1 /* $FreeBSD$ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/lock.h> 19 #include <sys/mutex.h> 20 #include <sys/sem.h> 21 #include <sys/syscall.h> 22 #include <sys/sysent.h> 23 #include <sys/sysctl.h> 24 #include <sys/malloc.h> 25 #include <sys/jail.h> 26 27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29 static void seminit(void); 30 static int sysvsem_modload(struct module *, int, void *); 31 static int semunload(void); 32 static void semexit_myhook(struct proc *p); 33 static int sysctl_sema(SYSCTL_HANDLER_ARGS); 34 35 #ifndef _SYS_SYSPROTO_H_ 36 struct __semctl_args; 37 int __semctl(struct thread *td, struct __semctl_args *uap); 38 struct semget_args; 39 int semget(struct thread *td, struct semget_args *uap); 40 struct semop_args; 41 int semop(struct thread *td, struct semop_args *uap); 42 #endif 43 44 static struct sem_undo *semu_alloc(struct thread *td); 45 static int semundo_adjust(struct thread *td, struct sem_undo **supptr, 46 int semid, int semnum, int adjval); 47 static void semundo_clear(int semid, int semnum); 48 49 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 50 static sy_call_t *semcalls[] = { 51 (sy_call_t *)__semctl, (sy_call_t *)semget, 52 (sy_call_t *)semop 53 }; 54 55 static int semtot = 0; 56 static struct semid_ds *sema; /* semaphore id pool */ 57 static struct sem *sem; /* semaphore pool */ 58 static struct sem_undo *semu_list; /* list of active undo structures */ 59 static int *semu; /* undo structure pool */ 60 61 struct sem { 62 u_short semval; /* semaphore value */ 63 pid_t sempid; /* pid of last operation */ 64 u_short semncnt; /* # awaiting semval > cval */ 65 u_short semzcnt; /* # awaiting semval = 0 */ 66 }; 67 68 /* 69 * Undo structure (one per process) 70 */ 71 struct sem_undo { 72 struct sem_undo *un_next; /* ptr to next active undo structure */ 73 struct proc *un_proc; /* owner of this structure */ 74 short un_cnt; /* # of active entries */ 75 struct undo { 76 short un_adjval; /* adjust on exit values */ 77 short un_num; /* semaphore # */ 78 int un_id; /* semid */ 79 } un_ent[1]; /* undo entries */ 80 }; 81 82 /* 83 * Configuration parameters 84 */ 85 #ifndef SEMMNI 86 #define SEMMNI 10 /* # of semaphore identifiers */ 87 #endif 88 #ifndef SEMMNS 89 #define SEMMNS 60 /* # of semaphores in system */ 90 #endif 91 #ifndef SEMUME 92 #define SEMUME 10 /* max # of undo entries per process */ 93 #endif 94 #ifndef SEMMNU 95 #define SEMMNU 30 /* # of undo structures in system */ 96 #endif 97 98 /* shouldn't need tuning */ 99 #ifndef SEMMAP 100 #define SEMMAP 30 /* # of entries in semaphore map */ 101 #endif 102 #ifndef SEMMSL 103 #define SEMMSL SEMMNS /* max # of semaphores per id */ 104 #endif 105 #ifndef SEMOPM 106 #define SEMOPM 100 /* max # of operations per semop call */ 107 #endif 108 109 #define SEMVMX 32767 /* semaphore maximum value */ 110 #define SEMAEM 16384 /* adjust on exit max value */ 111 112 /* 113 * Due to the way semaphore memory is allocated, we have to ensure that 114 * SEMUSZ is properly aligned. 115 */ 116 117 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 118 119 /* actual size of an undo structure */ 120 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 121 122 /* 123 * Macro to find a particular sem_undo vector 124 */ 125 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 126 127 /* 128 * semaphore info struct 129 */ 130 struct seminfo seminfo = { 131 SEMMAP, /* # of entries in semaphore map */ 132 SEMMNI, /* # of semaphore identifiers */ 133 SEMMNS, /* # of semaphores in system */ 134 SEMMNU, /* # of undo structures in system */ 135 SEMMSL, /* max # of semaphores per id */ 136 SEMOPM, /* max # of operations per semop call */ 137 SEMUME, /* max # of undo entries per process */ 138 SEMUSZ, /* size in bytes of undo structure */ 139 SEMVMX, /* semaphore maximum value */ 140 SEMAEM /* adjust on exit max value */ 141 }; 142 143 SYSCTL_DECL(_kern_ipc); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 150 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 152 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 154 SYSCTL_PROC(_kern_ipc, OID_AUTO, sema, CTLFLAG_RD, 155 NULL, 0, sysctl_sema, "", ""); 156 157 static void 158 seminit(void) 159 { 160 register int i; 161 162 TUNABLE_INT_FETCH("kern.ipc.semmap", &seminfo.semmap); 163 TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni); 164 TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns); 165 TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu); 166 TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl); 167 TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm); 168 TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume); 169 TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz); 170 TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx); 171 TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem); 172 173 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 174 if (sem == NULL) 175 panic("sem is NULL"); 176 sema = malloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 177 if (sema == NULL) 178 panic("sema is NULL"); 179 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 180 if (semu == NULL) 181 panic("semu is NULL"); 182 183 for (i = 0; i < seminfo.semmni; i++) { 184 sema[i].sem_base = 0; 185 sema[i].sem_perm.mode = 0; 186 } 187 for (i = 0; i < seminfo.semmnu; i++) { 188 register struct sem_undo *suptr = SEMU(i); 189 suptr->un_proc = NULL; 190 } 191 semu_list = NULL; 192 at_exit(semexit_myhook); 193 } 194 195 static int 196 semunload(void) 197 { 198 199 if (semtot != 0) 200 return (EBUSY); 201 202 free(sem, M_SEM); 203 free(sema, M_SEM); 204 free(semu, M_SEM); 205 rm_at_exit(semexit_myhook); 206 return (0); 207 } 208 209 static int 210 sysvsem_modload(struct module *module, int cmd, void *arg) 211 { 212 int error = 0; 213 214 switch (cmd) { 215 case MOD_LOAD: 216 seminit(); 217 break; 218 case MOD_UNLOAD: 219 error = semunload(); 220 break; 221 case MOD_SHUTDOWN: 222 break; 223 default: 224 error = EINVAL; 225 break; 226 } 227 return (error); 228 } 229 230 static moduledata_t sysvsem_mod = { 231 "sysvsem", 232 &sysvsem_modload, 233 NULL 234 }; 235 236 SYSCALL_MODULE_HELPER(semsys); 237 SYSCALL_MODULE_HELPER(__semctl); 238 SYSCALL_MODULE_HELPER(semget); 239 SYSCALL_MODULE_HELPER(semop); 240 241 DECLARE_MODULE(sysvsem, sysvsem_mod, 242 SI_SUB_SYSV_SEM, SI_ORDER_FIRST); 243 MODULE_VERSION(sysvsem, 1); 244 245 /* 246 * Entry point for all SEM calls 247 * 248 * MPSAFE 249 */ 250 int 251 semsys(td, uap) 252 struct thread *td; 253 /* XXX actually varargs. */ 254 struct semsys_args /* { 255 u_int which; 256 int a2; 257 int a3; 258 int a4; 259 int a5; 260 } */ *uap; 261 { 262 int error; 263 264 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 265 return (ENOSYS); 266 if (uap->which >= sizeof(semcalls)/sizeof(semcalls[0])) 267 return (EINVAL); 268 mtx_lock(&Giant); 269 error = (*semcalls[uap->which])(td, &uap->a2); 270 mtx_unlock(&Giant); 271 return (error); 272 } 273 274 /* 275 * Allocate a new sem_undo structure for a process 276 * (returns ptr to structure or NULL if no more room) 277 */ 278 279 static struct sem_undo * 280 semu_alloc(td) 281 struct thread *td; 282 { 283 register int i; 284 register struct sem_undo *suptr; 285 register struct sem_undo **supptr; 286 int attempt; 287 288 /* 289 * Try twice to allocate something. 290 * (we'll purge any empty structures after the first pass so 291 * two passes are always enough) 292 */ 293 294 for (attempt = 0; attempt < 2; attempt++) { 295 /* 296 * Look for a free structure. 297 * Fill it in and return it if we find one. 298 */ 299 300 for (i = 0; i < seminfo.semmnu; i++) { 301 suptr = SEMU(i); 302 if (suptr->un_proc == NULL) { 303 suptr->un_next = semu_list; 304 semu_list = suptr; 305 suptr->un_cnt = 0; 306 suptr->un_proc = td->td_proc; 307 return(suptr); 308 } 309 } 310 311 /* 312 * We didn't find a free one, if this is the first attempt 313 * then try to free some structures. 314 */ 315 316 if (attempt == 0) { 317 /* All the structures are in use - try to free some */ 318 int did_something = 0; 319 320 supptr = &semu_list; 321 while ((suptr = *supptr) != NULL) { 322 if (suptr->un_cnt == 0) { 323 suptr->un_proc = NULL; 324 *supptr = suptr->un_next; 325 did_something = 1; 326 } else 327 supptr = &(suptr->un_next); 328 } 329 330 /* If we didn't free anything then just give-up */ 331 if (!did_something) 332 return(NULL); 333 } else { 334 /* 335 * The second pass failed even though we freed 336 * something after the first pass! 337 * This is IMPOSSIBLE! 338 */ 339 panic("semu_alloc - second attempt failed"); 340 } 341 } 342 return (NULL); 343 } 344 345 /* 346 * Adjust a particular entry for a particular proc 347 */ 348 349 static int 350 semundo_adjust(td, supptr, semid, semnum, adjval) 351 register struct thread *td; 352 struct sem_undo **supptr; 353 int semid, semnum; 354 int adjval; 355 { 356 struct proc *p = td->td_proc; 357 register struct sem_undo *suptr; 358 register struct undo *sunptr; 359 int i; 360 361 /* Look for and remember the sem_undo if the caller doesn't provide 362 it */ 363 364 suptr = *supptr; 365 if (suptr == NULL) { 366 for (suptr = semu_list; suptr != NULL; 367 suptr = suptr->un_next) { 368 if (suptr->un_proc == p) { 369 *supptr = suptr; 370 break; 371 } 372 } 373 if (suptr == NULL) { 374 if (adjval == 0) 375 return(0); 376 suptr = semu_alloc(td); 377 if (suptr == NULL) 378 return(ENOSPC); 379 *supptr = suptr; 380 } 381 } 382 383 /* 384 * Look for the requested entry and adjust it (delete if adjval becomes 385 * 0). 386 */ 387 sunptr = &suptr->un_ent[0]; 388 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 389 if (sunptr->un_id != semid || sunptr->un_num != semnum) 390 continue; 391 if (adjval != 0) { 392 adjval += sunptr->un_adjval; 393 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 394 return (ERANGE); 395 } 396 sunptr->un_adjval = adjval; 397 if (sunptr->un_adjval == 0) { 398 suptr->un_cnt--; 399 if (i < suptr->un_cnt) 400 suptr->un_ent[i] = 401 suptr->un_ent[suptr->un_cnt]; 402 } 403 return(0); 404 } 405 406 /* Didn't find the right entry - create it */ 407 if (adjval == 0) 408 return(0); 409 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 410 return (ERANGE); 411 if (suptr->un_cnt != seminfo.semume) { 412 sunptr = &suptr->un_ent[suptr->un_cnt]; 413 suptr->un_cnt++; 414 sunptr->un_adjval = adjval; 415 sunptr->un_id = semid; sunptr->un_num = semnum; 416 } else 417 return(EINVAL); 418 return(0); 419 } 420 421 static void 422 semundo_clear(semid, semnum) 423 int semid, semnum; 424 { 425 register struct sem_undo *suptr; 426 427 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 428 register struct undo *sunptr = &suptr->un_ent[0]; 429 register int i = 0; 430 431 while (i < suptr->un_cnt) { 432 if (sunptr->un_id == semid) { 433 if (semnum == -1 || sunptr->un_num == semnum) { 434 suptr->un_cnt--; 435 if (i < suptr->un_cnt) { 436 suptr->un_ent[i] = 437 suptr->un_ent[suptr->un_cnt]; 438 continue; 439 } 440 } 441 if (semnum != -1) 442 break; 443 } 444 i++, sunptr++; 445 } 446 } 447 } 448 449 /* 450 * Note that the user-mode half of this passes a union, not a pointer 451 */ 452 #ifndef _SYS_SYSPROTO_H_ 453 struct __semctl_args { 454 int semid; 455 int semnum; 456 int cmd; 457 union semun *arg; 458 }; 459 #endif 460 461 /* 462 * MPSAFE 463 */ 464 int 465 __semctl(td, uap) 466 struct thread *td; 467 register struct __semctl_args *uap; 468 { 469 int semid = uap->semid; 470 int semnum = uap->semnum; 471 int cmd = uap->cmd; 472 union semun *arg = uap->arg; 473 union semun real_arg; 474 struct ucred *cred = td->td_ucred; 475 int i, rval, error; 476 struct semid_ds sbuf; 477 register struct semid_ds *semaptr; 478 u_short usval; 479 480 #ifdef SEM_DEBUG 481 printf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 482 #endif 483 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 484 return (ENOSYS); 485 486 mtx_lock(&Giant); 487 switch(cmd) { 488 case SEM_STAT: 489 if (semid < 0 || semid >= seminfo.semmni) 490 UGAR(EINVAL); 491 semaptr = &sema[semid]; 492 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ) 493 UGAR(EINVAL); 494 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 495 UGAR(error); 496 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 497 UGAR(error); 498 error = copyout((caddr_t)semaptr, real_arg.buf, 499 sizeof(struct semid_ds)); 500 rval = IXSEQ_TO_IPCID(semid,semaptr->sem_perm); 501 if (error == 0) 502 td->td_retval[0] = rval; 503 goto done2; 504 } 505 506 semid = IPCID_TO_IX(semid); 507 if (semid < 0 || semid >= seminfo.semmni) { 508 error = EINVAL; 509 goto done2; 510 } 511 512 semaptr = &sema[semid]; 513 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 514 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 515 error = EINVAL; 516 goto done2; 517 } 518 519 error = 0; 520 rval = 0; 521 522 switch (cmd) { 523 case IPC_RMID: 524 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 525 goto done2; 526 semaptr->sem_perm.cuid = cred->cr_uid; 527 semaptr->sem_perm.uid = cred->cr_uid; 528 semtot -= semaptr->sem_nsems; 529 for (i = semaptr->sem_base - sem; i < semtot; i++) 530 sem[i] = sem[i + semaptr->sem_nsems]; 531 for (i = 0; i < seminfo.semmni; i++) { 532 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 533 sema[i].sem_base > semaptr->sem_base) 534 sema[i].sem_base -= semaptr->sem_nsems; 535 } 536 semaptr->sem_perm.mode = 0; 537 semundo_clear(semid, -1); 538 wakeup((caddr_t)semaptr); 539 break; 540 541 case IPC_SET: 542 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 543 goto done2; 544 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 545 goto done2; 546 if ((error = copyin(real_arg.buf, (caddr_t)&sbuf, 547 sizeof(sbuf))) != 0) { 548 goto done2; 549 } 550 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 551 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 552 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 553 (sbuf.sem_perm.mode & 0777); 554 semaptr->sem_ctime = time_second; 555 break; 556 557 case IPC_STAT: 558 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 559 goto done2; 560 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 561 goto done2; 562 error = copyout((caddr_t)semaptr, real_arg.buf, 563 sizeof(struct semid_ds)); 564 break; 565 566 case GETNCNT: 567 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 568 goto done2; 569 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 570 error = EINVAL; 571 goto done2; 572 } 573 rval = semaptr->sem_base[semnum].semncnt; 574 break; 575 576 case GETPID: 577 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 578 goto done2; 579 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 580 error = EINVAL; 581 goto done2; 582 } 583 rval = semaptr->sem_base[semnum].sempid; 584 break; 585 586 case GETVAL: 587 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 588 goto done2; 589 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 590 error = EINVAL; 591 goto done2; 592 } 593 rval = semaptr->sem_base[semnum].semval; 594 break; 595 596 case GETALL: 597 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 598 goto done2; 599 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 600 goto done2; 601 for (i = 0; i < semaptr->sem_nsems; i++) { 602 error = copyout((caddr_t)&semaptr->sem_base[i].semval, 603 &real_arg.array[i], sizeof(real_arg.array[0])); 604 if (error != 0) 605 break; 606 } 607 break; 608 609 case GETZCNT: 610 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 611 goto done2; 612 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 613 error = EINVAL; 614 goto done2; 615 } 616 rval = semaptr->sem_base[semnum].semzcnt; 617 break; 618 619 case SETVAL: 620 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 621 goto done2; 622 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 623 error = EINVAL; 624 goto done2; 625 } 626 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 627 goto done2; 628 if (real_arg.val < 0 || real_arg.val > seminfo.semvmx) { 629 error = ERANGE; 630 goto done2; 631 } 632 semaptr->sem_base[semnum].semval = real_arg.val; 633 semundo_clear(semid, semnum); 634 wakeup((caddr_t)semaptr); 635 break; 636 637 case SETALL: 638 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 639 goto done2; 640 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 641 goto done2; 642 for (i = 0; i < semaptr->sem_nsems; i++) { 643 error = copyin(&real_arg.array[i], 644 (caddr_t)&usval, sizeof(real_arg.array[0])); 645 if (error != 0) 646 break; 647 if (usval > seminfo.semvmx) { 648 error = ERANGE; 649 break; 650 } 651 semaptr->sem_base[i].semval = usval; 652 } 653 semundo_clear(semid, -1); 654 wakeup((caddr_t)semaptr); 655 break; 656 657 default: 658 error = EINVAL; 659 break; 660 } 661 662 if (error == 0) 663 td->td_retval[0] = rval; 664 done2: 665 mtx_unlock(&Giant); 666 return(error); 667 } 668 669 #ifndef _SYS_SYSPROTO_H_ 670 struct semget_args { 671 key_t key; 672 int nsems; 673 int semflg; 674 }; 675 #endif 676 677 /* 678 * MPSAFE 679 */ 680 int 681 semget(td, uap) 682 struct thread *td; 683 register struct semget_args *uap; 684 { 685 int semid, error = 0; 686 int key = uap->key; 687 int nsems = uap->nsems; 688 int semflg = uap->semflg; 689 struct ucred *cred = td->td_ucred; 690 691 #ifdef SEM_DEBUG 692 printf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 693 #endif 694 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 695 return (ENOSYS); 696 697 mtx_lock(&Giant); 698 if (key != IPC_PRIVATE) { 699 for (semid = 0; semid < seminfo.semmni; semid++) { 700 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 701 sema[semid].sem_perm.key == key) 702 break; 703 } 704 if (semid < seminfo.semmni) { 705 #ifdef SEM_DEBUG 706 printf("found public key\n"); 707 #endif 708 if ((error = ipcperm(td, &sema[semid].sem_perm, 709 semflg & 0700))) { 710 goto done2; 711 } 712 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 713 #ifdef SEM_DEBUG 714 printf("too small\n"); 715 #endif 716 error = EINVAL; 717 goto done2; 718 } 719 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 720 #ifdef SEM_DEBUG 721 printf("not exclusive\n"); 722 #endif 723 error = EEXIST; 724 goto done2; 725 } 726 goto found; 727 } 728 } 729 730 #ifdef SEM_DEBUG 731 printf("need to allocate the semid_ds\n"); 732 #endif 733 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 734 if (nsems <= 0 || nsems > seminfo.semmsl) { 735 #ifdef SEM_DEBUG 736 printf("nsems out of range (0<%d<=%d)\n", nsems, 737 seminfo.semmsl); 738 #endif 739 error = EINVAL; 740 goto done2; 741 } 742 if (nsems > seminfo.semmns - semtot) { 743 #ifdef SEM_DEBUG 744 printf("not enough semaphores left (need %d, got %d)\n", 745 nsems, seminfo.semmns - semtot); 746 #endif 747 error = ENOSPC; 748 goto done2; 749 } 750 for (semid = 0; semid < seminfo.semmni; semid++) { 751 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 752 break; 753 } 754 if (semid == seminfo.semmni) { 755 #ifdef SEM_DEBUG 756 printf("no more semid_ds's available\n"); 757 #endif 758 error = ENOSPC; 759 goto done2; 760 } 761 #ifdef SEM_DEBUG 762 printf("semid %d is available\n", semid); 763 #endif 764 sema[semid].sem_perm.key = key; 765 sema[semid].sem_perm.cuid = cred->cr_uid; 766 sema[semid].sem_perm.uid = cred->cr_uid; 767 sema[semid].sem_perm.cgid = cred->cr_gid; 768 sema[semid].sem_perm.gid = cred->cr_gid; 769 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 770 sema[semid].sem_perm.seq = 771 (sema[semid].sem_perm.seq + 1) & 0x7fff; 772 sema[semid].sem_nsems = nsems; 773 sema[semid].sem_otime = 0; 774 sema[semid].sem_ctime = time_second; 775 sema[semid].sem_base = &sem[semtot]; 776 semtot += nsems; 777 bzero(sema[semid].sem_base, 778 sizeof(sema[semid].sem_base[0])*nsems); 779 #ifdef SEM_DEBUG 780 printf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 781 &sem[semtot]); 782 #endif 783 } else { 784 #ifdef SEM_DEBUG 785 printf("didn't find it and wasn't asked to create it\n"); 786 #endif 787 error = ENOENT; 788 goto done2; 789 } 790 791 found: 792 td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 793 done2: 794 mtx_unlock(&Giant); 795 return (error); 796 } 797 798 #ifndef _SYS_SYSPROTO_H_ 799 struct semop_args { 800 int semid; 801 struct sembuf *sops; 802 u_int nsops; 803 }; 804 #endif 805 806 /* 807 * MPSAFE 808 */ 809 int 810 semop(td, uap) 811 struct thread *td; 812 register struct semop_args *uap; 813 { 814 int semid = uap->semid; 815 u_int nsops = uap->nsops; 816 struct sembuf *sops = NULL; 817 register struct semid_ds *semaptr; 818 register struct sembuf *sopptr = 0; 819 register struct sem *semptr = 0; 820 struct sem_undo *suptr; 821 int i, j, error; 822 int do_wakeup, do_undos; 823 824 #ifdef SEM_DEBUG 825 printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 826 #endif 827 828 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 829 return (ENOSYS); 830 831 mtx_lock(&Giant); 832 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 833 834 if (semid < 0 || semid >= seminfo.semmni) { 835 error = EINVAL; 836 goto done2; 837 } 838 839 semaptr = &sema[semid]; 840 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 841 error = EINVAL; 842 goto done2; 843 } 844 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 845 error = EINVAL; 846 goto done2; 847 } 848 if (nsops > seminfo.semopm) { 849 #ifdef SEM_DEBUG 850 printf("too many sops (max=%d, nsops=%d)\n", seminfo.semopm, 851 nsops); 852 #endif 853 error = E2BIG; 854 goto done2; 855 } 856 857 /* Allocate memory for sem_ops */ 858 sops = malloc(nsops * sizeof(sops[0]), M_SEM, M_WAITOK); 859 if (!sops) 860 panic("Failed to allocate %d sem_ops", nsops); 861 862 if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) { 863 #ifdef SEM_DEBUG 864 printf("error = %d from copyin(%08x, %08x, %d)\n", error, 865 uap->sops, sops, nsops * sizeof(sops[0])); 866 #endif 867 goto done2; 868 } 869 870 /* 871 * Initial pass thru sops to see what permissions are needed. 872 * Also perform any checks that don't need repeating on each 873 * attempt to satisfy the request vector. 874 */ 875 j = 0; /* permission needed */ 876 do_undos = 0; 877 for (i = 0; i < nsops; i++) { 878 sopptr = &sops[i]; 879 if (sopptr->sem_num >= semaptr->sem_nsems) { 880 error = EFBIG; 881 goto done2; 882 } 883 if (sopptr->sem_flg & SEM_UNDO && sopptr->sem_op != 0) 884 do_undos = 1; 885 j |= (sopptr->sem_op == 0) ? SEM_R : SEM_A; 886 } 887 888 if ((error = ipcperm(td, &semaptr->sem_perm, j))) { 889 #ifdef SEM_DEBUG 890 printf("error = %d from ipaccess\n", error); 891 #endif 892 goto done2; 893 } 894 895 /* 896 * Loop trying to satisfy the vector of requests. 897 * If we reach a point where we must wait, any requests already 898 * performed are rolled back and we go to sleep until some other 899 * process wakes us up. At this point, we start all over again. 900 * 901 * This ensures that from the perspective of other tasks, a set 902 * of requests is atomic (never partially satisfied). 903 */ 904 for (;;) { 905 do_wakeup = 0; 906 error = 0; /* error return if necessary */ 907 908 for (i = 0; i < nsops; i++) { 909 sopptr = &sops[i]; 910 semptr = &semaptr->sem_base[sopptr->sem_num]; 911 912 #ifdef SEM_DEBUG 913 printf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 914 semaptr, semaptr->sem_base, semptr, 915 sopptr->sem_num, semptr->semval, sopptr->sem_op, 916 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 917 #endif 918 919 if (sopptr->sem_op < 0) { 920 if (semptr->semval + sopptr->sem_op < 0) { 921 #ifdef SEM_DEBUG 922 printf("semop: can't do it now\n"); 923 #endif 924 break; 925 } else { 926 semptr->semval += sopptr->sem_op; 927 if (semptr->semval == 0 && 928 semptr->semzcnt > 0) 929 do_wakeup = 1; 930 } 931 } else if (sopptr->sem_op == 0) { 932 if (semptr->semval != 0) { 933 #ifdef SEM_DEBUG 934 printf("semop: not zero now\n"); 935 #endif 936 break; 937 } 938 } else if (semptr->semval + sopptr->sem_op > 939 seminfo.semvmx) { 940 error = ERANGE; 941 break; 942 } else { 943 if (semptr->semncnt > 0) 944 do_wakeup = 1; 945 semptr->semval += sopptr->sem_op; 946 } 947 } 948 949 /* 950 * Did we get through the entire vector? 951 */ 952 if (i >= nsops) 953 goto done; 954 955 /* 956 * No ... rollback anything that we've already done 957 */ 958 #ifdef SEM_DEBUG 959 printf("semop: rollback 0 through %d\n", i-1); 960 #endif 961 for (j = 0; j < i; j++) 962 semaptr->sem_base[sops[j].sem_num].semval -= 963 sops[j].sem_op; 964 965 /* If we detected an error, return it */ 966 if (error != 0) 967 goto done2; 968 969 /* 970 * If the request that we couldn't satisfy has the 971 * NOWAIT flag set then return with EAGAIN. 972 */ 973 if (sopptr->sem_flg & IPC_NOWAIT) { 974 error = EAGAIN; 975 goto done2; 976 } 977 978 if (sopptr->sem_op == 0) 979 semptr->semzcnt++; 980 else 981 semptr->semncnt++; 982 983 #ifdef SEM_DEBUG 984 printf("semop: good night!\n"); 985 #endif 986 error = tsleep((caddr_t)semaptr, (PZERO - 4) | PCATCH, 987 "semwait", 0); 988 #ifdef SEM_DEBUG 989 printf("semop: good morning (error=%d)!\n", error); 990 #endif 991 992 if (error != 0) { 993 error = EINTR; 994 goto done2; 995 } 996 #ifdef SEM_DEBUG 997 printf("semop: good morning!\n"); 998 #endif 999 1000 /* 1001 * Make sure that the semaphore still exists 1002 */ 1003 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 1004 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 1005 error = EIDRM; 1006 goto done2; 1007 } 1008 1009 /* 1010 * The semaphore is still alive. Readjust the count of 1011 * waiting processes. 1012 */ 1013 if (sopptr->sem_op == 0) 1014 semptr->semzcnt--; 1015 else 1016 semptr->semncnt--; 1017 } 1018 1019 done: 1020 /* 1021 * Process any SEM_UNDO requests. 1022 */ 1023 if (do_undos) { 1024 suptr = NULL; 1025 for (i = 0; i < nsops; i++) { 1026 /* 1027 * We only need to deal with SEM_UNDO's for non-zero 1028 * op's. 1029 */ 1030 int adjval; 1031 1032 if ((sops[i].sem_flg & SEM_UNDO) == 0) 1033 continue; 1034 adjval = sops[i].sem_op; 1035 if (adjval == 0) 1036 continue; 1037 error = semundo_adjust(td, &suptr, semid, 1038 sops[i].sem_num, -adjval); 1039 if (error == 0) 1040 continue; 1041 1042 /* 1043 * Oh-Oh! We ran out of either sem_undo's or undo's. 1044 * Rollback the adjustments to this point and then 1045 * rollback the semaphore ups and down so we can return 1046 * with an error with all structures restored. We 1047 * rollback the undo's in the exact reverse order that 1048 * we applied them. This guarantees that we won't run 1049 * out of space as we roll things back out. 1050 */ 1051 for (j = i - 1; j >= 0; j--) { 1052 if ((sops[j].sem_flg & SEM_UNDO) == 0) 1053 continue; 1054 adjval = sops[j].sem_op; 1055 if (adjval == 0) 1056 continue; 1057 if (semundo_adjust(td, &suptr, semid, 1058 sops[j].sem_num, adjval) != 0) 1059 panic("semop - can't undo undos"); 1060 } 1061 1062 for (j = 0; j < nsops; j++) 1063 semaptr->sem_base[sops[j].sem_num].semval -= 1064 sops[j].sem_op; 1065 1066 #ifdef SEM_DEBUG 1067 printf("error = %d from semundo_adjust\n", error); 1068 #endif 1069 goto done2; 1070 } /* loop through the sops */ 1071 } /* if (do_undos) */ 1072 1073 /* We're definitely done - set the sempid's and time */ 1074 for (i = 0; i < nsops; i++) { 1075 sopptr = &sops[i]; 1076 semptr = &semaptr->sem_base[sopptr->sem_num]; 1077 semptr->sempid = td->td_proc->p_pid; 1078 } 1079 semaptr->sem_otime = time_second; 1080 1081 /* 1082 * Do a wakeup if any semaphore was up'd whilst something was 1083 * sleeping on it. 1084 */ 1085 if (do_wakeup) { 1086 #ifdef SEM_DEBUG 1087 printf("semop: doing wakeup\n"); 1088 #endif 1089 wakeup((caddr_t)semaptr); 1090 #ifdef SEM_DEBUG 1091 printf("semop: back from wakeup\n"); 1092 #endif 1093 } 1094 #ifdef SEM_DEBUG 1095 printf("semop: done\n"); 1096 #endif 1097 td->td_retval[0] = 0; 1098 done2: 1099 if (sops) 1100 free(sops, M_SEM); 1101 mtx_unlock(&Giant); 1102 return (error); 1103 } 1104 1105 /* 1106 * Go through the undo structures for this process and apply the adjustments to 1107 * semaphores. 1108 */ 1109 static void 1110 semexit_myhook(p) 1111 struct proc *p; 1112 { 1113 register struct sem_undo *suptr; 1114 register struct sem_undo **supptr; 1115 1116 /* 1117 * Go through the chain of undo vectors looking for one 1118 * associated with this process. 1119 */ 1120 1121 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1122 supptr = &suptr->un_next) { 1123 if (suptr->un_proc == p) 1124 break; 1125 } 1126 1127 if (suptr == NULL) 1128 return; 1129 1130 #ifdef SEM_DEBUG 1131 printf("proc @%08x has undo structure with %d entries\n", p, 1132 suptr->un_cnt); 1133 #endif 1134 1135 /* 1136 * If there are any active undo elements then process them. 1137 */ 1138 if (suptr->un_cnt > 0) { 1139 int ix; 1140 1141 for (ix = 0; ix < suptr->un_cnt; ix++) { 1142 int semid = suptr->un_ent[ix].un_id; 1143 int semnum = suptr->un_ent[ix].un_num; 1144 int adjval = suptr->un_ent[ix].un_adjval; 1145 struct semid_ds *semaptr; 1146 1147 semaptr = &sema[semid]; 1148 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1149 panic("semexit - semid not allocated"); 1150 if (semnum >= semaptr->sem_nsems) 1151 panic("semexit - semnum out of range"); 1152 1153 #ifdef SEM_DEBUG 1154 printf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1155 suptr->un_proc, suptr->un_ent[ix].un_id, 1156 suptr->un_ent[ix].un_num, 1157 suptr->un_ent[ix].un_adjval, 1158 semaptr->sem_base[semnum].semval); 1159 #endif 1160 1161 if (adjval < 0) { 1162 if (semaptr->sem_base[semnum].semval < -adjval) 1163 semaptr->sem_base[semnum].semval = 0; 1164 else 1165 semaptr->sem_base[semnum].semval += 1166 adjval; 1167 } else 1168 semaptr->sem_base[semnum].semval += adjval; 1169 1170 wakeup((caddr_t)semaptr); 1171 #ifdef SEM_DEBUG 1172 printf("semexit: back from wakeup\n"); 1173 #endif 1174 } 1175 } 1176 1177 /* 1178 * Deallocate the undo vector. 1179 */ 1180 #ifdef SEM_DEBUG 1181 printf("removing vector\n"); 1182 #endif 1183 suptr->un_proc = NULL; 1184 *supptr = suptr->un_next; 1185 } 1186 1187 static int 1188 sysctl_sema(SYSCTL_HANDLER_ARGS) 1189 { 1190 1191 return (SYSCTL_OUT(req, sema, 1192 sizeof(struct semid_ds) * seminfo.semmni)); 1193 } 1194