xref: /netbsd-src/sys/kern/sysv_shm.c (revision ce2c90c7c172d95d2402a5b3d96d8f8e6d138a21)
1 /*	$NetBSD: sysv_shm.c,v 1.90 2006/10/12 01:32:18 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 1999 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Copyright (c) 1994 Adam Glass and Charles M. Hannum.  All rights reserved.
42  *
43  * Redistribution and use in source and binary forms, with or without
44  * modification, are permitted provided that the following conditions
45  * are met:
46  * 1. Redistributions of source code must retain the above copyright
47  *    notice, this list of conditions and the following disclaimer.
48  * 2. Redistributions in binary form must reproduce the above copyright
49  *    notice, this list of conditions and the following disclaimer in the
50  *    documentation and/or other materials provided with the distribution.
51  * 3. All advertising materials mentioning features or use of this software
52  *    must display the following acknowledgement:
53  *	This product includes software developed by Adam Glass and Charles M.
54  *	Hannum.
55  * 4. The names of the authors may not be used to endorse or promote products
56  *    derived from this software without specific prior written permission.
57  *
58  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
59  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
60  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
61  * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
62  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
63  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
64  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
65  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
66  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
67  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
68  */
69 
70 #include <sys/cdefs.h>
71 __KERNEL_RCSID(0, "$NetBSD: sysv_shm.c,v 1.90 2006/10/12 01:32:18 christos Exp $");
72 
73 #define SYSVSHM
74 
75 #include <sys/param.h>
76 #include <sys/kernel.h>
77 #include <sys/shm.h>
78 #include <sys/malloc.h>
79 #include <sys/mman.h>
80 #include <sys/stat.h>
81 #include <sys/sysctl.h>
82 #include <sys/mount.h>		/* XXX for <sys/syscallargs.h> */
83 #include <sys/sa.h>
84 #include <sys/syscallargs.h>
85 #include <sys/queue.h>
86 #include <sys/pool.h>
87 #include <sys/kauth.h>
88 
89 #include <uvm/uvm_extern.h>
90 #include <uvm/uvm_object.h>
91 
92 static MALLOC_DEFINE(M_SHM, "shm", "SVID compatible shared memory segments");
93 
94 /*
95  * Provides the following externally accessible functions:
96  *
97  * shminit(void);		                 initialization
98  * shmexit(struct vmspace *)                     cleanup
99  * shmfork(struct vmspace *, struct vmspace *)   fork handling
100  *
101  * Structures:
102  * shmsegs (an array of 'struct shmid_ds')
103  * per proc array of 'struct shmmap_state'
104  */
105 
106 int shm_nused;
107 struct	shmid_ds *shmsegs;
108 
109 struct shmmap_entry {
110 	SLIST_ENTRY(shmmap_entry) next;
111 	vaddr_t va;
112 	int shmid;
113 };
114 
115 static int	shm_last_free, shm_committed;
116 
117 static POOL_INIT(shmmap_entry_pool, sizeof(struct shmmap_entry), 0, 0, 0,
118     "shmmp", &pool_allocator_nointr);
119 
120 struct shmmap_state {
121 	unsigned int nitems;
122 	unsigned int nrefs;
123 	SLIST_HEAD(, shmmap_entry) entries;
124 };
125 
126 static int shm_find_segment_by_key(key_t);
127 static void shm_deallocate_segment(struct shmid_ds *);
128 static void shm_delete_mapping(struct vmspace *, struct shmmap_state *,
129 			       struct shmmap_entry *);
130 static int shmget_existing(struct lwp *, struct sys_shmget_args *,
131 			   int, int, register_t *);
132 static int shmget_allocate_segment(struct lwp *, struct sys_shmget_args *,
133 				   int, register_t *);
134 static struct shmmap_state *shmmap_getprivate(struct proc *);
135 static struct shmmap_entry *shm_find_mapping(struct shmmap_state *, vaddr_t);
136 
137 static int
138 shm_find_segment_by_key(key_t key)
139 {
140 	int i;
141 
142 	for (i = 0; i < shminfo.shmmni; i++)
143 		if ((shmsegs[i].shm_perm.mode & SHMSEG_ALLOCATED) &&
144 		    shmsegs[i].shm_perm._key == key)
145 			return i;
146 	return -1;
147 }
148 
149 static struct shmid_ds *
150 shm_find_segment_by_shmid(int shmid)
151 {
152 	int segnum;
153 	struct shmid_ds *shmseg;
154 
155 	segnum = IPCID_TO_IX(shmid);
156 	if (segnum < 0 || segnum >= shminfo.shmmni)
157 		return NULL;
158 	shmseg = &shmsegs[segnum];
159 	if ((shmseg->shm_perm.mode & SHMSEG_ALLOCATED) == 0)
160 		return NULL;
161 	if ((shmseg->shm_perm.mode & (SHMSEG_REMOVED|SHMSEG_RMLINGER)) == SHMSEG_REMOVED)
162 		return NULL;
163 	if (shmseg->shm_perm._seq != IPCID_TO_SEQ(shmid))
164 		return NULL;
165 	return shmseg;
166 }
167 
168 static void
169 shm_deallocate_segment(struct shmid_ds *shmseg)
170 {
171 	struct uvm_object *uobj = shmseg->_shm_internal;
172 	size_t size = (shmseg->shm_segsz + PGOFSET) & ~PGOFSET;
173 
174 #ifdef SHMDEBUG
175 	printf("shm freeing key 0x%lx seq 0x%x\n",
176 	       shmseg->shm_perm._key, shmseg->shm_perm._seq);
177 #endif
178 
179 	(*uobj->pgops->pgo_detach)(uobj);
180 	shmseg->_shm_internal = NULL;
181 	shm_committed -= btoc(size);
182 	shmseg->shm_perm.mode = SHMSEG_FREE;
183 	shm_nused--;
184 }
185 
186 static void
187 shm_delete_mapping(struct vmspace *vm, struct shmmap_state *shmmap_s,
188     struct shmmap_entry *shmmap_se)
189 {
190 	struct shmid_ds *shmseg;
191 	int segnum;
192 	size_t size;
193 
194 	segnum = IPCID_TO_IX(shmmap_se->shmid);
195 #ifdef DEBUG
196 	if (segnum < 0 || segnum >= shminfo.shmmni)
197 		panic("shm_delete_mapping: vmspace %p state %p entry %p - "
198 		    "entry segment ID bad (%d)",
199 		    vm, shmmap_s, shmmap_se, segnum);
200 #endif
201 	shmseg = &shmsegs[segnum];
202 	size = (shmseg->shm_segsz + PGOFSET) & ~PGOFSET;
203 	uvm_deallocate(&vm->vm_map, shmmap_se->va, size);
204 	SLIST_REMOVE(&shmmap_s->entries, shmmap_se, shmmap_entry, next);
205 	shmmap_s->nitems--;
206 	pool_put(&shmmap_entry_pool, shmmap_se);
207 	shmseg->shm_dtime = time_second;
208 	if ((--shmseg->shm_nattch <= 0) &&
209 	    (shmseg->shm_perm.mode & SHMSEG_REMOVED)) {
210 		shm_deallocate_segment(shmseg);
211 		shm_last_free = segnum;
212 	}
213 }
214 
215 /*
216  * Get a non-shared shm map for that vmspace.
217  * 3 cases:
218  *   - no shm map present: create a fresh one
219  *   - a shm map with refcount=1, just used by ourselves: fine
220  *   - a shared shm map: copy to a fresh one and adjust refcounts
221  */
222 static struct shmmap_state *
223 shmmap_getprivate(struct proc *p)
224 {
225 	struct shmmap_state *oshmmap_s, *shmmap_s;
226 	struct shmmap_entry *oshmmap_se, *shmmap_se;
227 
228 	oshmmap_s = (struct shmmap_state *)p->p_vmspace->vm_shm;
229 	if (oshmmap_s && oshmmap_s->nrefs == 1)
230 		return (oshmmap_s);
231 
232 	shmmap_s = malloc(sizeof(struct shmmap_state), M_SHM, M_WAITOK);
233 	memset(shmmap_s, 0, sizeof(struct shmmap_state));
234 	shmmap_s->nrefs = 1;
235 	SLIST_INIT(&shmmap_s->entries);
236 	p->p_vmspace->vm_shm = (caddr_t)shmmap_s;
237 
238 	if (!oshmmap_s)
239 		return (shmmap_s);
240 
241 #ifdef SHMDEBUG
242 	printf("shmmap_getprivate: vm %p split (%d entries), was used by %d\n",
243 	       p->p_vmspace, oshmmap_s->nitems, oshmmap_s->nrefs);
244 #endif
245 	SLIST_FOREACH(oshmmap_se, &oshmmap_s->entries, next) {
246 		shmmap_se = pool_get(&shmmap_entry_pool, PR_WAITOK);
247 		shmmap_se->va = oshmmap_se->va;
248 		shmmap_se->shmid = oshmmap_se->shmid;
249 		SLIST_INSERT_HEAD(&shmmap_s->entries, shmmap_se, next);
250 	}
251 	shmmap_s->nitems = oshmmap_s->nitems;
252 	oshmmap_s->nrefs--;
253 	return (shmmap_s);
254 }
255 
256 static struct shmmap_entry *
257 shm_find_mapping(struct shmmap_state *map, vaddr_t va)
258 {
259 	struct shmmap_entry *shmmap_se;
260 
261 	SLIST_FOREACH(shmmap_se, &map->entries, next) {
262 		if (shmmap_se->va == va)
263 			return shmmap_se;
264 	}
265 	return 0;
266 }
267 
268 int
269 sys_shmdt(struct lwp *l, void *v, register_t *retval __unused)
270 {
271 	struct sys_shmdt_args /* {
272 		syscallarg(const void *) shmaddr;
273 	} */ *uap = v;
274 	struct proc *p = l->l_proc;
275 	struct shmmap_state *shmmap_s, *shmmap_s1;
276 	struct shmmap_entry *shmmap_se;
277 
278 	shmmap_s = (struct shmmap_state *)p->p_vmspace->vm_shm;
279 	if (shmmap_s == NULL)
280 		return EINVAL;
281 
282 	shmmap_se = shm_find_mapping(shmmap_s, (vaddr_t)SCARG(uap, shmaddr));
283 	if (!shmmap_se)
284 		return EINVAL;
285 
286 	shmmap_s1 = shmmap_getprivate(p);
287 	if (shmmap_s1 != shmmap_s) {
288 		/* map has been copied, lookup entry in new map */
289 		shmmap_se = shm_find_mapping(shmmap_s1,
290 					     (vaddr_t)SCARG(uap, shmaddr));
291 		KASSERT(shmmap_se != NULL);
292 	}
293 #ifdef SHMDEBUG
294 	printf("shmdt: vm %p: remove %d @%lx\n",
295 	       p->p_vmspace, shmmap_se->shmid, shmmap_se->va);
296 #endif
297 	shm_delete_mapping(p->p_vmspace, shmmap_s1, shmmap_se);
298 	return 0;
299 }
300 
301 int
302 sys_shmat(struct lwp *l, void *v, register_t *retval)
303 {
304 	struct sys_shmat_args /* {
305 		syscallarg(int) shmid;
306 		syscallarg(const void *) shmaddr;
307 		syscallarg(int) shmflg;
308 	} */ *uap = v;
309 	int error, flags;
310 	struct proc *p = l->l_proc;
311 	kauth_cred_t cred = l->l_cred;
312 	struct shmid_ds *shmseg;
313 	struct shmmap_state *shmmap_s;
314 	struct uvm_object *uobj;
315 	vaddr_t attach_va;
316 	vm_prot_t prot;
317 	vsize_t size;
318 	struct shmmap_entry *shmmap_se;
319 
320 	shmseg = shm_find_segment_by_shmid(SCARG(uap, shmid));
321 	if (shmseg == NULL)
322 		return EINVAL;
323 	error = ipcperm(cred, &shmseg->shm_perm,
324 		    (SCARG(uap, shmflg) & SHM_RDONLY) ? IPC_R : IPC_R|IPC_W);
325 	if (error)
326 		return error;
327 
328 	shmmap_s = (struct shmmap_state *)p->p_vmspace->vm_shm;
329 	if (shmmap_s && shmmap_s->nitems >= shminfo.shmseg)
330 		return EMFILE;
331 
332 	size = (shmseg->shm_segsz + PGOFSET) & ~PGOFSET;
333 	prot = VM_PROT_READ;
334 	if ((SCARG(uap, shmflg) & SHM_RDONLY) == 0)
335 		prot |= VM_PROT_WRITE;
336 	flags = MAP_ANON | MAP_SHARED;
337 	if (SCARG(uap, shmaddr)) {
338 		flags |= MAP_FIXED;
339 		if (SCARG(uap, shmflg) & SHM_RND)
340 			attach_va =
341 			    (vaddr_t)SCARG(uap, shmaddr) & ~(SHMLBA-1);
342 		else if (((vaddr_t)SCARG(uap, shmaddr) & (SHMLBA-1)) == 0)
343 			attach_va = (vaddr_t)SCARG(uap, shmaddr);
344 		else
345 			return EINVAL;
346 	} else {
347 		/* This is just a hint to uvm_mmap() about where to put it. */
348 		attach_va = p->p_emul->e_vm_default_addr(p,
349 		    (vaddr_t)p->p_vmspace->vm_daddr, size);
350 	}
351 	uobj = shmseg->_shm_internal;
352 	(*uobj->pgops->pgo_reference)(uobj);
353 	error = uvm_map(&p->p_vmspace->vm_map, &attach_va, size,
354 	    uobj, 0, 0,
355 	    UVM_MAPFLAG(prot, prot, UVM_INH_SHARE, UVM_ADV_RANDOM, 0));
356 	if (error) {
357 		(*uobj->pgops->pgo_detach)(uobj);
358 		return error;
359 	}
360 	shmmap_se = pool_get(&shmmap_entry_pool, PR_WAITOK);
361 	shmmap_se->va = attach_va;
362 	shmmap_se->shmid = SCARG(uap, shmid);
363 	shmmap_s = shmmap_getprivate(p);
364 #ifdef SHMDEBUG
365 	printf("shmat: vm %p: add %d @%lx\n", p->p_vmspace, shmmap_se->shmid, attach_va);
366 #endif
367 	SLIST_INSERT_HEAD(&shmmap_s->entries, shmmap_se, next);
368 	shmmap_s->nitems++;
369 	shmseg->shm_lpid = p->p_pid;
370 	shmseg->shm_atime = time_second;
371 	shmseg->shm_nattch++;
372 
373 	retval[0] = attach_va;
374 	return 0;
375 }
376 
377 int
378 sys___shmctl13(struct lwp *l, void *v, register_t *retval __unused)
379 {
380 	struct sys___shmctl13_args /* {
381 		syscallarg(int) shmid;
382 		syscallarg(int) cmd;
383 		syscallarg(struct shmid_ds *) buf;
384 	} */ *uap = v;
385 	struct shmid_ds shmbuf;
386 	int cmd, error;
387 
388 	cmd = SCARG(uap, cmd);
389 
390 	if (cmd == IPC_SET) {
391 		error = copyin(SCARG(uap, buf), &shmbuf, sizeof(shmbuf));
392 		if (error)
393 			return (error);
394 	}
395 
396 	error = shmctl1(l, SCARG(uap, shmid), cmd,
397 	    (cmd == IPC_SET || cmd == IPC_STAT) ? &shmbuf : NULL);
398 
399 	if (error == 0 && cmd == IPC_STAT)
400 		error = copyout(&shmbuf, SCARG(uap, buf), sizeof(shmbuf));
401 
402 	return (error);
403 }
404 
405 int
406 shmctl1(struct lwp *l, int shmid, int cmd, struct shmid_ds *shmbuf)
407 {
408 	kauth_cred_t cred = l->l_cred;
409 	struct shmid_ds *shmseg;
410 	int error = 0;
411 
412 	shmseg = shm_find_segment_by_shmid(shmid);
413 	if (shmseg == NULL)
414 		return EINVAL;
415 	switch (cmd) {
416 	case IPC_STAT:
417 		if ((error = ipcperm(cred, &shmseg->shm_perm, IPC_R)) != 0)
418 			return error;
419 		memcpy(shmbuf, shmseg, sizeof(struct shmid_ds));
420 		break;
421 	case IPC_SET:
422 		if ((error = ipcperm(cred, &shmseg->shm_perm, IPC_M)) != 0)
423 			return error;
424 		shmseg->shm_perm.uid = shmbuf->shm_perm.uid;
425 		shmseg->shm_perm.gid = shmbuf->shm_perm.gid;
426 		shmseg->shm_perm.mode =
427 		    (shmseg->shm_perm.mode & ~ACCESSPERMS) |
428 		    (shmbuf->shm_perm.mode & ACCESSPERMS);
429 		shmseg->shm_ctime = time_second;
430 		break;
431 	case IPC_RMID:
432 		if ((error = ipcperm(cred, &shmseg->shm_perm, IPC_M)) != 0)
433 			return error;
434 		shmseg->shm_perm._key = IPC_PRIVATE;
435 		shmseg->shm_perm.mode |= SHMSEG_REMOVED;
436 		if (shmseg->shm_nattch <= 0) {
437 			shm_deallocate_segment(shmseg);
438 			shm_last_free = IPCID_TO_IX(shmid);
439 		}
440 		break;
441 	case SHM_LOCK:
442 	case SHM_UNLOCK:
443 	default:
444 		return EINVAL;
445 	}
446 	return 0;
447 }
448 
449 static int
450 shmget_existing(struct lwp *l, struct sys_shmget_args *uap, int mode,
451     int segnum, register_t *retval)
452 {
453 	struct shmid_ds *shmseg;
454 	kauth_cred_t cred = l->l_cred;
455 	int error;
456 
457 	shmseg = &shmsegs[segnum];
458 	if (shmseg->shm_perm.mode & SHMSEG_REMOVED) {
459 		/*
460 		 * This segment is in the process of being allocated.  Wait
461 		 * until it's done, and look the key up again (in case the
462 		 * allocation failed or it was freed).
463 		 */
464 		shmseg->shm_perm.mode |= SHMSEG_WANTED;
465 		error = tsleep((caddr_t)shmseg, PLOCK | PCATCH, "shmget", 0);
466 		if (error)
467 			return error;
468 		return EAGAIN;
469 	}
470 	if ((error = ipcperm(cred, &shmseg->shm_perm, mode)) != 0)
471 		return error;
472 	if (SCARG(uap, size) && SCARG(uap, size) > shmseg->shm_segsz)
473 		return EINVAL;
474 	if ((SCARG(uap, shmflg) & (IPC_CREAT | IPC_EXCL)) ==
475 	    (IPC_CREAT | IPC_EXCL))
476 		return EEXIST;
477 	*retval = IXSEQ_TO_IPCID(segnum, shmseg->shm_perm);
478 	return 0;
479 }
480 
481 static int
482 shmget_allocate_segment(struct lwp *l, struct sys_shmget_args *uap, int mode,
483     register_t *retval)
484 {
485 	int i, segnum, shmid, size;
486 	kauth_cred_t cred = l->l_cred;
487 	struct shmid_ds *shmseg;
488 	int error = 0;
489 
490 	if (SCARG(uap, size) < shminfo.shmmin ||
491 	    SCARG(uap, size) > shminfo.shmmax)
492 		return EINVAL;
493 	if (shm_nused >= shminfo.shmmni) /* any shmids left? */
494 		return ENOSPC;
495 	size = (SCARG(uap, size) + PGOFSET) & ~PGOFSET;
496 	if (shm_committed + btoc(size) > shminfo.shmall)
497 		return ENOMEM;
498 	if (shm_last_free < 0) {
499 		for (i = 0; i < shminfo.shmmni; i++)
500 			if (shmsegs[i].shm_perm.mode & SHMSEG_FREE)
501 				break;
502 		if (i == shminfo.shmmni)
503 			panic("shmseg free count inconsistent");
504 		segnum = i;
505 	} else  {
506 		segnum = shm_last_free;
507 		shm_last_free = -1;
508 	}
509 	shmseg = &shmsegs[segnum];
510 	/*
511 	 * In case we sleep in malloc(), mark the segment present but deleted
512 	 * so that noone else tries to create the same key.
513 	 */
514 	shmseg->shm_perm.mode = SHMSEG_ALLOCATED | SHMSEG_REMOVED;
515 	shmseg->shm_perm._key = SCARG(uap, key);
516 	shmseg->shm_perm._seq = (shmseg->shm_perm._seq + 1) & 0x7fff;
517 	shmid = IXSEQ_TO_IPCID(segnum, shmseg->shm_perm);
518 
519 	shmseg->_shm_internal = uao_create(size, 0);
520 
521 	shmseg->shm_perm.cuid = shmseg->shm_perm.uid = kauth_cred_geteuid(cred);
522 	shmseg->shm_perm.cgid = shmseg->shm_perm.gid = kauth_cred_getegid(cred);
523 	shmseg->shm_perm.mode = (shmseg->shm_perm.mode & SHMSEG_WANTED) |
524 	    (mode & (ACCESSPERMS|SHMSEG_RMLINGER)) | SHMSEG_ALLOCATED;
525 	shmseg->shm_segsz = SCARG(uap, size);
526 	shmseg->shm_cpid = l->l_proc->p_pid;
527 	shmseg->shm_lpid = shmseg->shm_nattch = 0;
528 	shmseg->shm_atime = shmseg->shm_dtime = 0;
529 	shmseg->shm_ctime = time_second;
530 	shm_committed += btoc(size);
531 	shm_nused++;
532 
533 	*retval = shmid;
534 	if (shmseg->shm_perm.mode & SHMSEG_WANTED) {
535 		/*
536 		 * Somebody else wanted this key while we were asleep.  Wake
537 		 * them up now.
538 		 */
539 		shmseg->shm_perm.mode &= ~SHMSEG_WANTED;
540 		wakeup((caddr_t)shmseg);
541 	}
542 	return error;
543 }
544 
545 int
546 sys_shmget(struct lwp *l, void *v, register_t *retval)
547 {
548 	struct sys_shmget_args /* {
549 		syscallarg(key_t) key;
550 		syscallarg(int) size;
551 		syscallarg(int) shmflg;
552 	} */ *uap = v;
553 	int segnum, mode, error;
554 
555 	mode = SCARG(uap, shmflg) & ACCESSPERMS;
556 	if (SCARG(uap, shmflg) & _SHM_RMLINGER)
557 		mode |= SHMSEG_RMLINGER;
558 
559 #ifdef SHMDEBUG
560 	printf("shmget: key 0x%lx size 0x%x shmflg 0x%x mode 0x%x\n",
561         	SCARG(uap, key), SCARG(uap, size), SCARG(uap, shmflg), mode);
562 #endif
563 
564 	if (SCARG(uap, key) != IPC_PRIVATE) {
565 again:
566 		segnum = shm_find_segment_by_key(SCARG(uap, key));
567 		if (segnum >= 0) {
568 			error = shmget_existing(l, uap, mode, segnum, retval);
569 			if (error == EAGAIN)
570 				goto again;
571 			return error;
572 		}
573 		if ((SCARG(uap, shmflg) & IPC_CREAT) == 0)
574 			return ENOENT;
575 	}
576 	return shmget_allocate_segment(l, uap, mode, retval);
577 }
578 
579 void
580 shmfork(struct vmspace *vm1, struct vmspace *vm2)
581 {
582 	struct shmmap_state *shmmap_s;
583 	struct shmmap_entry *shmmap_se;
584 
585 	vm2->vm_shm = vm1->vm_shm;
586 
587 	if (vm1->vm_shm == NULL)
588 		return;
589 
590 #ifdef SHMDEBUG
591 	printf("shmfork %p->%p\n", vm1, vm2);
592 #endif
593 
594 	shmmap_s = (struct shmmap_state *)vm1->vm_shm;
595 
596 	SLIST_FOREACH(shmmap_se, &shmmap_s->entries, next)
597 		shmsegs[IPCID_TO_IX(shmmap_se->shmid)].shm_nattch++;
598 	shmmap_s->nrefs++;
599 }
600 
601 void
602 shmexit(struct vmspace *vm)
603 {
604 	struct shmmap_state *shmmap_s;
605 	struct shmmap_entry *shmmap_se;
606 
607 	shmmap_s = (struct shmmap_state *)vm->vm_shm;
608 	if (shmmap_s == NULL)
609 		return;
610 
611 	vm->vm_shm = NULL;
612 
613 	if (--shmmap_s->nrefs > 0) {
614 #ifdef SHMDEBUG
615 		printf("shmexit: vm %p drop ref (%d entries), now used by %d\n",
616 		       vm, shmmap_s->nitems, shmmap_s->nrefs);
617 #endif
618 		SLIST_FOREACH(shmmap_se, &shmmap_s->entries, next)
619 			shmsegs[IPCID_TO_IX(shmmap_se->shmid)].shm_nattch--;
620 		return;
621 	}
622 
623 #ifdef SHMDEBUG
624 	printf("shmexit: vm %p cleanup (%d entries)\n", vm, shmmap_s->nitems);
625 #endif
626 	while (!SLIST_EMPTY(&shmmap_s->entries)) {
627 		shmmap_se = SLIST_FIRST(&shmmap_s->entries);
628 		shm_delete_mapping(vm, shmmap_s, shmmap_se);
629 	}
630 	KASSERT(shmmap_s->nitems == 0);
631 	free(shmmap_s, M_SHM);
632 }
633 
634 void
635 shminit(void)
636 {
637 	int i, sz;
638 	vaddr_t v;
639 
640 	/* Allocate pageable memory for our structures */
641 	sz = shminfo.shmmni * sizeof(struct shmid_ds);
642 	v = uvm_km_alloc(kernel_map, round_page(sz), 0, UVM_KMF_WIRED);
643 	if (v == 0)
644 		panic("sysv_shm: cannot allocate memory");
645 	shmsegs = (void *)v;
646 
647 	shminfo.shmmax *= PAGE_SIZE;
648 
649 	for (i = 0; i < shminfo.shmmni; i++) {
650 		shmsegs[i].shm_perm.mode = SHMSEG_FREE;
651 		shmsegs[i].shm_perm._seq = 0;
652 	}
653 	shm_last_free = 0;
654 	shm_nused = 0;
655 	shm_committed = 0;
656 }
657