xref: /netbsd-src/sys/kern/sysv_sem.c (revision e5548b402ae4c44fb816de42c7bba9581ce23ef5)
1 /*	$NetBSD: sysv_sem.c,v 1.59 2005/12/07 06:14:13 thorpej Exp $	*/
2 
3 /*-
4  * Copyright (c) 1999 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9  * NASA Ames Research Center.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the NetBSD
22  *	Foundation, Inc. and its contributors.
23  * 4. Neither the name of The NetBSD Foundation nor the names of its
24  *    contributors may be used to endorse or promote products derived
25  *    from this software without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
28  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
29  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
30  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
31  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
32  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
33  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
34  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
35  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
36  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
37  * POSSIBILITY OF SUCH DAMAGE.
38  */
39 
40 /*
41  * Implementation of SVID semaphores
42  *
43  * Author: Daniel Boulet
44  *
45  * This software is provided ``AS IS'' without any warranties of any kind.
46  */
47 
48 #include <sys/cdefs.h>
49 __KERNEL_RCSID(0, "$NetBSD: sysv_sem.c,v 1.59 2005/12/07 06:14:13 thorpej Exp $");
50 
51 #define SYSVSEM
52 
53 #include <sys/param.h>
54 #include <sys/kernel.h>
55 #include <sys/sem.h>
56 #include <sys/sysctl.h>
57 #include <sys/malloc.h>
58 #include <sys/mount.h>		/* XXX for <sys/syscallargs.h> */
59 #include <sys/sa.h>
60 #include <sys/syscallargs.h>
61 
62 static int	semtot = 0;
63 struct	semid_ds *sema;			/* semaphore id pool */
64 static struct	__sem *sem;		/* semaphore pool */
65 static struct	sem_undo *semu_list;	/* list of active undo structures */
66 static int	*semu;			/* undo structure pool */
67 
68 #ifdef SEM_DEBUG
69 #define SEM_PRINTF(a) printf a
70 #else
71 #define SEM_PRINTF(a)
72 #endif
73 
74 struct sem_undo *semu_alloc(struct proc *);
75 int semundo_adjust(struct proc *, struct sem_undo **, int, int, int);
76 void semundo_clear(int, int);
77 
78 /*
79  * XXXSMP Once we go MP, there needs to be a lock for the semaphore system.
80  * Until then, we're saved by being a non-preemptive kernel.
81  */
82 
83 void
84 seminit(void)
85 {
86 	int i, sz;
87 	vaddr_t v;
88 
89 	/* Allocate pageable memory for our structures */
90 	sz = seminfo.semmni * sizeof(struct semid_ds) +
91 	    seminfo.semmns * sizeof(struct __sem) +
92 	    seminfo.semmnu * seminfo.semusz;
93 	v = uvm_km_alloc(kernel_map, round_page(sz), 0,
94 	    UVM_KMF_WIRED|UVM_KMF_ZERO);
95 	if (v == 0)
96 		panic("sysv_sem: cannot allocate memory");
97 	sema = (void *)v;
98 	sem = (void *)(sema + seminfo.semmni);
99 	semu = (void *)(sem + seminfo.semmns);
100 
101 	for (i = 0; i < seminfo.semmni; i++) {
102 		sema[i]._sem_base = 0;
103 		sema[i].sem_perm.mode = 0;
104 	}
105 	for (i = 0; i < seminfo.semmnu; i++) {
106 		struct sem_undo *suptr = SEMU(i);
107 		suptr->un_proc = NULL;
108 	}
109 	semu_list = NULL;
110 	exithook_establish(semexit, NULL);
111 }
112 
113 /*
114  * Placebo.
115  */
116 
117 int
118 sys_semconfig(struct lwp *l, void *v, register_t *retval)
119 {
120 
121 	*retval = 0;
122 	return 0;
123 }
124 
125 /*
126  * Allocate a new sem_undo structure for a process
127  * (returns ptr to structure or NULL if no more room)
128  */
129 
130 struct sem_undo *
131 semu_alloc(struct proc *p)
132 {
133 	int i;
134 	struct sem_undo *suptr;
135 	struct sem_undo **supptr;
136 	int attempt;
137 
138 	/*
139 	 * Try twice to allocate something.
140 	 * (we'll purge any empty structures after the first pass so
141 	 * two passes are always enough)
142 	 */
143 
144 	for (attempt = 0; attempt < 2; attempt++) {
145 		/*
146 		 * Look for a free structure.
147 		 * Fill it in and return it if we find one.
148 		 */
149 
150 		for (i = 0; i < seminfo.semmnu; i++) {
151 			suptr = SEMU(i);
152 			if (suptr->un_proc == NULL) {
153 				suptr->un_next = semu_list;
154 				semu_list = suptr;
155 				suptr->un_cnt = 0;
156 				suptr->un_proc = p;
157 				return (suptr);
158 			}
159 		}
160 
161 		/*
162 		 * We didn't find a free one, if this is the first attempt
163 		 * then try to free some structures.
164 		 */
165 
166 		if (attempt == 0) {
167 			/* All the structures are in use - try to free some */
168 			int did_something = 0;
169 
170 			supptr = &semu_list;
171 			while ((suptr = *supptr) != NULL) {
172 				if (suptr->un_cnt == 0)  {
173 					suptr->un_proc = NULL;
174 					*supptr = suptr->un_next;
175 					did_something = 1;
176 				} else
177 					supptr = &suptr->un_next;
178 			}
179 
180 			/* If we didn't free anything then just give-up */
181 			if (!did_something)
182 				return (NULL);
183 		} else {
184 			/*
185 			 * The second pass failed even though we freed
186 			 * something after the first pass!
187 			 * This is IMPOSSIBLE!
188 			 */
189 			panic("semu_alloc - second attempt failed");
190 		}
191 	}
192 	return NULL;
193 }
194 
195 /*
196  * Adjust a particular entry for a particular proc
197  */
198 
199 int
200 semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum,
201     int adjval)
202 {
203 	struct sem_undo *suptr;
204 	struct undo *sunptr;
205 	int i;
206 
207 	/*
208 	 * Look for and remember the sem_undo if the caller doesn't
209 	 * provide it
210 	 */
211 
212 	suptr = *supptr;
213 	if (suptr == NULL) {
214 		for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
215 			if (suptr->un_proc == p)
216 				break;
217 
218 		if (suptr == NULL) {
219 			suptr = semu_alloc(p);
220 			if (suptr == NULL)
221 				return (ENOSPC);
222 		}
223 		*supptr = suptr;
224 	}
225 
226 	/*
227 	 * Look for the requested entry and adjust it (delete if
228 	 * adjval becomes 0).
229 	 */
230 	sunptr = &suptr->un_ent[0];
231 	for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
232 		if (sunptr->un_id != semid || sunptr->un_num != semnum)
233 			continue;
234 		sunptr->un_adjval += adjval;
235 		if (sunptr->un_adjval == 0) {
236 			suptr->un_cnt--;
237 			if (i < suptr->un_cnt)
238 				suptr->un_ent[i] =
239 				    suptr->un_ent[suptr->un_cnt];
240 		}
241 		return (0);
242 	}
243 
244 	/* Didn't find the right entry - create it */
245 	if (suptr->un_cnt == SEMUME)
246 		return (EINVAL);
247 
248 	sunptr = &suptr->un_ent[suptr->un_cnt];
249 	suptr->un_cnt++;
250 	sunptr->un_adjval = adjval;
251 	sunptr->un_id = semid;
252 	sunptr->un_num = semnum;
253 	return (0);
254 }
255 
256 void
257 semundo_clear(int semid, int semnum)
258 {
259 	struct sem_undo *suptr;
260 	struct undo *sunptr, *sunend;
261 
262 	for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
263 		for (sunptr = &suptr->un_ent[0],
264 		    sunend = sunptr + suptr->un_cnt; sunptr < sunend;) {
265 			if (sunptr->un_id == semid) {
266 				if (semnum == -1 || sunptr->un_num == semnum) {
267 					suptr->un_cnt--;
268 					sunend--;
269 					if (sunptr != sunend)
270 						*sunptr = *sunend;
271 					if (semnum != -1)
272 						break;
273 					else
274 						continue;
275 				}
276 			}
277 			sunptr++;
278 		}
279 }
280 
281 int
282 sys_____semctl13(struct lwp *l, void *v, register_t *retval)
283 {
284 	struct sys_____semctl13_args /* {
285 		syscallarg(int) semid;
286 		syscallarg(int) semnum;
287 		syscallarg(int) cmd;
288 		syscallarg(union __semun *) arg;
289 	} */ *uap = v;
290 	struct proc *p = l->l_proc;
291 	struct semid_ds sembuf;
292 	int cmd, error;
293 	void *pass_arg;
294 	union __semun karg;
295 
296 	cmd = SCARG(uap, cmd);
297 
298 	switch (cmd) {
299 	case IPC_SET:
300 	case IPC_STAT:
301 		pass_arg = &sembuf;
302 		break;
303 
304 	case GETALL:
305 	case SETVAL:
306 	case SETALL:
307 		pass_arg = &karg;
308 		break;
309 	default:
310 		pass_arg = NULL;
311 		break;
312 	}
313 
314 	if (pass_arg) {
315 		error = copyin(SCARG(uap, arg), &karg, sizeof(karg));
316 		if (error)
317 			return error;
318 		if (cmd == IPC_SET) {
319 			error = copyin(karg.buf, &sembuf, sizeof(sembuf));
320 			if (error)
321 				return (error);
322 		}
323 	}
324 
325 	error = semctl1(p, SCARG(uap, semid), SCARG(uap, semnum), cmd,
326 	    pass_arg, retval);
327 
328 	if (error == 0 && cmd == IPC_STAT)
329 		error = copyout(&sembuf, karg.buf, sizeof(sembuf));
330 
331 	return (error);
332 }
333 
334 int
335 semctl1(struct proc *p, int semid, int semnum, int cmd, void *v,
336     register_t *retval)
337 {
338 	struct ucred *cred = p->p_ucred;
339 	union __semun *arg = v;
340 	struct semid_ds *sembuf = v, *semaptr;
341 	int i, error, ix;
342 
343 	SEM_PRINTF(("call to semctl(%d, %d, %d, %p)\n",
344 	    semid, semnum, cmd, v));
345 
346 	ix = IPCID_TO_IX(semid);
347 	if (ix < 0 || ix >= seminfo.semmni)
348 		return (EINVAL);
349 
350 	semaptr = &sema[ix];
351 	if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
352 	    semaptr->sem_perm._seq != IPCID_TO_SEQ(semid))
353 		return (EINVAL);
354 
355 	switch (cmd) {
356 	case IPC_RMID:
357 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)) != 0)
358 			return (error);
359 		semaptr->sem_perm.cuid = cred->cr_uid;
360 		semaptr->sem_perm.uid = cred->cr_uid;
361 		semtot -= semaptr->sem_nsems;
362 		for (i = semaptr->_sem_base - sem; i < semtot; i++)
363 			sem[i] = sem[i + semaptr->sem_nsems];
364 		for (i = 0; i < seminfo.semmni; i++) {
365 			if ((sema[i].sem_perm.mode & SEM_ALLOC) &&
366 			    sema[i]._sem_base > semaptr->_sem_base)
367 				sema[i]._sem_base -= semaptr->sem_nsems;
368 		}
369 		semaptr->sem_perm.mode = 0;
370 		semundo_clear(ix, -1);
371 		wakeup(semaptr);
372 		break;
373 
374 	case IPC_SET:
375 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)))
376 			return (error);
377 		semaptr->sem_perm.uid = sembuf->sem_perm.uid;
378 		semaptr->sem_perm.gid = sembuf->sem_perm.gid;
379 		semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) |
380 		    (sembuf->sem_perm.mode & 0777);
381 		semaptr->sem_ctime = time.tv_sec;
382 		break;
383 
384 	case IPC_STAT:
385 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
386 			return (error);
387 		memcpy(sembuf, semaptr, sizeof(struct semid_ds));
388 		break;
389 
390 	case GETNCNT:
391 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
392 			return (error);
393 		if (semnum < 0 || semnum >= semaptr->sem_nsems)
394 			return (EINVAL);
395 		*retval = semaptr->_sem_base[semnum].semncnt;
396 		break;
397 
398 	case GETPID:
399 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
400 			return (error);
401 		if (semnum < 0 || semnum >= semaptr->sem_nsems)
402 			return (EINVAL);
403 		*retval = semaptr->_sem_base[semnum].sempid;
404 		break;
405 
406 	case GETVAL:
407 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
408 			return (error);
409 		if (semnum < 0 || semnum >= semaptr->sem_nsems)
410 			return (EINVAL);
411 		*retval = semaptr->_sem_base[semnum].semval;
412 		break;
413 
414 	case GETALL:
415 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
416 			return (error);
417 		for (i = 0; i < semaptr->sem_nsems; i++) {
418 			error = copyout(&semaptr->_sem_base[i].semval,
419 			    &arg->array[i], sizeof(arg->array[i]));
420 			if (error != 0)
421 				break;
422 		}
423 		break;
424 
425 	case GETZCNT:
426 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
427 			return (error);
428 		if (semnum < 0 || semnum >= semaptr->sem_nsems)
429 			return (EINVAL);
430 		*retval = semaptr->_sem_base[semnum].semzcnt;
431 		break;
432 
433 	case SETVAL:
434 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
435 			return (error);
436 		if (semnum < 0 || semnum >= semaptr->sem_nsems)
437 			return (EINVAL);
438 		semaptr->_sem_base[semnum].semval = arg->val;
439 		semundo_clear(ix, semnum);
440 		wakeup(semaptr);
441 		break;
442 
443 	case SETALL:
444 		if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
445 			return (error);
446 		for (i = 0; i < semaptr->sem_nsems; i++) {
447 			error = copyin(&arg->array[i],
448 			    &semaptr->_sem_base[i].semval,
449 			    sizeof(arg->array[i]));
450 			if (error != 0)
451 				break;
452 		}
453 		semundo_clear(ix, -1);
454 		wakeup(semaptr);
455 		break;
456 
457 	default:
458 		return (EINVAL);
459 	}
460 
461 	return (error);
462 }
463 
464 int
465 sys_semget(struct lwp *l, void *v, register_t *retval)
466 {
467 	struct sys_semget_args /* {
468 		syscallarg(key_t) key;
469 		syscallarg(int) nsems;
470 		syscallarg(int) semflg;
471 	} */ *uap = v;
472 	int semid, eval;
473 	int key = SCARG(uap, key);
474 	int nsems = SCARG(uap, nsems);
475 	int semflg = SCARG(uap, semflg);
476 	struct ucred *cred = l->l_proc->p_ucred;
477 
478 	SEM_PRINTF(("semget(0x%x, %d, 0%o)\n", key, nsems, semflg));
479 
480 	if (key != IPC_PRIVATE) {
481 		for (semid = 0; semid < seminfo.semmni; semid++) {
482 			if ((sema[semid].sem_perm.mode & SEM_ALLOC) &&
483 			    sema[semid].sem_perm._key == key)
484 				break;
485 		}
486 		if (semid < seminfo.semmni) {
487 			SEM_PRINTF(("found public key\n"));
488 			if ((eval = ipcperm(cred, &sema[semid].sem_perm,
489 			    semflg & 0700)))
490 				return (eval);
491 			if (nsems > 0 && sema[semid].sem_nsems < nsems) {
492 				SEM_PRINTF(("too small\n"));
493 				return (EINVAL);
494 			}
495 			if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) {
496 				SEM_PRINTF(("not exclusive\n"));
497 				return (EEXIST);
498 			}
499 			goto found;
500 		}
501 	}
502 
503 	SEM_PRINTF(("need to allocate the semid_ds\n"));
504 	if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) {
505 		if (nsems <= 0 || nsems > seminfo.semmsl) {
506 			SEM_PRINTF(("nsems out of range (0<%d<=%d)\n", nsems,
507 			    seminfo.semmsl));
508 			return (EINVAL);
509 		}
510 		if (nsems > seminfo.semmns - semtot) {
511 			SEM_PRINTF(("not enough semaphores left "
512 			    "(need %d, got %d)\n",
513 			    nsems, seminfo.semmns - semtot));
514 			return (ENOSPC);
515 		}
516 		for (semid = 0; semid < seminfo.semmni; semid++) {
517 			if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0)
518 				break;
519 		}
520 		if (semid == seminfo.semmni) {
521 			SEM_PRINTF(("no more semid_ds's available\n"));
522 			return (ENOSPC);
523 		}
524 		SEM_PRINTF(("semid %d is available\n", semid));
525 		sema[semid].sem_perm._key = key;
526 		sema[semid].sem_perm.cuid = cred->cr_uid;
527 		sema[semid].sem_perm.uid = cred->cr_uid;
528 		sema[semid].sem_perm.cgid = cred->cr_gid;
529 		sema[semid].sem_perm.gid = cred->cr_gid;
530 		sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
531 		sema[semid].sem_perm._seq =
532 		    (sema[semid].sem_perm._seq + 1) & 0x7fff;
533 		sema[semid].sem_nsems = nsems;
534 		sema[semid].sem_otime = 0;
535 		sema[semid].sem_ctime = time.tv_sec;
536 		sema[semid]._sem_base = &sem[semtot];
537 		semtot += nsems;
538 		memset(sema[semid]._sem_base, 0,
539 		    sizeof(sema[semid]._sem_base[0]) * nsems);
540 		SEM_PRINTF(("sembase = %p, next = %p\n", sema[semid]._sem_base,
541 		    &sem[semtot]));
542 	} else {
543 		SEM_PRINTF(("didn't find it and wasn't asked to create it\n"));
544 		return (ENOENT);
545 	}
546 
547 found:
548 	*retval = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm);
549 	return (0);
550 }
551 
552 #define SMALL_SOPS 8
553 
554 int
555 sys_semop(struct lwp *l, void *v, register_t *retval)
556 {
557 	struct sys_semop_args /* {
558 		syscallarg(int) semid;
559 		syscallarg(struct sembuf *) sops;
560 		syscallarg(size_t) nsops;
561 	} */ *uap = v;
562 	struct proc *p = l->l_proc;
563 	int semid = SCARG(uap, semid), seq;
564 	size_t nsops = SCARG(uap, nsops);
565 	struct sembuf small_sops[SMALL_SOPS];
566 	struct sembuf *sops;
567 	struct semid_ds *semaptr;
568 	struct sembuf *sopptr = NULL;
569 	struct __sem *semptr = NULL;
570 	struct sem_undo *suptr = NULL;
571 	struct ucred *cred = p->p_ucred;
572 	int i, eval;
573 	int do_wakeup, do_undos;
574 
575 	SEM_PRINTF(("call to semop(%d, %p, %zd)\n", semid, SCARG(uap,sops), nsops));
576 
577 	semid = IPCID_TO_IX(semid);	/* Convert back to zero origin */
578 	if (semid < 0 || semid >= seminfo.semmni)
579 		return (EINVAL);
580 
581 	semaptr = &sema[semid];
582 	seq = IPCID_TO_SEQ(SCARG(uap, semid));
583 	if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
584 	    semaptr->sem_perm._seq != seq)
585 		return (EINVAL);
586 
587 	if ((eval = ipcperm(cred, &semaptr->sem_perm, IPC_W))) {
588 		SEM_PRINTF(("eval = %d from ipaccess\n", eval));
589 		return (eval);
590 	}
591 
592 	if (nsops <= SMALL_SOPS) {
593 		sops = small_sops;
594 	} else if (nsops <= seminfo.semopm) {
595 		sops = malloc(nsops * sizeof(*sops), M_TEMP, M_WAITOK);
596 	} else {
597 		SEM_PRINTF(("too many sops (max=%d, nsops=%zd)\n",
598 		    seminfo.semopm, nsops));
599 		return (E2BIG);
600 	}
601 
602 	if ((eval = copyin(SCARG(uap, sops),
603 	    sops, nsops * sizeof(sops[0]))) != 0) {
604 		SEM_PRINTF(("eval = %d from copyin(%p, %p, %zd)\n", eval,
605 		    SCARG(uap, sops), &sops, nsops * sizeof(sops[0])));
606 		goto out;
607 	}
608 
609 	for (i = 0; i < nsops; i++)
610 		if (sops[i].sem_num >= semaptr->sem_nsems) {
611 			eval = EFBIG;
612 			goto out;
613 		}
614 
615 	/*
616 	 * Loop trying to satisfy the vector of requests.
617 	 * If we reach a point where we must wait, any requests already
618 	 * performed are rolled back and we go to sleep until some other
619 	 * process wakes us up.  At this point, we start all over again.
620 	 *
621 	 * This ensures that from the perspective of other tasks, a set
622 	 * of requests is atomic (never partially satisfied).
623 	 */
624 	do_undos = 0;
625 
626 	for (;;) {
627 		do_wakeup = 0;
628 
629 		for (i = 0; i < nsops; i++) {
630 			sopptr = &sops[i];
631 			semptr = &semaptr->_sem_base[sopptr->sem_num];
632 
633 			SEM_PRINTF(("semop:  semaptr=%p, sem_base=%p, "
634 			    "semptr=%p, sem[%d]=%d : op=%d, flag=%s\n",
635 			    semaptr, semaptr->_sem_base, semptr,
636 			    sopptr->sem_num, semptr->semval, sopptr->sem_op,
637 			    (sopptr->sem_flg & IPC_NOWAIT) ?
638 			    "nowait" : "wait"));
639 
640 			if (sopptr->sem_op < 0) {
641 				if ((int)(semptr->semval +
642 				    sopptr->sem_op) < 0) {
643 					SEM_PRINTF(("semop:  "
644 					    "can't do it now\n"));
645 					break;
646 				} else {
647 					semptr->semval += sopptr->sem_op;
648 					if (semptr->semval == 0 &&
649 					    semptr->semzcnt > 0)
650 						do_wakeup = 1;
651 				}
652 				if (sopptr->sem_flg & SEM_UNDO)
653 					do_undos = 1;
654 			} else if (sopptr->sem_op == 0) {
655 				if (semptr->semval > 0) {
656 					SEM_PRINTF(("semop:  not zero now\n"));
657 					break;
658 				}
659 			} else {
660 				if (semptr->semncnt > 0)
661 					do_wakeup = 1;
662 				semptr->semval += sopptr->sem_op;
663 				if (sopptr->sem_flg & SEM_UNDO)
664 					do_undos = 1;
665 			}
666 		}
667 
668 		/*
669 		 * Did we get through the entire vector?
670 		 */
671 		if (i >= nsops)
672 			goto done;
673 
674 		/*
675 		 * No ... rollback anything that we've already done
676 		 */
677 		SEM_PRINTF(("semop:  rollback 0 through %d\n", i - 1));
678 		while (i-- > 0)
679 			semaptr->_sem_base[sops[i].sem_num].semval -=
680 			    sops[i].sem_op;
681 
682 		/*
683 		 * If the request that we couldn't satisfy has the
684 		 * NOWAIT flag set then return with EAGAIN.
685 		 */
686 		if (sopptr->sem_flg & IPC_NOWAIT) {
687 			eval = EAGAIN;
688 			goto out;
689 		}
690 
691 		if (sopptr->sem_op == 0)
692 			semptr->semzcnt++;
693 		else
694 			semptr->semncnt++;
695 
696 		SEM_PRINTF(("semop:  good night!\n"));
697 		eval = tsleep((caddr_t)semaptr, (PZERO - 4) | PCATCH,
698 		    "semwait", 0);
699 		SEM_PRINTF(("semop:  good morning (eval=%d)!\n", eval));
700 
701 		/*
702 		 * Make sure that the semaphore still exists
703 		 */
704 		if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
705 		    semaptr->sem_perm._seq != seq) {
706 			eval = EIDRM;
707 			goto out;
708 		}
709 
710 		/*
711 		 * The semaphore is still alive.  Readjust the count of
712 		 * waiting processes.
713 		 */
714 		semptr = &semaptr->_sem_base[sopptr->sem_num];
715 		if (sopptr->sem_op == 0)
716 			semptr->semzcnt--;
717 		else
718 			semptr->semncnt--;
719 		/*
720 		 * Is it really morning, or was our sleep interrupted?
721 		 * (Delayed check of tsleep() return code because we
722 		 * need to decrement sem[nz]cnt either way.)
723 		 */
724 		if (eval != 0) {
725 			eval = EINTR;
726 			goto out;
727 		}
728 		SEM_PRINTF(("semop:  good morning!\n"));
729 	}
730 
731 done:
732 	/*
733 	 * Process any SEM_UNDO requests.
734 	 */
735 	if (do_undos) {
736 		for (i = 0; i < nsops; i++) {
737 			/*
738 			 * We only need to deal with SEM_UNDO's for non-zero
739 			 * op's.
740 			 */
741 			int adjval;
742 
743 			if ((sops[i].sem_flg & SEM_UNDO) == 0)
744 				continue;
745 			adjval = sops[i].sem_op;
746 			if (adjval == 0)
747 				continue;
748 			eval = semundo_adjust(p, &suptr, semid,
749 			    sops[i].sem_num, -adjval);
750 			if (eval == 0)
751 				continue;
752 
753 			/*
754 			 * Oh-Oh!  We ran out of either sem_undo's or undo's.
755 			 * Rollback the adjustments to this point and then
756 			 * rollback the semaphore ups and down so we can return
757 			 * with an error with all structures restored.  We
758 			 * rollback the undo's in the exact reverse order that
759 			 * we applied them.  This guarantees that we won't run
760 			 * out of space as we roll things back out.
761 			 */
762 			while (i-- > 0) {
763 				if ((sops[i].sem_flg & SEM_UNDO) == 0)
764 					continue;
765 				adjval = sops[i].sem_op;
766 				if (adjval == 0)
767 					continue;
768 				if (semundo_adjust(p, &suptr, semid,
769 				    sops[i].sem_num, adjval) != 0)
770 					panic("semop - can't undo undos");
771 			}
772 
773 			for (i = 0; i < nsops; i++)
774 				semaptr->_sem_base[sops[i].sem_num].semval -=
775 				    sops[i].sem_op;
776 
777 			SEM_PRINTF(("eval = %d from semundo_adjust\n", eval));
778 			goto out;
779 		} /* loop through the sops */
780 	} /* if (do_undos) */
781 
782 	/* We're definitely done - set the sempid's */
783 	for (i = 0; i < nsops; i++) {
784 		sopptr = &sops[i];
785 		semptr = &semaptr->_sem_base[sopptr->sem_num];
786 		semptr->sempid = p->p_pid;
787 	}
788 
789 	/* Update sem_otime */
790 	semaptr->sem_otime = time.tv_sec;
791 
792 	/* Do a wakeup if any semaphore was up'd. */
793 	if (do_wakeup) {
794 		SEM_PRINTF(("semop:  doing wakeup\n"));
795 #ifdef SEM_WAKEUP
796 		sem_wakeup((caddr_t)semaptr);
797 #else
798 		wakeup((caddr_t)semaptr);
799 #endif
800 		SEM_PRINTF(("semop:  back from wakeup\n"));
801 	}
802 	SEM_PRINTF(("semop:  done\n"));
803 	*retval = 0;
804 
805 out:
806 	if (sops != small_sops) {
807 		free(sops, M_TEMP);
808 	}
809 	return eval;
810 }
811 
812 /*
813  * Go through the undo structures for this process and apply the
814  * adjustments to semaphores.
815  */
816 /*ARGSUSED*/
817 void
818 semexit(struct proc *p, void *v)
819 {
820 	struct sem_undo *suptr;
821 	struct sem_undo **supptr;
822 
823 	/*
824 	 * Go through the chain of undo vectors looking for one
825 	 * associated with this process.
826 	 */
827 
828 	for (supptr = &semu_list; (suptr = *supptr) != NULL;
829 	    supptr = &suptr->un_next) {
830 		if (suptr->un_proc == p)
831 			break;
832 	}
833 
834 	/*
835 	 * If there is no undo vector, skip to the end.
836 	 */
837 
838 	if (suptr == NULL)
839 		return;
840 
841 	/*
842 	 * We now have an undo vector for this process.
843 	 */
844 
845 	SEM_PRINTF(("proc @%p has undo structure with %d entries\n", p,
846 	    suptr->un_cnt));
847 
848 	/*
849 	 * If there are any active undo elements then process them.
850 	 */
851 	if (suptr->un_cnt > 0) {
852 		int ix;
853 
854 		for (ix = 0; ix < suptr->un_cnt; ix++) {
855 			int semid = suptr->un_ent[ix].un_id;
856 			int semnum = suptr->un_ent[ix].un_num;
857 			int adjval = suptr->un_ent[ix].un_adjval;
858 			struct semid_ds *semaptr;
859 
860 			semaptr = &sema[semid];
861 			if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0)
862 				panic("semexit - semid not allocated");
863 			if (semnum >= semaptr->sem_nsems)
864 				panic("semexit - semnum out of range");
865 
866 			SEM_PRINTF(("semexit:  %p id=%d num=%d(adj=%d) ; "
867 			    "sem=%d\n",
868 			    suptr->un_proc, suptr->un_ent[ix].un_id,
869 			    suptr->un_ent[ix].un_num,
870 			    suptr->un_ent[ix].un_adjval,
871 			    semaptr->_sem_base[semnum].semval));
872 
873 			if (adjval < 0 &&
874 			    semaptr->_sem_base[semnum].semval < -adjval)
875 				semaptr->_sem_base[semnum].semval = 0;
876 			else
877 				semaptr->_sem_base[semnum].semval += adjval;
878 
879 #ifdef SEM_WAKEUP
880 			sem_wakeup((caddr_t)semaptr);
881 #else
882 			wakeup((caddr_t)semaptr);
883 #endif
884 			SEM_PRINTF(("semexit:  back from wakeup\n"));
885 		}
886 	}
887 
888 	/*
889 	 * Deallocate the undo vector.
890 	 */
891 	SEM_PRINTF(("removing vector\n"));
892 	suptr->un_proc = NULL;
893 	*supptr = suptr->un_next;
894 }
895