1 /* $FreeBSD: src/sys/kern/sysv_sem.c,v 1.69 2004/03/17 09:37:13 cperciva Exp $ */ 2 /* $DragonFly: src/sys/kern/sysv_sem.c,v 1.19 2008/01/06 16:55:51 swildner Exp $ */ 3 4 /* 5 * Implementation of SVID semaphores 6 * 7 * Author: Daniel Boulet 8 * 9 * This software is provided ``AS IS'' without any warranties of any kind. 10 */ 11 12 #include "opt_sysvipc.h" 13 14 #include <sys/param.h> 15 #include <sys/systm.h> 16 #include <sys/sysproto.h> 17 #include <sys/kernel.h> 18 #include <sys/proc.h> 19 #include <sys/sem.h> 20 #include <sys/sysent.h> 21 #include <sys/sysctl.h> 22 #include <sys/malloc.h> 23 #include <sys/jail.h> 24 25 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 26 27 static void seminit (void *); 28 29 static struct sem_undo *semu_alloc (struct proc *p); 30 static int semundo_adjust (struct proc *p, struct sem_undo **supptr, 31 int semid, int semnum, int adjval); 32 static void semundo_clear (int semid, int semnum); 33 34 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 35 static sy_call_t *semcalls[] = { 36 (sy_call_t *)sys___semctl, (sy_call_t *)sys_semget, 37 (sy_call_t *)sys_semop 38 }; 39 40 static int semtot = 0; 41 static struct semid_ds *sema; /* semaphore id pool */ 42 static struct sem *sem; /* semaphore pool */ 43 static struct sem_undo *semu_list; /* list of active undo structures */ 44 static int *semu; /* undo structure pool */ 45 46 struct sem { 47 u_short semval; /* semaphore value */ 48 pid_t sempid; /* pid of last operation */ 49 u_short semncnt; /* # awaiting semval > cval */ 50 u_short semzcnt; /* # awaiting semval = 0 */ 51 }; 52 53 /* 54 * Undo structure (one per process) 55 */ 56 struct sem_undo { 57 struct sem_undo *un_next; /* ptr to next active undo structure */ 58 struct proc *un_proc; /* owner of this structure */ 59 short un_cnt; /* # of active entries */ 60 struct undo { 61 short un_adjval; /* adjust on exit values */ 62 short un_num; /* semaphore # */ 63 int un_id; /* semid */ 64 } un_ent[1]; /* undo entries */ 65 }; 66 67 /* 68 * Configuration parameters 69 */ 70 #ifndef SEMMNI 71 #define SEMMNI 10 /* # of semaphore identifiers */ 72 #endif 73 #ifndef SEMMNS 74 #define SEMMNS 60 /* # of semaphores in system */ 75 #endif 76 #ifndef SEMUME 77 #define SEMUME 10 /* max # of undo entries per process */ 78 #endif 79 #ifndef SEMMNU 80 #define SEMMNU 30 /* # of undo structures in system */ 81 #endif 82 83 /* shouldn't need tuning */ 84 #ifndef SEMMAP 85 #define SEMMAP 30 /* # of entries in semaphore map */ 86 #endif 87 #ifndef SEMMSL 88 #define SEMMSL SEMMNS /* max # of semaphores per id */ 89 #endif 90 #ifndef SEMOPM 91 #define SEMOPM 100 /* max # of operations per semop call */ 92 #endif 93 94 #define SEMVMX 32767 /* semaphore maximum value */ 95 #define SEMAEM 16384 /* adjust on exit max value */ 96 97 /* 98 * Due to the way semaphore memory is allocated, we have to ensure that 99 * SEMUSZ is properly aligned. 100 */ 101 102 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 103 104 /* actual size of an undo structure */ 105 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 106 107 /* 108 * Macro to find a particular sem_undo vector 109 */ 110 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 111 112 /* 113 * semaphore info struct 114 */ 115 struct seminfo seminfo = { 116 SEMMAP, /* # of entries in semaphore map */ 117 SEMMNI, /* # of semaphore identifiers */ 118 SEMMNS, /* # of semaphores in system */ 119 SEMMNU, /* # of undo structures in system */ 120 SEMMSL, /* max # of semaphores per id */ 121 SEMOPM, /* max # of operations per semop call */ 122 SEMUME, /* max # of undo entries per process */ 123 SEMUSZ, /* size in bytes of undo structure */ 124 SEMVMX, /* semaphore maximum value */ 125 SEMAEM /* adjust on exit max value */ 126 }; 127 128 TUNABLE_INT("kern.ipc.semmap", &seminfo.semmap); 129 TUNABLE_INT("kern.ipc.semmni", &seminfo.semmni); 130 TUNABLE_INT("kern.ipc.semmns", &seminfo.semmns); 131 TUNABLE_INT("kern.ipc.semmnu", &seminfo.semmnu); 132 TUNABLE_INT("kern.ipc.semmsl", &seminfo.semmsl); 133 TUNABLE_INT("kern.ipc.semopm", &seminfo.semopm); 134 TUNABLE_INT("kern.ipc.semume", &seminfo.semume); 135 TUNABLE_INT("kern.ipc.semusz", &seminfo.semusz); 136 TUNABLE_INT("kern.ipc.semvmx", &seminfo.semvmx); 137 TUNABLE_INT("kern.ipc.semaem", &seminfo.semaem); 138 139 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 140 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 141 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 142 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 143 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 149 150 #if 0 151 RO seminfo.semmap /* SEMMAP unused */ 152 RO seminfo.semmni 153 RO seminfo.semmns 154 RO seminfo.semmnu /* undo entries per system */ 155 RW seminfo.semmsl 156 RO seminfo.semopm /* SEMOPM unused */ 157 RO seminfo.semume 158 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 159 RO seminfo.semvmx /* SEMVMX unused - user param */ 160 RO seminfo.semaem /* SEMAEM unused - user param */ 161 #endif 162 163 static void 164 seminit(void *dummy) 165 { 166 int i; 167 168 sem = kmalloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 169 sema = kmalloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 170 semu = kmalloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 171 172 for (i = 0; i < seminfo.semmni; i++) { 173 sema[i].sem_base = 0; 174 sema[i].sem_perm.mode = 0; 175 } 176 for (i = 0; i < seminfo.semmnu; i++) { 177 struct sem_undo *suptr = SEMU(i); 178 suptr->un_proc = NULL; 179 } 180 semu_list = NULL; 181 } 182 SYSINIT(sysv_sem, SI_SUB_SYSV_SEM, SI_ORDER_FIRST, seminit, NULL) 183 184 /* 185 * Entry point for all SEM calls 186 * 187 * semsys_args(int which, a2, a3, ...) (VARARGS) 188 * 189 * MPALMOSTSAFE 190 */ 191 int 192 sys_semsys(struct semsys_args *uap) 193 { 194 struct thread *td = curthread; 195 unsigned int which = (unsigned int)uap->which; 196 int error; 197 198 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 199 return (ENOSYS); 200 201 if (which >= sizeof(semcalls)/sizeof(semcalls[0])) 202 return (EINVAL); 203 bcopy(&uap->a2, &uap->which, 204 sizeof(struct semsys_args) - offsetof(struct semsys_args, a2)); 205 get_mplock(); 206 error = (*semcalls[which])(uap); 207 rel_mplock(); 208 return (error); 209 } 210 211 /* 212 * Allocate a new sem_undo structure for a process 213 * (returns ptr to structure or NULL if no more room) 214 */ 215 216 static struct sem_undo * 217 semu_alloc(struct proc *p) 218 { 219 int i; 220 struct sem_undo *suptr; 221 struct sem_undo **supptr; 222 int attempt; 223 224 /* 225 * Try twice to allocate something. 226 * (we'll purge any empty structures after the first pass so 227 * two passes are always enough) 228 */ 229 230 for (attempt = 0; attempt < 2; attempt++) { 231 /* 232 * Look for a free structure. 233 * Fill it in and return it if we find one. 234 */ 235 236 for (i = 0; i < seminfo.semmnu; i++) { 237 suptr = SEMU(i); 238 if (suptr->un_proc == NULL) { 239 suptr->un_next = semu_list; 240 semu_list = suptr; 241 suptr->un_cnt = 0; 242 suptr->un_proc = p; 243 return(suptr); 244 } 245 } 246 247 /* 248 * We didn't find a free one, if this is the first attempt 249 * then try to free some structures. 250 */ 251 252 if (attempt == 0) { 253 /* All the structures are in use - try to free some */ 254 int did_something = 0; 255 256 supptr = &semu_list; 257 while ((suptr = *supptr) != NULL) { 258 if (suptr->un_cnt == 0) { 259 suptr->un_proc = NULL; 260 *supptr = suptr->un_next; 261 did_something = 1; 262 } else 263 supptr = &(suptr->un_next); 264 } 265 266 /* If we didn't free anything then just give-up */ 267 if (!did_something) 268 return(NULL); 269 } else { 270 /* 271 * The second pass failed even though we freed 272 * something after the first pass! 273 * This is IMPOSSIBLE! 274 */ 275 panic("semu_alloc - second attempt failed"); 276 } 277 } 278 return (NULL); 279 } 280 281 /* 282 * Adjust a particular entry for a particular proc 283 */ 284 285 static int 286 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum, 287 int adjval) 288 { 289 struct sem_undo *suptr; 290 struct undo *sunptr; 291 int i; 292 293 /* Look for and remember the sem_undo if the caller doesn't provide 294 it */ 295 296 suptr = *supptr; 297 if (suptr == NULL) { 298 for (suptr = semu_list; suptr != NULL; 299 suptr = suptr->un_next) { 300 if (suptr->un_proc == p) { 301 *supptr = suptr; 302 break; 303 } 304 } 305 if (suptr == NULL) { 306 if (adjval == 0) 307 return(0); 308 suptr = semu_alloc(p); 309 if (suptr == NULL) 310 return(ENOSPC); 311 *supptr = suptr; 312 } 313 } 314 315 /* 316 * Look for the requested entry and adjust it (delete if adjval becomes 317 * 0). 318 */ 319 sunptr = &suptr->un_ent[0]; 320 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 321 if (sunptr->un_id != semid || sunptr->un_num != semnum) 322 continue; 323 if (adjval == 0) 324 sunptr->un_adjval = 0; 325 else 326 sunptr->un_adjval += adjval; 327 if (sunptr->un_adjval == 0) { 328 suptr->un_cnt--; 329 if (i < suptr->un_cnt) 330 suptr->un_ent[i] = 331 suptr->un_ent[suptr->un_cnt]; 332 } 333 return(0); 334 } 335 336 /* Didn't find the right entry - create it */ 337 if (adjval == 0) 338 return(0); 339 if (suptr->un_cnt != seminfo.semume) { 340 sunptr = &suptr->un_ent[suptr->un_cnt]; 341 suptr->un_cnt++; 342 sunptr->un_adjval = adjval; 343 sunptr->un_id = semid; sunptr->un_num = semnum; 344 } else 345 return(EINVAL); 346 return(0); 347 } 348 349 static void 350 semundo_clear(int semid, int semnum) 351 { 352 struct sem_undo *suptr; 353 354 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 355 struct undo *sunptr = &suptr->un_ent[0]; 356 int i = 0; 357 358 while (i < suptr->un_cnt) { 359 if (sunptr->un_id == semid) { 360 if (semnum == -1 || sunptr->un_num == semnum) { 361 suptr->un_cnt--; 362 if (i < suptr->un_cnt) { 363 suptr->un_ent[i] = 364 suptr->un_ent[suptr->un_cnt]; 365 continue; 366 } 367 } 368 if (semnum != -1) 369 break; 370 } 371 i++, sunptr++; 372 } 373 } 374 } 375 376 /* 377 * Note that the user-mode half of this passes a union, not a pointer 378 * 379 * MPALMOSTSAFE 380 */ 381 int 382 sys___semctl(struct __semctl_args *uap) 383 { 384 struct thread *td = curthread; 385 int semid = uap->semid; 386 int semnum = uap->semnum; 387 int cmd = uap->cmd; 388 union semun *arg = uap->arg; 389 union semun real_arg; 390 struct ucred *cred = td->td_ucred; 391 int i, rval, eval; 392 struct semid_ds sbuf; 393 struct semid_ds *semaptr; 394 395 #ifdef SEM_DEBUG 396 kprintf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 397 #endif 398 399 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 400 return (ENOSYS); 401 402 semid = IPCID_TO_IX(semid); 403 if (semid < 0 || semid >= seminfo.semmni) 404 return(EINVAL); 405 406 get_mplock(); 407 semaptr = &sema[semid]; 408 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 409 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 410 rel_mplock(); 411 return(EINVAL); 412 } 413 414 eval = 0; 415 rval = 0; 416 417 switch (cmd) { 418 case IPC_RMID: 419 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M)) != 0) 420 break; 421 semaptr->sem_perm.cuid = cred->cr_uid; 422 semaptr->sem_perm.uid = cred->cr_uid; 423 semtot -= semaptr->sem_nsems; 424 for (i = semaptr->sem_base - sem; i < semtot; i++) 425 sem[i] = sem[i + semaptr->sem_nsems]; 426 for (i = 0; i < seminfo.semmni; i++) { 427 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 428 sema[i].sem_base > semaptr->sem_base) 429 sema[i].sem_base -= semaptr->sem_nsems; 430 } 431 semaptr->sem_perm.mode = 0; 432 semundo_clear(semid, -1); 433 wakeup((caddr_t)semaptr); 434 break; 435 436 case IPC_SET: 437 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_M); 438 if (eval) 439 break; 440 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 441 break; 442 if ((eval = copyin(real_arg.buf, (caddr_t)&sbuf, 443 sizeof(sbuf))) != 0) { 444 break; 445 } 446 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 447 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 448 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 449 (sbuf.sem_perm.mode & 0777); 450 semaptr->sem_ctime = time_second; 451 break; 452 453 case IPC_STAT: 454 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R))) 455 break; 456 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 457 break; 458 eval = copyout(semaptr, real_arg.buf, sizeof(struct semid_ds)); 459 break; 460 461 case GETNCNT: 462 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 463 if (eval) 464 break; 465 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 466 eval = EINVAL; 467 break; 468 } 469 rval = semaptr->sem_base[semnum].semncnt; 470 break; 471 472 case GETPID: 473 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 474 if (eval) 475 break; 476 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 477 eval = EINVAL; 478 break; 479 } 480 rval = semaptr->sem_base[semnum].sempid; 481 break; 482 483 case GETVAL: 484 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 485 if (eval) 486 break; 487 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 488 eval = EINVAL; 489 break; 490 } 491 rval = semaptr->sem_base[semnum].semval; 492 break; 493 494 case GETALL: 495 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 496 if (eval) 497 break; 498 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 499 break; 500 for (i = 0; i < semaptr->sem_nsems; i++) { 501 eval = copyout(&semaptr->sem_base[i].semval, 502 &real_arg.array[i], 503 sizeof(real_arg.array[0])); 504 if (eval) 505 break; 506 } 507 break; 508 509 case GETZCNT: 510 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_R); 511 if (eval) 512 break; 513 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 514 eval = EINVAL; 515 break; 516 } 517 rval = semaptr->sem_base[semnum].semzcnt; 518 break; 519 520 case SETVAL: 521 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 522 if (eval) 523 break; 524 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 525 eval = EINVAL; 526 break; 527 } 528 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 529 break; 530 semaptr->sem_base[semnum].semval = real_arg.val; 531 semundo_clear(semid, semnum); 532 wakeup((caddr_t)semaptr); 533 break; 534 535 case SETALL: 536 eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W); 537 if (eval) 538 break; 539 if ((eval = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 540 break; 541 for (i = 0; i < semaptr->sem_nsems; i++) { 542 eval = copyin(&real_arg.array[i], 543 (caddr_t)&semaptr->sem_base[i].semval, 544 sizeof(real_arg.array[0])); 545 if (eval != 0) 546 break; 547 } 548 semundo_clear(semid, -1); 549 wakeup((caddr_t)semaptr); 550 break; 551 552 default: 553 eval = EINVAL; 554 break; 555 } 556 rel_mplock(); 557 558 if (eval == 0) 559 uap->sysmsg_result = rval; 560 return(eval); 561 } 562 563 /* 564 * MPALMOSTSAFE 565 */ 566 int 567 sys_semget(struct semget_args *uap) 568 { 569 struct thread *td = curthread; 570 int semid, eval; 571 int key = uap->key; 572 int nsems = uap->nsems; 573 int semflg = uap->semflg; 574 struct ucred *cred = td->td_ucred; 575 576 #ifdef SEM_DEBUG 577 kprintf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 578 #endif 579 580 if (!jail_sysvipc_allowed && cred->cr_prison != NULL) 581 return (ENOSYS); 582 583 get_mplock(); 584 eval = 0; 585 586 if (key != IPC_PRIVATE) { 587 for (semid = 0; semid < seminfo.semmni; semid++) { 588 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 589 sema[semid].sem_perm.key == key) 590 break; 591 } 592 if (semid < seminfo.semmni) { 593 #ifdef SEM_DEBUG 594 kprintf("found public key\n"); 595 #endif 596 if ((eval = ipcperm(td->td_proc, 597 &sema[semid].sem_perm, 598 semflg & 0700))) { 599 goto done; 600 } 601 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 602 #ifdef SEM_DEBUG 603 kprintf("too small\n"); 604 #endif 605 eval = EINVAL; 606 goto done; 607 } 608 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 609 #ifdef SEM_DEBUG 610 kprintf("not exclusive\n"); 611 #endif 612 eval = EEXIST; 613 goto done; 614 } 615 goto done; 616 } 617 } 618 619 #ifdef SEM_DEBUG 620 kprintf("need to allocate the semid_ds\n"); 621 #endif 622 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 623 if (nsems <= 0 || nsems > seminfo.semmsl) { 624 #ifdef SEM_DEBUG 625 kprintf("nsems out of range (0<%d<=%d)\n", nsems, 626 seminfo.semmsl); 627 #endif 628 eval = EINVAL; 629 goto done; 630 } 631 if (nsems > seminfo.semmns - semtot) { 632 #ifdef SEM_DEBUG 633 kprintf("not enough semaphores left (need %d, got %d)\n", 634 nsems, seminfo.semmns - semtot); 635 #endif 636 eval = ENOSPC; 637 goto done; 638 } 639 for (semid = 0; semid < seminfo.semmni; semid++) { 640 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 641 break; 642 } 643 if (semid == seminfo.semmni) { 644 #ifdef SEM_DEBUG 645 kprintf("no more semid_ds's available\n"); 646 #endif 647 eval = ENOSPC; 648 goto done; 649 } 650 #ifdef SEM_DEBUG 651 kprintf("semid %d is available\n", semid); 652 #endif 653 sema[semid].sem_perm.key = key; 654 sema[semid].sem_perm.cuid = cred->cr_uid; 655 sema[semid].sem_perm.uid = cred->cr_uid; 656 sema[semid].sem_perm.cgid = cred->cr_gid; 657 sema[semid].sem_perm.gid = cred->cr_gid; 658 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 659 sema[semid].sem_perm.seq = 660 (sema[semid].sem_perm.seq + 1) & 0x7fff; 661 sema[semid].sem_nsems = nsems; 662 sema[semid].sem_otime = 0; 663 sema[semid].sem_ctime = time_second; 664 sema[semid].sem_base = &sem[semtot]; 665 semtot += nsems; 666 bzero(sema[semid].sem_base, 667 sizeof(sema[semid].sem_base[0])*nsems); 668 #ifdef SEM_DEBUG 669 kprintf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 670 &sem[semtot]); 671 #endif 672 } else { 673 #ifdef SEM_DEBUG 674 kprintf("didn't find it and wasn't asked to create it\n"); 675 #endif 676 eval = ENOENT; 677 } 678 679 done: 680 if (eval == 0) { 681 uap->sysmsg_result = IXSEQ_TO_IPCID(semid, 682 sema[semid].sem_perm); 683 } 684 rel_mplock(); 685 return(eval); 686 } 687 688 /* 689 * MPALMOSTSAFE 690 */ 691 int 692 sys_semop(struct semop_args *uap) 693 { 694 struct thread *td = curthread; 695 int semid = uap->semid; 696 u_int nsops = uap->nsops; 697 struct sembuf sops[MAX_SOPS]; 698 struct semid_ds *semaptr; 699 struct sembuf *sopptr; 700 struct sem *semptr; 701 struct sem_undo *suptr = NULL; 702 int i, j, eval; 703 int do_wakeup, do_undos; 704 705 #ifdef SEM_DEBUG 706 kprintf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 707 #endif 708 709 if (!jail_sysvipc_allowed && td->td_ucred->cr_prison != NULL) 710 return (ENOSYS); 711 712 get_mplock(); 713 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 714 715 if (semid < 0 || semid >= seminfo.semmni) { 716 eval = EINVAL; 717 goto done; 718 } 719 720 semaptr = &sema[semid]; 721 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 722 eval = EINVAL; 723 goto done; 724 } 725 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 726 eval = EINVAL; 727 goto done; 728 } 729 730 if ((eval = ipcperm(td->td_proc, &semaptr->sem_perm, IPC_W))) { 731 #ifdef SEM_DEBUG 732 kprintf("eval = %d from ipaccess\n", eval); 733 #endif 734 goto done; 735 } 736 737 if (nsops > MAX_SOPS) { 738 #ifdef SEM_DEBUG 739 kprintf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 740 #endif 741 eval = E2BIG; 742 goto done; 743 } 744 745 if ((eval = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 746 #ifdef SEM_DEBUG 747 kprintf("eval = %d from copyin(%08x, %08x, %u)\n", eval, 748 uap->sops, &sops, nsops * sizeof(sops[0])); 749 #endif 750 goto done; 751 } 752 753 /* 754 * Loop trying to satisfy the vector of requests. 755 * If we reach a point where we must wait, any requests already 756 * performed are rolled back and we go to sleep until some other 757 * process wakes us up. At this point, we start all over again. 758 * 759 * This ensures that from the perspective of other tasks, a set 760 * of requests is atomic (never partially satisfied). 761 */ 762 do_undos = 0; 763 764 for (;;) { 765 do_wakeup = 0; 766 767 for (i = 0; i < nsops; i++) { 768 sopptr = &sops[i]; 769 770 if (sopptr->sem_num >= semaptr->sem_nsems) { 771 eval = EFBIG; 772 goto done; 773 } 774 775 semptr = &semaptr->sem_base[sopptr->sem_num]; 776 777 #ifdef SEM_DEBUG 778 kprintf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 779 semaptr, semaptr->sem_base, semptr, 780 sopptr->sem_num, semptr->semval, sopptr->sem_op, 781 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 782 #endif 783 784 if (sopptr->sem_op < 0) { 785 if (semptr->semval + sopptr->sem_op < 0) { 786 #ifdef SEM_DEBUG 787 kprintf("semop: can't do it now\n"); 788 #endif 789 break; 790 } else { 791 semptr->semval += sopptr->sem_op; 792 if (semptr->semval == 0 && 793 semptr->semzcnt > 0) 794 do_wakeup = 1; 795 } 796 if (sopptr->sem_flg & SEM_UNDO) 797 do_undos = 1; 798 } else if (sopptr->sem_op == 0) { 799 if (semptr->semval > 0) { 800 #ifdef SEM_DEBUG 801 kprintf("semop: not zero now\n"); 802 #endif 803 break; 804 } 805 } else { 806 if (semptr->semncnt > 0) 807 do_wakeup = 1; 808 semptr->semval += sopptr->sem_op; 809 if (sopptr->sem_flg & SEM_UNDO) 810 do_undos = 1; 811 } 812 } 813 814 /* 815 * Did we get through the entire vector? 816 */ 817 if (i >= nsops) 818 goto donex; 819 820 /* 821 * No ... rollback anything that we've already done 822 */ 823 #ifdef SEM_DEBUG 824 kprintf("semop: rollback 0 through %d\n", i-1); 825 #endif 826 for (j = 0; j < i; j++) 827 semaptr->sem_base[sops[j].sem_num].semval -= 828 sops[j].sem_op; 829 830 /* 831 * If the request that we couldn't satisfy has the 832 * NOWAIT flag set then return with EAGAIN. 833 */ 834 if (sopptr->sem_flg & IPC_NOWAIT) { 835 eval = EAGAIN; 836 goto done; 837 } 838 839 if (sopptr->sem_op == 0) 840 semptr->semzcnt++; 841 else 842 semptr->semncnt++; 843 844 #ifdef SEM_DEBUG 845 kprintf("semop: good night!\n"); 846 #endif 847 eval = tsleep((caddr_t)semaptr, PCATCH, "semwait", 0); 848 #ifdef SEM_DEBUG 849 kprintf("semop: good morning (eval=%d)!\n", eval); 850 #endif 851 852 suptr = NULL; /* sem_undo may have been reallocated */ 853 854 /* return code is checked below, after sem[nz]cnt-- */ 855 856 /* 857 * Make sure that the semaphore still exists 858 */ 859 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 860 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 861 eval = EIDRM; 862 goto done; 863 } 864 865 /* 866 * The semaphore is still alive. Readjust the count of 867 * waiting processes. 868 */ 869 if (sopptr->sem_op == 0) 870 semptr->semzcnt--; 871 else 872 semptr->semncnt--; 873 874 /* 875 * Is it really morning, or was our sleep interrupted? 876 * (Delayed check of tsleep() return code because we 877 * need to decrement sem[nz]cnt either way.) 878 */ 879 if (eval) { 880 eval = EINTR; 881 goto done; 882 } 883 #ifdef SEM_DEBUG 884 kprintf("semop: good morning!\n"); 885 #endif 886 } 887 888 donex: 889 /* 890 * Process any SEM_UNDO requests. 891 */ 892 if (do_undos) { 893 for (i = 0; i < nsops; i++) { 894 /* 895 * We only need to deal with SEM_UNDO's for non-zero 896 * op's. 897 */ 898 int adjval; 899 900 if ((sops[i].sem_flg & SEM_UNDO) == 0) 901 continue; 902 adjval = sops[i].sem_op; 903 if (adjval == 0) 904 continue; 905 eval = semundo_adjust(td->td_proc, &suptr, semid, 906 sops[i].sem_num, -adjval); 907 if (eval == 0) 908 continue; 909 910 /* 911 * Oh-Oh! We ran out of either sem_undo's or undo's. 912 * Rollback the adjustments to this point and then 913 * rollback the semaphore ups and down so we can return 914 * with an error with all structures restored. We 915 * rollback the undo's in the exact reverse order that 916 * we applied them. This guarantees that we won't run 917 * out of space as we roll things back out. 918 */ 919 for (j = i - 1; j >= 0; j--) { 920 if ((sops[j].sem_flg & SEM_UNDO) == 0) 921 continue; 922 adjval = sops[j].sem_op; 923 if (adjval == 0) 924 continue; 925 if (semundo_adjust(td->td_proc, &suptr, semid, 926 sops[j].sem_num, adjval) != 0) 927 panic("semop - can't undo undos"); 928 } 929 930 for (j = 0; j < nsops; j++) 931 semaptr->sem_base[sops[j].sem_num].semval -= 932 sops[j].sem_op; 933 934 #ifdef SEM_DEBUG 935 kprintf("eval = %d from semundo_adjust\n", eval); 936 #endif 937 goto done; 938 } /* loop through the sops */ 939 } /* if (do_undos) */ 940 941 /* We're definitely done - set the sempid's */ 942 for (i = 0; i < nsops; i++) { 943 sopptr = &sops[i]; 944 semptr = &semaptr->sem_base[sopptr->sem_num]; 945 semptr->sempid = td->td_proc->p_pid; 946 } 947 948 /* Do a wakeup if any semaphore was up'd. */ 949 if (do_wakeup) { 950 #ifdef SEM_DEBUG 951 kprintf("semop: doing wakeup\n"); 952 #endif 953 wakeup((caddr_t)semaptr); 954 #ifdef SEM_DEBUG 955 kprintf("semop: back from wakeup\n"); 956 #endif 957 } 958 #ifdef SEM_DEBUG 959 kprintf("semop: done\n"); 960 #endif 961 uap->sysmsg_result = 0; 962 eval = 0; 963 done: 964 rel_mplock(); 965 return(eval); 966 } 967 968 /* 969 * Go through the undo structures for this process and apply the adjustments to 970 * semaphores. 971 */ 972 void 973 semexit(struct proc *p) 974 { 975 struct sem_undo *suptr; 976 struct sem_undo **supptr; 977 int did_something; 978 979 did_something = 0; 980 981 /* 982 * Go through the chain of undo vectors looking for one 983 * associated with this process. 984 */ 985 986 for (supptr = &semu_list; (suptr = *supptr) != NULL; 987 supptr = &suptr->un_next) { 988 if (suptr->un_proc == p) 989 break; 990 } 991 992 if (suptr == NULL) 993 return; 994 995 #ifdef SEM_DEBUG 996 kprintf("proc @%08x has undo structure with %d entries\n", p, 997 suptr->un_cnt); 998 #endif 999 1000 /* 1001 * If there are any active undo elements then process them. 1002 */ 1003 if (suptr->un_cnt > 0) { 1004 int ix; 1005 1006 for (ix = 0; ix < suptr->un_cnt; ix++) { 1007 int semid = suptr->un_ent[ix].un_id; 1008 int semnum = suptr->un_ent[ix].un_num; 1009 int adjval = suptr->un_ent[ix].un_adjval; 1010 struct semid_ds *semaptr; 1011 1012 semaptr = &sema[semid]; 1013 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1014 panic("semexit - semid not allocated"); 1015 if (semnum >= semaptr->sem_nsems) 1016 panic("semexit - semnum out of range"); 1017 1018 #ifdef SEM_DEBUG 1019 kprintf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1020 suptr->un_proc, suptr->un_ent[ix].un_id, 1021 suptr->un_ent[ix].un_num, 1022 suptr->un_ent[ix].un_adjval, 1023 semaptr->sem_base[semnum].semval); 1024 #endif 1025 1026 if (adjval < 0) { 1027 if (semaptr->sem_base[semnum].semval < -adjval) 1028 semaptr->sem_base[semnum].semval = 0; 1029 else 1030 semaptr->sem_base[semnum].semval += 1031 adjval; 1032 } else 1033 semaptr->sem_base[semnum].semval += adjval; 1034 1035 wakeup((caddr_t)semaptr); 1036 #ifdef SEM_DEBUG 1037 kprintf("semexit: back from wakeup\n"); 1038 #endif 1039 } 1040 } 1041 1042 /* 1043 * Deallocate the undo vector. 1044 */ 1045 #ifdef SEM_DEBUG 1046 kprintf("removing vector\n"); 1047 #endif 1048 suptr->un_proc = NULL; 1049 *supptr = suptr->un_next; 1050 } 1051