1/* $NetBSD: sysv_sem.c,v 1.95 2015/11/06 02:26:42 pgoyette Exp $ */
2
3/*-
4 * Copyright (c) 1999, 2007 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9 * NASA Ames Research Center, and by Andrew Doran.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33/*
34 * Implementation of SVID semaphores
35 *
36 * Author: Daniel Boulet
37 *
38 * This software is provided ``AS IS'' without any warranties of any kind.
39 */
40
41#include <sys/cdefs.h>
42__KERNEL_RCSID(0, "$NetBSD: sysv_sem.c,v 1.95 2015/11/06 02:26:42 pgoyette Exp $");
43
44#ifdef _KERNEL_OPT
45#include "opt_sysv.h"
46#endif
47
48#include <sys/param.h>
49#include <sys/kernel.h>
50#include <sys/sem.h>
51#include <sys/sysctl.h>
52#include <sys/kmem.h>
53#include <sys/mount.h> /* XXX for <sys/syscallargs.h> */
54#include <sys/syscallargs.h>
55#include <sys/kauth.h>
56#include <sys/once.h>
57
58/*
59 * Memory areas:
60 * 1st: Pool of semaphore identifiers
61 * 2nd: Semaphores
62 * 3rd: Conditional variables
63 * 4th: Undo structures
64 */
65struct semid_ds * sema __read_mostly;
66static struct __sem * sem __read_mostly;
67static kcondvar_t * semcv __read_mostly;
68static int * semu __read_mostly;
69
70static kmutex_t semlock __cacheline_aligned;
71static bool sem_realloc_state __read_mostly;
72static kcondvar_t sem_realloc_cv;
73
74/*
75 * List of active undo structures, total number of semaphores,
76 * and total number of semop waiters.
77 */
78static struct sem_undo *semu_list __read_mostly;
79static u_int semtot __cacheline_aligned;
80static u_int sem_waiters __cacheline_aligned;
81
82/* Macro to find a particular sem_undo vector */
83#define SEMU(s, ix) ((struct sem_undo *)(((long)s) + ix * seminfo.semusz))
84
85#ifdef SEM_DEBUG
86#define SEM_PRINTF(a) printf a
87#else
88#define SEM_PRINTF(a)
89#endif
90
91void *hook; /* cookie from exithook_establish() */
92
93extern int kern_has_sysvsem;
94
95SYSCTL_SETUP_PROTO(sysctl_ipc_sem_setup);
96
97struct sem_undo *semu_alloc(struct proc *);
98int semundo_adjust(struct proc *, struct sem_undo **, int, int, int);
99void semundo_clear(int, int);
100
101static ONCE_DECL(exithook_control);
102static int seminit_exithook(void);
103
104void
105seminit(struct sysctllog **clog)
106{
107 int i, sz;
108 vaddr_t v;
109
110 mutex_init(&semlock, MUTEX_DEFAULT, IPL_NONE);
111 cv_init(&sem_realloc_cv, "semrealc");
112 sem_realloc_state = false;
113 semtot = 0;
114 sem_waiters = 0;
115
116 /* Allocate the wired memory for our structures */
117 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
118 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
119 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
120 ALIGN(seminfo.semmnu * seminfo.semusz);
121 sz = round_page(sz);
122 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
123 if (v == 0)
124 panic("sysv_sem: cannot allocate memory");
125 sema = (void *)v;
126 sem = (void *)((uintptr_t)sema +
127 ALIGN(seminfo.semmni * sizeof(struct semid_ds)));
128 semcv = (void *)((uintptr_t)sem +
129 ALIGN(seminfo.semmns * sizeof(struct __sem)));
130 semu = (void *)((uintptr_t)semcv +
131 ALIGN(seminfo.semmni * sizeof(kcondvar_t)));
132
133 for (i = 0; i < seminfo.semmni; i++) {
134 sema[i]._sem_base = 0;
135 sema[i].sem_perm.mode = 0;
136 cv_init(&semcv[i], "semwait");
137 }
138 for (i = 0; i < seminfo.semmnu; i++) {
139 struct sem_undo *suptr = SEMU(semu, i);
140 suptr->un_proc = NULL;
141 }
142 semu_list = NULL;
143
144 kern_has_sysvsem = 1;
145
146#ifdef _MODULE
147 if (clog)
148 sysctl_ipc_sem_setup(clog);
149#endif
150}
151
152static int
153seminit_exithook(void)
154{
155
156 hook = exithook_establish(semexit, NULL);
157 return 0;
158}
159
160int
161semfini(void)
162{
163 int i, sz;
164 vaddr_t v = (vaddr_t)sema;
165
166 /* Don't allow module unload if we're busy */
167 mutex_enter(&semlock);
168 if (semtot) {
169 mutex_exit(&semlock);
170 return 1;
171 }
172
173 /* Remove the exit hook */
174 if (hook)
175 exithook_disestablish(hook);
176
177 /* Destroy all our condvars */
178 for (i = 0; i < seminfo.semmni; i++) {
179 cv_destroy(&semcv[i]);
180 }
181
182 /* Free the wired memory that we allocated */
183 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
184 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
185 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
186 ALIGN(seminfo.semmnu * seminfo.semusz);
187 sz = round_page(sz);
188 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
189
190 /* Destroy the last cv and mutex */
191 cv_destroy(&sem_realloc_cv);
192 mutex_exit(&semlock);
193 mutex_destroy(&semlock);
194
195 kern_has_sysvsem = 0;
196
197 return 0;
198}
199
200static int
201semrealloc(int newsemmni, int newsemmns, int newsemmnu)
202{
203 struct semid_ds *new_sema, *old_sema;
204 struct __sem *new_sem;
205 struct sem_undo *new_semu_list, *suptr, *nsuptr;
206 int *new_semu;
207 kcondvar_t *new_semcv;
208 vaddr_t v;
209 int i, j, lsemid, nmnus, sz;
210
211 if (newsemmni < 1 || newsemmns < 1 || newsemmnu < 1)
212 return EINVAL;
213
214 /* Allocate the wired memory for our structures */
215 sz = ALIGN(newsemmni * sizeof(struct semid_ds)) +
216 ALIGN(newsemmns * sizeof(struct __sem)) +
217 ALIGN(newsemmni * sizeof(kcondvar_t)) +
218 ALIGN(newsemmnu * seminfo.semusz);
219 sz = round_page(sz);
220 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
221 if (v == 0)
222 return ENOMEM;
223
224 mutex_enter(&semlock);
225 if (sem_realloc_state) {
226 mutex_exit(&semlock);
227 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
228 return EBUSY;
229 }
230 sem_realloc_state = true;
231 if (sem_waiters) {
232 /*
233 * Mark reallocation state, wake-up all waiters,
234 * and wait while they will all exit.
235 */
236 for (i = 0; i < seminfo.semmni; i++)
237 cv_broadcast(&semcv[i]);
238 while (sem_waiters)
239 cv_wait(&sem_realloc_cv, &semlock);
240 }
241 old_sema = sema;
242
243 /* Get the number of last slot */
244 lsemid = 0;
245 for (i = 0; i < seminfo.semmni; i++)
246 if (sema[i].sem_perm.mode & SEM_ALLOC)
247 lsemid = i;
248
249 /* Get the number of currently used undo structures */
250 nmnus = 0;
251 for (i = 0; i < seminfo.semmnu; i++) {
252 suptr = SEMU(semu, i);
253 if (suptr->un_proc == NULL)
254 continue;
255 nmnus++;
256 }
257
258 /* We cannot reallocate less memory than we use */
259 if (lsemid >= newsemmni || semtot > newsemmns || nmnus > newsemmnu) {
260 mutex_exit(&semlock);
261 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
262 return EBUSY;
263 }
264
265 new_sema = (void *)v;
266 new_sem = (void *)((uintptr_t)new_sema +
267 ALIGN(newsemmni * sizeof(struct semid_ds)));
268 new_semcv = (void *)((uintptr_t)new_sem +
269 ALIGN(newsemmns * sizeof(struct __sem)));
270 new_semu = (void *)((uintptr_t)new_semcv +
271 ALIGN(newsemmni * sizeof(kcondvar_t)));
272
273 /* Initialize all semaphore identifiers and condvars */
274 for (i = 0; i < newsemmni; i++) {
275 new_sema[i]._sem_base = 0;
276 new_sema[i].sem_perm.mode = 0;
277 cv_init(&new_semcv[i], "semwait");
278 }
279 for (i = 0; i < newsemmnu; i++) {
280 nsuptr = SEMU(new_semu, i);
281 nsuptr->un_proc = NULL;
282 }
283
284 /*
285 * Copy all identifiers, semaphores and list of the
286 * undo structures to the new memory allocation.
287 */
288 j = 0;
289 for (i = 0; i <= lsemid; i++) {
290 if ((sema[i].sem_perm.mode & SEM_ALLOC) == 0)
291 continue;
292 memcpy(&new_sema[i], &sema[i], sizeof(struct semid_ds));
293 new_sema[i]._sem_base = &new_sem[j];
294 memcpy(new_sema[i]._sem_base, sema[i]._sem_base,
295 (sizeof(struct __sem) * sema[i].sem_nsems));
296 j += sema[i].sem_nsems;
297 }
298 KASSERT(j == semtot);
299
300 j = 0;
301 new_semu_list = NULL;
302 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next) {
303 KASSERT(j < newsemmnu);
304 nsuptr = SEMU(new_semu, j);
305 memcpy(nsuptr, suptr, SEMUSZ);
306 nsuptr->un_next = new_semu_list;
307 new_semu_list = nsuptr;
308 j++;
309 }
310
311 for (i = 0; i < seminfo.semmni; i++) {
312 KASSERT(cv_has_waiters(&semcv[i]) == false);
313 cv_destroy(&semcv[i]);
314 }
315
316 sz = ALIGN(seminfo.semmni * sizeof(struct semid_ds)) +
317 ALIGN(seminfo.semmns * sizeof(struct __sem)) +
318 ALIGN(seminfo.semmni * sizeof(kcondvar_t)) +
319 ALIGN(seminfo.semmnu * seminfo.semusz);
320 sz = round_page(sz);
321
322 /* Set the pointers and update the new values */
323 sema = new_sema;
324 sem = new_sem;
325 semcv = new_semcv;
326 semu = new_semu;
327 semu_list = new_semu_list;
328
329 seminfo.semmni = newsemmni;
330 seminfo.semmns = newsemmns;
331 seminfo.semmnu = newsemmnu;
332
333 /* Reallocation completed - notify all waiters, if any */
334 sem_realloc_state = false;
335 cv_broadcast(&sem_realloc_cv);
336 mutex_exit(&semlock);
337
338 uvm_km_free(kernel_map, (vaddr_t)old_sema, sz, UVM_KMF_WIRED);
339 return 0;
340}
341
342/*
343 * Placebo.
344 */
345
346int
347sys_semconfig(struct lwp *l, const struct sys_semconfig_args *uap, register_t *retval)
348{
349
350 RUN_ONCE(&exithook_control, seminit_exithook);
351
352 *retval = 0;
353 return 0;
354}
355
356/*
357 * Allocate a new sem_undo structure for a process.
358 * => Returns NULL on failure.
359 */
360struct sem_undo *
361semu_alloc(struct proc *p)
362{
363 struct sem_undo *suptr, **supptr;
364 bool attempted = false;
365 int i;
366
367 KASSERT(mutex_owned(&semlock));
368again:
369 /* Look for a free structure. */
370 for (i = 0; i < seminfo.semmnu; i++) {
371 suptr = SEMU(semu, i);
372 if (suptr->un_proc == NULL) {
373 /* Found. Fill it in and return. */
374 suptr->un_next = semu_list;
375 semu_list = suptr;
376 suptr->un_cnt = 0;
377 suptr->un_proc = p;
378 return suptr;
379 }
380 }
381
382 /* Not found. Attempt to free some structures. */
383 if (!attempted) {
384 bool freed = false;
385
386 attempted = true;
387 supptr = &semu_list;
388 while ((suptr = *supptr) != NULL) {
389 if (suptr->un_cnt == 0) {
390 suptr->un_proc = NULL;
391 *supptr = suptr->un_next;
392 freed = true;
393 } else {
394 supptr = &suptr->un_next;
395 }
396 }
397 if (freed) {
398 goto again;
399 }
400 }
401 return NULL;
402}
403
404/*
405 * Adjust a particular entry for a particular proc
406 */
407
408int
409semundo_adjust(struct proc *p, struct sem_undo **supptr, int semid, int semnum,
410 int adjval)
411{
412 struct sem_undo *suptr;
413 struct sem_undo_entry *sunptr;
414 int i;
415
416 KASSERT(mutex_owned(&semlock));
417
418 /*
419 * Look for and remember the sem_undo if the caller doesn't
420 * provide it
421 */
422
423 suptr = *supptr;
424 if (suptr == NULL) {
425 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
426 if (suptr->un_proc == p)
427 break;
428
429 if (suptr == NULL) {
430 suptr = semu_alloc(p);
431 if (suptr == NULL)
432 return (ENOSPC);
433 }
434 *supptr = suptr;
435 }
436
437 /*
438 * Look for the requested entry and adjust it (delete if
439 * adjval becomes 0).
440 */
441 sunptr = &suptr->un_ent[0];
442 for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
443 if (sunptr->un_id != semid || sunptr->un_num != semnum)
444 continue;
445 sunptr->un_adjval += adjval;
446 if (sunptr->un_adjval == 0) {
447 suptr->un_cnt--;
448 if (i < suptr->un_cnt)
449 suptr->un_ent[i] =
450 suptr->un_ent[suptr->un_cnt];
451 }
452 return (0);
453 }
454
455 /* Didn't find the right entry - create it */
456 if (suptr->un_cnt == SEMUME)
457 return (EINVAL);
458
459 sunptr = &suptr->un_ent[suptr->un_cnt];
460 suptr->un_cnt++;
461 sunptr->un_adjval = adjval;
462 sunptr->un_id = semid;
463 sunptr->un_num = semnum;
464 return (0);
465}
466
467void
468semundo_clear(int semid, int semnum)
469{
470 struct sem_undo *suptr;
471 struct sem_undo_entry *sunptr, *sunend;
472
473 KASSERT(mutex_owned(&semlock));
474
475 for (suptr = semu_list; suptr != NULL; suptr = suptr->un_next)
476 for (sunptr = &suptr->un_ent[0],
477 sunend = sunptr + suptr->un_cnt; sunptr < sunend;) {
478 if (sunptr->un_id == semid) {
479 if (semnum == -1 || sunptr->un_num == semnum) {
480 suptr->un_cnt--;
481 sunend--;
482 if (sunptr != sunend)
483 *sunptr = *sunend;
484 if (semnum != -1)
485 break;
486 else
487 continue;
488 }
489 }
490 sunptr++;
491 }
492}
493
494int
495sys_____semctl50(struct lwp *l, const struct sys_____semctl50_args *uap,
496 register_t *retval)
497{
498 /* {
499 syscallarg(int) semid;
500 syscallarg(int) semnum;
501 syscallarg(int) cmd;
502 syscallarg(union __semun *) arg;
503 } */
504 struct semid_ds sembuf;
505 int cmd, error;
506 void *pass_arg;
507 union __semun karg;
508
509 RUN_ONCE(&exithook_control, seminit_exithook);
510
511 cmd = SCARG(uap, cmd);
512
513 pass_arg = get_semctl_arg(cmd, &sembuf, &karg);
514
515 if (pass_arg) {
516 error = copyin(SCARG(uap, arg), &karg, sizeof(karg));
517 if (error)
518 return error;
519 if (cmd == IPC_SET) {
520 error = copyin(karg.buf, &sembuf, sizeof(sembuf));
521 if (error)
522 return (error);
523 }
524 }
525
526 error = semctl1(l, SCARG(uap, semid), SCARG(uap, semnum), cmd,
527 pass_arg, retval);
528
529 if (error == 0 && cmd == IPC_STAT)
530 error = copyout(&sembuf, karg.buf, sizeof(sembuf));
531
532 return (error);
533}
534
535int
536semctl1(struct lwp *l, int semid, int semnum, int cmd, void *v,
537 register_t *retval)
538{
539 kauth_cred_t cred = l->l_cred;
540 union __semun *arg = v;
541 struct semid_ds *sembuf = v, *semaptr;
542 int i, error, ix;
543
544 SEM_PRINTF(("call to semctl(%d, %d, %d, %p)\n",
545 semid, semnum, cmd, v));
546
547 mutex_enter(&semlock);
548
549 ix = IPCID_TO_IX(semid);
550 if (ix < 0 || ix >= seminfo.semmni) {
551 mutex_exit(&semlock);
552 return (EINVAL);
553 }
554
555 semaptr = &sema[ix];
556 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
557 semaptr->sem_perm._seq != IPCID_TO_SEQ(semid)) {
558 mutex_exit(&semlock);
559 return (EINVAL);
560 }
561
562 switch (cmd) {
563 case IPC_RMID:
564 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)) != 0)
565 break;
566 semaptr->sem_perm.cuid = kauth_cred_geteuid(cred);
567 semaptr->sem_perm.uid = kauth_cred_geteuid(cred);
568 semtot -= semaptr->sem_nsems;
569 for (i = semaptr->_sem_base - sem; i < semtot; i++)
570 sem[i] = sem[i + semaptr->sem_nsems];
571 for (i = 0; i < seminfo.semmni; i++) {
572 if ((sema[i].sem_perm.mode & SEM_ALLOC) &&
573 sema[i]._sem_base > semaptr->_sem_base)
574 sema[i]._sem_base -= semaptr->sem_nsems;
575 }
576 semaptr->sem_perm.mode = 0;
577 semundo_clear(ix, -1);
578 cv_broadcast(&semcv[ix]);
579 break;
580
581 case IPC_SET:
582 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_M)))
583 break;
584 KASSERT(sembuf != NULL);
585 semaptr->sem_perm.uid = sembuf->sem_perm.uid;
586 semaptr->sem_perm.gid = sembuf->sem_perm.gid;
587 semaptr->sem_perm.mode = (semaptr->sem_perm.mode & ~0777) |
588 (sembuf->sem_perm.mode & 0777);
589 semaptr->sem_ctime = time_second;
590 break;
591
592 case IPC_STAT:
593 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
594 break;
595 KASSERT(sembuf != NULL);
596 memcpy(sembuf, semaptr, sizeof(struct semid_ds));
597 sembuf->sem_perm.mode &= 0777;
598 break;
599
600 case GETNCNT:
601 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
602 break;
603 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
604 error = EINVAL;
605 break;
606 }
607 *retval = semaptr->_sem_base[semnum].semncnt;
608 break;
609
610 case GETPID:
611 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
612 break;
613 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
614 error = EINVAL;
615 break;
616 }
617 *retval = semaptr->_sem_base[semnum].sempid;
618 break;
619
620 case GETVAL:
621 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
622 break;
623 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
624 error = EINVAL;
625 break;
626 }
627 *retval = semaptr->_sem_base[semnum].semval;
628 break;
629
630 case GETALL:
631 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
632 break;
633 KASSERT(arg != NULL);
634 for (i = 0; i < semaptr->sem_nsems; i++) {
635 error = copyout(&semaptr->_sem_base[i].semval,
636 &arg->array[i], sizeof(arg->array[i]));
637 if (error != 0)
638 break;
639 }
640 break;
641
642 case GETZCNT:
643 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_R)))
644 break;
645 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
646 error = EINVAL;
647 break;
648 }
649 *retval = semaptr->_sem_base[semnum].semzcnt;
650 break;
651
652 case SETVAL:
653 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
654 break;
655 if (semnum < 0 || semnum >= semaptr->sem_nsems) {
656 error = EINVAL;
657 break;
658 }
659 KASSERT(arg != NULL);
660 if ((unsigned int)arg->val > seminfo.semvmx) {
661 error = ERANGE;
662 break;
663 }
664 semaptr->_sem_base[semnum].semval = arg->val;
665 semundo_clear(ix, semnum);
666 cv_broadcast(&semcv[ix]);
667 break;
668
669 case SETALL:
670 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W)))
671 break;
672 KASSERT(arg != NULL);
673 for (i = 0; i < semaptr->sem_nsems; i++) {
674 unsigned short semval;
675 error = copyin(&arg->array[i], &semval,
676 sizeof(arg->array[i]));
677 if (error != 0)
678 break;
679 if ((unsigned int)semval > seminfo.semvmx) {
680 error = ERANGE;
681 break;
682 }
683 semaptr->_sem_base[i].semval = semval;
684 }
685 semundo_clear(ix, -1);
686 cv_broadcast(&semcv[ix]);
687 break;
688
689 default:
690 error = EINVAL;
691 break;
692 }
693
694 mutex_exit(&semlock);
695 return (error);
696}
697
698int
699sys_semget(struct lwp *l, const struct sys_semget_args *uap, register_t *retval)
700{
701 /* {
702 syscallarg(key_t) key;
703 syscallarg(int) nsems;
704 syscallarg(int) semflg;
705 } */
706 int semid, error = 0;
707 int key = SCARG(uap, key);
708 int nsems = SCARG(uap, nsems);
709 int semflg = SCARG(uap, semflg);
710 kauth_cred_t cred = l->l_cred;
711
712 RUN_ONCE(&exithook_control, seminit_exithook);
713
714 SEM_PRINTF(("semget(0x%x, %d, 0%o)\n", key, nsems, semflg));
715
716 mutex_enter(&semlock);
717
718 if (key != IPC_PRIVATE) {
719 for (semid = 0; semid < seminfo.semmni; semid++) {
720 if ((sema[semid].sem_perm.mode & SEM_ALLOC) &&
721 sema[semid].sem_perm._key == key)
722 break;
723 }
724 if (semid < seminfo.semmni) {
725 SEM_PRINTF(("found public key\n"));
726 if ((error = ipcperm(cred, &sema[semid].sem_perm,
727 semflg & 0700)))
728 goto out;
729 if (nsems > 0 && sema[semid].sem_nsems < nsems) {
730 SEM_PRINTF(("too small\n"));
731 error = EINVAL;
732 goto out;
733 }
734 if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) {
735 SEM_PRINTF(("not exclusive\n"));
736 error = EEXIST;
737 goto out;
738 }
739 goto found;
740 }
741 }
742
743 SEM_PRINTF(("need to allocate the semid_ds\n"));
744 if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) {
745 if (nsems <= 0 || nsems > seminfo.semmsl) {
746 SEM_PRINTF(("nsems out of range (0<%d<=%d)\n", nsems,
747 seminfo.semmsl));
748 error = EINVAL;
749 goto out;
750 }
751 if (nsems > seminfo.semmns - semtot) {
752 SEM_PRINTF(("not enough semaphores left "
753 "(need %d, got %d)\n",
754 nsems, seminfo.semmns - semtot));
755 error = ENOSPC;
756 goto out;
757 }
758 for (semid = 0; semid < seminfo.semmni; semid++) {
759 if ((sema[semid].sem_perm.mode & SEM_ALLOC) == 0)
760 break;
761 }
762 if (semid == seminfo.semmni) {
763 SEM_PRINTF(("no more semid_ds's available\n"));
764 error = ENOSPC;
765 goto out;
766 }
767 SEM_PRINTF(("semid %d is available\n", semid));
768 sema[semid].sem_perm._key = key;
769 sema[semid].sem_perm.cuid = kauth_cred_geteuid(cred);
770 sema[semid].sem_perm.uid = kauth_cred_geteuid(cred);
771 sema[semid].sem_perm.cgid = kauth_cred_getegid(cred);
772 sema[semid].sem_perm.gid = kauth_cred_getegid(cred);
773 sema[semid].sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
774 sema[semid].sem_perm._seq =
775 (sema[semid].sem_perm._seq + 1) & 0x7fff;
776 sema[semid].sem_nsems = nsems;
777 sema[semid].sem_otime = 0;
778 sema[semid].sem_ctime = time_second;
779 sema[semid]._sem_base = &sem[semtot];
780 semtot += nsems;
781 memset(sema[semid]._sem_base, 0,
782 sizeof(sema[semid]._sem_base[0]) * nsems);
783 SEM_PRINTF(("sembase = %p, next = %p\n", sema[semid]._sem_base,
784 &sem[semtot]));
785 } else {
786 SEM_PRINTF(("didn't find it and wasn't asked to create it\n"));
787 error = ENOENT;
788 goto out;
789 }
790
791 found:
792 *retval = IXSEQ_TO_IPCID(semid, sema[semid].sem_perm);
793 out:
794 mutex_exit(&semlock);
795 return (error);
796}
797
798#define SMALL_SOPS 8
799
800int
801sys_semop(struct lwp *l, const struct sys_semop_args *uap, register_t *retval)
802{
803 /* {
804 syscallarg(int) semid;
805 syscallarg(struct sembuf *) sops;
806 syscallarg(size_t) nsops;
807 } */
808 struct proc *p = l->l_proc;
809 int semid = SCARG(uap, semid), seq;
810 size_t nsops = SCARG(uap, nsops);
811 struct sembuf small_sops[SMALL_SOPS];
812 struct sembuf *sops;
813 struct semid_ds *semaptr;
814 struct sembuf *sopptr = NULL;
815 struct __sem *semptr = NULL;
816 struct sem_undo *suptr = NULL;
817 kauth_cred_t cred = l->l_cred;
818 int i, error;
819 int do_wakeup, do_undos;
820
821 RUN_ONCE(&exithook_control, seminit_exithook);
822
823 SEM_PRINTF(("call to semop(%d, %p, %zd)\n", semid, SCARG(uap,sops), nsops));
824
825 if (__predict_false((p->p_flag & PK_SYSVSEM) == 0)) {
826 mutex_enter(p->p_lock);
827 p->p_flag |= PK_SYSVSEM;
828 mutex_exit(p->p_lock);
829 }
830
831restart:
832 if (nsops <= SMALL_SOPS) {
833 sops = small_sops;
834 } else if (nsops <= seminfo.semopm) {
835 sops = kmem_alloc(nsops * sizeof(*sops), KM_SLEEP);
836 } else {
837 SEM_PRINTF(("too many sops (max=%d, nsops=%zd)\n",
838 seminfo.semopm, nsops));
839 return (E2BIG);
840 }
841
842 error = copyin(SCARG(uap, sops), sops, nsops * sizeof(sops[0]));
843 if (error) {
844 SEM_PRINTF(("error = %d from copyin(%p, %p, %zd)\n", error,
845 SCARG(uap, sops), &sops, nsops * sizeof(sops[0])));
846 if (sops != small_sops)
847 kmem_free(sops, nsops * sizeof(*sops));
848 return error;
849 }
850
851 mutex_enter(&semlock);
852 /* In case of reallocation, we will wait for completion */
853 while (__predict_false(sem_realloc_state))
854 cv_wait(&sem_realloc_cv, &semlock);
855
856 semid = IPCID_TO_IX(semid); /* Convert back to zero origin */
857 if (semid < 0 || semid >= seminfo.semmni) {
858 error = EINVAL;
859 goto out;
860 }
861
862 semaptr = &sema[semid];
863 seq = IPCID_TO_SEQ(SCARG(uap, semid));
864 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
865 semaptr->sem_perm._seq != seq) {
866 error = EINVAL;
867 goto out;
868 }
869
870 if ((error = ipcperm(cred, &semaptr->sem_perm, IPC_W))) {
871 SEM_PRINTF(("error = %d from ipaccess\n", error));
872 goto out;
873 }
874
875 for (i = 0; i < nsops; i++)
876 if (sops[i].sem_num >= semaptr->sem_nsems) {
877 error = EFBIG;
878 goto out;
879 }
880
881 /*
882 * Loop trying to satisfy the vector of requests.
883 * If we reach a point where we must wait, any requests already
884 * performed are rolled back and we go to sleep until some other
885 * process wakes us up. At this point, we start all over again.
886 *
887 * This ensures that from the perspective of other tasks, a set
888 * of requests is atomic (never partially satisfied).
889 */
890 do_undos = 0;
891
892 for (;;) {
893 do_wakeup = 0;
894
895 for (i = 0; i < nsops; i++) {
896 sopptr = &sops[i];
897 semptr = &semaptr->_sem_base[sopptr->sem_num];
898
899 SEM_PRINTF(("semop: semaptr=%p, sem_base=%p, "
900 "semptr=%p, sem[%d]=%d : op=%d, flag=%s\n",
901 semaptr, semaptr->_sem_base, semptr,
902 sopptr->sem_num, semptr->semval, sopptr->sem_op,
903 (sopptr->sem_flg & IPC_NOWAIT) ?
904 "nowait" : "wait"));
905
906 if (sopptr->sem_op < 0) {
907 if ((int)(semptr->semval +
908 sopptr->sem_op) < 0) {
909 SEM_PRINTF(("semop: "
910 "can't do it now\n"));
911 break;
912 } else {
913 semptr->semval += sopptr->sem_op;
914 if (semptr->semval == 0 &&
915 semptr->semzcnt > 0)
916 do_wakeup = 1;
917 }
918 if (sopptr->sem_flg & SEM_UNDO)
919 do_undos = 1;
920 } else if (sopptr->sem_op == 0) {
921 if (semptr->semval > 0) {
922 SEM_PRINTF(("semop: not zero now\n"));
923 break;
924 }
925 } else {
926 if (semptr->semncnt > 0)
927 do_wakeup = 1;
928 semptr->semval += sopptr->sem_op;
929 if (sopptr->sem_flg & SEM_UNDO)
930 do_undos = 1;
931 }
932 }
933
934 /*
935 * Did we get through the entire vector?
936 */
937 if (i >= nsops)
938 goto done;
939
940 /*
941 * No ... rollback anything that we've already done
942 */
943 SEM_PRINTF(("semop: rollback 0 through %d\n", i - 1));
944 while (i-- > 0)
945 semaptr->_sem_base[sops[i].sem_num].semval -=
946 sops[i].sem_op;
947
948 /*
949 * If the request that we couldn't satisfy has the
950 * NOWAIT flag set then return with EAGAIN.
951 */
952 if (sopptr->sem_flg & IPC_NOWAIT) {
953 error = EAGAIN;
954 goto out;
955 }
956
957 if (sopptr->sem_op == 0)
958 semptr->semzcnt++;
959 else
960 semptr->semncnt++;
961
962 sem_waiters++;
963 SEM_PRINTF(("semop: good night!\n"));
964 error = cv_wait_sig(&semcv[semid], &semlock);
965 SEM_PRINTF(("semop: good morning (error=%d)!\n", error));
966 sem_waiters--;
967
968 /* Notify reallocator, if it is waiting */
969 cv_broadcast(&sem_realloc_cv);
970
971 /*
972 * Make sure that the semaphore still exists
973 */
974 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0 ||
975 semaptr->sem_perm._seq != seq) {
976 error = EIDRM;
977 goto out;
978 }
979
980 /*
981 * The semaphore is still alive. Readjust the count of
982 * waiting processes.
983 */
984 semptr = &semaptr->_sem_base[sopptr->sem_num];
985 if (sopptr->sem_op == 0)
986 semptr->semzcnt--;
987 else
988 semptr->semncnt--;
989
990 /* In case of such state, restart the call */
991 if (sem_realloc_state) {
992 mutex_exit(&semlock);
993 goto restart;
994 }
995
996 /* Is it really morning, or was our sleep interrupted? */
997 if (error != 0) {
998 error = EINTR;
999 goto out;
1000 }
1001 SEM_PRINTF(("semop: good morning!\n"));
1002 }
1003
1004done:
1005 /*
1006 * Process any SEM_UNDO requests.
1007 */
1008 if (do_undos) {
1009 for (i = 0; i < nsops; i++) {
1010 /*
1011 * We only need to deal with SEM_UNDO's for non-zero
1012 * op's.
1013 */
1014 int adjval;
1015
1016 if ((sops[i].sem_flg & SEM_UNDO) == 0)
1017 continue;
1018 adjval = sops[i].sem_op;
1019 if (adjval == 0)
1020 continue;
1021 error = semundo_adjust(p, &suptr, semid,
1022 sops[i].sem_num, -adjval);
1023 if (error == 0)
1024 continue;
1025
1026 /*
1027 * Oh-Oh! We ran out of either sem_undo's or undo's.
1028 * Rollback the adjustments to this point and then
1029 * rollback the semaphore ups and down so we can return
1030 * with an error with all structures restored. We
1031 * rollback the undo's in the exact reverse order that
1032 * we applied them. This guarantees that we won't run
1033 * out of space as we roll things back out.
1034 */
1035 while (i-- > 0) {
1036 if ((sops[i].sem_flg & SEM_UNDO) == 0)
1037 continue;
1038 adjval = sops[i].sem_op;
1039 if (adjval == 0)
1040 continue;
1041 if (semundo_adjust(p, &suptr, semid,
1042 sops[i].sem_num, adjval) != 0)
1043 panic("semop - can't undo undos");
1044 }
1045
1046 for (i = 0; i < nsops; i++)
1047 semaptr->_sem_base[sops[i].sem_num].semval -=
1048 sops[i].sem_op;
1049
1050 SEM_PRINTF(("error = %d from semundo_adjust\n", error));
1051 goto out;
1052 } /* loop through the sops */
1053 } /* if (do_undos) */
1054
1055 /* We're definitely done - set the sempid's */
1056 for (i = 0; i < nsops; i++) {
1057 sopptr = &sops[i];
1058 semptr = &semaptr->_sem_base[sopptr->sem_num];
1059 semptr->sempid = p->p_pid;
1060 }
1061
1062 /* Update sem_otime */
1063 semaptr->sem_otime = time_second;
1064
1065 /* Do a wakeup if any semaphore was up'd. */
1066 if (do_wakeup) {
1067 SEM_PRINTF(("semop: doing wakeup\n"));
1068 cv_broadcast(&semcv[semid]);
1069 SEM_PRINTF(("semop: back from wakeup\n"));
1070 }
1071 SEM_PRINTF(("semop: done\n"));
1072 *retval = 0;
1073
1074 out:
1075 mutex_exit(&semlock);
1076 if (sops != small_sops)
1077 kmem_free(sops, nsops * sizeof(*sops));
1078 return error;
1079}
1080
1081/*
1082 * Go through the undo structures for this process and apply the
1083 * adjustments to semaphores.
1084 */
1085/*ARGSUSED*/
1086void
1087semexit(struct proc *p, void *v)
1088{
1089 struct sem_undo *suptr;
1090 struct sem_undo **supptr;
1091
1092 if ((p->p_flag & PK_SYSVSEM) == 0)
1093 return;
1094
1095 mutex_enter(&semlock);
1096
1097 /*
1098 * Go through the chain of undo vectors looking for one
1099 * associated with this process.
1100 */
1101
1102 for (supptr = &semu_list; (suptr = *supptr) != NULL;
1103 supptr = &suptr->un_next) {
1104 if (suptr->un_proc == p)
1105 break;
1106 }
1107
1108 /*
1109 * If there is no undo vector, skip to the end.
1110 */
1111
1112 if (suptr == NULL) {
1113 mutex_exit(&semlock);
1114 return;
1115 }
1116
1117 /*
1118 * We now have an undo vector for this process.
1119 */
1120
1121 SEM_PRINTF(("proc @%p has undo structure with %d entries\n", p,
1122 suptr->un_cnt));
1123
1124 /*
1125 * If there are any active undo elements then process them.
1126 */
1127 if (suptr->un_cnt > 0) {
1128 int ix;
1129
1130 for (ix = 0; ix < suptr->un_cnt; ix++) {
1131 int semid = suptr->un_ent[ix].un_id;
1132 int semnum = suptr->un_ent[ix].un_num;
1133 int adjval = suptr->un_ent[ix].un_adjval;
1134 struct semid_ds *semaptr;
1135
1136 semaptr = &sema[semid];
1137 if ((semaptr->sem_perm.mode & SEM_ALLOC) == 0)
1138 if (semnum >= semaptr->sem_nsems)
1139 panic("semexit - semnum out of range");
1140
1141 SEM_PRINTF(("semexit: %p id=%d num=%d(adj=%d) ; "
1142 "sem=%d\n",
1143 suptr->un_proc, suptr->un_ent[ix].un_id,
1144 suptr->un_ent[ix].un_num,
1145 suptr->un_ent[ix].un_adjval,
1146 semaptr->_sem_base[semnum].semval));
1147
1148 if (adjval < 0 &&
1149 semaptr->_sem_base[semnum].semval < -adjval)
1150 semaptr->_sem_base[semnum].semval = 0;
1151 else
1152 semaptr->_sem_base[semnum].semval += adjval;
1153
1154 cv_broadcast(&semcv[semid]);
1155 SEM_PRINTF(("semexit: back from wakeup\n"));
1156 }
1157 }
1158
1159 /*
1160 * Deallocate the undo vector.
1161 */
1162 SEM_PRINTF(("removing vector\n"));
1163 suptr->un_proc = NULL;
1164 *supptr = suptr->un_next;
1165 mutex_exit(&semlock);
1166}
1167
1168/*
1169 * Sysctl initialization and nodes.
1170 */
1171
1172static int
1173sysctl_ipc_semmni(SYSCTLFN_ARGS)
1174{
1175 int newsize, error;
1176 struct sysctlnode node;
1177 node = *rnode;
1178 node.sysctl_data = &newsize;
1179
1180 newsize = seminfo.semmni;
1181 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1182 if (error || newp == NULL)
1183 return error;
1184
1185 return semrealloc(newsize, seminfo.semmns, seminfo.semmnu);
1186}
1187
1188static int
1189sysctl_ipc_semmns(SYSCTLFN_ARGS)
1190{
1191 int newsize, error;
1192 struct sysctlnode node;
1193 node = *rnode;
1194 node.sysctl_data = &newsize;
1195
1196 newsize = seminfo.semmns;
1197 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1198 if (error || newp == NULL)
1199 return error;
1200
1201 return semrealloc(seminfo.semmni, newsize, seminfo.semmnu);
1202}
1203
1204static int
1205sysctl_ipc_semmnu(SYSCTLFN_ARGS)
1206{
1207 int newsize, error;
1208 struct sysctlnode node;
1209 node = *rnode;
1210 node.sysctl_data = &newsize;
1211
1212 newsize = seminfo.semmnu;
1213 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1214 if (error || newp == NULL)
1215 return error;
1216
1217 return semrealloc(seminfo.semmni, seminfo.semmns, newsize);
1218}
1219
1220SYSCTL_SETUP(sysctl_ipc_sem_setup, "sysctl kern.ipc subtree setup")
1221{
1222 const struct sysctlnode *node = NULL;
1223
1224 sysctl_createv(clog, 0, NULL, &node,
1225 CTLFLAG_PERMANENT,
1226 CTLTYPE_NODE, "ipc",
1227 SYSCTL_DESCR("SysV IPC options"),
1228 NULL, 0, NULL, 0,
1229 CTL_KERN, KERN_SYSVIPC, CTL_EOL);
1230
1231 if (node == NULL)
1232 return;
1233
1234 sysctl_createv(clog, 0, &node, NULL,
1235 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1236 CTLTYPE_INT, "semmni",
1237 SYSCTL_DESCR("Max number of number of semaphore identifiers"),
1238 sysctl_ipc_semmni, 0, &seminfo.semmni, 0,
1239 CTL_CREATE, CTL_EOL);
1240 sysctl_createv(clog, 0, &node, NULL,
1241 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1242 CTLTYPE_INT, "semmns",
1243 SYSCTL_DESCR("Max number of number of semaphores in system"),
1244 sysctl_ipc_semmns, 0, &seminfo.semmns, 0,
1245 CTL_CREATE, CTL_EOL);
1246 sysctl_createv(clog, 0, &node, NULL,
1247 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1248 CTLTYPE_INT, "semmnu",
1249 SYSCTL_DESCR("Max number of undo structures in system"),
1250 sysctl_ipc_semmnu, 0, &seminfo.semmnu, 0,
1251 CTL_CREATE, CTL_EOL);
1252}
1253