-gate return (SHMID_NONE);
13007c478bd9Sstevel@tonic-gate
13017c478bd9Sstevel@tonic-gate template.sa_addr = addr;
13027c478bd9Sstevel@tonic-gate template.sa_len = 0;
13037c478bd9Sstevel@tonic-gate if ((sap = avl_find(pp->p_segacct, &template, NULL)) == NULL)
13047c478bd9Sstevel@tonic-gate return (SHMID_NONE);
13057c478bd9Sstevel@tonic-gate
13067c478bd9Sstevel@tonic-gate if (IPC_FREE(&sap->sa_id->shm_perm))
13077c478bd9Sstevel@tonic-gate return (SHMID_FREE);
13087c478bd9Sstevel@tonic-gate
13097c478bd9Sstevel@tonic-gate return (sap->sa_id->shm_perm.ipc_id);
13107c478bd9Sstevel@tonic-gate }
1311