1 /* $NetBSD: sysv_sem.c,v 1.98 2019/08/07 00:38:02 pgoyette Exp $ */
2
3 /*-
4 * Copyright (c) 1999, 2007 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9 * NASA Ames Research Center, and by Andrew Doran.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /*
34 * Implementation of SVID semaphores
35 *
36 * Author: Daniel Boulet
37 *
38 * This software is provided ``AS IS'' without any warranties of any kind.
39 */
40
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: sysv_sem.c,v 1.98 2019/08/07 00:38:02 pgoyette Exp $");
43
44 #ifdef _KERNEL_OPT
45 #include "opt_sysv.h"
46 #endif
47
48 #include <sys/param.h>
49 #include <sys/kernel.h>
50 #include <sys/sem.h>
51 #include <sys/sysctl.h>
52 #include <sys/kmem.h>
53 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */
54 #include <sys/syscallargs.h>
55 #include <sys/kauth.h>
56 #include <sys/once.h>
57
58 /*
59 * Memory areas:
60 * 1st: Pool of semaphore identifiers
61 * 2nd: Semaphores
62 * 3rd: Conditional variables
63 * 4th: Undo structures
64 */
65 struct semid_ds * sema __read_mostly;
66 static struct __sem * sem __read_mostly;
67 static kcondvar_t * semcv __read_mostly;
68 static int * semu __read_mostly;
69
70 static kmutex_t semlock __cacheline_aligned;
71 static bool sem_realloc_state __read_mostly;
72 static kcondvar_t sem_realloc_cv;
73
74 /*
75 * List of active undo structures, total number of semaphores,
76 * and total number of semop waiters.
77 */
78 static struct sem_undo *semu_list __read_mostly;
79 static u_int semtot __cacheline_aligned;
80 static u_int sem_waiters __cacheline_aligned;
81
82 /* Macro to find a particular sem_undo vector */
83 #define SEMU(s, ix) ((struct sem_undo *)(((long)s) + ix * seminfo.semusz))
84
85 #ifdef SEM_DEBUG
86 #define SEM_PRINTF(a) printf a
87 #else
88 #define SEM_PRINTF(a)
89 #endif
90
91 void *hook; /* cookie from exithook_establish() */
92
93 extern int kern_has_sysvsem;
94
95 SYSCTL_SETUP_PROTO(sysctl_ipc_sem_setup);
96
97 struct sem_undo *semu_alloc(struct proc *);
98 int semundo_adjust(struct proc *, struct sem_undo **, int, int, int);
99 void semundo_clear(int, int);
100
101 static ONCE_DECL(exithook_control);
102 static int seminit_exithook(void);
103
104 int
seminit(void)105 seminit(void)
106 {
107 int i, sz;
108 vaddr_t v;
109
110 mutex_init(&semlock, MUTEX_DEFAULT, IPL_NONE);
111 cv_init(&sem_realloc_cv, "semrealc");
112 sem_realloc_state = false;
113 semtot = 0;
114 sem_waiters = 0;
115
116 /* Allocate the wired memory for our structures */
117 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
118 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
119 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
120 ALIGN(seminfo.semmnu * seminfo.semusz);
121 sz = round_page(sz);
122 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
123 if (v == 0) {
124 printf("sysv_sem: cannot allocate memory");
125 return ENOMEM;
126 }
127 sema = (void *)v;
128 sem = (void *)((uintptr_t)sema +
129 ALIGN(seminfo.semmni * sizeof(struct semid_ds)));
130 semcv = (void *)((uintptr_t)sem +
131 ALIGN(seminfo.semmns * sizeof(struct __sem)));
132 semu = (void *)((uintptr_t)semcv +
133 ALIGN(seminfo.semmni * sizeof(kcondvar_t)));
134
135 for (i = 0; i < seminfo.semmni; i++) {
136 sema[i]._sem_base = 0;
137 sema[i].sem_perm.mode = 0;
138 cv_init(&semcv[i], "semwait");
139 }
140 for (i = 0; i < seminfo.semmnu; i++) {
141 struct sem_undo *suptr = SEMU(semu, i);
142 suptr->un_proc = NULL;
143 }
144 semu_list = NULL;
145
146 kern_has_sysvsem = 1;
147
148 return 0;
149 }
150
151 static int
seminit_exithook(void)152 seminit_exithook(void)
153 {
154
155 hook = exithook_establish(semexit, NULL);
156 return 0;
157 }
158
159 int
semfini(void)160 semfini(void)
161 {
162 int i, sz;
163 vaddr_t v = (vaddr_t)sema;
164
165 /* Don't allow module unload if we're busy */
166 mutex_enter(&semlock);
167 if (semtot) {
168 mutex_exit(&semlock);
169 return 1;
170 }
171
172 /* Remove the exit hook */
173 if (hook)
174 exithook_disestablish(hook);
175
176 /* Destroy all our condvars */
177 for (i = 0; i < seminfo.semmni; i++) {
178 cv_destroy(&semcv[i]);
179 }
180
181 /* Free the wired memory that we allocated */
182 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
183 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
184 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
185 ALIGN(seminfo.semmnu * seminfo.semusz);
186 sz = round_page(sz);
187 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
188
189 /* Destroy the last cv and mutex */
190 cv_destroy(&sem_realloc_cv);
191 mutex_exit(&semlock);
192 mutex_destroy(&semlock);
193
194 kern_has_sysvsem = 0;
195
196 return 0;
197 }
198
199 static int
semrealloc(int newsemmni,int newsemmns,int newsemmnu)200 semrealloc(int newsemmni, int newsemmns, int newsemmnu)
201 {
202 struct semid_ds *new_sema, *old_sema;
203 struct __sem *new_sem;
204 struct sem_undo *new_semu_list, *suptr, *nsuptr;
205 int *new_semu;
206 kcondvar_t *new_semcv;
207 vaddr_t v;
208 int i, j, lsemid, nmnus, sz;
209
210 if (newsemmni < 1 || newsemmns < 1 || newsemmnu < 1)
211 return EINVAL;
212
213 /* Allocate the wired memory for our structures */
214 sz = ALIGN(newsemmni * sizeof(struct semid_ds)) +
215 ALIGN(newsemmns * sizeof(struct __sem)) +
216 ALIGN(newsemmni * sizeof(kcondvar_t)) +
217 ALIGN(newsemmnu * seminfo.semusz);
218 sz = round_page(sz);
219 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
220 if (v == 0)
221 return ENOMEM;
222
223 mutex_enter(&semlock);
224 if (sem_realloc_state) {
225 mutex_exit(&semlock);
226 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
227 return EBUSY;
228 }
229 sem_realloc_state = true;
230 if (sem_waiters) {
231 /*
232 * Mark reallocation state, wake-up all waiters,
233 * and wait while they will all exit.
234 */
235 for (i = 0; i < seminfo.semmni; i++)
236 cv_broadcast(&semcv[i]);
237 while (sem_waiters)
238 cv_wait(&sem_realloc_cv, &semlock);
239 }
240 old_sema = sema;
241
242 /* Get the number of last slot */
243 lsemid = 0;
244 for (i = 0; i < seminfo.semmni; i++)
245 if (sema[i].sem_perm.mode & SEM_ALLOC)
246 lsemid = i;
247
248 /* Get the number of currently used undo structures */
249 nmnus = 0;
250 for (i = 0; i < seminfo.semmnu; i++) {
251 suptr = SEMU(semu, i);
252 if (suptr->un_proc == NULL)
253 continue;
254 nmnus++;
255 }
256
257 /* We cannot reallocate less memory than we use */
258 if (lsemid >= newsemmni || semtot > newsemmns || nmnus > newsemmnu) {
259 mutex_exit(&semlock);
260 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
261 return EBUSY;
262 }
263
264 new_sema = (void *)v;
265 new_sem = (void *)((uintptr_t)new_sema +
266 ALIGN(newsemmni * sizeof(struct semid_ds)));
267 new_semcv = (void *)((uintptr_t)new_sem +
268 ALIGN(newsemmns * sizeof(struct __sem)));
269 new_semu = (void *)((uintptr_t)new_semcv +
270 ALIGN(newsemmni * sizeof(kcondvar_t)));
271
272 /* Initialize all semaphore identifiers and condvars */
273 for (i = 0; i < newsemmni; i++) {
274 new_sema[i]._sem_base = 0;
275 new_sema[i].sem_perm.mode = 0;
276 cv_init(&new_semcv[i], "semwait");
277 }
278 for (i = 0; i < newsemmnu; i++) {
279 nsuptr = SEMU(new_semu, i);
280 nsuptr->un_proc = NULL;
281 }
282
283 /*
284 * Copy all identifiers, semaphores and list of the
285 * undo structures to the new memory allocation.
286 */
287 j = 0;
288 for (i = 0; i <= lsemid; i++) {
289 if ((sema[i].sem_perm.mode & SEM_ALLOC) == 0)
290 continue;
291 memcpy(&new_sema[i], &sema[i], sizeof(struct semid_ds));
292 new_sema[i]._sem_base = &new_sem[j];
293 memcpy(new_sema[i]._sem_base, sema[i]._sem_base,
294 (sizeof(struct __sem) * sema[i].sem_nsems));
295 j += sema[i].sem_nsems;
296 }
297 KASSERT(j == semtot);
298
299 j = 0;
300 new_semu_list = NULL;
301 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) {
302 KASSERT(j < newsemmnu);
303 nsuptr = SEMU(new_semu, j);
304 memcpy(nsuptr, suptr, SEMUSZ);
305 nsuptr->un_next = new_semu_list;
306 new_semu_list = nsuptr;
307 j++;
308 }
309
310 for (i = 0; i < seminfo.semmni; i++) {
311 KASSERT(cv_has_waiters(&semcv[i]) == false);
312 cv_destroy(&semcv[i]);
313 }
314
315 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
316 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
317 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
318 ALIGN(seminfo.semmnu * seminfo.semusz);
319 sz = round_page(sz);
320
321 /* Set the pointers and update the new values */
322 sema = new_sema;
323 sem = new_sem;
324 semcv = new_semcv;
325 semu = new_semu;
326 semu_list = new_semu_list;
327
328 seminfo.semmni = newsemmni;
329 seminfo.semmns = newsemmns;
330 seminfo.semmnu = newsemmnu;
331
332 /* Reallocation completed - notify all waiters, if any */
333 sem_realloc_state = false;
334 cv_broadcast(&sem_realloc_cv);
335 mutex_exit(&semlock);
336
337 uvm_km_free(kernel_map, (vaddr_t)old_sema, sz, UVM_KMF_WIRED);
338 return 0;
339 }
340
341 /*
342 * Placebo.
343 */
344
345 int
sys_semconfig(struct lwp * l,const struct sys_semconfig_args * uap,register_t * retval)346 sys_semconfig(struct lwp *l, const struct sys_semconfig_args *uap, register_t *retval)
347 {
348
349 RUN_ONCE(&exithook_control, seminit_exithook);
350
351 *retval = 0;
352 return 0;
353 }
354
355 /*
356 * Allocate a new sem_undo structure for a process.
357 * => Returns NULL on failure.
358 */
359 struct sem_undo *
semu_alloc(struct proc * p)360 semu_alloc(struct proc *p)
361 {
362 struct sem_undo *suptr, **supptr;
363 bool attempted = false;
364 int i;
365
366 KASSERT(mutex_owned(&semlock));
367 again:
368 /* Look for a free structure. */
369 for (i = 0; i < seminfo.semmnu; i++) {
370 suptr = SEMU(semu, i);
371 if (suptr->un_proc == NULL) {
372 /* Found. Fill it in and return. */
373 suptr->un_next = semu_list;
374 semu_list = suptr;
375 suptr->un_cnt = 0;
376 suptr->un_proc = p;
377 return suptr;
378 }
379 }
380
381 /* Not found. Attempt to free some structures. */
382 if (!attempted) {
383 bool freed = false;
384
385 attempted = true;
386 supptr = &semu_list;
387 while ((suptr = *supptr) != NULL) {
388 if (suptr->un_cnt == 0) {
389 suptr->un_proc = NULL;
390 *supptr = suptr->un_next;
391 freed = true;
392 } else {
393 supptr = &suptr->un_next;
394 }
395 }
396 if (freed) {
397 goto again;
398 }
399 }
400 return NULL;
401 }
402
403 /*
404 * Adjust a particular entry for a particular proc
405 */
406
407 int
semundo_adjust(struct proc * p,struct sem_undo ** supptr,int semid,int semnum,int adjval)408 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum,
409 int adjval)
410 {
411 struct sem_undo *suptr;
412 struct sem_undo_entry *sunptr;
413 int i;
414
415 KASSERT(mutex_owned(&semlock));
416
417 /*
418 * Look for and remember the sem_undo if the caller doesn't
419 * provide it
420 */
421
422 suptr = *supptr;
423 if (suptr == NULL) {
424 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
425 if (suptr->un_proc == p)
426 break;
427
428 if (suptr == NULL) {
429 suptr = semu_alloc(p);
430 if (suptr == NULL)
431 return (ENOSPC);
432 }
433 *supptr = suptr;
434 }
435
436 /*
437 * Look for the requested entry and adjust it (delete if
438 * adjval becomes 0).
439 */
440 sunptr = &suptr->un_ent[0];
441 for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
442 if (sunptr->un_id != semid || sunptr->un_num != semnum)
443 continue;
444 sunptr->un_adjval += adjval;
445 if (sunptr->un_adjval == 0) {
446 suptr->un_cnt--;
447 if (i < suptr->un_cnt)
448 suptr->un_ent[i] =
449 suptr->un_ent[suptr->un_cnt];
450 }
451 return (0);
452 }
453
454 /* Didn't find the right entry - create it */
455 if (suptr->un_cnt == SEMUME)
456 return (EINVAL);
457
458 sunptr = &suptr->un_ent[suptr->un_cnt];
459 suptr->un_cnt++;
460 sunptr->un_adjval = adjval;
461 sunptr->un_id = semid;
462 sunptr->un_num = semnum;
463 return (0);
464 }
465
466 void
semundo_clear(int semid,int semnum)467 semundo_clear(int semid, int semnum)
468 {
469 struct sem_undo *suptr;
470 struct sem_undo_entry *sunptr, *sunend;
471
472 KASSERT(mutex_owned(&semlock));
473
474 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
475 for (sunptr = &suptr->un_ent[0],
476 sunend = sunptr + suptr->un_cnt; sunptr < sunend;) {
477 if (sunptr->un_id == semid) {
478 if (semnum == -1 || sunptr->un_num == semnum) {
479 suptr->un_cnt--;
480 sunend--;
481 if (sunptr != sunend)
482 *sunptr = *sunend;
483 if (semnum != -1)
484 break;
485 else
486 continue;
487 }
488 }
489 sunptr++;
490 }
491 }
492
493 int
sys_____semctl50(struct lwp * l,const struct sys_____semctl50_args * uap,register_t * retval)494 sys_____semctl50(struct lwp *l, const struct sys_____semctl50_args *uap,
495 register_t *retval)
496 {
497 /* {
498 syscallarg(int) semid;
499 syscallarg(int) semnum;
500 syscallarg(int) cmd;
501 syscallarg(union __semun *) arg;
502 } */
503 struct semid_ds sembuf;
504 int cmd, error;
505 void *pass_arg;
506 union __semun karg;
507
508 RUN_ONCE(&exithook_control, seminit_exithook);
509
510 cmd = SCARG(uap, cmd);
511
512 pass_arg = get_semctl_arg(cmd, &sembuf, &karg);
513
514 if (pass_arg) {
515 error = copyin(SCARG(uap, arg), &karg, sizeof(karg));
516 if (error)
517 return error;
518 if (cmd == IPC_SET) {
519 error = copyin(karg.buf, &sembuf, sizeof(sembuf));
520 if (error)
521 return (error);
522 }
523 }
524
525 error = semctl1(l, SCARG(uap, semid), SCARG(uap, semnum), cmd,
526 pass_arg, retval);
527
528 if (error == 0 && cmd == IPC_STAT)
529 error = copyout(&sembuf, karg.buf, sizeof(sembuf));
530
531 return (error);
532 }
533
534 int
semctl1(struct lwp * l,int semid,int semnum,int cmd,void * v,register_t * retval)535 semctl1(struct lwp *l, int semid, int semnum, int cmd, void *v,
536 register_t *retval)
537 {
538 kauth_cred_t cred = l->l_cred;
539 union __semun *arg = v;
540 struct semid_ds *sembuf = v, *semaptr;
541 int i, error, ix;
542
543 SEM_PRINTF(("call to semctl(%d, %d, %d, %p)\n",
544 semid, semnum, cmd, v));
545
546 mutex_enter(&semlock);
547
548 ix = IPCID_TO_IX(semid);
549 if (ix < 0 || ix >= seminfo.semmni) {
550 mutex_exit(&semlock);
551 return (EINVAL);
552 }
553
554 semaptr = &sema[ix];
555 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
556 semaptr->sem_perm._seq != IPCID_TO_SEQ(semid)) {
557 mutex_exit(&semlock);
558 return (EINVAL);
559 }
560
561 switch (cmd) {
562 case IPC_RMID:
563 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)) != 0)
564 break;
565 semaptr->sem_perm.cuid = kauth_cred_geteuid(cred);
566 semaptr->sem_perm.uid = kauth_cred_geteuid(cred);
567 semtot -= semaptr->sem_nsems;
568 for (i = semaptr->_sem_base - sem; i < semtot; i++)
569 sem[i] = sem[i + semaptr->sem_nsems];
570 for (i = 0; i < seminfo.semmni; i++) {
571 if ((sema[i].sem_perm.mode & SEM_ALLOC) &&
572 sema[i]._sem_base > semaptr->_sem_base)
573 sema[i]._sem_base -= semaptr->sem_nsems;
574 }
575 semaptr->sem_perm.mode = 0;
576 semundo_clear(ix, -1);
577 cv_broadcast(&semcv[ix]);
578 break;
579
580 case IPC_SET:
581 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)))
582 break;
583 KASSERT(sembuf != NULL);
584 semaptr->sem_perm.uid = sembuf->sem_perm.uid;
585 semaptr->sem_perm.gid = sembuf->sem_perm.gid;
586 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) |
587 (sembuf->sem_perm.mode & 0777);
588 semaptr->sem_ctime = time_second;
589 break;
590
591 case IPC_STAT:
592 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
593 break;
594 KASSERT(sembuf != NULL);
595 memset(sembuf, 0, sizeof *sembuf);
596 sembuf->sem_perm = semaptr->sem_perm;
597 sembuf->sem_perm.mode &= 0777;
598 sembuf->sem_nsems = semaptr->sem_nsems;
599 sembuf->sem_otime = semaptr->sem_otime;
600 sembuf->sem_ctime = semaptr->sem_ctime;
601 break;
602
603 case GETNCNT:
604 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
605 break;
606 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
607 error = EINVAL;
608 break;
609 }
610 *retval = semaptr->_sem_base[semnum].semncnt;
611 break;
612
613 case GETPID:
614 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
615 break;
616 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
617 error = EINVAL;
618 break;
619 }
620 *retval = semaptr->_sem_base[semnum].sempid;
621 break;
622
623 case GETVAL:
624 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
625 break;
626 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
627 error = EINVAL;
628 break;
629 }
630 *retval = semaptr->_sem_base[semnum].semval;
631 break;
632
633 case GETALL:
634 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
635 break;
636 KASSERT(arg != NULL);
637 for (i = 0; i < semaptr->sem_nsems; i++) {
638 error = copyout(&semaptr->_sem_base[i].semval,
639 &arg->array[i], sizeof(arg->array[i]));
640 if (error != 0)
641 break;
642 }
643 break;
644
645 case GETZCNT:
646 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
647 break;
648 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
649 error = EINVAL;
650 break;
651 }
652 *retval = semaptr->_sem_base[semnum].semzcnt;
653 break;
654
655 case SETVAL:
656 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
657 break;
658 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
659 error = EINVAL;
660 break;
661 }
662 KASSERT(arg != NULL);
663 if ((unsigned int)arg->val > seminfo.semvmx) {
664 error = ERANGE;
665 break;
666 }
667 semaptr->_sem_base[semnum].semval = arg->val;
668 semundo_clear(ix, semnum);
669 cv_broadcast(&semcv[ix]);
670 break;
671
672 case SETALL:
673 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
674 break;
675 KASSERT(arg != NULL);
676 for (i = 0; i < semaptr->sem_nsems; i++) {
677 unsigned short semval;
678 error = copyin(&arg->array[i], &semval,
679 sizeof(arg->array[i]));
680 if (error != 0)
681 break;
682 if ((unsigned int)semval > seminfo.semvmx) {
683 error = ERANGE;
684 break;
685 }
686 semaptr->_sem_base[i].semval = semval;
687 }
688 semundo_clear(ix, -1);
689 cv_broadcast(&semcv[ix]);
690 break;
691
692 default:
693 error = EINVAL;
694 break;
695 }
696
697 mutex_exit(&semlock);
698 return (error);
699 }
700
701 int
sys_semget(struct lwp * l,const struct sys_semget_args * uap,register_t * retval)702 sys_semget(struct lwp *l, const struct sys_semget_args *uap, register_t *retval)
703 {
704 /* {
705 syscallarg(key_t) key;
706 syscallarg(int) nsems;
707 syscallarg(int) semflg;
708 } */
709 int semid, error = 0;
710 int key = SCARG(uap, key);
711 int nsems = SCARG(uap, nsems);
712 int semflg = SCARG(uap, semflg);
713 kauth_cred_t cred = l->l_cred;
714
715 RUN_ONCE(&exithook_control, seminit_exithook);
716
717 SEM_PRINTF(("semget(0x%x, %d, 0%o)\n", key, nsems, semflg));
718
719 mutex_enter(&semlock);
720
721 if (key != IPC_PRIVATE) {
722 for (semid = 0; semid < seminfo.semmni; semid++) {
723 if ((sema[semid].sem_perm.mode & SEM_ALLOC) &&
724 sema[semid].sem_perm._key == key)
725 break;
726 }
727 if (semid < seminfo.semmni) {
728 SEM_PRINTF(("found public key\n"));
729 if ((error = ipcperm(cred, &sema[semid].sem_perm,
730 semflg & 0700)))
731 goto out;
732 if (nsems > 0 && sema[semid].sem_nsems < nsems) {
733 SEM_PRINTF(("too small\n"));
734 error = EINVAL;
735 goto out;
736 }
737 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) {
738 SEM_PRINTF(("not exclusive\n"));
739 error = EEXIST;
740 goto out;
741 }
742 goto found;
743 }
744 }
745
746 SEM_PRINTF(("need to allocate the semid_ds\n"));
747 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) {
748 if (nsems <= 0 || nsems > seminfo.semmsl) {
749 SEM_PRINTF(("nsems out of range (0<%d<=%d)\n", nsems,
750 seminfo.semmsl));
751 error = EINVAL;
752 goto out;
753 }
754 if (nsems > seminfo.semmns - semtot) {
755 SEM_PRINTF(("not enough semaphores left "
756 "(need %d, got %d)\n",
757 nsems, seminfo.semmns - semtot));
758 error = ENOSPC;
759 goto out;
760 }
761 for (semid = 0; semid < seminfo.semmni; semid++) {
762 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0)
763 break;
764 }
765 if (semid == seminfo.semmni) {
766 SEM_PRINTF(("no more semid_ds's available\n"));
767 error = ENOSPC;
768 goto out;
769 }
770 SEM_PRINTF(("semid %d is available\n", semid));
771 sema[semid].sem_perm._key = key;
772 sema[semid].sem_perm.cuid = kauth_cred_geteuid(cred);
773 sema[semid].sem_perm.uid = kauth_cred_geteuid(cred);
774 sema[semid].sem_perm.cgid = kauth_cred_getegid(cred);
775 sema[semid].sem_perm.gid = kauth_cred_getegid(cred);
776 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
777 sema[semid].sem_perm._seq =
778 (sema[semid].sem_perm._seq + 1) & 0x7fff;
779 sema[semid].sem_nsems = nsems;
780 sema[semid].sem_otime = 0;
781 sema[semid].sem_ctime = time_second;
782 sema[semid]._sem_base = &sem[semtot];
783 semtot += nsems;
784 memset(sema[semid]._sem_base, 0,
785 sizeof(sema[semid]._sem_base[0]) * nsems);
786 SEM_PRINTF(("sembase = %p, next = %p\n", sema[semid]._sem_base,
787 &sem[semtot]));
788 } else {
789 SEM_PRINTF(("didn't find it and wasn't asked to create it\n"));
790 error = ENOENT;
791 goto out;
792 }
793
794 found:
795 *retval = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm);
796 out:
797 mutex_exit(&semlock);
798 return (error);
799 }
800
801 #define SMALL_SOPS 8
802
803 int
sys_semop(struct lwp * l,const struct sys_semop_args * uap,register_t * retval)804 sys_semop(struct lwp *l, const struct sys_semop_args *uap, register_t *retval)
805 {
806 /* {
807 syscallarg(int) semid;
808 syscallarg(struct sembuf *) sops;
809 syscallarg(size_t) nsops;
810 } */
811 struct proc *p = l->l_proc;
812 int semid = SCARG(uap, semid), seq;
813 size_t nsops = SCARG(uap, nsops);
814 struct sembuf small_sops[SMALL_SOPS];
815 struct sembuf *sops;
816 struct semid_ds *semaptr;
817 struct sembuf *sopptr = NULL;
818 struct __sem *semptr = NULL;
819 struct sem_undo *suptr = NULL;
820 kauth_cred_t cred = l->l_cred;
821 int i, error;
822 int do_wakeup, do_undos;
823
824 RUN_ONCE(&exithook_control, seminit_exithook);
825
826 SEM_PRINTF(("call to semop(%d, %p, %zd)\n", semid, SCARG(uap,sops), nsops));
827
828 if (__predict_false((p->p_flag & PK_SYSVSEM) == 0)) {
829 mutex_enter(p->p_lock);
830 p->p_flag |= PK_SYSVSEM;
831 mutex_exit(p->p_lock);
832 }
833
834 restart:
835 if (nsops <= SMALL_SOPS) {
836 sops = small_sops;
837 } else if (nsops <= seminfo.semopm) {
838 sops = kmem_alloc(nsops * sizeof(*sops), KM_SLEEP);
839 } else {
840 SEM_PRINTF(("too many sops (max=%d, nsops=%zd)\n",
841 seminfo.semopm, nsops));
842 return (E2BIG);
843 }
844
845 error = copyin(SCARG(uap, sops), sops, nsops * sizeof(sops[0]));
846 if (error) {
847 SEM_PRINTF(("error = %d from copyin(%p, %p, %zd)\n", error,
848 SCARG(uap, sops), &sops, nsops * sizeof(sops[0])));
849 if (sops != small_sops)
850 kmem_free(sops, nsops * sizeof(*sops));
851 return error;
852 }
853
854 mutex_enter(&semlock);
855 /* In case of reallocation, we will wait for completion */
856 while (__predict_false(sem_realloc_state))
857 cv_wait(&sem_realloc_cv, &semlock);
858
859 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */
860 if (semid < 0 || semid >= seminfo.semmni) {
861 error = EINVAL;
862 goto out;
863 }
864
865 semaptr = &sema[semid];
866 seq = IPCID_TO_SEQ(SCARG(uap, semid));
867 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
868 semaptr->sem_perm._seq != seq) {
869 error = EINVAL;
870 goto out;
871 }
872
873 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W))) {
874 SEM_PRINTF(("error = %d from ipaccess\n", error));
875 goto out;
876 }
877
878 for (i = 0; i < nsops; i++)
879 if (sops[i].sem_num >= semaptr->sem_nsems) {
880 error = EFBIG;
881 goto out;
882 }
883
884 /*
885 * Loop trying to satisfy the vector of requests.
886 * If we reach a point where we must wait, any requests already
887 * performed are rolled back and we go to sleep until some other
888 * process wakes us up. At this point, we start all over again.
889 *
890 * This ensures that from the perspective of other tasks, a set
891 * of requests is atomic (never partially satisfied).
892 */
893 do_undos = 0;
894
895 for (;;) {
896 do_wakeup = 0;
897
898 for (i = 0; i < nsops; i++) {
899 sopptr = &sops[i];
900 semptr = &semaptr->_sem_base[sopptr->sem_num];
901
902 SEM_PRINTF(("semop: semaptr=%p, sem_base=%p, "
903 "semptr=%p, sem[%d]=%d : op=%d, flag=%s\n",
904 semaptr, semaptr->_sem_base, semptr,
905 sopptr->sem_num, semptr->semval, sopptr->sem_op,
906 (sopptr->sem_flg & IPC_NOWAIT) ?
907 "nowait" : "wait"));
908
909 if (sopptr->sem_op < 0) {
910 if ((int)(semptr->semval +
911 sopptr->sem_op) < 0) {
912 SEM_PRINTF(("semop: "
913 "can't do it now\n"));
914 break;
915 } else {
916 semptr->semval += sopptr->sem_op;
917 if (semptr->semval == 0 &&
918 semptr->semzcnt > 0)
919 do_wakeup = 1;
920 }
921 if (sopptr->sem_flg & SEM_UNDO)
922 do_undos = 1;
923 } else if (sopptr->sem_op == 0) {
924 if (semptr->semval > 0) {
925 SEM_PRINTF(("semop: not zero now\n"));
926 break;
927 }
928 } else {
929 if (semptr->semncnt > 0)
930 do_wakeup = 1;
931 semptr->semval += sopptr->sem_op;
932 if (sopptr->sem_flg & SEM_UNDO)
933 do_undos = 1;
934 }
935 }
936
937 /*
938 * Did we get through the entire vector?
939 */
940 if (i >= nsops)
941 goto done;
942
943 /*
944 * No ... rollback anything that we've already done
945 */
946 SEM_PRINTF(("semop: rollback 0 through %d\n", i - 1));
947 while (i-- > 0)
948 semaptr->_sem_base[sops[i].sem_num].semval -=
949 sops[i].sem_op;
950
951 /*
952 * If the request that we couldn't satisfy has the
953 * NOWAIT flag set then return with EAGAIN.
954 */
955 if (sopptr->sem_flg & IPC_NOWAIT) {
956 error = EAGAIN;
957 goto out;
958 }
959
960 if (sopptr->sem_op == 0)
961 semptr->semzcnt++;
962 else
963 semptr->semncnt++;
964
965 sem_waiters++;
966 SEM_PRINTF(("semop: good night!\n"));
967 error = cv_wait_sig(&semcv[semid], &semlock);
968 SEM_PRINTF(("semop: good morning (error=%d)!\n", error));
969 sem_waiters--;
970
971 /* Notify reallocator, if it is waiting */
972 cv_broadcast(&sem_realloc_cv);
973
974 /*
975 * Make sure that the semaphore still exists
976 */
977 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
978 semaptr->sem_perm._seq != seq) {
979 error = EIDRM;
980 goto out;
981 }
982
983 /*
984 * The semaphore is still alive. Readjust the count of
985 * waiting processes.
986 */
987 semptr = &semaptr->_sem_base[sopptr->sem_num];
988 if (sopptr->sem_op == 0)
989 semptr->semzcnt--;
990 else
991 semptr->semncnt--;
992
993 /* In case of such state, restart the call */
994 if (sem_realloc_state) {
995 mutex_exit(&semlock);
996 goto restart;
997 }
998
999 /* Is it really morning, or was our sleep interrupted? */
1000 if (error != 0) {
1001 error = EINTR;
1002 goto out;
1003 }
1004 SEM_PRINTF(("semop: good morning!\n"));
1005 }
1006
1007 done:
1008 /*
1009 * Process any SEM_UNDO requests.
1010 */
1011 if (do_undos) {
1012 for (i = 0; i < nsops; i++) {
1013 /*
1014 * We only need to deal with SEM_UNDO's for non-zero
1015 * op's.
1016 */
1017 int adjval;
1018
1019 if ((sops[i].sem_flg & SEM_UNDO) == 0)
1020 continue;
1021 adjval = sops[i].sem_op;
1022 if (adjval == 0)
1023 continue;
1024 error = semundo_adjust(p, &suptr, semid,
1025 sops[i].sem_num, -adjval);
1026 if (error == 0)
1027 continue;
1028
1029 /*
1030 * Oh-Oh! We ran out of either sem_undo's or undo's.
1031 * Rollback the adjustments to this point and then
1032 * rollback the semaphore ups and down so we can return
1033 * with an error with all structures restored. We
1034 * rollback the undo's in the exact reverse order that
1035 * we applied them. This guarantees that we won't run
1036 * out of space as we roll things back out.
1037 */
1038 while (i-- > 0) {
1039 if ((sops[i].sem_flg & SEM_UNDO) == 0)
1040 continue;
1041 adjval = sops[i].sem_op;
1042 if (adjval == 0)
1043 continue;
1044 if (semundo_adjust(p, &suptr, semid,
1045 sops[i].sem_num, adjval) != 0)
1046 panic("semop - can't undo undos");
1047 }
1048
1049 for (i = 0; i < nsops; i++)
1050 semaptr->_sem_base[sops[i].sem_num].semval -=
1051 sops[i].sem_op;
1052
1053 SEM_PRINTF(("error = %d from semundo_adjust\n", error));
1054 goto out;
1055 } /* loop through the sops */
1056 } /* if (do_undos) */
1057
1058 /* We're definitely done - set the sempid's */
1059 for (i = 0; i < nsops; i++) {
1060 sopptr = &sops[i];
1061 semptr = &semaptr->_sem_base[sopptr->sem_num];
1062 semptr->sempid = p->p_pid;
1063 }
1064
1065 /* Update sem_otime */
1066 semaptr->sem_otime = time_second;
1067
1068 /* Do a wakeup if any semaphore was up'd. */
1069 if (do_wakeup) {
1070 SEM_PRINTF(("semop: doing wakeup\n"));
1071 cv_broadcast(&semcv[semid]);
1072 SEM_PRINTF(("semop: back from wakeup\n"));
1073 }
1074 SEM_PRINTF(("semop: done\n"));
1075 *retval = 0;
1076
1077 out:
1078 mutex_exit(&semlock);
1079 if (sops != small_sops)
1080 kmem_free(sops, nsops * sizeof(*sops));
1081 return error;
1082 }
1083
1084 /*
1085 * Go through the undo structures for this process and apply the
1086 * adjustments to semaphores.
1087 */
1088 /*ARGSUSED*/
1089 void
semexit(struct proc * p,void * v)1090 semexit(struct proc *p, void *v)
1091 {
1092 struct sem_undo *suptr;
1093 struct sem_undo **supptr;
1094
1095 if ((p->p_flag & PK_SYSVSEM) == 0)
1096 return;
1097
1098 mutex_enter(&semlock);
1099
1100 /*
1101 * Go through the chain of undo vectors looking for one
1102 * associated with this process.
1103 */
1104
1105 for (supptr = &semu_list; (suptr = *supptr) != NULL;
1106 supptr = &suptr->un_next) {
1107 if (suptr->un_proc == p)
1108 break;
1109 }
1110
1111 /*
1112 * If there is no undo vector, skip to the end.
1113 */
1114
1115 if (suptr == NULL) {
1116 mutex_exit(&semlock);
1117 return;
1118 }
1119
1120 /*
1121 * We now have an undo vector for this process.
1122 */
1123
1124 SEM_PRINTF(("proc @%p has undo structure with %d entries\n", p,
1125 suptr->un_cnt));
1126
1127 /*
1128 * If there are any active undo elements then process them.
1129 */
1130 if (suptr->un_cnt > 0) {
1131 int ix;
1132
1133 for (ix = 0; ix < suptr->un_cnt; ix++) {
1134 int semid = suptr->un_ent[ix].un_id;
1135 int semnum = suptr->un_ent[ix].un_num;
1136 int adjval = suptr->un_ent[ix].un_adjval;
1137 struct semid_ds *semaptr;
1138
1139 semaptr = &sema[semid];
1140 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0)
1141 if (semnum >= semaptr->sem_nsems)
1142 panic("semexit - semnum out of range");
1143
1144 SEM_PRINTF(("semexit: %p id=%d num=%d(adj=%d) ; "
1145 "sem=%d\n",
1146 suptr->un_proc, suptr->un_ent[ix].un_id,
1147 suptr->un_ent[ix].un_num,
1148 suptr->un_ent[ix].un_adjval,
1149 semaptr->_sem_base[semnum].semval));
1150
1151 if (adjval < 0 &&
1152 semaptr->_sem_base[semnum].semval < -adjval)
1153 semaptr->_sem_base[semnum].semval = 0;
1154 else
1155 semaptr->_sem_base[semnum].semval += adjval;
1156
1157 cv_broadcast(&semcv[semid]);
1158 SEM_PRINTF(("semexit: back from wakeup\n"));
1159 }
1160 }
1161
1162 /*
1163 * Deallocate the undo vector.
1164 */
1165 SEM_PRINTF(("removing vector\n"));
1166 suptr->un_proc = NULL;
1167 *supptr = suptr->un_next;
1168 mutex_exit(&semlock);
1169 }
1170
1171 /*
1172 * Sysctl initialization and nodes.
1173 */
1174
1175 static int
sysctl_ipc_semmni(SYSCTLFN_ARGS)1176 sysctl_ipc_semmni(SYSCTLFN_ARGS)
1177 {
1178 int newsize, error;
1179 struct sysctlnode node;
1180 node = *rnode;
1181 node.sysctl_data = &newsize;
1182
1183 newsize = seminfo.semmni;
1184 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1185 if (error || newp == NULL)
1186 return error;
1187
1188 return semrealloc(newsize, seminfo.semmns, seminfo.semmnu);
1189 }
1190
1191 static int
sysctl_ipc_semmns(SYSCTLFN_ARGS)1192 sysctl_ipc_semmns(SYSCTLFN_ARGS)
1193 {
1194 int newsize, error;
1195 struct sysctlnode node;
1196 node = *rnode;
1197 node.sysctl_data = &newsize;
1198
1199 newsize = seminfo.semmns;
1200 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1201 if (error || newp == NULL)
1202 return error;
1203
1204 return semrealloc(seminfo.semmni, newsize, seminfo.semmnu);
1205 }
1206
1207 static int
sysctl_ipc_semmnu(SYSCTLFN_ARGS)1208 sysctl_ipc_semmnu(SYSCTLFN_ARGS)
1209 {
1210 int newsize, error;
1211 struct sysctlnode node;
1212 node = *rnode;
1213 node.sysctl_data = &newsize;
1214
1215 newsize = seminfo.semmnu;
1216 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1217 if (error || newp == NULL)
1218 return error;
1219
1220 return semrealloc(seminfo.semmni, seminfo.semmns, newsize);
1221 }
1222
1223 SYSCTL_SETUP(sysctl_ipc_sem_setup, "sysctl kern.ipc subtree setup")
1224 {
1225 const struct sysctlnode *node = NULL;
1226
1227 sysctl_createv(clog, 0, NULL, &node,
1228 CTLFLAG_PERMANENT,
1229 CTLTYPE_NODE, "ipc",
1230 SYSCTL_DESCR("SysV IPC options"),
1231 NULL, 0, NULL, 0,
1232 CTL_KERN, KERN_SYSVIPC, CTL_EOL);
1233
1234 if (node == NULL)
1235 return;
1236
1237 sysctl_createv(clog, 0, &node, NULL,
1238 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1239 CTLTYPE_INT, "semmni",
1240 SYSCTL_DESCR("Max number of number of semaphore identifiers"),
1241 sysctl_ipc_semmni, 0, &seminfo.semmni, 0,
1242 CTL_CREATE, CTL_EOL);
1243 sysctl_createv(clog, 0, &node, NULL,
1244 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1245 CTLTYPE_INT, "semmns",
1246 SYSCTL_DESCR("Max number of number of semaphores in system"),
1247 sysctl_ipc_semmns, 0, &seminfo.semmns, 0,
1248 CTL_CREATE, CTL_EOL);
1249 sysctl_createv(clog, 0, &node, NULL,
1250 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1251 CTLTYPE_INT, "semmnu",
1252 SYSCTL_DESCR("Max number of undo structures in system"),
1253 sysctl_ipc_semmnu, 0, &seminfo.semmnu, 0,
1254 CTL_CREATE, CTL_EOL);
1255 }
1256