The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/kern/uipc_shm.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2006, 2011 Robert N. M. Watson
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   24  * SUCH DAMAGE.
   25  */
   26 
   27 /*
   28  * Support for shared swap-backed anonymous memory objects via
   29  * shm_open(2) and shm_unlink(2).  While most of the implementation is
   30  * here, vm_mmap.c contains mapping logic changes.
   31  *
   32  * TODO:
   33  *
   34  * (1) Need to export data to a userland tool via a sysctl.  Should ipcs(1)
   35  *     and ipcrm(1) be expanded or should new tools to manage both POSIX
   36  *     kernel semaphores and POSIX shared memory be written?
   37  *
   38  * (2) Add support for this file type to fstat(1).
   39  *
   40  * (3) Resource limits?  Does this need its own resource limits or are the
   41  *     existing limits in mmap(2) sufficient?
   42  */
   43 
   44 #include <sys/cdefs.h>
   45 __FBSDID("$FreeBSD: releng/9.2/sys/kern/uipc_shm.c 249953 2013-04-26 21:07:27Z jilles $");
   46 
   47 #include "opt_capsicum.h"
   48 
   49 #include <sys/param.h>
   50 #include <sys/capability.h>
   51 #include <sys/fcntl.h>
   52 #include <sys/file.h>
   53 #include <sys/filedesc.h>
   54 #include <sys/fnv_hash.h>
   55 #include <sys/kernel.h>
   56 #include <sys/lock.h>
   57 #include <sys/malloc.h>
   58 #include <sys/mman.h>
   59 #include <sys/mutex.h>
   60 #include <sys/priv.h>
   61 #include <sys/proc.h>
   62 #include <sys/refcount.h>
   63 #include <sys/resourcevar.h>
   64 #include <sys/stat.h>
   65 #include <sys/sysctl.h>
   66 #include <sys/sysproto.h>
   67 #include <sys/systm.h>
   68 #include <sys/sx.h>
   69 #include <sys/time.h>
   70 #include <sys/vnode.h>
   71 
   72 #include <security/mac/mac_framework.h>
   73 
   74 #include <vm/vm.h>
   75 #include <vm/vm_param.h>
   76 #include <vm/pmap.h>
   77 #include <vm/vm_extern.h>
   78 #include <vm/vm_map.h>
   79 #include <vm/vm_kern.h>
   80 #include <vm/vm_object.h>
   81 #include <vm/vm_page.h>
   82 #include <vm/vm_pageout.h>
   83 #include <vm/vm_pager.h>
   84 #include <vm/swap_pager.h>
   85 
   86 struct shm_mapping {
   87         char            *sm_path;
   88         Fnv32_t         sm_fnv;
   89         struct shmfd    *sm_shmfd;
   90         LIST_ENTRY(shm_mapping) sm_link;
   91 };
   92 
   93 static MALLOC_DEFINE(M_SHMFD, "shmfd", "shared memory file descriptor");
   94 static LIST_HEAD(, shm_mapping) *shm_dictionary;
   95 static struct sx shm_dict_lock;
   96 static struct mtx shm_timestamp_lock;
   97 static u_long shm_hash;
   98 
   99 #define SHM_HASH(fnv)   (&shm_dictionary[(fnv) & shm_hash])
  100 
  101 static int      shm_access(struct shmfd *shmfd, struct ucred *ucred, int flags);
  102 static struct shmfd *shm_alloc(struct ucred *ucred, mode_t mode);
  103 static void     shm_dict_init(void *arg);
  104 static void     shm_drop(struct shmfd *shmfd);
  105 static struct shmfd *shm_hold(struct shmfd *shmfd);
  106 static void     shm_insert(char *path, Fnv32_t fnv, struct shmfd *shmfd);
  107 static struct shmfd *shm_lookup(char *path, Fnv32_t fnv);
  108 static int      shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred);
  109 static int      shm_dotruncate(struct shmfd *shmfd, off_t length);
  110 
  111 static fo_rdwr_t        shm_read;
  112 static fo_rdwr_t        shm_write;
  113 static fo_truncate_t    shm_truncate;
  114 static fo_ioctl_t       shm_ioctl;
  115 static fo_poll_t        shm_poll;
  116 static fo_kqfilter_t    shm_kqfilter;
  117 static fo_stat_t        shm_stat;
  118 static fo_close_t       shm_close;
  119 static fo_chmod_t       shm_chmod;
  120 static fo_chown_t       shm_chown;
  121 
  122 /* File descriptor operations. */
  123 static struct fileops shm_ops = {
  124         .fo_read = shm_read,
  125         .fo_write = shm_write,
  126         .fo_truncate = shm_truncate,
  127         .fo_ioctl = shm_ioctl,
  128         .fo_poll = shm_poll,
  129         .fo_kqfilter = shm_kqfilter,
  130         .fo_stat = shm_stat,
  131         .fo_close = shm_close,
  132         .fo_chmod = shm_chmod,
  133         .fo_chown = shm_chown,
  134         .fo_flags = DFLAG_PASSABLE
  135 };
  136 
  137 FEATURE(posix_shm, "POSIX shared memory");
  138 
  139 static int
  140 shm_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
  141     int flags, struct thread *td)
  142 {
  143 
  144         return (EOPNOTSUPP);
  145 }
  146 
  147 static int
  148 shm_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
  149     int flags, struct thread *td)
  150 {
  151 
  152         return (EOPNOTSUPP);
  153 }
  154 
  155 static int
  156 shm_truncate(struct file *fp, off_t length, struct ucred *active_cred,
  157     struct thread *td)
  158 {
  159         struct shmfd *shmfd;
  160 #ifdef MAC
  161         int error;
  162 #endif
  163 
  164         shmfd = fp->f_data;
  165 #ifdef MAC
  166         error = mac_posixshm_check_truncate(active_cred, fp->f_cred, shmfd);
  167         if (error)
  168                 return (error);
  169 #endif
  170         return (shm_dotruncate(shmfd, length));
  171 }
  172 
  173 static int
  174 shm_ioctl(struct file *fp, u_long com, void *data,
  175     struct ucred *active_cred, struct thread *td)
  176 {
  177 
  178         return (EOPNOTSUPP);
  179 }
  180 
  181 static int
  182 shm_poll(struct file *fp, int events, struct ucred *active_cred,
  183     struct thread *td)
  184 {
  185 
  186         return (EOPNOTSUPP);
  187 }
  188 
  189 static int
  190 shm_kqfilter(struct file *fp, struct knote *kn)
  191 {
  192 
  193         return (EOPNOTSUPP);
  194 }
  195 
  196 static int
  197 shm_stat(struct file *fp, struct stat *sb, struct ucred *active_cred,
  198     struct thread *td)
  199 {
  200         struct shmfd *shmfd;
  201 #ifdef MAC
  202         int error;
  203 #endif
  204 
  205         shmfd = fp->f_data;
  206 
  207 #ifdef MAC
  208         error = mac_posixshm_check_stat(active_cred, fp->f_cred, shmfd);
  209         if (error)
  210                 return (error);
  211 #endif
  212         
  213         /*
  214          * Attempt to return sanish values for fstat() on a memory file
  215          * descriptor.
  216          */
  217         bzero(sb, sizeof(*sb));
  218         sb->st_blksize = PAGE_SIZE;
  219         sb->st_size = shmfd->shm_size;
  220         sb->st_blocks = (sb->st_size + sb->st_blksize - 1) / sb->st_blksize;
  221         mtx_lock(&shm_timestamp_lock);
  222         sb->st_atim = shmfd->shm_atime;
  223         sb->st_ctim = shmfd->shm_ctime;
  224         sb->st_mtim = shmfd->shm_mtime;
  225         sb->st_birthtim = shmfd->shm_birthtime;
  226         sb->st_mode = S_IFREG | shmfd->shm_mode;                /* XXX */
  227         sb->st_uid = shmfd->shm_uid;
  228         sb->st_gid = shmfd->shm_gid;
  229         mtx_unlock(&shm_timestamp_lock);
  230 
  231         return (0);
  232 }
  233 
  234 static int
  235 shm_close(struct file *fp, struct thread *td)
  236 {
  237         struct shmfd *shmfd;
  238 
  239         shmfd = fp->f_data;
  240         fp->f_data = NULL;
  241         shm_drop(shmfd);
  242 
  243         return (0);
  244 }
  245 
  246 static int
  247 shm_dotruncate(struct shmfd *shmfd, off_t length)
  248 {
  249         vm_object_t object;
  250         vm_page_t m, ma[1];
  251         vm_pindex_t idx, nobjsize;
  252         vm_ooffset_t delta;
  253         int base, rv;
  254 
  255         object = shmfd->shm_object;
  256         VM_OBJECT_LOCK(object);
  257         if (length == shmfd->shm_size) {
  258                 VM_OBJECT_UNLOCK(object);
  259                 return (0);
  260         }
  261         nobjsize = OFF_TO_IDX(length + PAGE_MASK);
  262 
  263         /* Are we shrinking?  If so, trim the end. */
  264         if (length < shmfd->shm_size) {
  265                 /*
  266                  * Disallow any requests to shrink the size if this
  267                  * object is mapped into the kernel.
  268                  */
  269                 if (shmfd->shm_kmappings > 0) {
  270                         VM_OBJECT_UNLOCK(object);
  271                         return (EBUSY);
  272                 }
  273 
  274                 /*
  275                  * Zero the truncated part of the last page.
  276                  */
  277                 base = length & PAGE_MASK;
  278                 if (base != 0) {
  279                         idx = OFF_TO_IDX(length);
  280 retry:
  281                         m = vm_page_lookup(object, idx);
  282                         if (m != NULL) {
  283                                 if ((m->oflags & VPO_BUSY) != 0 ||
  284                                     m->busy != 0) {
  285                                         vm_page_sleep(m, "shmtrc");
  286                                         goto retry;
  287                                 }
  288                         } else if (vm_pager_has_page(object, idx, NULL, NULL)) {
  289                                 m = vm_page_alloc(object, idx, VM_ALLOC_NORMAL);
  290                                 if (m == NULL) {
  291                                         VM_OBJECT_UNLOCK(object);
  292                                         VM_WAIT;
  293                                         VM_OBJECT_LOCK(object);
  294                                         goto retry;
  295                                 } else if (m->valid != VM_PAGE_BITS_ALL) {
  296                                         ma[0] = m;
  297                                         rv = vm_pager_get_pages(object, ma, 1,
  298                                             0);
  299                                         m = vm_page_lookup(object, idx);
  300                                 } else
  301                                         /* A cached page was reactivated. */
  302                                         rv = VM_PAGER_OK;
  303                                 vm_page_lock(m);
  304                                 if (rv == VM_PAGER_OK) {
  305                                         vm_page_deactivate(m);
  306                                         vm_page_unlock(m);
  307                                         vm_page_wakeup(m);
  308                                 } else {
  309                                         vm_page_free(m);
  310                                         vm_page_unlock(m);
  311                                         VM_OBJECT_UNLOCK(object);
  312                                         return (EIO);
  313                                 }
  314                         }
  315                         if (m != NULL) {
  316                                 pmap_zero_page_area(m, base, PAGE_SIZE - base);
  317                                 KASSERT(m->valid == VM_PAGE_BITS_ALL,
  318                                     ("shm_dotruncate: page %p is invalid", m));
  319                                 vm_page_dirty(m);
  320                                 vm_pager_page_unswapped(m);
  321                         }
  322                 }
  323                 delta = ptoa(object->size - nobjsize);
  324 
  325                 /* Toss in memory pages. */
  326                 if (nobjsize < object->size)
  327                         vm_object_page_remove(object, nobjsize, object->size,
  328                             0);
  329 
  330                 /* Toss pages from swap. */
  331                 if (object->type == OBJT_SWAP)
  332                         swap_pager_freespace(object, nobjsize, delta);
  333 
  334                 /* Free the swap accounted for shm */
  335                 swap_release_by_cred(delta, object->cred);
  336                 object->charge -= delta;
  337         } else {
  338                 /* Attempt to reserve the swap */
  339                 delta = ptoa(nobjsize - object->size);
  340                 if (!swap_reserve_by_cred(delta, object->cred)) {
  341                         VM_OBJECT_UNLOCK(object);
  342                         return (ENOMEM);
  343                 }
  344                 object->charge += delta;
  345         }
  346         shmfd->shm_size = length;
  347         mtx_lock(&shm_timestamp_lock);
  348         vfs_timestamp(&shmfd->shm_ctime);
  349         shmfd->shm_mtime = shmfd->shm_ctime;
  350         mtx_unlock(&shm_timestamp_lock);
  351         object->size = nobjsize;
  352         VM_OBJECT_UNLOCK(object);
  353         return (0);
  354 }
  355 
  356 /*
  357  * shmfd object management including creation and reference counting
  358  * routines.
  359  */
  360 static struct shmfd *
  361 shm_alloc(struct ucred *ucred, mode_t mode)
  362 {
  363         struct shmfd *shmfd;
  364 
  365         shmfd = malloc(sizeof(*shmfd), M_SHMFD, M_WAITOK | M_ZERO);
  366         shmfd->shm_size = 0;
  367         shmfd->shm_uid = ucred->cr_uid;
  368         shmfd->shm_gid = ucred->cr_gid;
  369         shmfd->shm_mode = mode;
  370         shmfd->shm_object = vm_pager_allocate(OBJT_DEFAULT, NULL,
  371             shmfd->shm_size, VM_PROT_DEFAULT, 0, ucred);
  372         KASSERT(shmfd->shm_object != NULL, ("shm_create: vm_pager_allocate"));
  373         VM_OBJECT_LOCK(shmfd->shm_object);
  374         vm_object_clear_flag(shmfd->shm_object, OBJ_ONEMAPPING);
  375         vm_object_set_flag(shmfd->shm_object, OBJ_NOSPLIT);
  376         VM_OBJECT_UNLOCK(shmfd->shm_object);
  377         vfs_timestamp(&shmfd->shm_birthtime);
  378         shmfd->shm_atime = shmfd->shm_mtime = shmfd->shm_ctime =
  379             shmfd->shm_birthtime;
  380         refcount_init(&shmfd->shm_refs, 1);
  381 #ifdef MAC
  382         mac_posixshm_init(shmfd);
  383         mac_posixshm_create(ucred, shmfd);
  384 #endif
  385 
  386         return (shmfd);
  387 }
  388 
  389 static struct shmfd *
  390 shm_hold(struct shmfd *shmfd)
  391 {
  392 
  393         refcount_acquire(&shmfd->shm_refs);
  394         return (shmfd);
  395 }
  396 
  397 static void
  398 shm_drop(struct shmfd *shmfd)
  399 {
  400 
  401         if (refcount_release(&shmfd->shm_refs)) {
  402 #ifdef MAC
  403                 mac_posixshm_destroy(shmfd);
  404 #endif
  405                 vm_object_deallocate(shmfd->shm_object);
  406                 free(shmfd, M_SHMFD);
  407         }
  408 }
  409 
  410 /*
  411  * Determine if the credentials have sufficient permissions for a
  412  * specified combination of FREAD and FWRITE.
  413  */
  414 static int
  415 shm_access(struct shmfd *shmfd, struct ucred *ucred, int flags)
  416 {
  417         accmode_t accmode;
  418         int error;
  419 
  420         accmode = 0;
  421         if (flags & FREAD)
  422                 accmode |= VREAD;
  423         if (flags & FWRITE)
  424                 accmode |= VWRITE;
  425         mtx_lock(&shm_timestamp_lock);
  426         error = vaccess(VREG, shmfd->shm_mode, shmfd->shm_uid, shmfd->shm_gid,
  427             accmode, ucred, NULL);
  428         mtx_unlock(&shm_timestamp_lock);
  429         return (error);
  430 }
  431 
  432 /*
  433  * Dictionary management.  We maintain an in-kernel dictionary to map
  434  * paths to shmfd objects.  We use the FNV hash on the path to store
  435  * the mappings in a hash table.
  436  */
  437 static void
  438 shm_dict_init(void *arg)
  439 {
  440 
  441         mtx_init(&shm_timestamp_lock, "shm timestamps", NULL, MTX_DEF);
  442         sx_init(&shm_dict_lock, "shm dictionary");
  443         shm_dictionary = hashinit(1024, M_SHMFD, &shm_hash);
  444 }
  445 SYSINIT(shm_dict_init, SI_SUB_SYSV_SHM, SI_ORDER_ANY, shm_dict_init, NULL);
  446 
  447 static struct shmfd *
  448 shm_lookup(char *path, Fnv32_t fnv)
  449 {
  450         struct shm_mapping *map;
  451 
  452         LIST_FOREACH(map, SHM_HASH(fnv), sm_link) {
  453                 if (map->sm_fnv != fnv)
  454                         continue;
  455                 if (strcmp(map->sm_path, path) == 0)
  456                         return (map->sm_shmfd);
  457         }
  458 
  459         return (NULL);
  460 }
  461 
  462 static void
  463 shm_insert(char *path, Fnv32_t fnv, struct shmfd *shmfd)
  464 {
  465         struct shm_mapping *map;
  466 
  467         map = malloc(sizeof(struct shm_mapping), M_SHMFD, M_WAITOK);
  468         map->sm_path = path;
  469         map->sm_fnv = fnv;
  470         map->sm_shmfd = shm_hold(shmfd);
  471         shmfd->shm_path = path;
  472         LIST_INSERT_HEAD(SHM_HASH(fnv), map, sm_link);
  473 }
  474 
  475 static int
  476 shm_remove(char *path, Fnv32_t fnv, struct ucred *ucred)
  477 {
  478         struct shm_mapping *map;
  479         int error;
  480 
  481         LIST_FOREACH(map, SHM_HASH(fnv), sm_link) {
  482                 if (map->sm_fnv != fnv)
  483                         continue;
  484                 if (strcmp(map->sm_path, path) == 0) {
  485 #ifdef MAC
  486                         error = mac_posixshm_check_unlink(ucred, map->sm_shmfd);
  487                         if (error)
  488                                 return (error);
  489 #endif
  490                         error = shm_access(map->sm_shmfd, ucred,
  491                             FREAD | FWRITE);
  492                         if (error)
  493                                 return (error);
  494                         map->sm_shmfd->shm_path = NULL;
  495                         LIST_REMOVE(map, sm_link);
  496                         shm_drop(map->sm_shmfd);
  497                         free(map->sm_path, M_SHMFD);
  498                         free(map, M_SHMFD);
  499                         return (0);
  500                 }
  501         }
  502 
  503         return (ENOENT);
  504 }
  505 
  506 /* System calls. */
  507 int
  508 sys_shm_open(struct thread *td, struct shm_open_args *uap)
  509 {
  510         struct filedesc *fdp;
  511         struct shmfd *shmfd;
  512         struct file *fp;
  513         char *path;
  514         Fnv32_t fnv;
  515         mode_t cmode;
  516         int fd, error;
  517 
  518 #ifdef CAPABILITY_MODE
  519         /*
  520          * shm_open(2) is only allowed for anonymous objects.
  521          */
  522         if (IN_CAPABILITY_MODE(td) && (uap->path != SHM_ANON))
  523                 return (ECAPMODE);
  524 #endif
  525 
  526         if ((uap->flags & O_ACCMODE) != O_RDONLY &&
  527             (uap->flags & O_ACCMODE) != O_RDWR)
  528                 return (EINVAL);
  529 
  530         if ((uap->flags & ~(O_ACCMODE | O_CREAT | O_EXCL | O_TRUNC)) != 0)
  531                 return (EINVAL);
  532 
  533         fdp = td->td_proc->p_fd;
  534         cmode = (uap->mode & ~fdp->fd_cmask) & ACCESSPERMS;
  535 
  536         error = falloc(td, &fp, &fd, O_CLOEXEC);
  537         if (error)
  538                 return (error);
  539 
  540         /* A SHM_ANON path pointer creates an anonymous object. */
  541         if (uap->path == SHM_ANON) {
  542                 /* A read-only anonymous object is pointless. */
  543                 if ((uap->flags & O_ACCMODE) == O_RDONLY) {
  544                         fdclose(fdp, fp, fd, td);
  545                         fdrop(fp, td);
  546                         return (EINVAL);
  547                 }
  548                 shmfd = shm_alloc(td->td_ucred, cmode);
  549         } else {
  550                 path = malloc(MAXPATHLEN, M_SHMFD, M_WAITOK);
  551                 error = copyinstr(uap->path, path, MAXPATHLEN, NULL);
  552 
  553                 /* Require paths to start with a '/' character. */
  554                 if (error == 0 && path[0] != '/')
  555                         error = EINVAL;
  556                 if (error) {
  557                         fdclose(fdp, fp, fd, td);
  558                         fdrop(fp, td);
  559                         free(path, M_SHMFD);
  560                         return (error);
  561                 }
  562 
  563                 fnv = fnv_32_str(path, FNV1_32_INIT);
  564                 sx_xlock(&shm_dict_lock);
  565                 shmfd = shm_lookup(path, fnv);
  566                 if (shmfd == NULL) {
  567                         /* Object does not yet exist, create it if requested. */
  568                         if (uap->flags & O_CREAT) {
  569 #ifdef MAC
  570                                 error = mac_posixshm_check_create(td->td_ucred,
  571                                     path);
  572                                 if (error == 0) {
  573 #endif
  574                                         shmfd = shm_alloc(td->td_ucred, cmode);
  575                                         shm_insert(path, fnv, shmfd);
  576 #ifdef MAC
  577                                 }
  578 #endif
  579                         } else {
  580                                 free(path, M_SHMFD);
  581                                 error = ENOENT;
  582                         }
  583                 } else {
  584                         /*
  585                          * Object already exists, obtain a new
  586                          * reference if requested and permitted.
  587                          */
  588                         free(path, M_SHMFD);
  589                         if ((uap->flags & (O_CREAT | O_EXCL)) ==
  590                             (O_CREAT | O_EXCL))
  591                                 error = EEXIST;
  592                         else {
  593 #ifdef MAC
  594                                 error = mac_posixshm_check_open(td->td_ucred,
  595                                     shmfd, FFLAGS(uap->flags & O_ACCMODE));
  596                                 if (error == 0)
  597 #endif
  598                                 error = shm_access(shmfd, td->td_ucred,
  599                                     FFLAGS(uap->flags & O_ACCMODE));
  600                         }
  601 
  602                         /*
  603                          * Truncate the file back to zero length if
  604                          * O_TRUNC was specified and the object was
  605                          * opened with read/write.
  606                          */
  607                         if (error == 0 &&
  608                             (uap->flags & (O_ACCMODE | O_TRUNC)) ==
  609                             (O_RDWR | O_TRUNC)) {
  610 #ifdef MAC
  611                                 error = mac_posixshm_check_truncate(
  612                                         td->td_ucred, fp->f_cred, shmfd);
  613                                 if (error == 0)
  614 #endif
  615                                         shm_dotruncate(shmfd, 0);
  616                         }
  617                         if (error == 0)
  618                                 shm_hold(shmfd);
  619                 }
  620                 sx_xunlock(&shm_dict_lock);
  621 
  622                 if (error) {
  623                         fdclose(fdp, fp, fd, td);
  624                         fdrop(fp, td);
  625                         return (error);
  626                 }
  627         }
  628 
  629         finit(fp, FFLAGS(uap->flags & O_ACCMODE), DTYPE_SHM, shmfd, &shm_ops);
  630 
  631         td->td_retval[0] = fd;
  632         fdrop(fp, td);
  633 
  634         return (0);
  635 }
  636 
  637 int
  638 sys_shm_unlink(struct thread *td, struct shm_unlink_args *uap)
  639 {
  640         char *path;
  641         Fnv32_t fnv;
  642         int error;
  643 
  644         path = malloc(MAXPATHLEN, M_TEMP, M_WAITOK);
  645         error = copyinstr(uap->path, path, MAXPATHLEN, NULL);
  646         if (error) {
  647                 free(path, M_TEMP);
  648                 return (error);
  649         }
  650 
  651         fnv = fnv_32_str(path, FNV1_32_INIT);
  652         sx_xlock(&shm_dict_lock);
  653         error = shm_remove(path, fnv, td->td_ucred);
  654         sx_xunlock(&shm_dict_lock);
  655         free(path, M_TEMP);
  656 
  657         return (error);
  658 }
  659 
  660 /*
  661  * mmap() helper to validate mmap() requests against shm object state
  662  * and give mmap() the vm_object to use for the mapping.
  663  */
  664 int
  665 shm_mmap(struct shmfd *shmfd, vm_size_t objsize, vm_ooffset_t foff,
  666     vm_object_t *obj)
  667 {
  668 
  669         /*
  670          * XXXRW: This validation is probably insufficient, and subject to
  671          * sign errors.  It should be fixed.
  672          */
  673         if (foff >= shmfd->shm_size ||
  674             foff + objsize > round_page(shmfd->shm_size))
  675                 return (EINVAL);
  676 
  677         mtx_lock(&shm_timestamp_lock);
  678         vfs_timestamp(&shmfd->shm_atime);
  679         mtx_unlock(&shm_timestamp_lock);
  680         vm_object_reference(shmfd->shm_object);
  681         *obj = shmfd->shm_object;
  682         return (0);
  683 }
  684 
  685 static int
  686 shm_chmod(struct file *fp, mode_t mode, struct ucred *active_cred,
  687     struct thread *td)
  688 {
  689         struct shmfd *shmfd;
  690         int error;
  691 
  692         error = 0;
  693         shmfd = fp->f_data;
  694         mtx_lock(&shm_timestamp_lock);
  695         /*
  696          * SUSv4 says that x bits of permission need not be affected.
  697          * Be consistent with our shm_open there.
  698          */
  699 #ifdef MAC
  700         error = mac_posixshm_check_setmode(active_cred, shmfd, mode);
  701         if (error != 0)
  702                 goto out;
  703 #endif
  704         error = vaccess(VREG, shmfd->shm_mode, shmfd->shm_uid,
  705             shmfd->shm_gid, VADMIN, active_cred, NULL);
  706         if (error != 0)
  707                 goto out;
  708         shmfd->shm_mode = mode & ACCESSPERMS;
  709 out:
  710         mtx_unlock(&shm_timestamp_lock);
  711         return (error);
  712 }
  713 
  714 static int
  715 shm_chown(struct file *fp, uid_t uid, gid_t gid, struct ucred *active_cred,
  716     struct thread *td)
  717 {
  718         struct shmfd *shmfd;
  719         int error;
  720 
  721         error = 0;
  722         shmfd = fp->f_data;
  723         mtx_lock(&shm_timestamp_lock);
  724 #ifdef MAC
  725         error = mac_posixshm_check_setowner(active_cred, shmfd, uid, gid);
  726         if (error != 0)
  727                 goto out;
  728 #endif
  729         if (uid == (uid_t)-1)
  730                 uid = shmfd->shm_uid;
  731         if (gid == (gid_t)-1)
  732                  gid = shmfd->shm_gid;
  733         if (((uid != shmfd->shm_uid && uid != active_cred->cr_uid) ||
  734             (gid != shmfd->shm_gid && !groupmember(gid, active_cred))) &&
  735             (error = priv_check_cred(active_cred, PRIV_VFS_CHOWN, 0)))
  736                 goto out;
  737         shmfd->shm_uid = uid;
  738         shmfd->shm_gid = gid;
  739 out:
  740         mtx_unlock(&shm_timestamp_lock);
  741         return (error);
  742 }
  743 
  744 /*
  745  * Helper routines to allow the backing object of a shared memory file
  746  * descriptor to be mapped in the kernel.
  747  */
  748 int
  749 shm_map(struct file *fp, size_t size, off_t offset, void **memp)
  750 {
  751         struct shmfd *shmfd;
  752         vm_offset_t kva, ofs;
  753         vm_object_t obj;
  754         int rv;
  755 
  756         if (fp->f_type != DTYPE_SHM)
  757                 return (EINVAL);
  758         shmfd = fp->f_data;
  759         obj = shmfd->shm_object;
  760         VM_OBJECT_LOCK(obj);
  761         /*
  762          * XXXRW: This validation is probably insufficient, and subject to
  763          * sign errors.  It should be fixed.
  764          */
  765         if (offset >= shmfd->shm_size ||
  766             offset + size > round_page(shmfd->shm_size)) {
  767                 VM_OBJECT_UNLOCK(obj);
  768                 return (EINVAL);
  769         }
  770 
  771         shmfd->shm_kmappings++;
  772         vm_object_reference_locked(obj);
  773         VM_OBJECT_UNLOCK(obj);
  774 
  775         /* Map the object into the kernel_map and wire it. */
  776         kva = vm_map_min(kernel_map);
  777         ofs = offset & PAGE_MASK;
  778         offset = trunc_page(offset);
  779         size = round_page(size + ofs);
  780         rv = vm_map_find(kernel_map, obj, offset, &kva, size,
  781             VMFS_ALIGNED_SPACE, VM_PROT_READ | VM_PROT_WRITE,
  782             VM_PROT_READ | VM_PROT_WRITE, 0);
  783         if (rv == KERN_SUCCESS) {
  784                 rv = vm_map_wire(kernel_map, kva, kva + size,
  785                     VM_MAP_WIRE_SYSTEM | VM_MAP_WIRE_NOHOLES);
  786                 if (rv == KERN_SUCCESS) {
  787                         *memp = (void *)(kva + ofs);
  788                         return (0);
  789                 }
  790                 vm_map_remove(kernel_map, kva, kva + size);
  791         } else
  792                 vm_object_deallocate(obj);
  793 
  794         /* On failure, drop our mapping reference. */
  795         VM_OBJECT_LOCK(obj);
  796         shmfd->shm_kmappings--;
  797         VM_OBJECT_UNLOCK(obj);
  798 
  799         return (vm_mmap_to_errno(rv));
  800 }
  801 
  802 /*
  803  * We require the caller to unmap the entire entry.  This allows us to
  804  * safely decrement shm_kmappings when a mapping is removed.
  805  */
  806 int
  807 shm_unmap(struct file *fp, void *mem, size_t size)
  808 {
  809         struct shmfd *shmfd;
  810         vm_map_entry_t entry;
  811         vm_offset_t kva, ofs;
  812         vm_object_t obj;
  813         vm_pindex_t pindex;
  814         vm_prot_t prot;
  815         boolean_t wired;
  816         vm_map_t map;
  817         int rv;
  818 
  819         if (fp->f_type != DTYPE_SHM)
  820                 return (EINVAL);
  821         shmfd = fp->f_data;
  822         kva = (vm_offset_t)mem;
  823         ofs = kva & PAGE_MASK;
  824         kva = trunc_page(kva);
  825         size = round_page(size + ofs);
  826         map = kernel_map;
  827         rv = vm_map_lookup(&map, kva, VM_PROT_READ | VM_PROT_WRITE, &entry,
  828             &obj, &pindex, &prot, &wired);
  829         if (rv != KERN_SUCCESS)
  830                 return (EINVAL);
  831         if (entry->start != kva || entry->end != kva + size) {
  832                 vm_map_lookup_done(map, entry);
  833                 return (EINVAL);
  834         }
  835         vm_map_lookup_done(map, entry);
  836         if (obj != shmfd->shm_object)
  837                 return (EINVAL);
  838         vm_map_remove(map, kva, kva + size);
  839         VM_OBJECT_LOCK(obj);
  840         KASSERT(shmfd->shm_kmappings > 0, ("shm_unmap: object not mapped"));
  841         shmfd->shm_kmappings--;
  842         VM_OBJECT_UNLOCK(obj);
  843         return (0);
  844 }
  845 
  846 void
  847 shm_path(struct shmfd *shmfd, char *path, size_t size)
  848 {
  849 
  850         if (shmfd->shm_path == NULL)
  851                 return;
  852         sx_slock(&shm_dict_lock);
  853         if (shmfd->shm_path != NULL)
  854                 strlcpy(path, shmfd->shm_path, size);
  855         sx_sunlock(&shm_dict_lock);
  856 }

Cache object: 9188018a814331834c6ba997a3d422f2


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.