1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/sem.h> 19 #include <sys/sysent.h> 20 #include <sys/sysctl.h> 21 #include <sys/malloc.h> 22 #include <sys/jail.h> 23 #include <sys/thread.h> 24 25 #include <sys/thread2.h> 26 27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29 static void seminit (void *); 30 31 static struct sem_undo *semu_alloc (struct proc *p); 32 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 33 int semid, int semnum, int adjval); 34 static void semundo_clear (int semid, int semnum); 35 36 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 37 static sy_call_t *semcalls[] = { 38 (sy_call_t *)sys___semctl, (sy_call_t *)sys_semget, 39 (sy_call_t *)sys_semop 40 }; 41 42 static int semtot = 0; 43 static struct semid_ds *sema; /* semaphore id pool */ 44 static struct sem *sem; /* semaphore pool */ 45 static struct sem_undo *semu_list; /* list of active undo structures */ 46 static int *semu; /* undo structure pool */ 47 48 struct sem { 49 u_short semval; /* semaphore value */ 50 pid_t sempid; /* pid of last operation */ 51 u_short semncnt; /* # awaiting semval > cval */ 52 u_short semzcnt; /* # awaiting semval = 0 */ 53 }; 54 55 /* 56 * Undo structure (one per process) 57 */ 58 struct sem_undo { 59 struct sem_undo *un_next; /* ptr to next active undo structure */ 60 struct proc *un_proc; /* owner of this structure */ 61 short un_cnt; /* # of active entries */ 62 struct undo { 63 short un_adjval; /* adjust on exit values */ 64 short un_num; /* semaphore # */ 65 int un_id; /* semid */ 66 } un_ent[1]; /* undo entries */ 67 }; 68 69 /* 70 * Configuration parameters 71 */ 72 #ifndef SEMMNI 73 #define SEMMNI 22 /* # of semaphore identifiers */ 74 #endif 75 #ifndef SEMMNS 76 #define SEMMNS 341 /* # of semaphores in system */ 77 #endif 78 #ifndef SEMUME 79 #define SEMUME 10 /* max # of undo entries per process */ 80 #endif 81 #ifndef SEMMNU 82 #define SEMMNU 30 /* # of undo structures in system */ 83 #endif 84 85 /* shouldn't need tuning */ 86 #ifndef SEMMAP 87 #define SEMMAP 30 /* # of entries in semaphore map */ 88 #endif 89 #ifndef SEMMSL 90 #define SEMMSL SEMMNS /* max # of semaphores per id */ 91 #endif 92 #ifndef SEMOPM 93 #define SEMOPM 100 /* max # of operations per semop call */ 94 #endif 95 96 #define SEMVMX 32767 /* semaphore maximum value */ 97 #define SEMAEM 16384 /* adjust on exit max value */ 98 99 /* 100 * Due to the way semaphore memory is allocated, we have to ensure that 101 * SEMUSZ is properly aligned. 102 */ 103 104 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 105 106 /* actual size of an undo structure */ 107 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 108 109 /* 110 * Macro to find a particular sem_undo vector 111 */ 112 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 113 114 /* 115 * semaphore info struct 116 */ 117 struct seminfo seminfo = { 118 SEMMAP, /* # of entries in semaphore map */ 119 SEMMNI, /* # of semaphore identifiers */ 120 SEMMNS, /* # of semaphores in system */ 121 SEMMNU, /* # of undo structures in system */ 122 SEMMSL, /* max # of semaphores per id */ 123 SEMOPM, /* max # of operations per semop call */ 124 SEMUME, /* max # of undo entries per process */ 125 SEMUSZ, /* size in bytes of undo structure */ 126 SEMVMX, /* semaphore maximum value */ 127 SEMAEM /* adjust on exit max value */ 128 }; 129 130 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 131 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 132 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 133 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 134 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 135 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 136 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 137 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 138 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 139 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 140 141 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, 142 "Number of entries in semaphore map"); 143 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, 144 "Number of semaphore identifiers"); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, 146 "Total number of semaphores"); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, 148 "Total number of undo structures"); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, 150 "Max number of semaphores per id"); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, 152 "Max number of operations per semop call"); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, 154 "Max number of undo entries per process"); 155 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, 156 "Size in bytes of undo structure"); 157 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, 158 "Semaphore maximum value"); 159 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, 160 "Adjust on exit max value"); 161 162 #if 0 163 RO seminfo.semmap /* SEMMAP unused */ 164 RO seminfo.semmni 165 RO seminfo.semmns 166 RO seminfo.semmnu /* undo entries per system */ 167 RW seminfo.semmsl 168 RO seminfo.semopm /* SEMOPM unused */ 169 RO seminfo.semume 170 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 171 RO seminfo.semvmx /* SEMVMX unused - user param */ 172 RO seminfo.semaem /* SEMAEM unused - user param */ 173 #endif 174 175 static void 176 seminit(void *dummy) 177 { 178 int i; 179 180 sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 181 sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 182 semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 183 184 for (i = 0; i < seminfo.semmni; i++) { 185 sema[i].sem_base = 0; 186 sema[i].sem_perm.mode = 0; 187 } 188 for (i = 0; i < seminfo.semmnu; i++) { 189 struct sem_undo *suptr = SEMU(i); 190 suptr->un_proc = NULL; 191 } 192 semu_list = NULL; 193 } 194 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 195 196 /* 197 * Entry point for all SEM calls 198 * 199 * semsys_args(int which, a2, a3, ...) (VARARGS) 200 * 201 * MPALMOSTSAFE 202 */ 203 int 204 sys_semsys(struct semsys_args *uap) 205 { 206 struct thread *td = curthread; 207 unsigned int which = (unsigned int)uap->which; 208 int error; 209 210 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 211 return (ENOSYS); 212 213 if (which >= NELEM(semcalls)) 214 return (EINVAL); 215 bcopy(&uap->a2, &uap->which, 216 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 217 error = (*semcalls[which])(uap); 218 return (error); 219 } 220 221 /* 222 * Allocate a new sem_undo structure for a process 223 * (returns ptr to structure or NULL if no more room) 224 */ 225 226 static struct sem_undo * 227 semu_alloc(struct proc *p) 228 { 229 int i; 230 struct sem_undo *suptr; 231 struct sem_undo **supptr; 232 int attempt; 233 234 /* 235 * Try twice to allocate something. 236 * (we'll purge any empty structures after the first pass so 237 * two passes are always enough) 238 */ 239 240 for (attempt = 0; attempt < 2; attempt++) { 241 /* 242 * Look for a free structure. 243 * Fill it in and return it if we find one. 244 */ 245 246 for (i = 0; i < seminfo.semmnu; i++) { 247 suptr = SEMU(i); 248 if (suptr->un_proc == NULL) { 249 suptr->un_next = semu_list; 250 semu_list = suptr; 251 suptr->un_cnt = 0; 252 suptr->un_proc = p; 253 return(suptr); 254 } 255 } 256 257 /* 258 * We didn't find a free one, if this is the first attempt 259 * then try to free some structures. 260 */ 261 262 if (attempt == 0) { 263 /* All the structures are in use - try to free some */ 264 int did_something = 0; 265 266 supptr = &semu_list; 267 while ((suptr = *supptr) != NULL) { 268 if (suptr->un_cnt == 0) { 269 suptr->un_proc = NULL; 270 *supptr = suptr->un_next; 271 did_something = 1; 272 } else 273 supptr = &(suptr->un_next); 274 } 275 276 /* If we didn't free anything then just give-up */ 277 if (!did_something) 278 return(NULL); 279 } else { 280 /* 281 * The second pass failed even though we freed 282 * something after the first pass! 283 * This is IMPOSSIBLE! 284 */ 285 panic("semu_alloc - second attempt failed"); 286 } 287 } 288 return (NULL); 289 } 290 291 /* 292 * Adjust a particular entry for a particular proc 293 */ 294 295 static int 296 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum, 297 int adjval) 298 { 299 struct sem_undo *suptr; 300 struct undo *sunptr; 301 int i; 302 303 /* Look for and remember the sem_undo if the caller doesn't provide 304 it */ 305 306 suptr = *supptr; 307 if (suptr == NULL) { 308 for (suptr = semu_list; suptr != NULL; 309 suptr = suptr->un_next) { 310 if (suptr->un_proc == p) { 311 *supptr = suptr; 312 break; 313 } 314 } 315 if (suptr == NULL) { 316 if (adjval == 0) 317 return(0); 318 suptr = semu_alloc(p); 319 if (suptr == NULL) 320 return(ENOSPC); 321 *supptr = suptr; 322 } 323 } 324 325 /* 326 * Look for the requested entry and adjust it (delete if adjval becomes 327 * 0). 328 */ 329 sunptr = &suptr->un_ent[0]; 330 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 331 if (sunptr->un_id != semid || sunptr->un_num != semnum) 332 continue; 333 if (adjval == 0) 334 sunptr->un_adjval = 0; 335 else 336 sunptr->un_adjval += adjval; 337 if (sunptr->un_adjval == 0) { 338 suptr->un_cnt--; 339 if (i < suptr->un_cnt) 340 suptr->un_ent[i] = 341 suptr->un_ent[suptr->un_cnt]; 342 } 343 return(0); 344 } 345 346 /* Didn't find the right entry - create it */ 347 if (adjval == 0) 348 return(0); 349 if (suptr->un_cnt != seminfo.semume) { 350 sunptr = &suptr->un_ent[suptr->un_cnt]; 351 suptr->un_cnt++; 352 sunptr->un_adjval = adjval; 353 sunptr->un_id = semid; sunptr->un_num = semnum; 354 } else 355 return(EINVAL); 356 return(0); 357 } 358 359 static void 360 semundo_clear(int semid, int semnum) 361 { 362 struct sem_undo *suptr; 363 364 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 365 struct undo *sunptr = &suptr->un_ent[0]; 366 int i = 0; 367 368 while (i < suptr->un_cnt) { 369 if (sunptr->un_id == semid) { 370 if (semnum == -1 || sunptr->un_num == semnum) { 371 suptr->un_cnt--; 372 if (i < suptr->un_cnt) { 373 suptr->un_ent[i] = 374 suptr->un_ent[suptr->un_cnt]; 375 continue; 376 } 377 } 378 if (semnum != -1) 379 break; 380 } 381 i++, sunptr++; 382 } 383 } 384 } 385 386 /* 387 * Note that the user-mode half of this passes a union, not a pointer 388 * 389 * MPALMOSTSAFE 390 */ 391 int 392 sys___semctl(struct __semctl_args *uap) 393 { 394 struct thread *td = curthread; 395 int semid = uap->semid; 396 int semnum = uap->semnum; 397 int cmd = uap->cmd; 398 union semun *arg = uap->arg; 399 union semun real_arg; 400 struct ucred *cred = td->td_ucred; 401 int i, rval, eval; 402 struct semid_ds sbuf; 403 struct semid_ds *semaptr; 404 struct semid_ds *semakptr; 405 406 #ifdef SEM_DEBUG 407 kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 408 #endif 409 410 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 411 return (ENOSYS); 412 413 switch (cmd) { 414 case SEM_STAT: 415 /* 416 * For this command we assume semid is an array index 417 * rather than an IPC id. 418 */ 419 if (semid < 0 || semid >= seminfo.semmni) { 420 eval = EINVAL; 421 break; 422 } 423 semakptr = &sema[semid]; 424 lwkt_getpooltoken(semakptr); 425 if ((semakptr->sem_perm.mode & SEM_ALLOC) == 0) { 426 eval = EINVAL; 427 lwkt_relpooltoken(semakptr); 428 break; 429 } 430 if ((eval = ipcperm(td->td_proc, &semakptr->sem_perm, IPC_R))) { 431 lwkt_relpooltoken(semakptr); 432 break; 433 } 434 bcopy(&semakptr, arg->buf, sizeof(struct semid_ds)); 435 rval = IXSEQ_TO_IPCID(semid, semakptr->sem_perm); 436 lwkt_relpooltoken(semakptr); 437 break; 438 } 439 440 semid = IPCID_TO_IX(semid); 441 if (semid < 0 || semid >= seminfo.semmni) { 442 return(EINVAL); 443 } 444 semaptr = &sema[semid]; 445 lwkt_getpooltoken(semaptr); 446 447 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 448 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 449 lwkt_relpooltoken(semaptr); 450 return(EINVAL); 451 } 452 453 eval = 0; 454 rval = 0; 455 456 switch (cmd) { 457 case IPC_RMID: 458 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M)) != 0) 459 break; 460 semaptr->sem_perm.cuid = cred->cr_uid; 461 semaptr->sem_perm.uid = cred->cr_uid; 462 semtot -= semaptr->sem_nsems; 463 for (i = semaptr->sem_base - sem; i < semtot; i++) 464 sem[i] = sem[i + semaptr->sem_nsems]; 465 for (i = 0; i < seminfo.semmni; i++) { 466 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 467 sema[i].sem_base > semaptr->sem_base) 468 sema[i].sem_base -= semaptr->sem_nsems; 469 } 470 semaptr->sem_perm.mode = 0; 471 semundo_clear(semid, -1); 472 wakeup((caddr_t)semaptr); 473 break; 474 475 case IPC_SET: 476 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M); 477 if (eval) 478 break; 479 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 480 break; 481 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 482 sizeof(sbuf))) != 0) { 483 break; 484 } 485 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 486 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 487 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 488 (sbuf.sem_perm.mode & 0777); 489 semaptr->sem_ctime = time_second; 490 break; 491 492 case IPC_STAT: 493 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R))) 494 break; 495 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 496 break; 497 eval = copyout(semaptr, real_arg.buf, sizeof(struct semid_ds)); 498 break; 499 500 case GETNCNT: 501 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 502 if (eval) 503 break; 504 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 505 eval = EINVAL; 506 break; 507 } 508 rval = semaptr->sem_base[semnum].semncnt; 509 break; 510 511 case GETPID: 512 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 513 if (eval) 514 break; 515 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 516 eval = EINVAL; 517 break; 518 } 519 rval = semaptr->sem_base[semnum].sempid; 520 break; 521 522 case GETVAL: 523 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 524 if (eval) 525 break; 526 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 527 eval = EINVAL; 528 break; 529 } 530 rval = semaptr->sem_base[semnum].semval; 531 break; 532 533 case GETALL: 534 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 535 if (eval) 536 break; 537 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 538 break; 539 for (i = 0; i < semaptr->sem_nsems; i++) { 540 eval = copyout(&semaptr->sem_base[i].semval, 541 &real_arg.array[i], 542 sizeof(real_arg.array[0])); 543 if (eval) 544 break; 545 } 546 break; 547 548 case GETZCNT: 549 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 550 if (eval) 551 break; 552 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 553 eval = EINVAL; 554 break; 555 } 556 rval = semaptr->sem_base[semnum].semzcnt; 557 break; 558 559 case SETVAL: 560 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 561 if (eval) 562 break; 563 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 564 eval = EINVAL; 565 break; 566 } 567 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 568 break; 569 semaptr->sem_base[semnum].semval = real_arg.val; 570 semundo_clear(semid, semnum); 571 wakeup((caddr_t)semaptr); 572 break; 573 574 case SETALL: 575 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 576 if (eval) 577 break; 578 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 579 break; 580 for (i = 0; i < semaptr->sem_nsems; i++) { 581 eval = copyin(&real_arg.array[i], 582 (caddr_t)&semaptr->sem_base[i].semval, 583 sizeof(real_arg.array[0])); 584 if (eval != 0) 585 break; 586 } 587 semundo_clear(semid, -1); 588 wakeup((caddr_t)semaptr); 589 break; 590 591 default: 592 eval = EINVAL; 593 break; 594 } 595 lwkt_relpooltoken(semaptr); 596 597 if (eval == 0) 598 uap->sysmsg_result = rval; 599 return(eval); 600 } 601 602 /* 603 * MPALMOSTSAFE 604 */ 605 int 606 sys_semget(struct semget_args *uap) 607 { 608 struct thread *td = curthread; 609 int semid, eval; 610 int key = uap->key; 611 int nsems = uap->nsems; 612 int semflg = uap->semflg; 613 struct ucred *cred = td->td_ucred; 614 615 #ifdef SEM_DEBUG 616 kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 617 #endif 618 619 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 620 return (ENOSYS); 621 622 eval = 0; 623 624 if (key != IPC_PRIVATE) { 625 for (semid = 0; semid < seminfo.semmni; semid++) { 626 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0 || 627 sema[semid].sem_perm.key != key) { 628 continue; 629 } 630 lwkt_getpooltoken(&sema[semid]); 631 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0 || 632 sema[semid].sem_perm.key != key) { 633 lwkt_relpooltoken(&sema[semid]); 634 continue; 635 } 636 break; 637 } 638 if (semid < seminfo.semmni) { 639 #ifdef SEM_DEBUG 640 kprintf("found public key\n"); 641 #endif 642 if ((eval = ipcperm(td->td_proc, 643 &sema[semid].sem_perm, 644 semflg & 0700))) { 645 lwkt_relpooltoken(&sema[semid]); 646 goto done; 647 } 648 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 649 #ifdef SEM_DEBUG 650 kprintf("too small\n"); 651 #endif 652 eval = EINVAL; 653 lwkt_relpooltoken(&sema[semid]); 654 goto done; 655 } 656 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 657 #ifdef SEM_DEBUG 658 kprintf("not exclusive\n"); 659 #endif 660 eval = EEXIST; 661 lwkt_relpooltoken(&sema[semid]); 662 goto done; 663 } 664 goto done; 665 } 666 } 667 668 #ifdef SEM_DEBUG 669 kprintf("need to allocate the semid_ds\n"); 670 #endif 671 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 672 if (nsems <= 0 || nsems > seminfo.semmsl) { 673 #ifdef SEM_DEBUG 674 kprintf("nsems out of range (0<%d<=%d)\n", 675 nsems, seminfo.semmsl); 676 #endif 677 eval = EINVAL; 678 goto done; 679 } 680 if (nsems > seminfo.semmns - semtot) { 681 #ifdef SEM_DEBUG 682 kprintf("not enough semaphores left " 683 "(need %d, got %d)\n", 684 nsems, seminfo.semmns - semtot); 685 #endif 686 eval = ENOSPC; 687 goto done; 688 } 689 for (semid = 0; semid < seminfo.semmni; semid++) { 690 if (sema[semid].sem_perm.mode & SEM_ALLOC) 691 continue; 692 lwkt_getpooltoken(&sema[semid]); 693 if (sema[semid].sem_perm.mode & SEM_ALLOC) { 694 lwkt_relpooltoken(&sema[semid]); 695 continue; 696 } 697 break; 698 } 699 if (semid == seminfo.semmni) { 700 #ifdef SEM_DEBUG 701 kprintf("no more semid_ds's available\n"); 702 #endif 703 eval = ENOSPC; 704 goto done; 705 } 706 #ifdef SEM_DEBUG 707 kprintf("semid %d is available\n", semid); 708 #endif 709 sema[semid].sem_perm.key = key; 710 sema[semid].sem_perm.cuid = cred->cr_uid; 711 sema[semid].sem_perm.uid = cred->cr_uid; 712 sema[semid].sem_perm.cgid = cred->cr_gid; 713 sema[semid].sem_perm.gid = cred->cr_gid; 714 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 715 sema[semid].sem_perm.seq = 716 (sema[semid].sem_perm.seq + 1) & 0x7fff; 717 sema[semid].sem_nsems = nsems; 718 sema[semid].sem_otime = 0; 719 sema[semid].sem_ctime = time_second; 720 sema[semid].sem_base = &sem[semtot]; 721 semtot += nsems; 722 bzero(sema[semid].sem_base, 723 sizeof(sema[semid].sem_base[0])*nsems); 724 #ifdef SEM_DEBUG 725 kprintf("sembase = 0x%x, next = 0x%x\n", 726 sema[semid].sem_base, &sem[semtot]); 727 #endif 728 /* eval == 0 */ 729 } else { 730 #ifdef SEM_DEBUG 731 kprintf("didn't find it and wasn't asked to create it\n"); 732 #endif 733 eval = ENOENT; 734 } 735 736 done: 737 if (eval == 0) { 738 uap->sysmsg_result = 739 IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 740 lwkt_relpooltoken(&sema[semid]); 741 } 742 return(eval); 743 } 744 745 /* 746 * MPALMOSTSAFE 747 */ 748 int 749 sys_semop(struct semop_args *uap) 750 { 751 struct thread *td = curthread; 752 int semid = uap->semid; 753 u_int nsops = uap->nsops; 754 struct sembuf sops[MAX_SOPS]; 755 struct semid_ds *semaptr; 756 struct sembuf *sopptr; 757 struct sem *semptr; 758 struct sem_undo *suptr = NULL; 759 int i, j, eval; 760 int do_wakeup, do_undos; 761 762 #ifdef SEM_DEBUG 763 kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 764 #endif 765 766 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 767 return (ENOSYS); 768 769 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 770 771 if (semid < 0 || semid >= seminfo.semmni) { 772 eval = EINVAL; 773 goto done2; 774 } 775 semaptr = &sema[semid]; 776 lwkt_getpooltoken(semaptr); 777 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 778 eval = EINVAL; 779 goto done; 780 } 781 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 782 eval = EINVAL; 783 goto done; 784 } 785 786 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W))) { 787 #ifdef SEM_DEBUG 788 kprintf("eval = %d from ipaccess\n", eval); 789 #endif 790 goto done; 791 } 792 793 if (nsops > MAX_SOPS) { 794 #ifdef SEM_DEBUG 795 kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 796 #endif 797 eval = E2BIG; 798 goto done; 799 } 800 801 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 802 #ifdef SEM_DEBUG 803 kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 804 uap->sops, &sops, nsops * sizeof(sops[0])); 805 #endif 806 goto done; 807 } 808 809 /* 810 * Loop trying to satisfy the vector of requests. 811 * If we reach a point where we must wait, any requests already 812 * performed are rolled back and we go to sleep until some other 813 * process wakes us up. At this point, we start all over again. 814 * 815 * This ensures that from the perspective of other tasks, a set 816 * of requests is atomic (never partially satisfied). 817 */ 818 do_undos = 0; 819 820 for (;;) { 821 do_wakeup = 0; 822 823 for (i = 0; i < nsops; i++) { 824 sopptr = &sops[i]; 825 826 if (sopptr->sem_num >= semaptr->sem_nsems) { 827 eval = EFBIG; 828 goto done; 829 } 830 831 semptr = &semaptr->sem_base[sopptr->sem_num]; 832 833 #ifdef SEM_DEBUG 834 kprintf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 835 semaptr, semaptr->sem_base, semptr, 836 sopptr->sem_num, semptr->semval, sopptr->sem_op, 837 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 838 #endif 839 840 if (sopptr->sem_op < 0) { 841 if (semptr->semval + sopptr->sem_op < 0) { 842 #ifdef SEM_DEBUG 843 kprintf("semop: can't do it now\n"); 844 #endif 845 break; 846 } else { 847 semptr->semval += sopptr->sem_op; 848 if (semptr->semval == 0 && 849 semptr->semzcnt > 0) 850 do_wakeup = 1; 851 } 852 if (sopptr->sem_flg & SEM_UNDO) 853 do_undos = 1; 854 } else if (sopptr->sem_op == 0) { 855 if (semptr->semval > 0) { 856 #ifdef SEM_DEBUG 857 kprintf("semop: not zero now\n"); 858 #endif 859 break; 860 } 861 } else { 862 if (semptr->semncnt > 0) 863 do_wakeup = 1; 864 semptr->semval += sopptr->sem_op; 865 if (sopptr->sem_flg & SEM_UNDO) 866 do_undos = 1; 867 } 868 } 869 870 /* 871 * Did we get through the entire vector? 872 */ 873 if (i >= nsops) 874 goto donex; 875 876 /* 877 * No ... rollback anything that we've already done 878 */ 879 #ifdef SEM_DEBUG 880 kprintf("semop: rollback 0 through %d\n", i-1); 881 #endif 882 for (j = 0; j < i; j++) 883 semaptr->sem_base[sops[j].sem_num].semval -= 884 sops[j].sem_op; 885 886 /* 887 * If the request that we couldn't satisfy has the 888 * NOWAIT flag set then return with EAGAIN. 889 */ 890 if (sopptr->sem_flg & IPC_NOWAIT) { 891 eval = EAGAIN; 892 goto done; 893 } 894 895 if (sopptr->sem_op == 0) 896 semptr->semzcnt++; 897 else 898 semptr->semncnt++; 899 900 #ifdef SEM_DEBUG 901 kprintf("semop: good night!\n"); 902 #endif 903 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 904 #ifdef SEM_DEBUG 905 kprintf("semop: good morning (eval=%d)!\n", eval); 906 #endif 907 908 suptr = NULL; /* sem_undo may have been reallocated */ 909 910 /* return code is checked below, after sem[nz]cnt-- */ 911 912 /* 913 * Make sure that the semaphore still exists 914 */ 915 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 916 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 917 eval = EIDRM; 918 goto done; 919 } 920 921 /* 922 * The semaphore is still alive. Readjust the count of 923 * waiting processes. 924 */ 925 if (sopptr->sem_op == 0) 926 semptr->semzcnt--; 927 else 928 semptr->semncnt--; 929 930 /* 931 * Is it really morning, or was our sleep interrupted? 932 * (Delayed check of tsleep() return code because we 933 * need to decrement sem[nz]cnt either way.) 934 */ 935 if (eval) { 936 eval = EINTR; 937 goto done; 938 } 939 #ifdef SEM_DEBUG 940 kprintf("semop: good morning!\n"); 941 #endif 942 } 943 944 donex: 945 /* 946 * Process any SEM_UNDO requests. 947 */ 948 if (do_undos) { 949 for (i = 0; i < nsops; i++) { 950 /* 951 * We only need to deal with SEM_UNDO's for non-zero 952 * op's. 953 */ 954 int adjval; 955 956 if ((sops[i].sem_flg & SEM_UNDO) == 0) 957 continue; 958 adjval = sops[i].sem_op; 959 if (adjval == 0) 960 continue; 961 eval = semundo_adjust(td->td_proc, &suptr, semid, 962 sops[i].sem_num, -adjval); 963 if (eval == 0) 964 continue; 965 966 /* 967 * Oh-Oh! We ran out of either sem_undo's or undo's. 968 * Rollback the adjustments to this point and then 969 * rollback the semaphore ups and down so we can return 970 * with an error with all structures restored. We 971 * rollback the undo's in the exact reverse order that 972 * we applied them. This guarantees that we won't run 973 * out of space as we roll things back out. 974 */ 975 for (j = i - 1; j >= 0; j--) { 976 if ((sops[j].sem_flg & SEM_UNDO) == 0) 977 continue; 978 adjval = sops[j].sem_op; 979 if (adjval == 0) 980 continue; 981 if (semundo_adjust(td->td_proc, &suptr, semid, 982 sops[j].sem_num, adjval) != 0) 983 panic("semop - can't undo undos"); 984 } 985 986 for (j = 0; j < nsops; j++) 987 semaptr->sem_base[sops[j].sem_num].semval -= 988 sops[j].sem_op; 989 990 #ifdef SEM_DEBUG 991 kprintf("eval = %d from semundo_adjust\n", eval); 992 #endif 993 goto done; 994 } /* loop through the sops */ 995 } /* if (do_undos) */ 996 997 /* We're definitely done - set the sempid's */ 998 for (i = 0; i < nsops; i++) { 999 sopptr = &sops[i]; 1000 semptr = &semaptr->sem_base[sopptr->sem_num]; 1001 semptr->sempid = td->td_proc->p_pid; 1002 } 1003 1004 /* Do a wakeup if any semaphore was up'd. */ 1005 if (do_wakeup) { 1006 #ifdef SEM_DEBUG 1007 kprintf("semop: doing wakeup\n"); 1008 #endif 1009 wakeup((caddr_t)semaptr); 1010 #ifdef SEM_DEBUG 1011 kprintf("semop: back from wakeup\n"); 1012 #endif 1013 } 1014 #ifdef SEM_DEBUG 1015 kprintf("semop: done\n"); 1016 #endif 1017 uap->sysmsg_result = 0; 1018 eval = 0; 1019 done: 1020 lwkt_relpooltoken(semaptr); 1021 done2: 1022 return(eval); 1023 } 1024 1025 /* 1026 * Go through the undo structures for this process and apply the adjustments to 1027 * semaphores. 1028 */ 1029 void 1030 semexit(struct proc *p) 1031 { 1032 struct sem_undo *suptr; 1033 struct sem_undo **supptr; 1034 int did_something; 1035 1036 did_something = 0; 1037 1038 /* 1039 * Go through the chain of undo vectors looking for one 1040 * associated with this process. 1041 */ 1042 1043 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1044 supptr = &suptr->un_next) { 1045 if (suptr->un_proc == p) 1046 break; 1047 } 1048 1049 if (suptr == NULL) 1050 return; 1051 1052 #ifdef SEM_DEBUG 1053 kprintf("proc @%08x has undo structure with %d entries\n", p, 1054 suptr->un_cnt); 1055 #endif 1056 1057 /* 1058 * If there are any active undo elements then process them. 1059 */ 1060 if (suptr->un_cnt > 0) { 1061 int ix; 1062 1063 for (ix = 0; ix < suptr->un_cnt; ix++) { 1064 int semid = suptr->un_ent[ix].un_id; 1065 int semnum = suptr->un_ent[ix].un_num; 1066 int adjval = suptr->un_ent[ix].un_adjval; 1067 struct semid_ds *semaptr; 1068 1069 semaptr = &sema[semid]; 1070 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1071 panic("semexit - semid not allocated"); 1072 if (semnum >= semaptr->sem_nsems) 1073 panic("semexit - semnum out of range"); 1074 1075 #ifdef SEM_DEBUG 1076 kprintf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1077 suptr->un_proc, suptr->un_ent[ix].un_id, 1078 suptr->un_ent[ix].un_num, 1079 suptr->un_ent[ix].un_adjval, 1080 semaptr->sem_base[semnum].semval); 1081 #endif 1082 1083 if (adjval < 0) { 1084 if (semaptr->sem_base[semnum].semval < -adjval) 1085 semaptr->sem_base[semnum].semval = 0; 1086 else 1087 semaptr->sem_base[semnum].semval += 1088 adjval; 1089 } else 1090 semaptr->sem_base[semnum].semval += adjval; 1091 1092 wakeup((caddr_t)semaptr); 1093 #ifdef SEM_DEBUG 1094 kprintf("semexit: back from wakeup\n"); 1095 #endif 1096 } 1097 } 1098 1099 /* 1100 * Deallocate the undo vector. 1101 */ 1102 #ifdef SEM_DEBUG 1103 kprintf("removing vector\n"); 1104 #endif 1105 suptr->un_proc = NULL; 1106 *supptr = suptr->un_next; 1107 } 1108