Home | History | Annotate | Line # | Download | only in kern
uipc_sem.c revision 1.20
      1 /*	$NetBSD: uipc_sem.c,v 1.20 2007/02/09 21:55:32 ad Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2003 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Jason R. Thorpe of Wasabi Systems, Inc.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *        This product includes software developed by the NetBSD
     21  *        Foundation, Inc. and its contributors.
     22  * 4. Neither the name of The NetBSD Foundation nor the names of its
     23  *    contributors may be used to endorse or promote products derived
     24  *    from this software without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     28  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     29  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     30  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     31  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     34  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     36  * POSSIBILITY OF SUCH DAMAGE.
     37  */
     38 
     39 /*
     40  * Copyright (c) 2002 Alfred Perlstein <alfred (at) FreeBSD.org>
     41  * All rights reserved.
     42  *
     43  * Redistribution and use in source and binary forms, with or without
     44  * modification, are permitted provided that the following conditions
     45  * are met:
     46  * 1. Redistributions of source code must retain the above copyright
     47  *    notice, this list of conditions and the following disclaimer.
     48  * 2. Redistributions in binary form must reproduce the above copyright
     49  *    notice, this list of conditions and the following disclaimer in the
     50  *    documentation and/or other materials provided with the distribution.
     51  *
     52  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     62  * SUCH DAMAGE.
     63  */
     64 
     65 #include <sys/cdefs.h>
     66 __KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v 1.20 2007/02/09 21:55:32 ad Exp $");
     67 
     68 #include "opt_posix.h"
     69 
     70 #include <sys/param.h>
     71 #include <sys/systm.h>
     72 #include <sys/kernel.h>
     73 #include <sys/proc.h>
     74 #include <sys/lock.h>
     75 #include <sys/ksem.h>
     76 #include <sys/syscall.h>
     77 #include <sys/stat.h>
     78 #include <sys/malloc.h>
     79 #include <sys/fcntl.h>
     80 #include <sys/kauth.h>
     81 
     82 #include <sys/mount.h>
     83 
     84 #include <sys/syscallargs.h>
     85 
     86 #ifndef SEM_MAX
     87 #define SEM_MAX	30
     88 #endif
     89 
     90 #define SEM_MAX_NAMELEN	14
     91 #define SEM_VALUE_MAX (~0U)
     92 #define SEM_HASHTBL_SIZE 13
     93 
     94 #define SEM_TO_ID(x)	(((x)->ks_id))
     95 #define SEM_HASH(id)	((id) % SEM_HASHTBL_SIZE)
     96 
     97 MALLOC_DEFINE(M_SEM, "p1003_1b_sem", "p1003_1b semaphores");
     98 
     99 /*
    100  * Note: to read the ks_name member, you need either the ks_interlock
    101  * or the ksem_slock.  To write the ks_name member, you need both.  Make
    102  * sure the order is ksem_slock -> ks_interlock.
    103  */
    104 struct ksem {
    105 	LIST_ENTRY(ksem) ks_entry;	/* global list entry */
    106 	LIST_ENTRY(ksem) ks_hash;	/* hash list entry */
    107 	kmutex_t ks_interlock;		/* lock on this ksem */
    108 	kcondvar_t ks_cv;		/* condition variable */
    109 	char *ks_name;			/* if named, this is the name */
    110 	unsigned int ks_ref;		/* number of references */
    111 	mode_t ks_mode;			/* protection bits */
    112 	uid_t ks_uid;			/* creator uid */
    113 	gid_t ks_gid;			/* creator gid */
    114 	unsigned int ks_value;		/* current value */
    115 	unsigned int ks_waiters;	/* number of waiters */
    116 	semid_t ks_id;			/* unique identifier */
    117 };
    118 
    119 struct ksem_ref {
    120 	LIST_ENTRY(ksem_ref) ksr_list;
    121 	struct ksem *ksr_ksem;
    122 };
    123 
    124 struct ksem_proc {
    125 	krwlock_t kp_lock;
    126 	LIST_HEAD(, ksem_ref) kp_ksems;
    127 };
    128 
    129 LIST_HEAD(ksem_list, ksem);
    130 
    131 /*
    132  * ksem_slock protects ksem_head and nsems.  Only named semaphores go
    133  * onto ksem_head.
    134  */
    135 static kmutex_t ksem_mutex;
    136 static struct ksem_list ksem_head = LIST_HEAD_INITIALIZER(&ksem_head);
    137 static struct ksem_list ksem_hash[SEM_HASHTBL_SIZE];
    138 static int nsems = 0;
    139 
    140 /*
    141  * ksem_counter is the last assigned semid_t.  It needs to be COMPAT_NETBSD32
    142  * friendly, even though semid_t itself is defined as uintptr_t.
    143  */
    144 static uint32_t ksem_counter = 1;
    145 
    146 static specificdata_key_t ksem_specificdata_key;
    147 
    148 static void
    149 ksem_free(struct ksem *ks)
    150 {
    151 
    152 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    153 
    154 	/*
    155 	 * If the ksem is anonymous (or has been unlinked), then
    156 	 * this is the end if its life.
    157 	 */
    158 	if (ks->ks_name == NULL) {
    159 		mutex_exit(&ks->ks_interlock);
    160 		mutex_destroy(&ks->ks_interlock);
    161 		cv_destroy(&ks->ks_cv);
    162 
    163 		mutex_enter(&ksem_mutex);
    164 		nsems--;
    165 		LIST_REMOVE(ks, ks_hash);
    166 		mutex_exit(&ksem_mutex);
    167 
    168 		free(ks, M_SEM);
    169 		return;
    170 	}
    171 	mutex_exit(&ks->ks_interlock);
    172 }
    173 
    174 static inline void
    175 ksem_addref(struct ksem *ks)
    176 {
    177 
    178 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    179 	ks->ks_ref++;
    180 	KASSERT(ks->ks_ref != 0);	/* XXX KDASSERT */
    181 }
    182 
    183 static inline void
    184 ksem_delref(struct ksem *ks)
    185 {
    186 
    187 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    188 	KASSERT(ks->ks_ref != 0);	/* XXX KDASSERT */
    189 	if (--ks->ks_ref == 0) {
    190 		ksem_free(ks);
    191 		return;
    192 	}
    193 	mutex_exit(&ks->ks_interlock);
    194 }
    195 
    196 static struct ksem_proc *
    197 ksem_proc_alloc(void)
    198 {
    199 	struct ksem_proc *kp;
    200 
    201 	kp = malloc(sizeof(*kp), M_SEM, M_WAITOK);
    202 	rw_init(&kp->kp_lock);
    203 	LIST_INIT(&kp->kp_ksems);
    204 
    205 	return (kp);
    206 }
    207 
    208 static void
    209 ksem_proc_dtor(void *arg)
    210 {
    211 	struct ksem_proc *kp = arg;
    212 	struct ksem_ref *ksr;
    213 
    214 	rw_enter(&kp->kp_lock, RW_WRITER);
    215 
    216 	while ((ksr = LIST_FIRST(&kp->kp_ksems)) != NULL) {
    217 		LIST_REMOVE(ksr, ksr_list);
    218 		mutex_enter(&ksr->ksr_ksem->ks_interlock);
    219 		ksem_delref(ksr->ksr_ksem);
    220 		mutex_exit(&ksr->ksr_ksem->ks_interlock);
    221 		free(ksr, M_SEM);
    222 	}
    223 
    224 	rw_exit(&kp->kp_lock);
    225 	rw_destroy(&kp->kp_lock);
    226 	free(kp, M_SEM);
    227 }
    228 
    229 static void
    230 ksem_add_proc(struct proc *p, struct ksem *ks)
    231 {
    232 	struct ksem_proc *kp;
    233 	struct ksem_ref *ksr;
    234 
    235 	kp = proc_getspecific(p, ksem_specificdata_key);
    236 	if (kp == NULL) {
    237 		kp = ksem_proc_alloc();
    238 		proc_setspecific(p, ksem_specificdata_key, kp);
    239 	}
    240 
    241 	ksr = malloc(sizeof(*ksr), M_SEM, M_WAITOK);
    242 	ksr->ksr_ksem = ks;
    243 
    244 	rw_enter(&kp->kp_lock, RW_WRITER);
    245 	LIST_INSERT_HEAD(&kp->kp_ksems, ksr, ksr_list);
    246 	rw_exit(&kp->kp_lock);
    247 }
    248 
    249 /* We MUST have a write lock on the ksem_proc list! */
    250 static struct ksem_ref *
    251 ksem_drop_proc(struct ksem_proc *kp, struct ksem *ks)
    252 {
    253 	struct ksem_ref *ksr;
    254 
    255 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    256 	LIST_FOREACH(ksr, &kp->kp_ksems, ksr_list) {
    257 		if (ksr->ksr_ksem == ks) {
    258 			ksem_delref(ks);
    259 			LIST_REMOVE(ksr, ksr_list);
    260 			return (ksr);
    261 		}
    262 	}
    263 #ifdef DIAGNOSTIC
    264 	panic("ksem_drop_proc: ksem_proc %p ksem %p", kp, ks);
    265 #endif
    266 	return (NULL);
    267 }
    268 
    269 static int
    270 ksem_perm(struct lwp *l, struct ksem *ks)
    271 {
    272 	kauth_cred_t uc;
    273 
    274 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    275 	uc = l->l_cred;
    276 	if ((kauth_cred_geteuid(uc) == ks->ks_uid && (ks->ks_mode & S_IWUSR) != 0) ||
    277 	    (kauth_cred_getegid(uc) == ks->ks_gid && (ks->ks_mode & S_IWGRP) != 0) ||
    278 	    (ks->ks_mode & S_IWOTH) != 0 ||
    279 	    kauth_authorize_generic(uc, KAUTH_GENERIC_ISSUSER, NULL) == 0)
    280 		return (0);
    281 	return (EPERM);
    282 }
    283 
    284 static struct ksem *
    285 ksem_lookup_byid(semid_t id)
    286 {
    287 	struct ksem *ks;
    288 
    289 	LOCK_ASSERT(mutex_owned(&ksem_mutex));
    290 	LIST_FOREACH(ks, &ksem_hash[SEM_HASH(id)], ks_hash) {
    291 		if (ks->ks_id == id)
    292 			return ks;
    293 	}
    294 	return NULL;
    295 }
    296 
    297 static struct ksem *
    298 ksem_lookup_byname(const char *name)
    299 {
    300 	struct ksem *ks;
    301 
    302 	LOCK_ASSERT(mutex_owned(&ksem_mutex));
    303 	LIST_FOREACH(ks, &ksem_head, ks_entry) {
    304 		if (strcmp(ks->ks_name, name) == 0) {
    305 			mutex_enter(&ks->ks_interlock);
    306 			return (ks);
    307 		}
    308 	}
    309 	return (NULL);
    310 }
    311 
    312 static int
    313 ksem_create(struct lwp *l, const char *name, struct ksem **ksret,
    314     mode_t mode, unsigned int value)
    315 {
    316 	struct ksem *ret;
    317 	kauth_cred_t uc;
    318 	size_t len;
    319 
    320 	uc = l->l_cred;
    321 	if (value > SEM_VALUE_MAX)
    322 		return (EINVAL);
    323 	ret = malloc(sizeof(*ret), M_SEM, M_WAITOK | M_ZERO);
    324 	if (name != NULL) {
    325 		len = strlen(name);
    326 		if (len > SEM_MAX_NAMELEN) {
    327 			free(ret, M_SEM);
    328 			return (ENAMETOOLONG);
    329 		}
    330 		/* name must start with a '/' but not contain one. */
    331 		if (*name != '/' || len < 2 || strchr(name + 1, '/') != NULL) {
    332 			free(ret, M_SEM);
    333 			return (EINVAL);
    334 		}
    335 		ret->ks_name = malloc(len + 1, M_SEM, M_WAITOK);
    336 		strlcpy(ret->ks_name, name, len + 1);
    337 	} else
    338 		ret->ks_name = NULL;
    339 	ret->ks_mode = mode;
    340 	ret->ks_value = value;
    341 	ret->ks_ref = 1;
    342 	ret->ks_waiters = 0;
    343 	ret->ks_uid = kauth_cred_geteuid(uc);
    344 	ret->ks_gid = kauth_cred_getegid(uc);
    345 	mutex_init(&ret->ks_interlock, MUTEX_DEFAULT, IPL_NONE);
    346 	cv_init(&ret->ks_cv, "psem");
    347 
    348 	mutex_enter(&ksem_mutex);
    349 	if (nsems >= SEM_MAX) {
    350 		mutex_exit(&ksem_mutex);
    351 		if (ret->ks_name != NULL)
    352 			free(ret->ks_name, M_SEM);
    353 		free(ret, M_SEM);
    354 		return (ENFILE);
    355 	}
    356 	nsems++;
    357 	while (ksem_lookup_byid(ksem_counter) != NULL) {
    358 		ksem_counter++;
    359 		/* 0 is a special value for libpthread */
    360 		if (ksem_counter == 0)
    361 			ksem_counter++;
    362 	}
    363 	ret->ks_id = ksem_counter;
    364 	LIST_INSERT_HEAD(&ksem_hash[SEM_HASH(ret->ks_id)], ret, ks_hash);
    365 	mutex_exit(&ksem_mutex);
    366 
    367 	*ksret = ret;
    368 	return (0);
    369 }
    370 
    371 int
    372 sys__ksem_init(struct lwp *l, void *v, register_t *retval)
    373 {
    374 	struct sys__ksem_init_args /* {
    375 		unsigned int value;
    376 		semid_t *idp;
    377 	} */ *uap = v;
    378 
    379 	return do_ksem_init(l, SCARG(uap, value), SCARG(uap, idp), copyout);
    380 }
    381 
    382 int
    383 do_ksem_init(struct lwp *l, unsigned int value, semid_t *idp,
    384     copyout_t docopyout)
    385 {
    386 	struct ksem *ks;
    387 	semid_t id;
    388 	int error;
    389 
    390 	/* Note the mode does not matter for anonymous semaphores. */
    391 	error = ksem_create(l, NULL, &ks, 0, value);
    392 	if (error)
    393 		return (error);
    394 	id = SEM_TO_ID(ks);
    395 	error = (*docopyout)(&id, idp, sizeof(id));
    396 	if (error) {
    397 		mutex_enter(&ks->ks_interlock);
    398 		ksem_delref(ks);
    399 		return (error);
    400 	}
    401 
    402 	ksem_add_proc(l->l_proc, ks);
    403 
    404 	return (0);
    405 }
    406 
    407 int
    408 sys__ksem_open(struct lwp *l, void *v, register_t *retval)
    409 {
    410 	struct sys__ksem_open_args /* {
    411 		const char *name;
    412 		int oflag;
    413 		mode_t mode;
    414 		unsigned int value;
    415 		semid_t *idp;
    416 	} */ *uap = v;
    417 
    418 	return do_ksem_open(l, SCARG(uap, name), SCARG(uap, oflag),
    419 	    SCARG(uap, mode), SCARG(uap, value), SCARG(uap, idp), copyout);
    420 }
    421 
    422 int
    423 do_ksem_open(struct lwp *l, const char *semname, int oflag, mode_t mode,
    424      unsigned int value, semid_t *idp, copyout_t docopyout)
    425 {
    426 	char name[SEM_MAX_NAMELEN + 1];
    427 	size_t done;
    428 	int error;
    429 	struct ksem *ksnew, *ks;
    430 	semid_t id;
    431 
    432 	error = copyinstr(semname, name, sizeof(name), &done);
    433 	if (error)
    434 		return (error);
    435 
    436 	ksnew = NULL;
    437 	mutex_enter(&ksem_mutex);
    438 	ks = ksem_lookup_byname(name);
    439 
    440 	/* Found one? */
    441 	if (ks != NULL) {
    442 		/* Check for exclusive create. */
    443 		if (oflag & O_EXCL) {
    444 			mutex_exit(&ks->ks_interlock);
    445 			mutex_exit(&ksem_mutex);
    446 			return (EEXIST);
    447 		}
    448  found_one:
    449 		/*
    450 		 * Verify permissions.  If we can access it, add
    451 		 * this process's reference.
    452 		 */
    453 		LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    454 		error = ksem_perm(l, ks);
    455 		if (error == 0)
    456 			ksem_addref(ks);
    457 		mutex_exit(&ks->ks_interlock);
    458 		mutex_exit(&ksem_mutex);
    459 		if (error)
    460 			return (error);
    461 
    462 		id = SEM_TO_ID(ks);
    463 		error = (*docopyout)(&id, idp, sizeof(id));
    464 		if (error) {
    465 			mutex_enter(&ks->ks_interlock);
    466 			ksem_delref(ks);
    467 			return (error);
    468 		}
    469 
    470 		ksem_add_proc(l->l_proc, ks);
    471 
    472 		return (0);
    473 	}
    474 
    475 	/*
    476 	 * didn't ask for creation? error.
    477 	 */
    478 	if ((oflag & O_CREAT) == 0) {
    479 		mutex_exit(&ksem_mutex);
    480 		return (ENOENT);
    481 	}
    482 
    483 	/*
    484 	 * We may block during creation, so drop the lock.
    485 	 */
    486 	mutex_exit(&ksem_mutex);
    487 	error = ksem_create(l, name, &ksnew, mode, value);
    488 	if (error != 0)
    489 		return (error);
    490 
    491 	id = SEM_TO_ID(ksnew);
    492 	error = (*docopyout)(&id, idp, sizeof(id));
    493 	if (error) {
    494 		free(ksnew->ks_name, M_SEM);
    495 		ksnew->ks_name = NULL;
    496 
    497 		mutex_enter(&ksnew->ks_interlock);
    498 		ksem_delref(ksnew);
    499 		return (error);
    500 	}
    501 
    502 	/*
    503 	 * We need to make sure we haven't lost a race while
    504 	 * allocating during creation.
    505 	 */
    506 	mutex_enter(&ksem_mutex);
    507 	if ((ks = ksem_lookup_byname(name)) != NULL) {
    508 		if (oflag & O_EXCL) {
    509 			mutex_exit(&ks->ks_interlock);
    510 			mutex_exit(&ksem_mutex);
    511 
    512 			free(ksnew->ks_name, M_SEM);
    513 			ksnew->ks_name = NULL;
    514 
    515 			mutex_enter(&ksnew->ks_interlock);
    516 			ksem_delref(ksnew);
    517 			return (EEXIST);
    518 		}
    519 		goto found_one;
    520 	} else {
    521 		/* ksnew already has its initial reference. */
    522 		LIST_INSERT_HEAD(&ksem_head, ksnew, ks_entry);
    523 		mutex_exit(&ksem_mutex);
    524 
    525 		ksem_add_proc(l->l_proc, ksnew);
    526 	}
    527 	return (error);
    528 }
    529 
    530 /* We must have a read lock on the ksem_proc list! */
    531 static struct ksem *
    532 ksem_lookup_proc(struct ksem_proc *kp, semid_t id)
    533 {
    534 	struct ksem_ref *ksr;
    535 
    536 	LIST_FOREACH(ksr, &kp->kp_ksems, ksr_list) {
    537 		if (id == SEM_TO_ID(ksr->ksr_ksem)) {
    538 			mutex_enter(&ksr->ksr_ksem->ks_interlock);
    539 			return (ksr->ksr_ksem);
    540 		}
    541 	}
    542 
    543 	return (NULL);
    544 }
    545 
    546 int
    547 sys__ksem_unlink(struct lwp *l, void *v, register_t *retval)
    548 {
    549 	struct sys__ksem_unlink_args /* {
    550 		const char *name;
    551 	} */ *uap = v;
    552 	char name[SEM_MAX_NAMELEN + 1], *cp;
    553 	size_t done;
    554 	struct ksem *ks;
    555 	int error;
    556 
    557 	error = copyinstr(SCARG(uap, name), name, sizeof(name), &done);
    558 	if (error)
    559 		return error;
    560 
    561 	mutex_enter(&ksem_mutex);
    562 	ks = ksem_lookup_byname(name);
    563 	if (ks == NULL) {
    564 		mutex_exit(&ksem_mutex);
    565 		return (ENOENT);
    566 	}
    567 
    568 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    569 
    570 	LIST_REMOVE(ks, ks_entry);
    571 	cp = ks->ks_name;
    572 	ks->ks_name = NULL;
    573 
    574 	mutex_exit(&ksem_mutex);
    575 
    576 	if (ks->ks_ref == 0)
    577 		ksem_free(ks);
    578 	else
    579 		mutex_exit(&ks->ks_interlock);
    580 
    581 	free(cp, M_SEM);
    582 
    583 	return (0);
    584 }
    585 
    586 int
    587 sys__ksem_close(struct lwp *l, void *v, register_t *retval)
    588 {
    589 	struct sys__ksem_close_args /* {
    590 		semid_t id;
    591 	} */ *uap = v;
    592 	struct ksem_proc *kp;
    593 	struct ksem_ref *ksr;
    594 	struct ksem *ks;
    595 
    596 	kp = proc_getspecific(l->l_proc, ksem_specificdata_key);
    597 	if (kp == NULL)
    598 		return (EINVAL);
    599 
    600 	rw_enter(&kp->kp_lock, RW_WRITER);
    601 
    602 	ks = ksem_lookup_proc(kp, SCARG(uap, id));
    603 	if (ks == NULL) {
    604 		rw_exit(&kp->kp_lock);
    605 		return (EINVAL);
    606 	}
    607 
    608 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    609 	if (ks->ks_name == NULL) {
    610 		mutex_exit(&ks->ks_interlock);
    611 		rw_exit(&kp->kp_lock);
    612 		return (EINVAL);
    613 	}
    614 
    615 	ksr = ksem_drop_proc(kp, ks);
    616 	rw_exit(&kp->kp_lock);
    617 	free(ksr, M_SEM);
    618 
    619 	return (0);
    620 }
    621 
    622 int
    623 sys__ksem_post(struct lwp *l, void *v, register_t *retval)
    624 {
    625 	struct sys__ksem_post_args /* {
    626 		semid_t id;
    627 	} */ *uap = v;
    628 	struct ksem_proc *kp;
    629 	struct ksem *ks;
    630 	int error;
    631 
    632 	kp = proc_getspecific(l->l_proc, ksem_specificdata_key);
    633 	if (kp == NULL)
    634 		return (EINVAL);
    635 
    636 	rw_enter(&kp->kp_lock, RW_READER);
    637 	ks = ksem_lookup_proc(kp, SCARG(uap, id));
    638 	rw_exit(&kp->kp_lock);
    639 	if (ks == NULL)
    640 		return (EINVAL);
    641 
    642 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    643 	if (ks->ks_value == SEM_VALUE_MAX) {
    644 		error = EOVERFLOW;
    645 		goto out;
    646 	}
    647 	++ks->ks_value;
    648 	if (ks->ks_waiters)
    649 		cv_broadcast(&ks->ks_cv);
    650 	error = 0;
    651  out:
    652 	mutex_exit(&ks->ks_interlock);
    653 	return (error);
    654 }
    655 
    656 static int
    657 ksem_wait(struct lwp *l, semid_t id, int tryflag)
    658 {
    659 	struct ksem_proc *kp;
    660 	struct ksem *ks;
    661 	int error;
    662 
    663 	kp = proc_getspecific(l->l_proc, ksem_specificdata_key);
    664 	if (kp == NULL)
    665 		return (EINVAL);
    666 
    667 	rw_enter(&kp->kp_lock, RW_READER);
    668 	ks = ksem_lookup_proc(kp, id);
    669 	rw_exit(&kp->kp_lock);
    670 	if (ks == NULL)
    671 		return (EINVAL);
    672 
    673 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    674 	ksem_addref(ks);
    675 	while (ks->ks_value == 0) {
    676 		ks->ks_waiters++;
    677 		if (tryflag)
    678 			error = EAGAIN;
    679 		else
    680 			error = cv_wait_sig(&ks->ks_cv, &ks->ks_interlock);
    681 		ks->ks_waiters--;
    682 		if (error)
    683 			goto out;
    684 	}
    685 	ks->ks_value--;
    686 	error = 0;
    687  out:
    688 	ksem_delref(ks);
    689 	return (error);
    690 }
    691 
    692 int
    693 sys__ksem_wait(struct lwp *l, void *v, register_t *retval)
    694 {
    695 	struct sys__ksem_wait_args /* {
    696 		semid_t id;
    697 	} */ *uap = v;
    698 
    699 	return ksem_wait(l, SCARG(uap, id), 0);
    700 }
    701 
    702 int
    703 sys__ksem_trywait(struct lwp *l, void *v, register_t *retval)
    704 {
    705 	struct sys__ksem_trywait_args /* {
    706 		semid_t id;
    707 	} */ *uap = v;
    708 
    709 	return ksem_wait(l, SCARG(uap, id), 1);
    710 }
    711 
    712 int
    713 sys__ksem_getvalue(struct lwp *l, void *v, register_t *retval)
    714 {
    715 	struct sys__ksem_getvalue_args /* {
    716 		semid_t id;
    717 		unsigned int *value;
    718 	} */ *uap = v;
    719 	struct ksem_proc *kp;
    720 	struct ksem *ks;
    721 	unsigned int val;
    722 
    723 	kp = proc_getspecific(l->l_proc, ksem_specificdata_key);
    724 	if (kp == NULL)
    725 		return (EINVAL);
    726 
    727 	rw_enter(&kp->kp_lock, RW_READER);
    728 	ks = ksem_lookup_proc(kp, SCARG(uap, id));
    729 	rw_exit(&kp->kp_lock);
    730 	if (ks == NULL)
    731 		return (EINVAL);
    732 
    733 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    734 	val = ks->ks_value;
    735 	mutex_exit(&ks->ks_interlock);
    736 
    737 	return (copyout(&val, SCARG(uap, value), sizeof(val)));
    738 }
    739 
    740 int
    741 sys__ksem_destroy(struct lwp *l, void *v, register_t *retval)
    742 {
    743 	struct sys__ksem_destroy_args /*{
    744 		semid_t id;
    745 	} */ *uap = v;
    746 	struct ksem_proc *kp;
    747 	struct ksem_ref *ksr;
    748 	struct ksem *ks;
    749 
    750 	kp = proc_getspecific(l->l_proc, ksem_specificdata_key);
    751 	if (kp == NULL)
    752 		return (EINVAL);
    753 
    754 	rw_enter(&kp->kp_lock, RW_WRITER);
    755 
    756 	ks = ksem_lookup_proc(kp, SCARG(uap, id));
    757 	if (ks == NULL) {
    758 		rw_exit(&kp->kp_lock);
    759 		return (EINVAL);
    760 	}
    761 
    762 	LOCK_ASSERT(mutex_owned(&ks->ks_interlock));
    763 
    764 	/*
    765 	 * XXX This misses named semaphores which have been unlink'd,
    766 	 * XXX but since behavior of destroying a named semaphore is
    767 	 * XXX undefined, this is technically allowed.
    768 	 */
    769 	if (ks->ks_name != NULL) {
    770 		mutex_exit(&ks->ks_interlock);
    771 		rw_exit(&kp->kp_lock);
    772 		return (EINVAL);
    773 	}
    774 
    775 	if (ks->ks_waiters) {
    776 		mutex_exit(&ks->ks_interlock);
    777 		rw_exit(&kp->kp_lock);
    778 		return (EBUSY);
    779 	}
    780 
    781 	ksr = ksem_drop_proc(kp, ks);
    782 	rw_exit(&kp->kp_lock);
    783 	free(ksr, M_SEM);
    784 
    785 	return (0);
    786 }
    787 
    788 static void
    789 ksem_forkhook(struct proc *p2, struct proc *p1)
    790 {
    791 	struct ksem_proc *kp1, *kp2;
    792 	struct ksem_ref *ksr, *ksr1;
    793 
    794 	kp1 = proc_getspecific(p1, ksem_specificdata_key);
    795 	if (kp1 == NULL)
    796 		return;
    797 
    798 	kp2 = ksem_proc_alloc();
    799 
    800 	rw_enter(&kp1->kp_lock, RW_READER);
    801 
    802 	if (!LIST_EMPTY(&kp1->kp_ksems)) {
    803 		LIST_FOREACH(ksr, &kp1->kp_ksems, ksr_list) {
    804 			ksr1 = malloc(sizeof(*ksr), M_SEM, M_WAITOK);
    805 			ksr1->ksr_ksem = ksr->ksr_ksem;
    806 			mutex_enter(&ksr->ksr_ksem->ks_interlock);
    807 			ksem_addref(ksr->ksr_ksem);
    808 			mutex_exit(&ksr->ksr_ksem->ks_interlock);
    809 			LIST_INSERT_HEAD(&kp2->kp_ksems, ksr1, ksr_list);
    810 		}
    811 	}
    812 
    813 	rw_exit(&kp1->kp_lock);
    814 	proc_setspecific(p2, ksem_specificdata_key, kp2);
    815 }
    816 
    817 static void
    818 ksem_exechook(struct proc *p, void *arg)
    819 {
    820 	struct ksem_proc *kp;
    821 
    822 	kp = proc_getspecific(p, ksem_specificdata_key);
    823 	if (kp != NULL) {
    824 		proc_setspecific(p, ksem_specificdata_key, NULL);
    825 		ksem_proc_dtor(kp);
    826 	}
    827 }
    828 
    829 void
    830 ksem_init(void)
    831 {
    832 	int i, error;
    833 
    834 	mutex_init(&ksem_mutex, MUTEX_DEFAULT, IPL_NONE);
    835 	exechook_establish(ksem_exechook, NULL);
    836 	forkhook_establish(ksem_forkhook);
    837 
    838 	for (i = 0; i < SEM_HASHTBL_SIZE; i++)
    839 		LIST_INIT(&ksem_hash[i]);
    840 
    841 	error = proc_specific_key_create(&ksem_specificdata_key,
    842 					 ksem_proc_dtor);
    843 	KASSERT(error == 0);
    844 }
    845