1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/sem.h> 19 #include <sys/sysent.h> 20 #include <sys/sysctl.h> 21 #include <sys/malloc.h> 22 #include <sys/jail.h> 23 24 #include <sys/mplock2.h> 25 26 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 27 28 static void seminit (void *); 29 30 static struct sem_undo *semu_alloc (struct proc *p); 31 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 32 int semid, int semnum, int adjval); 33 static void semundo_clear (int semid, int semnum); 34 35 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 36 static sy_call_t *semcalls[] = { 37 (sy_call_t *)sys___semctl, (sy_call_t *)sys_semget, 38 (sy_call_t *)sys_semop 39 }; 40 41 static int semtot = 0; 42 static struct semid_ds *sema; /* semaphore id pool */ 43 static struct sem *sem; /* semaphore pool */ 44 static struct sem_undo *semu_list; /* list of active undo structures */ 45 static int *semu; /* undo structure pool */ 46 47 struct sem { 48 u_short semval; /* semaphore value */ 49 pid_t sempid; /* pid of last operation */ 50 u_short semncnt; /* # awaiting semval > cval */ 51 u_short semzcnt; /* # awaiting semval = 0 */ 52 }; 53 54 /* 55 * Undo structure (one per process) 56 */ 57 struct sem_undo { 58 struct sem_undo *un_next; /* ptr to next active undo structure */ 59 struct proc *un_proc; /* owner of this structure */ 60 short un_cnt; /* # of active entries */ 61 struct undo { 62 short un_adjval; /* adjust on exit values */ 63 short un_num; /* semaphore # */ 64 int un_id; /* semid */ 65 } un_ent[1]; /* undo entries */ 66 }; 67 68 /* 69 * Configuration parameters 70 */ 71 #ifndef SEMMNI 72 #define SEMMNI 10 /* # of semaphore identifiers */ 73 #endif 74 #ifndef SEMMNS 75 #define SEMMNS 60 /* # of semaphores in system */ 76 #endif 77 #ifndef SEMUME 78 #define SEMUME 10 /* max # of undo entries per process */ 79 #endif 80 #ifndef SEMMNU 81 #define SEMMNU 30 /* # of undo structures in system */ 82 #endif 83 84 /* shouldn't need tuning */ 85 #ifndef SEMMAP 86 #define SEMMAP 30 /* # of entries in semaphore map */ 87 #endif 88 #ifndef SEMMSL 89 #define SEMMSL SEMMNS /* max # of semaphores per id */ 90 #endif 91 #ifndef SEMOPM 92 #define SEMOPM 100 /* max # of operations per semop call */ 93 #endif 94 95 #define SEMVMX 32767 /* semaphore maximum value */ 96 #define SEMAEM 16384 /* adjust on exit max value */ 97 98 /* 99 * Due to the way semaphore memory is allocated, we have to ensure that 100 * SEMUSZ is properly aligned. 101 */ 102 103 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 104 105 /* actual size of an undo structure */ 106 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 107 108 /* 109 * Macro to find a particular sem_undo vector 110 */ 111 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 112 113 /* 114 * semaphore info struct 115 */ 116 struct seminfo seminfo = { 117 SEMMAP, /* # of entries in semaphore map */ 118 SEMMNI, /* # of semaphore identifiers */ 119 SEMMNS, /* # of semaphores in system */ 120 SEMMNU, /* # of undo structures in system */ 121 SEMMSL, /* max # of semaphores per id */ 122 SEMOPM, /* max # of operations per semop call */ 123 SEMUME, /* max # of undo entries per process */ 124 SEMUSZ, /* size in bytes of undo structure */ 125 SEMVMX, /* semaphore maximum value */ 126 SEMAEM /* adjust on exit max value */ 127 }; 128 129 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 130 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 131 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 132 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 133 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 134 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 135 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 136 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 137 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 138 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 139 140 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, 141 "Number of entries in semaphore map"); 142 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, 143 "Number of semaphore identifiers"); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, 145 "Total number of semaphores"); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, 147 "Total number of undo structures"); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, 149 "Max number of semaphores per id"); 150 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, 151 "Max number of operations per semop call"); 152 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, 153 "Max number of undo entries per process"); 154 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, 155 "Size in bytes of undo structure"); 156 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, 157 "Semaphore maximum value"); 158 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, 159 "Adjust on exit max value"); 160 161 #if 0 162 RO seminfo.semmap /* SEMMAP unused */ 163 RO seminfo.semmni 164 RO seminfo.semmns 165 RO seminfo.semmnu /* undo entries per system */ 166 RW seminfo.semmsl 167 RO seminfo.semopm /* SEMOPM unused */ 168 RO seminfo.semume 169 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 170 RO seminfo.semvmx /* SEMVMX unused - user param */ 171 RO seminfo.semaem /* SEMAEM unused - user param */ 172 #endif 173 174 static void 175 seminit(void *dummy) 176 { 177 int i; 178 179 sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 180 sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 181 semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 182 183 for (i = 0; i < seminfo.semmni; i++) { 184 sema[i].sem_base = 0; 185 sema[i].sem_perm.mode = 0; 186 } 187 for (i = 0; i < seminfo.semmnu; i++) { 188 struct sem_undo *suptr = SEMU(i); 189 suptr->un_proc = NULL; 190 } 191 semu_list = NULL; 192 } 193 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 194 195 /* 196 * Entry point for all SEM calls 197 * 198 * semsys_args(int which, a2, a3, ...) (VARARGS) 199 * 200 * MPALMOSTSAFE 201 */ 202 int 203 sys_semsys(struct semsys_args *uap) 204 { 205 struct thread *td = curthread; 206 unsigned int which = (unsigned int)uap->which; 207 int error; 208 209 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 210 return (ENOSYS); 211 212 if (which >= NELEM(semcalls)) 213 return (EINVAL); 214 bcopy(&uap->a2, &uap->which, 215 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 216 get_mplock(); 217 error = (*semcalls[which])(uap); 218 rel_mplock(); 219 return (error); 220 } 221 222 /* 223 * Allocate a new sem_undo structure for a process 224 * (returns ptr to structure or NULL if no more room) 225 */ 226 227 static struct sem_undo * 228 semu_alloc(struct proc *p) 229 { 230 int i; 231 struct sem_undo *suptr; 232 struct sem_undo **supptr; 233 int attempt; 234 235 /* 236 * Try twice to allocate something. 237 * (we'll purge any empty structures after the first pass so 238 * two passes are always enough) 239 */ 240 241 for (attempt = 0; attempt < 2; attempt++) { 242 /* 243 * Look for a free structure. 244 * Fill it in and return it if we find one. 245 */ 246 247 for (i = 0; i < seminfo.semmnu; i++) { 248 suptr = SEMU(i); 249 if (suptr->un_proc == NULL) { 250 suptr->un_next = semu_list; 251 semu_list = suptr; 252 suptr->un_cnt = 0; 253 suptr->un_proc = p; 254 return(suptr); 255 } 256 } 257 258 /* 259 * We didn't find a free one, if this is the first attempt 260 * then try to free some structures. 261 */ 262 263 if (attempt == 0) { 264 /* All the structures are in use - try to free some */ 265 int did_something = 0; 266 267 supptr = &semu_list; 268 while ((suptr = *supptr) != NULL) { 269 if (suptr->un_cnt == 0) { 270 suptr->un_proc = NULL; 271 *supptr = suptr->un_next; 272 did_something = 1; 273 } else 274 supptr = &(suptr->un_next); 275 } 276 277 /* If we didn't free anything then just give-up */ 278 if (!did_something) 279 return(NULL); 280 } else { 281 /* 282 * The second pass failed even though we freed 283 * something after the first pass! 284 * This is IMPOSSIBLE! 285 */ 286 panic("semu_alloc - second attempt failed"); 287 } 288 } 289 return (NULL); 290 } 291 292 /* 293 * Adjust a particular entry for a particular proc 294 */ 295 296 static int 297 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum, 298 int adjval) 299 { 300 struct sem_undo *suptr; 301 struct undo *sunptr; 302 int i; 303 304 /* Look for and remember the sem_undo if the caller doesn't provide 305 it */ 306 307 suptr = *supptr; 308 if (suptr == NULL) { 309 for (suptr = semu_list; suptr != NULL; 310 suptr = suptr->un_next) { 311 if (suptr->un_proc == p) { 312 *supptr = suptr; 313 break; 314 } 315 } 316 if (suptr == NULL) { 317 if (adjval == 0) 318 return(0); 319 suptr = semu_alloc(p); 320 if (suptr == NULL) 321 return(ENOSPC); 322 *supptr = suptr; 323 } 324 } 325 326 /* 327 * Look for the requested entry and adjust it (delete if adjval becomes 328 * 0). 329 */ 330 sunptr = &suptr->un_ent[0]; 331 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 332 if (sunptr->un_id != semid || sunptr->un_num != semnum) 333 continue; 334 if (adjval == 0) 335 sunptr->un_adjval = 0; 336 else 337 sunptr->un_adjval += adjval; 338 if (sunptr->un_adjval == 0) { 339 suptr->un_cnt--; 340 if (i < suptr->un_cnt) 341 suptr->un_ent[i] = 342 suptr->un_ent[suptr->un_cnt]; 343 } 344 return(0); 345 } 346 347 /* Didn't find the right entry - create it */ 348 if (adjval == 0) 349 return(0); 350 if (suptr->un_cnt != seminfo.semume) { 351 sunptr = &suptr->un_ent[suptr->un_cnt]; 352 suptr->un_cnt++; 353 sunptr->un_adjval = adjval; 354 sunptr->un_id = semid; sunptr->un_num = semnum; 355 } else 356 return(EINVAL); 357 return(0); 358 } 359 360 static void 361 semundo_clear(int semid, int semnum) 362 { 363 struct sem_undo *suptr; 364 365 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 366 struct undo *sunptr = &suptr->un_ent[0]; 367 int i = 0; 368 369 while (i < suptr->un_cnt) { 370 if (sunptr->un_id == semid) { 371 if (semnum == -1 || sunptr->un_num == semnum) { 372 suptr->un_cnt--; 373 if (i < suptr->un_cnt) { 374 suptr->un_ent[i] = 375 suptr->un_ent[suptr->un_cnt]; 376 continue; 377 } 378 } 379 if (semnum != -1) 380 break; 381 } 382 i++, sunptr++; 383 } 384 } 385 } 386 387 /* 388 * Note that the user-mode half of this passes a union, not a pointer 389 * 390 * MPALMOSTSAFE 391 */ 392 int 393 sys___semctl(struct __semctl_args *uap) 394 { 395 struct thread *td = curthread; 396 int semid = uap->semid; 397 int semnum = uap->semnum; 398 int cmd = uap->cmd; 399 union semun *arg = uap->arg; 400 union semun real_arg; 401 struct ucred *cred = td->td_ucred; 402 int i, rval, eval; 403 struct semid_ds sbuf; 404 struct semid_ds *semaptr; 405 struct semid_ds *semakptr; 406 407 #ifdef SEM_DEBUG 408 kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 409 #endif 410 411 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 412 return (ENOSYS); 413 414 get_mplock(); 415 switch (cmd) { 416 case SEM_STAT: 417 /* 418 * For this command we assume semid is an array index 419 * rather than an IPC id. 420 */ 421 if (semid < 0 || semid >= seminfo.semmni) { 422 eval = EINVAL; 423 break; 424 } 425 semakptr = &sema[semid]; 426 if ((semakptr->sem_perm.mode & SEM_ALLOC) == 0) { 427 eval = EINVAL; 428 break; 429 } 430 if ((eval = ipcperm(td->td_proc, &semakptr->sem_perm, IPC_R))) 431 break; 432 433 bcopy(&semakptr, arg->buf, sizeof(struct semid_ds)); 434 rval = IXSEQ_TO_IPCID(semid, semakptr->sem_perm); 435 break; 436 } 437 438 semid = IPCID_TO_IX(semid); 439 if (semid < 0 || semid >= seminfo.semmni) { 440 rel_mplock(); 441 return(EINVAL); 442 } 443 444 semaptr = &sema[semid]; 445 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 446 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 447 rel_mplock(); 448 return(EINVAL); 449 } 450 451 eval = 0; 452 rval = 0; 453 454 switch (cmd) { 455 case IPC_RMID: 456 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M)) != 0) 457 break; 458 semaptr->sem_perm.cuid = cred->cr_uid; 459 semaptr->sem_perm.uid = cred->cr_uid; 460 semtot -= semaptr->sem_nsems; 461 for (i = semaptr->sem_base - sem; i < semtot; i++) 462 sem[i] = sem[i + semaptr->sem_nsems]; 463 for (i = 0; i < seminfo.semmni; i++) { 464 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 465 sema[i].sem_base > semaptr->sem_base) 466 sema[i].sem_base -= semaptr->sem_nsems; 467 } 468 semaptr->sem_perm.mode = 0; 469 semundo_clear(semid, -1); 470 wakeup((caddr_t)semaptr); 471 break; 472 473 case IPC_SET: 474 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M); 475 if (eval) 476 break; 477 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 478 break; 479 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 480 sizeof(sbuf))) != 0) { 481 break; 482 } 483 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 484 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 485 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 486 (sbuf.sem_perm.mode & 0777); 487 semaptr->sem_ctime = time_second; 488 break; 489 490 case IPC_STAT: 491 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R))) 492 break; 493 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 494 break; 495 eval = copyout(semaptr, real_arg.buf, sizeof(struct semid_ds)); 496 break; 497 498 case GETNCNT: 499 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 500 if (eval) 501 break; 502 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 503 eval = EINVAL; 504 break; 505 } 506 rval = semaptr->sem_base[semnum].semncnt; 507 break; 508 509 case GETPID: 510 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 511 if (eval) 512 break; 513 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 514 eval = EINVAL; 515 break; 516 } 517 rval = semaptr->sem_base[semnum].sempid; 518 break; 519 520 case GETVAL: 521 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 522 if (eval) 523 break; 524 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 525 eval = EINVAL; 526 break; 527 } 528 rval = semaptr->sem_base[semnum].semval; 529 break; 530 531 case GETALL: 532 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 533 if (eval) 534 break; 535 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 536 break; 537 for (i = 0; i < semaptr->sem_nsems; i++) { 538 eval = copyout(&semaptr->sem_base[i].semval, 539 &real_arg.array[i], 540 sizeof(real_arg.array[0])); 541 if (eval) 542 break; 543 } 544 break; 545 546 case GETZCNT: 547 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 548 if (eval) 549 break; 550 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 551 eval = EINVAL; 552 break; 553 } 554 rval = semaptr->sem_base[semnum].semzcnt; 555 break; 556 557 case SETVAL: 558 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 559 if (eval) 560 break; 561 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 562 eval = EINVAL; 563 break; 564 } 565 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 566 break; 567 semaptr->sem_base[semnum].semval = real_arg.val; 568 semundo_clear(semid, semnum); 569 wakeup((caddr_t)semaptr); 570 break; 571 572 case SETALL: 573 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 574 if (eval) 575 break; 576 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 577 break; 578 for (i = 0; i < semaptr->sem_nsems; i++) { 579 eval = copyin(&real_arg.array[i], 580 (caddr_t)&semaptr->sem_base[i].semval, 581 sizeof(real_arg.array[0])); 582 if (eval != 0) 583 break; 584 } 585 semundo_clear(semid, -1); 586 wakeup((caddr_t)semaptr); 587 break; 588 589 default: 590 eval = EINVAL; 591 break; 592 } 593 rel_mplock(); 594 595 if (eval == 0) 596 uap->sysmsg_result = rval; 597 return(eval); 598 } 599 600 /* 601 * MPALMOSTSAFE 602 */ 603 int 604 sys_semget(struct semget_args *uap) 605 { 606 struct thread *td = curthread; 607 int semid, eval; 608 int key = uap->key; 609 int nsems = uap->nsems; 610 int semflg = uap->semflg; 611 struct ucred *cred = td->td_ucred; 612 613 #ifdef SEM_DEBUG 614 kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 615 #endif 616 617 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 618 return (ENOSYS); 619 620 get_mplock(); 621 eval = 0; 622 623 if (key != IPC_PRIVATE) { 624 for (semid = 0; semid < seminfo.semmni; semid++) { 625 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 626 sema[semid].sem_perm.key == key) 627 break; 628 } 629 if (semid < seminfo.semmni) { 630 #ifdef SEM_DEBUG 631 kprintf("found public key\n"); 632 #endif 633 if ((eval = ipcperm(td->td_proc, 634 &sema[semid].sem_perm, 635 semflg & 0700))) { 636 goto done; 637 } 638 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 639 #ifdef SEM_DEBUG 640 kprintf("too small\n"); 641 #endif 642 eval = EINVAL; 643 goto done; 644 } 645 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 646 #ifdef SEM_DEBUG 647 kprintf("not exclusive\n"); 648 #endif 649 eval = EEXIST; 650 goto done; 651 } 652 goto done; 653 } 654 } 655 656 #ifdef SEM_DEBUG 657 kprintf("need to allocate the semid_ds\n"); 658 #endif 659 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 660 if (nsems <= 0 || nsems > seminfo.semmsl) { 661 #ifdef SEM_DEBUG 662 kprintf("nsems out of range (0<%d<=%d)\n", nsems, 663 seminfo.semmsl); 664 #endif 665 eval = EINVAL; 666 goto done; 667 } 668 if (nsems > seminfo.semmns - semtot) { 669 #ifdef SEM_DEBUG 670 kprintf("not enough semaphores left (need %d, got %d)\n", 671 nsems, seminfo.semmns - semtot); 672 #endif 673 eval = ENOSPC; 674 goto done; 675 } 676 for (semid = 0; semid < seminfo.semmni; semid++) { 677 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 678 break; 679 } 680 if (semid == seminfo.semmni) { 681 #ifdef SEM_DEBUG 682 kprintf("no more semid_ds's available\n"); 683 #endif 684 eval = ENOSPC; 685 goto done; 686 } 687 #ifdef SEM_DEBUG 688 kprintf("semid %d is available\n", semid); 689 #endif 690 sema[semid].sem_perm.key = key; 691 sema[semid].sem_perm.cuid = cred->cr_uid; 692 sema[semid].sem_perm.uid = cred->cr_uid; 693 sema[semid].sem_perm.cgid = cred->cr_gid; 694 sema[semid].sem_perm.gid = cred->cr_gid; 695 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 696 sema[semid].sem_perm.seq = 697 (sema[semid].sem_perm.seq + 1) & 0x7fff; 698 sema[semid].sem_nsems = nsems; 699 sema[semid].sem_otime = 0; 700 sema[semid].sem_ctime = time_second; 701 sema[semid].sem_base = &sem[semtot]; 702 semtot += nsems; 703 bzero(sema[semid].sem_base, 704 sizeof(sema[semid].sem_base[0])*nsems); 705 #ifdef SEM_DEBUG 706 kprintf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 707 &sem[semtot]); 708 #endif 709 } else { 710 #ifdef SEM_DEBUG 711 kprintf("didn't find it and wasn't asked to create it\n"); 712 #endif 713 eval = ENOENT; 714 } 715 716 done: 717 if (eval == 0) { 718 uap->sysmsg_result = IXSEQ_TO_IPCID(semid, 719 sema[semid].sem_perm); 720 } 721 rel_mplock(); 722 return(eval); 723 } 724 725 /* 726 * MPALMOSTSAFE 727 */ 728 int 729 sys_semop(struct semop_args *uap) 730 { 731 struct thread *td = curthread; 732 int semid = uap->semid; 733 u_int nsops = uap->nsops; 734 struct sembuf sops[MAX_SOPS]; 735 struct semid_ds *semaptr; 736 struct sembuf *sopptr; 737 struct sem *semptr; 738 struct sem_undo *suptr = NULL; 739 int i, j, eval; 740 int do_wakeup, do_undos; 741 742 #ifdef SEM_DEBUG 743 kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 744 #endif 745 746 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 747 return (ENOSYS); 748 749 get_mplock(); 750 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 751 752 if (semid < 0 || semid >= seminfo.semmni) { 753 eval = EINVAL; 754 goto done; 755 } 756 757 semaptr = &sema[semid]; 758 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 759 eval = EINVAL; 760 goto done; 761 } 762 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 763 eval = EINVAL; 764 goto done; 765 } 766 767 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W))) { 768 #ifdef SEM_DEBUG 769 kprintf("eval = %d from ipaccess\n", eval); 770 #endif 771 goto done; 772 } 773 774 if (nsops > MAX_SOPS) { 775 #ifdef SEM_DEBUG 776 kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 777 #endif 778 eval = E2BIG; 779 goto done; 780 } 781 782 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 783 #ifdef SEM_DEBUG 784 kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 785 uap->sops, &sops, nsops * sizeof(sops[0])); 786 #endif 787 goto done; 788 } 789 790 /* 791 * Loop trying to satisfy the vector of requests. 792 * If we reach a point where we must wait, any requests already 793 * performed are rolled back and we go to sleep until some other 794 * process wakes us up. At this point, we start all over again. 795 * 796 * This ensures that from the perspective of other tasks, a set 797 * of requests is atomic (never partially satisfied). 798 */ 799 do_undos = 0; 800 801 for (;;) { 802 do_wakeup = 0; 803 804 for (i = 0; i < nsops; i++) { 805 sopptr = &sops[i]; 806 807 if (sopptr->sem_num >= semaptr->sem_nsems) { 808 eval = EFBIG; 809 goto done; 810 } 811 812 semptr = &semaptr->sem_base[sopptr->sem_num]; 813 814 #ifdef SEM_DEBUG 815 kprintf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 816 semaptr, semaptr->sem_base, semptr, 817 sopptr->sem_num, semptr->semval, sopptr->sem_op, 818 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 819 #endif 820 821 if (sopptr->sem_op < 0) { 822 if (semptr->semval + sopptr->sem_op < 0) { 823 #ifdef SEM_DEBUG 824 kprintf("semop: can't do it now\n"); 825 #endif 826 break; 827 } else { 828 semptr->semval += sopptr->sem_op; 829 if (semptr->semval == 0 && 830 semptr->semzcnt > 0) 831 do_wakeup = 1; 832 } 833 if (sopptr->sem_flg & SEM_UNDO) 834 do_undos = 1; 835 } else if (sopptr->sem_op == 0) { 836 if (semptr->semval > 0) { 837 #ifdef SEM_DEBUG 838 kprintf("semop: not zero now\n"); 839 #endif 840 break; 841 } 842 } else { 843 if (semptr->semncnt > 0) 844 do_wakeup = 1; 845 semptr->semval += sopptr->sem_op; 846 if (sopptr->sem_flg & SEM_UNDO) 847 do_undos = 1; 848 } 849 } 850 851 /* 852 * Did we get through the entire vector? 853 */ 854 if (i >= nsops) 855 goto donex; 856 857 /* 858 * No ... rollback anything that we've already done 859 */ 860 #ifdef SEM_DEBUG 861 kprintf("semop: rollback 0 through %d\n", i-1); 862 #endif 863 for (j = 0; j < i; j++) 864 semaptr->sem_base[sops[j].sem_num].semval -= 865 sops[j].sem_op; 866 867 /* 868 * If the request that we couldn't satisfy has the 869 * NOWAIT flag set then return with EAGAIN. 870 */ 871 if (sopptr->sem_flg & IPC_NOWAIT) { 872 eval = EAGAIN; 873 goto done; 874 } 875 876 if (sopptr->sem_op == 0) 877 semptr->semzcnt++; 878 else 879 semptr->semncnt++; 880 881 #ifdef SEM_DEBUG 882 kprintf("semop: good night!\n"); 883 #endif 884 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 885 #ifdef SEM_DEBUG 886 kprintf("semop: good morning (eval=%d)!\n", eval); 887 #endif 888 889 suptr = NULL; /* sem_undo may have been reallocated */ 890 891 /* return code is checked below, after sem[nz]cnt-- */ 892 893 /* 894 * Make sure that the semaphore still exists 895 */ 896 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 897 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 898 eval = EIDRM; 899 goto done; 900 } 901 902 /* 903 * The semaphore is still alive. Readjust the count of 904 * waiting processes. 905 */ 906 if (sopptr->sem_op == 0) 907 semptr->semzcnt--; 908 else 909 semptr->semncnt--; 910 911 /* 912 * Is it really morning, or was our sleep interrupted? 913 * (Delayed check of tsleep() return code because we 914 * need to decrement sem[nz]cnt either way.) 915 */ 916 if (eval) { 917 eval = EINTR; 918 goto done; 919 } 920 #ifdef SEM_DEBUG 921 kprintf("semop: good morning!\n"); 922 #endif 923 } 924 925 donex: 926 /* 927 * Process any SEM_UNDO requests. 928 */ 929 if (do_undos) { 930 for (i = 0; i < nsops; i++) { 931 /* 932 * We only need to deal with SEM_UNDO's for non-zero 933 * op's. 934 */ 935 int adjval; 936 937 if ((sops[i].sem_flg & SEM_UNDO) == 0) 938 continue; 939 adjval = sops[i].sem_op; 940 if (adjval == 0) 941 continue; 942 eval = semundo_adjust(td->td_proc, &suptr, semid, 943 sops[i].sem_num, -adjval); 944 if (eval == 0) 945 continue; 946 947 /* 948 * Oh-Oh! We ran out of either sem_undo's or undo's. 949 * Rollback the adjustments to this point and then 950 * rollback the semaphore ups and down so we can return 951 * with an error with all structures restored. We 952 * rollback the undo's in the exact reverse order that 953 * we applied them. This guarantees that we won't run 954 * out of space as we roll things back out. 955 */ 956 for (j = i - 1; j >= 0; j--) { 957 if ((sops[j].sem_flg & SEM_UNDO) == 0) 958 continue; 959 adjval = sops[j].sem_op; 960 if (adjval == 0) 961 continue; 962 if (semundo_adjust(td->td_proc, &suptr, semid, 963 sops[j].sem_num, adjval) != 0) 964 panic("semop - can't undo undos"); 965 } 966 967 for (j = 0; j < nsops; j++) 968 semaptr->sem_base[sops[j].sem_num].semval -= 969 sops[j].sem_op; 970 971 #ifdef SEM_DEBUG 972 kprintf("eval = %d from semundo_adjust\n", eval); 973 #endif 974 goto done; 975 } /* loop through the sops */ 976 } /* if (do_undos) */ 977 978 /* We're definitely done - set the sempid's */ 979 for (i = 0; i < nsops; i++) { 980 sopptr = &sops[i]; 981 semptr = &semaptr->sem_base[sopptr->sem_num]; 982 semptr->sempid = td->td_proc->p_pid; 983 } 984 985 /* Do a wakeup if any semaphore was up'd. */ 986 if (do_wakeup) { 987 #ifdef SEM_DEBUG 988 kprintf("semop: doing wakeup\n"); 989 #endif 990 wakeup((caddr_t)semaptr); 991 #ifdef SEM_DEBUG 992 kprintf("semop: back from wakeup\n"); 993 #endif 994 } 995 #ifdef SEM_DEBUG 996 kprintf("semop: done\n"); 997 #endif 998 uap->sysmsg_result = 0; 999 eval = 0; 1000 done: 1001 rel_mplock(); 1002 return(eval); 1003 } 1004 1005 /* 1006 * Go through the undo structures for this process and apply the adjustments to 1007 * semaphores. 1008 */ 1009 void 1010 semexit(struct proc *p) 1011 { 1012 struct sem_undo *suptr; 1013 struct sem_undo **supptr; 1014 int did_something; 1015 1016 did_something = 0; 1017 1018 /* 1019 * Go through the chain of undo vectors looking for one 1020 * associated with this process. 1021 */ 1022 1023 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1024 supptr = &suptr->un_next) { 1025 if (suptr->un_proc == p) 1026 break; 1027 } 1028 1029 if (suptr == NULL) 1030 return; 1031 1032 #ifdef SEM_DEBUG 1033 kprintf("proc @%08x has undo structure with %d entries\n", p, 1034 suptr->un_cnt); 1035 #endif 1036 1037 /* 1038 * If there are any active undo elements then process them. 1039 */ 1040 if (suptr->un_cnt > 0) { 1041 int ix; 1042 1043 for (ix = 0; ix < suptr->un_cnt; ix++) { 1044 int semid = suptr->un_ent[ix].un_id; 1045 int semnum = suptr->un_ent[ix].un_num; 1046 int adjval = suptr->un_ent[ix].un_adjval; 1047 struct semid_ds *semaptr; 1048 1049 semaptr = &sema[semid]; 1050 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1051 panic("semexit - semid not allocated"); 1052 if (semnum >= semaptr->sem_nsems) 1053 panic("semexit - semnum out of range"); 1054 1055 #ifdef SEM_DEBUG 1056 kprintf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1057 suptr->un_proc, suptr->un_ent[ix].un_id, 1058 suptr->un_ent[ix].un_num, 1059 suptr->un_ent[ix].un_adjval, 1060 semaptr->sem_base[semnum].semval); 1061 #endif 1062 1063 if (adjval < 0) { 1064 if (semaptr->sem_base[semnum].semval < -adjval) 1065 semaptr->sem_base[semnum].semval = 0; 1066 else 1067 semaptr->sem_base[semnum].semval += 1068 adjval; 1069 } else 1070 semaptr->sem_base[semnum].semval += adjval; 1071 1072 wakeup((caddr_t)semaptr); 1073 #ifdef SEM_DEBUG 1074 kprintf("semexit: back from wakeup\n"); 1075 #endif 1076 } 1077 } 1078 1079 /* 1080 * Deallocate the undo vector. 1081 */ 1082 #ifdef SEM_DEBUG 1083 kprintf("removing vector\n"); 1084 #endif 1085 suptr->un_proc = NULL; 1086 *supptr = suptr->un_next; 1087 } 1088