1 /* $FreeBSD$ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/lock.h> 19 #include <sys/mutex.h> 20 #include <sys/sem.h> 21 #include <sys/syscall.h> 22 #include <sys/sysent.h> 23 #include <sys/sysctl.h> 24 #include <sys/malloc.h> 25 #include <sys/jail.h> 26 27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29 static void seminit __P((void)); 30 static int sysvsem_modload __P((struct module *, int, void *)); 31 static int semunload __P((void)); 32 static void semexit_myhook __P((struct proc *p)); 33 static int sysctl_sema __P((SYSCTL_HANDLER_ARGS)); 34 35 #ifndef _SYS_SYSPROTO_H_ 36 struct __semctl_args; 37 int __semctl __P((struct thread *td, struct __semctl_args *uap)); 38 struct semget_args; 39 int semget __P((struct thread *td, struct semget_args *uap)); 40 struct semop_args; 41 int semop __P((struct thread *td, struct semop_args *uap)); 42 #endif 43 44 static struct sem_undo *semu_alloc __P((struct thread *td)); 45 static int semundo_adjust __P((struct thread *td, struct sem_undo **supptr, 46 int semid, int semnum, int adjval)); 47 static void semundo_clear __P((int semid, int semnum)); 48 49 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 50 static sy_call_t *semcalls[] = { 51 (sy_call_t *)__semctl, (sy_call_t *)semget, 52 (sy_call_t *)semop 53 }; 54 55 static int semtot = 0; 56 static struct semid_ds *sema; /* semaphore id pool */ 57 static struct sem *sem; /* semaphore pool */ 58 static struct sem_undo *semu_list; /* list of active undo structures */ 59 static int *semu; /* undo structure pool */ 60 61 struct sem { 62 u_short semval; /* semaphore value */ 63 pid_t sempid; /* pid of last operation */ 64 u_short semncnt; /* # awaiting semval > cval */ 65 u_short semzcnt; /* # awaiting semval = 0 */ 66 }; 67 68 /* 69 * Undo structure (one per process) 70 */ 71 struct sem_undo { 72 struct sem_undo *un_next; /* ptr to next active undo structure */ 73 struct proc *un_proc; /* owner of this structure */ 74 short un_cnt; /* # of active entries */ 75 struct undo { 76 short un_adjval; /* adjust on exit values */ 77 short un_num; /* semaphore # */ 78 int un_id; /* semid */ 79 } un_ent[1]; /* undo entries */ 80 }; 81 82 /* 83 * Configuration parameters 84 */ 85 #ifndef SEMMNI 86 #define SEMMNI 10 /* # of semaphore identifiers */ 87 #endif 88 #ifndef SEMMNS 89 #define SEMMNS 60 /* # of semaphores in system */ 90 #endif 91 #ifndef SEMUME 92 #define SEMUME 10 /* max # of undo entries per process */ 93 #endif 94 #ifndef SEMMNU 95 #define SEMMNU 30 /* # of undo structures in system */ 96 #endif 97 98 /* shouldn't need tuning */ 99 #ifndef SEMMAP 100 #define SEMMAP 30 /* # of entries in semaphore map */ 101 #endif 102 #ifndef SEMMSL 103 #define SEMMSL SEMMNS /* max # of semaphores per id */ 104 #endif 105 #ifndef SEMOPM 106 #define SEMOPM 100 /* max # of operations per semop call */ 107 #endif 108 109 #define SEMVMX 32767 /* semaphore maximum value */ 110 #define SEMAEM 16384 /* adjust on exit max value */ 111 112 /* 113 * Due to the way semaphore memory is allocated, we have to ensure that 114 * SEMUSZ is properly aligned. 115 */ 116 117 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 118 119 /* actual size of an undo structure */ 120 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 121 122 /* 123 * Macro to find a particular sem_undo vector 124 */ 125 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 126 127 /* 128 * semaphore info struct 129 */ 130 struct seminfo seminfo = { 131 SEMMAP, /* # of entries in semaphore map */ 132 SEMMNI, /* # of semaphore identifiers */ 133 SEMMNS, /* # of semaphores in system */ 134 SEMMNU, /* # of undo structures in system */ 135 SEMMSL, /* max # of semaphores per id */ 136 SEMOPM, /* max # of operations per semop call */ 137 SEMUME, /* max # of undo entries per process */ 138 SEMUSZ, /* size in bytes of undo structure */ 139 SEMVMX, /* semaphore maximum value */ 140 SEMAEM /* adjust on exit max value */ 141 }; 142 143 SYSCTL_DECL(_kern_ipc); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 150 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 152 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 154 SYSCTL_PROC(_kern_ipc, OID_AUTO, sema, CTLFLAG_RD, 155 NULL, 0, sysctl_sema, "", ""); 156 157 #if 0 158 RO seminfo.semmap /* SEMMAP unused */ 159 RO seminfo.semmni 160 RO seminfo.semmns 161 RO seminfo.semmnu /* undo entries per system */ 162 RW seminfo.semmsl 163 RO seminfo.semopm /* SEMOPM unused */ 164 RO seminfo.semume 165 RO seminfo.semusz /* param - derived from SEMUME for per-proc sizeof */ 166 RO seminfo.semvmx /* SEMVMX unused - user param */ 167 RO seminfo.semaem /* SEMAEM unused - user param */ 168 #endif 169 170 static void 171 seminit(void) 172 { 173 register int i; 174 175 TUNABLE_INT_FETCH("kern.ipc.semmap", &seminfo.semmap); 176 TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni); 177 TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns); 178 TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu); 179 TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl); 180 TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm); 181 TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume); 182 TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz); 183 TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx); 184 TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem); 185 186 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 187 if (sem == NULL) 188 panic("sem is NULL"); 189 sema = malloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 190 if (sema == NULL) 191 panic("sema is NULL"); 192 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 193 if (semu == NULL) 194 panic("semu is NULL"); 195 196 for (i = 0; i < seminfo.semmni; i++) { 197 sema[i].sem_base = 0; 198 sema[i].sem_perm.mode = 0; 199 } 200 for (i = 0; i < seminfo.semmnu; i++) { 201 register struct sem_undo *suptr = SEMU(i); 202 suptr->un_proc = NULL; 203 } 204 semu_list = NULL; 205 semexit_hook = &semexit_myhook; 206 } 207 208 static int 209 semunload(void) 210 { 211 212 if (semtot != 0) 213 return (EBUSY); 214 215 free(sem, M_SEM); 216 free(sema, M_SEM); 217 free(semu, M_SEM); 218 semexit_hook = NULL; 219 return (0); 220 } 221 222 static int 223 sysvsem_modload(struct module *module, int cmd, void *arg) 224 { 225 int error = 0; 226 227 switch (cmd) { 228 case MOD_LOAD: 229 seminit(); 230 break; 231 case MOD_UNLOAD: 232 error = semunload(); 233 break; 234 case MOD_SHUTDOWN: 235 break; 236 default: 237 error = EINVAL; 238 break; 239 } 240 return (error); 241 } 242 243 static moduledata_t sysvsem_mod = { 244 "sysvsem", 245 &sysvsem_modload, 246 NULL 247 }; 248 249 SYSCALL_MODULE_HELPER(semsys, 5); 250 SYSCALL_MODULE_HELPER(__semctl, 4); 251 SYSCALL_MODULE_HELPER(semget, 3); 252 SYSCALL_MODULE_HELPER(semop, 3); 253 254 DECLARE_MODULE(sysvsem, sysvsem_mod, 255 SI_SUB_SYSV_SEM, SI_ORDER_FIRST); 256 MODULE_VERSION(sysvsem, 1); 257 258 /* 259 * Entry point for all SEM calls 260 * 261 * MPSAFE 262 */ 263 int 264 semsys(td, uap) 265 struct thread *td; 266 /* XXX actually varargs. */ 267 struct semsys_args /* { 268 u_int which; 269 int a2; 270 int a3; 271 int a4; 272 int a5; 273 } */ *uap; 274 { 275 int error; 276 277 mtx_lock(&Giant); 278 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 279 error = ENOSYS; 280 goto done2; 281 } 282 if (uap->which >= sizeof(semcalls)/sizeof(semcalls[0])) { 283 error = EINVAL; 284 goto done2; 285 } 286 error = (*semcalls[uap->which])(td, &uap->a2); 287 done2: 288 mtx_unlock(&Giant); 289 return (error); 290 } 291 292 /* 293 * Allocate a new sem_undo structure for a process 294 * (returns ptr to structure or NULL if no more room) 295 */ 296 297 static struct sem_undo * 298 semu_alloc(td) 299 struct thread *td; 300 { 301 register int i; 302 register struct sem_undo *suptr; 303 register struct sem_undo **supptr; 304 int attempt; 305 306 /* 307 * Try twice to allocate something. 308 * (we'll purge any empty structures after the first pass so 309 * two passes are always enough) 310 */ 311 312 for (attempt = 0; attempt < 2; attempt++) { 313 /* 314 * Look for a free structure. 315 * Fill it in and return it if we find one. 316 */ 317 318 for (i = 0; i < seminfo.semmnu; i++) { 319 suptr = SEMU(i); 320 if (suptr->un_proc == NULL) { 321 suptr->un_next = semu_list; 322 semu_list = suptr; 323 suptr->un_cnt = 0; 324 suptr->un_proc = td->td_proc; 325 return(suptr); 326 } 327 } 328 329 /* 330 * We didn't find a free one, if this is the first attempt 331 * then try to free some structures. 332 */ 333 334 if (attempt == 0) { 335 /* All the structures are in use - try to free some */ 336 int did_something = 0; 337 338 supptr = &semu_list; 339 while ((suptr = *supptr) != NULL) { 340 if (suptr->un_cnt == 0) { 341 suptr->un_proc = NULL; 342 *supptr = suptr->un_next; 343 did_something = 1; 344 } else 345 supptr = &(suptr->un_next); 346 } 347 348 /* If we didn't free anything then just give-up */ 349 if (!did_something) 350 return(NULL); 351 } else { 352 /* 353 * The second pass failed even though we freed 354 * something after the first pass! 355 * This is IMPOSSIBLE! 356 */ 357 panic("semu_alloc - second attempt failed"); 358 } 359 } 360 return (NULL); 361 } 362 363 /* 364 * Adjust a particular entry for a particular proc 365 */ 366 367 static int 368 semundo_adjust(td, supptr, semid, semnum, adjval) 369 register struct thread *td; 370 struct sem_undo **supptr; 371 int semid, semnum; 372 int adjval; 373 { 374 struct proc *p = td->td_proc; 375 register struct sem_undo *suptr; 376 register struct undo *sunptr; 377 int i; 378 379 /* Look for and remember the sem_undo if the caller doesn't provide 380 it */ 381 382 suptr = *supptr; 383 if (suptr == NULL) { 384 for (suptr = semu_list; suptr != NULL; 385 suptr = suptr->un_next) { 386 if (suptr->un_proc == p) { 387 *supptr = suptr; 388 break; 389 } 390 } 391 if (suptr == NULL) { 392 if (adjval == 0) 393 return(0); 394 suptr = semu_alloc(td); 395 if (suptr == NULL) 396 return(ENOSPC); 397 *supptr = suptr; 398 } 399 } 400 401 /* 402 * Look for the requested entry and adjust it (delete if adjval becomes 403 * 0). 404 */ 405 sunptr = &suptr->un_ent[0]; 406 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 407 if (sunptr->un_id != semid || sunptr->un_num != semnum) 408 continue; 409 if (adjval == 0) 410 sunptr->un_adjval = 0; 411 else 412 sunptr->un_adjval += adjval; 413 if (sunptr->un_adjval == 0) { 414 suptr->un_cnt--; 415 if (i < suptr->un_cnt) 416 suptr->un_ent[i] = 417 suptr->un_ent[suptr->un_cnt]; 418 } 419 return(0); 420 } 421 422 /* Didn't find the right entry - create it */ 423 if (adjval == 0) 424 return(0); 425 if (suptr->un_cnt != seminfo.semume) { 426 sunptr = &suptr->un_ent[suptr->un_cnt]; 427 suptr->un_cnt++; 428 sunptr->un_adjval = adjval; 429 sunptr->un_id = semid; sunptr->un_num = semnum; 430 } else 431 return(EINVAL); 432 return(0); 433 } 434 435 static void 436 semundo_clear(semid, semnum) 437 int semid, semnum; 438 { 439 register struct sem_undo *suptr; 440 441 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 442 register struct undo *sunptr = &suptr->un_ent[0]; 443 register int i = 0; 444 445 while (i < suptr->un_cnt) { 446 if (sunptr->un_id == semid) { 447 if (semnum == -1 || sunptr->un_num == semnum) { 448 suptr->un_cnt--; 449 if (i < suptr->un_cnt) { 450 suptr->un_ent[i] = 451 suptr->un_ent[suptr->un_cnt]; 452 continue; 453 } 454 } 455 if (semnum != -1) 456 break; 457 } 458 i++, sunptr++; 459 } 460 } 461 } 462 463 /* 464 * Note that the user-mode half of this passes a union, not a pointer 465 */ 466 #ifndef _SYS_SYSPROTO_H_ 467 struct __semctl_args { 468 int semid; 469 int semnum; 470 int cmd; 471 union semun *arg; 472 }; 473 #endif 474 475 /* 476 * MPSAFE 477 */ 478 int 479 __semctl(td, uap) 480 struct thread *td; 481 register struct __semctl_args *uap; 482 { 483 int semid = uap->semid; 484 int semnum = uap->semnum; 485 int cmd = uap->cmd; 486 union semun *arg = uap->arg; 487 union semun real_arg; 488 struct ucred *cred = td->td_proc->p_ucred; 489 int i, rval, error; 490 struct semid_ds sbuf; 491 register struct semid_ds *semaptr; 492 493 #ifdef SEM_DEBUG 494 printf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 495 #endif 496 mtx_lock(&Giant); 497 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 498 error = ENOSYS; 499 goto done2; 500 } 501 502 switch(cmd) { 503 case SEM_STAT: 504 if (semid < 0 || semid >= seminfo.semmsl) 505 return(EINVAL); 506 semaptr = &sema[semid]; 507 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ) 508 return(EINVAL); 509 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 510 return(error); 511 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 512 return(error); 513 error = copyout((caddr_t)semaptr, real_arg.buf, 514 sizeof(struct semid_ds)); 515 rval = IXSEQ_TO_IPCID(semid,semaptr->sem_perm); 516 if (error == 0) 517 td->td_retval[0] = rval; 518 goto done2; 519 } 520 521 semid = IPCID_TO_IX(semid); 522 if (semid < 0 || semid >= seminfo.semmsl) { 523 error = EINVAL; 524 goto done2; 525 } 526 527 semaptr = &sema[semid]; 528 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 529 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 530 error = EINVAL; 531 goto done2; 532 } 533 534 error = 0; 535 rval = 0; 536 537 switch (cmd) { 538 case IPC_RMID: 539 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 540 goto done2; 541 semaptr->sem_perm.cuid = cred->cr_uid; 542 semaptr->sem_perm.uid = cred->cr_uid; 543 semtot -= semaptr->sem_nsems; 544 for (i = semaptr->sem_base - sem; i < semtot; i++) 545 sem[i] = sem[i + semaptr->sem_nsems]; 546 for (i = 0; i < seminfo.semmni; i++) { 547 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 548 sema[i].sem_base > semaptr->sem_base) 549 sema[i].sem_base -= semaptr->sem_nsems; 550 } 551 semaptr->sem_perm.mode = 0; 552 semundo_clear(semid, -1); 553 wakeup((caddr_t)semaptr); 554 break; 555 556 case IPC_SET: 557 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 558 goto done2; 559 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 560 goto done2; 561 if ((error = copyin(real_arg.buf, (caddr_t)&sbuf, 562 sizeof(sbuf))) != 0) { 563 goto done2; 564 } 565 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 566 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 567 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 568 (sbuf.sem_perm.mode & 0777); 569 semaptr->sem_ctime = time_second; 570 break; 571 572 case IPC_STAT: 573 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 574 goto done2; 575 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 576 goto done2; 577 error = copyout((caddr_t)semaptr, real_arg.buf, 578 sizeof(struct semid_ds)); 579 break; 580 581 case GETNCNT: 582 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 583 goto done2; 584 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 585 error = EINVAL; 586 goto done2; 587 } 588 rval = semaptr->sem_base[semnum].semncnt; 589 break; 590 591 case GETPID: 592 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 593 goto done2; 594 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 595 error = EINVAL; 596 goto done2; 597 } 598 rval = semaptr->sem_base[semnum].sempid; 599 break; 600 601 case GETVAL: 602 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 603 goto done2; 604 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 605 error = EINVAL; 606 goto done2; 607 } 608 rval = semaptr->sem_base[semnum].semval; 609 break; 610 611 case GETALL: 612 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 613 goto done2; 614 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 615 goto done2; 616 for (i = 0; i < semaptr->sem_nsems; i++) { 617 error = copyout((caddr_t)&semaptr->sem_base[i].semval, 618 &real_arg.array[i], sizeof(real_arg.array[0])); 619 if (error != 0) 620 break; 621 } 622 break; 623 624 case GETZCNT: 625 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 626 goto done2; 627 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 628 error = EINVAL; 629 goto done2; 630 } 631 rval = semaptr->sem_base[semnum].semzcnt; 632 break; 633 634 case SETVAL: 635 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 636 goto done2; 637 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 638 error = EINVAL; 639 goto done2; 640 } 641 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 642 goto done2; 643 semaptr->sem_base[semnum].semval = real_arg.val; 644 semundo_clear(semid, semnum); 645 wakeup((caddr_t)semaptr); 646 break; 647 648 case SETALL: 649 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 650 goto done2; 651 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 652 goto done2; 653 for (i = 0; i < semaptr->sem_nsems; i++) { 654 error = copyin(&real_arg.array[i], 655 (caddr_t)&semaptr->sem_base[i].semval, 656 sizeof(real_arg.array[0])); 657 if (error != 0) 658 break; 659 } 660 semundo_clear(semid, -1); 661 wakeup((caddr_t)semaptr); 662 break; 663 664 default: 665 error = EINVAL; 666 break; 667 } 668 669 if (error == 0) 670 td->td_retval[0] = rval; 671 done2: 672 mtx_unlock(&Giant); 673 return(error); 674 } 675 676 #ifndef _SYS_SYSPROTO_H_ 677 struct semget_args { 678 key_t key; 679 int nsems; 680 int semflg; 681 }; 682 #endif 683 684 /* 685 * MPSAFE 686 */ 687 int 688 semget(td, uap) 689 struct thread *td; 690 register struct semget_args *uap; 691 { 692 int semid, error = 0; 693 int key = uap->key; 694 int nsems = uap->nsems; 695 int semflg = uap->semflg; 696 struct ucred *cred = td->td_proc->p_ucred; 697 698 #ifdef SEM_DEBUG 699 printf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 700 #endif 701 mtx_lock(&Giant); 702 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 703 error = ENOSYS; 704 goto done2; 705 } 706 707 if (key != IPC_PRIVATE) { 708 for (semid = 0; semid < seminfo.semmni; semid++) { 709 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 710 sema[semid].sem_perm.key == key) 711 break; 712 } 713 if (semid < seminfo.semmni) { 714 #ifdef SEM_DEBUG 715 printf("found public key\n"); 716 #endif 717 if ((error = ipcperm(td, &sema[semid].sem_perm, 718 semflg & 0700))) { 719 goto done2; 720 } 721 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 722 #ifdef SEM_DEBUG 723 printf("too small\n"); 724 #endif 725 error = EINVAL; 726 goto done2; 727 } 728 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 729 #ifdef SEM_DEBUG 730 printf("not exclusive\n"); 731 #endif 732 error = EEXIST; 733 goto done2; 734 } 735 goto found; 736 } 737 } 738 739 #ifdef SEM_DEBUG 740 printf("need to allocate the semid_ds\n"); 741 #endif 742 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 743 if (nsems <= 0 || nsems > seminfo.semmsl) { 744 #ifdef SEM_DEBUG 745 printf("nsems out of range (0<%d<=%d)\n", nsems, 746 seminfo.semmsl); 747 #endif 748 error = EINVAL; 749 goto done2; 750 } 751 if (nsems > seminfo.semmns - semtot) { 752 #ifdef SEM_DEBUG 753 printf("not enough semaphores left (need %d, got %d)\n", 754 nsems, seminfo.semmns - semtot); 755 #endif 756 error = ENOSPC; 757 goto done2; 758 } 759 for (semid = 0; semid < seminfo.semmni; semid++) { 760 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 761 break; 762 } 763 if (semid == seminfo.semmni) { 764 #ifdef SEM_DEBUG 765 printf("no more semid_ds's available\n"); 766 #endif 767 error = ENOSPC; 768 goto done2; 769 } 770 #ifdef SEM_DEBUG 771 printf("semid %d is available\n", semid); 772 #endif 773 sema[semid].sem_perm.key = key; 774 sema[semid].sem_perm.cuid = cred->cr_uid; 775 sema[semid].sem_perm.uid = cred->cr_uid; 776 sema[semid].sem_perm.cgid = cred->cr_gid; 777 sema[semid].sem_perm.gid = cred->cr_gid; 778 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 779 sema[semid].sem_perm.seq = 780 (sema[semid].sem_perm.seq + 1) & 0x7fff; 781 sema[semid].sem_nsems = nsems; 782 sema[semid].sem_otime = 0; 783 sema[semid].sem_ctime = time_second; 784 sema[semid].sem_base = &sem[semtot]; 785 semtot += nsems; 786 bzero(sema[semid].sem_base, 787 sizeof(sema[semid].sem_base[0])*nsems); 788 #ifdef SEM_DEBUG 789 printf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 790 &sem[semtot]); 791 #endif 792 } else { 793 #ifdef SEM_DEBUG 794 printf("didn't find it and wasn't asked to create it\n"); 795 #endif 796 error = ENOENT; 797 goto done2; 798 } 799 800 found: 801 td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 802 done2: 803 mtx_unlock(&Giant); 804 return (error); 805 } 806 807 #ifndef _SYS_SYSPROTO_H_ 808 struct semop_args { 809 int semid; 810 struct sembuf *sops; 811 u_int nsops; 812 }; 813 #endif 814 815 /* 816 * MPSAFE 817 */ 818 int 819 semop(td, uap) 820 struct thread *td; 821 register struct semop_args *uap; 822 { 823 int semid = uap->semid; 824 u_int nsops = uap->nsops; 825 struct sembuf sops[MAX_SOPS]; 826 register struct semid_ds *semaptr; 827 register struct sembuf *sopptr; 828 register struct sem *semptr; 829 struct sem_undo *suptr = NULL; 830 int i, j, error = 0; 831 int do_wakeup, do_undos; 832 833 #ifdef SEM_DEBUG 834 printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 835 #endif 836 837 mtx_lock(&Giant); 838 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 839 error = ENOSYS; 840 goto done2; 841 } 842 843 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 844 845 if (semid < 0 || semid >= seminfo.semmsl) { 846 error = EINVAL; 847 goto done2; 848 } 849 850 semaptr = &sema[semid]; 851 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 852 error = EINVAL; 853 goto done2; 854 } 855 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 856 error = EINVAL; 857 goto done2; 858 } 859 860 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) { 861 #ifdef SEM_DEBUG 862 printf("error = %d from ipcperm\n", error); 863 #endif 864 goto done2; 865 } 866 867 if (nsops > MAX_SOPS) { 868 #ifdef SEM_DEBUG 869 printf("too many sops (max=%d, nsops=%u)\n", MAX_SOPS, nsops); 870 #endif 871 error = E2BIG; 872 goto done2; 873 } 874 875 if ((error = copyin(uap->sops, &sops, nsops * sizeof(sops[0]))) != 0) { 876 #ifdef SEM_DEBUG 877 printf("error = %d from copyin(%08x, %08x, %u)\n", error, 878 uap->sops, &sops, nsops * sizeof(sops[0])); 879 #endif 880 goto done2; 881 } 882 883 /* 884 * Loop trying to satisfy the vector of requests. 885 * If we reach a point where we must wait, any requests already 886 * performed are rolled back and we go to sleep until some other 887 * process wakes us up. At this point, we start all over again. 888 * 889 * This ensures that from the perspective of other tasks, a set 890 * of requests is atomic (never partially satisfied). 891 */ 892 do_undos = 0; 893 894 for (;;) { 895 do_wakeup = 0; 896 897 for (i = 0; i < nsops; i++) { 898 sopptr = &sops[i]; 899 900 if (sopptr->sem_num >= semaptr->sem_nsems) { 901 error = EFBIG; 902 goto done2; 903 } 904 905 semptr = &semaptr->sem_base[sopptr->sem_num]; 906 907 #ifdef SEM_DEBUG 908 printf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 909 semaptr, semaptr->sem_base, semptr, 910 sopptr->sem_num, semptr->semval, sopptr->sem_op, 911 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 912 #endif 913 914 if (sopptr->sem_op < 0) { 915 if (semptr->semval + sopptr->sem_op < 0) { 916 #ifdef SEM_DEBUG 917 printf("semop: can't do it now\n"); 918 #endif 919 break; 920 } else { 921 semptr->semval += sopptr->sem_op; 922 if (semptr->semval == 0 && 923 semptr->semzcnt > 0) 924 do_wakeup = 1; 925 } 926 if (sopptr->sem_flg & SEM_UNDO) 927 do_undos = 1; 928 } else if (sopptr->sem_op == 0) { 929 if (semptr->semval > 0) { 930 #ifdef SEM_DEBUG 931 printf("semop: not zero now\n"); 932 #endif 933 break; 934 } 935 } else { 936 if (semptr->semncnt > 0) 937 do_wakeup = 1; 938 semptr->semval += sopptr->sem_op; 939 if (sopptr->sem_flg & SEM_UNDO) 940 do_undos = 1; 941 } 942 } 943 944 /* 945 * Did we get through the entire vector? 946 */ 947 if (i >= nsops) 948 goto done; 949 950 /* 951 * No ... rollback anything that we've already done 952 */ 953 #ifdef SEM_DEBUG 954 printf("semop: rollback 0 through %d\n", i-1); 955 #endif 956 for (j = 0; j < i; j++) 957 semaptr->sem_base[sops[j].sem_num].semval -= 958 sops[j].sem_op; 959 960 /* 961 * If the request that we couldn't satisfy has the 962 * NOWAIT flag set then return with EAGAIN. 963 */ 964 if (sopptr->sem_flg & IPC_NOWAIT) { 965 error = EAGAIN; 966 goto done2; 967 } 968 969 if (sopptr->sem_op == 0) 970 semptr->semzcnt++; 971 else 972 semptr->semncnt++; 973 974 #ifdef SEM_DEBUG 975 printf("semop: good night!\n"); 976 #endif 977 error = tsleep((caddr_t)semaptr, (PZERO - 4) | PCATCH, 978 "semwait", 0); 979 #ifdef SEM_DEBUG 980 printf("semop: good morning (error=%d)!\n", error); 981 #endif 982 983 suptr = NULL; /* sem_undo may have been reallocated */ 984 985 if (error != 0) { 986 error = EINTR; 987 goto done2; 988 } 989 #ifdef SEM_DEBUG 990 printf("semop: good morning!\n"); 991 #endif 992 993 /* 994 * Make sure that the semaphore still exists 995 */ 996 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 997 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 998 error = EIDRM; 999 goto done2; 1000 } 1001 1002 /* 1003 * The semaphore is still alive. Readjust the count of 1004 * waiting processes. 1005 */ 1006 if (sopptr->sem_op == 0) 1007 semptr->semzcnt--; 1008 else 1009 semptr->semncnt--; 1010 } 1011 1012 done: 1013 /* 1014 * Process any SEM_UNDO requests. 1015 */ 1016 if (do_undos) { 1017 for (i = 0; i < nsops; i++) { 1018 /* 1019 * We only need to deal with SEM_UNDO's for non-zero 1020 * op's. 1021 */ 1022 int adjval; 1023 1024 if ((sops[i].sem_flg & SEM_UNDO) == 0) 1025 continue; 1026 adjval = sops[i].sem_op; 1027 if (adjval == 0) 1028 continue; 1029 error = semundo_adjust(td, &suptr, semid, 1030 sops[i].sem_num, -adjval); 1031 if (error == 0) 1032 continue; 1033 1034 /* 1035 * Oh-Oh! We ran out of either sem_undo's or undo's. 1036 * Rollback the adjustments to this point and then 1037 * rollback the semaphore ups and down so we can return 1038 * with an error with all structures restored. We 1039 * rollback the undo's in the exact reverse order that 1040 * we applied them. This guarantees that we won't run 1041 * out of space as we roll things back out. 1042 */ 1043 for (j = i - 1; j >= 0; j--) { 1044 if ((sops[j].sem_flg & SEM_UNDO) == 0) 1045 continue; 1046 adjval = sops[j].sem_op; 1047 if (adjval == 0) 1048 continue; 1049 if (semundo_adjust(td, &suptr, semid, 1050 sops[j].sem_num, adjval) != 0) 1051 panic("semop - can't undo undos"); 1052 } 1053 1054 for (j = 0; j < nsops; j++) 1055 semaptr->sem_base[sops[j].sem_num].semval -= 1056 sops[j].sem_op; 1057 1058 #ifdef SEM_DEBUG 1059 printf("error = %d from semundo_adjust\n", error); 1060 #endif 1061 goto done2; 1062 } /* loop through the sops */ 1063 } /* if (do_undos) */ 1064 1065 /* We're definitely done - set the sempid's */ 1066 for (i = 0; i < nsops; i++) { 1067 sopptr = &sops[i]; 1068 semptr = &semaptr->sem_base[sopptr->sem_num]; 1069 semptr->sempid = td->td_proc->p_pid; 1070 } 1071 1072 /* Do a wakeup if any semaphore was up'd. */ 1073 if (do_wakeup) { 1074 #ifdef SEM_DEBUG 1075 printf("semop: doing wakeup\n"); 1076 #endif 1077 wakeup((caddr_t)semaptr); 1078 #ifdef SEM_DEBUG 1079 printf("semop: back from wakeup\n"); 1080 #endif 1081 } 1082 #ifdef SEM_DEBUG 1083 printf("semop: done\n"); 1084 #endif 1085 td->td_retval[0] = 0; 1086 done2: 1087 mtx_unlock(&Giant); 1088 return (error); 1089 } 1090 1091 /* 1092 * Go through the undo structures for this process and apply the adjustments to 1093 * semaphores. 1094 */ 1095 static void 1096 semexit_myhook(p) 1097 struct proc *p; 1098 { 1099 register struct sem_undo *suptr; 1100 register struct sem_undo **supptr; 1101 int did_something; 1102 1103 did_something = 0; 1104 1105 /* 1106 * Go through the chain of undo vectors looking for one 1107 * associated with this process. 1108 */ 1109 1110 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1111 supptr = &suptr->un_next) { 1112 if (suptr->un_proc == p) 1113 break; 1114 } 1115 1116 if (suptr == NULL) 1117 return; 1118 1119 #ifdef SEM_DEBUG 1120 printf("proc @%08x has undo structure with %d entries\n", p, 1121 suptr->un_cnt); 1122 #endif 1123 1124 /* 1125 * If there are any active undo elements then process them. 1126 */ 1127 if (suptr->un_cnt > 0) { 1128 int ix; 1129 1130 for (ix = 0; ix < suptr->un_cnt; ix++) { 1131 int semid = suptr->un_ent[ix].un_id; 1132 int semnum = suptr->un_ent[ix].un_num; 1133 int adjval = suptr->un_ent[ix].un_adjval; 1134 struct semid_ds *semaptr; 1135 1136 semaptr = &sema[semid]; 1137 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1138 panic("semexit - semid not allocated"); 1139 if (semnum >= semaptr->sem_nsems) 1140 panic("semexit - semnum out of range"); 1141 1142 #ifdef SEM_DEBUG 1143 printf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1144 suptr->un_proc, suptr->un_ent[ix].un_id, 1145 suptr->un_ent[ix].un_num, 1146 suptr->un_ent[ix].un_adjval, 1147 semaptr->sem_base[semnum].semval); 1148 #endif 1149 1150 if (adjval < 0) { 1151 if (semaptr->sem_base[semnum].semval < -adjval) 1152 semaptr->sem_base[semnum].semval = 0; 1153 else 1154 semaptr->sem_base[semnum].semval += 1155 adjval; 1156 } else 1157 semaptr->sem_base[semnum].semval += adjval; 1158 1159 wakeup((caddr_t)semaptr); 1160 #ifdef SEM_DEBUG 1161 printf("semexit: back from wakeup\n"); 1162 #endif 1163 } 1164 } 1165 1166 /* 1167 * Deallocate the undo vector. 1168 */ 1169 #ifdef SEM_DEBUG 1170 printf("removing vector\n"); 1171 #endif 1172 suptr->un_proc = NULL; 1173 *supptr = suptr->un_next; 1174 } 1175 1176 static int 1177 sysctl_sema(SYSCTL_HANDLER_ARGS) 1178 { 1179 1180 return (SYSCTL_OUT(req, sema, 1181 sizeof(struct semid_ds) * seminfo.semmni)); 1182 } 1183