1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/sem.h> 19 #include <sys/sysent.h> 20 #include <sys/sysctl.h> 21 #include <sys/malloc.h> 22 #include <sys/jail.h> 23 #include <sys/thread.h> 24 25 #include <sys/thread2.h> 26 27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29 static void seminit (void *); 30 31 static struct sem_undo *semu_alloc (struct proc *p); 32 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 33 int semid, int semnum, int adjval); 34 static void semundo_clear (int semid, int semnum); 35 36 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 37 static sy_call_t *semcalls[] = { 38 (sy_call_t *)sys___semctl, (sy_call_t *)sys_semget, 39 (sy_call_t *)sys_semop 40 }; 41 42 static struct lwkt_token semu_token = LWKT_TOKEN_INITIALIZER(semu_token); 43 static int semtot = 0; 44 static struct semid_ds *sema; /* semaphore id pool */ 45 static struct sem *sem; /* semaphore pool */ 46 static struct sem_undo *semu_list; /* list of active undo structures */ 47 static int *semu; /* undo structure pool */ 48 49 struct sem { 50 u_short semval; /* semaphore value */ 51 pid_t sempid; /* pid of last operation */ 52 u_short semncnt; /* # awaiting semval > cval */ 53 u_short semzcnt; /* # awaiting semval = 0 */ 54 }; 55 56 /* 57 * Undo structure (one per process) 58 */ 59 struct sem_undo { 60 struct sem_undo *un_next; /* ptr to next active undo structure */ 61 struct proc *un_proc; /* owner of this structure */ 62 short un_cnt; /* # of active entries */ 63 struct undo { 64 short un_adjval; /* adjust on exit values */ 65 short un_num; /* semaphore # */ 66 int un_id; /* semid */ 67 } un_ent[1]; /* undo entries */ 68 }; 69 70 /* 71 * Configuration parameters 72 */ 73 #ifndef SEMMNI 74 #define SEMMNI 22 /* # of semaphore identifiers */ 75 #endif 76 #ifndef SEMMNS 77 #define SEMMNS 341 /* # of semaphores in system */ 78 #endif 79 #ifndef SEMUME 80 #define SEMUME 10 /* max # of undo entries per process */ 81 #endif 82 #ifndef SEMMNU 83 #define SEMMNU 30 /* # of undo structures in system */ 84 #endif 85 86 /* shouldn't need tuning */ 87 #ifndef SEMMAP 88 #define SEMMAP 30 /* # of entries in semaphore map */ 89 #endif 90 #ifndef SEMMSL 91 #define SEMMSL SEMMNS /* max # of semaphores per id */ 92 #endif 93 #ifndef SEMOPM 94 #define SEMOPM 100 /* max # of operations per semop call */ 95 #endif 96 97 #define SEMVMX 32767 /* semaphore maximum value */ 98 #define SEMAEM 16384 /* adjust on exit max value */ 99 100 /* 101 * Due to the way semaphore memory is allocated, we have to ensure that 102 * SEMUSZ is properly aligned. 103 */ 104 105 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 106 107 /* actual size of an undo structure */ 108 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 109 110 /* 111 * Macro to find a particular sem_undo vector 112 */ 113 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu) + (ix) * \ 114 seminfo.semusz)) 115 116 /* 117 * semaphore info struct 118 */ 119 struct seminfo seminfo = { 120 SEMMAP, /* # of entries in semaphore map */ 121 SEMMNI, /* # of semaphore identifiers */ 122 SEMMNS, /* # of semaphores in system */ 123 SEMMNU, /* # of undo structures in system */ 124 SEMMSL, /* max # of semaphores per id */ 125 SEMOPM, /* max # of operations per semop call */ 126 SEMUME, /* max # of undo entries per process */ 127 SEMUSZ, /* size in bytes of undo structure */ 128 SEMVMX, /* semaphore maximum value */ 129 SEMAEM /* adjust on exit max value */ 130 }; 131 132 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 133 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 134 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 135 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 136 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 137 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 138 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 139 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 140 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 141 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 142 143 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, 144 "Number of entries in semaphore map"); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, 146 "Number of semaphore identifiers"); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, 148 "Total number of semaphores"); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, 150 "Total number of undo structures"); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, 152 "Max number of semaphores per id"); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, 154 "Max number of operations per semop call"); 155 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, 156 "Max number of undo entries per process"); 157 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, 158 "Size in bytes of undo structure"); 159 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, 160 "Semaphore maximum value"); 161 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, 162 "Adjust on exit max value"); 163 164 #if 0 165 RO seminfo.semmap /* SEMMAP unused */ 166 RO seminfo.semmni 167 RO seminfo.semmns 168 RO seminfo.semmnu /* undo entries per system */ 169 RW seminfo.semmsl 170 RO seminfo.semopm /* SEMOPM unused */ 171 RO seminfo.semume 172 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 173 RO seminfo.semvmx /* SEMVMX unused - user param */ 174 RO seminfo.semaem /* SEMAEM unused - user param */ 175 #endif 176 177 static void 178 seminit(void *dummy) 179 { 180 int i; 181 182 sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 183 sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 184 semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 185 186 for (i = 0; i < seminfo.semmni; i++) { 187 sema[i].sem_base = 0; 188 sema[i].sem_perm.mode = 0; 189 } 190 for (i = 0; i < seminfo.semmnu; i++) { 191 struct sem_undo *suptr = SEMU(i); 192 suptr->un_proc = NULL; 193 } 194 semu_list = NULL; 195 } 196 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 197 198 /* 199 * Entry point for all SEM calls 200 * 201 * semsys_args(int which, a2, a3, ...) (VARARGS) 202 * 203 * MPALMOSTSAFE 204 */ 205 int 206 sys_semsys(struct semsys_args *uap) 207 { 208 struct thread *td = curthread; 209 unsigned int which = (unsigned int)uap->which; 210 int error; 211 212 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 213 return (ENOSYS); 214 215 if (which >= NELEM(semcalls)) 216 return (EINVAL); 217 bcopy(&uap->a2, &uap->which, 218 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 219 error = (*semcalls[which])(uap); 220 return (error); 221 } 222 223 /* 224 * Allocate a new sem_undo structure for a process 225 * (returns ptr to structure or NULL if no more room) 226 * 227 * semu_token is held by the caller. 228 */ 229 static struct sem_undo * 230 semu_alloc(struct proc *p) 231 { 232 int i; 233 struct sem_undo *suptr; 234 struct sem_undo **supptr; 235 int attempt; 236 237 /* 238 * Try twice to allocate something. 239 * (we'll purge any empty structures after the first pass so 240 * two passes are always enough) 241 */ 242 for (attempt = 0; attempt < 2; attempt++) { 243 /* 244 * Look for a free structure. 245 * Fill it in and return it if we find one. 246 */ 247 for (i = 0; i < seminfo.semmnu; i++) { 248 suptr = SEMU(i); 249 if (suptr->un_proc == NULL) { 250 suptr->un_next = semu_list; 251 semu_list = suptr; 252 suptr->un_cnt = 0; 253 suptr->un_proc = p; 254 goto done; 255 } 256 } 257 258 /* 259 * We didn't find a free one, if this is the first attempt 260 * then try to free some structures. 261 */ 262 263 if (attempt == 0) { 264 /* All the structures are in use - try to free some */ 265 int did_something = 0; 266 267 supptr = &semu_list; 268 while ((suptr = *supptr) != NULL) { 269 if (suptr->un_cnt == 0) { 270 suptr->un_proc = NULL; 271 *supptr = suptr->un_next; 272 did_something = 1; 273 } else { 274 supptr = &(suptr->un_next); 275 } 276 } 277 278 /* If we didn't free anything then just give-up */ 279 if (!did_something) { 280 suptr = NULL; 281 goto done; 282 } 283 } else { 284 /* 285 * The second pass failed even though we freed 286 * something after the first pass! 287 * This is IMPOSSIBLE! 288 */ 289 panic("semu_alloc - second attempt failed"); 290 } 291 } 292 suptr = NULL; 293 done: 294 return (suptr); 295 } 296 297 /* 298 * Adjust a particular entry for a particular proc 299 */ 300 301 static int 302 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum, 303 int adjval) 304 { 305 struct sem_undo *suptr; 306 struct undo *sunptr; 307 int i; 308 int error = 0; 309 310 /* 311 * Look for and remember the sem_undo if the caller doesn't 312 * provide it. 313 */ 314 lwkt_gettoken(&semu_token); 315 lwkt_gettoken(&p->p_token); 316 suptr = *supptr; 317 if (suptr == NULL) { 318 for (suptr = semu_list; suptr != NULL; 319 suptr = suptr->un_next) { 320 if (suptr->un_proc == p) { 321 *supptr = suptr; 322 break; 323 } 324 } 325 if (suptr == NULL) { 326 if (adjval == 0) 327 goto done; 328 p->p_flags |= P_SYSVSEM; 329 suptr = semu_alloc(p); 330 if (suptr == NULL) { 331 error = ENOSPC; 332 goto done; 333 } 334 *supptr = suptr; 335 } 336 } 337 338 /* 339 * Look for the requested entry and adjust it (delete if adjval becomes 340 * 0). 341 */ 342 sunptr = &suptr->un_ent[0]; 343 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 344 if (sunptr->un_id != semid || sunptr->un_num != semnum) 345 continue; 346 if (adjval == 0) 347 sunptr->un_adjval = 0; 348 else 349 sunptr->un_adjval += adjval; 350 if (sunptr->un_adjval == 0) { 351 suptr->un_cnt--; 352 if (i < suptr->un_cnt) 353 suptr->un_ent[i] = 354 suptr->un_ent[suptr->un_cnt]; 355 } 356 goto done; 357 } 358 359 /* Didn't find the right entry - create it */ 360 if (adjval == 0) 361 goto done; 362 if (suptr->un_cnt != seminfo.semume) { 363 sunptr = &suptr->un_ent[suptr->un_cnt]; 364 suptr->un_cnt++; 365 sunptr->un_adjval = adjval; 366 sunptr->un_id = semid; sunptr->un_num = semnum; 367 } else { 368 error = EINVAL; 369 } 370 done: 371 lwkt_reltoken(&p->p_token); 372 lwkt_reltoken(&semu_token); 373 return (error); 374 } 375 376 static void 377 semundo_clear(int semid, int semnum) 378 { 379 struct sem_undo *suptr; 380 381 lwkt_gettoken(&semu_token); 382 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 383 struct undo *sunptr = &suptr->un_ent[0]; 384 int i = 0; 385 386 while (i < suptr->un_cnt) { 387 if (sunptr->un_id == semid) { 388 if (semnum == -1 || sunptr->un_num == semnum) { 389 suptr->un_cnt--; 390 if (i < suptr->un_cnt) { 391 suptr->un_ent[i] = 392 suptr->un_ent[suptr->un_cnt]; 393 continue; 394 } 395 } 396 if (semnum != -1) 397 break; 398 } 399 i++, sunptr++; 400 } 401 } 402 lwkt_reltoken(&semu_token); 403 } 404 405 /* 406 * Note that the user-mode half of this passes a union, not a pointer 407 * 408 * MPALMOSTSAFE 409 */ 410 int 411 sys___semctl(struct __semctl_args *uap) 412 { 413 struct thread *td = curthread; 414 int semid = uap->semid; 415 int semnum = uap->semnum; 416 int cmd = uap->cmd; 417 union semun *arg = uap->arg; 418 union semun real_arg; 419 struct ucred *cred = td->td_ucred; 420 int i, rval, eval; 421 struct semid_ds sbuf; 422 struct semid_ds *semaptr; 423 struct semid_ds *semakptr; 424 425 #ifdef SEM_DEBUG 426 kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 427 #endif 428 429 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 430 return (ENOSYS); 431 432 switch (cmd) { 433 case SEM_STAT: 434 /* 435 * For this command we assume semid is an array index 436 * rather than an IPC id. 437 */ 438 if (semid < 0 || semid >= seminfo.semmni) { 439 eval = EINVAL; 440 break; 441 } 442 semakptr = &sema[semid]; 443 lwkt_getpooltoken(semakptr); 444 if ((semakptr->sem_perm.mode & SEM_ALLOC) == 0) { 445 eval = EINVAL; 446 lwkt_relpooltoken(semakptr); 447 break; 448 } 449 if ((eval = ipcperm(td->td_proc, &semakptr->sem_perm, IPC_R))) { 450 lwkt_relpooltoken(semakptr); 451 break; 452 } 453 bcopy(&semakptr, arg->buf, sizeof(struct semid_ds)); 454 rval = IXSEQ_TO_IPCID(semid, semakptr->sem_perm); 455 lwkt_relpooltoken(semakptr); 456 break; 457 } 458 459 semid = IPCID_TO_IX(semid); 460 if (semid < 0 || semid >= seminfo.semmni) { 461 return(EINVAL); 462 } 463 semaptr = &sema[semid]; 464 lwkt_getpooltoken(semaptr); 465 466 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 467 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 468 lwkt_relpooltoken(semaptr); 469 return(EINVAL); 470 } 471 472 eval = 0; 473 rval = 0; 474 475 switch (cmd) { 476 case IPC_RMID: 477 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M)) != 0) 478 break; 479 semaptr->sem_perm.cuid = cred->cr_uid; 480 semaptr->sem_perm.uid = cred->cr_uid; 481 semtot -= semaptr->sem_nsems; 482 for (i = semaptr->sem_base - sem; i < semtot; i++) 483 sem[i] = sem[i + semaptr->sem_nsems]; 484 for (i = 0; i < seminfo.semmni; i++) { 485 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 486 sema[i].sem_base > semaptr->sem_base) 487 sema[i].sem_base -= semaptr->sem_nsems; 488 } 489 semaptr->sem_perm.mode = 0; 490 semundo_clear(semid, -1); 491 wakeup((caddr_t)semaptr); 492 break; 493 494 case IPC_SET: 495 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M); 496 if (eval) 497 break; 498 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 499 break; 500 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 501 sizeof(sbuf))) != 0) { 502 break; 503 } 504 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 505 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 506 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 507 (sbuf.sem_perm.mode & 0777); 508 semaptr->sem_ctime = time_second; 509 break; 510 511 case IPC_STAT: 512 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R))) 513 break; 514 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 515 break; 516 eval = copyout(semaptr, real_arg.buf, sizeof(struct semid_ds)); 517 break; 518 519 case GETNCNT: 520 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 521 if (eval) 522 break; 523 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 524 eval = EINVAL; 525 break; 526 } 527 rval = semaptr->sem_base[semnum].semncnt; 528 break; 529 530 case GETPID: 531 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 532 if (eval) 533 break; 534 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 535 eval = EINVAL; 536 break; 537 } 538 rval = semaptr->sem_base[semnum].sempid; 539 break; 540 541 case GETVAL: 542 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 543 if (eval) 544 break; 545 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 546 eval = EINVAL; 547 break; 548 } 549 rval = semaptr->sem_base[semnum].semval; 550 break; 551 552 case GETALL: 553 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 554 if (eval) 555 break; 556 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 557 break; 558 for (i = 0; i < semaptr->sem_nsems; i++) { 559 eval = copyout(&semaptr->sem_base[i].semval, 560 &real_arg.array[i], 561 sizeof(real_arg.array[0])); 562 if (eval) 563 break; 564 } 565 break; 566 567 case GETZCNT: 568 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 569 if (eval) 570 break; 571 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 572 eval = EINVAL; 573 break; 574 } 575 rval = semaptr->sem_base[semnum].semzcnt; 576 break; 577 578 case SETVAL: 579 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 580 if (eval) 581 break; 582 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 583 eval = EINVAL; 584 break; 585 } 586 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 587 break; 588 semaptr->sem_base[semnum].semval = real_arg.val; 589 semundo_clear(semid, semnum); 590 wakeup((caddr_t)semaptr); 591 break; 592 593 case SETALL: 594 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 595 if (eval) 596 break; 597 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 598 break; 599 for (i = 0; i < semaptr->sem_nsems; i++) { 600 eval = copyin(&real_arg.array[i], 601 (caddr_t)&semaptr->sem_base[i].semval, 602 sizeof(real_arg.array[0])); 603 if (eval != 0) 604 break; 605 } 606 semundo_clear(semid, -1); 607 wakeup((caddr_t)semaptr); 608 break; 609 610 default: 611 eval = EINVAL; 612 break; 613 } 614 lwkt_relpooltoken(semaptr); 615 616 if (eval == 0) 617 uap->sysmsg_result = rval; 618 return(eval); 619 } 620 621 /* 622 * MPALMOSTSAFE 623 */ 624 int 625 sys_semget(struct semget_args *uap) 626 { 627 struct thread *td = curthread; 628 int semid, eval; 629 int key = uap->key; 630 int nsems = uap->nsems; 631 int semflg = uap->semflg; 632 struct ucred *cred = td->td_ucred; 633 634 #ifdef SEM_DEBUG 635 kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 636 #endif 637 638 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 639 return (ENOSYS); 640 641 eval = 0; 642 643 if (key != IPC_PRIVATE) { 644 for (semid = 0; semid < seminfo.semmni; semid++) { 645 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0 || 646 sema[semid].sem_perm.key != key) { 647 continue; 648 } 649 lwkt_getpooltoken(&sema[semid]); 650 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0 || 651 sema[semid].sem_perm.key != key) { 652 lwkt_relpooltoken(&sema[semid]); 653 continue; 654 } 655 break; 656 } 657 if (semid < seminfo.semmni) { 658 #ifdef SEM_DEBUG 659 kprintf("found public key\n"); 660 #endif 661 if ((eval = ipcperm(td->td_proc, 662 &sema[semid].sem_perm, 663 semflg & 0700))) { 664 lwkt_relpooltoken(&sema[semid]); 665 goto done; 666 } 667 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 668 #ifdef SEM_DEBUG 669 kprintf("too small\n"); 670 #endif 671 eval = EINVAL; 672 lwkt_relpooltoken(&sema[semid]); 673 goto done; 674 } 675 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 676 #ifdef SEM_DEBUG 677 kprintf("not exclusive\n"); 678 #endif 679 eval = EEXIST; 680 lwkt_relpooltoken(&sema[semid]); 681 goto done; 682 } 683 goto done; 684 } 685 } 686 687 #ifdef SEM_DEBUG 688 kprintf("need to allocate the semid_ds\n"); 689 #endif 690 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 691 if (nsems <= 0 || nsems > seminfo.semmsl) { 692 #ifdef SEM_DEBUG 693 kprintf("nsems out of range (0<%d<=%d)\n", 694 nsems, seminfo.semmsl); 695 #endif 696 eval = EINVAL; 697 goto done; 698 } 699 if (nsems > seminfo.semmns - semtot) { 700 #ifdef SEM_DEBUG 701 kprintf("not enough semaphores left " 702 "(need %d, got %d)\n", 703 nsems, seminfo.semmns - semtot); 704 #endif 705 eval = ENOSPC; 706 goto done; 707 } 708 for (semid = 0; semid < seminfo.semmni; semid++) { 709 if (sema[semid].sem_perm.mode & SEM_ALLOC) 710 continue; 711 lwkt_getpooltoken(&sema[semid]); 712 if (sema[semid].sem_perm.mode & SEM_ALLOC) { 713 lwkt_relpooltoken(&sema[semid]); 714 continue; 715 } 716 break; 717 } 718 if (semid == seminfo.semmni) { 719 #ifdef SEM_DEBUG 720 kprintf("no more semid_ds's available\n"); 721 #endif 722 eval = ENOSPC; 723 goto done; 724 } 725 #ifdef SEM_DEBUG 726 kprintf("semid %d is available\n", semid); 727 #endif 728 sema[semid].sem_perm.key = key; 729 sema[semid].sem_perm.cuid = cred->cr_uid; 730 sema[semid].sem_perm.uid = cred->cr_uid; 731 sema[semid].sem_perm.cgid = cred->cr_gid; 732 sema[semid].sem_perm.gid = cred->cr_gid; 733 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 734 sema[semid].sem_perm.seq = 735 (sema[semid].sem_perm.seq + 1) & 0x7fff; 736 sema[semid].sem_nsems = nsems; 737 sema[semid].sem_otime = 0; 738 sema[semid].sem_ctime = time_second; 739 sema[semid].sem_base = &sem[semtot]; 740 semtot += nsems; 741 bzero(sema[semid].sem_base, 742 sizeof(sema[semid].sem_base[0])*nsems); 743 #ifdef SEM_DEBUG 744 kprintf("sembase = 0x%x, next = 0x%x\n", 745 sema[semid].sem_base, &sem[semtot]); 746 #endif 747 /* eval == 0 */ 748 } else { 749 #ifdef SEM_DEBUG 750 kprintf("didn't find it and wasn't asked to create it\n"); 751 #endif 752 eval = ENOENT; 753 } 754 755 done: 756 if (eval == 0) { 757 uap->sysmsg_result = 758 IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 759 lwkt_relpooltoken(&sema[semid]); 760 } 761 return(eval); 762 } 763 764 /* 765 * MPALMOSTSAFE 766 */ 767 int 768 sys_semop(struct semop_args *uap) 769 { 770 struct thread *td = curthread; 771 int semid = uap->semid; 772 u_int nsops = uap->nsops; 773 struct sembuf sops[MAX_SOPS]; 774 struct semid_ds *semaptr; 775 struct sembuf *sopptr; 776 struct sem *semptr; 777 struct sem_undo *suptr = NULL; 778 int i, j, eval; 779 int do_wakeup, do_undos; 780 781 #ifdef SEM_DEBUG 782 kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 783 #endif 784 785 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 786 return (ENOSYS); 787 788 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 789 790 if (semid < 0 || semid >= seminfo.semmni) { 791 eval = EINVAL; 792 goto done2; 793 } 794 semaptr = &sema[semid]; 795 lwkt_getpooltoken(semaptr); 796 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 797 eval = EINVAL; 798 goto done; 799 } 800 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 801 eval = EINVAL; 802 goto done; 803 } 804 805 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W))) { 806 #ifdef SEM_DEBUG 807 kprintf("eval = %d from ipaccess\n", eval); 808 #endif 809 goto done; 810 } 811 812 if (nsops > MAX_SOPS) { 813 #ifdef SEM_DEBUG 814 kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 815 #endif 816 eval = E2BIG; 817 goto done; 818 } 819 820 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 821 #ifdef SEM_DEBUG 822 kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 823 uap->sops, &sops, nsops * sizeof(sops[0])); 824 #endif 825 goto done; 826 } 827 828 /* 829 * Loop trying to satisfy the vector of requests. 830 * If we reach a point where we must wait, any requests already 831 * performed are rolled back and we go to sleep until some other 832 * process wakes us up. At this point, we start all over again. 833 * 834 * This ensures that from the perspective of other tasks, a set 835 * of requests is atomic (never partially satisfied). 836 */ 837 do_undos = 0; 838 839 for (;;) { 840 do_wakeup = 0; 841 842 for (i = 0; i < nsops; i++) { 843 sopptr = &sops[i]; 844 845 if (sopptr->sem_num >= semaptr->sem_nsems) { 846 eval = EFBIG; 847 goto done; 848 } 849 850 semptr = &semaptr->sem_base[sopptr->sem_num]; 851 852 #ifdef SEM_DEBUG 853 kprintf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 854 semaptr, semaptr->sem_base, semptr, 855 sopptr->sem_num, semptr->semval, sopptr->sem_op, 856 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 857 #endif 858 859 if (sopptr->sem_op < 0) { 860 if (semptr->semval + sopptr->sem_op < 0) { 861 #ifdef SEM_DEBUG 862 kprintf("semop: can't do it now\n"); 863 #endif 864 break; 865 } else { 866 semptr->semval += sopptr->sem_op; 867 if (semptr->semval == 0 && 868 semptr->semzcnt > 0) 869 do_wakeup = 1; 870 } 871 if (sopptr->sem_flg & SEM_UNDO) 872 do_undos = 1; 873 } else if (sopptr->sem_op == 0) { 874 if (semptr->semval > 0) { 875 #ifdef SEM_DEBUG 876 kprintf("semop: not zero now\n"); 877 #endif 878 break; 879 } 880 } else { 881 if (semptr->semncnt > 0) 882 do_wakeup = 1; 883 semptr->semval += sopptr->sem_op; 884 if (sopptr->sem_flg & SEM_UNDO) 885 do_undos = 1; 886 } 887 } 888 889 /* 890 * Did we get through the entire vector? 891 */ 892 if (i >= nsops) 893 goto donex; 894 895 /* 896 * No ... rollback anything that we've already done 897 */ 898 #ifdef SEM_DEBUG 899 kprintf("semop: rollback 0 through %d\n", i-1); 900 #endif 901 for (j = 0; j < i; j++) 902 semaptr->sem_base[sops[j].sem_num].semval -= 903 sops[j].sem_op; 904 905 /* 906 * If the request that we couldn't satisfy has the 907 * NOWAIT flag set then return with EAGAIN. 908 */ 909 if (sopptr->sem_flg & IPC_NOWAIT) { 910 eval = EAGAIN; 911 goto done; 912 } 913 914 if (sopptr->sem_op == 0) 915 semptr->semzcnt++; 916 else 917 semptr->semncnt++; 918 919 #ifdef SEM_DEBUG 920 kprintf("semop: good night!\n"); 921 #endif 922 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 923 #ifdef SEM_DEBUG 924 kprintf("semop: good morning (eval=%d)!\n", eval); 925 #endif 926 927 suptr = NULL; /* sem_undo may have been reallocated */ 928 929 /* return code is checked below, after sem[nz]cnt-- */ 930 931 /* 932 * Make sure that the semaphore still exists 933 */ 934 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 935 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 936 eval = EIDRM; 937 goto done; 938 } 939 940 /* 941 * The semaphore is still alive. Readjust the count of 942 * waiting processes. 943 */ 944 if (sopptr->sem_op == 0) 945 semptr->semzcnt--; 946 else 947 semptr->semncnt--; 948 949 /* 950 * Is it really morning, or was our sleep interrupted? 951 * (Delayed check of tsleep() return code because we 952 * need to decrement sem[nz]cnt either way.) 953 */ 954 if (eval) { 955 eval = EINTR; 956 goto done; 957 } 958 #ifdef SEM_DEBUG 959 kprintf("semop: good morning!\n"); 960 #endif 961 } 962 963 donex: 964 /* 965 * Process any SEM_UNDO requests. 966 */ 967 if (do_undos) { 968 for (i = 0; i < nsops; i++) { 969 /* 970 * We only need to deal with SEM_UNDO's for non-zero 971 * op's. 972 */ 973 int adjval; 974 975 if ((sops[i].sem_flg & SEM_UNDO) == 0) 976 continue; 977 adjval = sops[i].sem_op; 978 if (adjval == 0) 979 continue; 980 eval = semundo_adjust(td->td_proc, &suptr, semid, 981 sops[i].sem_num, -adjval); 982 if (eval == 0) 983 continue; 984 985 /* 986 * Oh-Oh! We ran out of either sem_undo's or undo's. 987 * Rollback the adjustments to this point and then 988 * rollback the semaphore ups and down so we can return 989 * with an error with all structures restored. We 990 * rollback the undo's in the exact reverse order that 991 * we applied them. This guarantees that we won't run 992 * out of space as we roll things back out. 993 */ 994 for (j = i - 1; j >= 0; j--) { 995 if ((sops[j].sem_flg & SEM_UNDO) == 0) 996 continue; 997 adjval = sops[j].sem_op; 998 if (adjval == 0) 999 continue; 1000 if (semundo_adjust(td->td_proc, &suptr, semid, 1001 sops[j].sem_num, adjval) != 0) 1002 panic("semop - can't undo undos"); 1003 } 1004 1005 for (j = 0; j < nsops; j++) 1006 semaptr->sem_base[sops[j].sem_num].semval -= 1007 sops[j].sem_op; 1008 1009 #ifdef SEM_DEBUG 1010 kprintf("eval = %d from semundo_adjust\n", eval); 1011 #endif 1012 goto done; 1013 } /* loop through the sops */ 1014 } /* if (do_undos) */ 1015 1016 /* We're definitely done - set the sempid's */ 1017 for (i = 0; i < nsops; i++) { 1018 sopptr = &sops[i]; 1019 semptr = &semaptr->sem_base[sopptr->sem_num]; 1020 semptr->sempid = td->td_proc->p_pid; 1021 } 1022 1023 /* Do a wakeup if any semaphore was up'd. */ 1024 if (do_wakeup) { 1025 #ifdef SEM_DEBUG 1026 kprintf("semop: doing wakeup\n"); 1027 #endif 1028 wakeup((caddr_t)semaptr); 1029 #ifdef SEM_DEBUG 1030 kprintf("semop: back from wakeup\n"); 1031 #endif 1032 } 1033 #ifdef SEM_DEBUG 1034 kprintf("semop: done\n"); 1035 #endif 1036 uap->sysmsg_result = 0; 1037 eval = 0; 1038 done: 1039 lwkt_relpooltoken(semaptr); 1040 done2: 1041 return(eval); 1042 } 1043 1044 /* 1045 * Go through the undo structures for this process and apply the adjustments to 1046 * semaphores. 1047 */ 1048 void 1049 semexit(struct proc *p) 1050 { 1051 struct sem_undo *suptr; 1052 struct sem_undo **supptr; 1053 int did_something; 1054 1055 did_something = 0; 1056 1057 /* 1058 * We're getting a global token, don't do it if we couldn't 1059 * possibly have any semaphores. 1060 */ 1061 if ((p->p_flags & P_SYSVSEM) == 0) 1062 return; 1063 1064 /* 1065 * Go through the chain of undo vectors looking for one 1066 * associated with this process. De-link it from the 1067 * list right now, while we have the token, but do not 1068 * clear un_proc until we finish cleaning up the relationship. 1069 */ 1070 lwkt_gettoken(&semu_token); 1071 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1072 supptr = &suptr->un_next) { 1073 if (suptr->un_proc == p) { 1074 *supptr = suptr->un_next; 1075 break; 1076 } 1077 } 1078 p->p_flags &= ~P_SYSVSEM; 1079 lwkt_reltoken(&semu_token); 1080 1081 if (suptr == NULL) 1082 return; 1083 1084 #ifdef SEM_DEBUG 1085 kprintf("proc @%08x has undo structure with %d entries\n", p, 1086 suptr->un_cnt); 1087 #endif 1088 1089 /* 1090 * If there are any active undo elements then process them. 1091 */ 1092 if (suptr->un_cnt > 0) { 1093 int ix; 1094 1095 for (ix = 0; ix < suptr->un_cnt; ix++) { 1096 int semid = suptr->un_ent[ix].un_id; 1097 int semnum = suptr->un_ent[ix].un_num; 1098 int adjval = suptr->un_ent[ix].un_adjval; 1099 struct semid_ds *semaptr; 1100 1101 semaptr = &sema[semid]; 1102 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1103 panic("semexit - semid not allocated"); 1104 if (semnum >= semaptr->sem_nsems) 1105 panic("semexit - semnum out of range"); 1106 1107 #ifdef SEM_DEBUG 1108 kprintf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1109 suptr->un_proc, suptr->un_ent[ix].un_id, 1110 suptr->un_ent[ix].un_num, 1111 suptr->un_ent[ix].un_adjval, 1112 semaptr->sem_base[semnum].semval); 1113 #endif 1114 1115 if (adjval < 0) { 1116 if (semaptr->sem_base[semnum].semval < -adjval) 1117 semaptr->sem_base[semnum].semval = 0; 1118 else 1119 semaptr->sem_base[semnum].semval += 1120 adjval; 1121 } else 1122 semaptr->sem_base[semnum].semval += adjval; 1123 1124 wakeup((caddr_t)semaptr); 1125 #ifdef SEM_DEBUG 1126 kprintf("semexit: back from wakeup\n"); 1127 #endif 1128 } 1129 } 1130 1131 /* 1132 * Deallocate the undo vector. 1133 */ 1134 cpu_sfence(); 1135 suptr->un_proc = NULL; 1136 #ifdef SEM_DEBUG 1137 kprintf("removing vector\n"); 1138 #endif 1139 } 1140