blob: cb5bb2a5df96f417f5c44b1108e8483ee3a10585 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/ipc/sem.c
3 * Copyright (C) 1992 Krishna Balasubramanian
4 * Copyright (C) 1995 Eric Schenk, Bruno Haible
5 *
6 * IMPLEMENTATION NOTES ON CODE REWRITE (Eric Schenk, January 1995):
7 * This code underwent a massive rewrite in order to solve some problems
8 * with the original code. In particular the original code failed to
9 * wake up processes that were waiting for semval to go to 0 if the
10 * value went to 0 and was then incremented rapidly enough. In solving
11 * this problem I have also modified the implementation so that it
12 * processes pending operations in a FIFO manner, thus give a guarantee
13 * that processes waiting for a lock on the semaphore won't starve
14 * unless another locking process fails to unlock.
15 * In addition the following two changes in behavior have been introduced:
16 * - The original implementation of semop returned the value
17 * last semaphore element examined on success. This does not
18 * match the manual page specifications, and effectively
19 * allows the user to read the semaphore even if they do not
20 * have read permissions. The implementation now returns 0
21 * on success as stated in the manual page.
22 * - There is some confusion over whether the set of undo adjustments
23 * to be performed at exit should be done in an atomic manner.
24 * That is, if we are attempting to decrement the semval should we queue
25 * up and wait until we can do so legally?
26 * The original implementation attempted to do this.
27 * The current implementation does not do so. This is because I don't
28 * think it is the right thing (TM) to do, and because I couldn't
29 * see a clean way to get the old behavior with the new design.
30 * The POSIX standard and SVID should be consulted to determine
31 * what behavior is mandated.
32 *
33 * Further notes on refinement (Christoph Rohland, December 1998):
34 * - The POSIX standard says, that the undo adjustments simply should
35 * redo. So the current implementation is o.K.
36 * - The previous code had two flaws:
37 * 1) It actively gave the semaphore to the next waiting process
38 * sleeping on the semaphore. Since this process did not have the
39 * cpu this led to many unnecessary context switches and bad
40 * performance. Now we only check which process should be able to
41 * get the semaphore and if this process wants to reduce some
42 * semaphore value we simply wake it up without doing the
43 * operation. So it has to try to get it later. Thus e.g. the
44 * running process may reacquire the semaphore during the current
45 * time slice. If it only waits for zero or increases the semaphore,
46 * we do the operation in advance and wake it up.
47 * 2) It did not wake up all zero waiting processes. We try to do
48 * better but only get the semops right which only wait for zero or
49 * increase. If there are decrement operations in the operations
50 * array we do the same as before.
51 *
52 * With the incarnation of O(1) scheduler, it becomes unnecessary to perform
53 * check/retry algorithm for waking up blocked processes as the new scheduler
54 * is better at handling thread switch than the old one.
55 *
56 * /proc/sysvipc/sem support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
57 *
58 * SMP-threaded, sysctl's added
59 * (c) 1999 Manfred Spraul <manfreds@colorfullife.com>
60 * Enforced range limit on SEM_UNDO
61 * (c) 2001 Red Hat Inc <alan@redhat.com>
62 * Lockless wakeup
63 * (c) 2003 Manfred Spraul <manfred@colorfullife.com>
64 */
65
66#include <linux/config.h>
67#include <linux/slab.h>
68#include <linux/spinlock.h>
69#include <linux/init.h>
70#include <linux/proc_fs.h>
71#include <linux/time.h>
72#include <linux/smp_lock.h>
73#include <linux/security.h>
74#include <linux/syscalls.h>
75#include <linux/audit.h>
Mike Waychison19b49462005-09-06 15:17:10 -070076#include <linux/seq_file.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070077#include <asm/uaccess.h>
78#include "util.h"
79
80
81#define sem_lock(id) ((struct sem_array*)ipc_lock(&sem_ids,id))
82#define sem_unlock(sma) ipc_unlock(&(sma)->sem_perm)
83#define sem_rmid(id) ((struct sem_array*)ipc_rmid(&sem_ids,id))
84#define sem_checkid(sma, semid) \
85 ipc_checkid(&sem_ids,&sma->sem_perm,semid)
86#define sem_buildid(id, seq) \
87 ipc_buildid(&sem_ids, id, seq)
88static struct ipc_ids sem_ids;
89
90static int newary (key_t, int, int);
91static void freeary (struct sem_array *sma, int id);
92#ifdef CONFIG_PROC_FS
Mike Waychison19b49462005-09-06 15:17:10 -070093static int sysvipc_sem_proc_show(struct seq_file *s, void *it);
Linus Torvalds1da177e2005-04-16 15:20:36 -070094#endif
95
96#define SEMMSL_FAST 256 /* 512 bytes on stack */
97#define SEMOPM_FAST 64 /* ~ 372 bytes on stack */
98
99/*
100 * linked list protection:
101 * sem_undo.id_next,
102 * sem_array.sem_pending{,last},
103 * sem_array.sem_undo: sem_lock() for read/write
104 * sem_undo.proc_next: only "current" is allowed to read/write that field.
105 *
106 */
107
108int sem_ctls[4] = {SEMMSL, SEMMNS, SEMOPM, SEMMNI};
109#define sc_semmsl (sem_ctls[0])
110#define sc_semmns (sem_ctls[1])
111#define sc_semopm (sem_ctls[2])
112#define sc_semmni (sem_ctls[3])
113
114static int used_sems;
115
116void __init sem_init (void)
117{
118 used_sems = 0;
119 ipc_init_ids(&sem_ids,sc_semmni);
Mike Waychison19b49462005-09-06 15:17:10 -0700120 ipc_init_proc_interface("sysvipc/sem",
121 " key semid perms nsems uid gid cuid cgid otime ctime\n",
122 &sem_ids,
123 sysvipc_sem_proc_show);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700124}
125
126/*
127 * Lockless wakeup algorithm:
128 * Without the check/retry algorithm a lockless wakeup is possible:
129 * - queue.status is initialized to -EINTR before blocking.
130 * - wakeup is performed by
131 * * unlinking the queue entry from sma->sem_pending
132 * * setting queue.status to IN_WAKEUP
133 * This is the notification for the blocked thread that a
134 * result value is imminent.
135 * * call wake_up_process
136 * * set queue.status to the final value.
137 * - the previously blocked thread checks queue.status:
138 * * if it's IN_WAKEUP, then it must wait until the value changes
139 * * if it's not -EINTR, then the operation was completed by
140 * update_queue. semtimedop can return queue.status without
141 * performing any operation on the semaphore array.
142 * * otherwise it must acquire the spinlock and check what's up.
143 *
144 * The two-stage algorithm is necessary to protect against the following
145 * races:
146 * - if queue.status is set after wake_up_process, then the woken up idle
147 * thread could race forward and try (and fail) to acquire sma->lock
148 * before update_queue had a chance to set queue.status
149 * - if queue.status is written before wake_up_process and if the
150 * blocked process is woken up by a signal between writing
151 * queue.status and the wake_up_process, then the woken up
152 * process could return from semtimedop and die by calling
153 * sys_exit before wake_up_process is called. Then wake_up_process
154 * will oops, because the task structure is already invalid.
155 * (yes, this happened on s390 with sysv msg).
156 *
157 */
158#define IN_WAKEUP 1
159
160static int newary (key_t key, int nsems, int semflg)
161{
162 int id;
163 int retval;
164 struct sem_array *sma;
165 int size;
166
167 if (!nsems)
168 return -EINVAL;
169 if (used_sems + nsems > sc_semmns)
170 return -ENOSPC;
171
172 size = sizeof (*sma) + nsems * sizeof (struct sem);
173 sma = ipc_rcu_alloc(size);
174 if (!sma) {
175 return -ENOMEM;
176 }
177 memset (sma, 0, size);
178
179 sma->sem_perm.mode = (semflg & S_IRWXUGO);
180 sma->sem_perm.key = key;
181
182 sma->sem_perm.security = NULL;
183 retval = security_sem_alloc(sma);
184 if (retval) {
185 ipc_rcu_putref(sma);
186 return retval;
187 }
188
189 id = ipc_addid(&sem_ids, &sma->sem_perm, sc_semmni);
190 if(id == -1) {
191 security_sem_free(sma);
192 ipc_rcu_putref(sma);
193 return -ENOSPC;
194 }
195 used_sems += nsems;
196
Mike Waychison19b49462005-09-06 15:17:10 -0700197 sma->sem_id = sem_buildid(id, sma->sem_perm.seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700198 sma->sem_base = (struct sem *) &sma[1];
199 /* sma->sem_pending = NULL; */
200 sma->sem_pending_last = &sma->sem_pending;
201 /* sma->undo = NULL; */
202 sma->sem_nsems = nsems;
203 sma->sem_ctime = get_seconds();
204 sem_unlock(sma);
205
Mike Waychison19b49462005-09-06 15:17:10 -0700206 return sma->sem_id;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700207}
208
209asmlinkage long sys_semget (key_t key, int nsems, int semflg)
210{
211 int id, err = -EINVAL;
212 struct sem_array *sma;
213
214 if (nsems < 0 || nsems > sc_semmsl)
215 return -EINVAL;
216 down(&sem_ids.sem);
217
218 if (key == IPC_PRIVATE) {
219 err = newary(key, nsems, semflg);
220 } else if ((id = ipc_findkey(&sem_ids, key)) == -1) { /* key not used */
221 if (!(semflg & IPC_CREAT))
222 err = -ENOENT;
223 else
224 err = newary(key, nsems, semflg);
225 } else if (semflg & IPC_CREAT && semflg & IPC_EXCL) {
226 err = -EEXIST;
227 } else {
228 sma = sem_lock(id);
229 if(sma==NULL)
230 BUG();
231 if (nsems > sma->sem_nsems)
232 err = -EINVAL;
233 else if (ipcperms(&sma->sem_perm, semflg))
234 err = -EACCES;
235 else {
236 int semid = sem_buildid(id, sma->sem_perm.seq);
237 err = security_sem_associate(sma, semflg);
238 if (!err)
239 err = semid;
240 }
241 sem_unlock(sma);
242 }
243
244 up(&sem_ids.sem);
245 return err;
246}
247
248/* Manage the doubly linked list sma->sem_pending as a FIFO:
249 * insert new queue elements at the tail sma->sem_pending_last.
250 */
251static inline void append_to_queue (struct sem_array * sma,
252 struct sem_queue * q)
253{
254 *(q->prev = sma->sem_pending_last) = q;
255 *(sma->sem_pending_last = &q->next) = NULL;
256}
257
258static inline void prepend_to_queue (struct sem_array * sma,
259 struct sem_queue * q)
260{
261 q->next = sma->sem_pending;
262 *(q->prev = &sma->sem_pending) = q;
263 if (q->next)
264 q->next->prev = &q->next;
265 else /* sma->sem_pending_last == &sma->sem_pending */
266 sma->sem_pending_last = &q->next;
267}
268
269static inline void remove_from_queue (struct sem_array * sma,
270 struct sem_queue * q)
271{
272 *(q->prev) = q->next;
273 if (q->next)
274 q->next->prev = q->prev;
275 else /* sma->sem_pending_last == &q->next */
276 sma->sem_pending_last = q->prev;
277 q->prev = NULL; /* mark as removed */
278}
279
280/*
281 * Determine whether a sequence of semaphore operations would succeed
282 * all at once. Return 0 if yes, 1 if need to sleep, else return error code.
283 */
284
285static int try_atomic_semop (struct sem_array * sma, struct sembuf * sops,
286 int nsops, struct sem_undo *un, int pid)
287{
288 int result, sem_op;
289 struct sembuf *sop;
290 struct sem * curr;
291
292 for (sop = sops; sop < sops + nsops; sop++) {
293 curr = sma->sem_base + sop->sem_num;
294 sem_op = sop->sem_op;
295 result = curr->semval;
296
297 if (!sem_op && result)
298 goto would_block;
299
300 result += sem_op;
301 if (result < 0)
302 goto would_block;
303 if (result > SEMVMX)
304 goto out_of_range;
305 if (sop->sem_flg & SEM_UNDO) {
306 int undo = un->semadj[sop->sem_num] - sem_op;
307 /*
308 * Exceeding the undo range is an error.
309 */
310 if (undo < (-SEMAEM - 1) || undo > SEMAEM)
311 goto out_of_range;
312 }
313 curr->semval = result;
314 }
315
316 sop--;
317 while (sop >= sops) {
318 sma->sem_base[sop->sem_num].sempid = pid;
319 if (sop->sem_flg & SEM_UNDO)
320 un->semadj[sop->sem_num] -= sop->sem_op;
321 sop--;
322 }
323
324 sma->sem_otime = get_seconds();
325 return 0;
326
327out_of_range:
328 result = -ERANGE;
329 goto undo;
330
331would_block:
332 if (sop->sem_flg & IPC_NOWAIT)
333 result = -EAGAIN;
334 else
335 result = 1;
336
337undo:
338 sop--;
339 while (sop >= sops) {
340 sma->sem_base[sop->sem_num].semval -= sop->sem_op;
341 sop--;
342 }
343
344 return result;
345}
346
347/* Go through the pending queue for the indicated semaphore
348 * looking for tasks that can be completed.
349 */
350static void update_queue (struct sem_array * sma)
351{
352 int error;
353 struct sem_queue * q;
354
355 q = sma->sem_pending;
356 while(q) {
357 error = try_atomic_semop(sma, q->sops, q->nsops,
358 q->undo, q->pid);
359
360 /* Does q->sleeper still need to sleep? */
361 if (error <= 0) {
362 struct sem_queue *n;
363 remove_from_queue(sma,q);
364 q->status = IN_WAKEUP;
365 /*
366 * Continue scanning. The next operation
367 * that must be checked depends on the type of the
368 * completed operation:
369 * - if the operation modified the array, then
370 * restart from the head of the queue and
371 * check for threads that might be waiting
372 * for semaphore values to become 0.
373 * - if the operation didn't modify the array,
374 * then just continue.
375 */
376 if (q->alter)
377 n = sma->sem_pending;
378 else
379 n = q->next;
380 wake_up_process(q->sleeper);
381 /* hands-off: q will disappear immediately after
382 * writing q->status.
383 */
Linus Torvalds1224b372005-12-24 12:19:38 -0800384 smp_wmb();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385 q->status = error;
386 q = n;
387 } else {
388 q = q->next;
389 }
390 }
391}
392
393/* The following counts are associated to each semaphore:
394 * semncnt number of tasks waiting on semval being nonzero
395 * semzcnt number of tasks waiting on semval being zero
396 * This model assumes that a task waits on exactly one semaphore.
397 * Since semaphore operations are to be performed atomically, tasks actually
398 * wait on a whole sequence of semaphores simultaneously.
399 * The counts we return here are a rough approximation, but still
400 * warrant that semncnt+semzcnt>0 if the task is on the pending queue.
401 */
402static int count_semncnt (struct sem_array * sma, ushort semnum)
403{
404 int semncnt;
405 struct sem_queue * q;
406
407 semncnt = 0;
408 for (q = sma->sem_pending; q; q = q->next) {
409 struct sembuf * sops = q->sops;
410 int nsops = q->nsops;
411 int i;
412 for (i = 0; i < nsops; i++)
413 if (sops[i].sem_num == semnum
414 && (sops[i].sem_op < 0)
415 && !(sops[i].sem_flg & IPC_NOWAIT))
416 semncnt++;
417 }
418 return semncnt;
419}
420static int count_semzcnt (struct sem_array * sma, ushort semnum)
421{
422 int semzcnt;
423 struct sem_queue * q;
424
425 semzcnt = 0;
426 for (q = sma->sem_pending; q; q = q->next) {
427 struct sembuf * sops = q->sops;
428 int nsops = q->nsops;
429 int i;
430 for (i = 0; i < nsops; i++)
431 if (sops[i].sem_num == semnum
432 && (sops[i].sem_op == 0)
433 && !(sops[i].sem_flg & IPC_NOWAIT))
434 semzcnt++;
435 }
436 return semzcnt;
437}
438
439/* Free a semaphore set. freeary() is called with sem_ids.sem down and
440 * the spinlock for this semaphore set hold. sem_ids.sem remains locked
441 * on exit.
442 */
443static void freeary (struct sem_array *sma, int id)
444{
445 struct sem_undo *un;
446 struct sem_queue *q;
447 int size;
448
449 /* Invalidate the existing undo structures for this semaphore set.
450 * (They will be freed without any further action in exit_sem()
451 * or during the next semop.)
452 */
453 for (un = sma->undo; un; un = un->id_next)
454 un->semid = -1;
455
456 /* Wake up all pending processes and let them fail with EIDRM. */
457 q = sma->sem_pending;
458 while(q) {
459 struct sem_queue *n;
460 /* lazy remove_from_queue: we are killing the whole queue */
461 q->prev = NULL;
462 n = q->next;
463 q->status = IN_WAKEUP;
464 wake_up_process(q->sleeper); /* doesn't sleep */
Manfred Spraul6003a932005-12-23 23:57:41 +0100465 smp_wmb();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700466 q->status = -EIDRM; /* hands-off q */
467 q = n;
468 }
469
470 /* Remove the semaphore set from the ID array*/
471 sma = sem_rmid(id);
472 sem_unlock(sma);
473
474 used_sems -= sma->sem_nsems;
475 size = sizeof (*sma) + sma->sem_nsems * sizeof (struct sem);
476 security_sem_free(sma);
477 ipc_rcu_putref(sma);
478}
479
480static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in, int version)
481{
482 switch(version) {
483 case IPC_64:
484 return copy_to_user(buf, in, sizeof(*in));
485 case IPC_OLD:
486 {
487 struct semid_ds out;
488
489 ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm);
490
491 out.sem_otime = in->sem_otime;
492 out.sem_ctime = in->sem_ctime;
493 out.sem_nsems = in->sem_nsems;
494
495 return copy_to_user(buf, &out, sizeof(out));
496 }
497 default:
498 return -EINVAL;
499 }
500}
501
502static int semctl_nolock(int semid, int semnum, int cmd, int version, union semun arg)
503{
504 int err = -EINVAL;
505 struct sem_array *sma;
506
507 switch(cmd) {
508 case IPC_INFO:
509 case SEM_INFO:
510 {
511 struct seminfo seminfo;
512 int max_id;
513
514 err = security_sem_semctl(NULL, cmd);
515 if (err)
516 return err;
517
518 memset(&seminfo,0,sizeof(seminfo));
519 seminfo.semmni = sc_semmni;
520 seminfo.semmns = sc_semmns;
521 seminfo.semmsl = sc_semmsl;
522 seminfo.semopm = sc_semopm;
523 seminfo.semvmx = SEMVMX;
524 seminfo.semmnu = SEMMNU;
525 seminfo.semmap = SEMMAP;
526 seminfo.semume = SEMUME;
527 down(&sem_ids.sem);
528 if (cmd == SEM_INFO) {
529 seminfo.semusz = sem_ids.in_use;
530 seminfo.semaem = used_sems;
531 } else {
532 seminfo.semusz = SEMUSZ;
533 seminfo.semaem = SEMAEM;
534 }
535 max_id = sem_ids.max_id;
536 up(&sem_ids.sem);
537 if (copy_to_user (arg.__buf, &seminfo, sizeof(struct seminfo)))
538 return -EFAULT;
539 return (max_id < 0) ? 0: max_id;
540 }
541 case SEM_STAT:
542 {
543 struct semid64_ds tbuf;
544 int id;
545
546 if(semid >= sem_ids.entries->size)
547 return -EINVAL;
548
549 memset(&tbuf,0,sizeof(tbuf));
550
551 sma = sem_lock(semid);
552 if(sma == NULL)
553 return -EINVAL;
554
555 err = -EACCES;
556 if (ipcperms (&sma->sem_perm, S_IRUGO))
557 goto out_unlock;
558
559 err = security_sem_semctl(sma, cmd);
560 if (err)
561 goto out_unlock;
562
563 id = sem_buildid(semid, sma->sem_perm.seq);
564
565 kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
566 tbuf.sem_otime = sma->sem_otime;
567 tbuf.sem_ctime = sma->sem_ctime;
568 tbuf.sem_nsems = sma->sem_nsems;
569 sem_unlock(sma);
570 if (copy_semid_to_user (arg.buf, &tbuf, version))
571 return -EFAULT;
572 return id;
573 }
574 default:
575 return -EINVAL;
576 }
577 return err;
578out_unlock:
579 sem_unlock(sma);
580 return err;
581}
582
583static int semctl_main(int semid, int semnum, int cmd, int version, union semun arg)
584{
585 struct sem_array *sma;
586 struct sem* curr;
587 int err;
588 ushort fast_sem_io[SEMMSL_FAST];
589 ushort* sem_io = fast_sem_io;
590 int nsems;
591
592 sma = sem_lock(semid);
593 if(sma==NULL)
594 return -EINVAL;
595
596 nsems = sma->sem_nsems;
597
598 err=-EIDRM;
599 if (sem_checkid(sma,semid))
600 goto out_unlock;
601
602 err = -EACCES;
603 if (ipcperms (&sma->sem_perm, (cmd==SETVAL||cmd==SETALL)?S_IWUGO:S_IRUGO))
604 goto out_unlock;
605
606 err = security_sem_semctl(sma, cmd);
607 if (err)
608 goto out_unlock;
609
610 err = -EACCES;
611 switch (cmd) {
612 case GETALL:
613 {
614 ushort __user *array = arg.array;
615 int i;
616
617 if(nsems > SEMMSL_FAST) {
618 ipc_rcu_getref(sma);
619 sem_unlock(sma);
620
621 sem_io = ipc_alloc(sizeof(ushort)*nsems);
622 if(sem_io == NULL) {
623 ipc_lock_by_ptr(&sma->sem_perm);
624 ipc_rcu_putref(sma);
625 sem_unlock(sma);
626 return -ENOMEM;
627 }
628
629 ipc_lock_by_ptr(&sma->sem_perm);
630 ipc_rcu_putref(sma);
631 if (sma->sem_perm.deleted) {
632 sem_unlock(sma);
633 err = -EIDRM;
634 goto out_free;
635 }
636 }
637
638 for (i = 0; i < sma->sem_nsems; i++)
639 sem_io[i] = sma->sem_base[i].semval;
640 sem_unlock(sma);
641 err = 0;
642 if(copy_to_user(array, sem_io, nsems*sizeof(ushort)))
643 err = -EFAULT;
644 goto out_free;
645 }
646 case SETALL:
647 {
648 int i;
649 struct sem_undo *un;
650
651 ipc_rcu_getref(sma);
652 sem_unlock(sma);
653
654 if(nsems > SEMMSL_FAST) {
655 sem_io = ipc_alloc(sizeof(ushort)*nsems);
656 if(sem_io == NULL) {
657 ipc_lock_by_ptr(&sma->sem_perm);
658 ipc_rcu_putref(sma);
659 sem_unlock(sma);
660 return -ENOMEM;
661 }
662 }
663
664 if (copy_from_user (sem_io, arg.array, nsems*sizeof(ushort))) {
665 ipc_lock_by_ptr(&sma->sem_perm);
666 ipc_rcu_putref(sma);
667 sem_unlock(sma);
668 err = -EFAULT;
669 goto out_free;
670 }
671
672 for (i = 0; i < nsems; i++) {
673 if (sem_io[i] > SEMVMX) {
674 ipc_lock_by_ptr(&sma->sem_perm);
675 ipc_rcu_putref(sma);
676 sem_unlock(sma);
677 err = -ERANGE;
678 goto out_free;
679 }
680 }
681 ipc_lock_by_ptr(&sma->sem_perm);
682 ipc_rcu_putref(sma);
683 if (sma->sem_perm.deleted) {
684 sem_unlock(sma);
685 err = -EIDRM;
686 goto out_free;
687 }
688
689 for (i = 0; i < nsems; i++)
690 sma->sem_base[i].semval = sem_io[i];
691 for (un = sma->undo; un; un = un->id_next)
692 for (i = 0; i < nsems; i++)
693 un->semadj[i] = 0;
694 sma->sem_ctime = get_seconds();
695 /* maybe some queued-up processes were waiting for this */
696 update_queue(sma);
697 err = 0;
698 goto out_unlock;
699 }
700 case IPC_STAT:
701 {
702 struct semid64_ds tbuf;
703 memset(&tbuf,0,sizeof(tbuf));
704 kernel_to_ipc64_perm(&sma->sem_perm, &tbuf.sem_perm);
705 tbuf.sem_otime = sma->sem_otime;
706 tbuf.sem_ctime = sma->sem_ctime;
707 tbuf.sem_nsems = sma->sem_nsems;
708 sem_unlock(sma);
709 if (copy_semid_to_user (arg.buf, &tbuf, version))
710 return -EFAULT;
711 return 0;
712 }
713 /* GETVAL, GETPID, GETNCTN, GETZCNT, SETVAL: fall-through */
714 }
715 err = -EINVAL;
716 if(semnum < 0 || semnum >= nsems)
717 goto out_unlock;
718
719 curr = &sma->sem_base[semnum];
720
721 switch (cmd) {
722 case GETVAL:
723 err = curr->semval;
724 goto out_unlock;
725 case GETPID:
726 err = curr->sempid;
727 goto out_unlock;
728 case GETNCNT:
729 err = count_semncnt(sma,semnum);
730 goto out_unlock;
731 case GETZCNT:
732 err = count_semzcnt(sma,semnum);
733 goto out_unlock;
734 case SETVAL:
735 {
736 int val = arg.val;
737 struct sem_undo *un;
738 err = -ERANGE;
739 if (val > SEMVMX || val < 0)
740 goto out_unlock;
741
742 for (un = sma->undo; un; un = un->id_next)
743 un->semadj[semnum] = 0;
744 curr->semval = val;
745 curr->sempid = current->tgid;
746 sma->sem_ctime = get_seconds();
747 /* maybe some queued-up processes were waiting for this */
748 update_queue(sma);
749 err = 0;
750 goto out_unlock;
751 }
752 }
753out_unlock:
754 sem_unlock(sma);
755out_free:
756 if(sem_io != fast_sem_io)
757 ipc_free(sem_io, sizeof(ushort)*nsems);
758 return err;
759}
760
761struct sem_setbuf {
762 uid_t uid;
763 gid_t gid;
764 mode_t mode;
765};
766
767static inline unsigned long copy_semid_from_user(struct sem_setbuf *out, void __user *buf, int version)
768{
769 switch(version) {
770 case IPC_64:
771 {
772 struct semid64_ds tbuf;
773
774 if(copy_from_user(&tbuf, buf, sizeof(tbuf)))
775 return -EFAULT;
776
777 out->uid = tbuf.sem_perm.uid;
778 out->gid = tbuf.sem_perm.gid;
779 out->mode = tbuf.sem_perm.mode;
780
781 return 0;
782 }
783 case IPC_OLD:
784 {
785 struct semid_ds tbuf_old;
786
787 if(copy_from_user(&tbuf_old, buf, sizeof(tbuf_old)))
788 return -EFAULT;
789
790 out->uid = tbuf_old.sem_perm.uid;
791 out->gid = tbuf_old.sem_perm.gid;
792 out->mode = tbuf_old.sem_perm.mode;
793
794 return 0;
795 }
796 default:
797 return -EINVAL;
798 }
799}
800
801static int semctl_down(int semid, int semnum, int cmd, int version, union semun arg)
802{
803 struct sem_array *sma;
804 int err;
805 struct sem_setbuf setbuf;
806 struct kern_ipc_perm *ipcp;
807
808 if(cmd == IPC_SET) {
809 if(copy_semid_from_user (&setbuf, arg.buf, version))
810 return -EFAULT;
811 if ((err = audit_ipc_perms(0, setbuf.uid, setbuf.gid, setbuf.mode)))
812 return err;
813 }
814 sma = sem_lock(semid);
815 if(sma==NULL)
816 return -EINVAL;
817
818 if (sem_checkid(sma,semid)) {
819 err=-EIDRM;
820 goto out_unlock;
821 }
822 ipcp = &sma->sem_perm;
823
824 if (current->euid != ipcp->cuid &&
825 current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN)) {
826 err=-EPERM;
827 goto out_unlock;
828 }
829
830 err = security_sem_semctl(sma, cmd);
831 if (err)
832 goto out_unlock;
833
834 switch(cmd){
835 case IPC_RMID:
836 freeary(sma, semid);
837 err = 0;
838 break;
839 case IPC_SET:
840 ipcp->uid = setbuf.uid;
841 ipcp->gid = setbuf.gid;
842 ipcp->mode = (ipcp->mode & ~S_IRWXUGO)
843 | (setbuf.mode & S_IRWXUGO);
844 sma->sem_ctime = get_seconds();
845 sem_unlock(sma);
846 err = 0;
847 break;
848 default:
849 sem_unlock(sma);
850 err = -EINVAL;
851 break;
852 }
853 return err;
854
855out_unlock:
856 sem_unlock(sma);
857 return err;
858}
859
860asmlinkage long sys_semctl (int semid, int semnum, int cmd, union semun arg)
861{
862 int err = -EINVAL;
863 int version;
864
865 if (semid < 0)
866 return -EINVAL;
867
868 version = ipc_parse_version(&cmd);
869
870 switch(cmd) {
871 case IPC_INFO:
872 case SEM_INFO:
873 case SEM_STAT:
874 err = semctl_nolock(semid,semnum,cmd,version,arg);
875 return err;
876 case GETALL:
877 case GETVAL:
878 case GETPID:
879 case GETNCNT:
880 case GETZCNT:
881 case IPC_STAT:
882 case SETVAL:
883 case SETALL:
884 err = semctl_main(semid,semnum,cmd,version,arg);
885 return err;
886 case IPC_RMID:
887 case IPC_SET:
888 down(&sem_ids.sem);
889 err = semctl_down(semid,semnum,cmd,version,arg);
890 up(&sem_ids.sem);
891 return err;
892 default:
893 return -EINVAL;
894 }
895}
896
897static inline void lock_semundo(void)
898{
899 struct sem_undo_list *undo_list;
900
901 undo_list = current->sysvsem.undo_list;
Ingo Molnar00a5dfd2005-08-05 23:05:27 +0200902 if (undo_list)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700903 spin_lock(&undo_list->lock);
904}
905
906/* This code has an interaction with copy_semundo().
907 * Consider; two tasks are sharing the undo_list. task1
908 * acquires the undo_list lock in lock_semundo(). If task2 now
909 * exits before task1 releases the lock (by calling
910 * unlock_semundo()), then task1 will never call spin_unlock().
911 * This leave the sem_undo_list in a locked state. If task1 now creats task3
912 * and once again shares the sem_undo_list, the sem_undo_list will still be
913 * locked, and future SEM_UNDO operations will deadlock. This case is
914 * dealt with in copy_semundo() by having it reinitialize the spin lock when
915 * the refcnt goes from 1 to 2.
916 */
917static inline void unlock_semundo(void)
918{
919 struct sem_undo_list *undo_list;
920
921 undo_list = current->sysvsem.undo_list;
Ingo Molnar00a5dfd2005-08-05 23:05:27 +0200922 if (undo_list)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700923 spin_unlock(&undo_list->lock);
924}
925
926
927/* If the task doesn't already have a undo_list, then allocate one
928 * here. We guarantee there is only one thread using this undo list,
929 * and current is THE ONE
930 *
931 * If this allocation and assignment succeeds, but later
932 * portions of this code fail, there is no need to free the sem_undo_list.
933 * Just let it stay associated with the task, and it'll be freed later
934 * at exit time.
935 *
936 * This can block, so callers must hold no locks.
937 */
938static inline int get_undo_list(struct sem_undo_list **undo_listp)
939{
940 struct sem_undo_list *undo_list;
941 int size;
942
943 undo_list = current->sysvsem.undo_list;
944 if (!undo_list) {
945 size = sizeof(struct sem_undo_list);
946 undo_list = (struct sem_undo_list *) kmalloc(size, GFP_KERNEL);
947 if (undo_list == NULL)
948 return -ENOMEM;
949 memset(undo_list, 0, size);
Ingo Molnar00a5dfd2005-08-05 23:05:27 +0200950 spin_lock_init(&undo_list->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700951 atomic_set(&undo_list->refcnt, 1);
952 current->sysvsem.undo_list = undo_list;
953 }
954 *undo_listp = undo_list;
955 return 0;
956}
957
958static struct sem_undo *lookup_undo(struct sem_undo_list *ulp, int semid)
959{
960 struct sem_undo **last, *un;
961
962 last = &ulp->proc_list;
963 un = *last;
964 while(un != NULL) {
965 if(un->semid==semid)
966 break;
967 if(un->semid==-1) {
968 *last=un->proc_next;
969 kfree(un);
970 } else {
971 last=&un->proc_next;
972 }
973 un=*last;
974 }
975 return un;
976}
977
978static struct sem_undo *find_undo(int semid)
979{
980 struct sem_array *sma;
981 struct sem_undo_list *ulp;
982 struct sem_undo *un, *new;
983 int nsems;
984 int error;
985
986 error = get_undo_list(&ulp);
987 if (error)
988 return ERR_PTR(error);
989
990 lock_semundo();
991 un = lookup_undo(ulp, semid);
992 unlock_semundo();
993 if (likely(un!=NULL))
994 goto out;
995
996 /* no undo structure around - allocate one. */
997 sma = sem_lock(semid);
998 un = ERR_PTR(-EINVAL);
999 if(sma==NULL)
1000 goto out;
1001 un = ERR_PTR(-EIDRM);
1002 if (sem_checkid(sma,semid)) {
1003 sem_unlock(sma);
1004 goto out;
1005 }
1006 nsems = sma->sem_nsems;
1007 ipc_rcu_getref(sma);
1008 sem_unlock(sma);
1009
1010 new = (struct sem_undo *) kmalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
1011 if (!new) {
1012 ipc_lock_by_ptr(&sma->sem_perm);
1013 ipc_rcu_putref(sma);
1014 sem_unlock(sma);
1015 return ERR_PTR(-ENOMEM);
1016 }
1017 memset(new, 0, sizeof(struct sem_undo) + sizeof(short)*nsems);
1018 new->semadj = (short *) &new[1];
1019 new->semid = semid;
1020
1021 lock_semundo();
1022 un = lookup_undo(ulp, semid);
1023 if (un) {
1024 unlock_semundo();
1025 kfree(new);
1026 ipc_lock_by_ptr(&sma->sem_perm);
1027 ipc_rcu_putref(sma);
1028 sem_unlock(sma);
1029 goto out;
1030 }
1031 ipc_lock_by_ptr(&sma->sem_perm);
1032 ipc_rcu_putref(sma);
1033 if (sma->sem_perm.deleted) {
1034 sem_unlock(sma);
1035 unlock_semundo();
1036 kfree(new);
1037 un = ERR_PTR(-EIDRM);
1038 goto out;
1039 }
1040 new->proc_next = ulp->proc_list;
1041 ulp->proc_list = new;
1042 new->id_next = sma->undo;
1043 sma->undo = new;
1044 sem_unlock(sma);
1045 un = new;
1046 unlock_semundo();
1047out:
1048 return un;
1049}
1050
1051asmlinkage long sys_semtimedop(int semid, struct sembuf __user *tsops,
1052 unsigned nsops, const struct timespec __user *timeout)
1053{
1054 int error = -EINVAL;
1055 struct sem_array *sma;
1056 struct sembuf fast_sops[SEMOPM_FAST];
1057 struct sembuf* sops = fast_sops, *sop;
1058 struct sem_undo *un;
Manfred Spraulb78755a2005-06-23 00:10:06 -07001059 int undos = 0, alter = 0, max;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001060 struct sem_queue queue;
1061 unsigned long jiffies_left = 0;
1062
1063 if (nsops < 1 || semid < 0)
1064 return -EINVAL;
1065 if (nsops > sc_semopm)
1066 return -E2BIG;
1067 if(nsops > SEMOPM_FAST) {
1068 sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL);
1069 if(sops==NULL)
1070 return -ENOMEM;
1071 }
1072 if (copy_from_user (sops, tsops, nsops * sizeof(*tsops))) {
1073 error=-EFAULT;
1074 goto out_free;
1075 }
1076 if (timeout) {
1077 struct timespec _timeout;
1078 if (copy_from_user(&_timeout, timeout, sizeof(*timeout))) {
1079 error = -EFAULT;
1080 goto out_free;
1081 }
1082 if (_timeout.tv_sec < 0 || _timeout.tv_nsec < 0 ||
1083 _timeout.tv_nsec >= 1000000000L) {
1084 error = -EINVAL;
1085 goto out_free;
1086 }
1087 jiffies_left = timespec_to_jiffies(&_timeout);
1088 }
1089 max = 0;
1090 for (sop = sops; sop < sops + nsops; sop++) {
1091 if (sop->sem_num >= max)
1092 max = sop->sem_num;
1093 if (sop->sem_flg & SEM_UNDO)
Manfred Spraulb78755a2005-06-23 00:10:06 -07001094 undos = 1;
1095 if (sop->sem_op != 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001096 alter = 1;
1097 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001098
1099retry_undos:
1100 if (undos) {
1101 un = find_undo(semid);
1102 if (IS_ERR(un)) {
1103 error = PTR_ERR(un);
1104 goto out_free;
1105 }
1106 } else
1107 un = NULL;
1108
1109 sma = sem_lock(semid);
1110 error=-EINVAL;
1111 if(sma==NULL)
1112 goto out_free;
1113 error = -EIDRM;
1114 if (sem_checkid(sma,semid))
1115 goto out_unlock_free;
1116 /*
1117 * semid identifies are not unique - find_undo may have
1118 * allocated an undo structure, it was invalidated by an RMID
1119 * and now a new array with received the same id. Check and retry.
1120 */
1121 if (un && un->semid == -1) {
1122 sem_unlock(sma);
1123 goto retry_undos;
1124 }
1125 error = -EFBIG;
1126 if (max >= sma->sem_nsems)
1127 goto out_unlock_free;
1128
1129 error = -EACCES;
1130 if (ipcperms(&sma->sem_perm, alter ? S_IWUGO : S_IRUGO))
1131 goto out_unlock_free;
1132
1133 error = security_sem_semop(sma, sops, nsops, alter);
1134 if (error)
1135 goto out_unlock_free;
1136
1137 error = try_atomic_semop (sma, sops, nsops, un, current->tgid);
1138 if (error <= 0) {
1139 if (alter && error == 0)
1140 update_queue (sma);
1141 goto out_unlock_free;
1142 }
1143
1144 /* We need to sleep on this operation, so we put the current
1145 * task into the pending queue and go to sleep.
1146 */
1147
1148 queue.sma = sma;
1149 queue.sops = sops;
1150 queue.nsops = nsops;
1151 queue.undo = un;
1152 queue.pid = current->tgid;
1153 queue.id = semid;
1154 queue.alter = alter;
1155 if (alter)
1156 append_to_queue(sma ,&queue);
1157 else
1158 prepend_to_queue(sma ,&queue);
1159
1160 queue.status = -EINTR;
1161 queue.sleeper = current;
1162 current->state = TASK_INTERRUPTIBLE;
1163 sem_unlock(sma);
1164
1165 if (timeout)
1166 jiffies_left = schedule_timeout(jiffies_left);
1167 else
1168 schedule();
1169
1170 error = queue.status;
1171 while(unlikely(error == IN_WAKEUP)) {
1172 cpu_relax();
1173 error = queue.status;
1174 }
1175
1176 if (error != -EINTR) {
1177 /* fast path: update_queue already obtained all requested
1178 * resources */
1179 goto out_free;
1180 }
1181
1182 sma = sem_lock(semid);
1183 if(sma==NULL) {
1184 if(queue.prev != NULL)
1185 BUG();
1186 error = -EIDRM;
1187 goto out_free;
1188 }
1189
1190 /*
1191 * If queue.status != -EINTR we are woken up by another process
1192 */
1193 error = queue.status;
1194 if (error != -EINTR) {
1195 goto out_unlock_free;
1196 }
1197
1198 /*
1199 * If an interrupt occurred we have to clean up the queue
1200 */
1201 if (timeout && jiffies_left == 0)
1202 error = -EAGAIN;
1203 remove_from_queue(sma,&queue);
1204 goto out_unlock_free;
1205
1206out_unlock_free:
1207 sem_unlock(sma);
1208out_free:
1209 if(sops != fast_sops)
1210 kfree(sops);
1211 return error;
1212}
1213
1214asmlinkage long sys_semop (int semid, struct sembuf __user *tsops, unsigned nsops)
1215{
1216 return sys_semtimedop(semid, tsops, nsops, NULL);
1217}
1218
1219/* If CLONE_SYSVSEM is set, establish sharing of SEM_UNDO state between
1220 * parent and child tasks.
1221 *
1222 * See the notes above unlock_semundo() regarding the spin_lock_init()
1223 * in this code. Initialize the undo_list->lock here instead of get_undo_list()
1224 * because of the reasoning in the comment above unlock_semundo.
1225 */
1226
1227int copy_semundo(unsigned long clone_flags, struct task_struct *tsk)
1228{
1229 struct sem_undo_list *undo_list;
1230 int error;
1231
1232 if (clone_flags & CLONE_SYSVSEM) {
1233 error = get_undo_list(&undo_list);
1234 if (error)
1235 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001236 atomic_inc(&undo_list->refcnt);
1237 tsk->sysvsem.undo_list = undo_list;
1238 } else
1239 tsk->sysvsem.undo_list = NULL;
1240
1241 return 0;
1242}
1243
1244/*
1245 * add semadj values to semaphores, free undo structures.
1246 * undo structures are not freed when semaphore arrays are destroyed
1247 * so some of them may be out of date.
1248 * IMPLEMENTATION NOTE: There is some confusion over whether the
1249 * set of adjustments that needs to be done should be done in an atomic
1250 * manner or not. That is, if we are attempting to decrement the semval
1251 * should we queue up and wait until we can do so legally?
1252 * The original implementation attempted to do this (queue and wait).
1253 * The current implementation does not do so. The POSIX standard
1254 * and SVID should be consulted to determine what behavior is mandated.
1255 */
1256void exit_sem(struct task_struct *tsk)
1257{
1258 struct sem_undo_list *undo_list;
1259 struct sem_undo *u, **up;
1260
1261 undo_list = tsk->sysvsem.undo_list;
1262 if (!undo_list)
1263 return;
1264
1265 if (!atomic_dec_and_test(&undo_list->refcnt))
1266 return;
1267
1268 /* There's no need to hold the semundo list lock, as current
1269 * is the last task exiting for this undo list.
1270 */
1271 for (up = &undo_list->proc_list; (u = *up); *up = u->proc_next, kfree(u)) {
1272 struct sem_array *sma;
1273 int nsems, i;
1274 struct sem_undo *un, **unp;
1275 int semid;
1276
1277 semid = u->semid;
1278
1279 if(semid == -1)
1280 continue;
1281 sma = sem_lock(semid);
1282 if (sma == NULL)
1283 continue;
1284
1285 if (u->semid == -1)
1286 goto next_entry;
1287
1288 BUG_ON(sem_checkid(sma,u->semid));
1289
1290 /* remove u from the sma->undo list */
1291 for (unp = &sma->undo; (un = *unp); unp = &un->id_next) {
1292 if (u == un)
1293 goto found;
1294 }
1295 printk ("exit_sem undo list error id=%d\n", u->semid);
1296 goto next_entry;
1297found:
1298 *unp = un->id_next;
1299 /* perform adjustments registered in u */
1300 nsems = sma->sem_nsems;
1301 for (i = 0; i < nsems; i++) {
1302 struct sem * sem = &sma->sem_base[i];
1303 if (u->semadj[i]) {
1304 sem->semval += u->semadj[i];
1305 /*
1306 * Range checks of the new semaphore value,
1307 * not defined by sus:
1308 * - Some unices ignore the undo entirely
1309 * (e.g. HP UX 11i 11.22, Tru64 V5.1)
1310 * - some cap the value (e.g. FreeBSD caps
1311 * at 0, but doesn't enforce SEMVMX)
1312 *
1313 * Linux caps the semaphore value, both at 0
1314 * and at SEMVMX.
1315 *
1316 * Manfred <manfred@colorfullife.com>
1317 */
1318 if (sem->semval < 0)
1319 sem->semval = 0;
1320 if (sem->semval > SEMVMX)
1321 sem->semval = SEMVMX;
1322 sem->sempid = current->tgid;
1323 }
1324 }
1325 sma->sem_otime = get_seconds();
1326 /* maybe some queued-up processes were waiting for this */
1327 update_queue(sma);
1328next_entry:
1329 sem_unlock(sma);
1330 }
1331 kfree(undo_list);
1332}
1333
1334#ifdef CONFIG_PROC_FS
Mike Waychison19b49462005-09-06 15:17:10 -07001335static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001336{
Mike Waychison19b49462005-09-06 15:17:10 -07001337 struct sem_array *sma = it;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001338
Mike Waychison19b49462005-09-06 15:17:10 -07001339 return seq_printf(s,
1340 "%10d %10d %4o %10lu %5u %5u %5u %5u %10lu %10lu\n",
1341 sma->sem_perm.key,
1342 sma->sem_id,
1343 sma->sem_perm.mode,
1344 sma->sem_nsems,
1345 sma->sem_perm.uid,
1346 sma->sem_perm.gid,
1347 sma->sem_perm.cuid,
1348 sma->sem_perm.cgid,
1349 sma->sem_otime,
1350 sma->sem_ctime);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001351}
1352#endif