The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/kern/sysv_sem.c

Version: -  FREEBSD  -  FREEBSD11  -  FREEBSD10  -  FREEBSD9  -  FREEBSD92  -  FREEBSD91  -  FREEBSD90  -  FREEBSD8  -  FREEBSD82  -  FREEBSD81  -  FREEBSD80  -  FREEBSD7  -  FREEBSD74  -  FREEBSD73  -  FREEBSD72  -  FREEBSD71  -  FREEBSD70  -  FREEBSD6  -  FREEBSD64  -  FREEBSD63  -  FREEBSD62  -  FREEBSD61  -  FREEBSD60  -  FREEBSD5  -  FREEBSD55  -  FREEBSD54  -  FREEBSD53  -  FREEBSD52  -  FREEBSD51  -  FREEBSD50  -  FREEBSD4  -  FREEBSD3  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Implementation of SVID semaphores
    3  *
    4  * Author:  Daniel Boulet
    5  *
    6  * This software is provided ``AS IS'' without any warranties of any kind.
    7  */
    8 /*-
    9  * Copyright (c) 2003-2005 McAfee, Inc.
   10  * All rights reserved.
   11  *
   12  * This software was developed for the FreeBSD Project in part by McAfee
   13  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
   14  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
   15  * program.
   16  *
   17  * Redistribution and use in source and binary forms, with or without
   18  * modification, are permitted provided that the following conditions
   19  * are met:
   20  * 1. Redistributions of source code must retain the above copyright
   21  *    notice, this list of conditions and the following disclaimer.
   22  * 2. Redistributions in binary form must reproduce the above copyright
   23  *    notice, this list of conditions and the following disclaimer in the
   24  *    documentation and/or other materials provided with the distribution.
   25  *
   26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   36  * SUCH DAMAGE.
   37  */
   38 
   39 #include <sys/cdefs.h>
   40 __FBSDID("$FreeBSD: stable/10/sys/kern/sysv_sem.c 329741 2018-02-21 18:32:57Z brooks $");
   41 
   42 #include "opt_compat.h"
   43 #include "opt_sysvipc.h"
   44 
   45 #include <sys/param.h>
   46 #include <sys/systm.h>
   47 #include <sys/sysproto.h>
   48 #include <sys/eventhandler.h>
   49 #include <sys/kernel.h>
   50 #include <sys/proc.h>
   51 #include <sys/lock.h>
   52 #include <sys/module.h>
   53 #include <sys/mutex.h>
   54 #include <sys/racct.h>
   55 #include <sys/sem.h>
   56 #include <sys/sx.h>
   57 #include <sys/syscall.h>
   58 #include <sys/syscallsubr.h>
   59 #include <sys/sysent.h>
   60 #include <sys/sysctl.h>
   61 #include <sys/uio.h>
   62 #include <sys/malloc.h>
   63 #include <sys/jail.h>
   64 
   65 #include <security/mac/mac_framework.h>
   66 
   67 FEATURE(sysv_sem, "System V semaphores support");
   68 
   69 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores");
   70 
   71 #ifdef SEM_DEBUG
   72 #define DPRINTF(a)      printf a
   73 #else
   74 #define DPRINTF(a)
   75 #endif
   76 
   77 static int seminit(void);
   78 static int sysvsem_modload(struct module *, int, void *);
   79 static int semunload(void);
   80 static void semexit_myhook(void *arg, struct proc *p);
   81 static int sysctl_sema(SYSCTL_HANDLER_ARGS);
   82 static int semvalid(int semid, struct prison *rpr,
   83     struct semid_kernel *semakptr);
   84 static void sem_remove(int semidx, struct ucred *cred);
   85 static struct prison *sem_find_prison(struct ucred *);
   86 static int sem_prison_cansee(struct prison *, struct semid_kernel *);
   87 static int sem_prison_check(void *, void *);
   88 static int sem_prison_set(void *, void *);
   89 static int sem_prison_get(void *, void *);
   90 static int sem_prison_remove(void *, void *);
   91 static void sem_prison_cleanup(struct prison *);
   92 
   93 #ifndef _SYS_SYSPROTO_H_
   94 struct __semctl_args;
   95 int __semctl(struct thread *td, struct __semctl_args *uap);
   96 struct semget_args;
   97 int semget(struct thread *td, struct semget_args *uap);
   98 struct semop_args;
   99 int semop(struct thread *td, struct semop_args *uap);
  100 #endif
  101 
  102 static struct sem_undo *semu_alloc(struct thread *td);
  103 static int semundo_adjust(struct thread *td, struct sem_undo **supptr,
  104     int semid, int semseq, int semnum, int adjval);
  105 static void semundo_clear(int semid, int semnum);
  106 
  107 static struct mtx       sem_mtx;        /* semaphore global lock */
  108 static struct mtx sem_undo_mtx;
  109 static int      semtot = 0;
  110 static struct semid_kernel *sema;       /* semaphore id pool */
  111 static struct mtx *sema_mtx;    /* semaphore id pool mutexes*/
  112 static struct sem *sem;         /* semaphore pool */
  113 LIST_HEAD(, sem_undo) semu_list;        /* list of active undo structures */
  114 LIST_HEAD(, sem_undo) semu_free_list;   /* list of free undo structures */
  115 static int      *semu;          /* undo structure pool */
  116 static eventhandler_tag semexit_tag;
  117 static unsigned sem_prison_slot;        /* prison OSD slot */
  118 
  119 #define SEMUNDO_MTX             sem_undo_mtx
  120 #define SEMUNDO_LOCK()          mtx_lock(&SEMUNDO_MTX);
  121 #define SEMUNDO_UNLOCK()        mtx_unlock(&SEMUNDO_MTX);
  122 #define SEMUNDO_LOCKASSERT(how) mtx_assert(&SEMUNDO_MTX, (how));
  123 
  124 struct sem {
  125         u_short semval;         /* semaphore value */
  126         pid_t   sempid;         /* pid of last operation */
  127         u_short semncnt;        /* # awaiting semval > cval */
  128         u_short semzcnt;        /* # awaiting semval = 0 */
  129 };
  130 
  131 /*
  132  * Undo structure (one per process)
  133  */
  134 struct sem_undo {
  135         LIST_ENTRY(sem_undo) un_next;   /* ptr to next active undo structure */
  136         struct  proc *un_proc;          /* owner of this structure */
  137         short   un_cnt;                 /* # of active entries */
  138         struct undo {
  139                 short   un_adjval;      /* adjust on exit values */
  140                 short   un_num;         /* semaphore # */
  141                 int     un_id;          /* semid */
  142                 unsigned short un_seq;
  143         } un_ent[1];                    /* undo entries */
  144 };
  145 
  146 /*
  147  * Configuration parameters
  148  */
  149 #ifndef SEMMNI
  150 #define SEMMNI  50              /* # of semaphore identifiers */
  151 #endif
  152 #ifndef SEMMNS
  153 #define SEMMNS  340             /* # of semaphores in system */
  154 #endif
  155 #ifndef SEMUME
  156 #define SEMUME  50              /* max # of undo entries per process */
  157 #endif
  158 #ifndef SEMMNU
  159 #define SEMMNU  150             /* # of undo structures in system */
  160 #endif
  161 
  162 /* shouldn't need tuning */
  163 #ifndef SEMMSL
  164 #define SEMMSL  SEMMNS          /* max # of semaphores per id */
  165 #endif
  166 #ifndef SEMOPM
  167 #define SEMOPM  100             /* max # of operations per semop call */
  168 #endif
  169 
  170 #define SEMVMX  32767           /* semaphore maximum value */
  171 #define SEMAEM  16384           /* adjust on exit max value */
  172 
  173 /*
  174  * Due to the way semaphore memory is allocated, we have to ensure that
  175  * SEMUSZ is properly aligned.
  176  */
  177 
  178 #define SEM_ALIGN(bytes) (((bytes) + (sizeof(long) - 1)) & ~(sizeof(long) - 1))
  179 
  180 /* actual size of an undo structure */
  181 #define SEMUSZ  SEM_ALIGN(offsetof(struct sem_undo, un_ent[SEMUME]))
  182 
  183 /*
  184  * Macro to find a particular sem_undo vector
  185  */
  186 #define SEMU(ix) \
  187         ((struct sem_undo *)(((intptr_t)semu)+ix * seminfo.semusz))
  188 
  189 /*
  190  * semaphore info struct
  191  */
  192 struct seminfo seminfo = {
  193                 SEMMNI,         /* # of semaphore identifiers */
  194                 SEMMNS,         /* # of semaphores in system */
  195                 SEMMNU,         /* # of undo structures in system */
  196                 SEMMSL,         /* max # of semaphores per id */
  197                 SEMOPM,         /* max # of operations per semop call */
  198                 SEMUME,         /* max # of undo entries per process */
  199                 SEMUSZ,         /* size in bytes of undo structure */
  200                 SEMVMX,         /* semaphore maximum value */
  201                 SEMAEM          /* adjust on exit max value */
  202 };
  203 
  204 SYSCTL_INT(_kern_ipc, OID_AUTO, semmni, CTLFLAG_RDTUN, &seminfo.semmni, 0,
  205     "Number of semaphore identifiers");
  206 SYSCTL_INT(_kern_ipc, OID_AUTO, semmns, CTLFLAG_RDTUN, &seminfo.semmns, 0,
  207     "Maximum number of semaphores in the system");
  208 SYSCTL_INT(_kern_ipc, OID_AUTO, semmnu, CTLFLAG_RDTUN, &seminfo.semmnu, 0,
  209     "Maximum number of undo structures in the system");
  210 SYSCTL_INT(_kern_ipc, OID_AUTO, semmsl, CTLFLAG_RW, &seminfo.semmsl, 0,
  211     "Max semaphores per id");
  212 SYSCTL_INT(_kern_ipc, OID_AUTO, semopm, CTLFLAG_RDTUN, &seminfo.semopm, 0,
  213     "Max operations per semop call");
  214 SYSCTL_INT(_kern_ipc, OID_AUTO, semume, CTLFLAG_RDTUN, &seminfo.semume, 0,
  215     "Max undo entries per process");
  216 SYSCTL_INT(_kern_ipc, OID_AUTO, semusz, CTLFLAG_RDTUN, &seminfo.semusz, 0,
  217     "Size in bytes of undo structure");
  218 SYSCTL_INT(_kern_ipc, OID_AUTO, semvmx, CTLFLAG_RW, &seminfo.semvmx, 0,
  219     "Semaphore maximum value");
  220 SYSCTL_INT(_kern_ipc, OID_AUTO, semaem, CTLFLAG_RW, &seminfo.semaem, 0,
  221     "Adjust on exit max value");
  222 SYSCTL_PROC(_kern_ipc, OID_AUTO, sema,
  223     CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE,
  224     NULL, 0, sysctl_sema, "",
  225     "Array of struct semid_kernel for each potential semaphore");
  226 
  227 static struct syscall_helper_data sem_syscalls[] = {
  228         SYSCALL_INIT_HELPER(__semctl),
  229         SYSCALL_INIT_HELPER(semget),
  230         SYSCALL_INIT_HELPER(semop),
  231 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
  232     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
  233         SYSCALL_INIT_HELPER(semsys),
  234         SYSCALL_INIT_HELPER_COMPAT(freebsd7___semctl),
  235 #endif
  236         SYSCALL_INIT_LAST
  237 };
  238 
  239 #ifdef COMPAT_FREEBSD32
  240 #include <compat/freebsd32/freebsd32.h>
  241 #include <compat/freebsd32/freebsd32_ipc.h>
  242 #include <compat/freebsd32/freebsd32_proto.h>
  243 #include <compat/freebsd32/freebsd32_signal.h>
  244 #include <compat/freebsd32/freebsd32_syscall.h>
  245 #include <compat/freebsd32/freebsd32_util.h>
  246 
  247 static struct syscall_helper_data sem32_syscalls[] = {
  248         SYSCALL32_INIT_HELPER(freebsd32_semctl),
  249         SYSCALL32_INIT_HELPER_COMPAT(semget),
  250         SYSCALL32_INIT_HELPER_COMPAT(semop),
  251         SYSCALL32_INIT_HELPER(freebsd32_semsys),
  252 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
  253     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
  254         SYSCALL32_INIT_HELPER(freebsd7_freebsd32_semctl),
  255 #endif
  256         SYSCALL_INIT_LAST
  257 };
  258 #endif
  259 
  260 static int
  261 seminit(void)
  262 {
  263         struct prison *pr;
  264         void *rsv;
  265         int i, error;
  266         osd_method_t methods[PR_MAXMETHOD] = {
  267             [PR_METHOD_CHECK] =         sem_prison_check,
  268             [PR_METHOD_SET] =           sem_prison_set,
  269             [PR_METHOD_GET] =           sem_prison_get,
  270             [PR_METHOD_REMOVE] =        sem_prison_remove,
  271         };
  272 
  273         TUNABLE_INT_FETCH("kern.ipc.semmni", &seminfo.semmni);
  274         TUNABLE_INT_FETCH("kern.ipc.semmns", &seminfo.semmns);
  275         TUNABLE_INT_FETCH("kern.ipc.semmnu", &seminfo.semmnu);
  276         TUNABLE_INT_FETCH("kern.ipc.semmsl", &seminfo.semmsl);
  277         TUNABLE_INT_FETCH("kern.ipc.semopm", &seminfo.semopm);
  278         TUNABLE_INT_FETCH("kern.ipc.semume", &seminfo.semume);
  279         TUNABLE_INT_FETCH("kern.ipc.semusz", &seminfo.semusz);
  280         TUNABLE_INT_FETCH("kern.ipc.semvmx", &seminfo.semvmx);
  281         TUNABLE_INT_FETCH("kern.ipc.semaem", &seminfo.semaem);
  282 
  283         sem = malloc(sizeof(struct sem) * seminfo.semmns, M_SEM, M_WAITOK);
  284         sema = malloc(sizeof(struct semid_kernel) * seminfo.semmni, M_SEM,
  285             M_WAITOK);
  286         sema_mtx = malloc(sizeof(struct mtx) * seminfo.semmni, M_SEM,
  287             M_WAITOK | M_ZERO);
  288         semu = malloc(seminfo.semmnu * seminfo.semusz, M_SEM, M_WAITOK);
  289 
  290         for (i = 0; i < seminfo.semmni; i++) {
  291                 sema[i].u.sem_base = 0;
  292                 sema[i].u.sem_perm.mode = 0;
  293                 sema[i].u.sem_perm.seq = 0;
  294 #ifdef MAC
  295                 mac_sysvsem_init(&sema[i]);
  296 #endif
  297         }
  298         for (i = 0; i < seminfo.semmni; i++)
  299                 mtx_init(&sema_mtx[i], "semid", NULL, MTX_DEF);
  300         LIST_INIT(&semu_free_list);
  301         for (i = 0; i < seminfo.semmnu; i++) {
  302                 struct sem_undo *suptr = SEMU(i);
  303                 suptr->un_proc = NULL;
  304                 LIST_INSERT_HEAD(&semu_free_list, suptr, un_next);
  305         }
  306         LIST_INIT(&semu_list);
  307         mtx_init(&sem_mtx, "sem", NULL, MTX_DEF);
  308         mtx_init(&sem_undo_mtx, "semu", NULL, MTX_DEF);
  309         semexit_tag = EVENTHANDLER_REGISTER(process_exit, semexit_myhook, NULL,
  310             EVENTHANDLER_PRI_ANY);
  311 
  312         /* Set current prisons according to their allow.sysvipc. */
  313         sem_prison_slot = osd_jail_register(NULL, methods);
  314         rsv = osd_reserve(sem_prison_slot);
  315         prison_lock(&prison0);
  316         (void)osd_jail_set_reserved(&prison0, sem_prison_slot, rsv, &prison0);
  317         prison_unlock(&prison0);
  318         rsv = NULL;
  319         sx_slock(&allprison_lock);
  320         TAILQ_FOREACH(pr, &allprison, pr_list) {
  321                 if (rsv == NULL)
  322                         rsv = osd_reserve(sem_prison_slot);
  323                 prison_lock(pr);
  324                 if ((pr->pr_allow & PR_ALLOW_SYSVIPC) && pr->pr_ref > 0) {
  325                         (void)osd_jail_set_reserved(pr, sem_prison_slot, rsv,
  326                             &prison0);
  327                         rsv = NULL;
  328                 }
  329                 prison_unlock(pr);
  330         }
  331         if (rsv != NULL)
  332                 osd_free_reserved(rsv);
  333         sx_sunlock(&allprison_lock);
  334 
  335         error = syscall_helper_register(sem_syscalls);
  336         if (error != 0)
  337                 return (error);
  338 #ifdef COMPAT_FREEBSD32
  339         error = syscall32_helper_register(sem32_syscalls);
  340         if (error != 0)
  341                 return (error);
  342 #endif
  343         return (0);
  344 }
  345 
  346 static int
  347 semunload(void)
  348 {
  349         int i;
  350 
  351         /* XXXKIB */
  352         if (semtot != 0)
  353                 return (EBUSY);
  354 
  355 #ifdef COMPAT_FREEBSD32
  356         syscall32_helper_unregister(sem32_syscalls);
  357 #endif
  358         syscall_helper_unregister(sem_syscalls);
  359         EVENTHANDLER_DEREGISTER(process_exit, semexit_tag);
  360         if (sem_prison_slot != 0)
  361                 osd_jail_deregister(sem_prison_slot);
  362 #ifdef MAC
  363         for (i = 0; i < seminfo.semmni; i++)
  364                 mac_sysvsem_destroy(&sema[i]);
  365 #endif
  366         free(sem, M_SEM);
  367         free(sema, M_SEM);
  368         free(semu, M_SEM);
  369         for (i = 0; i < seminfo.semmni; i++)
  370                 mtx_destroy(&sema_mtx[i]);
  371         free(sema_mtx, M_SEM);
  372         mtx_destroy(&sem_mtx);
  373         mtx_destroy(&sem_undo_mtx);
  374         return (0);
  375 }
  376 
  377 static int
  378 sysvsem_modload(struct module *module, int cmd, void *arg)
  379 {
  380         int error = 0;
  381 
  382         switch (cmd) {
  383         case MOD_LOAD:
  384                 error = seminit();
  385                 if (error != 0)
  386                         semunload();
  387                 break;
  388         case MOD_UNLOAD:
  389                 error = semunload();
  390                 break;
  391         case MOD_SHUTDOWN:
  392                 break;
  393         default:
  394                 error = EINVAL;
  395                 break;
  396         }
  397         return (error);
  398 }
  399 
  400 static moduledata_t sysvsem_mod = {
  401         "sysvsem",
  402         &sysvsem_modload,
  403         NULL
  404 };
  405 
  406 DECLARE_MODULE(sysvsem, sysvsem_mod, SI_SUB_SYSV_SEM, SI_ORDER_FIRST);
  407 MODULE_VERSION(sysvsem, 1);
  408 
  409 /*
  410  * Allocate a new sem_undo structure for a process
  411  * (returns ptr to structure or NULL if no more room)
  412  */
  413 
  414 static struct sem_undo *
  415 semu_alloc(struct thread *td)
  416 {
  417         struct sem_undo *suptr;
  418 
  419         SEMUNDO_LOCKASSERT(MA_OWNED);
  420         if ((suptr = LIST_FIRST(&semu_free_list)) == NULL)
  421                 return (NULL);
  422         LIST_REMOVE(suptr, un_next);
  423         LIST_INSERT_HEAD(&semu_list, suptr, un_next);
  424         suptr->un_cnt = 0;
  425         suptr->un_proc = td->td_proc;
  426         return (suptr);
  427 }
  428 
  429 static int
  430 semu_try_free(struct sem_undo *suptr)
  431 {
  432 
  433         SEMUNDO_LOCKASSERT(MA_OWNED);
  434 
  435         if (suptr->un_cnt != 0)
  436                 return (0);
  437         LIST_REMOVE(suptr, un_next);
  438         LIST_INSERT_HEAD(&semu_free_list, suptr, un_next);
  439         return (1);
  440 }
  441 
  442 /*
  443  * Adjust a particular entry for a particular proc
  444  */
  445 
  446 static int
  447 semundo_adjust(struct thread *td, struct sem_undo **supptr, int semid,
  448     int semseq, int semnum, int adjval)
  449 {
  450         struct proc *p = td->td_proc;
  451         struct sem_undo *suptr;
  452         struct undo *sunptr;
  453         int i;
  454 
  455         SEMUNDO_LOCKASSERT(MA_OWNED);
  456         /* Look for and remember the sem_undo if the caller doesn't provide
  457            it */
  458 
  459         suptr = *supptr;
  460         if (suptr == NULL) {
  461                 LIST_FOREACH(suptr, &semu_list, un_next) {
  462                         if (suptr->un_proc == p) {
  463                                 *supptr = suptr;
  464                                 break;
  465                         }
  466                 }
  467                 if (suptr == NULL) {
  468                         if (adjval == 0)
  469                                 return(0);
  470                         suptr = semu_alloc(td);
  471                         if (suptr == NULL)
  472                                 return (ENOSPC);
  473                         *supptr = suptr;
  474                 }
  475         }
  476 
  477         /*
  478          * Look for the requested entry and adjust it (delete if adjval becomes
  479          * 0).
  480          */
  481         sunptr = &suptr->un_ent[0];
  482         for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
  483                 if (sunptr->un_id != semid || sunptr->un_num != semnum)
  484                         continue;
  485                 if (adjval != 0) {
  486                         adjval += sunptr->un_adjval;
  487                         if (adjval > seminfo.semaem || adjval < -seminfo.semaem)
  488                                 return (ERANGE);
  489                 }
  490                 sunptr->un_adjval = adjval;
  491                 if (sunptr->un_adjval == 0) {
  492                         suptr->un_cnt--;
  493                         if (i < suptr->un_cnt)
  494                                 suptr->un_ent[i] =
  495                                     suptr->un_ent[suptr->un_cnt];
  496                         if (suptr->un_cnt == 0)
  497                                 semu_try_free(suptr);
  498                 }
  499                 return (0);
  500         }
  501 
  502         /* Didn't find the right entry - create it */
  503         if (adjval == 0)
  504                 return (0);
  505         if (adjval > seminfo.semaem || adjval < -seminfo.semaem)
  506                 return (ERANGE);
  507         if (suptr->un_cnt != seminfo.semume) {
  508                 sunptr = &suptr->un_ent[suptr->un_cnt];
  509                 suptr->un_cnt++;
  510                 sunptr->un_adjval = adjval;
  511                 sunptr->un_id = semid;
  512                 sunptr->un_num = semnum;
  513                 sunptr->un_seq = semseq;
  514         } else
  515                 return (EINVAL);
  516         return (0);
  517 }
  518 
  519 static void
  520 semundo_clear(int semid, int semnum)
  521 {
  522         struct sem_undo *suptr, *suptr1;
  523         struct undo *sunptr;
  524         int i;
  525 
  526         SEMUNDO_LOCKASSERT(MA_OWNED);
  527         LIST_FOREACH_SAFE(suptr, &semu_list, un_next, suptr1) {
  528                 sunptr = &suptr->un_ent[0];
  529                 for (i = 0; i < suptr->un_cnt; i++, sunptr++) {
  530                         if (sunptr->un_id != semid)
  531                                 continue;
  532                         if (semnum == -1 || sunptr->un_num == semnum) {
  533                                 suptr->un_cnt--;
  534                                 if (i < suptr->un_cnt) {
  535                                         suptr->un_ent[i] =
  536                                             suptr->un_ent[suptr->un_cnt];
  537                                         continue;
  538                                 }
  539                                 semu_try_free(suptr);
  540                         }
  541                         if (semnum != -1)
  542                                 break;
  543                 }
  544         }
  545 }
  546 
  547 static int
  548 semvalid(int semid, struct prison *rpr, struct semid_kernel *semakptr)
  549 {
  550 
  551         return ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 ||
  552             semakptr->u.sem_perm.seq != IPCID_TO_SEQ(semid) ||
  553             sem_prison_cansee(rpr, semakptr) ? EINVAL : 0);
  554 }
  555 
  556 static void
  557 sem_remove(int semidx, struct ucred *cred)
  558 {
  559         struct semid_kernel *semakptr;
  560         int i;
  561 
  562         KASSERT(semidx >= 0 && semidx < seminfo.semmni,
  563                 ("semidx out of bounds"));
  564         semakptr = &sema[semidx];
  565         semakptr->u.sem_perm.cuid = cred ? cred->cr_uid : 0;
  566         semakptr->u.sem_perm.uid = cred ? cred->cr_uid : 0;
  567         semakptr->u.sem_perm.mode = 0;
  568         racct_sub_cred(semakptr->cred, RACCT_NSEM, semakptr->u.sem_nsems);
  569         crfree(semakptr->cred);
  570         semakptr->cred = NULL;
  571         SEMUNDO_LOCK();
  572         semundo_clear(semidx, -1);
  573         SEMUNDO_UNLOCK();
  574 #ifdef MAC
  575         mac_sysvsem_cleanup(semakptr);
  576 #endif
  577         wakeup(semakptr);
  578         for (i = 0; i < seminfo.semmni; i++) {
  579                 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) &&
  580                     sema[i].u.sem_base > semakptr->u.sem_base)
  581                         mtx_lock_flags(&sema_mtx[i], LOP_DUPOK);
  582         }
  583         for (i = semakptr->u.sem_base - sem; i < semtot; i++)
  584                 sem[i] = sem[i + semakptr->u.sem_nsems];
  585         for (i = 0; i < seminfo.semmni; i++) {
  586                 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) &&
  587                     sema[i].u.sem_base > semakptr->u.sem_base) {
  588                         sema[i].u.sem_base -= semakptr->u.sem_nsems;
  589                         mtx_unlock(&sema_mtx[i]);
  590                 }
  591         }
  592         semtot -= semakptr->u.sem_nsems;
  593 }
  594 
  595 static struct prison *
  596 sem_find_prison(struct ucred *cred)
  597 {
  598         struct prison *pr, *rpr;
  599 
  600         pr = cred->cr_prison;
  601         prison_lock(pr);
  602         rpr = osd_jail_get(pr, sem_prison_slot);
  603         prison_unlock(pr);
  604         return rpr;
  605 }
  606 
  607 static int
  608 sem_prison_cansee(struct prison *rpr, struct semid_kernel *semakptr)
  609 {
  610 
  611         if (semakptr->cred == NULL ||
  612             !(rpr == semakptr->cred->cr_prison ||
  613               prison_ischild(rpr, semakptr->cred->cr_prison)))
  614                 return (EINVAL);
  615         return (0);
  616 }
  617 
  618 /*
  619  * Note that the user-mode half of this passes a union, not a pointer.
  620  */
  621 #ifndef _SYS_SYSPROTO_H_
  622 struct __semctl_args {
  623         int     semid;
  624         int     semnum;
  625         int     cmd;
  626         union   semun *arg;
  627 };
  628 #endif
  629 int
  630 sys___semctl(struct thread *td, struct __semctl_args *uap)
  631 {
  632         struct semid_ds dsbuf;
  633         union semun arg, semun;
  634         register_t rval;
  635         int error;
  636 
  637         switch (uap->cmd) {
  638         case SEM_STAT:
  639         case IPC_SET:
  640         case IPC_STAT:
  641         case GETALL:
  642         case SETVAL:
  643         case SETALL:
  644                 error = copyin(uap->arg, &arg, sizeof(arg));
  645                 if (error)
  646                         return (error);
  647                 break;
  648         }
  649 
  650         switch (uap->cmd) {
  651         case SEM_STAT:
  652         case IPC_STAT:
  653                 semun.buf = &dsbuf;
  654                 break;
  655         case IPC_SET:
  656                 error = copyin(arg.buf, &dsbuf, sizeof(dsbuf));
  657                 if (error)
  658                         return (error);
  659                 semun.buf = &dsbuf;
  660                 break;
  661         case GETALL:
  662         case SETALL:
  663                 semun.array = arg.array;
  664                 break;
  665         case SETVAL:
  666                 semun.val = arg.val;
  667                 break;          
  668         }
  669 
  670         error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun,
  671             &rval);
  672         if (error)
  673                 return (error);
  674 
  675         switch (uap->cmd) {
  676         case SEM_STAT:
  677         case IPC_STAT:
  678                 error = copyout(&dsbuf, arg.buf, sizeof(dsbuf));
  679                 break;
  680         }
  681 
  682         if (error == 0)
  683                 td->td_retval[0] = rval;
  684         return (error);
  685 }
  686 
  687 int
  688 kern_semctl(struct thread *td, int semid, int semnum, int cmd,
  689     union semun *arg, register_t *rval)
  690 {
  691         u_short *array;
  692         struct ucred *cred = td->td_ucred;
  693         int i, error;
  694         struct prison *rpr;
  695         struct semid_ds *sbuf;
  696         struct semid_kernel *semakptr;
  697         struct mtx *sema_mtxp;
  698         u_short usval, count;
  699         int semidx;
  700 
  701         DPRINTF(("call to semctl(%d, %d, %d, 0x%p)\n",
  702             semid, semnum, cmd, arg));
  703 
  704         rpr = sem_find_prison(td->td_ucred);
  705         if (sem == NULL)
  706                 return (ENOSYS);
  707 
  708         array = NULL;
  709 
  710         switch(cmd) {
  711         case SEM_STAT:
  712                 /*
  713                  * For this command we assume semid is an array index
  714                  * rather than an IPC id.
  715                  */
  716                 if (semid < 0 || semid >= seminfo.semmni)
  717                         return (EINVAL);
  718                 semakptr = &sema[semid];
  719                 sema_mtxp = &sema_mtx[semid];
  720                 mtx_lock(sema_mtxp);
  721                 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0) {
  722                         error = EINVAL;
  723                         goto done2;
  724                 }
  725                 if ((error = sem_prison_cansee(rpr, semakptr)))
  726                         goto done2;
  727                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  728                         goto done2;
  729 #ifdef MAC
  730                 error = mac_sysvsem_check_semctl(cred, semakptr, cmd);
  731                 if (error != 0)
  732                         goto done2;
  733 #endif
  734                 bcopy(&semakptr->u, arg->buf, sizeof(struct semid_ds));
  735                 if (cred->cr_prison != semakptr->cred->cr_prison)
  736                         arg->buf->sem_perm.key = IPC_PRIVATE;
  737                 *rval = IXSEQ_TO_IPCID(semid, semakptr->u.sem_perm);
  738                 mtx_unlock(sema_mtxp);
  739                 return (0);
  740         }
  741 
  742         semidx = IPCID_TO_IX(semid);
  743         if (semidx < 0 || semidx >= seminfo.semmni)
  744                 return (EINVAL);
  745 
  746         semakptr = &sema[semidx];
  747         sema_mtxp = &sema_mtx[semidx];
  748         if (cmd == IPC_RMID)
  749                 mtx_lock(&sem_mtx);
  750         mtx_lock(sema_mtxp);
  751 
  752 #ifdef MAC
  753         error = mac_sysvsem_check_semctl(cred, semakptr, cmd);
  754         if (error != 0)
  755                 goto done2;
  756 #endif
  757 
  758         error = 0;
  759         *rval = 0;
  760 
  761         switch (cmd) {
  762         case IPC_RMID:
  763                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  764                         goto done2;
  765                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_M)))
  766                         goto done2;
  767                 sem_remove(semidx, cred);
  768                 break;
  769 
  770         case IPC_SET:
  771                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  772                         goto done2;
  773                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_M)))
  774                         goto done2;
  775                 sbuf = arg->buf;
  776                 semakptr->u.sem_perm.uid = sbuf->sem_perm.uid;
  777                 semakptr->u.sem_perm.gid = sbuf->sem_perm.gid;
  778                 semakptr->u.sem_perm.mode = (semakptr->u.sem_perm.mode &
  779                     ~0777) | (sbuf->sem_perm.mode & 0777);
  780                 semakptr->u.sem_ctime = time_second;
  781                 break;
  782 
  783         case IPC_STAT:
  784                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  785                         goto done2;
  786                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  787                         goto done2;
  788                 bcopy(&semakptr->u, arg->buf, sizeof(struct semid_ds));
  789                 if (cred->cr_prison != semakptr->cred->cr_prison)
  790                         arg->buf->sem_perm.key = IPC_PRIVATE;
  791                 break;
  792 
  793         case GETNCNT:
  794                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  795                         goto done2;
  796                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  797                         goto done2;
  798                 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) {
  799                         error = EINVAL;
  800                         goto done2;
  801                 }
  802                 *rval = semakptr->u.sem_base[semnum].semncnt;
  803                 break;
  804 
  805         case GETPID:
  806                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  807                         goto done2;
  808                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  809                         goto done2;
  810                 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) {
  811                         error = EINVAL;
  812                         goto done2;
  813                 }
  814                 *rval = semakptr->u.sem_base[semnum].sempid;
  815                 break;
  816 
  817         case GETVAL:
  818                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  819                         goto done2;
  820                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  821                         goto done2;
  822                 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) {
  823                         error = EINVAL;
  824                         goto done2;
  825                 }
  826                 *rval = semakptr->u.sem_base[semnum].semval;
  827                 break;
  828 
  829         case GETALL:
  830                 /*
  831                  * Unfortunately, callers of this function don't know
  832                  * in advance how many semaphores are in this set.
  833                  * While we could just allocate the maximum size array
  834                  * and pass the actual size back to the caller, that
  835                  * won't work for SETALL since we can't copyin() more
  836                  * data than the user specified as we may return a
  837                  * spurious EFAULT.
  838                  * 
  839                  * Note that the number of semaphores in a set is
  840                  * fixed for the life of that set.  The only way that
  841                  * the 'count' could change while are blocked in
  842                  * malloc() is if this semaphore set were destroyed
  843                  * and a new one created with the same index.
  844                  * However, semvalid() will catch that due to the
  845                  * sequence number unless exactly 0x8000 (or a
  846                  * multiple thereof) semaphore sets for the same index
  847                  * are created and destroyed while we are in malloc!
  848                  *
  849                  */
  850                 count = semakptr->u.sem_nsems;
  851                 mtx_unlock(sema_mtxp);              
  852                 array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK);
  853                 mtx_lock(sema_mtxp);
  854                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  855                         goto done2;
  856                 KASSERT(count == semakptr->u.sem_nsems, ("nsems changed"));
  857                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  858                         goto done2;
  859                 for (i = 0; i < semakptr->u.sem_nsems; i++)
  860                         array[i] = semakptr->u.sem_base[i].semval;
  861                 mtx_unlock(sema_mtxp);
  862                 error = copyout(array, arg->array, count * sizeof(*array));
  863                 mtx_lock(sema_mtxp);
  864                 break;
  865 
  866         case GETZCNT:
  867                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  868                         goto done2;
  869                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_R)))
  870                         goto done2;
  871                 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) {
  872                         error = EINVAL;
  873                         goto done2;
  874                 }
  875                 *rval = semakptr->u.sem_base[semnum].semzcnt;
  876                 break;
  877 
  878         case SETVAL:
  879                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  880                         goto done2;
  881                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_W)))
  882                         goto done2;
  883                 if (semnum < 0 || semnum >= semakptr->u.sem_nsems) {
  884                         error = EINVAL;
  885                         goto done2;
  886                 }
  887                 if (arg->val < 0 || arg->val > seminfo.semvmx) {
  888                         error = ERANGE;
  889                         goto done2;
  890                 }
  891                 semakptr->u.sem_base[semnum].semval = arg->val;
  892                 SEMUNDO_LOCK();
  893                 semundo_clear(semidx, semnum);
  894                 SEMUNDO_UNLOCK();
  895                 wakeup(semakptr);
  896                 break;
  897 
  898         case SETALL:
  899                 /*
  900                  * See comment on GETALL for why 'count' shouldn't change
  901                  * and why we require a userland buffer.
  902                  */
  903                 count = semakptr->u.sem_nsems;
  904                 mtx_unlock(sema_mtxp);              
  905                 array = malloc(sizeof(*array) * count, M_TEMP, M_WAITOK);
  906                 error = copyin(arg->array, array, count * sizeof(*array));
  907                 mtx_lock(sema_mtxp);
  908                 if (error)
  909                         break;
  910                 if ((error = semvalid(semid, rpr, semakptr)) != 0)
  911                         goto done2;
  912                 KASSERT(count == semakptr->u.sem_nsems, ("nsems changed"));
  913                 if ((error = ipcperm(td, &semakptr->u.sem_perm, IPC_W)))
  914                         goto done2;
  915                 for (i = 0; i < semakptr->u.sem_nsems; i++) {
  916                         usval = array[i];
  917                         if (usval > seminfo.semvmx) {
  918                                 error = ERANGE;
  919                                 break;
  920                         }
  921                         semakptr->u.sem_base[i].semval = usval;
  922                 }
  923                 SEMUNDO_LOCK();
  924                 semundo_clear(semidx, -1);
  925                 SEMUNDO_UNLOCK();
  926                 wakeup(semakptr);
  927                 break;
  928 
  929         default:
  930                 error = EINVAL;
  931                 break;
  932         }
  933 
  934 done2:
  935         mtx_unlock(sema_mtxp);
  936         if (cmd == IPC_RMID)
  937                 mtx_unlock(&sem_mtx);
  938         if (array != NULL)
  939                 free(array, M_TEMP);
  940         return(error);
  941 }
  942 
  943 #ifndef _SYS_SYSPROTO_H_
  944 struct semget_args {
  945         key_t   key;
  946         int     nsems;
  947         int     semflg;
  948 };
  949 #endif
  950 int
  951 sys_semget(struct thread *td, struct semget_args *uap)
  952 {
  953         int semid, error = 0;
  954         int key = uap->key;
  955         int nsems = uap->nsems;
  956         int semflg = uap->semflg;
  957         struct ucred *cred = td->td_ucred;
  958 
  959         DPRINTF(("semget(0x%x, %d, 0%o)\n", key, nsems, semflg));
  960 
  961         if (sem_find_prison(cred) == NULL)
  962                 return (ENOSYS);
  963 
  964         mtx_lock(&sem_mtx);
  965         if (key != IPC_PRIVATE) {
  966                 for (semid = 0; semid < seminfo.semmni; semid++) {
  967                         if ((sema[semid].u.sem_perm.mode & SEM_ALLOC) &&
  968                             sema[semid].cred != NULL &&
  969                             sema[semid].cred->cr_prison == cred->cr_prison &&
  970                             sema[semid].u.sem_perm.key == key)
  971                                 break;
  972                 }
  973                 if (semid < seminfo.semmni) {
  974                         DPRINTF(("found public key\n"));
  975                         if ((semflg & IPC_CREAT) && (semflg & IPC_EXCL)) {
  976                                 DPRINTF(("not exclusive\n"));
  977                                 error = EEXIST;
  978                                 goto done2;
  979                         }
  980                         if ((error = ipcperm(td, &sema[semid].u.sem_perm,
  981                             semflg & 0700))) {
  982                                 goto done2;
  983                         }
  984                         if (nsems > 0 && sema[semid].u.sem_nsems < nsems) {
  985                                 DPRINTF(("too small\n"));
  986                                 error = EINVAL;
  987                                 goto done2;
  988                         }
  989 #ifdef MAC
  990                         error = mac_sysvsem_check_semget(cred, &sema[semid]);
  991                         if (error != 0)
  992                                 goto done2;
  993 #endif
  994                         goto found;
  995                 }
  996         }
  997 
  998         DPRINTF(("need to allocate the semid_kernel\n"));
  999         if (key == IPC_PRIVATE || (semflg & IPC_CREAT)) {
 1000                 if (nsems <= 0 || nsems > seminfo.semmsl) {
 1001                         DPRINTF(("nsems out of range (0<%d<=%d)\n", nsems,
 1002                             seminfo.semmsl));
 1003                         error = EINVAL;
 1004                         goto done2;
 1005                 }
 1006                 if (nsems > seminfo.semmns - semtot) {
 1007                         DPRINTF((
 1008                             "not enough semaphores left (need %d, got %d)\n",
 1009                             nsems, seminfo.semmns - semtot));
 1010                         error = ENOSPC;
 1011                         goto done2;
 1012                 }
 1013                 for (semid = 0; semid < seminfo.semmni; semid++) {
 1014                         if ((sema[semid].u.sem_perm.mode & SEM_ALLOC) == 0)
 1015                                 break;
 1016                 }
 1017                 if (semid == seminfo.semmni) {
 1018                         DPRINTF(("no more semid_kernel's available\n"));
 1019                         error = ENOSPC;
 1020                         goto done2;
 1021                 }
 1022 #ifdef RACCT
 1023                 if (racct_enable) {
 1024                         PROC_LOCK(td->td_proc);
 1025                         error = racct_add(td->td_proc, RACCT_NSEM, nsems);
 1026                         PROC_UNLOCK(td->td_proc);
 1027                         if (error != 0) {
 1028                                 error = ENOSPC;
 1029                                 goto done2;
 1030                         }
 1031                 }
 1032 #endif
 1033                 DPRINTF(("semid %d is available\n", semid));
 1034                 mtx_lock(&sema_mtx[semid]);
 1035                 KASSERT((sema[semid].u.sem_perm.mode & SEM_ALLOC) == 0,
 1036                     ("Lost semaphore %d", semid));
 1037                 sema[semid].u.sem_perm.key = key;
 1038                 sema[semid].u.sem_perm.cuid = cred->cr_uid;
 1039                 sema[semid].u.sem_perm.uid = cred->cr_uid;
 1040                 sema[semid].u.sem_perm.cgid = cred->cr_gid;
 1041                 sema[semid].u.sem_perm.gid = cred->cr_gid;
 1042                 sema[semid].u.sem_perm.mode = (semflg & 0777) | SEM_ALLOC;
 1043                 sema[semid].cred = crhold(cred);
 1044                 sema[semid].u.sem_perm.seq =
 1045                     (sema[semid].u.sem_perm.seq + 1) & 0x7fff;
 1046                 sema[semid].u.sem_nsems = nsems;
 1047                 sema[semid].u.sem_otime = 0;
 1048                 sema[semid].u.sem_ctime = time_second;
 1049                 sema[semid].u.sem_base = &sem[semtot];
 1050                 semtot += nsems;
 1051                 bzero(sema[semid].u.sem_base,
 1052                     sizeof(sema[semid].u.sem_base[0])*nsems);
 1053 #ifdef MAC
 1054                 mac_sysvsem_create(cred, &sema[semid]);
 1055 #endif
 1056                 mtx_unlock(&sema_mtx[semid]);
 1057                 DPRINTF(("sembase = %p, next = %p\n",
 1058                     sema[semid].u.sem_base, &sem[semtot]));
 1059         } else {
 1060                 DPRINTF(("didn't find it and wasn't asked to create it\n"));
 1061                 error = ENOENT;
 1062                 goto done2;
 1063         }
 1064 
 1065 found:
 1066         td->td_retval[0] = IXSEQ_TO_IPCID(semid, sema[semid].u.sem_perm);
 1067 done2:
 1068         mtx_unlock(&sem_mtx);
 1069         return (error);
 1070 }
 1071 
 1072 #ifndef _SYS_SYSPROTO_H_
 1073 struct semop_args {
 1074         int     semid;
 1075         struct  sembuf *sops;
 1076         size_t  nsops;
 1077 };
 1078 #endif
 1079 int
 1080 sys_semop(struct thread *td, struct semop_args *uap)
 1081 {
 1082 #define SMALL_SOPS      8
 1083         struct sembuf small_sops[SMALL_SOPS];
 1084         int semid = uap->semid;
 1085         size_t nsops = uap->nsops;
 1086         struct prison *rpr;
 1087         struct sembuf *sops;
 1088         struct semid_kernel *semakptr;
 1089         struct sembuf *sopptr = 0;
 1090         struct sem *semptr = 0;
 1091         struct sem_undo *suptr;
 1092         struct mtx *sema_mtxp;
 1093         size_t i, j, k;
 1094         int error;
 1095         int do_wakeup, do_undos;
 1096         unsigned short seq;
 1097 
 1098 #ifdef SEM_DEBUG
 1099         sops = NULL;
 1100 #endif
 1101         DPRINTF(("call to semop(%d, %p, %u)\n", semid, sops, nsops));
 1102 
 1103         rpr = sem_find_prison(td->td_ucred);
 1104         if (sem == NULL)
 1105                 return (ENOSYS);
 1106 
 1107         semid = IPCID_TO_IX(semid);     /* Convert back to zero origin */
 1108 
 1109         if (semid < 0 || semid >= seminfo.semmni)
 1110                 return (EINVAL);
 1111 
 1112         /* Allocate memory for sem_ops */
 1113         if (nsops <= SMALL_SOPS)
 1114                 sops = small_sops;
 1115         else if (nsops > seminfo.semopm) {
 1116                 DPRINTF(("too many sops (max=%d, nsops=%d)\n", seminfo.semopm,
 1117                     nsops));
 1118                 return (E2BIG);
 1119         } else {
 1120 #ifdef RACCT
 1121                 if (racct_enable) {
 1122                         PROC_LOCK(td->td_proc);
 1123                         if (nsops >
 1124                             racct_get_available(td->td_proc, RACCT_NSEMOP)) {
 1125                                 PROC_UNLOCK(td->td_proc);
 1126                                 return (E2BIG);
 1127                         }
 1128                         PROC_UNLOCK(td->td_proc);
 1129                 }
 1130 #endif
 1131 
 1132                 sops = malloc(nsops * sizeof(*sops), M_TEMP, M_WAITOK);
 1133         }
 1134         if ((error = copyin(uap->sops, sops, nsops * sizeof(sops[0]))) != 0) {
 1135                 DPRINTF(("error = %d from copyin(%p, %p, %d)\n", error,
 1136                     uap->sops, sops, nsops * sizeof(sops[0])));
 1137                 if (sops != small_sops)
 1138                         free(sops, M_SEM);
 1139                 return (error);
 1140         }
 1141 
 1142         semakptr = &sema[semid];
 1143         sema_mtxp = &sema_mtx[semid];
 1144         mtx_lock(sema_mtxp);
 1145         if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0) {
 1146                 error = EINVAL;
 1147                 goto done2;
 1148         }
 1149         seq = semakptr->u.sem_perm.seq;
 1150         if (seq != IPCID_TO_SEQ(uap->semid)) {
 1151                 error = EINVAL;
 1152                 goto done2;
 1153         }
 1154         if ((error = sem_prison_cansee(rpr, semakptr)) != 0)
 1155                 goto done2;
 1156         /*
 1157          * Initial pass through sops to see what permissions are needed.
 1158          * Also perform any checks that don't need repeating on each
 1159          * attempt to satisfy the request vector.
 1160          */
 1161         j = 0;          /* permission needed */
 1162         do_undos = 0;
 1163         for (i = 0; i < nsops; i++) {
 1164                 sopptr = &sops[i];
 1165                 if (sopptr->sem_num >= semakptr->u.sem_nsems) {
 1166                         error = EFBIG;
 1167                         goto done2;
 1168                 }
 1169                 if (sopptr->sem_flg & SEM_UNDO && sopptr->sem_op != 0)
 1170                         do_undos = 1;
 1171                 j |= (sopptr->sem_op == 0) ? SEM_R : SEM_A;
 1172         }
 1173 
 1174         if ((error = ipcperm(td, &semakptr->u.sem_perm, j))) {
 1175                 DPRINTF(("error = %d from ipaccess\n", error));
 1176                 goto done2;
 1177         }
 1178 #ifdef MAC
 1179         error = mac_sysvsem_check_semop(td->td_ucred, semakptr, j);
 1180         if (error != 0)
 1181                 goto done2;
 1182 #endif
 1183 
 1184         /*
 1185          * Loop trying to satisfy the vector of requests.
 1186          * If we reach a point where we must wait, any requests already
 1187          * performed are rolled back and we go to sleep until some other
 1188          * process wakes us up.  At this point, we start all over again.
 1189          *
 1190          * This ensures that from the perspective of other tasks, a set
 1191          * of requests is atomic (never partially satisfied).
 1192          */
 1193         for (;;) {
 1194                 do_wakeup = 0;
 1195                 error = 0;      /* error return if necessary */
 1196 
 1197                 for (i = 0; i < nsops; i++) {
 1198                         sopptr = &sops[i];
 1199                         semptr = &semakptr->u.sem_base[sopptr->sem_num];
 1200 
 1201                         DPRINTF((
 1202                             "semop:  semakptr=%p, sem_base=%p, "
 1203                             "semptr=%p, sem[%d]=%d : op=%d, flag=%s\n",
 1204                             semakptr, semakptr->u.sem_base, semptr,
 1205                             sopptr->sem_num, semptr->semval, sopptr->sem_op,
 1206                             (sopptr->sem_flg & IPC_NOWAIT) ?
 1207                             "nowait" : "wait"));
 1208 
 1209                         if (sopptr->sem_op < 0) {
 1210                                 if (semptr->semval + sopptr->sem_op < 0) {
 1211                                         DPRINTF(("semop:  can't do it now\n"));
 1212                                         break;
 1213                                 } else {
 1214                                         semptr->semval += sopptr->sem_op;
 1215                                         if (semptr->semval == 0 &&
 1216                                             semptr->semzcnt > 0)
 1217                                                 do_wakeup = 1;
 1218                                 }
 1219                         } else if (sopptr->sem_op == 0) {
 1220                                 if (semptr->semval != 0) {
 1221                                         DPRINTF(("semop:  not zero now\n"));
 1222                                         break;
 1223                                 }
 1224                         } else if (semptr->semval + sopptr->sem_op >
 1225                             seminfo.semvmx) {
 1226                                 error = ERANGE;
 1227                                 break;
 1228                         } else {
 1229                                 if (semptr->semncnt > 0)
 1230                                         do_wakeup = 1;
 1231                                 semptr->semval += sopptr->sem_op;
 1232                         }
 1233                 }
 1234 
 1235                 /*
 1236                  * Did we get through the entire vector?
 1237                  */
 1238                 if (i >= nsops)
 1239                         goto done;
 1240 
 1241                 /*
 1242                  * No ... rollback anything that we've already done
 1243                  */
 1244                 DPRINTF(("semop:  rollback 0 through %d\n", i-1));
 1245                 for (j = 0; j < i; j++)
 1246                         semakptr->u.sem_base[sops[j].sem_num].semval -=
 1247                             sops[j].sem_op;
 1248 
 1249                 /* If we detected an error, return it */
 1250                 if (error != 0)
 1251                         goto done2;
 1252 
 1253                 /*
 1254                  * If the request that we couldn't satisfy has the
 1255                  * NOWAIT flag set then return with EAGAIN.
 1256                  */
 1257                 if (sopptr->sem_flg & IPC_NOWAIT) {
 1258                         error = EAGAIN;
 1259                         goto done2;
 1260                 }
 1261 
 1262                 if (sopptr->sem_op == 0)
 1263                         semptr->semzcnt++;
 1264                 else
 1265                         semptr->semncnt++;
 1266 
 1267                 DPRINTF(("semop:  good night!\n"));
 1268                 error = msleep(semakptr, sema_mtxp, (PZERO - 4) | PCATCH,
 1269                     "semwait", 0);
 1270                 DPRINTF(("semop:  good morning (error=%d)!\n", error));
 1271                 /* return code is checked below, after sem[nz]cnt-- */
 1272 
 1273                 /*
 1274                  * Make sure that the semaphore still exists
 1275                  */
 1276                 seq = semakptr->u.sem_perm.seq;
 1277                 if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 ||
 1278                     seq != IPCID_TO_SEQ(uap->semid)) {
 1279                         error = EIDRM;
 1280                         goto done2;
 1281                 }
 1282 
 1283                 /*
 1284                  * Renew the semaphore's pointer after wakeup since
 1285                  * during msleep sem_base may have been modified and semptr
 1286                  * is not valid any more
 1287                  */
 1288                 semptr = &semakptr->u.sem_base[sopptr->sem_num];
 1289 
 1290                 /*
 1291                  * The semaphore is still alive.  Readjust the count of
 1292                  * waiting processes.
 1293                  */
 1294                 if (sopptr->sem_op == 0)
 1295                         semptr->semzcnt--;
 1296                 else
 1297                         semptr->semncnt--;
 1298 
 1299                 /*
 1300                  * Is it really morning, or was our sleep interrupted?
 1301                  * (Delayed check of msleep() return code because we
 1302                  * need to decrement sem[nz]cnt either way.)
 1303                  */
 1304                 if (error != 0) {
 1305                         error = EINTR;
 1306                         goto done2;
 1307                 }
 1308                 DPRINTF(("semop:  good morning!\n"));
 1309         }
 1310 
 1311 done:
 1312         /*
 1313          * Process any SEM_UNDO requests.
 1314          */
 1315         if (do_undos) {
 1316                 SEMUNDO_LOCK();
 1317                 suptr = NULL;
 1318                 for (i = 0; i < nsops; i++) {
 1319                         /*
 1320                          * We only need to deal with SEM_UNDO's for non-zero
 1321                          * op's.
 1322                          */
 1323                         int adjval;
 1324 
 1325                         if ((sops[i].sem_flg & SEM_UNDO) == 0)
 1326                                 continue;
 1327                         adjval = sops[i].sem_op;
 1328                         if (adjval == 0)
 1329                                 continue;
 1330                         error = semundo_adjust(td, &suptr, semid, seq,
 1331                             sops[i].sem_num, -adjval);
 1332                         if (error == 0)
 1333                                 continue;
 1334 
 1335                         /*
 1336                          * Oh-Oh!  We ran out of either sem_undo's or undo's.
 1337                          * Rollback the adjustments to this point and then
 1338                          * rollback the semaphore ups and down so we can return
 1339                          * with an error with all structures restored.  We
 1340                          * rollback the undo's in the exact reverse order that
 1341                          * we applied them.  This guarantees that we won't run
 1342                          * out of space as we roll things back out.
 1343                          */
 1344                         for (j = 0; j < i; j++) {
 1345                                 k = i - j - 1;
 1346                                 if ((sops[k].sem_flg & SEM_UNDO) == 0)
 1347                                         continue;
 1348                                 adjval = sops[k].sem_op;
 1349                                 if (adjval == 0)
 1350                                         continue;
 1351                                 if (semundo_adjust(td, &suptr, semid, seq,
 1352                                     sops[k].sem_num, adjval) != 0)
 1353                                         panic("semop - can't undo undos");
 1354                         }
 1355 
 1356                         for (j = 0; j < nsops; j++)
 1357                                 semakptr->u.sem_base[sops[j].sem_num].semval -=
 1358                                     sops[j].sem_op;
 1359 
 1360                         DPRINTF(("error = %d from semundo_adjust\n", error));
 1361                         SEMUNDO_UNLOCK();
 1362                         goto done2;
 1363                 } /* loop through the sops */
 1364                 SEMUNDO_UNLOCK();
 1365         } /* if (do_undos) */
 1366 
 1367         /* We're definitely done - set the sempid's and time */
 1368         for (i = 0; i < nsops; i++) {
 1369                 sopptr = &sops[i];
 1370                 semptr = &semakptr->u.sem_base[sopptr->sem_num];
 1371                 semptr->sempid = td->td_proc->p_pid;
 1372         }
 1373         semakptr->u.sem_otime = time_second;
 1374 
 1375         /*
 1376          * Do a wakeup if any semaphore was up'd whilst something was
 1377          * sleeping on it.
 1378          */
 1379         if (do_wakeup) {
 1380                 DPRINTF(("semop:  doing wakeup\n"));
 1381                 wakeup(semakptr);
 1382                 DPRINTF(("semop:  back from wakeup\n"));
 1383         }
 1384         DPRINTF(("semop:  done\n"));
 1385         td->td_retval[0] = 0;
 1386 done2:
 1387         mtx_unlock(sema_mtxp);
 1388         if (sops != small_sops)
 1389                 free(sops, M_SEM);
 1390         return (error);
 1391 }
 1392 
 1393 /*
 1394  * Go through the undo structures for this process and apply the adjustments to
 1395  * semaphores.
 1396  */
 1397 static void
 1398 semexit_myhook(void *arg, struct proc *p)
 1399 {
 1400         struct sem_undo *suptr;
 1401         struct semid_kernel *semakptr;
 1402         struct mtx *sema_mtxp;
 1403         int semid, semnum, adjval, ix;
 1404         unsigned short seq;
 1405 
 1406         /*
 1407          * Go through the chain of undo vectors looking for one
 1408          * associated with this process.
 1409          */
 1410         SEMUNDO_LOCK();
 1411         LIST_FOREACH(suptr, &semu_list, un_next) {
 1412                 if (suptr->un_proc == p)
 1413                         break;
 1414         }
 1415         if (suptr == NULL) {
 1416                 SEMUNDO_UNLOCK();
 1417                 return;
 1418         }
 1419         LIST_REMOVE(suptr, un_next);
 1420 
 1421         DPRINTF(("proc @%p has undo structure with %d entries\n", p,
 1422             suptr->un_cnt));
 1423 
 1424         /*
 1425          * If there are any active undo elements then process them.
 1426          */
 1427         if (suptr->un_cnt > 0) {
 1428                 SEMUNDO_UNLOCK();
 1429                 for (ix = 0; ix < suptr->un_cnt; ix++) {
 1430                         semid = suptr->un_ent[ix].un_id;
 1431                         semnum = suptr->un_ent[ix].un_num;
 1432                         adjval = suptr->un_ent[ix].un_adjval;
 1433                         seq = suptr->un_ent[ix].un_seq;
 1434                         semakptr = &sema[semid];
 1435                         sema_mtxp = &sema_mtx[semid];
 1436 
 1437                         mtx_lock(sema_mtxp);
 1438                         if ((semakptr->u.sem_perm.mode & SEM_ALLOC) == 0 ||
 1439                             (semakptr->u.sem_perm.seq != seq)) {
 1440                                 mtx_unlock(sema_mtxp);
 1441                                 continue;
 1442                         }
 1443                         if (semnum >= semakptr->u.sem_nsems)
 1444                                 panic("semexit - semnum out of range");
 1445 
 1446                         DPRINTF((
 1447                             "semexit:  %p id=%d num=%d(adj=%d) ; sem=%d\n",
 1448                             suptr->un_proc, suptr->un_ent[ix].un_id,
 1449                             suptr->un_ent[ix].un_num,
 1450                             suptr->un_ent[ix].un_adjval,
 1451                             semakptr->u.sem_base[semnum].semval));
 1452 
 1453                         if (adjval < 0 && semakptr->u.sem_base[semnum].semval <
 1454                             -adjval)
 1455                                 semakptr->u.sem_base[semnum].semval = 0;
 1456                         else
 1457                                 semakptr->u.sem_base[semnum].semval += adjval;
 1458 
 1459                         wakeup(semakptr);
 1460                         DPRINTF(("semexit:  back from wakeup\n"));
 1461                         mtx_unlock(sema_mtxp);
 1462                 }
 1463                 SEMUNDO_LOCK();
 1464         }
 1465 
 1466         /*
 1467          * Deallocate the undo vector.
 1468          */
 1469         DPRINTF(("removing vector\n"));
 1470         suptr->un_proc = NULL;
 1471         suptr->un_cnt = 0;
 1472         LIST_INSERT_HEAD(&semu_free_list, suptr, un_next);
 1473         SEMUNDO_UNLOCK();
 1474 }
 1475 
 1476 static int
 1477 sysctl_sema(SYSCTL_HANDLER_ARGS)
 1478 {
 1479         struct prison *pr, *rpr;
 1480         struct semid_kernel tsemak;
 1481         int error, i;
 1482 
 1483         pr = req->td->td_ucred->cr_prison;
 1484         rpr = sem_find_prison(req->td->td_ucred);
 1485         error = 0;
 1486         for (i = 0; i < seminfo.semmni; i++) {
 1487                 mtx_lock(&sema_mtx[i]);
 1488                 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) == 0 ||
 1489                     rpr == NULL || sem_prison_cansee(rpr, &sema[i]) != 0)
 1490                         bzero(&tsemak, sizeof(tsemak));
 1491                 else {
 1492                         tsemak = sema[i];
 1493                         if (tsemak.cred->cr_prison != pr)
 1494                                 tsemak.u.sem_perm.key = IPC_PRIVATE;
 1495                 }
 1496                 mtx_unlock(&sema_mtx[i]);
 1497                 error = SYSCTL_OUT(req, &tsemak, sizeof(tsemak));
 1498                 if (error != 0)
 1499                         break;
 1500         }
 1501         return (error);
 1502 }
 1503 
 1504 static int
 1505 sem_prison_check(void *obj, void *data)
 1506 {
 1507         struct prison *pr = obj;
 1508         struct prison *prpr;
 1509         struct vfsoptlist *opts = data;
 1510         int error, jsys;
 1511 
 1512         /*
 1513          * sysvsem is a jailsys integer.
 1514          * It must be "disable" if the parent jail is disabled.
 1515          */
 1516         error = vfs_copyopt(opts, "sysvsem", &jsys, sizeof(jsys));
 1517         if (error != ENOENT) {
 1518                 if (error != 0)
 1519                         return (error);
 1520                 switch (jsys) {
 1521                 case JAIL_SYS_DISABLE:
 1522                         break;
 1523                 case JAIL_SYS_NEW:
 1524                 case JAIL_SYS_INHERIT:
 1525                         prison_lock(pr->pr_parent);
 1526                         prpr = osd_jail_get(pr->pr_parent, sem_prison_slot);
 1527                         prison_unlock(pr->pr_parent);
 1528                         if (prpr == NULL)
 1529                                 return (EPERM);
 1530                         break;
 1531                 default:
 1532                         return (EINVAL);
 1533                 }
 1534         }
 1535 
 1536         return (0);
 1537 }
 1538 
 1539 static int
 1540 sem_prison_set(void *obj, void *data)
 1541 {
 1542         struct prison *pr = obj;
 1543         struct prison *tpr, *orpr, *nrpr, *trpr;
 1544         struct vfsoptlist *opts = data;
 1545         void *rsv;
 1546         int jsys, descend;
 1547 
 1548         /*
 1549          * sysvsem controls which jail is the root of the associated sems (this
 1550          * jail or same as the parent), or if the feature is available at all.
 1551          */
 1552         if (vfs_copyopt(opts, "sysvsem", &jsys, sizeof(jsys)) == ENOENT)
 1553                 jsys = vfs_flagopt(opts, "allow.sysvipc", NULL, 0)
 1554                     ? JAIL_SYS_INHERIT
 1555                     : vfs_flagopt(opts, "allow.nosysvipc", NULL, 0)
 1556                     ? JAIL_SYS_DISABLE
 1557                     : -1;
 1558         if (jsys == JAIL_SYS_DISABLE) {
 1559                 prison_lock(pr);
 1560                 orpr = osd_jail_get(pr, sem_prison_slot);
 1561                 if (orpr != NULL)
 1562                         osd_jail_del(pr, sem_prison_slot);
 1563                 prison_unlock(pr);
 1564                 if (orpr != NULL) {
 1565                         if (orpr == pr)
 1566                                 sem_prison_cleanup(pr);
 1567                         /* Disable all child jails as well. */
 1568                         FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
 1569                                 prison_lock(tpr);
 1570                                 trpr = osd_jail_get(tpr, sem_prison_slot);
 1571                                 if (trpr != NULL) {
 1572                                         osd_jail_del(tpr, sem_prison_slot);
 1573                                         prison_unlock(tpr);
 1574                                         if (trpr == tpr)
 1575                                                 sem_prison_cleanup(tpr);
 1576                                 } else {
 1577                                         prison_unlock(tpr);
 1578                                         descend = 0;
 1579                                 }
 1580                         }
 1581                 }
 1582         } else if (jsys != -1) {
 1583                 if (jsys == JAIL_SYS_NEW)
 1584                         nrpr = pr;
 1585                 else {
 1586                         prison_lock(pr->pr_parent);
 1587                         nrpr = osd_jail_get(pr->pr_parent, sem_prison_slot);
 1588                         prison_unlock(pr->pr_parent);
 1589                 }
 1590                 rsv = osd_reserve(sem_prison_slot);
 1591                 prison_lock(pr);
 1592                 orpr = osd_jail_get(pr, sem_prison_slot);
 1593                 if (orpr != nrpr)
 1594                         (void)osd_jail_set_reserved(pr, sem_prison_slot, rsv,
 1595                             nrpr);
 1596                 else
 1597                         osd_free_reserved(rsv);
 1598                 prison_unlock(pr);
 1599                 if (orpr != nrpr) {
 1600                         if (orpr == pr)
 1601                                 sem_prison_cleanup(pr);
 1602                         if (orpr != NULL) {
 1603                                 /* Change child jails matching the old root, */
 1604                                 FOREACH_PRISON_DESCENDANT(pr, tpr, descend) {
 1605                                         prison_lock(tpr);
 1606                                         trpr = osd_jail_get(tpr,
 1607                                             sem_prison_slot);
 1608                                         if (trpr == orpr) {
 1609                                                 (void)osd_jail_set(tpr,
 1610                                                     sem_prison_slot, nrpr);
 1611                                                 prison_unlock(tpr);
 1612                                                 if (trpr == tpr)
 1613                                                         sem_prison_cleanup(tpr);
 1614                                         } else {
 1615                                                 prison_unlock(tpr);
 1616                                                 descend = 0;
 1617                                         }
 1618                                 }
 1619                         }
 1620                 }
 1621         }
 1622 
 1623         return (0);
 1624 }
 1625 
 1626 static int
 1627 sem_prison_get(void *obj, void *data)
 1628 {
 1629         struct prison *pr = obj;
 1630         struct prison *rpr;
 1631         struct vfsoptlist *opts = data;
 1632         int error, jsys;
 1633 
 1634         /* Set sysvsem based on the jail's root prison. */
 1635         prison_lock(pr);
 1636         rpr = osd_jail_get(pr, sem_prison_slot);
 1637         prison_unlock(pr);
 1638         jsys = rpr == NULL ? JAIL_SYS_DISABLE
 1639             : rpr == pr ? JAIL_SYS_NEW : JAIL_SYS_INHERIT;
 1640         error = vfs_setopt(opts, "sysvsem", &jsys, sizeof(jsys));
 1641         if (error == ENOENT)
 1642                 error = 0;
 1643         return (error);
 1644 }
 1645 
 1646 static int
 1647 sem_prison_remove(void *obj, void *data __unused)
 1648 {
 1649         struct prison *pr = obj;
 1650         struct prison *rpr;
 1651 
 1652         prison_lock(pr);
 1653         rpr = osd_jail_get(pr, sem_prison_slot);
 1654         prison_unlock(pr);
 1655         if (rpr == pr)
 1656                 sem_prison_cleanup(pr);
 1657         return (0);
 1658 }
 1659 
 1660 static void
 1661 sem_prison_cleanup(struct prison *pr)
 1662 {
 1663         int i;
 1664 
 1665         /* Remove any sems that belong to this jail. */
 1666         mtx_lock(&sem_mtx);
 1667         for (i = 0; i < seminfo.semmni; i++) {
 1668                 if ((sema[i].u.sem_perm.mode & SEM_ALLOC) &&
 1669                     sema[i].cred != NULL && sema[i].cred->cr_prison == pr) {
 1670                         mtx_lock(&sema_mtx[i]);
 1671                         sem_remove(i, NULL);
 1672                         mtx_unlock(&sema_mtx[i]);
 1673                 }
 1674         }
 1675         mtx_unlock(&sem_mtx);
 1676 }
 1677 
 1678 SYSCTL_JAIL_PARAM_SYS_NODE(sysvsem, CTLFLAG_RW, "SYSV semaphores");
 1679 
 1680 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
 1681     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
 1682 
 1683 /* XXX casting to (sy_call_t *) is bogus, as usual. */
 1684 static sy_call_t *semcalls[] = {
 1685         (sy_call_t *)freebsd7___semctl, (sy_call_t *)sys_semget,
 1686         (sy_call_t *)sys_semop
 1687 };
 1688 
 1689 /*
 1690  * Entry point for all SEM calls.
 1691  */
 1692 int
 1693 sys_semsys(td, uap)
 1694         struct thread *td;
 1695         /* XXX actually varargs. */
 1696         struct semsys_args /* {
 1697                 int     which;
 1698                 int     a2;
 1699                 int     a3;
 1700                 int     a4;
 1701                 int     a5;
 1702         } */ *uap;
 1703 {
 1704         int error;
 1705 
 1706         if (uap->which < 0 ||
 1707             uap->which >= sizeof(semcalls)/sizeof(semcalls[0]))
 1708                 return (EINVAL);
 1709         error = (*semcalls[uap->which])(td, &uap->a2);
 1710         return (error);
 1711 }
 1712 
 1713 #ifndef CP
 1714 #define CP(src, dst, fld)       do { (dst).fld = (src).fld; } while (0)
 1715 #endif
 1716 
 1717 #ifndef _SYS_SYSPROTO_H_
 1718 struct freebsd7___semctl_args {
 1719         int     semid;
 1720         int     semnum;
 1721         int     cmd;
 1722         union   semun_old *arg;
 1723 };
 1724 #endif
 1725 int
 1726 freebsd7___semctl(struct thread *td, struct freebsd7___semctl_args *uap)
 1727 {
 1728         struct semid_ds_old dsold;
 1729         struct semid_ds dsbuf;
 1730         union semun_old arg;
 1731         union semun semun;
 1732         register_t rval;
 1733         int error;
 1734 
 1735         switch (uap->cmd) {
 1736         case SEM_STAT:
 1737         case IPC_SET:
 1738         case IPC_STAT:
 1739         case GETALL:
 1740         case SETVAL:
 1741         case SETALL:
 1742                 error = copyin(uap->arg, &arg, sizeof(arg));
 1743                 if (error)
 1744                         return (error);
 1745                 break;
 1746         }
 1747 
 1748         switch (uap->cmd) {
 1749         case SEM_STAT:
 1750         case IPC_STAT:
 1751                 semun.buf = &dsbuf;
 1752                 break;
 1753         case IPC_SET:
 1754                 error = copyin(arg.buf, &dsold, sizeof(dsold));
 1755                 if (error)
 1756                         return (error);
 1757                 ipcperm_old2new(&dsold.sem_perm, &dsbuf.sem_perm);
 1758                 CP(dsold, dsbuf, sem_base);
 1759                 CP(dsold, dsbuf, sem_nsems);
 1760                 CP(dsold, dsbuf, sem_otime);
 1761                 CP(dsold, dsbuf, sem_ctime);
 1762                 semun.buf = &dsbuf;
 1763                 break;
 1764         case GETALL:
 1765         case SETALL:
 1766                 semun.array = arg.array;
 1767                 break;
 1768         case SETVAL:
 1769                 semun.val = arg.val;
 1770                 break;          
 1771         }
 1772 
 1773         error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun,
 1774             &rval);
 1775         if (error)
 1776                 return (error);
 1777 
 1778         switch (uap->cmd) {
 1779         case SEM_STAT:
 1780         case IPC_STAT:
 1781                 bzero(&dsold, sizeof(dsold));
 1782                 ipcperm_new2old(&dsbuf.sem_perm, &dsold.sem_perm);
 1783                 CP(dsbuf, dsold, sem_base);
 1784                 CP(dsbuf, dsold, sem_nsems);
 1785                 CP(dsbuf, dsold, sem_otime);
 1786                 CP(dsbuf, dsold, sem_ctime);
 1787                 error = copyout(&dsold, arg.buf, sizeof(dsold));
 1788                 break;
 1789         }
 1790 
 1791         if (error == 0)
 1792                 td->td_retval[0] = rval;
 1793         return (error);
 1794 }
 1795 
 1796 #endif /* COMPAT_FREEBSD{4,5,6,7} */
 1797 
 1798 #ifdef COMPAT_FREEBSD32
 1799 
 1800 int
 1801 freebsd32_semsys(struct thread *td, struct freebsd32_semsys_args *uap)
 1802 {
 1803 
 1804 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
 1805     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
 1806         switch (uap->which) {
 1807         case 0:
 1808                 return (freebsd7_freebsd32_semctl(td,
 1809                     (struct freebsd7_freebsd32_semctl_args *)&uap->a2));
 1810         default:
 1811                 return (sys_semsys(td, (struct semsys_args *)uap));
 1812         }
 1813 #else
 1814         return (nosys(td, NULL));
 1815 #endif
 1816 }
 1817 
 1818 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
 1819     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
 1820 int
 1821 freebsd7_freebsd32_semctl(struct thread *td,
 1822     struct freebsd7_freebsd32_semctl_args *uap)
 1823 {
 1824         struct semid_ds32_old dsbuf32;
 1825         struct semid_ds dsbuf;
 1826         union semun semun;
 1827         union semun32 arg;
 1828         register_t rval;
 1829         int error;
 1830 
 1831         switch (uap->cmd) {
 1832         case SEM_STAT:
 1833         case IPC_SET:
 1834         case IPC_STAT:
 1835         case GETALL:
 1836         case SETVAL:
 1837         case SETALL:
 1838                 error = copyin(uap->arg, &arg, sizeof(arg));
 1839                 if (error)
 1840                         return (error);         
 1841                 break;
 1842         }
 1843 
 1844         switch (uap->cmd) {
 1845         case SEM_STAT:
 1846         case IPC_STAT:
 1847                 semun.buf = &dsbuf;
 1848                 break;
 1849         case IPC_SET:
 1850                 error = copyin(PTRIN(arg.buf), &dsbuf32, sizeof(dsbuf32));
 1851                 if (error)
 1852                         return (error);
 1853                 freebsd32_ipcperm_old_in(&dsbuf32.sem_perm, &dsbuf.sem_perm);
 1854                 PTRIN_CP(dsbuf32, dsbuf, sem_base);
 1855                 CP(dsbuf32, dsbuf, sem_nsems);
 1856                 CP(dsbuf32, dsbuf, sem_otime);
 1857                 CP(dsbuf32, dsbuf, sem_ctime);
 1858                 semun.buf = &dsbuf;
 1859                 break;
 1860         case GETALL:
 1861         case SETALL:
 1862                 semun.array = PTRIN(arg.array);
 1863                 break;
 1864         case SETVAL:
 1865                 semun.val = arg.val;
 1866                 break;
 1867         }
 1868 
 1869         error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun,
 1870             &rval);
 1871         if (error)
 1872                 return (error);
 1873 
 1874         switch (uap->cmd) {
 1875         case SEM_STAT:
 1876         case IPC_STAT:
 1877                 bzero(&dsbuf32, sizeof(dsbuf32));
 1878                 freebsd32_ipcperm_old_out(&dsbuf.sem_perm, &dsbuf32.sem_perm);
 1879                 PTROUT_CP(dsbuf, dsbuf32, sem_base);
 1880                 CP(dsbuf, dsbuf32, sem_nsems);
 1881                 CP(dsbuf, dsbuf32, sem_otime);
 1882                 CP(dsbuf, dsbuf32, sem_ctime);
 1883                 error = copyout(&dsbuf32, PTRIN(arg.buf), sizeof(dsbuf32));
 1884                 break;
 1885         }
 1886 
 1887         if (error == 0)
 1888                 td->td_retval[0] = rval;
 1889         return (error);
 1890 }
 1891 #endif
 1892 
 1893 int
 1894 freebsd32_semctl(struct thread *td, struct freebsd32_semctl_args *uap)
 1895 {
 1896         struct semid_ds32 dsbuf32;
 1897         struct semid_ds dsbuf;
 1898         union semun semun;
 1899         union semun32 arg;
 1900         register_t rval;
 1901         int error;
 1902 
 1903         switch (uap->cmd) {
 1904         case SEM_STAT:
 1905         case IPC_SET:
 1906         case IPC_STAT:
 1907         case GETALL:
 1908         case SETVAL:
 1909         case SETALL:
 1910                 error = copyin(uap->arg, &arg, sizeof(arg));
 1911                 if (error)
 1912                         return (error);         
 1913                 break;
 1914         }
 1915 
 1916         switch (uap->cmd) {
 1917         case SEM_STAT:
 1918         case IPC_STAT:
 1919                 semun.buf = &dsbuf;
 1920                 break;
 1921         case IPC_SET:
 1922                 error = copyin(PTRIN(arg.buf), &dsbuf32, sizeof(dsbuf32));
 1923                 if (error)
 1924                         return (error);
 1925                 freebsd32_ipcperm_in(&dsbuf32.sem_perm, &dsbuf.sem_perm);
 1926                 PTRIN_CP(dsbuf32, dsbuf, sem_base);
 1927                 CP(dsbuf32, dsbuf, sem_nsems);
 1928                 CP(dsbuf32, dsbuf, sem_otime);
 1929                 CP(dsbuf32, dsbuf, sem_ctime);
 1930                 semun.buf = &dsbuf;
 1931                 break;
 1932         case GETALL:
 1933         case SETALL:
 1934                 semun.array = PTRIN(arg.array);
 1935                 break;
 1936         case SETVAL:
 1937                 semun.val = arg.val;
 1938                 break;          
 1939         }
 1940 
 1941         error = kern_semctl(td, uap->semid, uap->semnum, uap->cmd, &semun,
 1942             &rval);
 1943         if (error)
 1944                 return (error);
 1945 
 1946         switch (uap->cmd) {
 1947         case SEM_STAT:
 1948         case IPC_STAT:
 1949                 bzero(&dsbuf32, sizeof(dsbuf32));
 1950                 freebsd32_ipcperm_out(&dsbuf.sem_perm, &dsbuf32.sem_perm);
 1951                 PTROUT_CP(dsbuf, dsbuf32, sem_base);
 1952                 CP(dsbuf, dsbuf32, sem_nsems);
 1953                 CP(dsbuf, dsbuf32, sem_otime);
 1954                 CP(dsbuf, dsbuf32, sem_ctime);
 1955                 error = copyout(&dsbuf32, PTRIN(arg.buf), sizeof(dsbuf32));
 1956                 break;
 1957         }
 1958 
 1959         if (error == 0)
 1960                 td->td_retval[0] = rval;
 1961         return (error);
 1962 }
 1963 
 1964 #endif /* COMPAT_FREEBSD32 */

Cache object: 68c8acf4a2209ac6b45dc617b070a378


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.