sysv_msg.c revision 100511
150477Speter/* $FreeBSD: head/sys/kern/sysv_msg.c 100511 2002-07-22 16:12:55Z alfred $ */ 22729Sdfr 32729Sdfr/* 42729Sdfr * Implementation of SVID messages 52729Sdfr * 62729Sdfr * Author: Daniel Boulet 72729Sdfr * 82729Sdfr * Copyright 1993 Daniel Boulet and RTMX Inc. 92729Sdfr * 102729Sdfr * This system call was implemented by Daniel Boulet under contract from RTMX. 112729Sdfr * 122729Sdfr * Redistribution and use in source forms, with and without modification, 132729Sdfr * are permitted provided that this entire comment appears intact. 142729Sdfr * 152729Sdfr * Redistribution in binary form may occur without any restrictions. 162729Sdfr * Obviously, it would be nice if you gave credit where credit is due 172729Sdfr * but requiring it would be too onerous. 182729Sdfr * 192729Sdfr * This software is provided ``AS IS'' without any warranties of any kind. 202729Sdfr */ 212729Sdfr 2259839Speter#include "opt_sysvipc.h" 2359839Speter 242729Sdfr#include <sys/param.h> 252729Sdfr#include <sys/systm.h> 2611626Sbde#include <sys/sysproto.h> 272729Sdfr#include <sys/kernel.h> 282729Sdfr#include <sys/proc.h> 2982607Sdillon#include <sys/lock.h> 3082607Sdillon#include <sys/mutex.h> 312729Sdfr#include <sys/msg.h> 3269449Salfred#include <sys/syscall.h> 3311626Sbde#include <sys/sysent.h> 3459839Speter#include <sys/sysctl.h> 3559839Speter#include <sys/malloc.h> 3668024Srwatson#include <sys/jail.h> 372729Sdfr 3859839Speterstatic MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); 3959839Speter 4092723Salfredstatic void msginit(void); 4192723Salfredstatic int msgunload(void); 4292723Salfredstatic int sysvmsg_modload(struct module *, int, void *); 4310358Sjulian 442729Sdfr#define MSG_DEBUG 452729Sdfr#undef MSG_DEBUG_OK 462729Sdfr 4792723Salfredstatic void msg_freehdr(struct msg *msghdr); 482729Sdfr 4911626Sbde/* XXX casting to (sy_call_t *) is bogus, as usual. */ 5012819Sphkstatic sy_call_t *msgcalls[] = { 5111626Sbde (sy_call_t *)msgctl, (sy_call_t *)msgget, 5211626Sbde (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 5311626Sbde}; 542729Sdfr 5559839Speterstruct msg { 5659839Speter struct msg *msg_next; /* next msg in the chain */ 5759839Speter long msg_type; /* type of this message */ 5859839Speter /* >0 -> type of this message */ 5959839Speter /* 0 -> free header */ 6059839Speter u_short msg_ts; /* size of this message */ 6159839Speter short msg_spot; /* location of start of msg in buffer */ 6259839Speter}; 6359839Speter 6459839Speter 6559839Speter#ifndef MSGSSZ 6659839Speter#define MSGSSZ 8 /* Each segment must be 2^N long */ 6759839Speter#endif 6859839Speter#ifndef MSGSEG 6959839Speter#define MSGSEG 2048 /* must be less than 32767 */ 7059839Speter#endif 7159839Speter#define MSGMAX (MSGSSZ*MSGSEG) 7259839Speter#ifndef MSGMNB 7359839Speter#define MSGMNB 2048 /* max # of bytes in a queue */ 7459839Speter#endif 7559839Speter#ifndef MSGMNI 7659839Speter#define MSGMNI 40 7759839Speter#endif 7859839Speter#ifndef MSGTQL 7959839Speter#define MSGTQL 40 8059839Speter#endif 8159839Speter 8259839Speter/* 8359839Speter * Based on the configuration parameters described in an SVR2 (yes, two) 8459839Speter * config(1m) man page. 8559839Speter * 8659839Speter * Each message is broken up and stored in segments that are msgssz bytes 8759839Speter * long. For efficiency reasons, this should be a power of two. Also, 8859839Speter * it doesn't make sense if it is less than 8 or greater than about 256. 8959839Speter * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of 9059839Speter * two between 8 and 1024 inclusive (and panic's if it isn't). 9159839Speter */ 9259839Speterstruct msginfo msginfo = { 9359839Speter MSGMAX, /* max chars in a message */ 9459839Speter MSGMNI, /* # of message queue identifiers */ 9559839Speter MSGMNB, /* max chars in a queue */ 9659839Speter MSGTQL, /* max messages in system */ 9759839Speter MSGSSZ, /* size of a message segment */ 9859839Speter /* (must be small power of 2 greater than 4) */ 9959839Speter MSGSEG /* number of message segments */ 10059839Speter}; 10159839Speter 10259839Speter/* 10359839Speter * macros to convert between msqid_ds's and msqid's. 10459839Speter * (specific to this implementation) 10559839Speter */ 10659839Speter#define MSQID(ix,ds) ((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000)) 10759839Speter#define MSQID_IX(id) ((id) & 0xffff) 10859839Speter#define MSQID_SEQ(id) (((id) >> 16) & 0xffff) 10959839Speter 11059839Speter/* 11159839Speter * The rest of this file is specific to this particular implementation. 11259839Speter */ 11359839Speter 11459839Speterstruct msgmap { 11559839Speter short next; /* next segment in buffer */ 11659839Speter /* -1 -> available */ 11759839Speter /* 0..(MSGSEG-1) -> index of next segment */ 11859839Speter}; 11959839Speter 12059839Speter#define MSG_LOCKED 01000 /* Is this msqid_ds locked? */ 12159839Speter 12212819Sphkstatic int nfree_msgmaps; /* # of free map entries */ 12312819Sphkstatic short free_msgmaps; /* head of linked list of free map entries */ 12459839Speterstatic struct msg *free_msghdrs;/* list of free msg headers */ 12559839Speterstatic char *msgpool; /* MSGMAX byte long msg buffer pool */ 12659839Speterstatic struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 12759839Speterstatic struct msg *msghdrs; /* MSGTQL msg headers */ 12859839Speterstatic struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 1292729Sdfr 13059839Speterstatic void 13169449Salfredmsginit() 1322729Sdfr{ 1332729Sdfr register int i; 1342729Sdfr 13583765Smr TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg); 13683765Smr TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz); 13783765Smr msginfo.msgmax = msginfo.msgseg * msginfo.msgssz; 13883765Smr TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni); 13983765Smr 14059839Speter msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK); 14159839Speter if (msgpool == NULL) 14259839Speter panic("msgpool is NULL"); 14359839Speter msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK); 14459839Speter if (msgmaps == NULL) 14559839Speter panic("msgmaps is NULL"); 14659839Speter msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK); 14759839Speter if (msghdrs == NULL) 14859839Speter panic("msghdrs is NULL"); 14959839Speter msqids = malloc(sizeof(struct msqid_ds) * msginfo.msgmni, M_MSG, M_WAITOK); 15059839Speter if (msqids == NULL) 15159839Speter panic("msqids is NULL"); 15259839Speter 1532729Sdfr /* 1542729Sdfr * msginfo.msgssz should be a power of two for efficiency reasons. 1552729Sdfr * It is also pretty silly if msginfo.msgssz is less than 8 1562729Sdfr * or greater than about 256 so ... 1572729Sdfr */ 1582729Sdfr 1592729Sdfr i = 8; 1602729Sdfr while (i < 1024 && i != msginfo.msgssz) 1612729Sdfr i <<= 1; 1622729Sdfr if (i != msginfo.msgssz) { 1632729Sdfr printf("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 1642729Sdfr msginfo.msgssz); 1652729Sdfr panic("msginfo.msgssz not a small power of 2"); 1662729Sdfr } 1672729Sdfr 1682729Sdfr if (msginfo.msgseg > 32767) { 1692729Sdfr printf("msginfo.msgseg=%d\n", msginfo.msgseg); 1702729Sdfr panic("msginfo.msgseg > 32767"); 1712729Sdfr } 1722729Sdfr 1732729Sdfr if (msgmaps == NULL) 1742729Sdfr panic("msgmaps is NULL"); 1752729Sdfr 1762729Sdfr for (i = 0; i < msginfo.msgseg; i++) { 1772729Sdfr if (i > 0) 1782729Sdfr msgmaps[i-1].next = i; 1792729Sdfr msgmaps[i].next = -1; /* implies entry is available */ 1802729Sdfr } 1812729Sdfr free_msgmaps = 0; 1822729Sdfr nfree_msgmaps = msginfo.msgseg; 1832729Sdfr 1842729Sdfr if (msghdrs == NULL) 1852729Sdfr panic("msghdrs is NULL"); 1862729Sdfr 1872729Sdfr for (i = 0; i < msginfo.msgtql; i++) { 1882729Sdfr msghdrs[i].msg_type = 0; 1892729Sdfr if (i > 0) 1902729Sdfr msghdrs[i-1].msg_next = &msghdrs[i]; 1912729Sdfr msghdrs[i].msg_next = NULL; 1922729Sdfr } 1932729Sdfr free_msghdrs = &msghdrs[0]; 1942729Sdfr 1952729Sdfr if (msqids == NULL) 1962729Sdfr panic("msqids is NULL"); 1972729Sdfr 1982729Sdfr for (i = 0; i < msginfo.msgmni; i++) { 1992729Sdfr msqids[i].msg_qbytes = 0; /* implies entry is available */ 2002729Sdfr msqids[i].msg_perm.seq = 0; /* reset to a known value */ 20166085Speter msqids[i].msg_perm.mode = 0; 2022729Sdfr } 2032729Sdfr} 2042729Sdfr 20569449Salfredstatic int 20669449Salfredmsgunload() 20769449Salfred{ 20869449Salfred struct msqid_ds *msqptr; 20969449Salfred int msqid; 21069449Salfred 21169449Salfred for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 21269449Salfred /* 21369449Salfred * Look for an unallocated and unlocked msqid_ds. 21469449Salfred * msqid_ds's can be locked by msgsnd or msgrcv while 21569449Salfred * they are copying the message in/out. We can't 21669449Salfred * re-use the entry until they release it. 21769449Salfred */ 21869449Salfred msqptr = &msqids[msqid]; 21969449Salfred if (msqptr->msg_qbytes != 0 || 22069449Salfred (msqptr->msg_perm.mode & MSG_LOCKED) != 0) 22169449Salfred break; 22269449Salfred } 22369449Salfred if (msqid != msginfo.msgmni) 22469449Salfred return (EBUSY); 22569449Salfred 22669449Salfred free(msgpool, M_MSG); 22769449Salfred free(msgmaps, M_MSG); 22869449Salfred free(msghdrs, M_MSG); 22969449Salfred free(msqids, M_MSG); 23069449Salfred return (0); 23169449Salfred} 23269449Salfred 23369449Salfred 23469449Salfredstatic int 23569449Salfredsysvmsg_modload(struct module *module, int cmd, void *arg) 23669449Salfred{ 23769449Salfred int error = 0; 23869449Salfred 23969449Salfred switch (cmd) { 24069449Salfred case MOD_LOAD: 24169449Salfred msginit(); 24269449Salfred break; 24369449Salfred case MOD_UNLOAD: 24469449Salfred error = msgunload(); 24569449Salfred break; 24669449Salfred case MOD_SHUTDOWN: 24769449Salfred break; 24869449Salfred default: 24969449Salfred error = EINVAL; 25069449Salfred break; 25169449Salfred } 25269449Salfred return (error); 25369449Salfred} 25469449Salfred 25571038Sdesstatic moduledata_t sysvmsg_mod = { 25671038Sdes "sysvmsg", 25769449Salfred &sysvmsg_modload, 25869449Salfred NULL 25969449Salfred}; 26069449Salfred 26188633SalfredSYSCALL_MODULE_HELPER(msgsys); 26288633SalfredSYSCALL_MODULE_HELPER(msgctl); 26388633SalfredSYSCALL_MODULE_HELPER(msgget); 26488633SalfredSYSCALL_MODULE_HELPER(msgsnd); 26588633SalfredSYSCALL_MODULE_HELPER(msgrcv); 26669449Salfred 26771038SdesDECLARE_MODULE(sysvmsg, sysvmsg_mod, 26869449Salfred SI_SUB_SYSV_MSG, SI_ORDER_FIRST); 26971038SdesMODULE_VERSION(sysvmsg, 1); 27069449Salfred 2712729Sdfr/* 2722729Sdfr * Entry point for all MSG calls 27382607Sdillon * 27482607Sdillon * MPSAFE 2752729Sdfr */ 2762729Sdfrint 27783366Sjulianmsgsys(td, uap) 27883366Sjulian struct thread *td; 27911626Sbde /* XXX actually varargs. */ 28011626Sbde struct msgsys_args /* { 28111626Sbde u_int which; 28211626Sbde int a2; 28311626Sbde int a3; 28411626Sbde int a4; 28511626Sbde int a5; 28611626Sbde int a6; 28711626Sbde } */ *uap; 2882729Sdfr{ 28982607Sdillon int error; 2902729Sdfr 29191703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 29291703Sjhb return (ENOSYS); 29391703Sjhb if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) 29491703Sjhb return (EINVAL); 29582607Sdillon mtx_lock(&Giant); 29683366Sjulian error = (*msgcalls[uap->which])(td, &uap->a2); 29782607Sdillon mtx_unlock(&Giant); 29882607Sdillon return (error); 2992729Sdfr} 3002729Sdfr 3012729Sdfrstatic void 3022729Sdfrmsg_freehdr(msghdr) 3032729Sdfr struct msg *msghdr; 3042729Sdfr{ 3052729Sdfr while (msghdr->msg_ts > 0) { 3062729Sdfr short next; 3072729Sdfr if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 3082729Sdfr panic("msghdr->msg_spot out of range"); 3092729Sdfr next = msgmaps[msghdr->msg_spot].next; 3102729Sdfr msgmaps[msghdr->msg_spot].next = free_msgmaps; 3112729Sdfr free_msgmaps = msghdr->msg_spot; 3122729Sdfr nfree_msgmaps++; 3132729Sdfr msghdr->msg_spot = next; 3142729Sdfr if (msghdr->msg_ts >= msginfo.msgssz) 3152729Sdfr msghdr->msg_ts -= msginfo.msgssz; 3162729Sdfr else 3172729Sdfr msghdr->msg_ts = 0; 3182729Sdfr } 3192729Sdfr if (msghdr->msg_spot != -1) 3202729Sdfr panic("msghdr->msg_spot != -1"); 3212729Sdfr msghdr->msg_next = free_msghdrs; 3222729Sdfr free_msghdrs = msghdr; 3232729Sdfr} 3242729Sdfr 32512866Speter#ifndef _SYS_SYSPROTO_H_ 3262729Sdfrstruct msgctl_args { 3272729Sdfr int msqid; 3282729Sdfr int cmd; 32912866Speter struct msqid_ds *buf; 3302729Sdfr}; 33112866Speter#endif 3322729Sdfr 33382607Sdillon/* 33482607Sdillon * MPSAFE 33582607Sdillon */ 33612866Speterint 33783366Sjulianmsgctl(td, uap) 33883366Sjulian struct thread *td; 3392729Sdfr register struct msgctl_args *uap; 3402729Sdfr{ 3412729Sdfr int msqid = uap->msqid; 3422729Sdfr int cmd = uap->cmd; 34312866Speter struct msqid_ds *user_msqptr = uap->buf; 34482607Sdillon int rval, error; 3452729Sdfr struct msqid_ds msqbuf; 3462729Sdfr register struct msqid_ds *msqptr; 3472729Sdfr 3482729Sdfr#ifdef MSG_DEBUG_OK 3492729Sdfr printf("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr); 3502729Sdfr#endif 35191703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 35291703Sjhb return (ENOSYS); 35391703Sjhb 35482607Sdillon mtx_lock(&Giant); 3552729Sdfr msqid = IPCID_TO_IX(msqid); 3562729Sdfr 3572729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 3582729Sdfr#ifdef MSG_DEBUG_OK 3592729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 3602729Sdfr msginfo.msgmni); 3612729Sdfr#endif 36282607Sdillon error = EINVAL; 36382607Sdillon goto done2; 3642729Sdfr } 3652729Sdfr 3662729Sdfr msqptr = &msqids[msqid]; 3672729Sdfr 3682729Sdfr if (msqptr->msg_qbytes == 0) { 3692729Sdfr#ifdef MSG_DEBUG_OK 3702729Sdfr printf("no such msqid\n"); 3712729Sdfr#endif 37282607Sdillon error = EINVAL; 37382607Sdillon goto done2; 3742729Sdfr } 3752729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 3762729Sdfr#ifdef MSG_DEBUG_OK 3772729Sdfr printf("wrong sequence number\n"); 3782729Sdfr#endif 37982607Sdillon error = EINVAL; 38082607Sdillon goto done2; 3812729Sdfr } 3822729Sdfr 38382607Sdillon error = 0; 3842729Sdfr rval = 0; 3852729Sdfr 3862729Sdfr switch (cmd) { 3872729Sdfr 3882729Sdfr case IPC_RMID: 3892729Sdfr { 3902729Sdfr struct msg *msghdr; 39183366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 39282607Sdillon goto done2; 3932729Sdfr /* Free the message headers */ 3942729Sdfr msghdr = msqptr->msg_first; 3952729Sdfr while (msghdr != NULL) { 3962729Sdfr struct msg *msghdr_tmp; 3972729Sdfr 3982729Sdfr /* Free the segments of each message */ 3992729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 4002729Sdfr msqptr->msg_qnum--; 4012729Sdfr msghdr_tmp = msghdr; 4022729Sdfr msghdr = msghdr->msg_next; 4032729Sdfr msg_freehdr(msghdr_tmp); 4042729Sdfr } 4052729Sdfr 4062729Sdfr if (msqptr->msg_cbytes != 0) 4072729Sdfr panic("msg_cbytes is screwed up"); 4082729Sdfr if (msqptr->msg_qnum != 0) 4092729Sdfr panic("msg_qnum is screwed up"); 4102729Sdfr 4112729Sdfr msqptr->msg_qbytes = 0; /* Mark it as free */ 4122729Sdfr 413100511Salfred wakeup(msqptr); 4142729Sdfr } 4152729Sdfr 4162729Sdfr break; 4172729Sdfr 4182729Sdfr case IPC_SET: 41983366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 42082607Sdillon goto done2; 42182607Sdillon if ((error = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0) 42282607Sdillon goto done2; 42343426Sphk if (msqbuf.msg_qbytes > msqptr->msg_qbytes) { 42493593Sjhb error = suser(td); 42582607Sdillon if (error) 42682607Sdillon goto done2; 42743426Sphk } 4282729Sdfr if (msqbuf.msg_qbytes > msginfo.msgmnb) { 4292729Sdfr#ifdef MSG_DEBUG_OK 4302729Sdfr printf("can't increase msg_qbytes beyond %d (truncating)\n", 4312729Sdfr msginfo.msgmnb); 4322729Sdfr#endif 4332729Sdfr msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 4342729Sdfr } 4352729Sdfr if (msqbuf.msg_qbytes == 0) { 4362729Sdfr#ifdef MSG_DEBUG_OK 4372729Sdfr printf("can't reduce msg_qbytes to 0\n"); 4382729Sdfr#endif 43982607Sdillon error = EINVAL; /* non-standard errno! */ 44082607Sdillon goto done2; 4412729Sdfr } 4422729Sdfr msqptr->msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */ 4432729Sdfr msqptr->msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */ 4442729Sdfr msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 4452729Sdfr (msqbuf.msg_perm.mode & 0777); 4462729Sdfr msqptr->msg_qbytes = msqbuf.msg_qbytes; 44734961Sphk msqptr->msg_ctime = time_second; 4482729Sdfr break; 4492729Sdfr 4502729Sdfr case IPC_STAT: 45183366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 4522729Sdfr#ifdef MSG_DEBUG_OK 4532729Sdfr printf("requester doesn't have read access\n"); 4542729Sdfr#endif 45582607Sdillon goto done2; 4562729Sdfr } 457100511Salfred error = copyout(msqptr, user_msqptr, sizeof(struct msqid_ds)); 4582729Sdfr break; 4592729Sdfr 4602729Sdfr default: 4612729Sdfr#ifdef MSG_DEBUG_OK 4622729Sdfr printf("invalid command %d\n", cmd); 4632729Sdfr#endif 46482607Sdillon error = EINVAL; 46582607Sdillon goto done2; 4662729Sdfr } 4672729Sdfr 46882607Sdillon if (error == 0) 46983366Sjulian td->td_retval[0] = rval; 47082607Sdillondone2: 47182607Sdillon mtx_unlock(&Giant); 47282607Sdillon return(error); 4732729Sdfr} 4742729Sdfr 47512866Speter#ifndef _SYS_SYSPROTO_H_ 4762729Sdfrstruct msgget_args { 4772729Sdfr key_t key; 4782729Sdfr int msgflg; 4792729Sdfr}; 48012866Speter#endif 4812729Sdfr 48282607Sdillon/* 48382607Sdillon * MPSAFE 48482607Sdillon */ 48512866Speterint 48683366Sjulianmsgget(td, uap) 48783366Sjulian struct thread *td; 4882729Sdfr register struct msgget_args *uap; 4892729Sdfr{ 49082607Sdillon int msqid, error = 0; 4912729Sdfr int key = uap->key; 4922729Sdfr int msgflg = uap->msgflg; 49391703Sjhb struct ucred *cred = td->td_ucred; 4942836Sdg register struct msqid_ds *msqptr = NULL; 4952729Sdfr 4962729Sdfr#ifdef MSG_DEBUG_OK 4972729Sdfr printf("msgget(0x%x, 0%o)\n", key, msgflg); 4982729Sdfr#endif 4992729Sdfr 50091703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 50191703Sjhb return (ENOSYS); 50291703Sjhb 50382607Sdillon mtx_lock(&Giant); 5042729Sdfr if (key != IPC_PRIVATE) { 5052729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 5062729Sdfr msqptr = &msqids[msqid]; 5072729Sdfr if (msqptr->msg_qbytes != 0 && 5082729Sdfr msqptr->msg_perm.key == key) 5092729Sdfr break; 5102729Sdfr } 5112729Sdfr if (msqid < msginfo.msgmni) { 5122729Sdfr#ifdef MSG_DEBUG_OK 5132729Sdfr printf("found public key\n"); 5142729Sdfr#endif 5152729Sdfr if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 5162729Sdfr#ifdef MSG_DEBUG_OK 5172729Sdfr printf("not exclusive\n"); 5182729Sdfr#endif 51982607Sdillon error = EEXIST; 52082607Sdillon goto done2; 5212729Sdfr } 52283366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, msgflg & 0700 ))) { 5232729Sdfr#ifdef MSG_DEBUG_OK 5242729Sdfr printf("requester doesn't have 0%o access\n", 5252729Sdfr msgflg & 0700); 5262729Sdfr#endif 52782607Sdillon goto done2; 5282729Sdfr } 5292729Sdfr goto found; 5302729Sdfr } 5312729Sdfr } 5322729Sdfr 5332729Sdfr#ifdef MSG_DEBUG_OK 5342729Sdfr printf("need to allocate the msqid_ds\n"); 5352729Sdfr#endif 5362729Sdfr if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 5372729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 5382729Sdfr /* 5392729Sdfr * Look for an unallocated and unlocked msqid_ds. 5402729Sdfr * msqid_ds's can be locked by msgsnd or msgrcv while 5412729Sdfr * they are copying the message in/out. We can't 5422729Sdfr * re-use the entry until they release it. 5432729Sdfr */ 5442729Sdfr msqptr = &msqids[msqid]; 5452729Sdfr if (msqptr->msg_qbytes == 0 && 5462729Sdfr (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 5472729Sdfr break; 5482729Sdfr } 5492729Sdfr if (msqid == msginfo.msgmni) { 5502729Sdfr#ifdef MSG_DEBUG_OK 5512729Sdfr printf("no more msqid_ds's available\n"); 5522729Sdfr#endif 55382607Sdillon error = ENOSPC; 55482607Sdillon goto done2; 5552729Sdfr } 5562729Sdfr#ifdef MSG_DEBUG_OK 5572729Sdfr printf("msqid %d is available\n", msqid); 5582729Sdfr#endif 5592729Sdfr msqptr->msg_perm.key = key; 5602729Sdfr msqptr->msg_perm.cuid = cred->cr_uid; 5612729Sdfr msqptr->msg_perm.uid = cred->cr_uid; 5622729Sdfr msqptr->msg_perm.cgid = cred->cr_gid; 5632729Sdfr msqptr->msg_perm.gid = cred->cr_gid; 5642729Sdfr msqptr->msg_perm.mode = (msgflg & 0777); 5652729Sdfr /* Make sure that the returned msqid is unique */ 5662729Sdfr msqptr->msg_perm.seq++; 5672729Sdfr msqptr->msg_first = NULL; 5682729Sdfr msqptr->msg_last = NULL; 5692729Sdfr msqptr->msg_cbytes = 0; 5702729Sdfr msqptr->msg_qnum = 0; 5712729Sdfr msqptr->msg_qbytes = msginfo.msgmnb; 5722729Sdfr msqptr->msg_lspid = 0; 5732729Sdfr msqptr->msg_lrpid = 0; 5742729Sdfr msqptr->msg_stime = 0; 5752729Sdfr msqptr->msg_rtime = 0; 57634961Sphk msqptr->msg_ctime = time_second; 5772729Sdfr } else { 5782729Sdfr#ifdef MSG_DEBUG_OK 5792729Sdfr printf("didn't find it and wasn't asked to create it\n"); 5802729Sdfr#endif 58182607Sdillon error = ENOENT; 58282607Sdillon goto done2; 5832729Sdfr } 5842729Sdfr 5852729Sdfrfound: 5862729Sdfr /* Construct the unique msqid */ 58783366Sjulian td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 58882607Sdillondone2: 58982607Sdillon mtx_unlock(&Giant); 59082607Sdillon return (error); 5912729Sdfr} 5922729Sdfr 59312866Speter#ifndef _SYS_SYSPROTO_H_ 5942729Sdfrstruct msgsnd_args { 5952729Sdfr int msqid; 59612866Speter void *msgp; 5972729Sdfr size_t msgsz; 5982729Sdfr int msgflg; 5992729Sdfr}; 60012866Speter#endif 6012729Sdfr 60282607Sdillon/* 60382607Sdillon * MPSAFE 60482607Sdillon */ 60512866Speterint 60683366Sjulianmsgsnd(td, uap) 60783366Sjulian struct thread *td; 6082729Sdfr register struct msgsnd_args *uap; 6092729Sdfr{ 6102729Sdfr int msqid = uap->msqid; 61112866Speter void *user_msgp = uap->msgp; 6122729Sdfr size_t msgsz = uap->msgsz; 6132729Sdfr int msgflg = uap->msgflg; 61482607Sdillon int segs_needed, error = 0; 6152729Sdfr register struct msqid_ds *msqptr; 6162729Sdfr register struct msg *msghdr; 6172729Sdfr short next; 6182729Sdfr 6192729Sdfr#ifdef MSG_DEBUG_OK 6202729Sdfr printf("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 6212729Sdfr msgflg); 6222729Sdfr#endif 62391703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 62491703Sjhb return (ENOSYS); 62591703Sjhb 62682607Sdillon mtx_lock(&Giant); 6272729Sdfr msqid = IPCID_TO_IX(msqid); 6282729Sdfr 6292729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 6302729Sdfr#ifdef MSG_DEBUG_OK 6312729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 6322729Sdfr msginfo.msgmni); 6332729Sdfr#endif 63482607Sdillon error = EINVAL; 63582607Sdillon goto done2; 6362729Sdfr } 6372729Sdfr 6382729Sdfr msqptr = &msqids[msqid]; 6392729Sdfr if (msqptr->msg_qbytes == 0) { 6402729Sdfr#ifdef MSG_DEBUG_OK 6412729Sdfr printf("no such message queue id\n"); 6422729Sdfr#endif 64382607Sdillon error = EINVAL; 64482607Sdillon goto done2; 6452729Sdfr } 6462729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 6472729Sdfr#ifdef MSG_DEBUG_OK 6482729Sdfr printf("wrong sequence number\n"); 6492729Sdfr#endif 65082607Sdillon error = EINVAL; 65182607Sdillon goto done2; 6522729Sdfr } 6532729Sdfr 65483366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_W))) { 6552729Sdfr#ifdef MSG_DEBUG_OK 6562729Sdfr printf("requester doesn't have write access\n"); 6572729Sdfr#endif 65882607Sdillon goto done2; 6592729Sdfr } 6602729Sdfr 6612729Sdfr segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 6622729Sdfr#ifdef MSG_DEBUG_OK 6632729Sdfr printf("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 6642729Sdfr segs_needed); 6652729Sdfr#endif 6662729Sdfr for (;;) { 6672729Sdfr int need_more_resources = 0; 6682729Sdfr 6692729Sdfr /* 6702729Sdfr * check msgsz 6712729Sdfr * (inside this loop in case msg_qbytes changes while we sleep) 6722729Sdfr */ 6732729Sdfr 6742836Sdg if (msgsz > msqptr->msg_qbytes) { 6752729Sdfr#ifdef MSG_DEBUG_OK 6762729Sdfr printf("msgsz > msqptr->msg_qbytes\n"); 6772729Sdfr#endif 67882607Sdillon error = EINVAL; 67982607Sdillon goto done2; 6802729Sdfr } 6812729Sdfr 6822729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) { 6832729Sdfr#ifdef MSG_DEBUG_OK 6842729Sdfr printf("msqid is locked\n"); 6852729Sdfr#endif 6862729Sdfr need_more_resources = 1; 6872729Sdfr } 6882729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) { 6892729Sdfr#ifdef MSG_DEBUG_OK 6902729Sdfr printf("msgsz + msg_cbytes > msg_qbytes\n"); 6912729Sdfr#endif 6922729Sdfr need_more_resources = 1; 6932729Sdfr } 6942729Sdfr if (segs_needed > nfree_msgmaps) { 6952729Sdfr#ifdef MSG_DEBUG_OK 6962729Sdfr printf("segs_needed > nfree_msgmaps\n"); 6972729Sdfr#endif 6982729Sdfr need_more_resources = 1; 6992729Sdfr } 7002729Sdfr if (free_msghdrs == NULL) { 7012729Sdfr#ifdef MSG_DEBUG_OK 7022729Sdfr printf("no more msghdrs\n"); 7032729Sdfr#endif 7042729Sdfr need_more_resources = 1; 7052729Sdfr } 7062729Sdfr 7072729Sdfr if (need_more_resources) { 7082729Sdfr int we_own_it; 7092729Sdfr 7102729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 7112729Sdfr#ifdef MSG_DEBUG_OK 7122729Sdfr printf("need more resources but caller doesn't want to wait\n"); 7132729Sdfr#endif 71482607Sdillon error = EAGAIN; 71582607Sdillon goto done2; 7162729Sdfr } 7172729Sdfr 7182729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 7192729Sdfr#ifdef MSG_DEBUG_OK 7202729Sdfr printf("we don't own the msqid_ds\n"); 7212729Sdfr#endif 7222729Sdfr we_own_it = 0; 7232729Sdfr } else { 7242729Sdfr /* Force later arrivals to wait for our 7252729Sdfr request */ 7262729Sdfr#ifdef MSG_DEBUG_OK 7272729Sdfr printf("we own the msqid_ds\n"); 7282729Sdfr#endif 7292729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 7302729Sdfr we_own_it = 1; 7312729Sdfr } 7322729Sdfr#ifdef MSG_DEBUG_OK 7332729Sdfr printf("goodnight\n"); 7342729Sdfr#endif 735100511Salfred error = tsleep(msqptr, (PZERO - 4) | PCATCH, 7362729Sdfr "msgwait", 0); 7372729Sdfr#ifdef MSG_DEBUG_OK 73882607Sdillon printf("good morning, error=%d\n", error); 7392729Sdfr#endif 7402729Sdfr if (we_own_it) 7412729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 74282607Sdillon if (error != 0) { 7432729Sdfr#ifdef MSG_DEBUG_OK 7442729Sdfr printf("msgsnd: interrupted system call\n"); 7452729Sdfr#endif 74682607Sdillon error = EINTR; 74782607Sdillon goto done2; 7482729Sdfr } 7492729Sdfr 7502729Sdfr /* 7512729Sdfr * Make sure that the msq queue still exists 7522729Sdfr */ 7532729Sdfr 7542729Sdfr if (msqptr->msg_qbytes == 0) { 7552729Sdfr#ifdef MSG_DEBUG_OK 7562729Sdfr printf("msqid deleted\n"); 7572729Sdfr#endif 75882607Sdillon error = EIDRM; 75982607Sdillon goto done2; 7602729Sdfr } 7612729Sdfr 7622729Sdfr } else { 7632729Sdfr#ifdef MSG_DEBUG_OK 7642729Sdfr printf("got all the resources that we need\n"); 7652729Sdfr#endif 7662729Sdfr break; 7672729Sdfr } 7682729Sdfr } 7692729Sdfr 7702729Sdfr /* 7712729Sdfr * We have the resources that we need. 7722729Sdfr * Make sure! 7732729Sdfr */ 7742729Sdfr 7752729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) 7762729Sdfr panic("msg_perm.mode & MSG_LOCKED"); 7772729Sdfr if (segs_needed > nfree_msgmaps) 7782729Sdfr panic("segs_needed > nfree_msgmaps"); 7792729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) 7802729Sdfr panic("msgsz + msg_cbytes > msg_qbytes"); 7812729Sdfr if (free_msghdrs == NULL) 7822729Sdfr panic("no more msghdrs"); 7832729Sdfr 7842729Sdfr /* 7852729Sdfr * Re-lock the msqid_ds in case we page-fault when copying in the 7862729Sdfr * message 7872729Sdfr */ 7882729Sdfr 7892729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 7902729Sdfr panic("msqid_ds is already locked"); 7912729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 7922729Sdfr 7932729Sdfr /* 7942729Sdfr * Allocate a message header 7952729Sdfr */ 7962729Sdfr 7972729Sdfr msghdr = free_msghdrs; 7982729Sdfr free_msghdrs = msghdr->msg_next; 7992729Sdfr msghdr->msg_spot = -1; 8002729Sdfr msghdr->msg_ts = msgsz; 8012729Sdfr 8022729Sdfr /* 8032729Sdfr * Allocate space for the message 8042729Sdfr */ 8052729Sdfr 8062729Sdfr while (segs_needed > 0) { 8072729Sdfr if (nfree_msgmaps <= 0) 8082729Sdfr panic("not enough msgmaps"); 8092729Sdfr if (free_msgmaps == -1) 8102729Sdfr panic("nil free_msgmaps"); 8112729Sdfr next = free_msgmaps; 8122729Sdfr if (next <= -1) 8132729Sdfr panic("next too low #1"); 8142729Sdfr if (next >= msginfo.msgseg) 8152729Sdfr panic("next out of range #1"); 8162729Sdfr#ifdef MSG_DEBUG_OK 8172729Sdfr printf("allocating segment %d to message\n", next); 8182729Sdfr#endif 8192729Sdfr free_msgmaps = msgmaps[next].next; 8202729Sdfr nfree_msgmaps--; 8212729Sdfr msgmaps[next].next = msghdr->msg_spot; 8222729Sdfr msghdr->msg_spot = next; 8232729Sdfr segs_needed--; 8242729Sdfr } 8252729Sdfr 8262729Sdfr /* 8272729Sdfr * Copy in the message type 8282729Sdfr */ 8292729Sdfr 83082607Sdillon if ((error = copyin(user_msgp, &msghdr->msg_type, 8312729Sdfr sizeof(msghdr->msg_type))) != 0) { 8322729Sdfr#ifdef MSG_DEBUG_OK 83382607Sdillon printf("error %d copying the message type\n", error); 8342729Sdfr#endif 8352729Sdfr msg_freehdr(msghdr); 8362729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 837100511Salfred wakeup(msqptr); 83882607Sdillon goto done2; 8392729Sdfr } 84017971Sbde user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 8412729Sdfr 8422729Sdfr /* 8432729Sdfr * Validate the message type 8442729Sdfr */ 8452729Sdfr 8462729Sdfr if (msghdr->msg_type < 1) { 8472729Sdfr msg_freehdr(msghdr); 8482729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 849100511Salfred wakeup(msqptr); 8502729Sdfr#ifdef MSG_DEBUG_OK 8512729Sdfr printf("mtype (%d) < 1\n", msghdr->msg_type); 8522729Sdfr#endif 85382607Sdillon error = EINVAL; 85482607Sdillon goto done2; 8552729Sdfr } 8562729Sdfr 8572729Sdfr /* 8582729Sdfr * Copy in the message body 8592729Sdfr */ 8602729Sdfr 8612729Sdfr next = msghdr->msg_spot; 8622729Sdfr while (msgsz > 0) { 8632729Sdfr size_t tlen; 8642729Sdfr if (msgsz > msginfo.msgssz) 8652729Sdfr tlen = msginfo.msgssz; 8662729Sdfr else 8672729Sdfr tlen = msgsz; 8682729Sdfr if (next <= -1) 8692729Sdfr panic("next too low #2"); 8702729Sdfr if (next >= msginfo.msgseg) 8712729Sdfr panic("next out of range #2"); 87282607Sdillon if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 8732729Sdfr tlen)) != 0) { 8742729Sdfr#ifdef MSG_DEBUG_OK 87582607Sdillon printf("error %d copying in message segment\n", error); 8762729Sdfr#endif 8772729Sdfr msg_freehdr(msghdr); 8782729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 879100511Salfred wakeup(msqptr); 88082607Sdillon goto done2; 8812729Sdfr } 8822729Sdfr msgsz -= tlen; 88317971Sbde user_msgp = (char *)user_msgp + tlen; 8842729Sdfr next = msgmaps[next].next; 8852729Sdfr } 8862729Sdfr if (next != -1) 8872729Sdfr panic("didn't use all the msg segments"); 8882729Sdfr 8892729Sdfr /* 8902729Sdfr * We've got the message. Unlock the msqid_ds. 8912729Sdfr */ 8922729Sdfr 8932729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 8942729Sdfr 8952729Sdfr /* 8962729Sdfr * Make sure that the msqid_ds is still allocated. 8972729Sdfr */ 8982729Sdfr 8992729Sdfr if (msqptr->msg_qbytes == 0) { 9002729Sdfr msg_freehdr(msghdr); 901100511Salfred wakeup(msqptr); 90282607Sdillon error = EIDRM; 90382607Sdillon goto done2; 9042729Sdfr } 9052729Sdfr 9062729Sdfr /* 9072729Sdfr * Put the message into the queue 9082729Sdfr */ 9092729Sdfr 9102729Sdfr if (msqptr->msg_first == NULL) { 9112729Sdfr msqptr->msg_first = msghdr; 9122729Sdfr msqptr->msg_last = msghdr; 9132729Sdfr } else { 9142729Sdfr msqptr->msg_last->msg_next = msghdr; 9152729Sdfr msqptr->msg_last = msghdr; 9162729Sdfr } 9172729Sdfr msqptr->msg_last->msg_next = NULL; 9182729Sdfr 9192729Sdfr msqptr->msg_cbytes += msghdr->msg_ts; 9202729Sdfr msqptr->msg_qnum++; 92183366Sjulian msqptr->msg_lspid = td->td_proc->p_pid; 92234961Sphk msqptr->msg_stime = time_second; 9232729Sdfr 924100511Salfred wakeup(msqptr); 92583366Sjulian td->td_retval[0] = 0; 92682607Sdillondone2: 92782607Sdillon mtx_unlock(&Giant); 92882607Sdillon return (error); 9292729Sdfr} 9302729Sdfr 93112866Speter#ifndef _SYS_SYSPROTO_H_ 9322729Sdfrstruct msgrcv_args { 9332729Sdfr int msqid; 9342729Sdfr void *msgp; 9352729Sdfr size_t msgsz; 9362729Sdfr long msgtyp; 9372729Sdfr int msgflg; 9382729Sdfr}; 93912866Speter#endif 9402729Sdfr 94182607Sdillon/* 94282607Sdillon * MPSAFE 94382607Sdillon */ 94412866Speterint 94583366Sjulianmsgrcv(td, uap) 94683366Sjulian struct thread *td; 9472729Sdfr register struct msgrcv_args *uap; 9482729Sdfr{ 9492729Sdfr int msqid = uap->msqid; 9502729Sdfr void *user_msgp = uap->msgp; 9512729Sdfr size_t msgsz = uap->msgsz; 9522729Sdfr long msgtyp = uap->msgtyp; 9532729Sdfr int msgflg = uap->msgflg; 9542729Sdfr size_t len; 9552729Sdfr register struct msqid_ds *msqptr; 9562729Sdfr register struct msg *msghdr; 95782607Sdillon int error = 0; 9582729Sdfr short next; 9592729Sdfr 9602729Sdfr#ifdef MSG_DEBUG_OK 9612729Sdfr printf("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 9622729Sdfr msgsz, msgtyp, msgflg); 9632729Sdfr#endif 9642729Sdfr 96591703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 96691703Sjhb return (ENOSYS); 96791703Sjhb 96882607Sdillon mtx_lock(&Giant); 9692729Sdfr msqid = IPCID_TO_IX(msqid); 9702729Sdfr 9712729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 9722729Sdfr#ifdef MSG_DEBUG_OK 9732729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 9742729Sdfr msginfo.msgmni); 9752729Sdfr#endif 97682607Sdillon error = EINVAL; 97782607Sdillon goto done2; 9782729Sdfr } 9792729Sdfr 9802729Sdfr msqptr = &msqids[msqid]; 9812729Sdfr if (msqptr->msg_qbytes == 0) { 9822729Sdfr#ifdef MSG_DEBUG_OK 9832729Sdfr printf("no such message queue id\n"); 9842729Sdfr#endif 98582607Sdillon error = EINVAL; 98682607Sdillon goto done2; 9872729Sdfr } 9882729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 9892729Sdfr#ifdef MSG_DEBUG_OK 9902729Sdfr printf("wrong sequence number\n"); 9912729Sdfr#endif 99282607Sdillon error = EINVAL; 99382607Sdillon goto done2; 9942729Sdfr } 9952729Sdfr 99683366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 9972729Sdfr#ifdef MSG_DEBUG_OK 9982729Sdfr printf("requester doesn't have read access\n"); 9992729Sdfr#endif 100082607Sdillon goto done2; 10012729Sdfr } 10022729Sdfr 10032729Sdfr msghdr = NULL; 10042729Sdfr while (msghdr == NULL) { 10052729Sdfr if (msgtyp == 0) { 10062729Sdfr msghdr = msqptr->msg_first; 10072729Sdfr if (msghdr != NULL) { 10082729Sdfr if (msgsz < msghdr->msg_ts && 10092729Sdfr (msgflg & MSG_NOERROR) == 0) { 10102729Sdfr#ifdef MSG_DEBUG_OK 10112729Sdfr printf("first message on the queue is too big (want %d, got %d)\n", 10122729Sdfr msgsz, msghdr->msg_ts); 10132729Sdfr#endif 101482607Sdillon error = E2BIG; 101582607Sdillon goto done2; 10162729Sdfr } 10172729Sdfr if (msqptr->msg_first == msqptr->msg_last) { 10182729Sdfr msqptr->msg_first = NULL; 10192729Sdfr msqptr->msg_last = NULL; 10202729Sdfr } else { 10212729Sdfr msqptr->msg_first = msghdr->msg_next; 10222729Sdfr if (msqptr->msg_first == NULL) 10232729Sdfr panic("msg_first/last screwed up #1"); 10242729Sdfr } 10252729Sdfr } 10262729Sdfr } else { 10272729Sdfr struct msg *previous; 10282729Sdfr struct msg **prev; 10292729Sdfr 10302729Sdfr previous = NULL; 10312729Sdfr prev = &(msqptr->msg_first); 10322729Sdfr while ((msghdr = *prev) != NULL) { 10332729Sdfr /* 10342729Sdfr * Is this message's type an exact match or is 10352729Sdfr * this message's type less than or equal to 10362729Sdfr * the absolute value of a negative msgtyp? 10372729Sdfr * Note that the second half of this test can 10382729Sdfr * NEVER be true if msgtyp is positive since 10392729Sdfr * msg_type is always positive! 10402729Sdfr */ 10412729Sdfr 10422729Sdfr if (msgtyp == msghdr->msg_type || 10432729Sdfr msghdr->msg_type <= -msgtyp) { 10442729Sdfr#ifdef MSG_DEBUG_OK 10452729Sdfr printf("found message type %d, requested %d\n", 10462729Sdfr msghdr->msg_type, msgtyp); 10472729Sdfr#endif 10482729Sdfr if (msgsz < msghdr->msg_ts && 10492729Sdfr (msgflg & MSG_NOERROR) == 0) { 10502729Sdfr#ifdef MSG_DEBUG_OK 10512729Sdfr printf("requested message on the queue is too big (want %d, got %d)\n", 10522729Sdfr msgsz, msghdr->msg_ts); 10532729Sdfr#endif 105482607Sdillon error = E2BIG; 105582607Sdillon goto done2; 10562729Sdfr } 10572729Sdfr *prev = msghdr->msg_next; 10582729Sdfr if (msghdr == msqptr->msg_last) { 10592729Sdfr if (previous == NULL) { 10602729Sdfr if (prev != 10612729Sdfr &msqptr->msg_first) 10622729Sdfr panic("msg_first/last screwed up #2"); 10632729Sdfr msqptr->msg_first = 10642729Sdfr NULL; 10652729Sdfr msqptr->msg_last = 10662729Sdfr NULL; 10672729Sdfr } else { 10682729Sdfr if (prev == 10692729Sdfr &msqptr->msg_first) 10702729Sdfr panic("msg_first/last screwed up #3"); 10712729Sdfr msqptr->msg_last = 10722729Sdfr previous; 10732729Sdfr } 10742729Sdfr } 10752729Sdfr break; 10762729Sdfr } 10772729Sdfr previous = msghdr; 10782729Sdfr prev = &(msghdr->msg_next); 10792729Sdfr } 10802729Sdfr } 10812729Sdfr 10822729Sdfr /* 10832729Sdfr * We've either extracted the msghdr for the appropriate 10842729Sdfr * message or there isn't one. 10852729Sdfr * If there is one then bail out of this loop. 10862729Sdfr */ 10872729Sdfr 10882729Sdfr if (msghdr != NULL) 10892729Sdfr break; 10902729Sdfr 10912729Sdfr /* 10922729Sdfr * Hmph! No message found. Does the user want to wait? 10932729Sdfr */ 10942729Sdfr 10952729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 10962729Sdfr#ifdef MSG_DEBUG_OK 10972729Sdfr printf("no appropriate message found (msgtyp=%d)\n", 10982729Sdfr msgtyp); 10992729Sdfr#endif 11002729Sdfr /* The SVID says to return ENOMSG. */ 110182607Sdillon error = ENOMSG; 110282607Sdillon goto done2; 11032729Sdfr } 11042729Sdfr 11052729Sdfr /* 11062729Sdfr * Wait for something to happen 11072729Sdfr */ 11082729Sdfr 11092729Sdfr#ifdef MSG_DEBUG_OK 11102729Sdfr printf("msgrcv: goodnight\n"); 11112729Sdfr#endif 1112100511Salfred error = tsleep(msqptr, (PZERO - 4) | PCATCH, "msgwait", 0); 11132729Sdfr#ifdef MSG_DEBUG_OK 111482607Sdillon printf("msgrcv: good morning (error=%d)\n", error); 11152729Sdfr#endif 11162729Sdfr 111782607Sdillon if (error != 0) { 11182729Sdfr#ifdef MSG_DEBUG_OK 11192729Sdfr printf("msgsnd: interrupted system call\n"); 11202729Sdfr#endif 112182607Sdillon error = EINTR; 112282607Sdillon goto done2; 11232729Sdfr } 11242729Sdfr 11252729Sdfr /* 11262729Sdfr * Make sure that the msq queue still exists 11272729Sdfr */ 11282729Sdfr 11292729Sdfr if (msqptr->msg_qbytes == 0 || 11302729Sdfr msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 11312729Sdfr#ifdef MSG_DEBUG_OK 11322729Sdfr printf("msqid deleted\n"); 11332729Sdfr#endif 113482607Sdillon error = EIDRM; 113582607Sdillon goto done2; 11362729Sdfr } 11372729Sdfr } 11382729Sdfr 11392729Sdfr /* 11402729Sdfr * Return the message to the user. 11412729Sdfr * 11422729Sdfr * First, do the bookkeeping (before we risk being interrupted). 11432729Sdfr */ 11442729Sdfr 11452729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 11462729Sdfr msqptr->msg_qnum--; 114783366Sjulian msqptr->msg_lrpid = td->td_proc->p_pid; 114834961Sphk msqptr->msg_rtime = time_second; 11492729Sdfr 11502729Sdfr /* 11512729Sdfr * Make msgsz the actual amount that we'll be returning. 11522729Sdfr * Note that this effectively truncates the message if it is too long 11532729Sdfr * (since msgsz is never increased). 11542729Sdfr */ 11552729Sdfr 11562729Sdfr#ifdef MSG_DEBUG_OK 11572729Sdfr printf("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 11582729Sdfr msghdr->msg_ts); 11592729Sdfr#endif 11602729Sdfr if (msgsz > msghdr->msg_ts) 11612729Sdfr msgsz = msghdr->msg_ts; 11622729Sdfr 11632729Sdfr /* 11642729Sdfr * Return the type to the user. 11652729Sdfr */ 11662729Sdfr 1167100511Salfred error = copyout(&(msghdr->msg_type), user_msgp, 11682729Sdfr sizeof(msghdr->msg_type)); 116982607Sdillon if (error != 0) { 11702729Sdfr#ifdef MSG_DEBUG_OK 117182607Sdillon printf("error (%d) copying out message type\n", error); 11722729Sdfr#endif 11732729Sdfr msg_freehdr(msghdr); 1174100511Salfred wakeup(msqptr); 117582607Sdillon goto done2; 11762729Sdfr } 117717971Sbde user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 11782729Sdfr 11792729Sdfr /* 11802729Sdfr * Return the segments to the user 11812729Sdfr */ 11822729Sdfr 11832729Sdfr next = msghdr->msg_spot; 11842729Sdfr for (len = 0; len < msgsz; len += msginfo.msgssz) { 11852729Sdfr size_t tlen; 11862729Sdfr 118745921Ssada if (msgsz - len > msginfo.msgssz) 11882729Sdfr tlen = msginfo.msgssz; 11892729Sdfr else 119045921Ssada tlen = msgsz - len; 11912729Sdfr if (next <= -1) 11922729Sdfr panic("next too low #3"); 11932729Sdfr if (next >= msginfo.msgseg) 11942729Sdfr panic("next out of range #3"); 1195100511Salfred error = copyout(&msgpool[next * msginfo.msgssz], 11962729Sdfr user_msgp, tlen); 119782607Sdillon if (error != 0) { 11982729Sdfr#ifdef MSG_DEBUG_OK 11992729Sdfr printf("error (%d) copying out message segment\n", 120082607Sdillon error); 12012729Sdfr#endif 12022729Sdfr msg_freehdr(msghdr); 1203100511Salfred wakeup(msqptr); 120482607Sdillon goto done2; 12052729Sdfr } 120617971Sbde user_msgp = (char *)user_msgp + tlen; 12072729Sdfr next = msgmaps[next].next; 12082729Sdfr } 12092729Sdfr 12102729Sdfr /* 12112729Sdfr * Done, return the actual number of bytes copied out. 12122729Sdfr */ 12132729Sdfr 12142729Sdfr msg_freehdr(msghdr); 1215100511Salfred wakeup(msqptr); 121683366Sjulian td->td_retval[0] = msgsz; 121782607Sdillondone2: 121882607Sdillon mtx_unlock(&Giant); 121982607Sdillon return (error); 12202729Sdfr} 122177461Sdd 122277461Sddstatic int 122377461Sddsysctl_msqids(SYSCTL_HANDLER_ARGS) 122477461Sdd{ 122577461Sdd 122677461Sdd return (SYSCTL_OUT(req, msqids, 122777461Sdd sizeof(struct msqid_ds) * msginfo.msgmni)); 122877461Sdd} 122977461Sdd 123077461SddSYSCTL_DECL(_kern_ipc); 123177461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, ""); 123277461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RD, &msginfo.msgmni, 0, ""); 123377461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RD, &msginfo.msgmnb, 0, ""); 123477461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RD, &msginfo.msgtql, 0, ""); 123577461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RD, &msginfo.msgssz, 0, ""); 1236100076SmarkmSYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RD, &msginfo.msgseg, 0, ""); 123777461SddSYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD, 123877461Sdd NULL, 0, sysctl_msqids, "", "Message queue IDs"); 1239