sysv_sem.c revision 284665
1/*- 2 * Implementation of SVID semaphores 3 * 4 * Author: Daniel Boulet 5 * 6 * This software is provided ``AS IS'' without any warranties of any kind. 7 */ 8/*- 9 * Copyright (c) 2003-2005 McAfee, Inc. 10 * All rights reserved. 11 * 12 * This software was developed for the FreeBSD Project in part by McAfee 13 * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR 14 * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 15 * program. 16 * 17 * Redistribution and use in source and binary forms, with or without 18 * modification, are permitted provided that the following conditions 19 * are met: 20 * 1. Redistributions of source code must retain the above copyright 21 * notice, this list of conditions and the following disclaimer. 22 * 2. Redistributions in binary form must reproduce the above copyright 23 * notice, this list of conditions and the following disclaimer in the 24 * documentation and/or other materials provided with the distribution. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 */ 38 39#include <sys/cdefs.h> 40__FBSDID("$FreeBSD: stable/10/sys/kern/sysv_sem.c 284665 2015-06-21 06:28:26Z trasz $"); 41 42#include "opt_compat.h" 43#include "opt_sysvipc.h" 44 45#include <sys/param.h> 46#include <sys/systm.h> 47#include <sys/sysproto.h> 48#include <sys/eventhandler.h> 49#include <sys/kernel.h> 50#include <sys/proc.h> 51#include <sys/lock.h> 52#include <sys/module.h> 53#include <sys/mutex.h> 54#include <sys/racct.h> 55#include <sys/sem.h> 56#include <sys/syscall.h> 57#include <sys/syscallsubr.h> 58#include <sys/sysent.h> 59#include <sys/sysctl.h> 60#include <sys/uio.h> 61#include <sys/malloc.h> 62#include <sys/jail.h> 63 64#include <security/mac/mac_framework.h> 65 66FEATURE(sysv_sem, "System V semaphores support"); 67 68static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 69 70#ifdef SEM_DEBUG 71#define DPRINTF(a) printf a 72#else 73#define DPRINTF(a) 74#endif 75 76static int seminit(void); 77static int sysvsem_modload(struct module *, int, void *); 78static int semunload(void); 79static void semexit_myhook(void *arg, struct proc *p); 80static int sysctl_sema(SYSCTL_HANDLER_ARGS); 81static int semvalid(int semid, struct semid_kernel *semakptr); 82 83#ifndef _SYS_SYSPROTO_H_ 84struct __semctl_args; 85int __semctl(struct thread *td, struct __semctl_args *uap); 86struct semget_args; 87int semget(struct thread *td, struct semget_args *uap); 88struct semop_args; 89int semop(struct thread *td, struct semop_args *uap); 90#endif 91 92static struct sem_undo *semu_alloc(struct thread *td); 93static int semundo_adjust(struct thread *td, struct sem_undo **supptr, 94 int semid, int semseq, int semnum, int adjval); 95static void semundo_clear(int semid, int semnum); 96 97static struct mtx sem_mtx; /* semaphore global lock */ 98static struct mtx sem_undo_mtx; 99static int semtot = 0; 100static struct semid_kernel *sema; /* semaphore id pool */ 101static struct mtx *sema_mtx; /* semaphore id pool mutexes*/ 102static struct sem *sem; /* semaphore pool */ 103LIST_HEAD(, sem_undo) semu_list; /* list of active undo structures */ 104LIST_HEAD(, sem_undo) semu_free_list; /* list of free undo structures */ 105static int *semu; /* undo structure pool */ 106static eventhandler_tag semexit_tag; 107 108#define SEMUNDO_MTX sem_undo_mtx 109#define SEMUNDO_LOCK() mtx_lock(&SEMUNDO_MTX); 110#define SEMUNDO_UNLOCK() mtx_unlock(&SEMUNDO_MTX); 111#define SEMUNDO_LOCKASSERT(how) mtx_assert(&SEMUNDO_MTX, (how)); 112 113struct sem { 114 u_short semval; /* semaphore value */ 115 pid_t sempid; /* pid of last operation */ 116 u_short semncnt; /* # awaiting semval > cval */ 117 u_short semzcnt; /* # awaiting semval = 0 */ 118}; 119 120/* 121 * Undo structure (one per process) 122 */ 123struct sem_undo { 124 LIST_ENTRY(sem_undo) un_next; /* ptr to next active undo structure */ 125 struct proc *un_proc; /* owner of this structure */ 126 short un_cnt; /* # of active entries */ 127 struct undo { 128 short un_adjval; /* adjust on exit values */ 129 short un_num; /* semaphore # */ 130 int un_id; /* semid */ 131 unsigned short un_seq; 132 } un_ent[1]; /* undo entries */ 133}; 134 135/* 136 * Configuration parameters 137 */ 138#ifndef SEMMNI 139#define SEMMNI 50 /* # of semaphore identifiers */ 140#endif 141#ifndef SEMMNS 142#define SEMMNS 340 /* # of semaphores in system */ 143#endif 144#ifndef SEMUME 145#define SEMUME 50 /* max # of undo entries per process */ 146#endif 147#ifndef SEMMNU 148#define SEMMNU 150 /* # of undo structures in system */ 149#endif 150 151/* shouldn't need tuning */ 152#ifndef SEMMSL 153#define SEMMSL SEMMNS /* max # of semaphores per id */ 154#endif 155#ifndef SEMOPM 156#define SEMOPM 100 /* max # of operations per semop call */ 157#endif 158 159#define SEMVMX 32767 /* semaphore maximum value */ 160#define SEMAEM 16384 /* adjust on exit max value */ 161 162/* 163 * Due to the way semaphore memory is allocated, we have to ensure that 164 * SEMUSZ is properly aligned. 165 */ 166 167#define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 168 169/* actual size of an undo structure */ 170#define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 171 172/* 173 * Macro to find a particular sem_undo vector 174 */ 175#define SEMU(ix) \ 176 ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 177 178/* 179 * semaphore info struct 180 */ 181struct seminfo seminfo = { 182 SEMMNI, /* # of semaphore identifiers */ 183 SEMMNS, /* # of semaphores in system */ 184 SEMMNU, /* # of undo structures in system */ 185 SEMMSL, /* max # of semaphores per id */ 186 SEMOPM, /* max # of operations per semop call */ 187 SEMUME, /* max # of undo entries per process */ 188 SEMUSZ, /* size in bytes of undo structure */ 189 SEMVMX, /* semaphore maximum value */ 190 SEMAEM /* adjust on exit max value */ 191}; 192 193SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RDTUN, &seminfo.semmni, 0, 194 "Number of semaphore identifiers"); 195SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RDTUN, &seminfo.semmns, 0, 196 "Maximum number of semaphores in the system"); 197SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RDTUN, &seminfo.semmnu, 0, 198 "Maximum number of undo structures in the system"); 199SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, 200 "Max semaphores per id"); 201SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RDTUN, &seminfo.semopm, 0, 202 "Max operations per semop call"); 203SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RDTUN, &seminfo.semume, 0, 204 "Max undo entries per process"); 205SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RDTUN, &seminfo.semusz, 0, 206 "Size in bytes of undo structure"); 207SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, 208 "Semaphore maximum value"); 209SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, 210 "Adjust on exit max value"); 211SYSCTL_PROC(_kern_ipc, OID_AUTO, sema, CTLTYPE_OPAQUE | CTLFLAG_RD, 212 NULL, 0, sysctl_sema, "", "Semaphore id pool"); 213 214static struct syscall_helper_data sem_syscalls[] = { 215 SYSCALL_INIT_HELPER(__semctl), 216 SYSCALL_INIT_HELPER(semget), 217 SYSCALL_INIT_HELPER(semop), 218#if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 219 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 220 SYSCALL_INIT_HELPER(semsys), 221 SYSCALL_INIT_HELPER_COMPAT(freebsd7___semctl), 222#endif 223 SYSCALL_INIT_LAST 224}; 225 226#ifdef COMPAT_FREEBSD32 227#include <compat/freebsd32/freebsd32.h> 228#include <compat/freebsd32/freebsd32_ipc.h> 229#include <compat/freebsd32/freebsd32_proto.h> 230#include <compat/freebsd32/freebsd32_signal.h> 231#include <compat/freebsd32/freebsd32_syscall.h> 232#include <compat/freebsd32/freebsd32_util.h> 233 234static struct syscall_helper_data sem32_syscalls[] = { 235 SYSCALL32_INIT_HELPER(freebsd32_semctl), 236 SYSCALL32_INIT_HELPER_COMPAT(semget), 237 SYSCALL32_INIT_HELPER_COMPAT(semop), 238 SYSCALL32_INIT_HELPER(freebsd32_semsys), 239#if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 240 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 241 SYSCALL32_INIT_HELPER(freebsd7_freebsd32_semctl), 242#endif 243 SYSCALL_INIT_LAST 244}; 245#endif 246 247static int 248seminit(void) 249{ 250 int i, error; 251 252 TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni); 253 TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns); 254 TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu); 255 TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl); 256 TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm); 257 TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume); 258 TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz); 259 TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx); 260 TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem); 261 262 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 263 sema = malloc(sizeof(struct semid_kernel) * seminfo.semmni, M_SEM, 264 M_WAITOK); 265 sema_mtx = malloc(sizeof(struct mtx) * seminfo.semmni, M_SEM, 266 M_WAITOK | M_ZERO); 267 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 268 269 for (i = 0; i < seminfo.semmni; i++) { 270 sema[i].u.sem_base = 0; 271 sema[i].u.sem_perm.mode = 0; 272 sema[i].u.sem_perm.seq = 0; 273#ifdef MAC 274 mac_sysvsem_init(&sema[i]); 275#endif 276 } 277 for (i = 0; i < seminfo.semmni; i++) 278 mtx_init(&sema_mtx[i], "semid", NULL, MTX_DEF); 279 LIST_INIT(&semu_free_list); 280 for (i = 0; i < seminfo.semmnu; i++) { 281 struct sem_undo *suptr = SEMU(i); 282 suptr->un_proc = NULL; 283 LIST_INSERT_HEAD(&semu_free_list, suptr, un_next); 284 } 285 LIST_INIT(&semu_list); 286 mtx_init(&sem_mtx, "sem", NULL, MTX_DEF); 287 mtx_init(&sem_undo_mtx, "semu", NULL, MTX_DEF); 288 semexit_tag = EVENTHANDLER_REGISTER(process_exit, semexit_myhook, NULL, 289 EVENTHANDLER_PRI_ANY); 290 291 error = syscall_helper_register(sem_syscalls); 292 if (error != 0) 293 return (error); 294#ifdef COMPAT_FREEBSD32 295 error = syscall32_helper_register(sem32_syscalls); 296 if (error != 0) 297 return (error); 298#endif 299 return (0); 300} 301 302static int 303semunload(void) 304{ 305 int i; 306 307 /* XXXKIB */ 308 if (semtot != 0) 309 return (EBUSY); 310 311#ifdef COMPAT_FREEBSD32 312 syscall32_helper_unregister(sem32_syscalls); 313#endif 314 syscall_helper_unregister(sem_syscalls); 315 EVENTHANDLER_DEREGISTER(process_exit, semexit_tag); 316#ifdef MAC 317 for (i = 0; i < seminfo.semmni; i++) 318 mac_sysvsem_destroy(&sema[i]); 319#endif 320 free(sem, M_SEM); 321 free(sema, M_SEM); 322 free(semu, M_SEM); 323 for (i = 0; i < seminfo.semmni; i++) 324 mtx_destroy(&sema_mtx[i]); 325 free(sema_mtx, M_SEM); 326 mtx_destroy(&sem_mtx); 327 mtx_destroy(&sem_undo_mtx); 328 return (0); 329} 330 331static int 332sysvsem_modload(struct module *module, int cmd, void *arg) 333{ 334 int error = 0; 335 336 switch (cmd) { 337 case MOD_LOAD: 338 error = seminit(); 339 if (error != 0) 340 semunload(); 341 break; 342 case MOD_UNLOAD: 343 error = semunload(); 344 break; 345 case MOD_SHUTDOWN: 346 break; 347 default: 348 error = EINVAL; 349 break; 350 } 351 return (error); 352} 353 354static moduledata_t sysvsem_mod = { 355 "sysvsem", 356 &sysvsem_modload, 357 NULL 358}; 359 360DECLARE_MODULE(sysvsem, sysvsem_mod, SI_SUB_SYSV_SEM, SI_ORDER_FIRST); 361MODULE_VERSION(sysvsem, 1); 362 363/* 364 * Allocate a new sem_undo structure for a process 365 * (returns ptr to structure or NULL if no more room) 366 */ 367 368static struct sem_undo * 369semu_alloc(struct thread *td) 370{ 371 struct sem_undo *suptr; 372 373 SEMUNDO_LOCKASSERT(MA_OWNED); 374 if ((suptr = LIST_FIRST(&semu_free_list)) == NULL) 375 return (NULL); 376 LIST_REMOVE(suptr, un_next); 377 LIST_INSERT_HEAD(&semu_list, suptr, un_next); 378 suptr->un_cnt = 0; 379 suptr->un_proc = td->td_proc; 380 return (suptr); 381} 382 383static int 384semu_try_free(struct sem_undo *suptr) 385{ 386 387 SEMUNDO_LOCKASSERT(MA_OWNED); 388 389 if (suptr->un_cnt != 0) 390 return (0); 391 LIST_REMOVE(suptr, un_next); 392 LIST_INSERT_HEAD(&semu_free_list, suptr, un_next); 393 return (1); 394} 395 396/* 397 * Adjust a particular entry for a particular proc 398 */ 399 400static int 401semundo_adjust(struct thread *td, struct sem_undo **supptr, int semid, 402 int semseq, int semnum, int adjval) 403{ 404 struct proc *p = td->td_proc; 405 struct sem_undo *suptr; 406 struct undo *sunptr; 407 int i; 408 409 SEMUNDO_LOCKASSERT(MA_OWNED); 410 /* Look for and remember the sem_undo if the caller doesn't provide 411 it */ 412 413 suptr = *supptr; 414 if (suptr == NULL) { 415 LIST_FOREACH(suptr, &semu_list, un_next) { 416 if (suptr->un_proc == p) { 417 *supptr = suptr; 418 break; 419 } 420 } 421 if (suptr == NULL) { 422 if (adjval == 0) 423 return(0); 424 suptr = semu_alloc(td); 425 if (suptr == NULL) 426 return (ENOSPC); 427 *supptr = suptr; 428 } 429 } 430 431 /* 432 * Look for the requested entry and adjust it (delete if adjval becomes 433 * 0). 434 */ 435 sunptr = &suptr->un_ent[0]; 436 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 437 if (sunptr->un_id != semid || sunptr->un_num != semnum) 438 continue; 439 if (adjval != 0) { 440 adjval += sunptr->un_adjval; 441 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 442 return (ERANGE); 443 } 444 sunptr->un_adjval = adjval; 445 if (sunptr->un_adjval == 0) { 446 suptr->un_cnt--; 447 if (i < suptr->un_cnt) 448 suptr->un_ent[i] = 449 suptr->un_ent[suptr->un_cnt]; 450 if (suptr->un_cnt == 0) 451 semu_try_free(suptr); 452 } 453 return (0); 454 } 455 456 /* Didn't find the right entry - create it */ 457 if (adjval == 0) 458 return (0); 459 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 460 return (ERANGE); 461 if (suptr->un_cnt != seminfo.semume) { 462 sunptr = &suptr->un_ent[suptr->un_cnt]; 463 suptr->un_cnt++; 464 sunptr->un_adjval = adjval; 465 sunptr->un_id = semid; 466 sunptr->un_num = semnum; 467 sunptr->un_seq = semseq; 468 } else 469 return (EINVAL); 470 return (0); 471} 472 473static void 474semundo_clear(int semid, int semnum) 475{ 476 struct sem_undo *suptr, *suptr1; 477 struct undo *sunptr; 478 int i; 479 480 SEMUNDO_LOCKASSERT(MA_OWNED); 481 LIST_FOREACH_SAFE(suptr, &semu_list, un_next, suptr1) { 482 sunptr = &suptr->un_ent[0]; 483 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 484 if (sunptr->un_id != semid) 485 continue; 486 if (semnum == -1 || sunptr->un_num == semnum) { 487 suptr->un_cnt--; 488 if (i < suptr->un_cnt) { 489 suptr->un_ent[i] = 490 suptr->un_ent[suptr->un_cnt]; 491 continue; 492 } 493 semu_try_free(suptr); 494 } 495 if (semnum != -1) 496 break; 497 } 498 } 499} 500 501static int 502semvalid(int semid, struct semid_kernel *semakptr) 503{ 504 505 return ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 || 506 semakptr->u.sem_perm.seq != IPCID_TO_SEQ(semid) ? EINVAL : 0); 507} 508 509/* 510 * Note that the user-mode half of this passes a union, not a pointer. 511 */ 512#ifndef _SYS_SYSPROTO_H_ 513struct __semctl_args { 514 int semid; 515 int semnum; 516 int cmd; 517 union semun *arg; 518}; 519#endif 520int 521sys___semctl(struct thread *td, struct __semctl_args *uap) 522{ 523 struct semid_ds dsbuf; 524 union semun arg, semun; 525 register_t rval; 526 int error; 527 528 switch (uap->cmd) { 529 case SEM_STAT: 530 case IPC_SET: 531 case IPC_STAT: 532 case GETALL: 533 case SETVAL: 534 case SETALL: 535 error = copyin(uap->arg, &arg, sizeof(arg)); 536 if (error) 537 return (error); 538 break; 539 } 540 541 switch (uap->cmd) { 542 case SEM_STAT: 543 case IPC_STAT: 544 semun.buf = &dsbuf; 545 break; 546 case IPC_SET: 547 error = copyin(arg.buf, &dsbuf, sizeof(dsbuf)); 548 if (error) 549 return (error); 550 semun.buf = &dsbuf; 551 break; 552 case GETALL: 553 case SETALL: 554 semun.array = arg.array; 555 break; 556 case SETVAL: 557 semun.val = arg.val; 558 break; 559 } 560 561 error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun, 562 &rval); 563 if (error) 564 return (error); 565 566 switch (uap->cmd) { 567 case SEM_STAT: 568 case IPC_STAT: 569 error = copyout(&dsbuf, arg.buf, sizeof(dsbuf)); 570 break; 571 } 572 573 if (error == 0) 574 td->td_retval[0] = rval; 575 return (error); 576} 577 578int 579kern_semctl(struct thread *td, int semid, int semnum, int cmd, 580 union semun *arg, register_t *rval) 581{ 582 u_short *array; 583 struct ucred *cred = td->td_ucred; 584 int i, error; 585 struct semid_ds *sbuf; 586 struct semid_kernel *semakptr; 587 struct mtx *sema_mtxp; 588 u_short usval, count; 589 int semidx; 590 591 DPRINTF(("call to semctl(%d, %d, %d, 0x%p)\n", 592 semid, semnum, cmd, arg)); 593 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 594 return (ENOSYS); 595 596 array = NULL; 597 598 switch(cmd) { 599 case SEM_STAT: 600 /* 601 * For this command we assume semid is an array index 602 * rather than an IPC id. 603 */ 604 if (semid < 0 || semid >= seminfo.semmni) 605 return (EINVAL); 606 semakptr = &sema[semid]; 607 sema_mtxp = &sema_mtx[semid]; 608 mtx_lock(sema_mtxp); 609 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0) { 610 error = EINVAL; 611 goto done2; 612 } 613 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 614 goto done2; 615#ifdef MAC 616 error = mac_sysvsem_check_semctl(cred, semakptr, cmd); 617 if (error != 0) 618 goto done2; 619#endif 620 bcopy(&semakptr->u, arg->buf, sizeof(struct semid_ds)); 621 *rval = IXSEQ_TO_IPCID(semid, semakptr->u.sem_perm); 622 mtx_unlock(sema_mtxp); 623 return (0); 624 } 625 626 semidx = IPCID_TO_IX(semid); 627 if (semidx < 0 || semidx >= seminfo.semmni) 628 return (EINVAL); 629 630 semakptr = &sema[semidx]; 631 sema_mtxp = &sema_mtx[semidx]; 632 if (cmd == IPC_RMID) 633 mtx_lock(&sem_mtx); 634 mtx_lock(sema_mtxp); 635#ifdef MAC 636 error = mac_sysvsem_check_semctl(cred, semakptr, cmd); 637 if (error != 0) 638 goto done2; 639#endif 640 641 error = 0; 642 *rval = 0; 643 644 switch (cmd) { 645 case IPC_RMID: 646 if ((error = semvalid(semid, semakptr)) != 0) 647 goto done2; 648 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_M))) 649 goto done2; 650 semakptr->u.sem_perm.cuid = cred->cr_uid; 651 semakptr->u.sem_perm.uid = cred->cr_uid; 652 semakptr->u.sem_perm.mode = 0; 653 racct_sub_cred(semakptr->cred, RACCT_NSEM, semakptr->u.sem_nsems); 654 crfree(semakptr->cred); 655 semakptr->cred = NULL; 656 SEMUNDO_LOCK(); 657 semundo_clear(semidx, -1); 658 SEMUNDO_UNLOCK(); 659#ifdef MAC 660 mac_sysvsem_cleanup(semakptr); 661#endif 662 wakeup(semakptr); 663 for (i = 0; i < seminfo.semmni; i++) { 664 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) && 665 sema[i].u.sem_base > semakptr->u.sem_base) 666 mtx_lock_flags(&sema_mtx[i], LOP_DUPOK); 667 } 668 for (i = semakptr->u.sem_base - sem; i < semtot; i++) 669 sem[i] = sem[i + semakptr->u.sem_nsems]; 670 for (i = 0; i < seminfo.semmni; i++) { 671 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) && 672 sema[i].u.sem_base > semakptr->u.sem_base) { 673 sema[i].u.sem_base -= semakptr->u.sem_nsems; 674 mtx_unlock(&sema_mtx[i]); 675 } 676 } 677 semtot -= semakptr->u.sem_nsems; 678 break; 679 680 case IPC_SET: 681 if ((error = semvalid(semid, semakptr)) != 0) 682 goto done2; 683 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_M))) 684 goto done2; 685 sbuf = arg->buf; 686 semakptr->u.sem_perm.uid = sbuf->sem_perm.uid; 687 semakptr->u.sem_perm.gid = sbuf->sem_perm.gid; 688 semakptr->u.sem_perm.mode = (semakptr->u.sem_perm.mode & 689 ~0777) | (sbuf->sem_perm.mode & 0777); 690 semakptr->u.sem_ctime = time_second; 691 break; 692 693 case IPC_STAT: 694 if ((error = semvalid(semid, semakptr)) != 0) 695 goto done2; 696 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 697 goto done2; 698 bcopy(&semakptr->u, arg->buf, sizeof(struct semid_ds)); 699 break; 700 701 case GETNCNT: 702 if ((error = semvalid(semid, semakptr)) != 0) 703 goto done2; 704 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 705 goto done2; 706 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) { 707 error = EINVAL; 708 goto done2; 709 } 710 *rval = semakptr->u.sem_base[semnum].semncnt; 711 break; 712 713 case GETPID: 714 if ((error = semvalid(semid, semakptr)) != 0) 715 goto done2; 716 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 717 goto done2; 718 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) { 719 error = EINVAL; 720 goto done2; 721 } 722 *rval = semakptr->u.sem_base[semnum].sempid; 723 break; 724 725 case GETVAL: 726 if ((error = semvalid(semid, semakptr)) != 0) 727 goto done2; 728 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 729 goto done2; 730 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) { 731 error = EINVAL; 732 goto done2; 733 } 734 *rval = semakptr->u.sem_base[semnum].semval; 735 break; 736 737 case GETALL: 738 /* 739 * Unfortunately, callers of this function don't know 740 * in advance how many semaphores are in this set. 741 * While we could just allocate the maximum size array 742 * and pass the actual size back to the caller, that 743 * won't work for SETALL since we can't copyin() more 744 * data than the user specified as we may return a 745 * spurious EFAULT. 746 * 747 * Note that the number of semaphores in a set is 748 * fixed for the life of that set. The only way that 749 * the 'count' could change while are blocked in 750 * malloc() is if this semaphore set were destroyed 751 * and a new one created with the same index. 752 * However, semvalid() will catch that due to the 753 * sequence number unless exactly 0x8000 (or a 754 * multiple thereof) semaphore sets for the same index 755 * are created and destroyed while we are in malloc! 756 * 757 */ 758 count = semakptr->u.sem_nsems; 759 mtx_unlock(sema_mtxp); 760 array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK); 761 mtx_lock(sema_mtxp); 762 if ((error = semvalid(semid, semakptr)) != 0) 763 goto done2; 764 KASSERT(count == semakptr->u.sem_nsems, ("nsems changed")); 765 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 766 goto done2; 767 for (i = 0; i < semakptr->u.sem_nsems; i++) 768 array[i] = semakptr->u.sem_base[i].semval; 769 mtx_unlock(sema_mtxp); 770 error = copyout(array, arg->array, count * sizeof(*array)); 771 mtx_lock(sema_mtxp); 772 break; 773 774 case GETZCNT: 775 if ((error = semvalid(semid, semakptr)) != 0) 776 goto done2; 777 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R))) 778 goto done2; 779 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) { 780 error = EINVAL; 781 goto done2; 782 } 783 *rval = semakptr->u.sem_base[semnum].semzcnt; 784 break; 785 786 case SETVAL: 787 if ((error = semvalid(semid, semakptr)) != 0) 788 goto done2; 789 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_W))) 790 goto done2; 791 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) { 792 error = EINVAL; 793 goto done2; 794 } 795 if (arg->val < 0 || arg->val > seminfo.semvmx) { 796 error = ERANGE; 797 goto done2; 798 } 799 semakptr->u.sem_base[semnum].semval = arg->val; 800 SEMUNDO_LOCK(); 801 semundo_clear(semidx, semnum); 802 SEMUNDO_UNLOCK(); 803 wakeup(semakptr); 804 break; 805 806 case SETALL: 807 /* 808 * See comment on GETALL for why 'count' shouldn't change 809 * and why we require a userland buffer. 810 */ 811 count = semakptr->u.sem_nsems; 812 mtx_unlock(sema_mtxp); 813 array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK); 814 error = copyin(arg->array, array, count * sizeof(*array)); 815 mtx_lock(sema_mtxp); 816 if (error) 817 break; 818 if ((error = semvalid(semid, semakptr)) != 0) 819 goto done2; 820 KASSERT(count == semakptr->u.sem_nsems, ("nsems changed")); 821 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_W))) 822 goto done2; 823 for (i = 0; i < semakptr->u.sem_nsems; i++) { 824 usval = array[i]; 825 if (usval > seminfo.semvmx) { 826 error = ERANGE; 827 break; 828 } 829 semakptr->u.sem_base[i].semval = usval; 830 } 831 SEMUNDO_LOCK(); 832 semundo_clear(semidx, -1); 833 SEMUNDO_UNLOCK(); 834 wakeup(semakptr); 835 break; 836 837 default: 838 error = EINVAL; 839 break; 840 } 841 842done2: 843 mtx_unlock(sema_mtxp); 844 if (cmd == IPC_RMID) 845 mtx_unlock(&sem_mtx); 846 if (array != NULL) 847 free(array, M_TEMP); 848 return(error); 849} 850 851#ifndef _SYS_SYSPROTO_H_ 852struct semget_args { 853 key_t key; 854 int nsems; 855 int semflg; 856}; 857#endif 858int 859sys_semget(struct thread *td, struct semget_args *uap) 860{ 861 int semid, error = 0; 862 int key = uap->key; 863 int nsems = uap->nsems; 864 int semflg = uap->semflg; 865 struct ucred *cred = td->td_ucred; 866 867 DPRINTF(("semget(0x%x, %d, 0%o)\n", key, nsems, semflg)); 868 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 869 return (ENOSYS); 870 871 mtx_lock(&sem_mtx); 872 if (key != IPC_PRIVATE) { 873 for (semid = 0; semid < seminfo.semmni; semid++) { 874 if ((sema[semid].u.sem_perm.mode & SEM_ALLOC) && 875 sema[semid].u.sem_perm.key == key) 876 break; 877 } 878 if (semid < seminfo.semmni) { 879 DPRINTF(("found public key\n")); 880 if ((error = ipcperm(td, &sema[semid].u.sem_perm, 881 semflg & 0700))) { 882 goto done2; 883 } 884 if (nsems > 0 && sema[semid].u.sem_nsems < nsems) { 885 DPRINTF(("too small\n")); 886 error = EINVAL; 887 goto done2; 888 } 889 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 890 DPRINTF(("not exclusive\n")); 891 error = EEXIST; 892 goto done2; 893 } 894#ifdef MAC 895 error = mac_sysvsem_check_semget(cred, &sema[semid]); 896 if (error != 0) 897 goto done2; 898#endif 899 goto found; 900 } 901 } 902 903 DPRINTF(("need to allocate the semid_kernel\n")); 904 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 905 if (nsems <= 0 || nsems > seminfo.semmsl) { 906 DPRINTF(("nsems out of range (0<%d<=%d)\n", nsems, 907 seminfo.semmsl)); 908 error = EINVAL; 909 goto done2; 910 } 911 if (nsems > seminfo.semmns - semtot) { 912 DPRINTF(( 913 "not enough semaphores left (need %d, got %d)\n", 914 nsems, seminfo.semmns - semtot)); 915 error = ENOSPC; 916 goto done2; 917 } 918 for (semid = 0; semid < seminfo.semmni; semid++) { 919 if ((sema[semid].u.sem_perm.mode & SEM_ALLOC) == 0) 920 break; 921 } 922 if (semid == seminfo.semmni) { 923 DPRINTF(("no more semid_kernel's available\n")); 924 error = ENOSPC; 925 goto done2; 926 } 927#ifdef RACCT 928 if (racct_enable) { 929 PROC_LOCK(td->td_proc); 930 error = racct_add(td->td_proc, RACCT_NSEM, nsems); 931 PROC_UNLOCK(td->td_proc); 932 if (error != 0) { 933 error = ENOSPC; 934 goto done2; 935 } 936 } 937#endif 938 DPRINTF(("semid %d is available\n", semid)); 939 mtx_lock(&sema_mtx[semid]); 940 KASSERT((sema[semid].u.sem_perm.mode & SEM_ALLOC) == 0, 941 ("Lost semaphore %d", semid)); 942 sema[semid].u.sem_perm.key = key; 943 sema[semid].u.sem_perm.cuid = cred->cr_uid; 944 sema[semid].u.sem_perm.uid = cred->cr_uid; 945 sema[semid].u.sem_perm.cgid = cred->cr_gid; 946 sema[semid].u.sem_perm.gid = cred->cr_gid; 947 sema[semid].u.sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 948 sema[semid].cred = crhold(cred); 949 sema[semid].u.sem_perm.seq = 950 (sema[semid].u.sem_perm.seq + 1) & 0x7fff; 951 sema[semid].u.sem_nsems = nsems; 952 sema[semid].u.sem_otime = 0; 953 sema[semid].u.sem_ctime = time_second; 954 sema[semid].u.sem_base = &sem[semtot]; 955 semtot += nsems; 956 bzero(sema[semid].u.sem_base, 957 sizeof(sema[semid].u.sem_base[0])*nsems); 958#ifdef MAC 959 mac_sysvsem_create(cred, &sema[semid]); 960#endif 961 mtx_unlock(&sema_mtx[semid]); 962 DPRINTF(("sembase = %p, next = %p\n", 963 sema[semid].u.sem_base, &sem[semtot])); 964 } else { 965 DPRINTF(("didn't find it and wasn't asked to create it\n")); 966 error = ENOENT; 967 goto done2; 968 } 969 970found: 971 td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].u.sem_perm); 972done2: 973 mtx_unlock(&sem_mtx); 974 return (error); 975} 976 977#ifndef _SYS_SYSPROTO_H_ 978struct semop_args { 979 int semid; 980 struct sembuf *sops; 981 size_t nsops; 982}; 983#endif 984int 985sys_semop(struct thread *td, struct semop_args *uap) 986{ 987#define SMALL_SOPS 8 988 struct sembuf small_sops[SMALL_SOPS]; 989 int semid = uap->semid; 990 size_t nsops = uap->nsops; 991 struct sembuf *sops; 992 struct semid_kernel *semakptr; 993 struct sembuf *sopptr = 0; 994 struct sem *semptr = 0; 995 struct sem_undo *suptr; 996 struct mtx *sema_mtxp; 997 size_t i, j, k; 998 int error; 999 int do_wakeup, do_undos; 1000 unsigned short seq; 1001 1002#ifdef SEM_DEBUG 1003 sops = NULL; 1004#endif 1005 DPRINTF(("call to semop(%d, %p, %u)\n", semid, sops, nsops)); 1006 1007 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 1008 return (ENOSYS); 1009 1010 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 1011 1012 if (semid < 0 || semid >= seminfo.semmni) 1013 return (EINVAL); 1014 1015 /* Allocate memory for sem_ops */ 1016 if (nsops <= SMALL_SOPS) 1017 sops = small_sops; 1018 else if (nsops > seminfo.semopm) { 1019 DPRINTF(("too many sops (max=%d, nsops=%d)\n", seminfo.semopm, 1020 nsops)); 1021 return (E2BIG); 1022 } else { 1023#ifdef RACCT 1024 if (racct_enable) { 1025 PROC_LOCK(td->td_proc); 1026 if (nsops > 1027 racct_get_available(td->td_proc, RACCT_NSEMOP)) { 1028 PROC_UNLOCK(td->td_proc); 1029 return (E2BIG); 1030 } 1031 PROC_UNLOCK(td->td_proc); 1032 } 1033#endif 1034 1035 sops = malloc(nsops * sizeof(*sops), M_TEMP, M_WAITOK); 1036 } 1037 if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) { 1038 DPRINTF(("error = %d from copyin(%p, %p, %d)\n", error, 1039 uap->sops, sops, nsops * sizeof(sops[0]))); 1040 if (sops != small_sops) 1041 free(sops, M_SEM); 1042 return (error); 1043 } 1044 1045 semakptr = &sema[semid]; 1046 sema_mtxp = &sema_mtx[semid]; 1047 mtx_lock(sema_mtxp); 1048 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0) { 1049 error = EINVAL; 1050 goto done2; 1051 } 1052 seq = semakptr->u.sem_perm.seq; 1053 if (seq != IPCID_TO_SEQ(uap->semid)) { 1054 error = EINVAL; 1055 goto done2; 1056 } 1057 /* 1058 * Initial pass thru sops to see what permissions are needed. 1059 * Also perform any checks that don't need repeating on each 1060 * attempt to satisfy the request vector. 1061 */ 1062 j = 0; /* permission needed */ 1063 do_undos = 0; 1064 for (i = 0; i < nsops; i++) { 1065 sopptr = &sops[i]; 1066 if (sopptr->sem_num >= semakptr->u.sem_nsems) { 1067 error = EFBIG; 1068 goto done2; 1069 } 1070 if (sopptr->sem_flg & SEM_UNDO && sopptr->sem_op != 0) 1071 do_undos = 1; 1072 j |= (sopptr->sem_op == 0) ? SEM_R : SEM_A; 1073 } 1074 1075 if ((error = ipcperm(td, &semakptr->u.sem_perm, j))) { 1076 DPRINTF(("error = %d from ipaccess\n", error)); 1077 goto done2; 1078 } 1079#ifdef MAC 1080 error = mac_sysvsem_check_semop(td->td_ucred, semakptr, j); 1081 if (error != 0) 1082 goto done2; 1083#endif 1084 1085 /* 1086 * Loop trying to satisfy the vector of requests. 1087 * If we reach a point where we must wait, any requests already 1088 * performed are rolled back and we go to sleep until some other 1089 * process wakes us up. At this point, we start all over again. 1090 * 1091 * This ensures that from the perspective of other tasks, a set 1092 * of requests is atomic (never partially satisfied). 1093 */ 1094 for (;;) { 1095 do_wakeup = 0; 1096 error = 0; /* error return if necessary */ 1097 1098 for (i = 0; i < nsops; i++) { 1099 sopptr = &sops[i]; 1100 semptr = &semakptr->u.sem_base[sopptr->sem_num]; 1101 1102 DPRINTF(( 1103 "semop: semakptr=%p, sem_base=%p, " 1104 "semptr=%p, sem[%d]=%d : op=%d, flag=%s\n", 1105 semakptr, semakptr->u.sem_base, semptr, 1106 sopptr->sem_num, semptr->semval, sopptr->sem_op, 1107 (sopptr->sem_flg & IPC_NOWAIT) ? 1108 "nowait" : "wait")); 1109 1110 if (sopptr->sem_op < 0) { 1111 if (semptr->semval + sopptr->sem_op < 0) { 1112 DPRINTF(("semop: can't do it now\n")); 1113 break; 1114 } else { 1115 semptr->semval += sopptr->sem_op; 1116 if (semptr->semval == 0 && 1117 semptr->semzcnt > 0) 1118 do_wakeup = 1; 1119 } 1120 } else if (sopptr->sem_op == 0) { 1121 if (semptr->semval != 0) { 1122 DPRINTF(("semop: not zero now\n")); 1123 break; 1124 } 1125 } else if (semptr->semval + sopptr->sem_op > 1126 seminfo.semvmx) { 1127 error = ERANGE; 1128 break; 1129 } else { 1130 if (semptr->semncnt > 0) 1131 do_wakeup = 1; 1132 semptr->semval += sopptr->sem_op; 1133 } 1134 } 1135 1136 /* 1137 * Did we get through the entire vector? 1138 */ 1139 if (i >= nsops) 1140 goto done; 1141 1142 /* 1143 * No ... rollback anything that we've already done 1144 */ 1145 DPRINTF(("semop: rollback 0 through %d\n", i-1)); 1146 for (j = 0; j < i; j++) 1147 semakptr->u.sem_base[sops[j].sem_num].semval -= 1148 sops[j].sem_op; 1149 1150 /* If we detected an error, return it */ 1151 if (error != 0) 1152 goto done2; 1153 1154 /* 1155 * If the request that we couldn't satisfy has the 1156 * NOWAIT flag set then return with EAGAIN. 1157 */ 1158 if (sopptr->sem_flg & IPC_NOWAIT) { 1159 error = EAGAIN; 1160 goto done2; 1161 } 1162 1163 if (sopptr->sem_op == 0) 1164 semptr->semzcnt++; 1165 else 1166 semptr->semncnt++; 1167 1168 DPRINTF(("semop: good night!\n")); 1169 error = msleep(semakptr, sema_mtxp, (PZERO - 4) | PCATCH, 1170 "semwait", 0); 1171 DPRINTF(("semop: good morning (error=%d)!\n", error)); 1172 /* return code is checked below, after sem[nz]cnt-- */ 1173 1174 /* 1175 * Make sure that the semaphore still exists 1176 */ 1177 seq = semakptr->u.sem_perm.seq; 1178 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 || 1179 seq != IPCID_TO_SEQ(uap->semid)) { 1180 error = EIDRM; 1181 goto done2; 1182 } 1183 1184 /* 1185 * Renew the semaphore's pointer after wakeup since 1186 * during msleep sem_base may have been modified and semptr 1187 * is not valid any more 1188 */ 1189 semptr = &semakptr->u.sem_base[sopptr->sem_num]; 1190 1191 /* 1192 * The semaphore is still alive. Readjust the count of 1193 * waiting processes. 1194 */ 1195 if (sopptr->sem_op == 0) 1196 semptr->semzcnt--; 1197 else 1198 semptr->semncnt--; 1199 1200 /* 1201 * Is it really morning, or was our sleep interrupted? 1202 * (Delayed check of msleep() return code because we 1203 * need to decrement sem[nz]cnt either way.) 1204 */ 1205 if (error != 0) { 1206 error = EINTR; 1207 goto done2; 1208 } 1209 DPRINTF(("semop: good morning!\n")); 1210 } 1211 1212done: 1213 /* 1214 * Process any SEM_UNDO requests. 1215 */ 1216 if (do_undos) { 1217 SEMUNDO_LOCK(); 1218 suptr = NULL; 1219 for (i = 0; i < nsops; i++) { 1220 /* 1221 * We only need to deal with SEM_UNDO's for non-zero 1222 * op's. 1223 */ 1224 int adjval; 1225 1226 if ((sops[i].sem_flg & SEM_UNDO) == 0) 1227 continue; 1228 adjval = sops[i].sem_op; 1229 if (adjval == 0) 1230 continue; 1231 error = semundo_adjust(td, &suptr, semid, seq, 1232 sops[i].sem_num, -adjval); 1233 if (error == 0) 1234 continue; 1235 1236 /* 1237 * Oh-Oh! We ran out of either sem_undo's or undo's. 1238 * Rollback the adjustments to this point and then 1239 * rollback the semaphore ups and down so we can return 1240 * with an error with all structures restored. We 1241 * rollback the undo's in the exact reverse order that 1242 * we applied them. This guarantees that we won't run 1243 * out of space as we roll things back out. 1244 */ 1245 for (j = 0; j < i; j++) { 1246 k = i - j - 1; 1247 if ((sops[k].sem_flg & SEM_UNDO) == 0) 1248 continue; 1249 adjval = sops[k].sem_op; 1250 if (adjval == 0) 1251 continue; 1252 if (semundo_adjust(td, &suptr, semid, seq, 1253 sops[k].sem_num, adjval) != 0) 1254 panic("semop - can't undo undos"); 1255 } 1256 1257 for (j = 0; j < nsops; j++) 1258 semakptr->u.sem_base[sops[j].sem_num].semval -= 1259 sops[j].sem_op; 1260 1261 DPRINTF(("error = %d from semundo_adjust\n", error)); 1262 SEMUNDO_UNLOCK(); 1263 goto done2; 1264 } /* loop through the sops */ 1265 SEMUNDO_UNLOCK(); 1266 } /* if (do_undos) */ 1267 1268 /* We're definitely done - set the sempid's and time */ 1269 for (i = 0; i < nsops; i++) { 1270 sopptr = &sops[i]; 1271 semptr = &semakptr->u.sem_base[sopptr->sem_num]; 1272 semptr->sempid = td->td_proc->p_pid; 1273 } 1274 semakptr->u.sem_otime = time_second; 1275 1276 /* 1277 * Do a wakeup if any semaphore was up'd whilst something was 1278 * sleeping on it. 1279 */ 1280 if (do_wakeup) { 1281 DPRINTF(("semop: doing wakeup\n")); 1282 wakeup(semakptr); 1283 DPRINTF(("semop: back from wakeup\n")); 1284 } 1285 DPRINTF(("semop: done\n")); 1286 td->td_retval[0] = 0; 1287done2: 1288 mtx_unlock(sema_mtxp); 1289 if (sops != small_sops) 1290 free(sops, M_SEM); 1291 return (error); 1292} 1293 1294/* 1295 * Go through the undo structures for this process and apply the adjustments to 1296 * semaphores. 1297 */ 1298static void 1299semexit_myhook(void *arg, struct proc *p) 1300{ 1301 struct sem_undo *suptr; 1302 struct semid_kernel *semakptr; 1303 struct mtx *sema_mtxp; 1304 int semid, semnum, adjval, ix; 1305 unsigned short seq; 1306 1307 /* 1308 * Go through the chain of undo vectors looking for one 1309 * associated with this process. 1310 */ 1311 SEMUNDO_LOCK(); 1312 LIST_FOREACH(suptr, &semu_list, un_next) { 1313 if (suptr->un_proc == p) 1314 break; 1315 } 1316 if (suptr == NULL) { 1317 SEMUNDO_UNLOCK(); 1318 return; 1319 } 1320 LIST_REMOVE(suptr, un_next); 1321 1322 DPRINTF(("proc @%p has undo structure with %d entries\n", p, 1323 suptr->un_cnt)); 1324 1325 /* 1326 * If there are any active undo elements then process them. 1327 */ 1328 if (suptr->un_cnt > 0) { 1329 SEMUNDO_UNLOCK(); 1330 for (ix = 0; ix < suptr->un_cnt; ix++) { 1331 semid = suptr->un_ent[ix].un_id; 1332 semnum = suptr->un_ent[ix].un_num; 1333 adjval = suptr->un_ent[ix].un_adjval; 1334 seq = suptr->un_ent[ix].un_seq; 1335 semakptr = &sema[semid]; 1336 sema_mtxp = &sema_mtx[semid]; 1337 1338 mtx_lock(sema_mtxp); 1339 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 || 1340 (semakptr->u.sem_perm.seq != seq)) { 1341 mtx_unlock(sema_mtxp); 1342 continue; 1343 } 1344 if (semnum >= semakptr->u.sem_nsems) 1345 panic("semexit - semnum out of range"); 1346 1347 DPRINTF(( 1348 "semexit: %p id=%d num=%d(adj=%d) ; sem=%d\n", 1349 suptr->un_proc, suptr->un_ent[ix].un_id, 1350 suptr->un_ent[ix].un_num, 1351 suptr->un_ent[ix].un_adjval, 1352 semakptr->u.sem_base[semnum].semval)); 1353 1354 if (adjval < 0 && semakptr->u.sem_base[semnum].semval < 1355 -adjval) 1356 semakptr->u.sem_base[semnum].semval = 0; 1357 else 1358 semakptr->u.sem_base[semnum].semval += adjval; 1359 1360 wakeup(semakptr); 1361 DPRINTF(("semexit: back from wakeup\n")); 1362 mtx_unlock(sema_mtxp); 1363 } 1364 SEMUNDO_LOCK(); 1365 } 1366 1367 /* 1368 * Deallocate the undo vector. 1369 */ 1370 DPRINTF(("removing vector\n")); 1371 suptr->un_proc = NULL; 1372 suptr->un_cnt = 0; 1373 LIST_INSERT_HEAD(&semu_free_list, suptr, un_next); 1374 SEMUNDO_UNLOCK(); 1375} 1376 1377static int 1378sysctl_sema(SYSCTL_HANDLER_ARGS) 1379{ 1380 1381 return (SYSCTL_OUT(req, sema, 1382 sizeof(struct semid_kernel) * seminfo.semmni)); 1383} 1384 1385#if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1386 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1387 1388/* XXX casting to (sy_call_t *) is bogus, as usual. */ 1389static sy_call_t *semcalls[] = { 1390 (sy_call_t *)freebsd7___semctl, (sy_call_t *)sys_semget, 1391 (sy_call_t *)sys_semop 1392}; 1393 1394/* 1395 * Entry point for all SEM calls. 1396 */ 1397int 1398sys_semsys(td, uap) 1399 struct thread *td; 1400 /* XXX actually varargs. */ 1401 struct semsys_args /* { 1402 int which; 1403 int a2; 1404 int a3; 1405 int a4; 1406 int a5; 1407 } */ *uap; 1408{ 1409 int error; 1410 1411 if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC)) 1412 return (ENOSYS); 1413 if (uap->which < 0 || 1414 uap->which >= sizeof(semcalls)/sizeof(semcalls[0])) 1415 return (EINVAL); 1416 error = (*semcalls[uap->which])(td, &uap->a2); 1417 return (error); 1418} 1419 1420#ifndef CP 1421#define CP(src, dst, fld) do { (dst).fld = (src).fld; } while (0) 1422#endif 1423 1424#ifndef _SYS_SYSPROTO_H_ 1425struct freebsd7___semctl_args { 1426 int semid; 1427 int semnum; 1428 int cmd; 1429 union semun_old *arg; 1430}; 1431#endif 1432int 1433freebsd7___semctl(struct thread *td, struct freebsd7___semctl_args *uap) 1434{ 1435 struct semid_ds_old dsold; 1436 struct semid_ds dsbuf; 1437 union semun_old arg; 1438 union semun semun; 1439 register_t rval; 1440 int error; 1441 1442 switch (uap->cmd) { 1443 case SEM_STAT: 1444 case IPC_SET: 1445 case IPC_STAT: 1446 case GETALL: 1447 case SETVAL: 1448 case SETALL: 1449 error = copyin(uap->arg, &arg, sizeof(arg)); 1450 if (error) 1451 return (error); 1452 break; 1453 } 1454 1455 switch (uap->cmd) { 1456 case SEM_STAT: 1457 case IPC_STAT: 1458 semun.buf = &dsbuf; 1459 break; 1460 case IPC_SET: 1461 error = copyin(arg.buf, &dsold, sizeof(dsold)); 1462 if (error) 1463 return (error); 1464 ipcperm_old2new(&dsold.sem_perm, &dsbuf.sem_perm); 1465 CP(dsold, dsbuf, sem_base); 1466 CP(dsold, dsbuf, sem_nsems); 1467 CP(dsold, dsbuf, sem_otime); 1468 CP(dsold, dsbuf, sem_ctime); 1469 semun.buf = &dsbuf; 1470 break; 1471 case GETALL: 1472 case SETALL: 1473 semun.array = arg.array; 1474 break; 1475 case SETVAL: 1476 semun.val = arg.val; 1477 break; 1478 } 1479 1480 error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun, 1481 &rval); 1482 if (error) 1483 return (error); 1484 1485 switch (uap->cmd) { 1486 case SEM_STAT: 1487 case IPC_STAT: 1488 bzero(&dsold, sizeof(dsold)); 1489 ipcperm_new2old(&dsbuf.sem_perm, &dsold.sem_perm); 1490 CP(dsbuf, dsold, sem_base); 1491 CP(dsbuf, dsold, sem_nsems); 1492 CP(dsbuf, dsold, sem_otime); 1493 CP(dsbuf, dsold, sem_ctime); 1494 error = copyout(&dsold, arg.buf, sizeof(dsold)); 1495 break; 1496 } 1497 1498 if (error == 0) 1499 td->td_retval[0] = rval; 1500 return (error); 1501} 1502 1503#endif /* COMPAT_FREEBSD{4,5,6,7} */ 1504 1505#ifdef COMPAT_FREEBSD32 1506 1507int 1508freebsd32_semsys(struct thread *td, struct freebsd32_semsys_args *uap) 1509{ 1510 1511#if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1512 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1513 switch (uap->which) { 1514 case 0: 1515 return (freebsd7_freebsd32_semctl(td, 1516 (struct freebsd7_freebsd32_semctl_args *)&uap->a2)); 1517 default: 1518 return (sys_semsys(td, (struct semsys_args *)uap)); 1519 } 1520#else 1521 return (nosys(td, NULL)); 1522#endif 1523} 1524 1525#if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \ 1526 defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7) 1527int 1528freebsd7_freebsd32_semctl(struct thread *td, 1529 struct freebsd7_freebsd32_semctl_args *uap) 1530{ 1531 struct semid_ds32_old dsbuf32; 1532 struct semid_ds dsbuf; 1533 union semun semun; 1534 union semun32 arg; 1535 register_t rval; 1536 int error; 1537 1538 switch (uap->cmd) { 1539 case SEM_STAT: 1540 case IPC_SET: 1541 case IPC_STAT: 1542 case GETALL: 1543 case SETVAL: 1544 case SETALL: 1545 error = copyin(uap->arg, &arg, sizeof(arg)); 1546 if (error) 1547 return (error); 1548 break; 1549 } 1550 1551 switch (uap->cmd) { 1552 case SEM_STAT: 1553 case IPC_STAT: 1554 semun.buf = &dsbuf; 1555 break; 1556 case IPC_SET: 1557 error = copyin(PTRIN(arg.buf), &dsbuf32, sizeof(dsbuf32)); 1558 if (error) 1559 return (error); 1560 freebsd32_ipcperm_old_in(&dsbuf32.sem_perm, &dsbuf.sem_perm); 1561 PTRIN_CP(dsbuf32, dsbuf, sem_base); 1562 CP(dsbuf32, dsbuf, sem_nsems); 1563 CP(dsbuf32, dsbuf, sem_otime); 1564 CP(dsbuf32, dsbuf, sem_ctime); 1565 semun.buf = &dsbuf; 1566 break; 1567 case GETALL: 1568 case SETALL: 1569 semun.array = PTRIN(arg.array); 1570 break; 1571 case SETVAL: 1572 semun.val = arg.val; 1573 break; 1574 } 1575 1576 error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun, 1577 &rval); 1578 if (error) 1579 return (error); 1580 1581 switch (uap->cmd) { 1582 case SEM_STAT: 1583 case IPC_STAT: 1584 bzero(&dsbuf32, sizeof(dsbuf32)); 1585 freebsd32_ipcperm_old_out(&dsbuf.sem_perm, &dsbuf32.sem_perm); 1586 PTROUT_CP(dsbuf, dsbuf32, sem_base); 1587 CP(dsbuf, dsbuf32, sem_nsems); 1588 CP(dsbuf, dsbuf32, sem_otime); 1589 CP(dsbuf, dsbuf32, sem_ctime); 1590 error = copyout(&dsbuf32, PTRIN(arg.buf), sizeof(dsbuf32)); 1591 break; 1592 } 1593 1594 if (error == 0) 1595 td->td_retval[0] = rval; 1596 return (error); 1597} 1598#endif 1599 1600int 1601freebsd32_semctl(struct thread *td, struct freebsd32_semctl_args *uap) 1602{ 1603 struct semid_ds32 dsbuf32; 1604 struct semid_ds dsbuf; 1605 union semun semun; 1606 union semun32 arg; 1607 register_t rval; 1608 int error; 1609 1610 switch (uap->cmd) { 1611 case SEM_STAT: 1612 case IPC_SET: 1613 case IPC_STAT: 1614 case GETALL: 1615 case SETVAL: 1616 case SETALL: 1617 error = copyin(uap->arg, &arg, sizeof(arg)); 1618 if (error) 1619 return (error); 1620 break; 1621 } 1622 1623 switch (uap->cmd) { 1624 case SEM_STAT: 1625 case IPC_STAT: 1626 semun.buf = &dsbuf; 1627 break; 1628 case IPC_SET: 1629 error = copyin(PTRIN(arg.buf), &dsbuf32, sizeof(dsbuf32)); 1630 if (error) 1631 return (error); 1632 freebsd32_ipcperm_in(&dsbuf32.sem_perm, &dsbuf.sem_perm); 1633 PTRIN_CP(dsbuf32, dsbuf, sem_base); 1634 CP(dsbuf32, dsbuf, sem_nsems); 1635 CP(dsbuf32, dsbuf, sem_otime); 1636 CP(dsbuf32, dsbuf, sem_ctime); 1637 semun.buf = &dsbuf; 1638 break; 1639 case GETALL: 1640 case SETALL: 1641 semun.array = PTRIN(arg.array); 1642 break; 1643 case SETVAL: 1644 semun.val = arg.val; 1645 break; 1646 } 1647 1648 error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun, 1649 &rval); 1650 if (error) 1651 return (error); 1652 1653 switch (uap->cmd) { 1654 case SEM_STAT: 1655 case IPC_STAT: 1656 bzero(&dsbuf32, sizeof(dsbuf32)); 1657 freebsd32_ipcperm_out(&dsbuf.sem_perm, &dsbuf32.sem_perm); 1658 PTROUT_CP(dsbuf, dsbuf32, sem_base); 1659 CP(dsbuf, dsbuf32, sem_nsems); 1660 CP(dsbuf, dsbuf32, sem_otime); 1661 CP(dsbuf, dsbuf32, sem_ctime); 1662 error = copyout(&dsbuf32, PTRIN(arg.buf), sizeof(dsbuf32)); 1663 break; 1664 } 1665 1666 if (error == 0) 1667 td->td_retval[0] = rval; 1668 return (error); 1669} 1670 1671#endif /* COMPAT_FREEBSD32 */ 1672