/*
 * linux/ipc/shm.c
 * Copyright (C) 1992, 1993 Krishna Balasubramanian
 *         Many improvements/fixes by Bruno Haible.
 * Replaced `struct shm_desc' by `struct vm_area_struct', July 1994.
 *
 * DIPC parts Copyright (C) Kamran Karimi
 * Adaption to kernel version 2.0.x by Michael Schmitz
 */

#include <linux/errno.h>
#include <linux/sched.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/ipc.h>
#include <linux/shm.h>
#include <linux/stat.h>
#include <linux/malloc.h>
#include <linux/swap.h>
#include <linux/smp.h>
#include <linux/smp_lock.h>
#include <linux/init.h>

#include <asm/uaccess.h>
#include <asm/pgtable.h>

#ifdef CONFIG_SYSVIPC_DIPC
#include <linux/dipc.h>
#include <asm/ipc.h>
#endif

extern int ipcperms (struct ipc_perm *ipcp, short shmflg);
extern unsigned long get_swap_page (void);
static int findkey (key_t key);
static int newseg (key_t key, int shmflg, int size);
static int shm_map (struct vm_area_struct *shmd);
static void killseg (int id);
static void shm_open (struct vm_area_struct *shmd);
static void shm_close (struct vm_area_struct *shmd);
static pte_t shm_swap_in(struct vm_area_struct *, unsigned long, unsigned long);

#ifdef CONFIG_SYSVIPC_DIPC
static int dipc_shmctl(int shmid, int cmd, struct shmid_ds *buff);
extern int dipc_inhibit_shm_signal, dipc_page_size, dipc_transfer_mode;
/* MSch 12/21/96: account for vm_area_struct change (omitting the task_struct);
 * declared in kernel/sched.c (proto should go into <linux/sched.h>) */ 
extern struct task_struct *find_process_by_mm(struct mm_struct *vm_mm);
/* this comes from mm/mprotect.c */
extern void change_protection(struct mm_struct *mm, unsigned long start, unsigned long end, pgprot_t newprot);
#endif

static int shm_tot = 0; /* total number of shared memory pages */
static int shm_rss = 0; /* number of shared memory pages that are in memory */
static int shm_swp = 0; /* number of shared memory pages that are in swap */
static int max_shmid = 0; /* every used id is <= max_shmid */
static struct wait_queue *shm_lock = NULL; /* calling findkey() may need to wait */
static struct shmid_ds *shm_segs[SHMMNI];

static unsigned short shm_seq = 0; /* incremented, for recognizing stale ids */

/* some statistics */
static ulong swap_attempts = 0;
static ulong swap_successes = 0;
static ulong used_segs = 0;

__initfunc(void shm_init (void))
{
	int id;

	for (id = 0; id < SHMMNI; id++)
		shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
	shm_tot = shm_rss = shm_seq = max_shmid = used_segs = 0;
	shm_lock = NULL;
	return;
}

static int findkey (key_t key)
{
	int id;
	struct shmid_ds *shp;

	for (id = 0; id <= max_shmid; id++) {
		while ((shp = shm_segs[id]) == IPC_NOID)
			sleep_on (&shm_lock);
		if (shp == IPC_UNUSED)
			continue;
		if (key == shp->shm_perm.key)
			return id;
	}
	return -1;
}

/*
 * allocate new shmid_ds and pgtable. protected by shm_segs[id] = NOID.
 */
static int newseg (key_t key, int shmflg, int size)
{
	struct shmid_ds *shp;
	int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
	int id, i;

	if (size < SHMMIN)
		return -EINVAL;
	if (shm_tot + numpages >= SHMALL)
		return -ENOSPC;
	for (id = 0; id < SHMMNI; id++)
		if (shm_segs[id] == IPC_UNUSED) {
			shm_segs[id] = (struct shmid_ds *) IPC_NOID;
			goto found;
		}
	return -ENOSPC;

found:
	shp = (struct shmid_ds *) kmalloc (sizeof (*shp), GFP_KERNEL);
	if (!shp) {
		shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
		wake_up (&shm_lock);
		return -ENOMEM;
	}

	shp->shm_pages = (ulong *) kmalloc (numpages*sizeof(ulong),GFP_KERNEL);
	if (!shp->shm_pages) {
		shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
		wake_up (&shm_lock);
		kfree(shp);
		return -ENOMEM;
	}

	for (i = 0; i < numpages; shp->shm_pages[i++] = 0);
	shm_tot += numpages;
	shp->shm_perm.key = key;
#ifdef CONFIG_SYSVIPC_DIPC
	if(dipc_can_act(key, NULL))
		shp->shm_perm.mode = (shmflg & (S_IRWXUGO | IPC_DIPC));
	else
#endif	
	shp->shm_perm.mode = (shmflg & S_IRWXUGO);
	shp->shm_perm.cuid = shp->shm_perm.uid = current->euid;
	shp->shm_perm.cgid = shp->shm_perm.gid = current->egid;
	shp->shm_perm.seq = shm_seq;
	
	shp->shm_segsz = size;
	shp->shm_cpid = current->pid;
	shp->attaches = NULL;
	shp->shm_lpid = shp->shm_nattch = 0;
	shp->shm_atime = shp->shm_dtime = 0;
	shp->shm_ctime = CURRENT_TIME;
	shp->shm_npages = numpages;

	if (id > max_shmid)
		max_shmid = id;
	shm_segs[id] = shp;
	used_segs++;
	wake_up (&shm_lock);
	return (unsigned int) shp->shm_perm.seq * SHMMNI + id;
}

asmlinkage int sys_shmget (key_t key, int size, int shmflg)
{
	struct shmid_ds *shp;
	int err, id = 0;

	down(&current->mm->mmap_sem);
	lock_kernel();
	if (size < 0 || size > SHMMAX) {
		err = -EINVAL;
	} else if (key == IPC_PRIVATE) {
		err = newseg(key, shmflg, size);
	} else {
#ifdef CONFIG_SYSVIPC_DIPC
	/* The key may be locked and freed several times.
	   Also, another worker may need to access this SHM
	   while locked (updating its contents) 
	   NOTE: Removing !dipc_manager() will cause deadlock! */ 

	  if(dipc_can_act(key, current)) 
	  	while(dipc_check(key, SHM)); 
#endif
 	  if ((id = findkey (key)) == -1) {
#ifdef CONFIG_SYSVIPC_DIPC 
		if(dipc_can_act(key, current)) {
               		int remote_size, result, distrib = shmflg & IPC_DIPC;
			dipc_excl(key, SHM);
			result = dipc_search_key(key, SHM, distrib, &remote_size);
			/**printk("sys_shmget(Key %d) has real_size %d\n", key, remote_size);*/
			if(remote_size) {
		 		if(((shmflg & IPC_DIPC) && (result == FOUND_IPC)) ||
		     		   (!(shmflg & IPC_DIPC) && (result == FOUND_DIPC))) {
		 			dipc_commit_key(key, SHM, 0, 0);
		  			dipc_wake(key, SHM);    
		  			err = -EEXIST;
		  			goto out;
		 		}
		 		else if((shmflg & IPC_DIPC) && (result == FOUND_DIPC)) {
		 			/* local and remote are DIPC, test remotely */
		  			result = dipc_test_key(key, SHM, size, shmflg);
		  			if(result < 0) {
		   				dipc_commit_key(key, SHM, 0, 0);
		   				dipc_wake(key, SHM);
		   				err = result;
 		   				goto out;
		  			}
		 		}
			}  
			else { /* nothing was found in other machines */
		 		if (!(shmflg & IPC_CREAT)) {
		  			dipc_commit_key(key, SHM, 0, 0);
		  			dipc_wake(key, SHM);
		  			err = -ENOENT;
 		  			goto out;
 		 		}	
			}
			/* take the size as specified remotely */
			if(remote_size)
		 		size = remote_size;
			id = newseg(key, shmflg, size);
			if(id < 0) {
		 		/**printk("sys_shmget(%d) failed to create! size = %d\n",key, size);*/
		 		dipc_commit_key(key, SHM, 0, 0);
			} 
			else {
		 		shp = shm_segs[id % SHMMNI];
		 		if(shmflg & IPC_DIPC) {
		  			if(remote_size) /* this is not the owner */
		   				dipc_shm_init(key, 0, remote_size);
		  			else {
		   				shp->shm_perm.mode |= IPC_OWN;
		   				dipc_shm_init(key, 3, size);
		  			} 
		 		} 
		 		dipc_commit_key(key, SHM, size, shp->shm_perm.mode);  
			}
			dipc_wake(key, SHM);
			err =  id;	
 			goto out;
	      	}
	      	else { /* no manager */
#endif
		if (!(shmflg & IPC_CREAT))
			err = -ENOENT;
		else
			err = newseg(key, shmflg, size);
#ifdef CONFIG_SYSVIPC_DIPC			
             	}
#endif             
	} else if ((shmflg & IPC_CREAT) && (shmflg & IPC_EXCL)) {
		err = -EEXIST;
	} else {
		shp = shm_segs[id];
		if (size > shp->shm_segsz)
			err = -EINVAL;
		else if (ipcperms (&shp->shm_perm, shmflg))
			err = -EACCES;

#ifdef CONFIG_SYSVIPC_DIPC
		else if(dipc_can_act(key, NULL) && 
			(((shp->shm_perm.mode & IPC_DIPC) && !(shmflg & IPC_DIPC)) ||
			 (!(shp->shm_perm.mode & IPC_DIPC) && (shmflg & IPC_DIPC))))
			 	err = -EEXIST;
#endif	
		else if (shp->shm_perm.mode & SHM_DEST) {
#ifdef CONFIG_SYSVIPC_DIPC
			 /* this is to let access to SHM when it is removed but 
			    not destroyed */
			 if(dipc_can_act(key, NULL) && dipc_manager(current))
			 	err = (unsigned int) shp->shm_perm.seq * SHMMNI + id;  	
			 else 
			  	err = -EIDRM; 
		}
#else		  		
			err = -EIDRM;
#endif			
		else
			err = (int) shp->shm_perm.seq * SHMMNI + id;
	}
	}
#ifdef CONFIG_SYSVIPC_DIPC	
out:
#endif
	unlock_kernel();
	up(&current->mm->mmap_sem);
	return err;
}

/*
 * Only called after testing nattch and SHM_DEST.
 * Here pages, pgtable and shmid_ds are freed.
 */
static void killseg (int id)
{
	struct shmid_ds *shp;
	int i, numpages;

	shp = shm_segs[id];
	if (shp == IPC_NOID || shp == IPC_UNUSED) {
		printk ("shm nono: killseg called on unused seg id=%d\n", id);
		return;
	}
#ifdef CONFIG_SYSVIPC_DIPC
	if(dipc_can_act(shp->shm_perm.key, NULL))
		while(dipc_check(shp->shm_perm.key, SHM));
#endif	
	shp->shm_perm.seq++;     /* for shmat */
	shm_seq = (shm_seq+1) % ((unsigned)(1<<31)/SHMMNI); /* increment, but avoid overflow */
	shm_segs[id] = (struct shmid_ds *) IPC_UNUSED;
	used_segs--;
	if (id == max_shmid)
		while (max_shmid && (shm_segs[--max_shmid] == IPC_UNUSED));
	if (!shp->shm_pages) {
		printk ("shm nono: killseg shp->pages=NULL. id=%d\n", id);
		return;
	}
#ifdef CONFIG_SYSVIPC_DIPC
	if(dipc_can_act(shp->shm_perm.key, NULL)) {
		dipc_excl(shp->shm_perm.key, SHM);
	 	/* if(shp->shm_perm.mode & IPC_OWN)*/
	 	dipc_del_key(shp->shm_perm.key, SHM);	
	 	dipc_wake(shp->shm_perm.key, SHM);
	 	dipc_shm_del(shp->shm_perm.key);
	} 
#endif	
	numpages = shp->shm_npages;
	for (i = 0; i < numpages ; i++) {
		pte_t pte;
		pte = __pte(shp->shm_pages[i]);
		if (pte_none(pte))
			continue;
		if (pte_present(pte)) {
			free_page (pte_page(pte));
			shm_rss--;
		} else {
			swap_free(pte_val(pte));
			shm_swp--;
		}
	}
	kfree(shp->shm_pages);
	shm_tot -= numpages;
	kfree(shp);
	return;
}

asmlinkage int sys_shmctl (int shmid, int cmd, struct shmid_ds *buf)
{
	struct shmid_ds tbuf;
	struct shmid_ds *shp;
	struct ipc_perm *ipcp;
	int id, err = -EINVAL;

	lock_kernel();
	if (cmd < 0 || shmid < 0)
		goto out;
#ifdef CONFIG_SYSVIPC_DIPC
	shp = shm_segs[id = (unsigned int) shmid % SHMMNI];
	if((shp != IPC_UNUSED) && (shp != IPC_NOID) &&
	   (shp->shm_perm.seq == (unsigned int) shmid / SHMMNI) &&
	   dipc_can_act(shp->shm_perm.key, current)) {
	 	if((cmd == IPC_STAT || cmd == IPC_SET || cmd == IPC_RMID) &&
	  	   (shp->shm_perm.mode & IPC_DIPC) && 
	  	   !(shp->shm_perm.mode & IPC_OWN)) {
			err = dipc_shmctl(id, cmd, buf);	
			goto out;
	 	}
	}      
#endif
 
	if (cmd == IPC_SET) {
		err = -EFAULT;
		if (!buf)
			goto out;
		err = verify_area (VERIFY_READ, buf, sizeof (*buf));
		if (err)
			goto out;
		copy_from_user (&tbuf, buf, sizeof (*buf));
	}

	switch (cmd) { /* replace with proc interface ? */
	case IPC_INFO:
	{
		struct shminfo shminfo;
		err = -EFAULT;
		if (!buf)
			goto out;
		shminfo.shmmni = SHMMNI;
		shminfo.shmmax = SHMMAX;
		shminfo.shmmin = SHMMIN;
		shminfo.shmall = SHMALL;
		shminfo.shmseg = SHMSEG;
		err = verify_area (VERIFY_WRITE, buf, sizeof (struct shminfo));
		if (err)
			goto out;
		copy_to_user (buf, &shminfo, sizeof(struct shminfo));
		err = max_shmid;
		goto out;
	}
	case SHM_INFO:
	{
		struct shm_info shm_info;
		err = -EFAULT;
		if (!buf)
			goto out;
		err = verify_area (VERIFY_WRITE, buf, sizeof (shm_info));
		if (err)
			goto out;
		shm_info.used_ids = used_segs;
		shm_info.shm_rss = shm_rss;
		shm_info.shm_tot = shm_tot;
		shm_info.shm_swp = shm_swp;
		shm_info.swap_attempts = swap_attempts;
		shm_info.swap_successes = swap_successes;
		copy_to_user (buf, &shm_info, sizeof(shm_info));
		err = max_shmid;
		goto out;
	}
	case SHM_STAT:
		err = -EFAULT;
		if (!buf)
			goto out;
		err = verify_area (VERIFY_WRITE, buf, sizeof (*buf));
		if (err)
			goto out;
		err = -EINVAL;
		if (shmid > max_shmid)
			goto out;
		shp = shm_segs[shmid];
		if (shp == IPC_UNUSED || shp == IPC_NOID)
			goto out;
		if (ipcperms (&shp->shm_perm, S_IRUGO))
			goto out;
		id = (unsigned int) shp->shm_perm.seq * SHMMNI + shmid;
		tbuf.shm_perm   = shp->shm_perm;
		tbuf.shm_segsz  = shp->shm_segsz;
		tbuf.shm_atime  = shp->shm_atime;
		tbuf.shm_dtime  = shp->shm_dtime;
		tbuf.shm_ctime  = shp->shm_ctime;
		tbuf.shm_cpid   = shp->shm_cpid;
		tbuf.shm_lpid   = shp->shm_lpid;
		tbuf.shm_nattch = shp->shm_nattch;
#ifdef CONFIG_SYSVIPC_DIPC
 		tbuf.shm_pages = (unsigned long *)dipc_find_owner_address(shp->shm_perm.key, SHM, 1);
#endif
		copy_to_user (buf, &tbuf, sizeof(*buf));
		err = id;
		goto out;
	}

#ifdef CONFIG_SYSVIPC_DIPC
again:
#endif

	shp = shm_segs[id = (unsigned int) shmid % SHMMNI];
	err = -EINVAL;
	if (shp == IPC_UNUSED || shp == IPC_NOID)
		goto out;
	err = -EIDRM;
	if (shp->shm_perm.seq != (unsigned int) shmid / SHMMNI)
		goto out;
	ipcp = &shp->shm_perm;

#ifdef CONFIG_SYSVIPC_DIPC
	if(dipc_can_act(shp->shm_perm.key, NULL))
		if(dipc_check(shp->shm_perm.key, SHM)) goto again;
#endif

	switch (cmd) {
	case SHM_UNLOCK:
		err = -EPERM;
		if (!capable(CAP_IPC_LOCK))
			goto out;
		err = -EINVAL;
		if (!(ipcp->mode & SHM_LOCKED))
			goto out;
		ipcp->mode &= ~SHM_LOCKED;
		break;
	case SHM_LOCK:
/* Allow superuser to lock segment in memory */
/* Should the pages be faulted in here or leave it to user? */
/* need to determine interaction with current->swappable */
		err = -EPERM;
		if (!capable(CAP_IPC_LOCK))
			goto out;
		err = -EINVAL;
		if (ipcp->mode & SHM_LOCKED)
			goto out;
		ipcp->mode |= SHM_LOCKED;
		break;
	case IPC_STAT:
		err = -EACCES;
		if (ipcperms (ipcp, S_IRUGO))
			goto out;
		err = -EFAULT;
		if (!buf)
			goto out;
		err = verify_area (VERIFY_WRITE, buf, sizeof (*buf));
		if (err)
			goto out;
		tbuf.shm_perm   = shp->shm_perm;
		tbuf.shm_segsz  = shp->shm_segsz;
		tbuf.shm_atime  = shp->shm_atime;
		tbuf.shm_dtime  = shp->shm_dtime;
		tbuf.shm_ctime  = shp->shm_ctime;
		tbuf.shm_cpid   = shp->shm_cpid;
		tbuf.shm_lpid   = shp->shm_lpid;
		tbuf.shm_nattch = shp->shm_nattch;
		copy_to_user (buf, &tbuf, sizeof(*buf));
		break;
	case IPC_SET:
		if (current->euid == shp->shm_perm.uid ||
		    current->euid == shp->shm_perm.cuid || 
		    capable(CAP_SYS_ADMIN)) {
			ipcp->uid = tbuf.shm_perm.uid;
			ipcp->gid = tbuf.shm_perm.gid;
			ipcp->mode = (ipcp->mode & ~S_IRWXUGO)
				| (tbuf.shm_perm.mode & S_IRWXUGO);
			shp->shm_ctime = CURRENT_TIME;
			break;
		}
		err = -EPERM;
		goto out;
	case IPC_RMID:
		if (current->euid == shp->shm_perm.uid ||
		    current->euid == shp->shm_perm.cuid || 
		    capable(CAP_SYS_ADMIN)) {
#ifdef CONFIG_SYSVIPC_DIPC
			if(dipc_can_act(shp->shm_perm.key, NULL)) {
		 		dipc_excl(shp->shm_perm.key, SHM);
				if((shp->shm_perm.mode & IPC_DIPC) &&
		           	   (shp->shm_perm.mode & IPC_OWN))
		  			dipc_rmid_key(shp->shm_perm.key, SHM);	
		 			dipc_wake(shp->shm_perm.key, SHM);
			} 
#endif		    
			shp->shm_perm.mode |= SHM_DEST;
			if (shp->shm_nattch <= 0)
				killseg (id);
			break;
		}
		err = -EPERM;
		goto out;
	default:
		err = -EINVAL;
		goto out;
	}
	err = 0;
out:
	unlock_kernel();
	return err;
}

/*
 * The per process internal structure for managing segments is
 * `struct vm_area_struct'.
 * A shmat will add to and shmdt will remove from the list.
 * shmd->vm_mm		the attacher
 * shmd->vm_start	virt addr of attach, multiple of SHMLBA
 * shmd->vm_end		multiple of SHMLBA
 * shmd->vm_next	next attach for task
 * shmd->vm_next_share	next attach for segment
 * shmd->vm_offset	offset into segment
 * shmd->vm_pte		signature for this attach
 */

static struct vm_operations_struct shm_vm_ops = {
	shm_open,		/* open - callback for a new vm-area open */
	shm_close,		/* close - callback for when the vm-area is released */
	NULL,			/* no need to sync pages at unmap */
	NULL,			/* protect */
	NULL,			/* sync */
	NULL,			/* advise */
	NULL,			/* nopage (done with swapin) */
	NULL,			/* wppage */
	NULL,			/* swapout (hardcoded right now) */
	shm_swap_in		/* swapin */
};

/* Insert shmd into the list shp->attaches */
static inline void insert_attach (struct shmid_ds * shp, struct vm_area_struct * shmd)
{
	if((shmd->vm_next_share = shp->attaches) != NULL)
		shp->attaches->vm_pprev_share = &shmd->vm_next_share;
	shp->attaches = shmd;
	shmd->vm_pprev_share = &shp->attaches;
}

/* Remove shmd from list shp->attaches */
static inline void remove_attach (struct shmid_ds * shp, struct vm_area_struct * shmd)
{
	if(shmd->vm_next_share)
		shmd->vm_next_share->vm_pprev_share = shmd->vm_pprev_share;
	*shmd->vm_pprev_share = shmd->vm_next_share;
}

/*
 * ensure page tables exist
 * mark page table entries with shm_sgn.
 */
static int shm_map (struct vm_area_struct *shmd)
{
	pgd_t *page_dir;
	pmd_t *page_middle;
	pte_t *page_table;
	unsigned long tmp, shm_sgn;
	int error;

	/* clear old mappings */
	do_munmap(shmd->vm_start, shmd->vm_end - shmd->vm_start);

	/* add new mapping */
	tmp = shmd->vm_end - shmd->vm_start;
	if((current->mm->total_vm << PAGE_SHIFT) + tmp
	   > (unsigned long) current->rlim[RLIMIT_AS].rlim_cur)
		return -ENOMEM;
	current->mm->total_vm += tmp >> PAGE_SHIFT;
	insert_vm_struct(current->mm, shmd);
	merge_segments(current->mm, shmd->vm_start, shmd->vm_end);

	/* map page range */
	error = 0;
	shm_sgn = shmd->vm_pte +
	  SWP_ENTRY(0, (shmd->vm_offset >> PAGE_SHIFT) << SHM_IDX_SHIFT);
	flush_cache_range(shmd->vm_mm, shmd->vm_start, shmd->vm_end);
	for (tmp = shmd->vm_start;
	     tmp < shmd->vm_end;
	     tmp += PAGE_SIZE, shm_sgn += SWP_ENTRY(0, 1 << SHM_IDX_SHIFT))
	{
		page_dir = pgd_offset(shmd->vm_mm,tmp);
		page_middle = pmd_alloc(page_dir,tmp);
		if (!page_middle) {
			error = -ENOMEM;
			break;
		}
		page_table = pte_alloc(page_middle,tmp);
		if (!page_table) {
			error = -ENOMEM;
			break;
		}
		set_pte(page_table, __pte(shm_sgn));
	}
	flush_tlb_range(shmd->vm_mm, shmd->vm_start, shmd->vm_end);
	return error;
}

/*
 * Fix shmaddr, allocate descriptor, map shm, add attach descriptor to lists.
 */
asmlinkage int sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
{
	struct shmid_ds *shp;
	struct vm_area_struct *shmd;
	int err = -EINVAL;
	unsigned int id;
	unsigned long addr;
	unsigned long len;

	down(&current->mm->mmap_sem);
	lock_kernel();
	if (shmid < 0) {
		/* printk("shmat() -> EINVAL because shmid = %d < 0\n",shmid); */
		goto out;
	}

	shp = shm_segs[id = (unsigned int) shmid % SHMMNI];
	if (shp == IPC_UNUSED || shp == IPC_NOID) {
		/* printk("shmat() -> EINVAL because shmid = %d is invalid\n",shmid); */
		goto out;
	}

	if (!(addr = (ulong) shmaddr)) {
		if (shmflg & SHM_REMAP)
			goto out;
		err = -ENOMEM;
		addr = 0;
	again:
		if (!(addr = get_unmapped_area(addr, shp->shm_segsz)))
			goto out;
		if(addr & (SHMLBA - 1)) {
			addr = (addr + (SHMLBA - 1)) & ~(SHMLBA - 1);
			goto again;
		}
	} else if (addr & (SHMLBA-1)) {
		if (shmflg & SHM_RND)
			addr &= ~(SHMLBA-1);       /* round down */
		else
			goto out;
	}
	/*
	 * Check if addr exceeds TASK_SIZE (from do_mmap)
	 */
	len = PAGE_SIZE*shp->shm_npages;
	err = -EINVAL;
	if (addr >= TASK_SIZE || len > TASK_SIZE  || addr > TASK_SIZE - len)
		goto out;
	/*
	 * If shm segment goes below stack, make sure there is some
	 * space left for the stack to grow (presently 4 pages).
	 */
	if (addr < current->mm->start_stack &&
	    addr > current->mm->start_stack - PAGE_SIZE*(shp->shm_npages + 4))
	{
		/* printk("shmat() -> EINVAL because segment intersects stack\n"); */
		goto out;
	}
	if (!(shmflg & SHM_REMAP))
		if ((shmd = find_vma_intersection(current->mm, addr, addr + shp->shm_segsz))) {
			/* printk("shmat() -> EINVAL because the interval [0x%lx,0x%lx) intersects an already mapped interval [0x%lx,0x%lx).\n",
				addr, addr + shp->shm_segsz, shmd->vm_start, shmd->vm_end); */
			goto out;
		}

	err = -EACCES;
	if (ipcperms(&shp->shm_perm, shmflg & SHM_RDONLY ? S_IRUGO : S_IRUGO|S_IWUGO))
		goto out;
	err = -EIDRM;
	if (shp->shm_perm.seq != (unsigned int) shmid / SHMMNI)
		goto out;

	err = -ENOMEM;
	shmd = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
	if (!shmd)
		goto out;
	if ((shp != shm_segs[id]) || (shp->shm_perm.seq != (unsigned int) shmid / SHMMNI)) {
		kmem_cache_free(vm_area_cachep, shmd);
		err = -EIDRM;
		goto out;
	}

	shmd->vm_pte = SWP_ENTRY(SHM_SWP_TYPE, id);
	shmd->vm_start = addr;
	shmd->vm_end = addr + shp->shm_npages * PAGE_SIZE;
	shmd->vm_mm = current->mm;
	shmd->vm_page_prot = (shmflg & SHM_RDONLY) ? PAGE_READONLY : PAGE_SHARED;
	shmd->vm_flags = VM_SHM | VM_MAYSHARE | VM_SHARED
			 | VM_MAYREAD | VM_MAYEXEC | VM_READ | VM_EXEC
			 | ((shmflg & SHM_RDONLY) ? 0 : VM_MAYWRITE | VM_WRITE);
	shmd->vm_file = NULL;
	shmd->vm_offset = 0;
	shmd->vm_ops = &shm_vm_ops;

	shp->shm_nattch++;            /* prevent destruction */
	if ((err = shm_map (shmd))) {
		if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST)
			killseg(id);
		kmem_cache_free(vm_area_cachep, shmd);
		goto out;
	}

	insert_attach(shp,shmd);  /* insert shmd into shp->attaches */

	shp->shm_lpid = current->pid;
	shp->shm_atime = CURRENT_TIME;

	*raddr = addr;
	err = 0;
	
#ifdef CONFIG_SYSVIPC_DIPC	
 	if(dipc_can_act(shp->shm_perm.key, current)) {
 	 	int count;
 	 
 	 	for(count = 0; count < shp->shm_npages * PAGE_SIZE / dipc_page_size; count++)
 	  		if(!dipc_shm_writable(shp->shm_perm.key, count * dipc_page_size))
 	   			shmd->vm_page_prot = __pgprot(DIPC_PAGE_RO(pgprot_val(shmd->vm_page_prot)));
 	}   
#endif

out:
	unlock_kernel();
	up(&current->mm->mmap_sem);
	return err;
}

/* This is called by fork, once for every shm attach. */
static void shm_open (struct vm_area_struct *shmd)
{
	unsigned int id;
	struct shmid_ds *shp;

	id = SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK;
	shp = shm_segs[id];
	if (shp == IPC_UNUSED) {
		printk("shm_open: unused id=%d PANIC\n", id);
		return;
	}
	insert_attach(shp,shmd);  /* insert shmd into shp->attaches */
	shp->shm_nattch++;
	shp->shm_atime = CURRENT_TIME;
	shp->shm_lpid = current->pid;
}

/*
 * remove the attach descriptor shmd.
 * free memory for segment if it is marked destroyed.
 * The descriptor has already been removed from the current->mm->mmap list
 * and will later be kfree()d.
 */
static void shm_close (struct vm_area_struct *shmd)
{
	struct shmid_ds *shp;
	int id;

	/* remove from the list of attaches of the shm segment */
	id = SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK;
	shp = shm_segs[id];
	remove_attach(shp,shmd);  /* remove from shp->attaches */
  	shp->shm_lpid = current->pid;
	shp->shm_dtime = CURRENT_TIME;
	if (--shp->shm_nattch <= 0 && shp->shm_perm.mode & SHM_DEST)
		killseg (id);
}

/*
 * detach and kill segment if marked destroyed.
 * The work is done in shm_close.
 */
asmlinkage int sys_shmdt (char *shmaddr)
{
	struct vm_area_struct *shmd, *shmdnext;

	down(&current->mm->mmap_sem);
	lock_kernel();
	for (shmd = current->mm->mmap; shmd; shmd = shmdnext) {
		shmdnext = shmd->vm_next;
		if (shmd->vm_ops == &shm_vm_ops
		    && shmd->vm_start - shmd->vm_offset == (ulong) shmaddr)
			do_munmap(shmd->vm_start, shmd->vm_end - shmd->vm_start);
	}
	unlock_kernel();
	up(&current->mm->mmap_sem);
	return 0;
}

/*
 * page not present ... go through shm_pages
 */
static pte_t shm_swap_in(struct vm_area_struct * shmd, unsigned long offset, unsigned long code)
{
	pte_t pte;
	struct shmid_ds *shp;
	unsigned int id, idx;

	id = SWP_OFFSET(code) & SHM_ID_MASK;
	if (id != (SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK)) {
		printk ("shm_swap_in: code id = %d and shmd id = %ld differ\n",
			id, SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK);
		return BAD_PAGE;
	}
	if (id > max_shmid) {
		printk ("shm_swap_in: id=%d too big. proc mem corrupted\n", id);
		return BAD_PAGE;
	}
	shp = shm_segs[id];
	if (shp == IPC_UNUSED || shp == IPC_NOID) {
		printk ("shm_swap_in: id=%d invalid. Race.\n", id);
		return BAD_PAGE;
	}
	idx = (SWP_OFFSET(code) >> SHM_IDX_SHIFT) & SHM_IDX_MASK;
	if (idx != (offset >> PAGE_SHIFT)) {
		printk ("shm_swap_in: code idx = %u and shmd idx = %lu differ\n",
			idx, offset >> PAGE_SHIFT);
		return BAD_PAGE;
	}
	if (idx >= shp->shm_npages) {
		printk ("shm_swap_in : too large page index. id=%d\n", id);
		return BAD_PAGE;
	}

	pte = __pte(shp->shm_pages[idx]);
	if (!pte_present(pte)) {
		unsigned long page = get_free_page(GFP_KERNEL);
		if (!page) {
			oom(current);
			return BAD_PAGE;
		}
		pte = __pte(shp->shm_pages[idx]);
		if (pte_present(pte)) {
			free_page (page); /* doesn't sleep */
			goto done;
		}
		if (!pte_none(pte)) {
			rw_swap_page_nocache(READ, pte_val(pte), (char *)page);
			pte = __pte(shp->shm_pages[idx]);
			if (pte_present(pte))  {
				free_page (page); /* doesn't sleep */
				goto done;
			}
			swap_free(pte_val(pte));
			shm_swp--;
		}
		shm_rss++;
		pte = pte_mkdirty(mk_pte(page, PAGE_SHARED));
		shp->shm_pages[idx] = pte_val(pte);
	} else
		--current->maj_flt;  /* was incremented in do_no_page */

done:	/* pte_val(pte) == shp->shm_pages[idx] */
	current->min_flt++;
	atomic_inc(&mem_map[MAP_NR(pte_page(pte))].count);
	return pte_modify(pte, shmd->vm_page_prot);
}

/*
 * Goes through counter = (shm_rss >> prio) present shm pages.
 */
static unsigned long swap_id = 0; /* currently being swapped */
static unsigned long swap_idx = 0; /* next to swap */

int shm_swap (int prio, int dma)
{
	pte_t page;
	struct shmid_ds *shp;
	struct vm_area_struct *shmd;
	unsigned long swap_nr;
	unsigned long id, idx;
	int loop = 0;
	int counter;
	
	counter = shm_rss >> prio;
	if (!counter || !(swap_nr = get_swap_page()))
		return 0;

 check_id:
	shp = shm_segs[swap_id];
	if (shp == IPC_UNUSED || shp == IPC_NOID || shp->shm_perm.mode & SHM_LOCKED ) {
		next_id:
		swap_idx = 0;
		if (++swap_id > max_shmid) {
			if (loop)
				goto failed;
			loop = 1;
			swap_id = 0;
		}
		goto check_id;
	}
	id = swap_id;

 check_table:
	idx = swap_idx++;
	if (idx >= shp->shm_npages)
		goto next_id;

	page = __pte(shp->shm_pages[idx]);
	if (!pte_present(page))
		goto check_table;
	if (dma && !PageDMA(&mem_map[MAP_NR(pte_page(page))]))
		goto check_table;
	swap_attempts++;

	if (--counter < 0) { /* failed */
		failed:
		swap_free (swap_nr);
		return 0;
	}
	if (shp->attaches)
	  for (shmd = shp->attaches; ; ) {
	    do {
		pgd_t *page_dir;
		pmd_t *page_middle;
		pte_t *page_table, pte;
		unsigned long tmp;

		if ((SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK) != id) {
			printk ("shm_swap: id=%ld does not match shmd->vm_pte.id=%ld\n",
				id, SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK);
			continue;
		}
		tmp = shmd->vm_start + (idx << PAGE_SHIFT) - shmd->vm_offset;
		if (!(tmp >= shmd->vm_start && tmp < shmd->vm_end))
			continue;
		page_dir = pgd_offset(shmd->vm_mm,tmp);
		if (pgd_none(*page_dir) || pgd_bad(*page_dir)) {
			printk("shm_swap: bad pgtbl! id=%ld start=%lx idx=%ld\n",
					id, shmd->vm_start, idx);
			pgd_clear(page_dir);
			continue;
		}
		page_middle = pmd_offset(page_dir,tmp);
		if (pmd_none(*page_middle) || pmd_bad(*page_middle)) {
			printk("shm_swap: bad pgmid! id=%ld start=%lx idx=%ld\n",
					id, shmd->vm_start, idx);
			pmd_clear(page_middle);
			continue;
		}
		page_table = pte_offset(page_middle,tmp);
		pte = *page_table;
		if (!pte_present(pte))
			continue;
		if (pte_young(pte)) {
			set_pte(page_table, pte_mkold(pte));
			continue;
		}
		if (pte_page(pte) != pte_page(page))
			printk("shm_swap_out: page and pte mismatch %lx %lx\n",
			       pte_page(pte),pte_page(page));
		flush_cache_page(shmd, tmp);
		set_pte(page_table,
		  __pte(shmd->vm_pte + SWP_ENTRY(0, idx << SHM_IDX_SHIFT)));
		atomic_dec(&mem_map[MAP_NR(pte_page(pte))].count);
		if (shmd->vm_mm->rss > 0)
			shmd->vm_mm->rss--;
		flush_tlb_page(shmd, tmp);
	    /* continue looping through the linked list */
	    } while (0);
	    shmd = shmd->vm_next_share;
	    if (!shmd)
		break;
	}

	if (atomic_read(&mem_map[MAP_NR(pte_page(page))].count) != 1)
		goto check_table;
	shp->shm_pages[idx] = swap_nr;
	rw_swap_page_nocache (WRITE, swap_nr, (char *) pte_page(page));
	free_page(pte_page(page));
	swap_successes++;
	shm_swp++;
	shm_rss--;
	return 1;
}


#ifdef CONFIG_SYSVIPC_DIPC
/**********************************/
/* Implement DIPC's shared memory */


/* this routine swaps out relevant parts of a shared memory. This was 
   constructed by doing some cut and paste on shm_swap. I hope this is 
   done the right way! */ 
int dipc_swap_out (int id, int offset, int mode)
{
	pte_t page;
	struct shmid_ds *shp;
	struct vm_area_struct *shmd=NULL;
	unsigned int swap_nr;
	unsigned long idx;
	int start, end;

	/**printk("dipc_swap_out(%d, %d, %d)\n",id, offset, mode);*/
	shp = shm_segs[id];
	/* no regard for locked shared memories! */
	if(shp == IPC_UNUSED || shp == IPC_NOID)
		return DIPC_FAIL;
 	/* swap_free (swap_nr); */
	
	if (shp->attaches) {
		start = offset / PAGE_SIZE;
		start = start - start % (dipc_page_size / PAGE_SIZE);
		end = start + dipc_page_size / PAGE_SIZE;
		if(end > shp->shm_npages)
		end = shp->shm_npages;
		if(mode == SEGMENT) {
			start = 0;
			end = shp->shm_npages;
		}
		for(idx = start; idx < end; idx++) { 
			swap_nr = get_swap_page();
			if(swap_nr == 0) 
				return DIPC_FAIL;
			pte_val(page) = shp->shm_pages[idx];
			if(!pte_present(page))
				continue;
			swap_attempts++; 
			for (shmd = shp->attaches; shmd != NULL; shmd = shmd->vm_next_share) {
    				pgd_t *page_dir;
				pmd_t *page_middle;
				pte_t *page_table, pte;
				unsigned long tmp;
				if ((SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK) != id) {
				printk ("dipc_swap_out: id=%d does not match shmd->vm_pte.id=%ld\n", 
	       	 					id, SWP_OFFSET(shmd->vm_pte) & SHM_ID_MASK);
					continue;
				}
				tmp = shmd->vm_start + (idx << PAGE_SHIFT) - shmd->vm_offset;
				if (!(tmp >= shmd->vm_start && tmp < shmd->vm_end))
					continue;
				page_dir = pgd_offset(shmd->vm_mm,tmp);
				if (pgd_none(*page_dir) || pgd_bad(*page_dir)) {
					printk("dipc_swap_out: bad pgtbl! id=%d start=%lx idx=%ld\n",
						id, shmd->vm_start, idx);
					pgd_clear(page_dir);
     					continue;
				}
				page_middle = pmd_offset(page_dir,tmp);
				if (pmd_none(*page_middle) || pmd_bad(*page_middle)) {
					printk("dipc_swap_out: bad pgmid! id=%d start=%lx idx=%ld\n",
						id, shmd->vm_start, idx);
					pmd_clear(page_middle);
					continue;
				}
				page_table = pte_offset(page_middle,tmp);
				pte = *page_table;
				if (!pte_present(pte))
					continue;
				/* if (pte_young(pte)) {
					*page_table = pte_mkold(pte);
					continue;
				} */
				if (pte_page(pte) != pte_page(page))
					printk("dipc_swap_out: page and pte mismatch %lx %lx\n",
						pte_page(pte),pte_page(page));
				flush_cache_page(shmd, tmp);
				set_pte(page_table,
	      			__pte(shmd->vm_pte + SWP_ENTRY(0, idx << SHM_IDX_SHIFT)));
				atomic_dec(&mem_map[MAP_NR(pte_page(pte))].count);
				if (shmd->vm_mm->rss > 0)
					shmd->vm_mm->rss--;
				flush_tlb_page(shmd, tmp);
			}
			/* if (atomic_read(&mem_map[MAP_NR(pte_page(page))].count) != 1)
				goto check_table; */	
			shp->shm_pages[idx] = swap_nr;
			rw_swap_page_nocache (WRITE, swap_nr, (char *) pte_page(page));
			free_page(pte_page(page));
			swap_successes++;
			shm_swp++;
			shm_rss--;
		} /* for idx ... */	
	} /* if shmat... */
	return DIPC_SUCCESS;
}


/* calls the change_protection routine in mm/mprotect.c */
static void dipc_change_protection(struct vm_area_struct *vma, 
				pgprot_t newprot, int offset, int mode)
{
	unsigned long start, end;

	if(mode == SEGMENT) {
		start = vma->vm_start;
		end = vma->vm_end;
	}
	else { /* page mode */
		start = vma->vm_start + offset;
		start = start - start % dipc_page_size;
		end = start + dipc_page_size;
		if(end > vma->vm_end)
		end = vma->vm_end;
	}
	change_protection(vma->vm_mm, start, end, newprot);
	vma->vm_page_prot = newprot;
}


static int dipc_enable_prot(key_t key, int enable_write, int offset, int mode)
{
	int id;
	long signal;
	struct shmid_ds *shp;
	struct vm_area_struct *attaches;
 
	/**printk("dipc_enable_prot(%d, %d, %d, %d)\n", key, enable_write, offset, mode);*/
	id = findkey(key);
	if(id < 0) 
		return -1;
	shp = shm_segs[id];

	if(enable_write)
		dipc_shm_enable(key, 3, offset, mode);
	else
		dipc_shm_enable(key, 1, offset, mode);
	attaches = shp->attaches;
	while(attaches) { 
		if(dipc_can_act(key, find_process_by_mm(attaches->vm_mm))) {
			signal = DIPC_SIG_READER;
			if(enable_write && (attaches->vm_flags & VM_MAYWRITE)) {
				/* only if the segment had this right in the first place */
				dipc_change_protection(attaches,
				__pgprot(DIPC_PAGE_RW(pgprot_val(attaches->vm_page_prot))), offset, mode);
				signal = DIPC_SIG_WRITER;
			}
			if(!dipc_inhibit_shm_signal)
				send_sig(signal, find_process_by_mm(attaches->vm_mm), 1);   
		} 
		attaches = attaches->vm_next_share;
		if(shp->attaches == attaches) 
			break;
	}
	return 0;
}


int dipc_disable_prot(key_t key, int cmd, int *mask)
{
 	struct shmid_ds *shp;
 	int id;
	int op[3], err;
	struct vm_area_struct *attaches;
 
	/**printk("dipc_disable_prot(%d, %d, %d)\n", key, cmd, *mask);*/
	id = findkey(key);
	if(id == -1) {
		printk("dipc_disable_prot(%d, %d, %d): key not found\n", 
							key, cmd, *mask);
		return -ENOENT;
	}
	shp = shm_segs[id];
	err = verify_area(VERIFY_READ, mask, 3 * sizeof(int));
	if(err) 
		return err;
	copy_from_user (&op, mask, 3 * sizeof(int));

 	/* for future attaches */
	if(op[0] == DISABLE_WR) { 
		dipc_shm_disable(key, 2, op[1], op[2]);
		attaches = shp->attaches;
		while(attaches) { 
			if(dipc_can_act(key, find_process_by_mm(attaches->vm_mm)))
				dipc_change_protection(attaches,
					__pgprot(DIPC_PAGE_RO(pgprot_val(attaches->vm_page_prot))), op[1], op[2]);
			attaches = attaches->vm_next_share;
			if(shp->attaches == attaches) /* circular */
				break;
		}
	}  
	else { /* read protect */
		dipc_shm_disable(key, 3, op[1], op[2]);
		if(dipc_swap_out(id, op[1], op[2]) != DIPC_SUCCESS) {
			printk("dipc_disable_prot(%d, %d, %d): Can't swap-out the shared memory\n",
							key, cmd, *mask);
			return DIPC_FAIL;
		}
	}
	return DIPC_SUCCESS;
}


extern int dipc_shm_request_coexists(key_t key, int addr);

int dipc_shm_fault(struct vm_area_struct *vma, unsigned long address, 
                                                  unsigned long write_access)
{
	int id, addr;
	struct shmid_ds *shp;
	struct dipc_request *dr;
 	key_t key;
	int can_coexist;
 
	if(!(vma->vm_flags & VM_MAYWRITE) && write_access) return 0;
	id = SWP_OFFSET(vma->vm_pte) & SHM_ID_MASK;
	shp = shm_segs[id];
	key = shp->shm_perm.key;
	/**printk("dipc_shm_fault() key %d, addr %d, shp %ld\n",
					key, addr, shp);*/
 	if(dipc_can_act(key, find_process_by_mm(vma->vm_mm))) { 
		addr = address - vma->vm_start;
		/* the following is to increase the chances of parallel execution of two 
		   processes wanting to access different pages of a shared memory, configured 
		   in page transfer mode */
		can_coexist = dipc_shm_request_coexists(key, addr);
		if(!can_coexist)  
			while(dipc_check(key, SHM));
		if(!dipc_shm_readable(key, addr) || (!dipc_shm_writable(key, addr) && write_access)) {
			if(!can_coexist) 
				dipc_excl(key, SHM);
			dr = kmalloc(sizeof(struct dipc_request), GFP_KERNEL);
			if(dr == NULL) 
				return -ENOMEM; /* set errno */
			dr->info.key = key;
			dr->info.type = SHM;
			dr->info.pid = current->pid;
			dr->info.uid = current->uid;
			if(write_access)
				dr->info.func = WANTWR;
			else
				dr->info.func = WANTRD;
			dr->info.arg1 = key;
			dr->info.arg2 = addr;
			dr->info.arg3 = dipc_transfer_mode;
			dr->info.arg4 = 0;
			dr->info.owner = -1;
			dr->working = 0;
			dr->next = dr->prev = NULL;
			dr->lock = NULL;
			dr->info.dsize = 0;
			dr->data = NULL;

   			dipc_add_request(dr);

   			if(dr->info.arg1 < 0)
				send_sig(SIGSEGV, current, 1);
			else
				dipc_enable_prot(key, write_access, addr, dr->info.arg3);  
			kfree(dr);
			if(!dipc_shm_request_coexists(key, addr))
				dipc_wake(key, SHM);
			return 1;
		}
	} 
	return 0; 
}

  
static int dipc_shmctl(int shmid, int cmd, struct shmid_ds *buff)
{
	struct dipc_request *dr;
	int err;
 
	/**printk("dipc_shmctl(shmid: %d, cmd: %d)\n", shmid, cmd);*/
	err = 0;
	if(cmd == IPC_SET)
		err = verify_area(VERIFY_READ, buff, sizeof(struct shmid_ds));
	else if(cmd == IPC_STAT)
		err = verify_area(VERIFY_WRITE, buff, sizeof(struct shmid_ds));
	if(err) 
		return err;

	dr = kmalloc(sizeof(struct dipc_request), GFP_KERNEL);
	if(dr == NULL) 
		return -ENOMEM; /* set errno */
	dr->info.key = shm_segs[shmid]->shm_perm.key;
	dr->info.type = SHM;
	dr->info.pid = current->pid;
	dr->info.uid = current->uid;
	dr->info.func = SHMCTL;
	dr->info.arg1 = shm_segs[shmid]->shm_perm.key;
	dr->info.arg2 = cmd;
	dr->info.arg3 = 0;
	dr->info.arg4 = 0;
	dr->info.owner = -1; 
	dr->info.dsize = 0;
	dr->working = 0;
	dr->next = dr->prev = NULL;
	dr->data = NULL;
	dr->lock = NULL;
	if(cmd == IPC_SET || cmd == IPC_STAT) {
 		dr->info.dsize = sizeof(struct shmid_ds);
 		dr->data = kmalloc(dr->info.dsize, GFP_KERNEL);
 		if(dr->data == NULL) {
  			kfree(dr);
  			return -ENOMEM;
 		}
	}
	if(cmd == IPC_SET)
 		copy_from_user (dr->data, buff, dr->info.dsize);

	dipc_add_request(dr); 
	
	err = dr->info.arg1;
	if(err == 0 && cmd == IPC_STAT)
		copy_to_user (buff, dr->data, dr->info.dsize);
	if(cmd == IPC_STAT || cmd == IPC_SET)
 		kfree(dr->data);
	kfree(dr);
	return err;
} /* shmctl */

#endif
