xref: /dragonfly/sys/kern/sysv_sem.c (revision dcd37f7d) 
1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */
2 /* $DragonFly: src/sys/kern/sysv_sem.c,v 1.19 2008/01/06 16:55:51 swildner Exp $ */
3 
4 /*
5  * Implementation of SVID semaphores
6  *
7  * Author:  Daniel Boulet
8  *
9  * This software is provided ``AS IS'' without any warranties of any kind.
10  */
11 
12 #include "opt_sysvipc.h"
13 
14 #include <sys/param.h>
15 #include <sys/systm.h>
16 #include <sys/sysproto.h>
17 #include <sys/kernel.h>
18 #include <sys/proc.h>
19 #include <sys/sem.h>
20 #include <sys/sysent.h>
21 #include <sys/sysctl.h>
22 #include <sys/malloc.h>
23 #include <sys/jail.h>
24 
25 #include <sys/mplock2.h>
26 
27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores");
28 
29 static void seminit (void *);
30 
31 static struct sem_undo *semu_alloc (struct proc *p);
32 static int semundo_adjust (struct proc *p, struct sem_undo **supptr,
33 		int semid, int semnum, int adjval);
34 static void semundo_clear (int semid, int semnum);
35 
36 /* XXX casting to (sy_call_t *) is bogus, as usual. */
37 static sy_call_t *semcalls[] = {
38 	(sy_call_t *)sys___semctl, (sy_call_t *)sys_semget,
39 	(sy_call_t *)sys_semop
40 };
41 
42 static int	semtot = 0;
43 static struct semid_ds *sema;	/* semaphore id pool */
44 static struct sem *sem;		/* semaphore pool */
45 static struct sem_undo *semu_list; /* list of active undo structures */
46 static int	*semu;		/* undo structure pool */
47 
48 struct sem {
49 	u_short	semval;		/* semaphore value */
50 	pid_t	sempid;		/* pid of last operation */
51 	u_short	semncnt;	/* # awaiting semval > cval */
52 	u_short	semzcnt;	/* # awaiting semval = 0 */
53 };
54 
55 /*
56  * Undo structure (one per process)
57  */
58 struct sem_undo {
59 	struct	sem_undo *un_next;	/* ptr to next active undo structure */
60 	struct	proc *un_proc;		/* owner of this structure */
61 	short	un_cnt;			/* # of active entries */
62 	struct undo {
63 		short	un_adjval;	/* adjust on exit values */
64 		short	un_num;		/* semaphore # */
65 		int	un_id;		/* semid */
66 	} un_ent[1];			/* undo entries */
67 };
68 
69 /*
70  * Configuration parameters
71  */
72 #ifndef SEMMNI
73 #define SEMMNI	10		/* # of semaphore identifiers */
74 #endif
75 #ifndef SEMMNS
76 #define SEMMNS	60		/* # of semaphores in system */
77 #endif
78 #ifndef SEMUME
79 #define SEMUME	10		/* max # of undo entries per process */
80 #endif
81 #ifndef SEMMNU
82 #define SEMMNU	30		/* # of undo structures in system */
83 #endif
84 
85 /* shouldn't need tuning */
86 #ifndef SEMMAP
87 #define SEMMAP	30		/* # of entries in semaphore map */
88 #endif
89 #ifndef SEMMSL
90 #define SEMMSL	SEMMNS		/* max # of semaphores per id */
91 #endif
92 #ifndef SEMOPM
93 #define SEMOPM	100		/* max # of operations per semop call */
94 #endif
95 
96 #define SEMVMX	32767		/* semaphore maximum value */
97 #define SEMAEM	16384		/* adjust on exit max value */
98 
99 /*
100  * Due to the way semaphore memory is allocated, we have to ensure that
101  * SEMUSZ is properly aligned.
102  */
103 
104 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1))
105 
106 /* actual size of an undo structure */
107 #define SEMUSZ	SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME]))
108 
109 /*
110  * Macro to find a particular sem_undo vector
111  */
112 #define SEMU(ix)	((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz))
113 
114 /*
115  * semaphore info struct
116  */
117 struct seminfo seminfo = {
118                 SEMMAP,         /* # of entries in semaphore map */
119                 SEMMNI,         /* # of semaphore identifiers */
120                 SEMMNS,         /* # of semaphores in system */
121                 SEMMNU,         /* # of undo structures in system */
122                 SEMMSL,         /* max # of semaphores per id */
123                 SEMOPM,         /* max # of operations per semop call */
124                 SEMUME,         /* max # of undo entries per process */
125                 SEMUSZ,         /* size in bytes of undo structure */
126                 SEMVMX,         /* semaphore maximum value */
127                 SEMAEM          /* adjust on exit max value */
128 };
129 
130 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap);
131 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni);
132 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns);
133 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu);
134 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl);
135 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm);
136 TUNABLE_INT("kern.ipc.semume", &seminfo.semume);
137 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz);
138 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx);
139 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem);
140 
141 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, "");
142 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, "");
143 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, "");
144 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, "");
145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, "");
146 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, "");
147 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, "");
148 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, "");
149 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, "");
150 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, "");
151 
152 #if 0
153 RO seminfo.semmap	/* SEMMAP unused */
154 RO seminfo.semmni
155 RO seminfo.semmns
156 RO seminfo.semmnu	/* undo entries per system */
157 RW seminfo.semmsl
158 RO seminfo.semopm	/* SEMOPM unused */
159 RO seminfo.semume
160 RO seminfo.semusz	/* param - derived from SEMUME for per-proc sizeof */
161 RO seminfo.semvmx	/* SEMVMX unused - user param */
162 RO seminfo.semaem	/* SEMAEM unused - user param */
163 #endif
164 
165 static void
166 seminit(void *dummy)
167 {
168 	int i;
169 
170 	sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK);
171 	sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK);
172 	semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK);
173 
174 	for (i = 0; i < seminfo.semmni; i++) {
175 		sema[i].sem_base = 0;
176 		sema[i].sem_perm.mode = 0;
177 	}
178 	for (i = 0; i < seminfo.semmnu; i++) {
179 		struct sem_undo *suptr = SEMU(i);
180 		suptr->un_proc = NULL;
181 	}
182 	semu_list = NULL;
183 }
184 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL)
185 
186 /*
187  * Entry point for all SEM calls
188  *
189  * semsys_args(int which, a2, a3, ...) (VARARGS)
190  *
191  * MPALMOSTSAFE
192  */
193 int
194 sys_semsys(struct semsys_args *uap)
195 {
196 	struct thread *td = curthread;
197 	unsigned int which = (unsigned int)uap->which;
198 	int error;
199 
200 	if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL)
201 		return (ENOSYS);
202 
203 	if (which >= sizeof(semcalls)/sizeof(semcalls[0]))
204 		return (EINVAL);
205 	bcopy(&uap->a2, &uap->which,
206 	      sizeof(struct semsys_args) - offsetof(struct semsys_args, a2));
207 	get_mplock();
208 	error = (*semcalls[which])(uap);
209 	rel_mplock();
210 	return (error);
211 }
212 
213 /*
214  * Allocate a new sem_undo structure for a process
215  * (returns ptr to structure or NULL if no more room)
216  */
217 
218 static struct sem_undo *
219 semu_alloc(struct proc *p)
220 {
221 	int i;
222 	struct sem_undo *suptr;
223 	struct sem_undo **supptr;
224 	int attempt;
225 
226 	/*
227 	 * Try twice to allocate something.
228 	 * (we'll purge any empty structures after the first pass so
229 	 * two passes are always enough)
230 	 */
231 
232 	for (attempt = 0; attempt < 2; attempt++) {
233 		/*
234 		 * Look for a free structure.
235 		 * Fill it in and return it if we find one.
236 		 */
237 
238 		for (i = 0; i < seminfo.semmnu; i++) {
239 			suptr = SEMU(i);
240 			if (suptr->un_proc == NULL) {
241 				suptr->un_next = semu_list;
242 				semu_list = suptr;
243 				suptr->un_cnt = 0;
244 				suptr->un_proc = p;
245 				return(suptr);
246 			}
247 		}
248 
249 		/*
250 		 * We didn't find a free one, if this is the first attempt
251 		 * then try to free some structures.
252 		 */
253 
254 		if (attempt == 0) {
255 			/* All the structures are in use - try to free some */
256 			int did_something = 0;
257 
258 			supptr = &semu_list;
259 			while ((suptr = *supptr) != NULL) {
260 				if (suptr->un_cnt == 0)  {
261 					suptr->un_proc = NULL;
262 					*supptr = suptr->un_next;
263 					did_something = 1;
264 				} else
265 					supptr = &(suptr->un_next);
266 			}
267 
268 			/* If we didn't free anything then just give-up */
269 			if (!did_something)
270 				return(NULL);
271 		} else {
272 			/*
273 			 * The second pass failed even though we freed
274 			 * something after the first pass!
275 			 * This is IMPOSSIBLE!
276 			 */
277 			panic("semu_alloc - second attempt failed");
278 		}
279 	}
280 	return (NULL);
281 }
282 
283 /*
284  * Adjust a particular entry for a particular proc
285  */
286 
287 static int
288 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum,
289 	       int adjval)
290 {
291 	struct sem_undo *suptr;
292 	struct undo *sunptr;
293 	int i;
294 
295 	/* Look for and remember the sem_undo if the caller doesn't provide
296 	   it */
297 
298 	suptr = *supptr;
299 	if (suptr == NULL) {
300 		for (suptr = semu_list; suptr != NULL;
301 		    suptr = suptr->un_next) {
302 			if (suptr->un_proc == p) {
303 				*supptr = suptr;
304 				break;
305 			}
306 		}
307 		if (suptr == NULL) {
308 			if (adjval == 0)
309 				return(0);
310 			suptr = semu_alloc(p);
311 			if (suptr == NULL)
312 				return(ENOSPC);
313 			*supptr = suptr;
314 		}
315 	}
316 
317 	/*
318 	 * Look for the requested entry and adjust it (delete if adjval becomes
319 	 * 0).
320 	 */
321 	sunptr = &suptr->un_ent[0];
322 	for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
323 		if (sunptr->un_id != semid || sunptr->un_num != semnum)
324 			continue;
325 		if (adjval == 0)
326 			sunptr->un_adjval = 0;
327 		else
328 			sunptr->un_adjval += adjval;
329 		if (sunptr->un_adjval == 0) {
330 			suptr->un_cnt--;
331 			if (i < suptr->un_cnt)
332 				suptr->un_ent[i] =
333 				    suptr->un_ent[suptr->un_cnt];
334 		}
335 		return(0);
336 	}
337 
338 	/* Didn't find the right entry - create it */
339 	if (adjval == 0)
340 		return(0);
341 	if (suptr->un_cnt != seminfo.semume) {
342 		sunptr = &suptr->un_ent[suptr->un_cnt];
343 		suptr->un_cnt++;
344 		sunptr->un_adjval = adjval;
345 		sunptr->un_id = semid; sunptr->un_num = semnum;
346 	} else
347 		return(EINVAL);
348 	return(0);
349 }
350 
351 static void
352 semundo_clear(int semid, int semnum)
353 {
354 	struct sem_undo *suptr;
355 
356 	for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) {
357 		struct undo *sunptr = &suptr->un_ent[0];
358 		int i = 0;
359 
360 		while (i < suptr->un_cnt) {
361 			if (sunptr->un_id == semid) {
362 				if (semnum == -1 || sunptr->un_num == semnum) {
363 					suptr->un_cnt--;
364 					if (i < suptr->un_cnt) {
365 						suptr->un_ent[i] =
366 						  suptr->un_ent[suptr->un_cnt];
367 						continue;
368 					}
369 				}
370 				if (semnum != -1)
371 					break;
372 			}
373 			i++, sunptr++;
374 		}
375 	}
376 }
377 
378 /*
379  * Note that the user-mode half of this passes a union, not a pointer
380  *
381  * MPALMOSTSAFE
382  */
383 int
384 sys___semctl(struct __semctl_args *uap)
385 {
386 	struct thread *td = curthread;
387 	int semid = uap->semid;
388 	int semnum = uap->semnum;
389 	int cmd = uap->cmd;
390 	union semun *arg = uap->arg;
391 	union semun real_arg;
392 	struct ucred *cred = td->td_ucred;
393 	int i, rval, eval;
394 	struct semid_ds sbuf;
395 	struct semid_ds *semaptr;
396 	struct semid_ds *semakptr;
397 
398 #ifdef SEM_DEBUG
399 	kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg);
400 #endif
401 
402 	if (!jail_sysvipc_allowed && cred->cr_prison != NULL)
403 		return (ENOSYS);
404 
405 	get_mplock();
406 	switch (cmd) {
407 	case SEM_STAT:
408 		/*
409 		 * For this command we assume semid is an array index
410 		 * rather than an IPC id.
411 		 */
412 		if (semid < 0 || semid >= seminfo.semmni) {
413 			eval = EINVAL;
414 			break;
415 		}
416 		semakptr = &sema[semid];
417 		if ((semakptr->sem_perm.mode & SEM_ALLOC) == 0) {
418 			eval = EINVAL;
419 			break;
420 		}
421 		if ((eval = ipcperm(td->td_proc, &semakptr->sem_perm, IPC_R)))
422 			break;
423 
424 		bcopy(&semakptr, arg->buf, sizeof(struct semid_ds));
425 		rval = IXSEQ_TO_IPCID(semid, semakptr->sem_perm);
426 		break;
427 	}
428 
429 	semid = IPCID_TO_IX(semid);
430 	if (semid < 0 || semid >= seminfo.semmni) {
431 		rel_mplock();
432 		return(EINVAL);
433 	}
434 
435 	semaptr = &sema[semid];
436 	if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
437 	    semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) {
438 		rel_mplock();
439 		return(EINVAL);
440 	}
441 
442 	eval = 0;
443 	rval = 0;
444 
445 	switch (cmd) {
446 	case IPC_RMID:
447 		if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M)) != 0)
448 			break;
449 		semaptr->sem_perm.cuid = cred->cr_uid;
450 		semaptr->sem_perm.uid = cred->cr_uid;
451 		semtot -= semaptr->sem_nsems;
452 		for (i = semaptr->sem_base - sem; i < semtot; i++)
453 			sem[i] = sem[i + semaptr->sem_nsems];
454 		for (i = 0; i < seminfo.semmni; i++) {
455 			if ((sema[i].sem_perm.mode & SEM_ALLOC) &&
456 			    sema[i].sem_base > semaptr->sem_base)
457 				sema[i].sem_base -= semaptr->sem_nsems;
458 		}
459 		semaptr->sem_perm.mode = 0;
460 		semundo_clear(semid, -1);
461 		wakeup((caddr_t)semaptr);
462 		break;
463 
464 	case IPC_SET:
465 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M);
466 		if (eval)
467 			break;
468 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
469 			break;
470 		if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf,
471 				   sizeof(sbuf))) != 0) {
472 			break;
473 		}
474 		semaptr->sem_perm.uid = sbuf.sem_perm.uid;
475 		semaptr->sem_perm.gid = sbuf.sem_perm.gid;
476 		semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) |
477 					 (sbuf.sem_perm.mode & 0777);
478 		semaptr->sem_ctime = time_second;
479 		break;
480 
481 	case IPC_STAT:
482 		if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R)))
483 			break;
484 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
485 			break;
486 		eval = copyout(semaptr, real_arg.buf, sizeof(struct semid_ds));
487 		break;
488 
489 	case GETNCNT:
490 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R);
491 		if (eval)
492 			break;
493 		if (semnum < 0 || semnum >= semaptr->sem_nsems) {
494 			eval = EINVAL;
495 			break;
496 		}
497 		rval = semaptr->sem_base[semnum].semncnt;
498 		break;
499 
500 	case GETPID:
501 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R);
502 		if (eval)
503 			break;
504 		if (semnum < 0 || semnum >= semaptr->sem_nsems) {
505 			eval = EINVAL;
506 			break;
507 		}
508 		rval = semaptr->sem_base[semnum].sempid;
509 		break;
510 
511 	case GETVAL:
512 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R);
513 		if (eval)
514 			break;
515 		if (semnum < 0 || semnum >= semaptr->sem_nsems) {
516 			eval = EINVAL;
517 			break;
518 		}
519 		rval = semaptr->sem_base[semnum].semval;
520 		break;
521 
522 	case GETALL:
523 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R);
524 		if (eval)
525 			break;
526 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
527 			break;
528 		for (i = 0; i < semaptr->sem_nsems; i++) {
529 			eval = copyout(&semaptr->sem_base[i].semval,
530 				       &real_arg.array[i],
531 				       sizeof(real_arg.array[0]));
532 			if (eval)
533 				break;
534 		}
535 		break;
536 
537 	case GETZCNT:
538 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R);
539 		if (eval)
540 			break;
541 		if (semnum < 0 || semnum >= semaptr->sem_nsems) {
542 			eval = EINVAL;
543 			break;
544 		}
545 		rval = semaptr->sem_base[semnum].semzcnt;
546 		break;
547 
548 	case SETVAL:
549 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W);
550 		if (eval)
551 			break;
552 		if (semnum < 0 || semnum >= semaptr->sem_nsems) {
553 			eval = EINVAL;
554 			break;
555 		}
556 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
557 			break;
558 		semaptr->sem_base[semnum].semval = real_arg.val;
559 		semundo_clear(semid, semnum);
560 		wakeup((caddr_t)semaptr);
561 		break;
562 
563 	case SETALL:
564 		eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W);
565 		if (eval)
566 			break;
567 		if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0)
568 			break;
569 		for (i = 0; i < semaptr->sem_nsems; i++) {
570 			eval = copyin(&real_arg.array[i],
571 			    (caddr_t)&semaptr->sem_base[i].semval,
572 			    sizeof(real_arg.array[0]));
573 			if (eval != 0)
574 				break;
575 		}
576 		semundo_clear(semid, -1);
577 		wakeup((caddr_t)semaptr);
578 		break;
579 
580 	default:
581 		eval = EINVAL;
582 		break;
583 	}
584 	rel_mplock();
585 
586 	if (eval == 0)
587 		uap->sysmsg_result = rval;
588 	return(eval);
589 }
590 
591 /*
592  * MPALMOSTSAFE
593  */
594 int
595 sys_semget(struct semget_args *uap)
596 {
597 	struct thread *td = curthread;
598 	int semid, eval;
599 	int key = uap->key;
600 	int nsems = uap->nsems;
601 	int semflg = uap->semflg;
602 	struct ucred *cred = td->td_ucred;
603 
604 #ifdef SEM_DEBUG
605 	kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg);
606 #endif
607 
608 	if (!jail_sysvipc_allowed && cred->cr_prison != NULL)
609 		return (ENOSYS);
610 
611 	get_mplock();
612 	eval = 0;
613 
614 	if (key != IPC_PRIVATE) {
615 		for (semid = 0; semid < seminfo.semmni; semid++) {
616 			if ((sema[semid].sem_perm.mode & SEM_ALLOC) &&
617 			    sema[semid].sem_perm.key == key)
618 				break;
619 		}
620 		if (semid < seminfo.semmni) {
621 #ifdef SEM_DEBUG
622 			kprintf("found public key\n");
623 #endif
624 			if ((eval = ipcperm(td->td_proc,
625 					    &sema[semid].sem_perm,
626 					    semflg & 0700))) {
627 				goto done;
628 			}
629 			if (nsems > 0 && sema[semid].sem_nsems < nsems) {
630 #ifdef SEM_DEBUG
631 				kprintf("too small\n");
632 #endif
633 				eval = EINVAL;
634 				goto done;
635 			}
636 			if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) {
637 #ifdef SEM_DEBUG
638 				kprintf("not exclusive\n");
639 #endif
640 				eval = EEXIST;
641 				goto done;
642 			}
643 			goto done;
644 		}
645 	}
646 
647 #ifdef SEM_DEBUG
648 	kprintf("need to allocate the semid_ds\n");
649 #endif
650 	if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) {
651 		if (nsems <= 0 || nsems > seminfo.semmsl) {
652 #ifdef SEM_DEBUG
653 			kprintf("nsems out of range (0<%d<=%d)\n", nsems,
654 			    seminfo.semmsl);
655 #endif
656 			eval = EINVAL;
657 			goto done;
658 		}
659 		if (nsems > seminfo.semmns - semtot) {
660 #ifdef SEM_DEBUG
661 			kprintf("not enough semaphores left (need %d, got %d)\n",
662 			    nsems, seminfo.semmns - semtot);
663 #endif
664 			eval = ENOSPC;
665 			goto done;
666 		}
667 		for (semid = 0; semid < seminfo.semmni; semid++) {
668 			if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0)
669 				break;
670 		}
671 		if (semid == seminfo.semmni) {
672 #ifdef SEM_DEBUG
673 			kprintf("no more semid_ds's available\n");
674 #endif
675 			eval = ENOSPC;
676 			goto done;
677 		}
678 #ifdef SEM_DEBUG
679 		kprintf("semid %d is available\n", semid);
680 #endif
681 		sema[semid].sem_perm.key = key;
682 		sema[semid].sem_perm.cuid = cred->cr_uid;
683 		sema[semid].sem_perm.uid = cred->cr_uid;
684 		sema[semid].sem_perm.cgid = cred->cr_gid;
685 		sema[semid].sem_perm.gid = cred->cr_gid;
686 		sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
687 		sema[semid].sem_perm.seq =
688 		    (sema[semid].sem_perm.seq + 1) & 0x7fff;
689 		sema[semid].sem_nsems = nsems;
690 		sema[semid].sem_otime = 0;
691 		sema[semid].sem_ctime = time_second;
692 		sema[semid].sem_base = &sem[semtot];
693 		semtot += nsems;
694 		bzero(sema[semid].sem_base,
695 		    sizeof(sema[semid].sem_base[0])*nsems);
696 #ifdef SEM_DEBUG
697 		kprintf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base,
698 		    &sem[semtot]);
699 #endif
700 	} else {
701 #ifdef SEM_DEBUG
702 		kprintf("didn't find it and wasn't asked to create it\n");
703 #endif
704 		eval = ENOENT;
705 	}
706 
707 done:
708 	if (eval == 0) {
709 		uap->sysmsg_result = IXSEQ_TO_IPCID(semid,
710 						    sema[semid].sem_perm);
711 	}
712 	rel_mplock();
713 	return(eval);
714 }
715 
716 /*
717  * MPALMOSTSAFE
718  */
719 int
720 sys_semop(struct semop_args *uap)
721 {
722 	struct thread *td = curthread;
723 	int semid = uap->semid;
724 	u_int nsops = uap->nsops;
725 	struct sembuf sops[MAX_SOPS];
726 	struct semid_ds *semaptr;
727 	struct sembuf *sopptr;
728 	struct sem *semptr;
729 	struct sem_undo *suptr = NULL;
730 	int i, j, eval;
731 	int do_wakeup, do_undos;
732 
733 #ifdef SEM_DEBUG
734 	kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops);
735 #endif
736 
737 	if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL)
738 		return (ENOSYS);
739 
740 	get_mplock();
741 	semid = IPCID_TO_IX(semid);	/* Convert back to zero origin */
742 
743 	if (semid < 0 || semid >= seminfo.semmni) {
744 		eval = EINVAL;
745 		goto done;
746 	}
747 
748 	semaptr = &sema[semid];
749 	if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) {
750 		eval = EINVAL;
751 		goto done;
752 	}
753 	if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) {
754 		eval = EINVAL;
755 		goto done;
756 	}
757 
758 	if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W))) {
759 #ifdef SEM_DEBUG
760 		kprintf("eval = %d from ipaccess\n", eval);
761 #endif
762 		goto done;
763 	}
764 
765 	if (nsops > MAX_SOPS) {
766 #ifdef SEM_DEBUG
767 		kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops);
768 #endif
769 		eval = E2BIG;
770 		goto done;
771 	}
772 
773 	if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) {
774 #ifdef SEM_DEBUG
775 		kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval,
776 		    uap->sops, &sops, nsops * sizeof(sops[0]));
777 #endif
778 		goto done;
779 	}
780 
781 	/*
782 	 * Loop trying to satisfy the vector of requests.
783 	 * If we reach a point where we must wait, any requests already
784 	 * performed are rolled back and we go to sleep until some other
785 	 * process wakes us up.  At this point, we start all over again.
786 	 *
787 	 * This ensures that from the perspective of other tasks, a set
788 	 * of requests is atomic (never partially satisfied).
789 	 */
790 	do_undos = 0;
791 
792 	for (;;) {
793 		do_wakeup = 0;
794 
795 		for (i = 0; i < nsops; i++) {
796 			sopptr = &sops[i];
797 
798 			if (sopptr->sem_num >= semaptr->sem_nsems) {
799 				eval = EFBIG;
800 				goto done;
801 			}
802 
803 			semptr = &semaptr->sem_base[sopptr->sem_num];
804 
805 #ifdef SEM_DEBUG
806 			kprintf("semop:  semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n",
807 			    semaptr, semaptr->sem_base, semptr,
808 			    sopptr->sem_num, semptr->semval, sopptr->sem_op,
809 			    (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait");
810 #endif
811 
812 			if (sopptr->sem_op < 0) {
813 				if (semptr->semval + sopptr->sem_op < 0) {
814 #ifdef SEM_DEBUG
815 					kprintf("semop:  can't do it now\n");
816 #endif
817 					break;
818 				} else {
819 					semptr->semval += sopptr->sem_op;
820 					if (semptr->semval == 0 &&
821 					    semptr->semzcnt > 0)
822 						do_wakeup = 1;
823 				}
824 				if (sopptr->sem_flg & SEM_UNDO)
825 					do_undos = 1;
826 			} else if (sopptr->sem_op == 0) {
827 				if (semptr->semval > 0) {
828 #ifdef SEM_DEBUG
829 					kprintf("semop:  not zero now\n");
830 #endif
831 					break;
832 				}
833 			} else {
834 				if (semptr->semncnt > 0)
835 					do_wakeup = 1;
836 				semptr->semval += sopptr->sem_op;
837 				if (sopptr->sem_flg & SEM_UNDO)
838 					do_undos = 1;
839 			}
840 		}
841 
842 		/*
843 		 * Did we get through the entire vector?
844 		 */
845 		if (i >= nsops)
846 			goto donex;
847 
848 		/*
849 		 * No ... rollback anything that we've already done
850 		 */
851 #ifdef SEM_DEBUG
852 		kprintf("semop:  rollback 0 through %d\n", i-1);
853 #endif
854 		for (j = 0; j < i; j++)
855 			semaptr->sem_base[sops[j].sem_num].semval -=
856 			    sops[j].sem_op;
857 
858 		/*
859 		 * If the request that we couldn't satisfy has the
860 		 * NOWAIT flag set then return with EAGAIN.
861 		 */
862 		if (sopptr->sem_flg & IPC_NOWAIT) {
863 			eval = EAGAIN;
864 			goto done;
865 		}
866 
867 		if (sopptr->sem_op == 0)
868 			semptr->semzcnt++;
869 		else
870 			semptr->semncnt++;
871 
872 #ifdef SEM_DEBUG
873 		kprintf("semop:  good night!\n");
874 #endif
875 		eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0);
876 #ifdef SEM_DEBUG
877 		kprintf("semop:  good morning (eval=%d)!\n", eval);
878 #endif
879 
880 		suptr = NULL;	/* sem_undo may have been reallocated */
881 
882 		/* return code is checked below, after sem[nz]cnt-- */
883 
884 		/*
885 		 * Make sure that the semaphore still exists
886 		 */
887 		if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
888 		    semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) {
889 			eval = EIDRM;
890 			goto done;
891 		}
892 
893 		/*
894 		 * The semaphore is still alive.  Readjust the count of
895 		 * waiting processes.
896 		 */
897 		if (sopptr->sem_op == 0)
898 			semptr->semzcnt--;
899 		else
900 			semptr->semncnt--;
901 
902 		/*
903 		 * Is it really morning, or was our sleep interrupted?
904 		 * (Delayed check of tsleep() return code because we
905 		 * need to decrement sem[nz]cnt either way.)
906 		 */
907 		if (eval) {
908 			eval = EINTR;
909 			goto done;
910 		}
911 #ifdef SEM_DEBUG
912 		kprintf("semop:  good morning!\n");
913 #endif
914 	}
915 
916 donex:
917 	/*
918 	 * Process any SEM_UNDO requests.
919 	 */
920 	if (do_undos) {
921 		for (i = 0; i < nsops; i++) {
922 			/*
923 			 * We only need to deal with SEM_UNDO's for non-zero
924 			 * op's.
925 			 */
926 			int adjval;
927 
928 			if ((sops[i].sem_flg & SEM_UNDO) == 0)
929 				continue;
930 			adjval = sops[i].sem_op;
931 			if (adjval == 0)
932 				continue;
933 			eval = semundo_adjust(td->td_proc, &suptr, semid,
934 					      sops[i].sem_num, -adjval);
935 			if (eval == 0)
936 				continue;
937 
938 			/*
939 			 * Oh-Oh!  We ran out of either sem_undo's or undo's.
940 			 * Rollback the adjustments to this point and then
941 			 * rollback the semaphore ups and down so we can return
942 			 * with an error with all structures restored.  We
943 			 * rollback the undo's in the exact reverse order that
944 			 * we applied them.  This guarantees that we won't run
945 			 * out of space as we roll things back out.
946 			 */
947 			for (j = i - 1; j >= 0; j--) {
948 				if ((sops[j].sem_flg & SEM_UNDO) == 0)
949 					continue;
950 				adjval = sops[j].sem_op;
951 				if (adjval == 0)
952 					continue;
953 				if (semundo_adjust(td->td_proc, &suptr, semid,
954 					       sops[j].sem_num, adjval) != 0)
955 					panic("semop - can't undo undos");
956 			}
957 
958 			for (j = 0; j < nsops; j++)
959 				semaptr->sem_base[sops[j].sem_num].semval -=
960 				    sops[j].sem_op;
961 
962 #ifdef SEM_DEBUG
963 			kprintf("eval = %d from semundo_adjust\n", eval);
964 #endif
965 			goto done;
966 		} /* loop through the sops */
967 	} /* if (do_undos) */
968 
969 	/* We're definitely done - set the sempid's */
970 	for (i = 0; i < nsops; i++) {
971 		sopptr = &sops[i];
972 		semptr = &semaptr->sem_base[sopptr->sem_num];
973 		semptr->sempid = td->td_proc->p_pid;
974 	}
975 
976 	/* Do a wakeup if any semaphore was up'd. */
977 	if (do_wakeup) {
978 #ifdef SEM_DEBUG
979 		kprintf("semop:  doing wakeup\n");
980 #endif
981 		wakeup((caddr_t)semaptr);
982 #ifdef SEM_DEBUG
983 		kprintf("semop:  back from wakeup\n");
984 #endif
985 	}
986 #ifdef SEM_DEBUG
987 	kprintf("semop:  done\n");
988 #endif
989 	uap->sysmsg_result = 0;
990 	eval = 0;
991 done:
992 	rel_mplock();
993 	return(eval);
994 }
995 
996 /*
997  * Go through the undo structures for this process and apply the adjustments to
998  * semaphores.
999  */
1000 void
1001 semexit(struct proc *p)
1002 {
1003 	struct sem_undo *suptr;
1004 	struct sem_undo **supptr;
1005 	int did_something;
1006 
1007 	did_something = 0;
1008 
1009 	/*
1010 	 * Go through the chain of undo vectors looking for one
1011 	 * associated with this process.
1012 	 */
1013 
1014 	for (supptr = &semu_list; (suptr = *supptr) != NULL;
1015 	    supptr = &suptr->un_next) {
1016 		if (suptr->un_proc == p)
1017 			break;
1018 	}
1019 
1020 	if (suptr == NULL)
1021 		return;
1022 
1023 #ifdef SEM_DEBUG
1024 	kprintf("proc @%08x has undo structure with %d entries\n", p,
1025 	    suptr->un_cnt);
1026 #endif
1027 
1028 	/*
1029 	 * If there are any active undo elements then process them.
1030 	 */
1031 	if (suptr->un_cnt > 0) {
1032 		int ix;
1033 
1034 		for (ix = 0; ix < suptr->un_cnt; ix++) {
1035 			int semid = suptr->un_ent[ix].un_id;
1036 			int semnum = suptr->un_ent[ix].un_num;
1037 			int adjval = suptr->un_ent[ix].un_adjval;
1038 			struct semid_ds *semaptr;
1039 
1040 			semaptr = &sema[semid];
1041 			if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0)
1042 				panic("semexit - semid not allocated");
1043 			if (semnum >= semaptr->sem_nsems)
1044 				panic("semexit - semnum out of range");
1045 
1046 #ifdef SEM_DEBUG
1047 			kprintf("semexit:  %08x id=%d num=%d(adj=%d) ; sem=%d\n",
1048 			    suptr->un_proc, suptr->un_ent[ix].un_id,
1049 			    suptr->un_ent[ix].un_num,
1050 			    suptr->un_ent[ix].un_adjval,
1051 			    semaptr->sem_base[semnum].semval);
1052 #endif
1053 
1054 			if (adjval < 0) {
1055 				if (semaptr->sem_base[semnum].semval < -adjval)
1056 					semaptr->sem_base[semnum].semval = 0;
1057 				else
1058 					semaptr->sem_base[semnum].semval +=
1059 					    adjval;
1060 			} else
1061 				semaptr->sem_base[semnum].semval += adjval;
1062 
1063 			wakeup((caddr_t)semaptr);
1064 #ifdef SEM_DEBUG
1065 			kprintf("semexit:  back from wakeup\n");
1066 #endif
1067 		}
1068 	}
1069 
1070 	/*
1071 	 * Deallocate the undo vector.
1072 	 */
1073 #ifdef SEM_DEBUG
1074 	kprintf("removing vector\n");
1075 #endif
1076 	suptr->un_proc = NULL;
1077 	*supptr = suptr->un_next;
1078 }
1079