1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.24.2.8 2002/10/22 20:45:03 fjoe Exp $ */ 2 /* $DragonFly: src/sys/kern/sysv_sem.c,v 1.12 2003/08/26 21:09:02 rob Exp $ */ 3 4 /* 5 * Implementation of SVID semaphores 6 * 7 * Author: Daniel Boulet 8 * 9 * This software is provided ``AS IS'' without any warranties of any kind. 10 */ 11 12 #include "opt_sysvipc.h" 13 14 #include <sys/param.h> 15 #include <sys/systm.h> 16 #include <sys/sysproto.h> 17 #include <sys/kernel.h> 18 #include <sys/proc.h> 19 #include <sys/sem.h> 20 #include <sys/sysent.h> 21 #include <sys/sysctl.h> 22 #include <sys/malloc.h> 23 #include <sys/jail.h> 24 25 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 26 27 static void seminit (void *); 28 29 #ifndef _SYS_SYSPROTO_H_ 30 struct __semctl_args; 31 int __semctl (struct proc *p, struct __semctl_args *uap); 32 struct semget_args; 33 int semget (struct proc *p, struct semget_args *uap); 34 struct semop_args; 35 int semop (struct proc *p, struct semop_args *uap); 36 #endif 37 38 static struct sem_undo *semu_alloc (struct proc *p); 39 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 40 int semid, int semnum, int adjval); 41 static void semundo_clear (int semid, int semnum); 42 43 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 44 static sy_call_t *semcalls[] = { 45 (sy_call_t *)__semctl, (sy_call_t *)semget, 46 (sy_call_t *)semop 47 }; 48 49 static int semtot = 0; 50 static struct semid_ds *sema; /* semaphore id pool */ 51 static struct sem *sem; /* semaphore pool */ 52 static struct sem_undo *semu_list; /* list of active undo structures */ 53 static int *semu; /* undo structure pool */ 54 55 struct sem { 56 u_short semval; /* semaphore value */ 57 pid_t sempid; /* pid of last operation */ 58 u_short semncnt; /* # awaiting semval > cval */ 59 u_short semzcnt; /* # awaiting semval = 0 */ 60 }; 61 62 /* 63 * Undo structure (one per process) 64 */ 65 struct sem_undo { 66 struct sem_undo *un_next; /* ptr to next active undo structure */ 67 struct proc *un_proc; /* owner of this structure */ 68 short un_cnt; /* # of active entries */ 69 struct undo { 70 short un_adjval; /* adjust on exit values */ 71 short un_num; /* semaphore # */ 72 int un_id; /* semid */ 73 } un_ent[1]; /* undo entries */ 74 }; 75 76 /* 77 * Configuration parameters 78 */ 79 #ifndef SEMMNI 80 #define SEMMNI 10 /* # of semaphore identifiers */ 81 #endif 82 #ifndef SEMMNS 83 #define SEMMNS 60 /* # of semaphores in system */ 84 #endif 85 #ifndef SEMUME 86 #define SEMUME 10 /* max # of undo entries per process */ 87 #endif 88 #ifndef SEMMNU 89 #define SEMMNU 30 /* # of undo structures in system */ 90 #endif 91 92 /* shouldn't need tuning */ 93 #ifndef SEMMAP 94 #define SEMMAP 30 /* # of entries in semaphore map */ 95 #endif 96 #ifndef SEMMSL 97 #define SEMMSL SEMMNS /* max # of semaphores per id */ 98 #endif 99 #ifndef SEMOPM 100 #define SEMOPM 100 /* max # of operations per semop call */ 101 #endif 102 103 #define SEMVMX 32767 /* semaphore maximum value */ 104 #define SEMAEM 16384 /* adjust on exit max value */ 105 106 /* 107 * Due to the way semaphore memory is allocated, we have to ensure that 108 * SEMUSZ is properly aligned. 109 */ 110 111 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 112 113 /* actual size of an undo structure */ 114 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 115 116 /* 117 * Macro to find a particular sem_undo vector 118 */ 119 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 120 121 /* 122 * semaphore info struct 123 */ 124 struct seminfo seminfo = { 125 SEMMAP, /* # of entries in semaphore map */ 126 SEMMNI, /* # of semaphore identifiers */ 127 SEMMNS, /* # of semaphores in system */ 128 SEMMNU, /* # of undo structures in system */ 129 SEMMSL, /* max # of semaphores per id */ 130 SEMOPM, /* max # of operations per semop call */ 131 SEMUME, /* max # of undo entries per process */ 132 SEMUSZ, /* size in bytes of undo structure */ 133 SEMVMX, /* semaphore maximum value */ 134 SEMAEM /* adjust on exit max value */ 135 }; 136 137 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 138 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 139 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 140 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 141 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 142 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 143 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 144 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 145 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 146 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 147 148 SYSCTL_DECL(_kern_ipc); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 150 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 152 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 154 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 155 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 156 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 157 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 158 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 159 160 #if 0 161 RO seminfo.semmap /* SEMMAP unused */ 162 RO seminfo.semmni 163 RO seminfo.semmns 164 RO seminfo.semmnu /* undo entries per system */ 165 RW seminfo.semmsl 166 RO seminfo.semopm /* SEMOPM unused */ 167 RO seminfo.semume 168 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 169 RO seminfo.semvmx /* SEMVMX unused - user param */ 170 RO seminfo.semaem /* SEMAEM unused - user param */ 171 #endif 172 173 static void 174 seminit(dummy) 175 void *dummy; 176 { 177 int i; 178 179 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 180 if (sem == NULL) 181 panic("sem is NULL"); 182 sema = malloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 183 if (sema == NULL) 184 panic("sema is NULL"); 185 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 186 if (semu == NULL) 187 panic("semu is NULL"); 188 189 for (i = 0; i < seminfo.semmni; i++) { 190 sema[i].sem_base = 0; 191 sema[i].sem_perm.mode = 0; 192 } 193 for (i = 0; i < seminfo.semmnu; i++) { 194 struct sem_undo *suptr = SEMU(i); 195 suptr->un_proc = NULL; 196 } 197 semu_list = NULL; 198 } 199 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 200 201 /* 202 * Entry point for all SEM calls 203 * 204 * semsys_args(int which, a2, a3, ...) (VARARGS) 205 */ 206 int 207 semsys(struct semsys_args *uap) 208 { 209 struct proc *p = curproc; 210 unsigned int which = (unsigned int)uap->which; 211 212 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 213 return (ENOSYS); 214 215 if (which >= sizeof(semcalls)/sizeof(semcalls[0])) 216 return (EINVAL); 217 bcopy(&uap->a2, &uap->which, 218 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 219 return ((*semcalls[which])(uap)); 220 } 221 222 /* 223 * Allocate a new sem_undo structure for a process 224 * (returns ptr to structure or NULL if no more room) 225 */ 226 227 static struct sem_undo * 228 semu_alloc(p) 229 struct proc *p; 230 { 231 int i; 232 struct sem_undo *suptr; 233 struct sem_undo **supptr; 234 int attempt; 235 236 /* 237 * Try twice to allocate something. 238 * (we'll purge any empty structures after the first pass so 239 * two passes are always enough) 240 */ 241 242 for (attempt = 0; attempt < 2; attempt++) { 243 /* 244 * Look for a free structure. 245 * Fill it in and return it if we find one. 246 */ 247 248 for (i = 0; i < seminfo.semmnu; i++) { 249 suptr = SEMU(i); 250 if (suptr->un_proc == NULL) { 251 suptr->un_next = semu_list; 252 semu_list = suptr; 253 suptr->un_cnt = 0; 254 suptr->un_proc = p; 255 return(suptr); 256 } 257 } 258 259 /* 260 * We didn't find a free one, if this is the first attempt 261 * then try to free some structures. 262 */ 263 264 if (attempt == 0) { 265 /* All the structures are in use - try to free some */ 266 int did_something = 0; 267 268 supptr = &semu_list; 269 while ((suptr = *supptr) != NULL) { 270 if (suptr->un_cnt == 0) { 271 suptr->un_proc = NULL; 272 *supptr = suptr->un_next; 273 did_something = 1; 274 } else 275 supptr = &(suptr->un_next); 276 } 277 278 /* If we didn't free anything then just give-up */ 279 if (!did_something) 280 return(NULL); 281 } else { 282 /* 283 * The second pass failed even though we freed 284 * something after the first pass! 285 * This is IMPOSSIBLE! 286 */ 287 panic("semu_alloc - second attempt failed"); 288 } 289 } 290 return (NULL); 291 } 292 293 /* 294 * Adjust a particular entry for a particular proc 295 */ 296 297 static int 298 semundo_adjust(p, supptr, semid, semnum, adjval) 299 struct proc *p; 300 struct sem_undo **supptr; 301 int semid, semnum; 302 int adjval; 303 { 304 struct sem_undo *suptr; 305 struct undo *sunptr; 306 int i; 307 308 /* Look for and remember the sem_undo if the caller doesn't provide 309 it */ 310 311 suptr = *supptr; 312 if (suptr == NULL) { 313 for (suptr = semu_list; suptr != NULL; 314 suptr = suptr->un_next) { 315 if (suptr->un_proc == p) { 316 *supptr = suptr; 317 break; 318 } 319 } 320 if (suptr == NULL) { 321 if (adjval == 0) 322 return(0); 323 suptr = semu_alloc(p); 324 if (suptr == NULL) 325 return(ENOSPC); 326 *supptr = suptr; 327 } 328 } 329 330 /* 331 * Look for the requested entry and adjust it (delete if adjval becomes 332 * 0). 333 */ 334 sunptr = &suptr->un_ent[0]; 335 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 336 if (sunptr->un_id != semid || sunptr->un_num != semnum) 337 continue; 338 if (adjval == 0) 339 sunptr->un_adjval = 0; 340 else 341 sunptr->un_adjval += adjval; 342 if (sunptr->un_adjval == 0) { 343 suptr->un_cnt--; 344 if (i < suptr->un_cnt) 345 suptr->un_ent[i] = 346 suptr->un_ent[suptr->un_cnt]; 347 } 348 return(0); 349 } 350 351 /* Didn't find the right entry - create it */ 352 if (adjval == 0) 353 return(0); 354 if (suptr->un_cnt != seminfo.semume) { 355 sunptr = &suptr->un_ent[suptr->un_cnt]; 356 suptr->un_cnt++; 357 sunptr->un_adjval = adjval; 358 sunptr->un_id = semid; sunptr->un_num = semnum; 359 } else 360 return(EINVAL); 361 return(0); 362 } 363 364 static void 365 semundo_clear(semid, semnum) 366 int semid, semnum; 367 { 368 struct sem_undo *suptr; 369 370 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 371 struct undo *sunptr = &suptr->un_ent[0]; 372 int i = 0; 373 374 while (i < suptr->un_cnt) { 375 if (sunptr->un_id == semid) { 376 if (semnum == -1 || sunptr->un_num == semnum) { 377 suptr->un_cnt--; 378 if (i < suptr->un_cnt) { 379 suptr->un_ent[i] = 380 suptr->un_ent[suptr->un_cnt]; 381 continue; 382 } 383 } 384 if (semnum != -1) 385 break; 386 } 387 i++, sunptr++; 388 } 389 } 390 } 391 392 /* 393 * Note that the user-mode half of this passes a union, not a pointer 394 */ 395 396 int 397 __semctl(struct __semctl_args *uap) 398 { 399 struct proc *p = curproc; 400 int semid = uap->semid; 401 int semnum = uap->semnum; 402 int cmd = uap->cmd; 403 union semun *arg = uap->arg; 404 union semun real_arg; 405 struct ucred *cred = p->p_ucred; 406 int i, rval, eval; 407 struct semid_ds sbuf; 408 struct semid_ds *semaptr; 409 410 #ifdef SEM_DEBUG 411 printf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 412 #endif 413 414 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 415 return (ENOSYS); 416 417 semid = IPCID_TO_IX(semid); 418 if (semid < 0 || semid >= seminfo.semmni) 419 return(EINVAL); 420 421 semaptr = &sema[semid]; 422 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 423 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 424 return(EINVAL); 425 426 eval = 0; 427 rval = 0; 428 429 switch (cmd) { 430 case IPC_RMID: 431 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_M))) 432 return(eval); 433 semaptr->sem_perm.cuid = cred->cr_uid; 434 semaptr->sem_perm.uid = cred->cr_uid; 435 semtot -= semaptr->sem_nsems; 436 for (i = semaptr->sem_base - sem; i < semtot; i++) 437 sem[i] = sem[i + semaptr->sem_nsems]; 438 for (i = 0; i < seminfo.semmni; i++) { 439 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 440 sema[i].sem_base > semaptr->sem_base) 441 sema[i].sem_base -= semaptr->sem_nsems; 442 } 443 semaptr->sem_perm.mode = 0; 444 semundo_clear(semid, -1); 445 wakeup((caddr_t)semaptr); 446 break; 447 448 case IPC_SET: 449 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_M))) 450 return(eval); 451 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 452 return(eval); 453 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 454 sizeof(sbuf))) != 0) 455 return(eval); 456 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 457 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 458 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 459 (sbuf.sem_perm.mode & 0777); 460 semaptr->sem_ctime = time_second; 461 break; 462 463 case IPC_STAT: 464 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 465 return(eval); 466 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 467 return(eval); 468 eval = copyout((caddr_t)semaptr, real_arg.buf, 469 sizeof(struct semid_ds)); 470 break; 471 472 case GETNCNT: 473 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 474 return(eval); 475 if (semnum < 0 || semnum >= semaptr->sem_nsems) 476 return(EINVAL); 477 rval = semaptr->sem_base[semnum].semncnt; 478 break; 479 480 case GETPID: 481 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 482 return(eval); 483 if (semnum < 0 || semnum >= semaptr->sem_nsems) 484 return(EINVAL); 485 rval = semaptr->sem_base[semnum].sempid; 486 break; 487 488 case GETVAL: 489 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 490 return(eval); 491 if (semnum < 0 || semnum >= semaptr->sem_nsems) 492 return(EINVAL); 493 rval = semaptr->sem_base[semnum].semval; 494 break; 495 496 case GETALL: 497 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 498 return(eval); 499 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 500 return(eval); 501 for (i = 0; i < semaptr->sem_nsems; i++) { 502 eval = copyout((caddr_t)&semaptr->sem_base[i].semval, 503 &real_arg.array[i], sizeof(real_arg.array[0])); 504 if (eval != 0) 505 break; 506 } 507 break; 508 509 case GETZCNT: 510 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 511 return(eval); 512 if (semnum < 0 || semnum >= semaptr->sem_nsems) 513 return(EINVAL); 514 rval = semaptr->sem_base[semnum].semzcnt; 515 break; 516 517 case SETVAL: 518 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) 519 return(eval); 520 if (semnum < 0 || semnum >= semaptr->sem_nsems) 521 return(EINVAL); 522 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 523 return(eval); 524 semaptr->sem_base[semnum].semval = real_arg.val; 525 semundo_clear(semid, semnum); 526 wakeup((caddr_t)semaptr); 527 break; 528 529 case SETALL: 530 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) 531 return(eval); 532 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 533 return(eval); 534 for (i = 0; i < semaptr->sem_nsems; i++) { 535 eval = copyin(&real_arg.array[i], 536 (caddr_t)&semaptr->sem_base[i].semval, 537 sizeof(real_arg.array[0])); 538 if (eval != 0) 539 break; 540 } 541 semundo_clear(semid, -1); 542 wakeup((caddr_t)semaptr); 543 break; 544 545 default: 546 return(EINVAL); 547 } 548 549 if (eval == 0) 550 uap->sysmsg_result = rval; 551 return(eval); 552 } 553 554 int 555 semget(struct semget_args *uap) 556 { 557 struct proc *p = curproc; 558 int semid, eval; 559 int key = uap->key; 560 int nsems = uap->nsems; 561 int semflg = uap->semflg; 562 struct ucred *cred = p->p_ucred; 563 564 #ifdef SEM_DEBUG 565 printf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 566 #endif 567 568 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 569 return (ENOSYS); 570 571 if (key != IPC_PRIVATE) { 572 for (semid = 0; semid < seminfo.semmni; semid++) { 573 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 574 sema[semid].sem_perm.key == key) 575 break; 576 } 577 if (semid < seminfo.semmni) { 578 #ifdef SEM_DEBUG 579 printf("found public key\n"); 580 #endif 581 if ((eval = ipcperm(p, &sema[semid].sem_perm, 582 semflg & 0700))) 583 return(eval); 584 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 585 #ifdef SEM_DEBUG 586 printf("too small\n"); 587 #endif 588 return(EINVAL); 589 } 590 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 591 #ifdef SEM_DEBUG 592 printf("not exclusive\n"); 593 #endif 594 return(EEXIST); 595 } 596 goto found; 597 } 598 } 599 600 #ifdef SEM_DEBUG 601 printf("need to allocate the semid_ds\n"); 602 #endif 603 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 604 if (nsems <= 0 || nsems > seminfo.semmsl) { 605 #ifdef SEM_DEBUG 606 printf("nsems out of range (0<%d<=%d)\n", nsems, 607 seminfo.semmsl); 608 #endif 609 return(EINVAL); 610 } 611 if (nsems > seminfo.semmns - semtot) { 612 #ifdef SEM_DEBUG 613 printf("not enough semaphores left (need %d, got %d)\n", 614 nsems, seminfo.semmns - semtot); 615 #endif 616 return(ENOSPC); 617 } 618 for (semid = 0; semid < seminfo.semmni; semid++) { 619 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 620 break; 621 } 622 if (semid == seminfo.semmni) { 623 #ifdef SEM_DEBUG 624 printf("no more semid_ds's available\n"); 625 #endif 626 return(ENOSPC); 627 } 628 #ifdef SEM_DEBUG 629 printf("semid %d is available\n", semid); 630 #endif 631 sema[semid].sem_perm.key = key; 632 sema[semid].sem_perm.cuid = cred->cr_uid; 633 sema[semid].sem_perm.uid = cred->cr_uid; 634 sema[semid].sem_perm.cgid = cred->cr_gid; 635 sema[semid].sem_perm.gid = cred->cr_gid; 636 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 637 sema[semid].sem_perm.seq = 638 (sema[semid].sem_perm.seq + 1) & 0x7fff; 639 sema[semid].sem_nsems = nsems; 640 sema[semid].sem_otime = 0; 641 sema[semid].sem_ctime = time_second; 642 sema[semid].sem_base = &sem[semtot]; 643 semtot += nsems; 644 bzero(sema[semid].sem_base, 645 sizeof(sema[semid].sem_base[0])*nsems); 646 #ifdef SEM_DEBUG 647 printf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 648 &sem[semtot]); 649 #endif 650 } else { 651 #ifdef SEM_DEBUG 652 printf("didn't find it and wasn't asked to create it\n"); 653 #endif 654 return(ENOENT); 655 } 656 657 found: 658 uap->sysmsg_result = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 659 return(0); 660 } 661 662 int 663 semop(struct semop_args *uap) 664 { 665 struct proc *p = curproc; 666 int semid = uap->semid; 667 u_int nsops = uap->nsops; 668 struct sembuf sops[MAX_SOPS]; 669 struct semid_ds *semaptr; 670 struct sembuf *sopptr; 671 struct sem *semptr; 672 struct sem_undo *suptr = NULL; 673 int i, j, eval; 674 int do_wakeup, do_undos; 675 676 #ifdef SEM_DEBUG 677 printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 678 #endif 679 680 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 681 return (ENOSYS); 682 683 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 684 685 if (semid < 0 || semid >= seminfo.semmni) 686 return(EINVAL); 687 688 semaptr = &sema[semid]; 689 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 690 return(EINVAL); 691 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 692 return(EINVAL); 693 694 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) { 695 #ifdef SEM_DEBUG 696 printf("eval = %d from ipaccess\n", eval); 697 #endif 698 return(eval); 699 } 700 701 if (nsops > MAX_SOPS) { 702 #ifdef SEM_DEBUG 703 printf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 704 #endif 705 return(E2BIG); 706 } 707 708 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 709 #ifdef SEM_DEBUG 710 printf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 711 uap->sops, &sops, nsops * sizeof(sops[0])); 712 #endif 713 return(eval); 714 } 715 716 /* 717 * Loop trying to satisfy the vector of requests. 718 * If we reach a point where we must wait, any requests already 719 * performed are rolled back and we go to sleep until some other 720 * process wakes us up. At this point, we start all over again. 721 * 722 * This ensures that from the perspective of other tasks, a set 723 * of requests is atomic (never partially satisfied). 724 */ 725 do_undos = 0; 726 727 for (;;) { 728 do_wakeup = 0; 729 730 for (i = 0; i < nsops; i++) { 731 sopptr = &sops[i]; 732 733 if (sopptr->sem_num >= semaptr->sem_nsems) 734 return(EFBIG); 735 736 semptr = &semaptr->sem_base[sopptr->sem_num]; 737 738 #ifdef SEM_DEBUG 739 printf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 740 semaptr, semaptr->sem_base, semptr, 741 sopptr->sem_num, semptr->semval, sopptr->sem_op, 742 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 743 #endif 744 745 if (sopptr->sem_op < 0) { 746 if (semptr->semval + sopptr->sem_op < 0) { 747 #ifdef SEM_DEBUG 748 printf("semop: can't do it now\n"); 749 #endif 750 break; 751 } else { 752 semptr->semval += sopptr->sem_op; 753 if (semptr->semval == 0 && 754 semptr->semzcnt > 0) 755 do_wakeup = 1; 756 } 757 if (sopptr->sem_flg & SEM_UNDO) 758 do_undos = 1; 759 } else if (sopptr->sem_op == 0) { 760 if (semptr->semval > 0) { 761 #ifdef SEM_DEBUG 762 printf("semop: not zero now\n"); 763 #endif 764 break; 765 } 766 } else { 767 if (semptr->semncnt > 0) 768 do_wakeup = 1; 769 semptr->semval += sopptr->sem_op; 770 if (sopptr->sem_flg & SEM_UNDO) 771 do_undos = 1; 772 } 773 } 774 775 /* 776 * Did we get through the entire vector? 777 */ 778 if (i >= nsops) 779 goto done; 780 781 /* 782 * No ... rollback anything that we've already done 783 */ 784 #ifdef SEM_DEBUG 785 printf("semop: rollback 0 through %d\n", i-1); 786 #endif 787 for (j = 0; j < i; j++) 788 semaptr->sem_base[sops[j].sem_num].semval -= 789 sops[j].sem_op; 790 791 /* 792 * If the request that we couldn't satisfy has the 793 * NOWAIT flag set then return with EAGAIN. 794 */ 795 if (sopptr->sem_flg & IPC_NOWAIT) 796 return(EAGAIN); 797 798 if (sopptr->sem_op == 0) 799 semptr->semzcnt++; 800 else 801 semptr->semncnt++; 802 803 #ifdef SEM_DEBUG 804 printf("semop: good night!\n"); 805 #endif 806 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 807 #ifdef SEM_DEBUG 808 printf("semop: good morning (eval=%d)!\n", eval); 809 #endif 810 811 suptr = NULL; /* sem_undo may have been reallocated */ 812 813 if (eval != 0) 814 return(EINTR); 815 #ifdef SEM_DEBUG 816 printf("semop: good morning!\n"); 817 #endif 818 819 /* 820 * Make sure that the semaphore still exists 821 */ 822 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 823 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 824 return(EIDRM); 825 826 /* 827 * The semaphore is still alive. Readjust the count of 828 * waiting processes. 829 */ 830 if (sopptr->sem_op == 0) 831 semptr->semzcnt--; 832 else 833 semptr->semncnt--; 834 } 835 836 done: 837 /* 838 * Process any SEM_UNDO requests. 839 */ 840 if (do_undos) { 841 for (i = 0; i < nsops; i++) { 842 /* 843 * We only need to deal with SEM_UNDO's for non-zero 844 * op's. 845 */ 846 int adjval; 847 848 if ((sops[i].sem_flg & SEM_UNDO) == 0) 849 continue; 850 adjval = sops[i].sem_op; 851 if (adjval == 0) 852 continue; 853 eval = semundo_adjust(p, &suptr, semid, 854 sops[i].sem_num, -adjval); 855 if (eval == 0) 856 continue; 857 858 /* 859 * Oh-Oh! We ran out of either sem_undo's or undo's. 860 * Rollback the adjustments to this point and then 861 * rollback the semaphore ups and down so we can return 862 * with an error with all structures restored. We 863 * rollback the undo's in the exact reverse order that 864 * we applied them. This guarantees that we won't run 865 * out of space as we roll things back out. 866 */ 867 for (j = i - 1; j >= 0; j--) { 868 if ((sops[j].sem_flg & SEM_UNDO) == 0) 869 continue; 870 adjval = sops[j].sem_op; 871 if (adjval == 0) 872 continue; 873 if (semundo_adjust(p, &suptr, semid, 874 sops[j].sem_num, adjval) != 0) 875 panic("semop - can't undo undos"); 876 } 877 878 for (j = 0; j < nsops; j++) 879 semaptr->sem_base[sops[j].sem_num].semval -= 880 sops[j].sem_op; 881 882 #ifdef SEM_DEBUG 883 printf("eval = %d from semundo_adjust\n", eval); 884 #endif 885 return(eval); 886 } /* loop through the sops */ 887 } /* if (do_undos) */ 888 889 /* We're definitely done - set the sempid's */ 890 for (i = 0; i < nsops; i++) { 891 sopptr = &sops[i]; 892 semptr = &semaptr->sem_base[sopptr->sem_num]; 893 semptr->sempid = p->p_pid; 894 } 895 896 /* Do a wakeup if any semaphore was up'd. */ 897 if (do_wakeup) { 898 #ifdef SEM_DEBUG 899 printf("semop: doing wakeup\n"); 900 #endif 901 wakeup((caddr_t)semaptr); 902 #ifdef SEM_DEBUG 903 printf("semop: back from wakeup\n"); 904 #endif 905 } 906 #ifdef SEM_DEBUG 907 printf("semop: done\n"); 908 #endif 909 uap->sysmsg_result = 0; 910 return(0); 911 } 912 913 /* 914 * Go through the undo structures for this process and apply the adjustments to 915 * semaphores. 916 */ 917 void 918 semexit(p) 919 struct proc *p; 920 { 921 struct sem_undo *suptr; 922 struct sem_undo **supptr; 923 int did_something; 924 925 did_something = 0; 926 927 /* 928 * Go through the chain of undo vectors looking for one 929 * associated with this process. 930 */ 931 932 for (supptr = &semu_list; (suptr = *supptr) != NULL; 933 supptr = &suptr->un_next) { 934 if (suptr->un_proc == p) 935 break; 936 } 937 938 if (suptr == NULL) 939 return; 940 941 #ifdef SEM_DEBUG 942 printf("proc @%08x has undo structure with %d entries\n", p, 943 suptr->un_cnt); 944 #endif 945 946 /* 947 * If there are any active undo elements then process them. 948 */ 949 if (suptr->un_cnt > 0) { 950 int ix; 951 952 for (ix = 0; ix < suptr->un_cnt; ix++) { 953 int semid = suptr->un_ent[ix].un_id; 954 int semnum = suptr->un_ent[ix].un_num; 955 int adjval = suptr->un_ent[ix].un_adjval; 956 struct semid_ds *semaptr; 957 958 semaptr = &sema[semid]; 959 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 960 panic("semexit - semid not allocated"); 961 if (semnum >= semaptr->sem_nsems) 962 panic("semexit - semnum out of range"); 963 964 #ifdef SEM_DEBUG 965 printf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 966 suptr->un_proc, suptr->un_ent[ix].un_id, 967 suptr->un_ent[ix].un_num, 968 suptr->un_ent[ix].un_adjval, 969 semaptr->sem_base[semnum].semval); 970 #endif 971 972 if (adjval < 0) { 973 if (semaptr->sem_base[semnum].semval < -adjval) 974 semaptr->sem_base[semnum].semval = 0; 975 else 976 semaptr->sem_base[semnum].semval += 977 adjval; 978 } else 979 semaptr->sem_base[semnum].semval += adjval; 980 981 wakeup((caddr_t)semaptr); 982 #ifdef SEM_DEBUG 983 printf("semexit: back from wakeup\n"); 984 #endif 985 } 986 } 987 988 /* 989 * Deallocate the undo vector. 990 */ 991 #ifdef SEM_DEBUG 992 printf("removing vector\n"); 993 #endif 994 suptr->un_proc = NULL; 995 *supptr = suptr->un_next; 996 } 997