1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */ 2 /* $DragonFly: src/sys/kern/sysv_sem.c,v 1.19 2008/01/06 16:55:51 swildner Exp $ */ 3 4 /* 5 * Implementation of SVID semaphores 6 * 7 * Author: Daniel Boulet 8 * 9 * This software is provided ``AS IS'' without any warranties of any kind. 10 */ 11 12 #include "opt_sysvipc.h" 13 14 #include <sys/param.h> 15 #include <sys/systm.h> 16 #include <sys/sysproto.h> 17 #include <sys/kernel.h> 18 #include <sys/proc.h> 19 #include <sys/sem.h> 20 #include <sys/sysent.h> 21 #include <sys/sysctl.h> 22 #include <sys/malloc.h> 23 #include <sys/jail.h> 24 25 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 26 27 static void seminit (void *); 28 29 static struct sem_undo *semu_alloc (struct proc *p); 30 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 31 int semid, int semnum, int adjval); 32 static void semundo_clear (int semid, int semnum); 33 34 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 35 static sy_call_t *semcalls[] = { 36 (sy_call_t *)sys___semctl, (sy_call_t *)sys_semget, 37 (sy_call_t *)sys_semop 38 }; 39 40 static int semtot = 0; 41 static struct semid_ds *sema; /* semaphore id pool */ 42 static struct sem *sem; /* semaphore pool */ 43 static struct sem_undo *semu_list; /* list of active undo structures */ 44 static int *semu; /* undo structure pool */ 45 46 struct sem { 47 u_short semval; /* semaphore value */ 48 pid_t sempid; /* pid of last operation */ 49 u_short semncnt; /* # awaiting semval > cval */ 50 u_short semzcnt; /* # awaiting semval = 0 */ 51 }; 52 53 /* 54 * Undo structure (one per process) 55 */ 56 struct sem_undo { 57 struct sem_undo *un_next; /* ptr to next active undo structure */ 58 struct proc *un_proc; /* owner of this structure */ 59 short un_cnt; /* # of active entries */ 60 struct undo { 61 short un_adjval; /* adjust on exit values */ 62 short un_num; /* semaphore # */ 63 int un_id; /* semid */ 64 } un_ent[1]; /* undo entries */ 65 }; 66 67 /* 68 * Configuration parameters 69 */ 70 #ifndef SEMMNI 71 #define SEMMNI 10 /* # of semaphore identifiers */ 72 #endif 73 #ifndef SEMMNS 74 #define SEMMNS 60 /* # of semaphores in system */ 75 #endif 76 #ifndef SEMUME 77 #define SEMUME 10 /* max # of undo entries per process */ 78 #endif 79 #ifndef SEMMNU 80 #define SEMMNU 30 /* # of undo structures in system */ 81 #endif 82 83 /* shouldn't need tuning */ 84 #ifndef SEMMAP 85 #define SEMMAP 30 /* # of entries in semaphore map */ 86 #endif 87 #ifndef SEMMSL 88 #define SEMMSL SEMMNS /* max # of semaphores per id */ 89 #endif 90 #ifndef SEMOPM 91 #define SEMOPM 100 /* max # of operations per semop call */ 92 #endif 93 94 #define SEMVMX 32767 /* semaphore maximum value */ 95 #define SEMAEM 16384 /* adjust on exit max value */ 96 97 /* 98 * Due to the way semaphore memory is allocated, we have to ensure that 99 * SEMUSZ is properly aligned. 100 */ 101 102 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 103 104 /* actual size of an undo structure */ 105 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 106 107 /* 108 * Macro to find a particular sem_undo vector 109 */ 110 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 111 112 /* 113 * semaphore info struct 114 */ 115 struct seminfo seminfo = { 116 SEMMAP, /* # of entries in semaphore map */ 117 SEMMNI, /* # of semaphore identifiers */ 118 SEMMNS, /* # of semaphores in system */ 119 SEMMNU, /* # of undo structures in system */ 120 SEMMSL, /* max # of semaphores per id */ 121 SEMOPM, /* max # of operations per semop call */ 122 SEMUME, /* max # of undo entries per process */ 123 SEMUSZ, /* size in bytes of undo structure */ 124 SEMVMX, /* semaphore maximum value */ 125 SEMAEM /* adjust on exit max value */ 126 }; 127 128 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 129 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 130 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 131 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 132 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 133 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 134 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 135 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 136 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 137 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 138 139 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 140 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 141 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 142 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 143 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 149 150 #if 0 151 RO seminfo.semmap /* SEMMAP unused */ 152 RO seminfo.semmni 153 RO seminfo.semmns 154 RO seminfo.semmnu /* undo entries per system */ 155 RW seminfo.semmsl 156 RO seminfo.semopm /* SEMOPM unused */ 157 RO seminfo.semume 158 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 159 RO seminfo.semvmx /* SEMVMX unused - user param */ 160 RO seminfo.semaem /* SEMAEM unused - user param */ 161 #endif 162 163 static void 164 seminit(void *dummy) 165 { 166 int i; 167 168 sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 169 sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 170 semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 171 172 for (i = 0; i < seminfo.semmni; i++) { 173 sema[i].sem_base = 0; 174 sema[i].sem_perm.mode = 0; 175 } 176 for (i = 0; i < seminfo.semmnu; i++) { 177 struct sem_undo *suptr = SEMU(i); 178 suptr->un_proc = NULL; 179 } 180 semu_list = NULL; 181 } 182 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 183 184 /* 185 * Entry point for all SEM calls 186 * 187 * semsys_args(int which, a2, a3, ...) (VARARGS) 188 */ 189 int 190 sys_semsys(struct semsys_args *uap) 191 { 192 struct proc *p = curproc; 193 unsigned int which = (unsigned int)uap->which; 194 195 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 196 return (ENOSYS); 197 198 if (which >= sizeof(semcalls)/sizeof(semcalls[0])) 199 return (EINVAL); 200 bcopy(&uap->a2, &uap->which, 201 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 202 return ((*semcalls[which])(uap)); 203 } 204 205 /* 206 * Allocate a new sem_undo structure for a process 207 * (returns ptr to structure or NULL if no more room) 208 */ 209 210 static struct sem_undo * 211 semu_alloc(struct proc *p) 212 { 213 int i; 214 struct sem_undo *suptr; 215 struct sem_undo **supptr; 216 int attempt; 217 218 /* 219 * Try twice to allocate something. 220 * (we'll purge any empty structures after the first pass so 221 * two passes are always enough) 222 */ 223 224 for (attempt = 0; attempt < 2; attempt++) { 225 /* 226 * Look for a free structure. 227 * Fill it in and return it if we find one. 228 */ 229 230 for (i = 0; i < seminfo.semmnu; i++) { 231 suptr = SEMU(i); 232 if (suptr->un_proc == NULL) { 233 suptr->un_next = semu_list; 234 semu_list = suptr; 235 suptr->un_cnt = 0; 236 suptr->un_proc = p; 237 return(suptr); 238 } 239 } 240 241 /* 242 * We didn't find a free one, if this is the first attempt 243 * then try to free some structures. 244 */ 245 246 if (attempt == 0) { 247 /* All the structures are in use - try to free some */ 248 int did_something = 0; 249 250 supptr = &semu_list; 251 while ((suptr = *supptr) != NULL) { 252 if (suptr->un_cnt == 0) { 253 suptr->un_proc = NULL; 254 *supptr = suptr->un_next; 255 did_something = 1; 256 } else 257 supptr = &(suptr->un_next); 258 } 259 260 /* If we didn't free anything then just give-up */ 261 if (!did_something) 262 return(NULL); 263 } else { 264 /* 265 * The second pass failed even though we freed 266 * something after the first pass! 267 * This is IMPOSSIBLE! 268 */ 269 panic("semu_alloc - second attempt failed"); 270 } 271 } 272 return (NULL); 273 } 274 275 /* 276 * Adjust a particular entry for a particular proc 277 */ 278 279 static int 280 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum, 281 int adjval) 282 { 283 struct sem_undo *suptr; 284 struct undo *sunptr; 285 int i; 286 287 /* Look for and remember the sem_undo if the caller doesn't provide 288 it */ 289 290 suptr = *supptr; 291 if (suptr == NULL) { 292 for (suptr = semu_list; suptr != NULL; 293 suptr = suptr->un_next) { 294 if (suptr->un_proc == p) { 295 *supptr = suptr; 296 break; 297 } 298 } 299 if (suptr == NULL) { 300 if (adjval == 0) 301 return(0); 302 suptr = semu_alloc(p); 303 if (suptr == NULL) 304 return(ENOSPC); 305 *supptr = suptr; 306 } 307 } 308 309 /* 310 * Look for the requested entry and adjust it (delete if adjval becomes 311 * 0). 312 */ 313 sunptr = &suptr->un_ent[0]; 314 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 315 if (sunptr->un_id != semid || sunptr->un_num != semnum) 316 continue; 317 if (adjval == 0) 318 sunptr->un_adjval = 0; 319 else 320 sunptr->un_adjval += adjval; 321 if (sunptr->un_adjval == 0) { 322 suptr->un_cnt--; 323 if (i < suptr->un_cnt) 324 suptr->un_ent[i] = 325 suptr->un_ent[suptr->un_cnt]; 326 } 327 return(0); 328 } 329 330 /* Didn't find the right entry - create it */ 331 if (adjval == 0) 332 return(0); 333 if (suptr->un_cnt != seminfo.semume) { 334 sunptr = &suptr->un_ent[suptr->un_cnt]; 335 suptr->un_cnt++; 336 sunptr->un_adjval = adjval; 337 sunptr->un_id = semid; sunptr->un_num = semnum; 338 } else 339 return(EINVAL); 340 return(0); 341 } 342 343 static void 344 semundo_clear(int semid, int semnum) 345 { 346 struct sem_undo *suptr; 347 348 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 349 struct undo *sunptr = &suptr->un_ent[0]; 350 int i = 0; 351 352 while (i < suptr->un_cnt) { 353 if (sunptr->un_id == semid) { 354 if (semnum == -1 || sunptr->un_num == semnum) { 355 suptr->un_cnt--; 356 if (i < suptr->un_cnt) { 357 suptr->un_ent[i] = 358 suptr->un_ent[suptr->un_cnt]; 359 continue; 360 } 361 } 362 if (semnum != -1) 363 break; 364 } 365 i++, sunptr++; 366 } 367 } 368 } 369 370 /* 371 * Note that the user-mode half of this passes a union, not a pointer 372 */ 373 374 int 375 sys___semctl(struct __semctl_args *uap) 376 { 377 struct proc *p = curproc; 378 int semid = uap->semid; 379 int semnum = uap->semnum; 380 int cmd = uap->cmd; 381 union semun *arg = uap->arg; 382 union semun real_arg; 383 struct ucred *cred = p->p_ucred; 384 int i, rval, eval; 385 struct semid_ds sbuf; 386 struct semid_ds *semaptr; 387 388 #ifdef SEM_DEBUG 389 kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 390 #endif 391 392 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 393 return (ENOSYS); 394 395 semid = IPCID_TO_IX(semid); 396 if (semid < 0 || semid >= seminfo.semmni) 397 return(EINVAL); 398 399 semaptr = &sema[semid]; 400 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 401 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 402 return(EINVAL); 403 404 eval = 0; 405 rval = 0; 406 407 switch (cmd) { 408 case IPC_RMID: 409 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_M))) 410 return(eval); 411 semaptr->sem_perm.cuid = cred->cr_uid; 412 semaptr->sem_perm.uid = cred->cr_uid; 413 semtot -= semaptr->sem_nsems; 414 for (i = semaptr->sem_base - sem; i < semtot; i++) 415 sem[i] = sem[i + semaptr->sem_nsems]; 416 for (i = 0; i < seminfo.semmni; i++) { 417 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 418 sema[i].sem_base > semaptr->sem_base) 419 sema[i].sem_base -= semaptr->sem_nsems; 420 } 421 semaptr->sem_perm.mode = 0; 422 semundo_clear(semid, -1); 423 wakeup((caddr_t)semaptr); 424 break; 425 426 case IPC_SET: 427 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_M))) 428 return(eval); 429 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 430 return(eval); 431 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 432 sizeof(sbuf))) != 0) 433 return(eval); 434 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 435 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 436 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 437 (sbuf.sem_perm.mode & 0777); 438 semaptr->sem_ctime = time_second; 439 break; 440 441 case IPC_STAT: 442 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 443 return(eval); 444 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 445 return(eval); 446 eval = copyout((caddr_t)semaptr, real_arg.buf, 447 sizeof(struct semid_ds)); 448 break; 449 450 case GETNCNT: 451 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 452 return(eval); 453 if (semnum < 0 || semnum >= semaptr->sem_nsems) 454 return(EINVAL); 455 rval = semaptr->sem_base[semnum].semncnt; 456 break; 457 458 case GETPID: 459 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 460 return(eval); 461 if (semnum < 0 || semnum >= semaptr->sem_nsems) 462 return(EINVAL); 463 rval = semaptr->sem_base[semnum].sempid; 464 break; 465 466 case GETVAL: 467 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 468 return(eval); 469 if (semnum < 0 || semnum >= semaptr->sem_nsems) 470 return(EINVAL); 471 rval = semaptr->sem_base[semnum].semval; 472 break; 473 474 case GETALL: 475 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 476 return(eval); 477 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 478 return(eval); 479 for (i = 0; i < semaptr->sem_nsems; i++) { 480 eval = copyout((caddr_t)&semaptr->sem_base[i].semval, 481 &real_arg.array[i], sizeof(real_arg.array[0])); 482 if (eval != 0) 483 break; 484 } 485 break; 486 487 case GETZCNT: 488 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_R))) 489 return(eval); 490 if (semnum < 0 || semnum >= semaptr->sem_nsems) 491 return(EINVAL); 492 rval = semaptr->sem_base[semnum].semzcnt; 493 break; 494 495 case SETVAL: 496 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) 497 return(eval); 498 if (semnum < 0 || semnum >= semaptr->sem_nsems) 499 return(EINVAL); 500 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 501 return(eval); 502 semaptr->sem_base[semnum].semval = real_arg.val; 503 semundo_clear(semid, semnum); 504 wakeup((caddr_t)semaptr); 505 break; 506 507 case SETALL: 508 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) 509 return(eval); 510 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 511 return(eval); 512 for (i = 0; i < semaptr->sem_nsems; i++) { 513 eval = copyin(&real_arg.array[i], 514 (caddr_t)&semaptr->sem_base[i].semval, 515 sizeof(real_arg.array[0])); 516 if (eval != 0) 517 break; 518 } 519 semundo_clear(semid, -1); 520 wakeup((caddr_t)semaptr); 521 break; 522 523 default: 524 return(EINVAL); 525 } 526 527 if (eval == 0) 528 uap->sysmsg_result = rval; 529 return(eval); 530 } 531 532 int 533 sys_semget(struct semget_args *uap) 534 { 535 struct proc *p = curproc; 536 int semid, eval; 537 int key = uap->key; 538 int nsems = uap->nsems; 539 int semflg = uap->semflg; 540 struct ucred *cred = p->p_ucred; 541 542 #ifdef SEM_DEBUG 543 kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 544 #endif 545 546 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 547 return (ENOSYS); 548 549 if (key != IPC_PRIVATE) { 550 for (semid = 0; semid < seminfo.semmni; semid++) { 551 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 552 sema[semid].sem_perm.key == key) 553 break; 554 } 555 if (semid < seminfo.semmni) { 556 #ifdef SEM_DEBUG 557 kprintf("found public key\n"); 558 #endif 559 if ((eval = ipcperm(p, &sema[semid].sem_perm, 560 semflg & 0700))) 561 return(eval); 562 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 563 #ifdef SEM_DEBUG 564 kprintf("too small\n"); 565 #endif 566 return(EINVAL); 567 } 568 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 569 #ifdef SEM_DEBUG 570 kprintf("not exclusive\n"); 571 #endif 572 return(EEXIST); 573 } 574 goto found; 575 } 576 } 577 578 #ifdef SEM_DEBUG 579 kprintf("need to allocate the semid_ds\n"); 580 #endif 581 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 582 if (nsems <= 0 || nsems > seminfo.semmsl) { 583 #ifdef SEM_DEBUG 584 kprintf("nsems out of range (0<%d<=%d)\n", nsems, 585 seminfo.semmsl); 586 #endif 587 return(EINVAL); 588 } 589 if (nsems > seminfo.semmns - semtot) { 590 #ifdef SEM_DEBUG 591 kprintf("not enough semaphores left (need %d, got %d)\n", 592 nsems, seminfo.semmns - semtot); 593 #endif 594 return(ENOSPC); 595 } 596 for (semid = 0; semid < seminfo.semmni; semid++) { 597 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 598 break; 599 } 600 if (semid == seminfo.semmni) { 601 #ifdef SEM_DEBUG 602 kprintf("no more semid_ds's available\n"); 603 #endif 604 return(ENOSPC); 605 } 606 #ifdef SEM_DEBUG 607 kprintf("semid %d is available\n", semid); 608 #endif 609 sema[semid].sem_perm.key = key; 610 sema[semid].sem_perm.cuid = cred->cr_uid; 611 sema[semid].sem_perm.uid = cred->cr_uid; 612 sema[semid].sem_perm.cgid = cred->cr_gid; 613 sema[semid].sem_perm.gid = cred->cr_gid; 614 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 615 sema[semid].sem_perm.seq = 616 (sema[semid].sem_perm.seq + 1) & 0x7fff; 617 sema[semid].sem_nsems = nsems; 618 sema[semid].sem_otime = 0; 619 sema[semid].sem_ctime = time_second; 620 sema[semid].sem_base = &sem[semtot]; 621 semtot += nsems; 622 bzero(sema[semid].sem_base, 623 sizeof(sema[semid].sem_base[0])*nsems); 624 #ifdef SEM_DEBUG 625 kprintf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 626 &sem[semtot]); 627 #endif 628 } else { 629 #ifdef SEM_DEBUG 630 kprintf("didn't find it and wasn't asked to create it\n"); 631 #endif 632 return(ENOENT); 633 } 634 635 found: 636 uap->sysmsg_result = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 637 return(0); 638 } 639 640 int 641 sys_semop(struct semop_args *uap) 642 { 643 struct proc *p = curproc; 644 int semid = uap->semid; 645 u_int nsops = uap->nsops; 646 struct sembuf sops[MAX_SOPS]; 647 struct semid_ds *semaptr; 648 struct sembuf *sopptr; 649 struct sem *semptr; 650 struct sem_undo *suptr = NULL; 651 int i, j, eval; 652 int do_wakeup, do_undos; 653 654 #ifdef SEM_DEBUG 655 kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 656 #endif 657 658 if (!jail_sysvipc_allowed && p->p_ucred->cr_prison != NULL) 659 return (ENOSYS); 660 661 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 662 663 if (semid < 0 || semid >= seminfo.semmni) 664 return(EINVAL); 665 666 semaptr = &sema[semid]; 667 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 668 return(EINVAL); 669 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 670 return(EINVAL); 671 672 if ((eval = ipcperm(p, &semaptr->sem_perm, IPC_W))) { 673 #ifdef SEM_DEBUG 674 kprintf("eval = %d from ipaccess\n", eval); 675 #endif 676 return(eval); 677 } 678 679 if (nsops > MAX_SOPS) { 680 #ifdef SEM_DEBUG 681 kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 682 #endif 683 return(E2BIG); 684 } 685 686 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 687 #ifdef SEM_DEBUG 688 kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 689 uap->sops, &sops, nsops * sizeof(sops[0])); 690 #endif 691 return(eval); 692 } 693 694 /* 695 * Loop trying to satisfy the vector of requests. 696 * If we reach a point where we must wait, any requests already 697 * performed are rolled back and we go to sleep until some other 698 * process wakes us up. At this point, we start all over again. 699 * 700 * This ensures that from the perspective of other tasks, a set 701 * of requests is atomic (never partially satisfied). 702 */ 703 do_undos = 0; 704 705 for (;;) { 706 do_wakeup = 0; 707 708 for (i = 0; i < nsops; i++) { 709 sopptr = &sops[i]; 710 711 if (sopptr->sem_num >= semaptr->sem_nsems) 712 return(EFBIG); 713 714 semptr = &semaptr->sem_base[sopptr->sem_num]; 715 716 #ifdef SEM_DEBUG 717 kprintf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 718 semaptr, semaptr->sem_base, semptr, 719 sopptr->sem_num, semptr->semval, sopptr->sem_op, 720 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 721 #endif 722 723 if (sopptr->sem_op < 0) { 724 if (semptr->semval + sopptr->sem_op < 0) { 725 #ifdef SEM_DEBUG 726 kprintf("semop: can't do it now\n"); 727 #endif 728 break; 729 } else { 730 semptr->semval += sopptr->sem_op; 731 if (semptr->semval == 0 && 732 semptr->semzcnt > 0) 733 do_wakeup = 1; 734 } 735 if (sopptr->sem_flg & SEM_UNDO) 736 do_undos = 1; 737 } else if (sopptr->sem_op == 0) { 738 if (semptr->semval > 0) { 739 #ifdef SEM_DEBUG 740 kprintf("semop: not zero now\n"); 741 #endif 742 break; 743 } 744 } else { 745 if (semptr->semncnt > 0) 746 do_wakeup = 1; 747 semptr->semval += sopptr->sem_op; 748 if (sopptr->sem_flg & SEM_UNDO) 749 do_undos = 1; 750 } 751 } 752 753 /* 754 * Did we get through the entire vector? 755 */ 756 if (i >= nsops) 757 goto done; 758 759 /* 760 * No ... rollback anything that we've already done 761 */ 762 #ifdef SEM_DEBUG 763 kprintf("semop: rollback 0 through %d\n", i-1); 764 #endif 765 for (j = 0; j < i; j++) 766 semaptr->sem_base[sops[j].sem_num].semval -= 767 sops[j].sem_op; 768 769 /* 770 * If the request that we couldn't satisfy has the 771 * NOWAIT flag set then return with EAGAIN. 772 */ 773 if (sopptr->sem_flg & IPC_NOWAIT) 774 return(EAGAIN); 775 776 if (sopptr->sem_op == 0) 777 semptr->semzcnt++; 778 else 779 semptr->semncnt++; 780 781 #ifdef SEM_DEBUG 782 kprintf("semop: good night!\n"); 783 #endif 784 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 785 #ifdef SEM_DEBUG 786 kprintf("semop: good morning (eval=%d)!\n", eval); 787 #endif 788 789 suptr = NULL; /* sem_undo may have been reallocated */ 790 791 /* return code is checked below, after sem[nz]cnt-- */ 792 793 /* 794 * Make sure that the semaphore still exists 795 */ 796 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 797 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) 798 return(EIDRM); 799 800 /* 801 * The semaphore is still alive. Readjust the count of 802 * waiting processes. 803 */ 804 if (sopptr->sem_op == 0) 805 semptr->semzcnt--; 806 else 807 semptr->semncnt--; 808 809 /* 810 * Is it really morning, or was our sleep interrupted? 811 * (Delayed check of msleep() return code because we 812 * need to decrement sem[nz]cnt either way.) 813 */ 814 if (eval != 0) 815 return(EINTR); 816 #ifdef SEM_DEBUG 817 kprintf("semop: good morning!\n"); 818 #endif 819 } 820 821 done: 822 /* 823 * Process any SEM_UNDO requests. 824 */ 825 if (do_undos) { 826 for (i = 0; i < nsops; i++) { 827 /* 828 * We only need to deal with SEM_UNDO's for non-zero 829 * op's. 830 */ 831 int adjval; 832 833 if ((sops[i].sem_flg & SEM_UNDO) == 0) 834 continue; 835 adjval = sops[i].sem_op; 836 if (adjval == 0) 837 continue; 838 eval = semundo_adjust(p, &suptr, semid, 839 sops[i].sem_num, -adjval); 840 if (eval == 0) 841 continue; 842 843 /* 844 * Oh-Oh! We ran out of either sem_undo's or undo's. 845 * Rollback the adjustments to this point and then 846 * rollback the semaphore ups and down so we can return 847 * with an error with all structures restored. We 848 * rollback the undo's in the exact reverse order that 849 * we applied them. This guarantees that we won't run 850 * out of space as we roll things back out. 851 */ 852 for (j = i - 1; j >= 0; j--) { 853 if ((sops[j].sem_flg & SEM_UNDO) == 0) 854 continue; 855 adjval = sops[j].sem_op; 856 if (adjval == 0) 857 continue; 858 if (semundo_adjust(p, &suptr, semid, 859 sops[j].sem_num, adjval) != 0) 860 panic("semop - can't undo undos"); 861 } 862 863 for (j = 0; j < nsops; j++) 864 semaptr->sem_base[sops[j].sem_num].semval -= 865 sops[j].sem_op; 866 867 #ifdef SEM_DEBUG 868 kprintf("eval = %d from semundo_adjust\n", eval); 869 #endif 870 return(eval); 871 } /* loop through the sops */ 872 } /* if (do_undos) */ 873 874 /* We're definitely done - set the sempid's */ 875 for (i = 0; i < nsops; i++) { 876 sopptr = &sops[i]; 877 semptr = &semaptr->sem_base[sopptr->sem_num]; 878 semptr->sempid = p->p_pid; 879 } 880 881 /* Do a wakeup if any semaphore was up'd. */ 882 if (do_wakeup) { 883 #ifdef SEM_DEBUG 884 kprintf("semop: doing wakeup\n"); 885 #endif 886 wakeup((caddr_t)semaptr); 887 #ifdef SEM_DEBUG 888 kprintf("semop: back from wakeup\n"); 889 #endif 890 } 891 #ifdef SEM_DEBUG 892 kprintf("semop: done\n"); 893 #endif 894 uap->sysmsg_result = 0; 895 return(0); 896 } 897 898 /* 899 * Go through the undo structures for this process and apply the adjustments to 900 * semaphores. 901 */ 902 void 903 semexit(struct proc *p) 904 { 905 struct sem_undo *suptr; 906 struct sem_undo **supptr; 907 int did_something; 908 909 did_something = 0; 910 911 /* 912 * Go through the chain of undo vectors looking for one 913 * associated with this process. 914 */ 915 916 for (supptr = &semu_list; (suptr = *supptr) != NULL; 917 supptr = &suptr->un_next) { 918 if (suptr->un_proc == p) 919 break; 920 } 921 922 if (suptr == NULL) 923 return; 924 925 #ifdef SEM_DEBUG 926 kprintf("proc @%08x has undo structure with %d entries\n", p, 927 suptr->un_cnt); 928 #endif 929 930 /* 931 * If there are any active undo elements then process them. 932 */ 933 if (suptr->un_cnt > 0) { 934 int ix; 935 936 for (ix = 0; ix < suptr->un_cnt; ix++) { 937 int semid = suptr->un_ent[ix].un_id; 938 int semnum = suptr->un_ent[ix].un_num; 939 int adjval = suptr->un_ent[ix].un_adjval; 940 struct semid_ds *semaptr; 941 942 semaptr = &sema[semid]; 943 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 944 panic("semexit - semid not allocated"); 945 if (semnum >= semaptr->sem_nsems) 946 panic("semexit - semnum out of range"); 947 948 #ifdef SEM_DEBUG 949 kprintf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 950 suptr->un_proc, suptr->un_ent[ix].un_id, 951 suptr->un_ent[ix].un_num, 952 suptr->un_ent[ix].un_adjval, 953 semaptr->sem_base[semnum].semval); 954 #endif 955 956 if (adjval < 0) { 957 if (semaptr->sem_base[semnum].semval < -adjval) 958 semaptr->sem_base[semnum].semval = 0; 959 else 960 semaptr->sem_base[semnum].semval += 961 adjval; 962 } else 963 semaptr->sem_base[semnum].semval += adjval; 964 965 wakeup((caddr_t)semaptr); 966 #ifdef SEM_DEBUG 967 kprintf("semexit: back from wakeup\n"); 968 #endif 969 } 970 } 971 972 /* 973 * Deallocate the undo vector. 974 */ 975 #ifdef SEM_DEBUG 976 kprintf("removing vector\n"); 977 #endif 978 suptr->un_proc = NULL; 979 *supptr = suptr->un_next; 980 } 981