| 1 | |
| 2 | * Fast Userspace Mutexes (which I call "Futexes!").
|
| 3 | * (C) Rusty Russell, IBM 2002
|
| 4 | *
|
| 5 | * Generalized futexes, futex requeueing, misc fixes by Ingo Molnar
|
| 6 | * (C) Copyright 2003 Red Hat Inc, All Rights Reserved
|
| 7 | *
|
| 8 | * Removed page pinning, fix privately mapped COW pages and other cleanups
|
| 9 | * (C) Copyright 2003, 2004 Jamie Lokier
|
| 10 | *
|
| 11 | * Thanks to Ben LaHaise for yelling "hashed waitqueues" loudly
|
| 12 | * enough at me, Linus for the original (flawed) idea, Matthew
|
| 13 | * Kirkwood for proof-of-concept implementation.
|
| 14 | *
|
| 15 | * "The futexes are also cursed."
|
| 16 | * "But they come in a choice of three flavours!"
|
| 17 | *
|
| 18 | * This program is free software; you can redistribute it and/or modify
|
| 19 | * it under the terms of the GNU General Public License as published by
|
| 20 | * the Free Software Foundation; either version 2 of the License, or
|
| 21 | * (at your option) any later version.
|
| 22 | *
|
| 23 | * This program is distributed in the hope that it will be useful,
|
| 24 | * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
| 25 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
| 26 | * GNU General Public License for more details.
|
| 27 | *
|
| 28 | * You should have received a copy of the GNU General Public License
|
| 29 | * along with this program; if not, write to the Free Software
|
| 30 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
| 31 |
|
| 32 | #include <linux/slab.h>
|
| 33 | #include <linux/poll.h>
|
| 34 | #include <linux/fs.h>
|
| 35 | #include <linux/file.h>
|
| 36 | #include <linux/jhash.h>
|
| 37 | #include <linux/init.h>
|
| 38 | #include <linux/futex.h>
|
| 39 | #include <linux/mount.h>
|
| 40 | #include <linux/pagemap.h>
|
| 41 | #include <linux/syscalls.h>
|
| 42 | #include <linux/signal.h>
|
| 43 |
|
| 44 | #define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
|
| 45 |
|
| 46 | |
| 47 | * Futexes are matched on equal values of this key.
|
| 48 | * The key type depends on whether it's a shared or private mapping.
|
| 49 | * Don't rearrange members without looking at hash_futex().
|
| 50 | *
|
| 51 | * offset is aligned to a multiple of sizeof(u32) (== 4) by definition.
|
| 52 | * We set bit 0 to indicate if it's an inode-based key.
|
| 53 |
|
| 54 | union futex_key {
|
| 55 | struct {
|
| 56 | unsigned long pgoff;
|
| 57 | struct inode *inode;
|
| 58 | int offset;
|
| 59 | } shared;
|
| 60 | struct {
|
| 61 | unsigned long uaddr;
|
| 62 | struct mm_struct *mm;
|
| 63 | int offset;
|
| 64 | } private;
|
| 65 | struct {
|
| 66 | unsigned long word;
|
| 67 | void *ptr;
|
| 68 | int offset;
|
| 69 | } both;
|
| 70 | };
|
| 71 |
|
| 72 | |
| 73 | * We use this hashed waitqueue instead of a normal wait_queue_t, so
|
| 74 | * we can wake only the relevant ones (hashed queues may be shared).
|
| 75 | *
|
| 76 | * A futex_q has a woken state, just like tasks have TASK_RUNNING.
|
| 77 | * It is considered woken when list_empty(&q->list) || q->lock_ptr == 0.
|
| 78 | * The order of wakup is always to make the first condition true, then
|
| 79 | * wake up q->waiters, then make the second condition true.
|
| 80 |
|
| 81 | struct futex_q {
|
| 82 | struct list_head list;
|
| 83 | wait_queue_head_t waiters;
|
| 84 |
|
| 85 |
|
| 86 | spinlock_t *lock_ptr;
|
| 87 |
|
| 88 |
|
| 89 | union futex_key key;
|
| 90 |
|
| 91 |
|
| 92 | int fd;
|
| 93 | struct file *filp;
|
| 94 | };
|
| 95 |
|
| 96 | |
| 97 | * Split the global futex_lock into every hash list lock.
|
| 98 |
|
| 99 | struct futex_hash_bucket {
|
| 100 | spinlock_t lock;
|
| 101 | struct list_head chain;
|
| 102 | };
|
| 103 |
|
| 104 | static struct futex_hash_bucket futex_queues[1<<FUTEX_HASHBITS];
|
| 105 |
|
| 106 |
|
| 107 | static struct vfsmount *futex_mnt;
|
| 108 |
|
| 109 | |
| 110 | * We hash on the keys returned from get_futex_key (see below).
|
| 111 |
|
| 112 | static struct futex_hash_bucket *hash_futex(union futex_key *key)
|
| 113 | {
|
| 114 | u32 hash = jhash2((u32*)&key->both.word,
|
| 115 | (sizeof(key->both.word)+sizeof(key->both.ptr))/4,
|
| 116 | key->both.offset);
|
| 117 | return &futex_queues[hash & ((1 << FUTEX_HASHBITS)-1)];
|
| 118 | }
|
| 119 |
|
| 120 | |
| 121 | * Return 1 if two futex_keys are equal, 0 otherwise.
|
| 122 |
|
| 123 | static inline int match_futex(union futex_key *key1, union futex_key *key2)
|
| 124 | {
|
| 125 | return (key1->both.word == key2->both.word
|
| 126 | && key1->both.ptr == key2->both.ptr
|
| 127 | && key1->both.offset == key2->both.offset);
|
| 128 | }
|
| 129 |
|
| 130 | |
| 131 | * Get parameters which are the keys for a futex.
|
| 132 | *
|
| 133 | * For shared mappings, it's (page->index, vma->vm_file->f_dentry->d_inode,
|
| 134 | * offset_within_page). For private mappings, it's (uaddr, current->mm).
|
| 135 | * We can usually work out the index without swapping in the page.
|
| 136 | *
|
| 137 | * Returns: 0, or negative error code.
|
| 138 | * The key words are stored in *key on success.
|
| 139 | *
|
| 140 | * Should be called with ¤t->mm->mmap_sem but NOT any spinlocks.
|
| 141 |
|
| 142 | static int get_futex_key(unsigned long uaddr, union futex_key *key)
|
| 143 | {
|
| 144 | struct mm_struct *mm = current->mm;
|
| 145 | struct vm_area_struct *vma;
|
| 146 | struct page *page;
|
| 147 | int err;
|
| 148 |
|
| 149 | |
| 150 | * The futex address must be "naturally" aligned.
|
| 151 |
|
| 152 | key->both.offset = uaddr % PAGE_SIZE;
|
| 153 | if (unlikely((key->both.offset % sizeof(u32)) != 0))
|
| 154 | return -EINVAL;
|
| 155 | uaddr -= key->both.offset;
|
| 156 |
|
| 157 | |
| 158 | * The futex is hashed differently depending on whether
|
| 159 | * it's in a shared or private mapping. So check vma first.
|
| 160 |
|
| 161 | vma = find_extend_vma(mm, uaddr);
|
| 162 | if (unlikely(!vma))
|
| 163 | return -EFAULT;
|
| 164 |
|
| 165 | |
| 166 | * Permissions.
|
| 167 |
|
| 168 | if (unlikely((vma->vm_flags & (VM_IO|VM_READ)) != VM_READ))
|
| 169 | return (vma->vm_flags & VM_IO) ? -EPERM : -EACCES;
|
| 170 |
|
| 171 | |
| 172 | * Private mappings are handled in a simple way.
|
| 173 | *
|
| 174 | * NOTE: When userspace waits on a MAP_SHARED mapping, even if
|
| 175 | * it's a read-only handle, it's expected that futexes attach to
|
| 176 | * the object not the particular process. Therefore we use
|
| 177 | * VM_MAYSHARE here, not VM_SHARED which is restricted to shared
|
| 178 | * mappings of _writable_ handles.
|
| 179 |
|
| 180 | if (likely(!(vma->vm_flags & VM_MAYSHARE))) {
|
| 181 | key->private.mm = mm;
|
| 182 | key->private.uaddr = uaddr;
|
| 183 | return 0;
|
| 184 | }
|
| 185 |
|
| 186 | |
| 187 | * Linear file mappings are also simple.
|
| 188 |
|
| 189 | key->shared.inode = vma->vm_file->f_dentry->d_inode;
|
| 190 | key->both.offset++;
|
| 191 | if (likely(!(vma->vm_flags & VM_NONLINEAR))) {
|
| 192 | key->shared.pgoff = (((uaddr - vma->vm_start) >> PAGE_SHIFT)
|
| 193 | + vma->vm_pgoff);
|
| 194 | return 0;
|
| 195 | }
|
| 196 |
|
| 197 | |
| 198 | * We could walk the page table to read the non-linear
|
| 199 | * pte, and get the page index without fetching the page
|
| 200 | * from swap. But that's a lot of code to duplicate here
|
| 201 | * for a rare case, so we simply fetch the page.
|
| 202 |
|
| 203 |
|
| 204 | |
| 205 | * Do a quick atomic lookup first - this is the fastpath.
|
| 206 |
|
| 207 | spin_lock(¤t->mm->page_table_lock);
|
| 208 | page = follow_page(mm, uaddr, 0);
|
| 209 | if (likely(page != NULL)) {
|
| 210 | key->shared.pgoff =
|
| 211 | page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
|
| 212 | spin_unlock(¤t->mm->page_table_lock);
|
| 213 | return 0;
|
| 214 | }
|
| 215 | spin_unlock(¤t->mm->page_table_lock);
|
| 216 |
|
| 217 | |
| 218 | * Do it the general way.
|
| 219 |
|
| 220 | err = get_user_pages(current, mm, uaddr, 1, 0, 0, &page, NULL);
|
| 221 | if (err >= 0) {
|
| 222 | key->shared.pgoff =
|
| 223 | page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
|
| 224 | put_page(page);
|
| 225 | return 0;
|
| 226 | }
|
| 227 | return err;
|
| 228 | }
|
| 229 |
|
| 230 | |
| 231 | * Take a reference to the resource addressed by a key.
|
| 232 | * Can be called while holding spinlocks.
|
| 233 | *
|
| 234 | * NOTE: mmap_sem MUST be held between get_futex_key() and calling this
|
| 235 | * function, if it is called at all. mmap_sem keeps key->shared.inode valid.
|
| 236 |
|
| 237 | static inline void get_key_refs(union futex_key *key)
|
| 238 | {
|
| 239 | if (key->both.ptr != 0) {
|
| 240 | if (key->both.offset & 1)
|
| 241 | atomic_inc(&key->shared.inode->i_count);
|
| 242 | else
|
| 243 | atomic_inc(&key->private.mm->mm_count);
|
| 244 | }
|
| 245 | }
|
| 246 |
|
| 247 | |
| 248 | * Drop a reference to the resource addressed by a key.
|
| 249 | * The hash bucket spinlock must not be held.
|
| 250 |
|
| 251 | static void drop_key_refs(union futex_key *key)
|
| 252 | {
|
| 253 | if (key->both.ptr != 0) {
|
| 254 | if (key->both.offset & 1)
|
| 255 | iput(key->shared.inode);
|
| 256 | else
|
| 257 | mmdrop(key->private.mm);
|
| 258 | }
|
| 259 | }
|
| 260 |
|
| 261 | static inline int get_futex_value_locked(int *dest, int __user *from)
|
| 262 | {
|
| 263 | int ret;
|
| 264 |
|
| 265 | inc_preempt_count();
|
| 266 | ret = __copy_from_user_inatomic(dest, from, sizeof(int));
|
| 267 | dec_preempt_count();
|
| 268 |
|
| 269 | return ret ? -EFAULT : 0;
|
| 270 | }
|
| 271 |
|
| 272 | |
| 273 | * The hash bucket lock must be held when this is called.
|
| 274 | * Afterwards, the futex_q must not be accessed.
|
| 275 |
|
| 276 | static void wake_futex(struct futex_q *q)
|
| 277 | {
|
| 278 | list_del_init(&q->list);
|
| 279 | if (q->filp)
|
| 280 | send_sigio(&q->filp->f_owner, q->fd, POLL_IN);
|
| 281 | |
| 282 | * The lock in wake_up_all() is a crucial memory barrier after the
|
| 283 | * list_del_init() and also before assigning to q->lock_ptr.
|
| 284 |
|
| 285 | wake_up_all(&q->waiters);
|
| 286 | |
| 287 | * The waiting task can free the futex_q as soon as this is written,
|
| 288 | * without taking any locks. This must come last.
|
| 289 |
|
| 290 | q->lock_ptr = NULL;
|
| 291 | }
|
| 292 |
|
| 293 | |
| 294 | * Wake up all waiters hashed on the physical page that is mapped
|
| 295 | * to this virtual address:
|
| 296 |
|
| 297 | static int futex_wake(unsigned long uaddr, int nr_wake)
|
| 298 | {
|
| 299 | union futex_key key;
|
| 300 | struct futex_hash_bucket *bh;
|
| 301 | struct list_head *head;
|
| 302 | struct futex_q *this, *next;
|
| 303 | int ret;
|
| 304 |
|
| 305 | down_read(¤t->mm->mmap_sem);
|
| 306 |
|
| 307 | ret = get_futex_key(uaddr, &key);
|
| 308 | if (unlikely(ret != 0))
|
| 309 | goto out;
|
| 310 |
|
| 311 | bh = hash_futex(&key);
|
| 312 | spin_lock(&bh->lock);
|
| 313 | head = &bh->chain;
|
| 314 |
|
| 315 | list_for_each_entry_safe(this, next, head, list) {
|
| 316 | if (match_futex (&this->key, &key)) {
|
| 317 | wake_futex(this);
|
| 318 | if (++ret >= nr_wake)
|
| 319 | break;
|
| 320 | }
|
| 321 | }
|
| 322 |
|
| 323 | spin_unlock(&bh->lock);
|
| 324 | out:
|
| 325 | up_read(¤t->mm->mmap_sem);
|
| 326 | return ret;
|
| 327 | }
|
| 328 |
|
| 329 | |
| 330 | * Requeue all waiters hashed on one physical page to another
|
| 331 | * physical page.
|
| 332 |
|
| 333 | static int futex_requeue(unsigned long uaddr1, unsigned long uaddr2,
|
| 334 | int nr_wake, int nr_requeue, int *valp)
|
| 335 | {
|
| 336 | union futex_key key1, key2;
|
| 337 | struct futex_hash_bucket *bh1, *bh2;
|
| 338 | struct list_head *head1;
|
| 339 | struct futex_q *this, *next;
|
| 340 | int ret, drop_count = 0;
|
| 341 |
|
| 342 | retry:
|
| 343 | down_read(¤t->mm->mmap_sem);
|
| 344 |
|
| 345 | ret = get_futex_key(uaddr1, &key1);
|
| 346 | if (unlikely(ret != 0))
|
| 347 | goto out;
|
| 348 | ret = get_futex_key(uaddr2, &key2);
|
| 349 | if (unlikely(ret != 0))
|
| 350 | goto out;
|
| 351 |
|
| 352 | bh1 = hash_futex(&key1);
|
| 353 | bh2 = hash_futex(&key2);
|
| 354 |
|
| 355 | if (bh1 < bh2)
|
| 356 | spin_lock(&bh1->lock);
|
| 357 | spin_lock(&bh2->lock);
|
| 358 | if (bh1 > bh2)
|
| 359 | spin_lock(&bh1->lock);
|
| 360 |
|
| 361 | if (likely(valp != NULL)) {
|
| 362 | int curval;
|
| 363 |
|
| 364 | ret = get_futex_value_locked(&curval, (int __user *)uaddr1);
|
| 365 |
|
| 366 | if (unlikely(ret)) {
|
| 367 | spin_unlock(&bh1->lock);
|
| 368 | if (bh1 != bh2)
|
| 369 | spin_unlock(&bh2->lock);
|
| 370 |
|
| 371 | |
| 372 | * it in and start all over again.
|
| 373 |
|
| 374 | up_read(¤t->mm->mmap_sem);
|
| 375 |
|
| 376 | ret = get_user(curval, (int __user *)uaddr1);
|
| 377 |
|
| 378 | if (!ret)
|
| 379 | goto retry;
|
| 380 |
|
| 381 | return ret;
|
| 382 | }
|
| 383 | if (curval != *valp) {
|
| 384 | ret = -EAGAIN;
|
| 385 | goto out_unlock;
|
| 386 | }
|
| 387 | }
|
| 388 |
|
| 389 | head1 = &bh1->chain;
|
| 390 | list_for_each_entry_safe(this, next, head1, list) {
|
| 391 | if (!match_futex (&this->key, &key1))
|
| 392 | continue;
|
| 393 | if (++ret <= nr_wake) {
|
| 394 | wake_futex(this);
|
| 395 | } else {
|
| 396 | list_move_tail(&this->list, &bh2->chain);
|
| 397 | this->lock_ptr = &bh2->lock;
|
| 398 | this->key = key2;
|
| 399 | get_key_refs(&key2);
|
| 400 | drop_count++;
|
| 401 |
|
| 402 | if (ret - nr_wake >= nr_requeue)
|
| 403 | break;
|
| 404 |
|
| 405 | if (head1 == &bh2->chain && head1 != &next->list)
|
| 406 | head1 = &this->list;
|
| 407 | }
|
| 408 | }
|
| 409 |
|
| 410 | out_unlock:
|
| 411 | spin_unlock(&bh1->lock);
|
| 412 | if (bh1 != bh2)
|
| 413 | spin_unlock(&bh2->lock);
|
| 414 |
|
| 415 |
|
| 416 | while (--drop_count >= 0)
|
| 417 | drop_key_refs(&key1);
|
| 418 |
|
| 419 | out:
|
| 420 | up_read(¤t->mm->mmap_sem);
|
| 421 | return ret;
|
| 422 | }
|
| 423 |
|
| 424 |
|
| 425 | static inline struct futex_hash_bucket *
|
| 426 | queue_lock(struct futex_q *q, int fd, struct file *filp)
|
| 427 | {
|
| 428 | struct futex_hash_bucket *bh;
|
| 429 |
|
| 430 | q->fd = fd;
|
| 431 | q->filp = filp;
|
| 432 |
|
| 433 | init_waitqueue_head(&q->waiters);
|
| 434 |
|
| 435 | get_key_refs(&q->key);
|
| 436 | bh = hash_futex(&q->key);
|
| 437 | q->lock_ptr = &bh->lock;
|
| 438 |
|
| 439 | spin_lock(&bh->lock);
|
| 440 | return bh;
|
| 441 | }
|
| 442 |
|
| 443 | static inline void __queue_me(struct futex_q *q, struct futex_hash_bucket *bh)
|
| 444 | {
|
| 445 | list_add_tail(&q->list, &bh->chain);
|
| 446 | spin_unlock(&bh->lock);
|
| 447 | }
|
| 448 |
|
| 449 | static inline void
|
| 450 | queue_unlock(struct futex_q *q, struct futex_hash_bucket *bh)
|
| 451 | {
|
| 452 | spin_unlock(&bh->lock);
|
| 453 | drop_key_refs(&q->key);
|
| 454 | }
|
| 455 |
|
| 456 | |
| 457 | * queue_me and unqueue_me must be called as a pair, each
|
| 458 | * exactly once. They are called with the hashed spinlock held.
|
| 459 |
|
| 460 |
|
| 461 |
|
| 462 | static void queue_me(struct futex_q *q, int fd, struct file *filp)
|
| 463 | {
|
| 464 | struct futex_hash_bucket *bh;
|
| 465 | bh = queue_lock(q, fd, filp);
|
| 466 | __queue_me(q, bh);
|
| 467 | }
|
| 468 |
|
| 469 |
|
| 470 | static int unqueue_me(struct futex_q *q)
|
| 471 | {
|
| 472 | int ret = 0;
|
| 473 | spinlock_t *lock_ptr;
|
| 474 |
|
| 475 |
|
| 476 | retry:
|
| 477 | lock_ptr = q->lock_ptr;
|
| 478 | if (lock_ptr != 0) {
|
| 479 | spin_lock(lock_ptr);
|
| 480 | |
| 481 | * q->lock_ptr can change between reading it and
|
| 482 | * spin_lock(), causing us to take the wrong lock. This
|
| 483 | * corrects the race condition.
|
| 484 | *
|
| 485 | * Reasoning goes like this: if we have the wrong lock,
|
| 486 | * q->lock_ptr must have changed (maybe several times)
|
| 487 | * between reading it and the spin_lock(). It can
|
| 488 | * change again after the spin_lock() but only if it was
|
| 489 | * already changed before the spin_lock(). It cannot,
|
| 490 | * however, change back to the original value. Therefore
|
| 491 | * we can detect whether we acquired the correct lock.
|
| 492 |
|
| 493 | if (unlikely(lock_ptr != q->lock_ptr)) {
|
| 494 | spin_unlock(lock_ptr);
|
| 495 | goto retry;
|
| 496 | }
|
| 497 | WARN_ON(list_empty(&q->list));
|
| 498 | list_del(&q->list);
|
| 499 | spin_unlock(lock_ptr);
|
| 500 | ret = 1;
|
| 501 | }
|
| 502 |
|
| 503 | drop_key_refs(&q->key);
|
| 504 | return ret;
|
| 505 | }
|
| 506 |
|
| 507 | static int futex_wait(unsigned long uaddr, int val, unsigned long time)
|
| 508 | {
|
| 509 | DECLARE_WAITQUEUE(wait, current);
|
| 510 | int ret, curval;
|
| 511 | struct futex_q q;
|
| 512 | struct futex_hash_bucket *bh;
|
| 513 |
|
| 514 | retry:
|
| 515 | down_read(¤t->mm->mmap_sem);
|
| 516 |
|
| 517 | ret = get_futex_key(uaddr, &q.key);
|
| 518 | if (unlikely(ret != 0))
|
| 519 | goto out_release_sem;
|
| 520 |
|
| 521 | bh = queue_lock(&q, -1, NULL);
|
| 522 |
|
| 523 | |
| 524 | * Access the page AFTER the futex is queued.
|
| 525 | * Order is important:
|
| 526 | *
|
| 527 | * Userspace waiter: val = var; if (cond(val)) futex_wait(&var, val);
|
| 528 | * Userspace waker: if (cond(var)) { var = new; futex_wake(&var); }
|
| 529 | *
|
| 530 | * The basic logical guarantee of a futex is that it blocks ONLY
|
| 531 | * if cond(var) is known to be true at the time of blocking, for
|
| 532 | * any cond. If we queued after testing *uaddr, that would open
|
| 533 | * a race condition where we could block indefinitely with
|
| 534 | * cond(var) false, which would violate the guarantee.
|
| 535 | *
|
| 536 | * A consequence is that futex_wait() can return zero and absorb
|
| 537 | * a wakeup when *uaddr != val on entry to the syscall. This is
|
| 538 | * rare, but normal.
|
| 539 | *
|
| 540 | * We hold the mmap semaphore, so the mapping cannot have changed
|
| 541 | * since we looked it up in get_futex_key.
|
| 542 |
|
| 543 |
|
| 544 | ret = get_futex_value_locked(&curval, (int __user *)uaddr);
|
| 545 |
|
| 546 | if (unlikely(ret)) {
|
| 547 | queue_unlock(&q, bh);
|
| 548 |
|
| 549 | |
| 550 | * start all over again.
|
| 551 |
|
| 552 | up_read(¤t->mm->mmap_sem);
|
| 553 |
|
| 554 | ret = get_user(curval, (int __user *)uaddr);
|
| 555 |
|
| 556 | if (!ret)
|
| 557 | goto retry;
|
| 558 | return ret;
|
| 559 | }
|
| 560 | if (curval != val) {
|
| 561 | ret = -EWOULDBLOCK;
|
| 562 | queue_unlock(&q, bh);
|
| 563 | goto out_release_sem;
|
| 564 | }
|
| 565 |
|
| 566 |
|
| 567 | __queue_me(&q, bh);
|
| 568 |
|
| 569 | |
| 570 | * Now the futex is queued and we have checked the data, we
|
| 571 | * don't want to hold mmap_sem while we sleep.
|
| 572 |
|
| 573 | up_read(¤t->mm->mmap_sem);
|
| 574 |
|
| 575 | |
| 576 | * There might have been scheduling since the queue_me(), as we
|
| 577 | * cannot hold a spinlock across the get_user() in case it
|
| 578 | * faults, and we cannot just set TASK_INTERRUPTIBLE state when
|
| 579 | * queueing ourselves into the futex hash. This code thus has to
|
| 580 | * rely on the futex_wake() code removing us from hash when it
|
| 581 | * wakes us up.
|
| 582 |
|
| 583 |
|
| 584 |
|
| 585 | __set_current_state(TASK_INTERRUPTIBLE);
|
| 586 | add_wait_queue(&q.waiters, &wait);
|
| 587 | |
| 588 | * !list_empty() is safe here without any lock.
|
| 589 | * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
|
| 590 |
|
| 591 | if (likely(!list_empty(&q.list)))
|
| 592 | time = schedule_timeout(time);
|
| 593 | __set_current_state(TASK_RUNNING);
|
| 594 |
|
| 595 | |
| 596 | * NOTE: we don't remove ourselves from the waitqueue because
|
| 597 | * we are the only user of it.
|
| 598 |
|
| 599 |
|
| 600 |
|
| 601 | if (!unqueue_me(&q))
|
| 602 | return 0;
|
| 603 | if (time == 0)
|
| 604 | return -ETIMEDOUT;
|
| 605 | |
| 606 | * have handled it for us already.
|
| 607 | return -EINTR;
|
| 608 |
|
| 609 | out_release_sem:
|
| 610 | up_read(¤t->mm->mmap_sem);
|
| 611 | return ret;
|
| 612 | }
|
| 613 |
|
| 614 | static int futex_close(struct inode *inode, struct file *filp)
|
| 615 | {
|
| 616 | struct futex_q *q = filp->private_data;
|
| 617 |
|
| 618 | unqueue_me(q);
|
| 619 | kfree(q);
|
| 620 | return 0;
|
| 621 | }
|
| 622 |
|
| 623 |
|
| 624 | static unsigned int futex_poll(struct file *filp,
|
| 625 | struct poll_table_struct *wait)
|
| 626 | {
|
| 627 | struct futex_q *q = filp->private_data;
|
| 628 | int ret = 0;
|
| 629 |
|
| 630 | poll_wait(filp, &q->waiters, wait);
|
| 631 |
|
| 632 | |
| 633 | * list_empty() is safe here without any lock.
|
| 634 | * q->lock_ptr != 0 is not safe, because of ordering against wakeup.
|
| 635 |
|
| 636 | if (list_empty(&q->list))
|
| 637 | ret = POLLIN | POLLRDNORM;
|
| 638 |
|
| 639 | return ret;
|
| 640 | }
|
| 641 |
|
| 642 | static struct file_operations futex_fops = {
|
| 643 | .release = futex_close,
|
| 644 | .poll = futex_poll,
|
| 645 | };
|
| 646 |
|
| 647 | |
| 648 | * Signal allows caller to avoid the race which would occur if they
|
| 649 | * set the sigio stuff up afterwards.
|
| 650 |
|
| 651 | static int futex_fd(unsigned long uaddr, int signal)
|
| 652 | {
|
| 653 | struct futex_q *q;
|
| 654 | struct file *filp;
|
| 655 | int ret, err;
|
| 656 |
|
| 657 | ret = -EINVAL;
|
| 658 | if (!valid_signal(signal))
|
| 659 | goto out;
|
| 660 |
|
| 661 | ret = get_unused_fd();
|
| 662 | if (ret < 0)
|
| 663 | goto out;
|
| 664 | filp = get_empty_filp();
|
| 665 | if (!filp) {
|
| 666 | put_unused_fd(ret);
|
| 667 | ret = -ENFILE;
|
| 668 | goto out;
|
| 669 | }
|
| 670 | filp->f_op = &futex_fops;
|
| 671 | filp->f_vfsmnt = mntget(futex_mnt);
|
| 672 | filp->f_dentry = dget(futex_mnt->mnt_root);
|
| 673 | filp->f_mapping = filp->f_dentry->d_inode->i_mapping;
|
| 674 |
|
| 675 | if (signal) {
|
| 676 | int err;
|
| 677 | err = f_setown(filp, current->pid, 1);
|
| 678 | if (err < 0) {
|
| 679 | put_unused_fd(ret);
|
| 680 | put_filp(filp);
|
| 681 | ret = err;
|
| 682 | goto out;
|
| 683 | }
|
| 684 | filp->f_owner.signum = signal;
|
| 685 | }
|
| 686 |
|
| 687 | q = kmalloc(sizeof(*q), GFP_KERNEL);
|
| 688 | if (!q) {
|
| 689 | put_unused_fd(ret);
|
| 690 | put_filp(filp);
|
| 691 | ret = -ENOMEM;
|
| 692 | goto out;
|
| 693 | }
|
| 694 |
|
| 695 | down_read(¤t->mm->mmap_sem);
|
| 696 | err = get_futex_key(uaddr, &q->key);
|
| 697 |
|
| 698 | if (unlikely(err != 0)) {
|
| 699 | up_read(¤t->mm->mmap_sem);
|
| 700 | put_unused_fd(ret);
|
| 701 | put_filp(filp);
|
| 702 | kfree(q);
|
| 703 | return err;
|
| 704 | }
|
| 705 |
|
| 706 | |
| 707 | * queue_me() must be called before releasing mmap_sem, because
|
| 708 | * key->shared.inode needs to be referenced while holding it.
|
| 709 |
|
| 710 | filp->private_data = q;
|
| 711 |
|
| 712 | queue_me(q, ret, filp);
|
| 713 | up_read(¤t->mm->mmap_sem);
|
| 714 |
|
| 715 |
|
| 716 | fd_install(ret, filp);
|
| 717 | out:
|
| 718 | return ret;
|
| 719 | }
|
| 720 |
|
| 721 | long do_futex(unsigned long uaddr, int op, int val, unsigned long timeout,
|
| 722 | unsigned long uaddr2, int val2, int val3)
|
| 723 | {
|
| 724 | int ret;
|
| 725 |
|
| 726 | switch (op) {
|
| 727 | case FUTEX_WAIT:
|
| 728 | ret = futex_wait(uaddr, val, timeout);
|
| 729 | break;
|
| 730 | case FUTEX_WAKE:
|
| 731 | ret = futex_wake(uaddr, val);
|
| 732 | break;
|
| 733 | case FUTEX_FD:
|
| 734 |
|
| 735 | ret = futex_fd(uaddr, val);
|
| 736 | break;
|
| 737 | case FUTEX_REQUEUE:
|
| 738 | ret = futex_requeue(uaddr, uaddr2, val, val2, NULL);
|
| 739 | break;
|
| 740 | case FUTEX_CMP_REQUEUE:
|
| 741 | ret = futex_requeue(uaddr, uaddr2, val, val2, &val3);
|
| 742 | break;
|
| 743 | default:
|
| 744 | ret = -ENOSYS;
|
| 745 | }
|
| 746 | return ret;
|
| 747 | }
|
| 748 |
|
| 749 |
|
| 750 | asmlinkage long sys_futex(u32 __user *uaddr, int op, int val,
|
| 751 | struct timespec __user *utime, u32 __user *uaddr2,
|
| 752 | int val3)
|
| 753 | {
|
| 754 | struct timespec t;
|
| 755 | unsigned long timeout = MAX_SCHEDULE_TIMEOUT;
|
| 756 | int val2 = 0;
|
| 757 |
|
| 758 | if ((op == FUTEX_WAIT) && utime) {
|
| 759 | if (copy_from_user(&t, utime, sizeof(t)) != 0)
|
| 760 | return -EFAULT;
|
| 761 | timeout = timespec_to_jiffies(&t) + 1;
|
| 762 | }
|
| 763 | |
| 764 | * requeue parameter in 'utime' if op == FUTEX_REQUEUE.
|
| 765 |
|
| 766 | if (op >= FUTEX_REQUEUE)
|
| 767 | val2 = (int) (unsigned long) utime;
|
| 768 |
|
| 769 | return do_futex((unsigned long)uaddr, op, val, timeout,
|
| 770 | (unsigned long)uaddr2, val2, val3);
|
| 771 | }
|
| 772 |
|
| 773 | static struct super_block *
|
| 774 | futexfs_get_sb(struct file_system_type *fs_type,
|
| 775 | int flags, const char *dev_name, void *data)
|
| 776 | {
|
| 777 | return get_sb_pseudo(fs_type, "futex", NULL, 0xBAD1DEA);
|
| 778 | }
|
| 779 |
|
| 780 | static struct file_system_type futex_fs_type = {
|
| 781 | .name = "futexfs",
|
| 782 | .get_sb = futexfs_get_sb,
|
| 783 | .kill_sb = kill_anon_super,
|
| 784 | };
|
| 785 |
|
| 786 | static int __init init(void)
|
| 787 | {
|
| 788 | unsigned int i;
|
| 789 |
|
| 790 | register_filesystem(&futex_fs_type);
|
| 791 | futex_mnt = kern_mount(&futex_fs_type);
|
| 792 |
|
| 793 | for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
|
| 794 | INIT_LIST_HEAD(&futex_queues[i].chain);
|
| 795 | spin_lock_init(&futex_queues[i].lock);
|
| 796 | }
|
| 797 | return 0;
|
| 798 | }
|
| 799 | __initcall(init);
|