This source file includes following definitions.
- shm_init
- findkey
- newseg
- sys_shmget
- killseg
- sys_shmctl
- shm_map
- sys_shmat
- detach
- sys_shmdt
- shm_exit
- shm_fork
- shm_no_page
- shm_swap
1
2
3
4
5
6
7
8 #include <linux/errno.h>
9 #include <asm/segment.h>
10 #include <linux/sched.h>
11 #include <linux/ipc.h>
12 #include <linux/shm.h>
13 #include <linux/stat.h>
14 #include <linux/malloc.h>
15
16 extern int ipcperms (struct ipc_perm *ipcp, short semflg);
17 extern unsigned int get_swap_page(void);
18 static int findkey (key_t key);
19 static int newseg (key_t key, int shmflg, int size);
20 static int shm_map (struct shm_desc *shmd, int remap);
21 static void killseg (int id);
22
23 static int shm_tot = 0;
24 static int shm_rss = 0;
25 static int shm_swp = 0;
26 static int max_shmid = 0;
27 static struct wait_queue *shm_lock = NULL;
28 static struct shmid_ds *shm_segs[SHMMNI];
29
30 static unsigned short shm_seq = 0;
31
32
33 static ulong swap_attempts = 0;
34 static ulong swap_successes = 0;
35 static ulong used_segs = 0;
36
37 void shm_init (void)
38 {
39 int id;
40
41 for (id = 0; id < SHMMNI; id++)
42 shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
43 shm_tot = shm_rss = shm_seq = max_shmid = used_segs = 0;
44 shm_lock = NULL;
45 return;
46 }
47
48 static int findkey (key_t key)
49 {
50 int id;
51 struct shmid_ds *shp;
52
53 for (id=0; id <= max_shmid; id++) {
54 while ((shp = shm_segs[id]) == IPC_NOID)
55 sleep_on (&shm_lock);
56 if (shp == IPC_UNUSED)
57 continue;
58 if (key == shp->shm_perm.key)
59 return id;
60 }
61 return -1;
62 }
63
64
65
66
67 static int newseg (key_t key, int shmflg, int size)
68 {
69 struct shmid_ds *shp;
70 int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
71 int id, i;
72
73 if (size < SHMMIN)
74 return -EINVAL;
75 if (shm_tot + numpages >= SHMALL)
76 return -ENOSPC;
77 for (id=0; id < SHMMNI; id++)
78 if (shm_segs[id] == IPC_UNUSED) {
79 shm_segs[id] = (struct shmid_ds *) IPC_NOID;
80 goto found;
81 }
82 return -ENOSPC;
83
84 found:
85 shp = (struct shmid_ds *) kmalloc (sizeof (*shp), GFP_KERNEL);
86 if (!shp) {
87 shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
88 if (shm_lock)
89 wake_up (&shm_lock);
90 return -ENOMEM;
91 }
92
93 shp->shm_pages = (ulong *) kmalloc (numpages*sizeof(ulong),GFP_KERNEL);
94 if (!shp->shm_pages) {
95 shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
96 if (shm_lock)
97 wake_up (&shm_lock);
98 kfree_s (shp, sizeof (*shp));
99 return -ENOMEM;
100 }
101
102 for (i=0; i< numpages; shp->shm_pages[i++] = 0);
103 shm_tot += numpages;
104 shp->shm_perm.key = key;
105 shp->shm_perm.mode = (shmflg & S_IRWXUGO);
106 shp->shm_perm.cuid = shp->shm_perm.uid = current->euid;
107 shp->shm_perm.cgid = shp->shm_perm.gid = current->egid;
108 shp->shm_perm.seq = shm_seq;
109 shp->shm_segsz = size;
110 shp->shm_cpid = current->pid;
111 shp->attaches = NULL;
112 shp->shm_lpid = shp->shm_nattch = 0;
113 shp->shm_atime = shp->shm_dtime = 0;
114 shp->shm_ctime = CURRENT_TIME;
115 shp->shm_npages = numpages;
116
117 if (id > max_shmid)
118 max_shmid = id;
119 shm_segs[id] = shp;
120 used_segs++;
121 if (shm_lock)
122 wake_up (&shm_lock);
123 return id + (int)shm_seq*SHMMNI;
124 }
125
126 int sys_shmget (key_t key, int size, int shmflg)
127 {
128 struct shmid_ds *shp;
129 int id = 0;
130
131 if (size < 0 || size > SHMMAX)
132 return -EINVAL;
133 if (key == IPC_PRIVATE)
134 return newseg(key, shmflg, size);
135 if ((id = findkey (key)) == -1) {
136 if (!(shmflg & IPC_CREAT))
137 return -ENOENT;
138 return newseg(key, shmflg, size);
139 }
140 if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL))
141 return -EEXIST;
142 shp = shm_segs[id];
143 if (shp->shm_perm.mode & SHM_DEST)
144 return -EIDRM;
145 if (size > shp->shm_segsz)
146 return -EINVAL;
147 if (ipcperms (&shp->shm_perm, shmflg))
148 return -EACCES;
149 return shp->shm_perm.seq*SHMMNI + id;
150 }
151
152
153
154
155
156 static void killseg (int id)
157 {
158 struct shmid_ds *shp;
159 int i, numpages;
160 ulong page;
161
162 shp = shm_segs[id];
163 if (shp == IPC_NOID || shp == IPC_UNUSED) {
164 printk ("shm nono: killseg called on unused seg id=%d\n", id);
165 return;
166 }
167 shp->shm_perm.seq++;
168 numpages = shp->shm_npages;
169 shm_seq++;
170 shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
171 used_segs--;
172 if (id == max_shmid)
173 while (max_shmid && (shm_segs[--max_shmid] == IPC_UNUSED));
174 if (!shp->shm_pages) {
175 printk ("shm nono: killseg shp->pages=NULL. id=%d\n", id);
176 return;
177 }
178 for (i=0; i< numpages ; i++) {
179 if (!(page = shp->shm_pages[i]))
180 continue;
181 if (page & 1) {
182 free_page (page & PAGE_MASK);
183 shm_rss--;
184 } else {
185 swap_free (page);
186 shm_swp--;
187 }
188 }
189 kfree_s (shp->shm_pages, numpages * sizeof (ulong));
190 shm_tot -= numpages;
191 kfree_s (shp, sizeof (*shp));
192 return;
193 }
194
195 int sys_shmctl (int shmid, int cmd, struct shmid_ds *buf)
196 {
197 struct shmid_ds *shp, tbuf;
198 struct ipc_perm *ipcp;
199 int id, err;
200
201 if (cmd < 0 || shmid < 0)
202 return -EINVAL;
203 if (cmd == IPC_SET) {
204 if (!buf)
205 return -EFAULT;
206 err = verify_area (VERIFY_READ, buf, sizeof (*buf));
207 if (err)
208 return err;
209 memcpy_fromfs (&tbuf, buf, sizeof (*buf));
210 }
211
212 switch (cmd) {
213 case IPC_INFO:
214 {
215 struct shminfo shminfo;
216 if (!buf)
217 return -EFAULT;
218 shminfo.shmmni = SHMMNI;
219 shminfo.shmmax = SHMMAX;
220 shminfo.shmmin = SHMMIN;
221 shminfo.shmall = SHMALL;
222 shminfo.shmseg = SHMSEG;
223 err = verify_area (VERIFY_WRITE, buf, sizeof (struct shminfo));
224 if (err)
225 return err;
226 memcpy_tofs (buf, &shminfo, sizeof(struct shminfo));
227 return max_shmid;
228 }
229 case SHM_INFO:
230 {
231 struct shm_info shm_info;
232 if (!buf)
233 return -EFAULT;
234 err = verify_area (VERIFY_WRITE, buf, sizeof (shm_info));
235 if (err)
236 return err;
237 shm_info.used_ids = used_segs;
238 shm_info.shm_rss = shm_rss;
239 shm_info.shm_tot = shm_tot;
240 shm_info.shm_swp = shm_swp;
241 shm_info.swap_attempts = swap_attempts;
242 shm_info.swap_successes = swap_successes;
243 memcpy_tofs (buf, &shm_info, sizeof(shm_info));
244 return max_shmid;
245 }
246 case SHM_STAT:
247 if (!buf)
248 return -EFAULT;
249 err = verify_area (VERIFY_WRITE, buf, sizeof (*shp));
250 if (err)
251 return err;
252 if (shmid > max_shmid)
253 return -EINVAL;
254 shp = shm_segs[shmid];
255 if (shp == IPC_UNUSED || shp == IPC_NOID)
256 return -EINVAL;
257 if (ipcperms (&shp->shm_perm, S_IRUGO))
258 return -EACCES;
259 id = shmid + shp->shm_perm.seq * SHMMNI;
260 memcpy_tofs (buf, shp, sizeof(*shp));
261 return id;
262 }
263
264 shp = shm_segs[id = shmid % SHMMNI];
265 if (shp == IPC_UNUSED || shp == IPC_NOID)
266 return -EINVAL;
267 ipcp = &shp->shm_perm;
268 if (ipcp->seq != shmid / SHMMNI)
269 return -EIDRM;
270
271 switch (cmd) {
272 case SHM_UNLOCK:
273 if (!suser())
274 return -EPERM;
275 if (!(ipcp->mode & SHM_LOCKED))
276 return -EINVAL;
277 ipcp->mode &= ~SHM_LOCKED;
278 break;
279 case SHM_LOCK:
280
281
282
283 if (!suser())
284 return -EPERM;
285 if (ipcp->mode & SHM_LOCKED)
286 return -EINVAL;
287 ipcp->mode |= SHM_LOCKED;
288 break;
289 case IPC_STAT:
290 if (ipcperms (ipcp, S_IRUGO))
291 return -EACCES;
292 if (!buf)
293 return -EFAULT;
294 err = verify_area (VERIFY_WRITE, buf, sizeof (*shp));
295 if (err)
296 return err;
297 memcpy_tofs (buf, shp, sizeof(*shp));
298 break;
299 case IPC_SET:
300 if (suser() || current->euid == shp->shm_perm.uid ||
301 current->euid == shp->shm_perm.cuid) {
302 ipcp->uid = tbuf.shm_perm.uid;
303 ipcp->gid = tbuf.shm_perm.gid;
304 ipcp->mode = (ipcp->mode & ~S_IRWXUGO)
305 | (tbuf.shm_perm.mode & S_IRWXUGO);
306 shp->shm_ctime = CURRENT_TIME;
307 break;
308 }
309 return -EPERM;
310 case IPC_RMID:
311 if (suser() || current->euid == shp->shm_perm.uid ||
312 current->euid == shp->shm_perm.cuid) {
313 shp->shm_perm.mode |= SHM_DEST;
314 if (shp->shm_nattch <= 0)
315 killseg (id);
316 break;
317 }
318 return -EPERM;
319 default:
320 return -EINVAL;
321 }
322 return 0;
323 }
324
325
326
327
328
329
330 static int shm_map (struct shm_desc *shmd, int remap)
331 {
332 unsigned long invalid = 0;
333 unsigned long *page_table;
334 unsigned long tmp, shm_sgn;
335 unsigned long page_dir = shmd->task->tss.cr3;
336
337
338 for (tmp = shmd->start; tmp < shmd->end; tmp += PAGE_SIZE) {
339 page_table = PAGE_DIR_OFFSET(page_dir,tmp);
340 if (*page_table & PAGE_PRESENT) {
341 page_table = (ulong *) (PAGE_MASK & *page_table);
342 page_table += ((tmp >> PAGE_SHIFT) & (PTRS_PER_PAGE-1));
343 if (*page_table) {
344 if (!remap)
345 return -EINVAL;
346 if (*page_table & PAGE_PRESENT) {
347 --current->rss;
348 free_page (*page_table & PAGE_MASK);
349 }
350 else
351 swap_free (*page_table);
352 invalid++;
353 }
354 continue;
355 }
356 {
357 unsigned long new_pt;
358 if(!(new_pt = get_free_page(GFP_KERNEL)))
359 return -ENOMEM;
360 *page_table = new_pt | PAGE_TABLE;
361 tmp |= ((PAGE_SIZE << 10) - PAGE_SIZE);
362 }}
363 if (invalid)
364 invalidate();
365
366
367 shm_sgn = shmd->shm_sgn;
368 for (tmp = shmd->start; tmp < shmd->end; tmp += PAGE_SIZE,
369 shm_sgn += (1 << SHM_IDX_SHIFT)) {
370 page_table = PAGE_DIR_OFFSET(page_dir,tmp);
371 page_table = (ulong *) (PAGE_MASK & *page_table);
372 page_table += (tmp >> PAGE_SHIFT) & (PTRS_PER_PAGE-1);
373 *page_table = shm_sgn;
374 }
375 return 0;
376 }
377
378
379
380
381
382
383 int sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
384 {
385 struct shmid_ds *shp;
386 struct shm_desc *shmd;
387 int err;
388 unsigned int id;
389 unsigned long addr;
390
391 if (shmid < 0)
392 return -EINVAL;
393
394 shp = shm_segs[id = shmid % SHMMNI];
395 if (shp == IPC_UNUSED || shp == IPC_NOID)
396 return -EINVAL;
397
398 if (!(addr = (ulong) shmaddr)) {
399 if (shmflg & SHM_REMAP)
400 return -EINVAL;
401
402 addr = SHM_RANGE_END;
403 for (shmd = current->shm; shmd; shmd = shmd->task_next) {
404 if (shmd->start < SHM_RANGE_START)
405 continue;
406 if (addr >= shmd->start)
407 addr = shmd->start;
408 }
409 addr = (addr - shp->shm_segsz) & PAGE_MASK;
410 } else if (addr & (SHMLBA-1)) {
411 if (shmflg & SHM_RND)
412 addr &= ~(SHMLBA-1);
413 else
414 return -EINVAL;
415 }
416 if ((addr > current->start_stack - 16384 - PAGE_SIZE*shp->shm_npages))
417 return -EINVAL;
418 if (shmflg & SHM_REMAP)
419 for (shmd = current->shm; shmd; shmd = shmd->task_next) {
420 if (addr >= shmd->start && addr < shmd->end)
421 return -EINVAL;
422 if (addr + shp->shm_segsz >= shmd->start &&
423 addr + shp->shm_segsz < shmd->end)
424 return -EINVAL;
425 }
426
427 if (ipcperms(&shp->shm_perm, shmflg & SHM_RDONLY ? S_IRUGO : S_IRUGO|S_IWUGO))
428 return -EACCES;
429 if (shp->shm_perm.seq != shmid / SHMMNI)
430 return -EIDRM;
431
432 shmd = (struct shm_desc *) kmalloc (sizeof(*shmd), GFP_KERNEL);
433 if (!shmd)
434 return -ENOMEM;
435 if ((shp != shm_segs[id]) || (shp->shm_perm.seq != shmid / SHMMNI)) {
436 kfree_s (shmd, sizeof (*shmd));
437 return -EIDRM;
438 }
439 shmd->shm_sgn = (SHM_SWP_TYPE << 1) | (id << SHM_ID_SHIFT) |
440 (shmflg & SHM_RDONLY ? SHM_READ_ONLY : 0);
441 shmd->start = addr;
442 shmd->end = addr + shp->shm_npages * PAGE_SIZE;
443 shmd->task = current;
444
445 shp->shm_nattch++;
446 if (addr < current->end_data) {
447 iput (current->executable);
448 current->executable = NULL;
449
450 }
451
452 if ((err = shm_map (shmd, shmflg & SHM_REMAP))) {
453 if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST)
454 killseg(id);
455 kfree_s (shmd, sizeof (*shmd));
456 return err;
457 }
458
459 shmd->task_next = current->shm;
460 current->shm = shmd;
461 shmd->seg_next = shp->attaches;
462 shp->attaches = shmd;
463 shp->shm_lpid = current->pid;
464 shp->shm_atime = CURRENT_TIME;
465 if (!raddr)
466 return addr;
467 put_fs_long (addr, raddr);
468 return 0;
469 }
470
471
472
473
474
475
476 static void detach (struct shm_desc **shmdp)
477 {
478 struct shm_desc *shmd = *shmdp;
479 struct shmid_ds *shp;
480 int id;
481
482 id = (shmd->shm_sgn >> SHM_ID_SHIFT) & SHM_ID_MASK;
483 shp = shm_segs[id];
484 *shmdp = shmd->task_next;
485 for (shmdp = &shp->attaches; *shmdp; shmdp = &(*shmdp)->seg_next)
486 if (*shmdp == shmd) {
487 *shmdp = shmd->seg_next;
488 goto found;
489 }
490 printk("detach: shm segment (id=%d) attach list inconsistent\n",id);
491
492 found:
493 unmap_page_range (shmd->start, shp->shm_segsz);
494 kfree_s (shmd, sizeof (*shmd));
495 shp->shm_lpid = current->pid;
496 shp->shm_dtime = CURRENT_TIME;
497 if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST)
498 killseg (id);
499 return;
500 }
501
502
503
504
505
506 int sys_shmdt (char *shmaddr)
507 {
508 struct shm_desc *shmd, **shmdp;
509
510 for (shmdp = ¤t->shm; (shmd = *shmdp); shmdp=&shmd->task_next) {
511 if (shmd->start == (ulong) shmaddr) {
512 detach (shmdp);
513 return 0;
514 }
515 }
516 return -EINVAL;
517 }
518
519
520
521
522 void shm_exit (void)
523 {
524 while (current->shm)
525 detach(¤t->shm);
526 return;
527 }
528
529
530
531
532
533
534 int shm_fork (struct task_struct *p1, struct task_struct *p2)
535 {
536 struct shm_desc *shmd, *new_desc = NULL, *tmp;
537 struct shmid_ds *shp;
538 int id;
539
540 if (!p1->shm)
541 return 0;
542 for (shmd = p1->shm; shmd; shmd = shmd->task_next) {
543 tmp = (struct shm_desc *) kmalloc(sizeof(*tmp), GFP_KERNEL);
544 if (!tmp) {
545 while (new_desc) {
546 tmp = new_desc->task_next;
547 kfree_s (new_desc, sizeof (*new_desc));
548 new_desc = tmp;
549 }
550 free_page_tables (p2);
551 return -ENOMEM;
552 }
553 *tmp = *shmd;
554 tmp->task = p2;
555 tmp->task_next = new_desc;
556 new_desc = tmp;
557 }
558 p2->shm = new_desc;
559 for (shmd = new_desc; shmd; shmd = shmd->task_next) {
560 id = (shmd->shm_sgn >> SHM_ID_SHIFT) & SHM_ID_MASK;
561 shp = shm_segs[id];
562 if (shp == IPC_UNUSED) {
563 printk("shm_fork: unused id=%d PANIC\n", id);
564 return -ENOMEM;
565 }
566 shmd->seg_next = shp->attaches;
567 shp->attaches = shmd;
568 shp->shm_nattch++;
569 shp->shm_atime = CURRENT_TIME;
570 shp->shm_lpid = current->pid;
571 }
572 return 0;
573 }
574
575
576
577
578 void shm_no_page (unsigned long *ptent)
579 {
580 unsigned long page;
581 unsigned long code = *ptent;
582 struct shmid_ds *shp;
583 unsigned int id, idx;
584
585 id = (code >> SHM_ID_SHIFT) & SHM_ID_MASK;
586 if (id > max_shmid) {
587 printk ("shm_no_page: id=%d too big. proc mem corruptedn", id);
588 return;
589 }
590 shp = shm_segs[id];
591 if (shp == IPC_UNUSED || shp == IPC_NOID) {
592 printk ("shm_no_page: id=%d invalid. Race.\n", id);
593 return;
594 }
595 idx = (code >> SHM_IDX_SHIFT) & SHM_IDX_MASK;
596 if (idx >= shp->shm_npages) {
597 printk ("shm_no_page : too large page index. id=%d\n", id);
598 return;
599 }
600
601 if (!(shp->shm_pages[idx] & PAGE_PRESENT)) {
602 if(!(page = get_free_page(GFP_KERNEL))) {
603 oom(current);
604 *ptent = BAD_PAGE | PAGE_ACCESSED | 7;
605 return;
606 }
607 if (shp->shm_pages[idx] & PAGE_PRESENT) {
608 free_page (page);
609 goto done;
610 }
611 if (shp->shm_pages[idx]) {
612 read_swap_page (shp->shm_pages[idx], (char *) page);
613 if (shp->shm_pages[idx] & PAGE_PRESENT) {
614 free_page (page);
615 goto done;
616 }
617 swap_free (shp->shm_pages[idx]);
618 shm_swp--;
619 }
620 shm_rss++;
621 shp->shm_pages[idx] = page | (PAGE_SHARED | PAGE_DIRTY);
622 } else
623 --current->maj_flt;
624
625 done:
626 current->min_flt++;
627 page = shp->shm_pages[idx];
628 if (code & SHM_READ_ONLY)
629 page &= ~2;
630 mem_map[MAP_NR(page)]++;
631 *ptent = page;
632 return;
633 }
634
635
636
637
638 static unsigned long swap_id = 0;
639 static unsigned long swap_idx = 0;
640
641 int shm_swap (int prio)
642 {
643 unsigned long page;
644 struct shmid_ds *shp;
645 struct shm_desc *shmd;
646 unsigned int swap_nr;
647 unsigned long id, idx, invalid = 0;
648 int counter;
649
650 counter = shm_rss >> prio;
651 if (!counter || !(swap_nr = get_swap_page()))
652 return 0;
653
654 check_id:
655 shp = shm_segs[swap_id];
656 if (shp == IPC_UNUSED || shp == IPC_NOID || shp->shm_perm.mode & SHM_LOCKED ) {
657 swap_idx = 0;
658 if (++swap_id > max_shmid)
659 swap_id = 0;
660 goto check_id;
661 }
662 id = swap_id;
663
664 check_table:
665 idx = swap_idx++;
666 if (idx >= shp->shm_npages) {
667 swap_idx = 0;
668 if (++swap_id > max_shmid)
669 swap_id = 0;
670 goto check_id;
671 }
672
673 page = shp->shm_pages[idx];
674 if (!(page & PAGE_PRESENT))
675 goto check_table;
676 swap_attempts++;
677
678 if (--counter < 0) {
679 if (invalid)
680 invalidate();
681 swap_free (swap_nr);
682 return 0;
683 }
684 for (shmd = shp->attaches; shmd; shmd = shmd->seg_next) {
685 unsigned long tmp, *pte;
686 if ((shmd->shm_sgn >> SHM_ID_SHIFT & SHM_ID_MASK) != id) {
687 printk ("shm_swap: id=%ld does not match shmd\n", id);
688 continue;
689 }
690 tmp = shmd->start + (idx << PAGE_SHIFT);
691 if (tmp >= shmd->end) {
692 printk ("shm_swap: too large idx=%ld id=%ld PANIC\n",idx, id);
693 continue;
694 }
695 pte = PAGE_DIR_OFFSET(shmd->task->tss.cr3,tmp);
696 if (!(*pte & 1)) {
697 printk("shm_swap: bad pgtbl! id=%ld start=%lx idx=%ld\n",
698 id, shmd->start, idx);
699 *pte = 0;
700 continue;
701 }
702 pte = (ulong *) (PAGE_MASK & *pte);
703 pte += ((tmp >> PAGE_SHIFT) & (PTRS_PER_PAGE-1));
704 tmp = *pte;
705 if (!(tmp & PAGE_PRESENT))
706 continue;
707 if (tmp & PAGE_ACCESSED) {
708 *pte &= ~PAGE_ACCESSED;
709 continue;
710 }
711 tmp = shmd->shm_sgn | idx << SHM_IDX_SHIFT;
712 *pte = tmp;
713 mem_map[MAP_NR(page)]--;
714 shmd->task->rss--;
715 invalid++;
716 }
717
718 if (mem_map[MAP_NR(page)] != 1)
719 goto check_table;
720 page &= PAGE_MASK;
721 shp->shm_pages[idx] = swap_nr;
722 if (invalid)
723 invalidate();
724 write_swap_page (swap_nr, (char *) page);
725 free_page (page);
726 swap_successes++;
727 shm_swp++;
728 shm_rss--;
729 return 1;
730 }