1 /* $FreeBSD$ */ 2 3 /* 4 * Implementation of SVID semaphores 5 * 6 * Author: Daniel Boulet 7 * 8 * This software is provided ``AS IS'' without any warranties of any kind. 9 */ 10 11 #include "opt_sysvipc.h" 12 13 #include <sys/param.h> 14 #include <sys/systm.h> 15 #include <sys/sysproto.h> 16 #include <sys/kernel.h> 17 #include <sys/proc.h> 18 #include <sys/lock.h> 19 #include <sys/mutex.h> 20 #include <sys/sem.h> 21 #include <sys/syscall.h> 22 #include <sys/sysent.h> 23 #include <sys/sysctl.h> 24 #include <sys/malloc.h> 25 #include <sys/jail.h> 26 27 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores"); 28 29 static void seminit __P((void)); 30 static int sysvsem_modload __P((struct module *, int, void *)); 31 static int semunload __P((void)); 32 static void semexit_myhook __P((struct proc *p)); 33 static int sysctl_sema __P((SYSCTL_HANDLER_ARGS)); 34 35 #ifndef _SYS_SYSPROTO_H_ 36 struct __semctl_args; 37 int __semctl __P((struct thread *td, struct __semctl_args *uap)); 38 struct semget_args; 39 int semget __P((struct thread *td, struct semget_args *uap)); 40 struct semop_args; 41 int semop __P((struct thread *td, struct semop_args *uap)); 42 #endif 43 44 static struct sem_undo *semu_alloc __P((struct thread *td)); 45 static int semundo_adjust __P((struct thread *td, struct sem_undo **supptr, 46 int semid, int semnum, int adjval)); 47 static void semundo_clear __P((int semid, int semnum)); 48 49 /* XXX casting to (sy_call_t *) is bogus, as usual. */ 50 static sy_call_t *semcalls[] = { 51 (sy_call_t *)__semctl, (sy_call_t *)semget, 52 (sy_call_t *)semop 53 }; 54 55 static int semtot = 0; 56 static struct semid_ds *sema; /* semaphore id pool */ 57 static struct sem *sem; /* semaphore pool */ 58 static struct sem_undo *semu_list; /* list of active undo structures */ 59 static int *semu; /* undo structure pool */ 60 61 struct sem { 62 u_short semval; /* semaphore value */ 63 pid_t sempid; /* pid of last operation */ 64 u_short semncnt; /* # awaiting semval > cval */ 65 u_short semzcnt; /* # awaiting semval = 0 */ 66 }; 67 68 /* 69 * Undo structure (one per process) 70 */ 71 struct sem_undo { 72 struct sem_undo *un_next; /* ptr to next active undo structure */ 73 struct proc *un_proc; /* owner of this structure */ 74 short un_cnt; /* # of active entries */ 75 struct undo { 76 short un_adjval; /* adjust on exit values */ 77 short un_num; /* semaphore # */ 78 int un_id; /* semid */ 79 } un_ent[1]; /* undo entries */ 80 }; 81 82 /* 83 * Configuration parameters 84 */ 85 #ifndef SEMMNI 86 #define SEMMNI 10 /* # of semaphore identifiers */ 87 #endif 88 #ifndef SEMMNS 89 #define SEMMNS 60 /* # of semaphores in system */ 90 #endif 91 #ifndef SEMUME 92 #define SEMUME 10 /* max # of undo entries per process */ 93 #endif 94 #ifndef SEMMNU 95 #define SEMMNU 30 /* # of undo structures in system */ 96 #endif 97 98 /* shouldn't need tuning */ 99 #ifndef SEMMAP 100 #define SEMMAP 30 /* # of entries in semaphore map */ 101 #endif 102 #ifndef SEMMSL 103 #define SEMMSL SEMMNS /* max # of semaphores per id */ 104 #endif 105 #ifndef SEMOPM 106 #define SEMOPM 100 /* max # of operations per semop call */ 107 #endif 108 109 #define SEMVMX 32767 /* semaphore maximum value */ 110 #define SEMAEM 16384 /* adjust on exit max value */ 111 112 /* 113 * Due to the way semaphore memory is allocated, we have to ensure that 114 * SEMUSZ is properly aligned. 115 */ 116 117 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1)) 118 119 /* actual size of an undo structure */ 120 #define SEMUSZ SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME])) 121 122 /* 123 * Macro to find a particular sem_undo vector 124 */ 125 #define SEMU(ix) ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz)) 126 127 /* 128 * semaphore info struct 129 */ 130 struct seminfo seminfo = { 131 SEMMAP, /* # of entries in semaphore map */ 132 SEMMNI, /* # of semaphore identifiers */ 133 SEMMNS, /* # of semaphores in system */ 134 SEMMNU, /* # of undo structures in system */ 135 SEMMSL, /* max # of semaphores per id */ 136 SEMOPM, /* max # of operations per semop call */ 137 SEMUME, /* max # of undo entries per process */ 138 SEMUSZ, /* size in bytes of undo structure */ 139 SEMVMX, /* semaphore maximum value */ 140 SEMAEM /* adjust on exit max value */ 141 }; 142 143 SYSCTL_DECL(_kern_ipc); 144 SYSCTL_INT(_kern_ipc, OID_AUTO, semmap, CTLFLAG_RW, &seminfo.semmap, 0, ""); 145 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RD, &seminfo.semmni, 0, ""); 146 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RD, &seminfo.semmns, 0, ""); 147 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RD, &seminfo.semmnu, 0, ""); 148 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0, ""); 149 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RD, &seminfo.semopm, 0, ""); 150 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RD, &seminfo.semume, 0, ""); 151 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RD, &seminfo.semusz, 0, ""); 152 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0, ""); 153 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0, ""); 154 SYSCTL_PROC(_kern_ipc, OID_AUTO, sema, CTLFLAG_RD, 155 NULL, 0, sysctl_sema, "", ""); 156 157 static void 158 seminit(void) 159 { 160 register int i; 161 162 TUNABLE_INT_FETCH("kern.ipc.semmap", &seminfo.semmap); 163 TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni); 164 TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns); 165 TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu); 166 TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl); 167 TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm); 168 TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume); 169 TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz); 170 TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx); 171 TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem); 172 173 sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK); 174 if (sem == NULL) 175 panic("sem is NULL"); 176 sema = malloc(sizeof(struct semid_ds) * seminfo.semmni, M_SEM, M_WAITOK); 177 if (sema == NULL) 178 panic("sema is NULL"); 179 semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK); 180 if (semu == NULL) 181 panic("semu is NULL"); 182 183 for (i = 0; i < seminfo.semmni; i++) { 184 sema[i].sem_base = 0; 185 sema[i].sem_perm.mode = 0; 186 } 187 for (i = 0; i < seminfo.semmnu; i++) { 188 register struct sem_undo *suptr = SEMU(i); 189 suptr->un_proc = NULL; 190 } 191 semu_list = NULL; 192 at_exit(semexit_myhook); 193 } 194 195 static int 196 semunload(void) 197 { 198 199 if (semtot != 0) 200 return (EBUSY); 201 202 free(sem, M_SEM); 203 free(sema, M_SEM); 204 free(semu, M_SEM); 205 rm_at_exit(semexit_myhook); 206 return (0); 207 } 208 209 static int 210 sysvsem_modload(struct module *module, int cmd, void *arg) 211 { 212 int error = 0; 213 214 switch (cmd) { 215 case MOD_LOAD: 216 seminit(); 217 break; 218 case MOD_UNLOAD: 219 error = semunload(); 220 break; 221 case MOD_SHUTDOWN: 222 break; 223 default: 224 error = EINVAL; 225 break; 226 } 227 return (error); 228 } 229 230 static moduledata_t sysvsem_mod = { 231 "sysvsem", 232 &sysvsem_modload, 233 NULL 234 }; 235 236 SYSCALL_MODULE_HELPER(semsys); 237 SYSCALL_MODULE_HELPER(__semctl); 238 SYSCALL_MODULE_HELPER(semget); 239 SYSCALL_MODULE_HELPER(semop); 240 241 DECLARE_MODULE(sysvsem, sysvsem_mod, 242 SI_SUB_SYSV_SEM, SI_ORDER_FIRST); 243 MODULE_VERSION(sysvsem, 1); 244 245 /* 246 * Entry point for all SEM calls 247 * 248 * MPSAFE 249 */ 250 int 251 semsys(td, uap) 252 struct thread *td; 253 /* XXX actually varargs. */ 254 struct semsys_args /* { 255 u_int which; 256 int a2; 257 int a3; 258 int a4; 259 int a5; 260 } */ *uap; 261 { 262 int error; 263 264 mtx_lock(&Giant); 265 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 266 error = ENOSYS; 267 goto done2; 268 } 269 if (uap->which >= sizeof(semcalls)/sizeof(semcalls[0])) { 270 error = EINVAL; 271 goto done2; 272 } 273 error = (*semcalls[uap->which])(td, &uap->a2); 274 done2: 275 mtx_unlock(&Giant); 276 return (error); 277 } 278 279 /* 280 * Allocate a new sem_undo structure for a process 281 * (returns ptr to structure or NULL if no more room) 282 */ 283 284 static struct sem_undo * 285 semu_alloc(td) 286 struct thread *td; 287 { 288 register int i; 289 register struct sem_undo *suptr; 290 register struct sem_undo **supptr; 291 int attempt; 292 293 /* 294 * Try twice to allocate something. 295 * (we'll purge any empty structures after the first pass so 296 * two passes are always enough) 297 */ 298 299 for (attempt = 0; attempt < 2; attempt++) { 300 /* 301 * Look for a free structure. 302 * Fill it in and return it if we find one. 303 */ 304 305 for (i = 0; i < seminfo.semmnu; i++) { 306 suptr = SEMU(i); 307 if (suptr->un_proc == NULL) { 308 suptr->un_next = semu_list; 309 semu_list = suptr; 310 suptr->un_cnt = 0; 311 suptr->un_proc = td->td_proc; 312 return(suptr); 313 } 314 } 315 316 /* 317 * We didn't find a free one, if this is the first attempt 318 * then try to free some structures. 319 */ 320 321 if (attempt == 0) { 322 /* All the structures are in use - try to free some */ 323 int did_something = 0; 324 325 supptr = &semu_list; 326 while ((suptr = *supptr) != NULL) { 327 if (suptr->un_cnt == 0) { 328 suptr->un_proc = NULL; 329 *supptr = suptr->un_next; 330 did_something = 1; 331 } else 332 supptr = &(suptr->un_next); 333 } 334 335 /* If we didn't free anything then just give-up */ 336 if (!did_something) 337 return(NULL); 338 } else { 339 /* 340 * The second pass failed even though we freed 341 * something after the first pass! 342 * This is IMPOSSIBLE! 343 */ 344 panic("semu_alloc - second attempt failed"); 345 } 346 } 347 return (NULL); 348 } 349 350 /* 351 * Adjust a particular entry for a particular proc 352 */ 353 354 static int 355 semundo_adjust(td, supptr, semid, semnum, adjval) 356 register struct thread *td; 357 struct sem_undo **supptr; 358 int semid, semnum; 359 int adjval; 360 { 361 struct proc *p = td->td_proc; 362 register struct sem_undo *suptr; 363 register struct undo *sunptr; 364 int i; 365 366 /* Look for and remember the sem_undo if the caller doesn't provide 367 it */ 368 369 suptr = *supptr; 370 if (suptr == NULL) { 371 for (suptr = semu_list; suptr != NULL; 372 suptr = suptr->un_next) { 373 if (suptr->un_proc == p) { 374 *supptr = suptr; 375 break; 376 } 377 } 378 if (suptr == NULL) { 379 if (adjval == 0) 380 return(0); 381 suptr = semu_alloc(td); 382 if (suptr == NULL) 383 return(ENOSPC); 384 *supptr = suptr; 385 } 386 } 387 388 /* 389 * Look for the requested entry and adjust it (delete if adjval becomes 390 * 0). 391 */ 392 sunptr = &suptr->un_ent[0]; 393 for (i = 0; i < suptr->un_cnt; i++, sunptr++) { 394 if (sunptr->un_id != semid || sunptr->un_num != semnum) 395 continue; 396 if (adjval != 0) { 397 adjval += sunptr->un_adjval; 398 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 399 return (ERANGE); 400 } 401 sunptr->un_adjval = adjval; 402 if (sunptr->un_adjval == 0) { 403 suptr->un_cnt--; 404 if (i < suptr->un_cnt) 405 suptr->un_ent[i] = 406 suptr->un_ent[suptr->un_cnt]; 407 } 408 return(0); 409 } 410 411 /* Didn't find the right entry - create it */ 412 if (adjval == 0) 413 return(0); 414 if (adjval > seminfo.semaem || adjval < -seminfo.semaem) 415 return (ERANGE); 416 if (suptr->un_cnt != seminfo.semume) { 417 sunptr = &suptr->un_ent[suptr->un_cnt]; 418 suptr->un_cnt++; 419 sunptr->un_adjval = adjval; 420 sunptr->un_id = semid; sunptr->un_num = semnum; 421 } else 422 return(EINVAL); 423 return(0); 424 } 425 426 static void 427 semundo_clear(semid, semnum) 428 int semid, semnum; 429 { 430 register struct sem_undo *suptr; 431 432 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) { 433 register struct undo *sunptr = &suptr->un_ent[0]; 434 register int i = 0; 435 436 while (i < suptr->un_cnt) { 437 if (sunptr->un_id == semid) { 438 if (semnum == -1 || sunptr->un_num == semnum) { 439 suptr->un_cnt--; 440 if (i < suptr->un_cnt) { 441 suptr->un_ent[i] = 442 suptr->un_ent[suptr->un_cnt]; 443 continue; 444 } 445 } 446 if (semnum != -1) 447 break; 448 } 449 i++, sunptr++; 450 } 451 } 452 } 453 454 /* 455 * Note that the user-mode half of this passes a union, not a pointer 456 */ 457 #ifndef _SYS_SYSPROTO_H_ 458 struct __semctl_args { 459 int semid; 460 int semnum; 461 int cmd; 462 union semun *arg; 463 }; 464 #endif 465 466 /* 467 * MPSAFE 468 */ 469 int 470 __semctl(td, uap) 471 struct thread *td; 472 register struct __semctl_args *uap; 473 { 474 int semid = uap->semid; 475 int semnum = uap->semnum; 476 int cmd = uap->cmd; 477 union semun *arg = uap->arg; 478 union semun real_arg; 479 struct ucred *cred = td->td_proc->p_ucred; 480 int i, rval, error; 481 struct semid_ds sbuf; 482 register struct semid_ds *semaptr; 483 u_short usval; 484 485 #ifdef SEM_DEBUG 486 printf("call to semctl(%d, %d, %d, 0x%x)\n", semid, semnum, cmd, arg); 487 #endif 488 mtx_lock(&Giant); 489 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 490 error = ENOSYS; 491 goto done2; 492 } 493 494 switch(cmd) { 495 case SEM_STAT: 496 if (semid < 0 || semid >= seminfo.semmsl) 497 return(EINVAL); 498 semaptr = &sema[semid]; 499 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ) 500 return(EINVAL); 501 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 502 return(error); 503 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 504 return(error); 505 error = copyout((caddr_t)semaptr, real_arg.buf, 506 sizeof(struct semid_ds)); 507 rval = IXSEQ_TO_IPCID(semid,semaptr->sem_perm); 508 if (error == 0) 509 td->td_retval[0] = rval; 510 goto done2; 511 } 512 513 semid = IPCID_TO_IX(semid); 514 if (semid < 0 || semid >= seminfo.semmsl) { 515 error = EINVAL; 516 goto done2; 517 } 518 519 semaptr = &sema[semid]; 520 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 521 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 522 error = EINVAL; 523 goto done2; 524 } 525 526 error = 0; 527 rval = 0; 528 529 switch (cmd) { 530 case IPC_RMID: 531 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 532 goto done2; 533 semaptr->sem_perm.cuid = cred->cr_uid; 534 semaptr->sem_perm.uid = cred->cr_uid; 535 semtot -= semaptr->sem_nsems; 536 for (i = semaptr->sem_base - sem; i < semtot; i++) 537 sem[i] = sem[i + semaptr->sem_nsems]; 538 for (i = 0; i < seminfo.semmni; i++) { 539 if ((sema[i].sem_perm.mode & SEM_ALLOC) && 540 sema[i].sem_base > semaptr->sem_base) 541 sema[i].sem_base -= semaptr->sem_nsems; 542 } 543 semaptr->sem_perm.mode = 0; 544 semundo_clear(semid, -1); 545 wakeup((caddr_t)semaptr); 546 break; 547 548 case IPC_SET: 549 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_M))) 550 goto done2; 551 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 552 goto done2; 553 if ((error = copyin(real_arg.buf, (caddr_t)&sbuf, 554 sizeof(sbuf))) != 0) { 555 goto done2; 556 } 557 semaptr->sem_perm.uid = sbuf.sem_perm.uid; 558 semaptr->sem_perm.gid = sbuf.sem_perm.gid; 559 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) | 560 (sbuf.sem_perm.mode & 0777); 561 semaptr->sem_ctime = time_second; 562 break; 563 564 case IPC_STAT: 565 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 566 goto done2; 567 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 568 goto done2; 569 error = copyout((caddr_t)semaptr, real_arg.buf, 570 sizeof(struct semid_ds)); 571 break; 572 573 case GETNCNT: 574 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 575 goto done2; 576 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 577 error = EINVAL; 578 goto done2; 579 } 580 rval = semaptr->sem_base[semnum].semncnt; 581 break; 582 583 case GETPID: 584 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 585 goto done2; 586 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 587 error = EINVAL; 588 goto done2; 589 } 590 rval = semaptr->sem_base[semnum].sempid; 591 break; 592 593 case GETVAL: 594 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 595 goto done2; 596 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 597 error = EINVAL; 598 goto done2; 599 } 600 rval = semaptr->sem_base[semnum].semval; 601 break; 602 603 case GETALL: 604 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 605 goto done2; 606 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 607 goto done2; 608 for (i = 0; i < semaptr->sem_nsems; i++) { 609 error = copyout((caddr_t)&semaptr->sem_base[i].semval, 610 &real_arg.array[i], sizeof(real_arg.array[0])); 611 if (error != 0) 612 break; 613 } 614 break; 615 616 case GETZCNT: 617 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_R))) 618 goto done2; 619 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 620 error = EINVAL; 621 goto done2; 622 } 623 rval = semaptr->sem_base[semnum].semzcnt; 624 break; 625 626 case SETVAL: 627 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 628 goto done2; 629 if (semnum < 0 || semnum >= semaptr->sem_nsems) { 630 error = EINVAL; 631 goto done2; 632 } 633 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 634 goto done2; 635 if (real_arg.val < 0 || real_arg.val > seminfo.semvmx) { 636 error = ERANGE; 637 goto done2; 638 } 639 semaptr->sem_base[semnum].semval = real_arg.val; 640 semundo_clear(semid, semnum); 641 wakeup((caddr_t)semaptr); 642 break; 643 644 case SETALL: 645 if ((error = ipcperm(td, &semaptr->sem_perm, IPC_W))) 646 goto done2; 647 if ((error = copyin(arg, &real_arg, sizeof(real_arg))) != 0) 648 goto done2; 649 for (i = 0; i < semaptr->sem_nsems; i++) { 650 error = copyin(&real_arg.array[i], 651 (caddr_t)&usval, sizeof(real_arg.array[0])); 652 if (error != 0) 653 break; 654 if (usval > seminfo.semvmx) { 655 error = ERANGE; 656 break; 657 } 658 semaptr->sem_base[i].semval = usval; 659 } 660 semundo_clear(semid, -1); 661 wakeup((caddr_t)semaptr); 662 break; 663 664 default: 665 error = EINVAL; 666 break; 667 } 668 669 if (error == 0) 670 td->td_retval[0] = rval; 671 done2: 672 mtx_unlock(&Giant); 673 return(error); 674 } 675 676 #ifndef _SYS_SYSPROTO_H_ 677 struct semget_args { 678 key_t key; 679 int nsems; 680 int semflg; 681 }; 682 #endif 683 684 /* 685 * MPSAFE 686 */ 687 int 688 semget(td, uap) 689 struct thread *td; 690 register struct semget_args *uap; 691 { 692 int semid, error = 0; 693 int key = uap->key; 694 int nsems = uap->nsems; 695 int semflg = uap->semflg; 696 struct ucred *cred = td->td_proc->p_ucred; 697 698 #ifdef SEM_DEBUG 699 printf("semget(0x%x, %d, 0%o)\n", key, nsems, semflg); 700 #endif 701 mtx_lock(&Giant); 702 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 703 error = ENOSYS; 704 goto done2; 705 } 706 707 if (key != IPC_PRIVATE) { 708 for (semid = 0; semid < seminfo.semmni; semid++) { 709 if ((sema[semid].sem_perm.mode & SEM_ALLOC) && 710 sema[semid].sem_perm.key == key) 711 break; 712 } 713 if (semid < seminfo.semmni) { 714 #ifdef SEM_DEBUG 715 printf("found public key\n"); 716 #endif 717 if ((error = ipcperm(td, &sema[semid].sem_perm, 718 semflg & 0700))) { 719 goto done2; 720 } 721 if (nsems > 0 && sema[semid].sem_nsems < nsems) { 722 #ifdef SEM_DEBUG 723 printf("too small\n"); 724 #endif 725 error = EINVAL; 726 goto done2; 727 } 728 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) { 729 #ifdef SEM_DEBUG 730 printf("not exclusive\n"); 731 #endif 732 error = EEXIST; 733 goto done2; 734 } 735 goto found; 736 } 737 } 738 739 #ifdef SEM_DEBUG 740 printf("need to allocate the semid_ds\n"); 741 #endif 742 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) { 743 if (nsems <= 0 || nsems > seminfo.semmsl) { 744 #ifdef SEM_DEBUG 745 printf("nsems out of range (0<%d<=%d)\n", nsems, 746 seminfo.semmsl); 747 #endif 748 error = EINVAL; 749 goto done2; 750 } 751 if (nsems > seminfo.semmns - semtot) { 752 #ifdef SEM_DEBUG 753 printf("not enough semaphores left (need %d, got %d)\n", 754 nsems, seminfo.semmns - semtot); 755 #endif 756 error = ENOSPC; 757 goto done2; 758 } 759 for (semid = 0; semid < seminfo.semmni; semid++) { 760 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0) 761 break; 762 } 763 if (semid == seminfo.semmni) { 764 #ifdef SEM_DEBUG 765 printf("no more semid_ds's available\n"); 766 #endif 767 error = ENOSPC; 768 goto done2; 769 } 770 #ifdef SEM_DEBUG 771 printf("semid %d is available\n", semid); 772 #endif 773 sema[semid].sem_perm.key = key; 774 sema[semid].sem_perm.cuid = cred->cr_uid; 775 sema[semid].sem_perm.uid = cred->cr_uid; 776 sema[semid].sem_perm.cgid = cred->cr_gid; 777 sema[semid].sem_perm.gid = cred->cr_gid; 778 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC; 779 sema[semid].sem_perm.seq = 780 (sema[semid].sem_perm.seq + 1) & 0x7fff; 781 sema[semid].sem_nsems = nsems; 782 sema[semid].sem_otime = 0; 783 sema[semid].sem_ctime = time_second; 784 sema[semid].sem_base = &sem[semtot]; 785 semtot += nsems; 786 bzero(sema[semid].sem_base, 787 sizeof(sema[semid].sem_base[0])*nsems); 788 #ifdef SEM_DEBUG 789 printf("sembase = 0x%x, next = 0x%x\n", sema[semid].sem_base, 790 &sem[semtot]); 791 #endif 792 } else { 793 #ifdef SEM_DEBUG 794 printf("didn't find it and wasn't asked to create it\n"); 795 #endif 796 error = ENOENT; 797 goto done2; 798 } 799 800 found: 801 td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm); 802 done2: 803 mtx_unlock(&Giant); 804 return (error); 805 } 806 807 #ifndef _SYS_SYSPROTO_H_ 808 struct semop_args { 809 int semid; 810 struct sembuf *sops; 811 u_int nsops; 812 }; 813 #endif 814 815 /* 816 * MPSAFE 817 */ 818 int 819 semop(td, uap) 820 struct thread *td; 821 register struct semop_args *uap; 822 { 823 int semid = uap->semid; 824 u_int nsops = uap->nsops; 825 struct sembuf *sops = NULL; 826 register struct semid_ds *semaptr; 827 register struct sembuf *sopptr; 828 register struct sem *semptr; 829 struct sem_undo *suptr; 830 int i, j, error; 831 int do_wakeup, do_undos; 832 833 #ifdef SEM_DEBUG 834 printf("call to semop(%d, 0x%x, %u)\n", semid, sops, nsops); 835 #endif 836 837 mtx_lock(&Giant); 838 if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) { 839 error = ENOSYS; 840 goto done2; 841 } 842 843 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */ 844 845 if (semid < 0 || semid >= seminfo.semmsl) { 846 error = EINVAL; 847 goto done2; 848 } 849 850 semaptr = &sema[semid]; 851 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) { 852 error = EINVAL; 853 goto done2; 854 } 855 if (semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 856 error = EINVAL; 857 goto done2; 858 } 859 if (nsops > seminfo.semopm) { 860 #ifdef SEM_DEBUG 861 printf("too many sops (max=%d, nsops=%d)\n", seminfo.semopm, 862 nsops); 863 #endif 864 error = E2BIG; 865 goto done2; 866 } 867 868 /* Allocate memory for sem_ops */ 869 sops = malloc(nsops * sizeof(sops[0]), M_SEM, M_WAITOK); 870 if (!sops) 871 panic("Failed to allocate %d sem_ops", nsops); 872 873 if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) { 874 #ifdef SEM_DEBUG 875 printf("error = %d from copyin(%08x, %08x, %d)\n", error, 876 uap->sops, sops, nsops * sizeof(sops[0])); 877 #endif 878 goto done2; 879 } 880 881 /* 882 * Initial pass thru sops to see what permissions are needed. 883 * Also perform any checks that don't need repeating on each 884 * attempt to satisfy the request vector. 885 */ 886 j = 0; /* permission needed */ 887 do_undos = 0; 888 for (i = 0; i < nsops; i++) { 889 sopptr = &sops[i]; 890 if (sopptr->sem_num >= semaptr->sem_nsems) { 891 error = EFBIG; 892 goto done2; 893 } 894 if (sopptr->sem_flg & SEM_UNDO && sopptr->sem_op != 0) 895 do_undos = 1; 896 j |= (sopptr->sem_op == 0) ? SEM_R : SEM_A; 897 } 898 899 if ((error = ipcperm(td, &semaptr->sem_perm, j))) { 900 #ifdef SEM_DEBUG 901 printf("error = %d from ipaccess\n", error); 902 #endif 903 goto done2; 904 } 905 906 /* 907 * Loop trying to satisfy the vector of requests. 908 * If we reach a point where we must wait, any requests already 909 * performed are rolled back and we go to sleep until some other 910 * process wakes us up. At this point, we start all over again. 911 * 912 * This ensures that from the perspective of other tasks, a set 913 * of requests is atomic (never partially satisfied). 914 */ 915 for (;;) { 916 do_wakeup = 0; 917 error = 0; /* error return if necessary */ 918 919 for (i = 0; i < nsops; i++) { 920 sopptr = &sops[i]; 921 semptr = &semaptr->sem_base[sopptr->sem_num]; 922 923 #ifdef SEM_DEBUG 924 printf("semop: semaptr=%x, sem_base=%x, semptr=%x, sem[%d]=%d : op=%d, flag=%s\n", 925 semaptr, semaptr->sem_base, semptr, 926 sopptr->sem_num, semptr->semval, sopptr->sem_op, 927 (sopptr->sem_flg & IPC_NOWAIT) ? "nowait" : "wait"); 928 #endif 929 930 if (sopptr->sem_op < 0) { 931 if (semptr->semval + sopptr->sem_op < 0) { 932 #ifdef SEM_DEBUG 933 printf("semop: can't do it now\n"); 934 #endif 935 break; 936 } else { 937 semptr->semval += sopptr->sem_op; 938 if (semptr->semval == 0 && 939 semptr->semzcnt > 0) 940 do_wakeup = 1; 941 } 942 } else if (sopptr->sem_op == 0) { 943 if (semptr->semval != 0) { 944 #ifdef SEM_DEBUG 945 printf("semop: not zero now\n"); 946 #endif 947 break; 948 } 949 } else if (semptr->semval + sopptr->sem_op > 950 seminfo.semvmx) { 951 error = ERANGE; 952 break; 953 } else { 954 if (semptr->semncnt > 0) 955 do_wakeup = 1; 956 semptr->semval += sopptr->sem_op; 957 } 958 } 959 960 /* 961 * Did we get through the entire vector? 962 */ 963 if (i >= nsops) 964 goto done; 965 966 /* 967 * No ... rollback anything that we've already done 968 */ 969 #ifdef SEM_DEBUG 970 printf("semop: rollback 0 through %d\n", i-1); 971 #endif 972 for (j = 0; j < i; j++) 973 semaptr->sem_base[sops[j].sem_num].semval -= 974 sops[j].sem_op; 975 976 /* If we detected an error, return it */ 977 if (error != 0) 978 goto done2; 979 980 /* 981 * If the request that we couldn't satisfy has the 982 * NOWAIT flag set then return with EAGAIN. 983 */ 984 if (sopptr->sem_flg & IPC_NOWAIT) { 985 error = EAGAIN; 986 goto done2; 987 } 988 989 if (sopptr->sem_op == 0) 990 semptr->semzcnt++; 991 else 992 semptr->semncnt++; 993 994 #ifdef SEM_DEBUG 995 printf("semop: good night!\n"); 996 #endif 997 error = tsleep((caddr_t)semaptr, (PZERO - 4) | PCATCH, 998 "semwait", 0); 999 #ifdef SEM_DEBUG 1000 printf("semop: good morning (error=%d)!\n", error); 1001 #endif 1002 1003 if (error != 0) { 1004 error = EINTR; 1005 goto done2; 1006 } 1007 #ifdef SEM_DEBUG 1008 printf("semop: good morning!\n"); 1009 #endif 1010 1011 /* 1012 * Make sure that the semaphore still exists 1013 */ 1014 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 || 1015 semaptr->sem_perm.seq != IPCID_TO_SEQ(uap->semid)) { 1016 error = EIDRM; 1017 goto done2; 1018 } 1019 1020 /* 1021 * The semaphore is still alive. Readjust the count of 1022 * waiting processes. 1023 */ 1024 if (sopptr->sem_op == 0) 1025 semptr->semzcnt--; 1026 else 1027 semptr->semncnt--; 1028 } 1029 1030 done: 1031 /* 1032 * Process any SEM_UNDO requests. 1033 */ 1034 if (do_undos) { 1035 suptr = NULL; 1036 for (i = 0; i < nsops; i++) { 1037 /* 1038 * We only need to deal with SEM_UNDO's for non-zero 1039 * op's. 1040 */ 1041 int adjval; 1042 1043 if ((sops[i].sem_flg & SEM_UNDO) == 0) 1044 continue; 1045 adjval = sops[i].sem_op; 1046 if (adjval == 0) 1047 continue; 1048 error = semundo_adjust(td, &suptr, semid, 1049 sops[i].sem_num, -adjval); 1050 if (error == 0) 1051 continue; 1052 1053 /* 1054 * Oh-Oh! We ran out of either sem_undo's or undo's. 1055 * Rollback the adjustments to this point and then 1056 * rollback the semaphore ups and down so we can return 1057 * with an error with all structures restored. We 1058 * rollback the undo's in the exact reverse order that 1059 * we applied them. This guarantees that we won't run 1060 * out of space as we roll things back out. 1061 */ 1062 for (j = i - 1; j >= 0; j--) { 1063 if ((sops[j].sem_flg & SEM_UNDO) == 0) 1064 continue; 1065 adjval = sops[j].sem_op; 1066 if (adjval == 0) 1067 continue; 1068 if (semundo_adjust(td, &suptr, semid, 1069 sops[j].sem_num, adjval) != 0) 1070 panic("semop - can't undo undos"); 1071 } 1072 1073 for (j = 0; j < nsops; j++) 1074 semaptr->sem_base[sops[j].sem_num].semval -= 1075 sops[j].sem_op; 1076 1077 #ifdef SEM_DEBUG 1078 printf("error = %d from semundo_adjust\n", error); 1079 #endif 1080 goto done2; 1081 } /* loop through the sops */ 1082 } /* if (do_undos) */ 1083 1084 /* We're definitely done - set the sempid's and time */ 1085 for (i = 0; i < nsops; i++) { 1086 sopptr = &sops[i]; 1087 semptr = &semaptr->sem_base[sopptr->sem_num]; 1088 semptr->sempid = td->td_proc->p_pid; 1089 } 1090 semaptr->sem_otime = time_second; 1091 1092 /* 1093 * Do a wakeup if any semaphore was up'd whilst something was 1094 * sleeping on it. 1095 */ 1096 if (do_wakeup) { 1097 #ifdef SEM_DEBUG 1098 printf("semop: doing wakeup\n"); 1099 #endif 1100 wakeup((caddr_t)semaptr); 1101 #ifdef SEM_DEBUG 1102 printf("semop: back from wakeup\n"); 1103 #endif 1104 } 1105 #ifdef SEM_DEBUG 1106 printf("semop: done\n"); 1107 #endif 1108 td->td_retval[0] = 0; 1109 done2: 1110 if (sops) 1111 free(sops, M_SEM); 1112 mtx_unlock(&Giant); 1113 return (error); 1114 } 1115 1116 /* 1117 * Go through the undo structures for this process and apply the adjustments to 1118 * semaphores. 1119 */ 1120 static void 1121 semexit_myhook(p) 1122 struct proc *p; 1123 { 1124 register struct sem_undo *suptr; 1125 register struct sem_undo **supptr; 1126 1127 /* 1128 * Go through the chain of undo vectors looking for one 1129 * associated with this process. 1130 */ 1131 1132 for (supptr = &semu_list; (suptr = *supptr) != NULL; 1133 supptr = &suptr->un_next) { 1134 if (suptr->un_proc == p) 1135 break; 1136 } 1137 1138 if (suptr == NULL) 1139 return; 1140 1141 #ifdef SEM_DEBUG 1142 printf("proc @%08x has undo structure with %d entries\n", p, 1143 suptr->un_cnt); 1144 #endif 1145 1146 /* 1147 * If there are any active undo elements then process them. 1148 */ 1149 if (suptr->un_cnt > 0) { 1150 int ix; 1151 1152 for (ix = 0; ix < suptr->un_cnt; ix++) { 1153 int semid = suptr->un_ent[ix].un_id; 1154 int semnum = suptr->un_ent[ix].un_num; 1155 int adjval = suptr->un_ent[ix].un_adjval; 1156 struct semid_ds *semaptr; 1157 1158 semaptr = &sema[semid]; 1159 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0) 1160 panic("semexit - semid not allocated"); 1161 if (semnum >= semaptr->sem_nsems) 1162 panic("semexit - semnum out of range"); 1163 1164 #ifdef SEM_DEBUG 1165 printf("semexit: %08x id=%d num=%d(adj=%d) ; sem=%d\n", 1166 suptr->un_proc, suptr->un_ent[ix].un_id, 1167 suptr->un_ent[ix].un_num, 1168 suptr->un_ent[ix].un_adjval, 1169 semaptr->sem_base[semnum].semval); 1170 #endif 1171 1172 if (adjval < 0) { 1173 if (semaptr->sem_base[semnum].semval < -adjval) 1174 semaptr->sem_base[semnum].semval = 0; 1175 else 1176 semaptr->sem_base[semnum].semval += 1177 adjval; 1178 } else 1179 semaptr->sem_base[semnum].semval += adjval; 1180 1181 wakeup((caddr_t)semaptr); 1182 #ifdef SEM_DEBUG 1183 printf("semexit: back from wakeup\n"); 1184 #endif 1185 } 1186 } 1187 1188 /* 1189 * Deallocate the undo vector. 1190 */ 1191 #ifdef SEM_DEBUG 1192 printf("removing vector\n"); 1193 #endif 1194 suptr->un_proc = NULL; 1195 *supptr = suptr->un_next; 1196 } 1197 1198 static int 1199 sysctl_sema(SYSCTL_HANDLER_ARGS) 1200 { 1201 1202 return (SYSCTL_OUT(req, sema, 1203 sizeof(struct semid_ds) * seminfo.semmni)); 1204 } 1205