sysv_sem.c revision 88633
1/* $FreeBSD: head/sys/kern/sysv_sem.c 88633 2001-12-29 07:13:47Z alfred $ */ 2 3/* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11#include "opt_sysvipc.h" 12 13#include <sys/param.h> 14#include <sys/systm.h> 15#include <sys/sysproto.h> 16#include <sys/kernel.h> 17#include <sys/proc.h> 18#include <sys/lock.h> 19#include <sys/mutex.h> 20#include <sys/sem.h> 21#include <sys/syscall.h> 22#include <sys/sysent.h> 23#include <sys/sysctl.h> 24#include <sys/malloc.h> 25#include <sys/jail.h> 26 27static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29static void seminit __P((void)); 30static int sysvsem_modload __P((struct module *, int, void *)); 31static int semunload __P((void)); 32static void semexit_myhook __P((struct proc *p)); 33static int sysctl_sema __P((SYSCTL_HANDLER_ARGS)); 34 35#ifndef _SYS_SYSPROTO_H_ 36struct __semctl_args; 37int __semctl __P((struct thread *td, struct __semctl_args *uap)); 38struct semget_args; 39int semget __P((struct thread *td, struct semget_args *uap)); 40struct semop_args; 41int semop __P((struct thread *td, struct semop_args *uap)); 42#endif 43 44static struct sem_undo *semu_alloc __P((struct thread *td)); 45static int semundo_adjust __P((struct thread *td, struct sem_undo **supptr, 46 int semid, int semnum, int adjval)); 47static void semundo_clear __P((int semid, int semnum)); 48 49/* XXX casting to (sy_call_t *) is bogus, as usual. */ 50static sy_call_t *semcalls[] = { 51 (sy_call_t *)__semctl, (sy_call_t *)semget, 52 (sy_call_t *)semop 53}; 54 55static int semtot = 0; 56static struct semid_ds *sema; /* semaphore id pool */ 57static struct sem *sem; /* semaphore pool */ 58static struct sem_undo *semu_list; /* list of active undo structures */ 59static int *semu; /* undo structure pool */ 60 61struct sem { 62 u_short semval; /* semaphore value */ 63 pid_t sempid; /* pid of last operation */ 64 u_short semncnt; /* # awaiting semval > cval */ 65 u_short semzcnt; /* # awaiting semval = 0 */ 66}; 67 68/* 69 * Undo structure (one per process) 70 */ 71struct sem_undo { 72 struct sem_undo *un_next; /* ptr to next active undo structure */ 73 struct proc *un_proc; /* owner of this structure */ 74 short un_cnt; /* # of active entries */ 75 struct undo { 76 short un_adjval; /* adjust on exit values */ 77 short un_num; /* semaphore # */ 78 int un_id; /* semid */ 79 } un_ent[1]; /* undo entries */ 80}; 81 82/* 83 * Configuration parameters 84 */ 85#ifndef SEMMNI 86#define SEMMNI 10 /* # of semaphore identifiers */ 87#endif 88#ifndef SEMMNS 89#define SEMMNS 60 /* # of semaphores in system */ 90#endif 91#ifndef SEMUME 92#define SEMUME 10 /* max # of undo entries per process */ 93#endif 94#ifndef SEMMNU 95#define SEMMNU 30 /* # of undo structures in system */ 96#endif 97 98/* shouldn't need tuning */ 99#ifndef SEMMAP 100#define SEMMAP 30 /* # of entries in semaphore map */ 101#endif 102#ifndef SEMMSL 103#define SEMMSL SEMMNS /* max # of semaphores per id */ 104#endif 105#ifndef SEMOPM 106#define SEMOPM 100 /* max # of operations per semop call */ 107#endif 108 109#define SEMVMX 32767 /* semaphore maximum value */ 110#define SEMAEM 16384 /* adjust on exit max value */ 111 112/* 113 * Due to the way semaphore memory is allocated, we have to ensure that 114 * SEMUSZ is properly aligned. 115 */ 116 117#define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 118 119/* actual size of an undo structure */ 120#define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 121 122/* 123 * Macro to find a particular sem_undo vector 124 */ 125#define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 126 127/* 128 * semaphore info struct 129 */ 130struct seminfo seminfo = { 131 SEMMAP, /* # of entries in semaphore map */ 132 SEMMNI, /* # of semaphore identifiers */ 133 SEMMNS, /* # of semaphores in system */ 134 SEMMNU, /* # of undo structures in system */ 135 SEMMSL, /* max # of semaphores per id */ 136 SEMOPM, /* max # of operations per semop call */ 137 SEMUME, /* max # of undo entries per process */ 138 SEMUSZ, /* size in bytes of undo structure */ 139 SEMVMX, /* semaphore maximum value */ 140 SEMAEM /* adjust on exit max value */ 141}; 142 143SYSCTL_DECL(_kern_ipc); 144SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 145SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 146SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 147SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 148SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 149SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 150SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 151SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 152SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 153SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 154SYSCTL_PROC(_kern_ipc, OID_AUTO, sema, CTLFLAG_RD, 155 NULL, 0, sysctl_sema, "", ""); 156 157#if 0 158RO seminfo.semmap /* SEMMAP unused */ 159RO seminfo.semmni 160RO seminfo.semmns 161RO seminfo.semmnu /* undo entries per system */ 162RW seminfo.semmsl 163RO seminfo.semopm /* SEMOPM unused */ 164RO seminfo.semume 165RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 166RO seminfo.semvmx /* SEMVMX unused - user param */ 167RO seminfo.semaem /* SEMAEM unused - user param */ 168#endif 169 170static void 171seminit(void) 172{ 173 register int i; 174 175 TUNABLE_INT_FETCH("kern.ipc.semmap", &seminfo.semmap); 176 TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni); 177 TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns); 178 TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu); 179 TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl); 180 TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm); 181 TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume); 182 TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz); 183 TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx); 184 TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem); 185 186 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 187 if (sem == NULL) 188 panic("sem is NULL"); 189 sema = malloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 190 if (sema == NULL) 191 panic("sema is NULL"); 192 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 193 if (semu == NULL) 194 panic("semu is NULL"); 195 196 for (i = 0; i < seminfo.semmni; i++) { 197 sema[i].sem_base = 0; 198 sema[i].sem_perm.mode = 0; 199 } 200 for (i = 0; i < seminfo.semmnu; i++) { 201 register struct sem_undo *suptr = SEMU(i); 202 suptr->un_proc = NULL; 203 } 204 semu_list = NULL; 205 semexit_hook = &semexit_myhook; 206} 207 208static int 209semunload(void) 210{ 211 212 if (semtot != 0) 213 return (EBUSY); 214 215 free(sem, M_SEM); 216 free(sema, M_SEM); 217 free(semu, M_SEM); 218 semexit_hook = NULL; 219 return (0); 220} 221 222static int 223sysvsem_modload(struct module *module, int cmd, void *arg) 224{ 225 int error = 0; 226 227 switch (cmd) { 228 case MOD_LOAD: 229 seminit(); 230 break; 231 case MOD_UNLOAD: 232 error = semunload(); 233 break; 234 case MOD_SHUTDOWN: 235 break; 236 default: 237 error = EINVAL; 238 break; 239 } 240 return (error); 241} 242 243static moduledata_t sysvsem_mod = { 244 "sysvsem", 245 &sysvsem_modload, 246 NULL 247}; 248 249SYSCALL_MODULE_HELPER(semsys); 250SYSCALL_MODULE_HELPER(__semctl); 251SYSCALL_MODULE_HELPER(semget); 252SYSCALL_MODULE_HELPER(semop); 253 254DECLARE_MODULE(sysvsem, sysvsem_mod, 255 SI_SUB_SYSV_SEM, SI_ORDER_FIRST); 256MODULE_VERSION(sysvsem, 1); 257 258/* 259 * Entry point for all SEM calls 260 * 261 * MPSAFE 262 */ 263int 264semsys(td, uap) 265 struct thread *td; 266 /* XXX actually varargs. */ 267 struct semsys_args /* { 268 u_int which; 269 int a2; 270 int a3; 271 int a4; 272 int a5; 273 } */ *uap; 274{ 275 int error; 276 277 mtx_lock(&Giant); 278 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 279 error = ENOSYS; 280 goto done2; 281 } 282 if (uap->which >= sizeof(semcalls)/sizeof(semcalls[0])) { 283 error = EINVAL; 284 goto done2; 285 } 286 error = (*semcalls[uap->which])(td, &uap->a2); 287done2: 288 mtx_unlock(&Giant); 289 return (error); 290} 291 292/* 293 * Allocate a new sem_undo structure for a process 294 * (returns ptr to structure or NULL if no more room) 295 */ 296 297static struct sem_undo * 298semu_alloc(td) 299 struct thread *td; 300{ 301 register int i; 302 register struct sem_undo *suptr; 303 register struct sem_undo **supptr; 304 int attempt; 305 306 /* 307 * Try twice to allocate something. 308 * (we'll purge any empty structures after the first pass so 309 * two passes are always enough) 310 */ 311 312 for (attempt = 0; attempt < 2; attempt++) { 313 /* 314 * Look for a free structure. 315 * Fill it in and return it if we find one. 316 */ 317 318 for (i = 0; i < seminfo.semmnu; i++) { 319 suptr = SEMU(i); 320 if (suptr->un_proc == NULL) { 321 suptr->un_next = semu_list; 322 semu_list = suptr; 323 suptr->un_cnt = 0; 324 suptr->un_proc = td->td_proc; 325 return(suptr); 326 } 327 } 328 329 /* 330 * We didn't find a free one, if this is the first attempt 331 * then try to free some structures. 332 */ 333 334 if (attempt == 0) { 335 /* All the structures are in use - try to free some */ 336 int did_something = 0; 337 338 supptr = &semu_list; 339 while ((suptr = *supptr) != NULL) { 340 if (suptr->un_cnt == 0) { 341 suptr->un_proc = NULL; 342 *supptr = suptr->un_next; 343 did_something = 1; 344 } else 345 supptr = &(suptr->un_next); 346 } 347 348 /* If we didn't free anything then just give-up */ 349 if (!did_something) 350 return(NULL); 351 } else { 352 /* 353 * The second pass failed even though we freed 354 * something after the first pass! 355 * This is IMPOSSIBLE! 356 */ 357 panic("semu_alloc - second attempt failed"); 358 } 359 } 360 return (NULL); 361} 362 363/* 364 * Adjust a particular entry for a particular proc 365 */ 366 367static int 368semundo_adjust(td, supptr, semid, semnum, adjval) 369 register struct thread *td; 370 struct sem_undo **supptr; 371 int semid, semnum; 372 int adjval; 373{ 374 struct proc *p = td->td_proc; 375 register struct sem_undo *suptr; 376 register struct undo *sunptr; 377 int i; 378 379 /* Look for and remember the sem_undo if the caller doesn't provide 380 it */ 381 382 suptr = *supptr; 383 if (suptr == NULL) { 384 for (suptr = semu_list; suptr != NULL; 385 suptr = suptr->un_next) { 386 if (suptr->un_proc == p) { 387 *supptr = suptr; 388 break; 389 } 390 } 391 if (suptr == NULL) { 392 if (adjval == 0) 393 return(0); 394 suptr = semu_alloc(td); 395 if (suptr == NULL) 396 return(ENOSPC); 397 *supptr = suptr; 398 } 399 } 400 401 /* 402 * Look for the requested entry and adjust it (delete if adjval becomes 403 * 0). 404 */ 405 sunptr = &suptr->un_ent[0]; 406 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 407 if (sunptr->un_id != semid || sunptr->un_num != semnum) 408 continue; 409 if (adjval != 0) { 410 adjval += sunptr->un_adjval; 411 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 412 return (ERANGE); 413 } 414 sunptr->un_adjval = adjval; 415 if (sunptr->un_adjval == 0) { 416 suptr->un_cnt--; 417 if (i < suptr->un_cnt) 418 suptr->un_ent[i] = 419 suptr->un_ent[suptr->un_cnt]; 420 } 421 return(0); 422 } 423 424 /* Didn't find the right entry - create it */ 425 if (adjval == 0) 426 return(0); 427 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 428 return (ERANGE); 429 if (suptr->un_cnt != seminfo.semume) { 430 sunptr = &suptr->un_ent[suptr->un_cnt]; 431 suptr->un_cnt++; 432 sunptr->un_adjval = adjval; 433 sunptr->un_id = semid; sunptr->un_num = semnum; 434 } else 435 return(EINVAL); 436 return(0); 437} 438 439static void 440semundo_clear(semid, semnum) 441 int semid, semnum; 442{ 443 register struct sem_undo *suptr; 444 445 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 446 register struct undo *sunptr = &suptr->un_ent[0]; 447 register int i = 0; 448 449 while (i < suptr->un_cnt) { 450 if (sunptr->un_id == semid) { 451 if (semnum == -1 || sunptr->un_num == semnum) { 452 suptr->un_cnt--; 453 if (i < suptr->un_cnt) { 454 suptr->un_ent[i] = 455 suptr->un_ent[suptr->un_cnt]; 456 continue; 457 } 458 } 459 if (semnum != -1) 460 break; 461 } 462 i++, sunptr++; 463 } 464 } 465} 466 467/* 468 * Note that the user-mode half of this passes a union, not a pointer 469 */ 470#ifndef _SYS_SYSPROTO_H_ 471struct __semctl_args { 472 int semid; 473 int semnum; 474 int cmd; 475 union semun *arg; 476}; 477#endif 478 479/* 480 * MPSAFE 481 */ 482int 483__semctl(td, uap) 484 struct thread *td; 485 register struct __semctl_args *uap; 486{ 487 int semid = uap->semid; 488 int semnum = uap->semnum; 489 int cmd = uap->cmd; 490 union semun *arg = uap->arg; 491 union semun real_arg; 492 struct ucred *cred = td->td_proc->p_ucred; 493 int i, rval, error; 494 struct semid_ds sbuf; 495 register struct semid_ds *semaptr; 496 u_short usval; 497 498#ifdef SEM_DEBUG 499 printf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 500#endif 501 mtx_lock(&Giant); 502 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 503 error = ENOSYS; 504 goto done2; 505 } 506 507 switch(cmd) { 508 case SEM_STAT: 509 if (semid < 0 || semid >= seminfo.semmsl) 510 return(EINVAL); 511 semaptr = &sema[semid]; 512 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ) 513 return(EINVAL); 514 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 515 return(error); 516 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 517 return(error); 518 error = copyout((caddr_t)semaptr, real_arg.buf, 519 sizeof(struct semid_ds)); 520 rval = IXSEQ_TO_IPCID(semid,semaptr->sem_perm); 521 if (error == 0) 522 td->td_retval[0] = rval; 523 goto done2; 524 } 525 526 semid = IPCID_TO_IX(semid); 527 if (semid < 0 || semid >= seminfo.semmsl) { 528 error = EINVAL; 529 goto done2; 530 } 531 532 semaptr = &sema[semid]; 533 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 534 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 535 error = EINVAL; 536 goto done2; 537 } 538 539 error = 0; 540 rval = 0; 541 542 switch (cmd) { 543 case IPC_RMID: 544 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 545 goto done2; 546 semaptr->sem_perm.cuid = cred->cr_uid; 547 semaptr->sem_perm.uid = cred->cr_uid; 548 semtot -= semaptr->sem_nsems; 549 for (i = semaptr->sem_base - sem; i < semtot; i++) 550 sem[i] = sem[i + semaptr->sem_nsems]; 551 for (i = 0; i < seminfo.semmni; i++) { 552 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 553 sema[i].sem_base > semaptr->sem_base) 554 sema[i].sem_base -= semaptr->sem_nsems; 555 } 556 semaptr->sem_perm.mode = 0; 557 semundo_clear(semid, -1); 558 wakeup((caddr_t)semaptr); 559 break; 560 561 case IPC_SET: 562 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 563 goto done2; 564 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 565 goto done2; 566 if ((error = copyin(real_arg.buf, (caddr_t)&sbuf, 567 sizeof(sbuf))) != 0) { 568 goto done2; 569 } 570 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 571 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 572 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 573 (sbuf.sem_perm.mode & 0777); 574 semaptr->sem_ctime = time_second; 575 break; 576 577 case IPC_STAT: 578 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 579 goto done2; 580 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 581 goto done2; 582 error = copyout((caddr_t)semaptr, real_arg.buf, 583 sizeof(struct semid_ds)); 584 break; 585 586 case GETNCNT: 587 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 588 goto done2; 589 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 590 error = EINVAL; 591 goto done2; 592 } 593 rval = semaptr->sem_base[semnum].semncnt; 594 break; 595 596 case GETPID: 597 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 598 goto done2; 599 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 600 error = EINVAL; 601 goto done2; 602 } 603 rval = semaptr->sem_base[semnum].sempid; 604 break; 605 606 case GETVAL: 607 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 608 goto done2; 609 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 610 error = EINVAL; 611 goto done2; 612 } 613 rval = semaptr->sem_base[semnum].semval; 614 break; 615 616 case GETALL: 617 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 618 goto done2; 619 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 620 goto done2; 621 for (i = 0; i < semaptr->sem_nsems; i++) { 622 error = copyout((caddr_t)&semaptr->sem_base[i].semval, 623 &real_arg.array[i], sizeof(real_arg.array[0])); 624 if (error != 0) 625 break; 626 } 627 break; 628 629 case GETZCNT: 630 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 631 goto done2; 632 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 633 error = EINVAL; 634 goto done2; 635 } 636 rval = semaptr->sem_base[semnum].semzcnt; 637 break; 638 639 case SETVAL: 640 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 641 goto done2; 642 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 643 error = EINVAL; 644 goto done2; 645 } 646 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 647 goto done2; 648 if (real_arg.val < 0 || real_arg.val > seminfo.semvmx) { 649 error = ERANGE; 650 goto done2; 651 } 652 semaptr->sem_base[semnum].semval = real_arg.val; 653 semundo_clear(semid, semnum); 654 wakeup((caddr_t)semaptr); 655 break; 656 657 case SETALL: 658 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 659 goto done2; 660 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 661 goto done2; 662 for (i = 0; i < semaptr->sem_nsems; i++) { 663 error = copyin(&real_arg.array[i], 664 (caddr_t)&usval, sizeof(real_arg.array[0])); 665 if (error != 0) 666 break; 667 if (usval > seminfo.semvmx) { 668 error = ERANGE; 669 break; 670 } 671 semaptr->sem_base[i].semval = usval; 672 } 673 semundo_clear(semid, -1); 674 wakeup((caddr_t)semaptr); 675 break; 676 677 default: 678 error = EINVAL; 679 break; 680 } 681 682 if (error == 0) 683 td->td_retval[0] = rval; 684done2: 685 mtx_unlock(&Giant); 686 return(error); 687} 688 689#ifndef _SYS_SYSPROTO_H_ 690struct semget_args { 691 key_t key; 692 int nsems; 693 int semflg; 694}; 695#endif 696 697/* 698 * MPSAFE 699 */ 700int 701semget(td, uap) 702 struct thread *td; 703 register struct semget_args *uap; 704{ 705 int semid, error = 0; 706 int key = uap->key; 707 int nsems = uap->nsems; 708 int semflg = uap->semflg; 709 struct ucred *cred = td->td_proc->p_ucred; 710 711#ifdef SEM_DEBUG 712 printf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 713#endif 714 mtx_lock(&Giant); 715 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 716 error = ENOSYS; 717 goto done2; 718 } 719 720 if (key != IPC_PRIVATE) { 721 for (semid = 0; semid < seminfo.semmni; semid++) { 722 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 723 sema[semid].sem_perm.key == key) 724 break; 725 } 726 if (semid < seminfo.semmni) { 727#ifdef SEM_DEBUG 728 printf("found public key\n"); 729#endif 730 if ((error = ipcperm(td, &sema[semid].sem_perm, 731 semflg & 0700))) { 732 goto done2; 733 } 734 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 735#ifdef SEM_DEBUG 736 printf("too small\n"); 737#endif 738 error = EINVAL; 739 goto done2; 740 } 741 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 742#ifdef SEM_DEBUG 743 printf("not exclusive\n"); 744#endif 745 error = EEXIST; 746 goto done2; 747 } 748 goto found; 749 } 750 } 751 752#ifdef SEM_DEBUG 753 printf("need to allocate the semid_ds\n"); 754#endif 755 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 756 if (nsems <= 0 || nsems > seminfo.semmsl) { 757#ifdef SEM_DEBUG 758 printf("nsems out of range (0<%d<=%d)\n", nsems, 759 seminfo.semmsl); 760#endif 761 error = EINVAL; 762 goto done2; 763 } 764 if (nsems > seminfo.semmns - semtot) { 765#ifdef SEM_DEBUG 766 printf("not enough semaphores left (need %d, got %d)\n", 767 nsems, seminfo.semmns - semtot); 768#endif 769 error = ENOSPC; 770 goto done2; 771 } 772 for (semid = 0; semid < seminfo.semmni; semid++) { 773 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 774 break; 775 } 776 if (semid == seminfo.semmni) { 777#ifdef SEM_DEBUG 778 printf("no more semid_ds's available\n"); 779#endif 780 error = ENOSPC; 781 goto done2; 782 } 783#ifdef SEM_DEBUG 784 printf("semid %d is available\n", semid); 785#endif 786 sema[semid].sem_perm.key = key; 787 sema[semid].sem_perm.cuid = cred->cr_uid; 788 sema[semid].sem_perm.uid = cred->cr_uid; 789 sema[semid].sem_perm.cgid = cred->cr_gid; 790 sema[semid].sem_perm.gid = cred->cr_gid; 791 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 792 sema[semid].sem_perm.seq = 793 (sema[semid].sem_perm.seq + 1) & 0x7fff; 794 sema[semid].sem_nsems = nsems; 795 sema[semid].sem_otime = 0; 796 sema[semid].sem_ctime = time_second; 797 sema[semid].sem_base = &sem[semtot]; 798 semtot += nsems; 799 bzero(sema[semid].sem_base, 800 sizeof(sema[semid].sem_base[0])*nsems); 801#ifdef SEM_DEBUG 802 printf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 803 &sem[semtot]); 804#endif 805 } else { 806#ifdef SEM_DEBUG 807 printf("didn't find it and wasn't asked to create it\n"); 808#endif 809 error = ENOENT; 810 goto done2; 811 } 812 813found: 814 td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 815done2: 816 mtx_unlock(&Giant); 817 return (error); 818} 819 820#ifndef _SYS_SYSPROTO_H_ 821struct semop_args { 822 int semid; 823 struct sembuf *sops; 824 u_int nsops; 825}; 826#endif 827 828/* 829 * MPSAFE 830 */ 831int 832semop(td, uap) 833 struct thread *td; 834 register struct semop_args *uap; 835{ 836 int semid = uap->semid; 837 u_int nsops = uap->nsops; 838 struct sembuf *sops = NULL; 839 register struct semid_ds *semaptr; 840 register struct sembuf *sopptr; 841 register struct sem *semptr; 842 struct sem_undo *suptr; 843 int i, j, error; 844 int do_wakeup, do_undos; 845 846#ifdef SEM_DEBUG 847 printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 848#endif 849 850 mtx_lock(&Giant); 851 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 852 error = ENOSYS; 853 goto done2; 854 } 855 856 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 857 858 if (semid < 0 || semid >= seminfo.semmsl) { 859 error = EINVAL; 860 goto done2; 861 } 862 863 semaptr = &sema[semid]; 864 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 865 error = EINVAL; 866 goto done2; 867 } 868 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 869 error = EINVAL; 870 goto done2; 871 } 872 if (nsops > seminfo.semopm) { 873#ifdef SEM_DEBUG 874 printf("too many sops (max=%d, nsops=%d)\n", seminfo.semopm, 875 nsops); 876#endif 877 error = E2BIG; 878 goto done2; 879 } 880 881 /* Allocate memory for sem_ops */ 882 sops = malloc(nsops * sizeof(sops[0]), M_SEM, M_WAITOK); 883 if (!sops) 884 panic("Failed to allocate %d sem_ops", nsops); 885 886 if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) { 887#ifdef SEM_DEBUG 888 printf("error = %d from copyin(%08x, %08x, %d)\n", error, 889 uap->sops, sops, nsops * sizeof(sops[0])); 890#endif 891 goto done2; 892 } 893 894 /* 895 * Initial pass thru sops to see what permissions are needed. 896 * Also perform any checks that don't need repeating on each 897 * attempt to satisfy the request vector. 898 */ 899 j = 0; /* permission needed */ 900 do_undos = 0; 901 for (i = 0; i < nsops; i++) { 902 sopptr = &sops[i]; 903 if (sopptr->sem_num >= semaptr->sem_nsems) { 904 error = EFBIG; 905 goto done2; 906 } 907 if (sopptr->sem_flg & SEM_UNDO && sopptr->sem_op != 0) 908 do_undos = 1; 909 j |= (sopptr->sem_op == 0) ? SEM_R : SEM_A; 910 } 911 912 if ((error = ipcperm(td, &semaptr->sem_perm, j))) { 913#ifdef SEM_DEBUG 914 printf("error = %d from ipaccess\n", error); 915#endif 916 goto done2; 917 } 918 919 /* 920 * Loop trying to satisfy the vector of requests. 921 * If we reach a point where we must wait, any requests already 922 * performed are rolled back and we go to sleep until some other 923 * process wakes us up. At this point, we start all over again. 924 * 925 * This ensures that from the perspective of other tasks, a set 926 * of requests is atomic (never partially satisfied). 927 */ 928 for (;;) { 929 do_wakeup = 0; 930 error = 0; /* error return if necessary */ 931 932 for (i = 0; i < nsops; i++) { 933 sopptr = &sops[i]; 934 semptr = &semaptr->sem_base[sopptr->sem_num]; 935 936#ifdef SEM_DEBUG 937 printf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 938 semaptr, semaptr->sem_base, semptr, 939 sopptr->sem_num, semptr->semval, sopptr->sem_op, 940 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 941#endif 942 943 if (sopptr->sem_op < 0) { 944 if (semptr->semval + sopptr->sem_op < 0) { 945#ifdef SEM_DEBUG 946 printf("semop: can't do it now\n"); 947#endif 948 break; 949 } else { 950 semptr->semval += sopptr->sem_op; 951 if (semptr->semval == 0 && 952 semptr->semzcnt > 0) 953 do_wakeup = 1; 954 } 955 } else if (sopptr->sem_op == 0) { 956 if (semptr->semval != 0) { 957#ifdef SEM_DEBUG 958 printf("semop: not zero now\n"); 959#endif 960 break; 961 } 962 } else if (semptr->semval + sopptr->sem_op > 963 seminfo.semvmx) { 964 error = ERANGE; 965 break; 966 } else { 967 if (semptr->semncnt > 0) 968 do_wakeup = 1; 969 semptr->semval += sopptr->sem_op; 970 } 971 } 972 973 /* 974 * Did we get through the entire vector? 975 */ 976 if (i >= nsops) 977 goto done; 978 979 /* 980 * No ... rollback anything that we've already done 981 */ 982#ifdef SEM_DEBUG 983 printf("semop: rollback 0 through %d\n", i-1); 984#endif 985 for (j = 0; j < i; j++) 986 semaptr->sem_base[sops[j].sem_num].semval -= 987 sops[j].sem_op; 988 989 /* If we detected an error, return it */ 990 if (error != 0) 991 goto done2; 992 993 /* 994 * If the request that we couldn't satisfy has the 995 * NOWAIT flag set then return with EAGAIN. 996 */ 997 if (sopptr->sem_flg & IPC_NOWAIT) { 998 error = EAGAIN; 999 goto done2; 1000 } 1001 1002 if (sopptr->sem_op == 0) 1003 semptr->semzcnt++; 1004 else 1005 semptr->semncnt++; 1006 1007#ifdef SEM_DEBUG 1008 printf("semop: good night!\n"); 1009#endif 1010 error = tsleep((caddr_t)semaptr, (PZERO - 4) | PCATCH, 1011 "semwait", 0); 1012#ifdef SEM_DEBUG 1013 printf("semop: good morning (error=%d)!\n", error); 1014#endif 1015 1016 if (error != 0) { 1017 error = EINTR; 1018 goto done2; 1019 } 1020#ifdef SEM_DEBUG 1021 printf("semop: good morning!\n"); 1022#endif 1023 1024 /* 1025 * Make sure that the semaphore still exists 1026 */ 1027 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 1028 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 1029 error = EIDRM; 1030 goto done2; 1031 } 1032 1033 /* 1034 * The semaphore is still alive. Readjust the count of 1035 * waiting processes. 1036 */ 1037 if (sopptr->sem_op == 0) 1038 semptr->semzcnt--; 1039 else 1040 semptr->semncnt--; 1041 } 1042 1043done: 1044 /* 1045 * Process any SEM_UNDO requests. 1046 */ 1047 if (do_undos) { 1048 suptr = NULL; 1049 for (i = 0; i < nsops; i++) { 1050 /* 1051 * We only need to deal with SEM_UNDO's for non-zero 1052 * op's. 1053 */ 1054 int adjval; 1055 1056 if ((sops[i].sem_flg & SEM_UNDO) == 0) 1057 continue; 1058 adjval = sops[i].sem_op; 1059 if (adjval == 0) 1060 continue; 1061 error = semundo_adjust(td, &suptr, semid, 1062 sops[i].sem_num, -adjval); 1063 if (error == 0) 1064 continue; 1065 1066 /* 1067 * Oh-Oh! We ran out of either sem_undo's or undo's. 1068 * Rollback the adjustments to this point and then 1069 * rollback the semaphore ups and down so we can return 1070 * with an error with all structures restored. We 1071 * rollback the undo's in the exact reverse order that 1072 * we applied them. This guarantees that we won't run 1073 * out of space as we roll things back out. 1074 */ 1075 for (j = i - 1; j >= 0; j--) { 1076 if ((sops[j].sem_flg & SEM_UNDO) == 0) 1077 continue; 1078 adjval = sops[j].sem_op; 1079 if (adjval == 0) 1080 continue; 1081 if (semundo_adjust(td, &suptr, semid, 1082 sops[j].sem_num, adjval) != 0) 1083 panic("semop - can't undo undos"); 1084 } 1085 1086 for (j = 0; j < nsops; j++) 1087 semaptr->sem_base[sops[j].sem_num].semval -= 1088 sops[j].sem_op; 1089 1090#ifdef SEM_DEBUG 1091 printf("error = %d from semundo_adjust\n", error); 1092#endif 1093 goto done2; 1094 } /* loop through the sops */ 1095 } /* if (do_undos) */ 1096 1097 /* We're definitely done - set the sempid's and time */ 1098 for (i = 0; i < nsops; i++) { 1099 sopptr = &sops[i]; 1100 semptr = &semaptr->sem_base[sopptr->sem_num]; 1101 semptr->sempid = td->td_proc->p_pid; 1102 } 1103 semaptr->sem_otime = time_second; 1104 1105 /* 1106 * Do a wakeup if any semaphore was up'd whilst something was 1107 * sleeping on it. 1108 */ 1109 if (do_wakeup) { 1110#ifdef SEM_DEBUG 1111 printf("semop: doing wakeup\n"); 1112#endif 1113 wakeup((caddr_t)semaptr); 1114#ifdef SEM_DEBUG 1115 printf("semop: back from wakeup\n"); 1116#endif 1117 } 1118#ifdef SEM_DEBUG 1119 printf("semop: done\n"); 1120#endif 1121 td->td_retval[0] = 0; 1122done2: 1123 if (sops) 1124 free(sops, M_SEM); 1125 mtx_unlock(&Giant); 1126 return (error); 1127} 1128 1129/* 1130 * Go through the undo structures for this process and apply the adjustments to 1131 * semaphores. 1132 */ 1133static void 1134semexit_myhook(p) 1135 struct proc *p; 1136{ 1137 register struct sem_undo *suptr; 1138 register struct sem_undo **supptr; 1139 1140 /* 1141 * Go through the chain of undo vectors looking for one 1142 * associated with this process. 1143 */ 1144 1145 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1146 supptr = &suptr->un_next) { 1147 if (suptr->un_proc == p) 1148 break; 1149 } 1150 1151 if (suptr == NULL) 1152 return; 1153 1154#ifdef SEM_DEBUG 1155 printf("proc @%08x has undo structure with %d entries\n", p, 1156 suptr->un_cnt); 1157#endif 1158 1159 /* 1160 * If there are any active undo elements then process them. 1161 */ 1162 if (suptr->un_cnt > 0) { 1163 int ix; 1164 1165 for (ix = 0; ix < suptr->un_cnt; ix++) { 1166 int semid = suptr->un_ent[ix].un_id; 1167 int semnum = suptr->un_ent[ix].un_num; 1168 int adjval = suptr->un_ent[ix].un_adjval; 1169 struct semid_ds *semaptr; 1170 1171 semaptr = &sema[semid]; 1172 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1173 panic("semexit - semid not allocated"); 1174 if (semnum >= semaptr->sem_nsems) 1175 panic("semexit - semnum out of range"); 1176 1177#ifdef SEM_DEBUG 1178 printf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1179 suptr->un_proc, suptr->un_ent[ix].un_id, 1180 suptr->un_ent[ix].un_num, 1181 suptr->un_ent[ix].un_adjval, 1182 semaptr->sem_base[semnum].semval); 1183#endif 1184 1185 if (adjval < 0) { 1186 if (semaptr->sem_base[semnum].semval < -adjval) 1187 semaptr->sem_base[semnum].semval = 0; 1188 else 1189 semaptr->sem_base[semnum].semval += 1190 adjval; 1191 } else 1192 semaptr->sem_base[semnum].semval += adjval; 1193 1194 wakeup((caddr_t)semaptr); 1195#ifdef SEM_DEBUG 1196 printf("semexit: back from wakeup\n"); 1197#endif 1198 } 1199 } 1200 1201 /* 1202 * Deallocate the undo vector. 1203 */ 1204#ifdef SEM_DEBUG 1205 printf("removing vector\n"); 1206#endif 1207 suptr->un_proc = NULL; 1208 *supptr = suptr->un_next; 1209} 1210 1211static int 1212sysctl_sema(SYSCTL_HANDLER_ARGS) 1213{ 1214 1215 return (SYSCTL_OUT(req, sema, 1216 sizeof(struct semid_ds) * seminfo.semmni)); 1217} 1218