sysv_msg.c revision 12819
112819Sphk/* $Id: sysv_msg.c,v 1.9 1995/10/21 19:49:57 bde Exp $ */ 22729Sdfr 32729Sdfr/* 42729Sdfr * Implementation of SVID messages 52729Sdfr * 62729Sdfr * Author: Daniel Boulet 72729Sdfr * 82729Sdfr * Copyright 1993 Daniel Boulet and RTMX Inc. 92729Sdfr * 102729Sdfr * This system call was implemented by Daniel Boulet under contract from RTMX. 112729Sdfr * 122729Sdfr * Redistribution and use in source forms, with and without modification, 132729Sdfr * are permitted provided that this entire comment appears intact. 142729Sdfr * 152729Sdfr * Redistribution in binary form may occur without any restrictions. 162729Sdfr * Obviously, it would be nice if you gave credit where credit is due 172729Sdfr * but requiring it would be too onerous. 182729Sdfr * 192729Sdfr * This software is provided ``AS IS'' without any warranties of any kind. 202729Sdfr */ 212729Sdfr 222729Sdfr#include <sys/param.h> 232729Sdfr#include <sys/systm.h> 2411626Sbde#include <sys/sysproto.h> 252729Sdfr#include <sys/kernel.h> 262729Sdfr#include <sys/proc.h> 272729Sdfr#include <sys/msg.h> 2811626Sbde#include <sys/sysent.h> 292729Sdfr 3010653Sdgstatic void msginit __P((void *)); 3110358SjulianSYSINIT(sysv_msg, SI_SUB_SYSV_MSG, SI_ORDER_FIRST, msginit, NULL) 3210358Sjulian 332729Sdfr#define MSG_DEBUG 342729Sdfr#undef MSG_DEBUG_OK 352729Sdfr 3611626Sbdestruct msgctl_args; 3711626Sbdestatic int msgctl __P((struct proc *p, struct msgctl_args *uap, int *retval)); 3811626Sbdestruct msgget_args; 3911626Sbdestatic int msgget __P((struct proc *p, struct msgget_args *uap, int *retval)); 4011626Sbdestruct msgsnd_args; 4111626Sbdestatic int msgsnd __P((struct proc *p, struct msgsnd_args *uap, int *retval)); 4211626Sbdestruct msgrcv_args; 4311626Sbdestatic int msgrcv __P((struct proc *p, struct msgrcv_args *uap, int *retval)); 4411626Sbdestatic void msg_freehdr __P((struct msg *msghdr)); 452729Sdfr 4611626Sbde/* XXX casting to (sy_call_t *) is bogus, as usual. */ 4712819Sphkstatic sy_call_t *msgcalls[] = { 4811626Sbde (sy_call_t *)msgctl, (sy_call_t *)msgget, 4911626Sbde (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 5011626Sbde}; 512729Sdfr 5212819Sphkstatic int nfree_msgmaps; /* # of free map entries */ 5312819Sphkstatic short free_msgmaps; /* head of linked list of free map entries */ 5412819Sphkstatic struct msg *free_msghdrs; /* list of free msg headers */ 559759Sbdechar *msgpool; /* MSGMAX byte long msg buffer pool */ 569759Sbdestruct msgmap *msgmaps; /* MSGSEG msgmap structures */ 579759Sbdestruct msg *msghdrs; /* MSGTQL msg headers */ 589759Sbdestruct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 592729Sdfr 602836Sdgvoid 6111626Sbdemsginit(dummy) 6211626Sbde void *dummy; 632729Sdfr{ 642729Sdfr register int i; 652729Sdfr 662729Sdfr /* 672729Sdfr * msginfo.msgssz should be a power of two for efficiency reasons. 682729Sdfr * It is also pretty silly if msginfo.msgssz is less than 8 692729Sdfr * or greater than about 256 so ... 702729Sdfr */ 712729Sdfr 722729Sdfr i = 8; 732729Sdfr while (i < 1024 && i != msginfo.msgssz) 742729Sdfr i <<= 1; 752729Sdfr if (i != msginfo.msgssz) { 762729Sdfr printf("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 772729Sdfr msginfo.msgssz); 782729Sdfr panic("msginfo.msgssz not a small power of 2"); 792729Sdfr } 802729Sdfr 812729Sdfr if (msginfo.msgseg > 32767) { 822729Sdfr printf("msginfo.msgseg=%d\n", msginfo.msgseg); 832729Sdfr panic("msginfo.msgseg > 32767"); 842729Sdfr } 852729Sdfr 862729Sdfr if (msgmaps == NULL) 872729Sdfr panic("msgmaps is NULL"); 882729Sdfr 892729Sdfr for (i = 0; i < msginfo.msgseg; i++) { 902729Sdfr if (i > 0) 912729Sdfr msgmaps[i-1].next = i; 922729Sdfr msgmaps[i].next = -1; /* implies entry is available */ 932729Sdfr } 942729Sdfr free_msgmaps = 0; 952729Sdfr nfree_msgmaps = msginfo.msgseg; 962729Sdfr 972729Sdfr if (msghdrs == NULL) 982729Sdfr panic("msghdrs is NULL"); 992729Sdfr 1002729Sdfr for (i = 0; i < msginfo.msgtql; i++) { 1012729Sdfr msghdrs[i].msg_type = 0; 1022729Sdfr if (i > 0) 1032729Sdfr msghdrs[i-1].msg_next = &msghdrs[i]; 1042729Sdfr msghdrs[i].msg_next = NULL; 1052729Sdfr } 1062729Sdfr free_msghdrs = &msghdrs[0]; 1072729Sdfr 1082729Sdfr if (msqids == NULL) 1092729Sdfr panic("msqids is NULL"); 1102729Sdfr 1112729Sdfr for (i = 0; i < msginfo.msgmni; i++) { 1122729Sdfr msqids[i].msg_qbytes = 0; /* implies entry is available */ 1132729Sdfr msqids[i].msg_perm.seq = 0; /* reset to a known value */ 1142729Sdfr } 1152729Sdfr} 1162729Sdfr 1172729Sdfr/* 1182729Sdfr * Entry point for all MSG calls 1192729Sdfr */ 1202729Sdfrint 1212729Sdfrmsgsys(p, uap, retval) 12211626Sbde struct proc *p; 12311626Sbde /* XXX actually varargs. */ 12411626Sbde struct msgsys_args /* { 12511626Sbde u_int which; 12611626Sbde int a2; 12711626Sbde int a3; 12811626Sbde int a4; 12911626Sbde int a5; 13011626Sbde int a6; 13111626Sbde } */ *uap; 1322729Sdfr int *retval; 1332729Sdfr{ 1342729Sdfr 1352729Sdfr if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) 1362729Sdfr return (EINVAL); 13711626Sbde return ((*msgcalls[uap->which])(p, &uap->a2, retval)); 1382729Sdfr} 1392729Sdfr 1402729Sdfrstatic void 1412729Sdfrmsg_freehdr(msghdr) 1422729Sdfr struct msg *msghdr; 1432729Sdfr{ 1442729Sdfr while (msghdr->msg_ts > 0) { 1452729Sdfr short next; 1462729Sdfr if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 1472729Sdfr panic("msghdr->msg_spot out of range"); 1482729Sdfr next = msgmaps[msghdr->msg_spot].next; 1492729Sdfr msgmaps[msghdr->msg_spot].next = free_msgmaps; 1502729Sdfr free_msgmaps = msghdr->msg_spot; 1512729Sdfr nfree_msgmaps++; 1522729Sdfr msghdr->msg_spot = next; 1532729Sdfr if (msghdr->msg_ts >= msginfo.msgssz) 1542729Sdfr msghdr->msg_ts -= msginfo.msgssz; 1552729Sdfr else 1562729Sdfr msghdr->msg_ts = 0; 1572729Sdfr } 1582729Sdfr if (msghdr->msg_spot != -1) 1592729Sdfr panic("msghdr->msg_spot != -1"); 1602729Sdfr msghdr->msg_next = free_msghdrs; 1612729Sdfr free_msghdrs = msghdr; 1622729Sdfr} 1632729Sdfr 1642729Sdfrstruct msgctl_args { 1652729Sdfr int msqid; 1662729Sdfr int cmd; 1672729Sdfr struct msqid_ds *user_msqptr; 1682729Sdfr}; 1692729Sdfr 17011626Sbdestatic int 1712729Sdfrmsgctl(p, uap, retval) 1722729Sdfr struct proc *p; 1732729Sdfr register struct msgctl_args *uap; 1742729Sdfr int *retval; 1752729Sdfr{ 1762729Sdfr int msqid = uap->msqid; 1772729Sdfr int cmd = uap->cmd; 1782729Sdfr struct msqid_ds *user_msqptr = uap->user_msqptr; 1792729Sdfr struct ucred *cred = p->p_ucred; 1803308Sphk int rval, eval; 1812729Sdfr struct msqid_ds msqbuf; 1822729Sdfr register struct msqid_ds *msqptr; 1832729Sdfr 1842729Sdfr#ifdef MSG_DEBUG_OK 1852729Sdfr printf("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr); 1862729Sdfr#endif 1872729Sdfr 1882729Sdfr msqid = IPCID_TO_IX(msqid); 1892729Sdfr 1902729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 1912729Sdfr#ifdef MSG_DEBUG_OK 1922729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 1932729Sdfr msginfo.msgmni); 1942729Sdfr#endif 1952729Sdfr return(EINVAL); 1962729Sdfr } 1972729Sdfr 1982729Sdfr msqptr = &msqids[msqid]; 1992729Sdfr 2002729Sdfr if (msqptr->msg_qbytes == 0) { 2012729Sdfr#ifdef MSG_DEBUG_OK 2022729Sdfr printf("no such msqid\n"); 2032729Sdfr#endif 2042729Sdfr return(EINVAL); 2052729Sdfr } 2062729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 2072729Sdfr#ifdef MSG_DEBUG_OK 2082729Sdfr printf("wrong sequence number\n"); 2092729Sdfr#endif 2102729Sdfr return(EINVAL); 2112729Sdfr } 2122729Sdfr 2132729Sdfr eval = 0; 2142729Sdfr rval = 0; 2152729Sdfr 2162729Sdfr switch (cmd) { 2172729Sdfr 2182729Sdfr case IPC_RMID: 2192729Sdfr { 2202729Sdfr struct msg *msghdr; 2212729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 2222729Sdfr return(eval); 2232729Sdfr /* Free the message headers */ 2242729Sdfr msghdr = msqptr->msg_first; 2252729Sdfr while (msghdr != NULL) { 2262729Sdfr struct msg *msghdr_tmp; 2272729Sdfr 2282729Sdfr /* Free the segments of each message */ 2292729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 2302729Sdfr msqptr->msg_qnum--; 2312729Sdfr msghdr_tmp = msghdr; 2322729Sdfr msghdr = msghdr->msg_next; 2332729Sdfr msg_freehdr(msghdr_tmp); 2342729Sdfr } 2352729Sdfr 2362729Sdfr if (msqptr->msg_cbytes != 0) 2372729Sdfr panic("msg_cbytes is screwed up"); 2382729Sdfr if (msqptr->msg_qnum != 0) 2392729Sdfr panic("msg_qnum is screwed up"); 2402729Sdfr 2412729Sdfr msqptr->msg_qbytes = 0; /* Mark it as free */ 2422729Sdfr 2432729Sdfr wakeup((caddr_t)msqptr); 2442729Sdfr } 2452729Sdfr 2462729Sdfr break; 2472729Sdfr 2482729Sdfr case IPC_SET: 2492729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 2502729Sdfr return(eval); 2512729Sdfr if ((eval = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0) 2522729Sdfr return(eval); 2532729Sdfr if (msqbuf.msg_qbytes > msqptr->msg_qbytes && cred->cr_uid != 0) 2542729Sdfr return(EPERM); 2552729Sdfr if (msqbuf.msg_qbytes > msginfo.msgmnb) { 2562729Sdfr#ifdef MSG_DEBUG_OK 2572729Sdfr printf("can't increase msg_qbytes beyond %d (truncating)\n", 2582729Sdfr msginfo.msgmnb); 2592729Sdfr#endif 2602729Sdfr msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 2612729Sdfr } 2622729Sdfr if (msqbuf.msg_qbytes == 0) { 2632729Sdfr#ifdef MSG_DEBUG_OK 2642729Sdfr printf("can't reduce msg_qbytes to 0\n"); 2652729Sdfr#endif 2662729Sdfr return(EINVAL); /* non-standard errno! */ 2672729Sdfr } 2682729Sdfr msqptr->msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */ 2692729Sdfr msqptr->msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */ 2702729Sdfr msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 2712729Sdfr (msqbuf.msg_perm.mode & 0777); 2722729Sdfr msqptr->msg_qbytes = msqbuf.msg_qbytes; 2732729Sdfr msqptr->msg_ctime = time.tv_sec; 2742729Sdfr break; 2752729Sdfr 2762729Sdfr case IPC_STAT: 2772729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 2782729Sdfr#ifdef MSG_DEBUG_OK 2792729Sdfr printf("requester doesn't have read access\n"); 2802729Sdfr#endif 2812729Sdfr return(eval); 2822729Sdfr } 2832729Sdfr eval = copyout((caddr_t)msqptr, user_msqptr, 2842729Sdfr sizeof(struct msqid_ds)); 2852729Sdfr break; 2862729Sdfr 2872729Sdfr default: 2882729Sdfr#ifdef MSG_DEBUG_OK 2892729Sdfr printf("invalid command %d\n", cmd); 2902729Sdfr#endif 2912729Sdfr return(EINVAL); 2922729Sdfr } 2932729Sdfr 2942729Sdfr if (eval == 0) 2952729Sdfr *retval = rval; 2962729Sdfr return(eval); 2972729Sdfr} 2982729Sdfr 2992729Sdfrstruct msgget_args { 3002729Sdfr key_t key; 3012729Sdfr int msgflg; 3022729Sdfr}; 3032729Sdfr 30411626Sbdestatic int 3052729Sdfrmsgget(p, uap, retval) 3062729Sdfr struct proc *p; 3072729Sdfr register struct msgget_args *uap; 3082729Sdfr int *retval; 3092729Sdfr{ 3102729Sdfr int msqid, eval; 3112729Sdfr int key = uap->key; 3122729Sdfr int msgflg = uap->msgflg; 3132729Sdfr struct ucred *cred = p->p_ucred; 3142836Sdg register struct msqid_ds *msqptr = NULL; 3152729Sdfr 3162729Sdfr#ifdef MSG_DEBUG_OK 3172729Sdfr printf("msgget(0x%x, 0%o)\n", key, msgflg); 3182729Sdfr#endif 3192729Sdfr 3202729Sdfr if (key != IPC_PRIVATE) { 3212729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 3222729Sdfr msqptr = &msqids[msqid]; 3232729Sdfr if (msqptr->msg_qbytes != 0 && 3242729Sdfr msqptr->msg_perm.key == key) 3252729Sdfr break; 3262729Sdfr } 3272729Sdfr if (msqid < msginfo.msgmni) { 3282729Sdfr#ifdef MSG_DEBUG_OK 3292729Sdfr printf("found public key\n"); 3302729Sdfr#endif 3312729Sdfr if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 3322729Sdfr#ifdef MSG_DEBUG_OK 3332729Sdfr printf("not exclusive\n"); 3342729Sdfr#endif 3352729Sdfr return(EEXIST); 3362729Sdfr } 3372729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, msgflg & 0700 ))) { 3382729Sdfr#ifdef MSG_DEBUG_OK 3392729Sdfr printf("requester doesn't have 0%o access\n", 3402729Sdfr msgflg & 0700); 3412729Sdfr#endif 3422729Sdfr return(eval); 3432729Sdfr } 3442729Sdfr goto found; 3452729Sdfr } 3462729Sdfr } 3472729Sdfr 3482729Sdfr#ifdef MSG_DEBUG_OK 3492729Sdfr printf("need to allocate the msqid_ds\n"); 3502729Sdfr#endif 3512729Sdfr if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 3522729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 3532729Sdfr /* 3542729Sdfr * Look for an unallocated and unlocked msqid_ds. 3552729Sdfr * msqid_ds's can be locked by msgsnd or msgrcv while 3562729Sdfr * they are copying the message in/out. We can't 3572729Sdfr * re-use the entry until they release it. 3582729Sdfr */ 3592729Sdfr msqptr = &msqids[msqid]; 3602729Sdfr if (msqptr->msg_qbytes == 0 && 3612729Sdfr (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 3622729Sdfr break; 3632729Sdfr } 3642729Sdfr if (msqid == msginfo.msgmni) { 3652729Sdfr#ifdef MSG_DEBUG_OK 3662729Sdfr printf("no more msqid_ds's available\n"); 3672729Sdfr#endif 3688876Srgrimes return(ENOSPC); 3692729Sdfr } 3702729Sdfr#ifdef MSG_DEBUG_OK 3712729Sdfr printf("msqid %d is available\n", msqid); 3722729Sdfr#endif 3732729Sdfr msqptr->msg_perm.key = key; 3742729Sdfr msqptr->msg_perm.cuid = cred->cr_uid; 3752729Sdfr msqptr->msg_perm.uid = cred->cr_uid; 3762729Sdfr msqptr->msg_perm.cgid = cred->cr_gid; 3772729Sdfr msqptr->msg_perm.gid = cred->cr_gid; 3782729Sdfr msqptr->msg_perm.mode = (msgflg & 0777); 3792729Sdfr /* Make sure that the returned msqid is unique */ 3802729Sdfr msqptr->msg_perm.seq++; 3812729Sdfr msqptr->msg_first = NULL; 3822729Sdfr msqptr->msg_last = NULL; 3832729Sdfr msqptr->msg_cbytes = 0; 3842729Sdfr msqptr->msg_qnum = 0; 3852729Sdfr msqptr->msg_qbytes = msginfo.msgmnb; 3862729Sdfr msqptr->msg_lspid = 0; 3872729Sdfr msqptr->msg_lrpid = 0; 3882729Sdfr msqptr->msg_stime = 0; 3892729Sdfr msqptr->msg_rtime = 0; 3902729Sdfr msqptr->msg_ctime = time.tv_sec; 3912729Sdfr } else { 3922729Sdfr#ifdef MSG_DEBUG_OK 3932729Sdfr printf("didn't find it and wasn't asked to create it\n"); 3942729Sdfr#endif 3952729Sdfr return(ENOENT); 3962729Sdfr } 3972729Sdfr 3982729Sdfrfound: 3992729Sdfr /* Construct the unique msqid */ 4002729Sdfr *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 4012729Sdfr return(0); 4022729Sdfr} 4032729Sdfr 4042729Sdfrstruct msgsnd_args { 4052729Sdfr int msqid; 4062729Sdfr void *user_msgp; 4072729Sdfr size_t msgsz; 4082729Sdfr int msgflg; 4092729Sdfr}; 4102729Sdfr 41111626Sbdestatic int 4122729Sdfrmsgsnd(p, uap, retval) 4132729Sdfr struct proc *p; 4142729Sdfr register struct msgsnd_args *uap; 4152729Sdfr int *retval; 4162729Sdfr{ 4172729Sdfr int msqid = uap->msqid; 4182729Sdfr void *user_msgp = uap->user_msgp; 4192729Sdfr size_t msgsz = uap->msgsz; 4202729Sdfr int msgflg = uap->msgflg; 4212729Sdfr int segs_needed, eval; 4222729Sdfr struct ucred *cred = p->p_ucred; 4232729Sdfr register struct msqid_ds *msqptr; 4242729Sdfr register struct msg *msghdr; 4252729Sdfr short next; 4262729Sdfr 4272729Sdfr#ifdef MSG_DEBUG_OK 4282729Sdfr printf("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 4292729Sdfr msgflg); 4302729Sdfr#endif 4312729Sdfr 4322729Sdfr msqid = IPCID_TO_IX(msqid); 4332729Sdfr 4342729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 4352729Sdfr#ifdef MSG_DEBUG_OK 4362729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 4372729Sdfr msginfo.msgmni); 4382729Sdfr#endif 4392729Sdfr return(EINVAL); 4402729Sdfr } 4412729Sdfr 4422729Sdfr msqptr = &msqids[msqid]; 4432729Sdfr if (msqptr->msg_qbytes == 0) { 4442729Sdfr#ifdef MSG_DEBUG_OK 4452729Sdfr printf("no such message queue id\n"); 4462729Sdfr#endif 4472729Sdfr return(EINVAL); 4482729Sdfr } 4492729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 4502729Sdfr#ifdef MSG_DEBUG_OK 4512729Sdfr printf("wrong sequence number\n"); 4522729Sdfr#endif 4532729Sdfr return(EINVAL); 4542729Sdfr } 4552729Sdfr 4562729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 4572729Sdfr#ifdef MSG_DEBUG_OK 4582729Sdfr printf("requester doesn't have write access\n"); 4592729Sdfr#endif 4602729Sdfr return(eval); 4612729Sdfr } 4622729Sdfr 4632729Sdfr segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 4642729Sdfr#ifdef MSG_DEBUG_OK 4652729Sdfr printf("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 4662729Sdfr segs_needed); 4672729Sdfr#endif 4682729Sdfr for (;;) { 4692729Sdfr int need_more_resources = 0; 4702729Sdfr 4712729Sdfr /* 4722729Sdfr * check msgsz 4732729Sdfr * (inside this loop in case msg_qbytes changes while we sleep) 4742729Sdfr */ 4752729Sdfr 4762836Sdg if (msgsz > msqptr->msg_qbytes) { 4772729Sdfr#ifdef MSG_DEBUG_OK 4782729Sdfr printf("msgsz > msqptr->msg_qbytes\n"); 4792729Sdfr#endif 4802729Sdfr return(EINVAL); 4812729Sdfr } 4822729Sdfr 4832729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) { 4842729Sdfr#ifdef MSG_DEBUG_OK 4852729Sdfr printf("msqid is locked\n"); 4862729Sdfr#endif 4872729Sdfr need_more_resources = 1; 4882729Sdfr } 4892729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) { 4902729Sdfr#ifdef MSG_DEBUG_OK 4912729Sdfr printf("msgsz + msg_cbytes > msg_qbytes\n"); 4922729Sdfr#endif 4932729Sdfr need_more_resources = 1; 4942729Sdfr } 4952729Sdfr if (segs_needed > nfree_msgmaps) { 4962729Sdfr#ifdef MSG_DEBUG_OK 4972729Sdfr printf("segs_needed > nfree_msgmaps\n"); 4982729Sdfr#endif 4992729Sdfr need_more_resources = 1; 5002729Sdfr } 5012729Sdfr if (free_msghdrs == NULL) { 5022729Sdfr#ifdef MSG_DEBUG_OK 5032729Sdfr printf("no more msghdrs\n"); 5042729Sdfr#endif 5052729Sdfr need_more_resources = 1; 5062729Sdfr } 5072729Sdfr 5082729Sdfr if (need_more_resources) { 5092729Sdfr int we_own_it; 5102729Sdfr 5112729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 5122729Sdfr#ifdef MSG_DEBUG_OK 5132729Sdfr printf("need more resources but caller doesn't want to wait\n"); 5142729Sdfr#endif 5152729Sdfr return(EAGAIN); 5162729Sdfr } 5172729Sdfr 5182729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 5192729Sdfr#ifdef MSG_DEBUG_OK 5202729Sdfr printf("we don't own the msqid_ds\n"); 5212729Sdfr#endif 5222729Sdfr we_own_it = 0; 5232729Sdfr } else { 5242729Sdfr /* Force later arrivals to wait for our 5252729Sdfr request */ 5262729Sdfr#ifdef MSG_DEBUG_OK 5272729Sdfr printf("we own the msqid_ds\n"); 5282729Sdfr#endif 5292729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 5302729Sdfr we_own_it = 1; 5312729Sdfr } 5322729Sdfr#ifdef MSG_DEBUG_OK 5332729Sdfr printf("goodnight\n"); 5342729Sdfr#endif 5352729Sdfr eval = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, 5362729Sdfr "msgwait", 0); 5372729Sdfr#ifdef MSG_DEBUG_OK 5382729Sdfr printf("good morning, eval=%d\n", eval); 5392729Sdfr#endif 5402729Sdfr if (we_own_it) 5412729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 5422729Sdfr if (eval != 0) { 5432729Sdfr#ifdef MSG_DEBUG_OK 5442729Sdfr printf("msgsnd: interrupted system call\n"); 5452729Sdfr#endif 5462729Sdfr return(EINTR); 5472729Sdfr } 5482729Sdfr 5492729Sdfr /* 5502729Sdfr * Make sure that the msq queue still exists 5512729Sdfr */ 5522729Sdfr 5532729Sdfr if (msqptr->msg_qbytes == 0) { 5542729Sdfr#ifdef MSG_DEBUG_OK 5552729Sdfr printf("msqid deleted\n"); 5562729Sdfr#endif 5572729Sdfr /* The SVID says to return EIDRM. */ 5582729Sdfr#ifdef EIDRM 5592729Sdfr return(EIDRM); 5602729Sdfr#else 5612729Sdfr /* Unfortunately, BSD doesn't define that code 5622729Sdfr yet! */ 5632729Sdfr return(EINVAL); 5642729Sdfr#endif 5652729Sdfr } 5662729Sdfr 5672729Sdfr } else { 5682729Sdfr#ifdef MSG_DEBUG_OK 5692729Sdfr printf("got all the resources that we need\n"); 5702729Sdfr#endif 5712729Sdfr break; 5722729Sdfr } 5732729Sdfr } 5742729Sdfr 5752729Sdfr /* 5762729Sdfr * We have the resources that we need. 5772729Sdfr * Make sure! 5782729Sdfr */ 5792729Sdfr 5802729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) 5812729Sdfr panic("msg_perm.mode & MSG_LOCKED"); 5822729Sdfr if (segs_needed > nfree_msgmaps) 5832729Sdfr panic("segs_needed > nfree_msgmaps"); 5842729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) 5852729Sdfr panic("msgsz + msg_cbytes > msg_qbytes"); 5862729Sdfr if (free_msghdrs == NULL) 5872729Sdfr panic("no more msghdrs"); 5882729Sdfr 5892729Sdfr /* 5902729Sdfr * Re-lock the msqid_ds in case we page-fault when copying in the 5912729Sdfr * message 5922729Sdfr */ 5932729Sdfr 5942729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 5952729Sdfr panic("msqid_ds is already locked"); 5962729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 5972729Sdfr 5982729Sdfr /* 5992729Sdfr * Allocate a message header 6002729Sdfr */ 6012729Sdfr 6022729Sdfr msghdr = free_msghdrs; 6032729Sdfr free_msghdrs = msghdr->msg_next; 6042729Sdfr msghdr->msg_spot = -1; 6052729Sdfr msghdr->msg_ts = msgsz; 6062729Sdfr 6072729Sdfr /* 6082729Sdfr * Allocate space for the message 6092729Sdfr */ 6102729Sdfr 6112729Sdfr while (segs_needed > 0) { 6122729Sdfr if (nfree_msgmaps <= 0) 6132729Sdfr panic("not enough msgmaps"); 6142729Sdfr if (free_msgmaps == -1) 6152729Sdfr panic("nil free_msgmaps"); 6162729Sdfr next = free_msgmaps; 6172729Sdfr if (next <= -1) 6182729Sdfr panic("next too low #1"); 6192729Sdfr if (next >= msginfo.msgseg) 6202729Sdfr panic("next out of range #1"); 6212729Sdfr#ifdef MSG_DEBUG_OK 6222729Sdfr printf("allocating segment %d to message\n", next); 6232729Sdfr#endif 6242729Sdfr free_msgmaps = msgmaps[next].next; 6252729Sdfr nfree_msgmaps--; 6262729Sdfr msgmaps[next].next = msghdr->msg_spot; 6272729Sdfr msghdr->msg_spot = next; 6282729Sdfr segs_needed--; 6292729Sdfr } 6302729Sdfr 6312729Sdfr /* 6322729Sdfr * Copy in the message type 6332729Sdfr */ 6342729Sdfr 6352729Sdfr if ((eval = copyin(user_msgp, &msghdr->msg_type, 6362729Sdfr sizeof(msghdr->msg_type))) != 0) { 6372729Sdfr#ifdef MSG_DEBUG_OK 6382729Sdfr printf("error %d copying the message type\n", eval); 6392729Sdfr#endif 6402729Sdfr msg_freehdr(msghdr); 6412729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 6422729Sdfr wakeup((caddr_t)msqptr); 6432729Sdfr return(eval); 6442729Sdfr } 6452729Sdfr user_msgp += sizeof(msghdr->msg_type); 6462729Sdfr 6472729Sdfr /* 6482729Sdfr * Validate the message type 6492729Sdfr */ 6502729Sdfr 6512729Sdfr if (msghdr->msg_type < 1) { 6522729Sdfr msg_freehdr(msghdr); 6532729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 6542729Sdfr wakeup((caddr_t)msqptr); 6552729Sdfr#ifdef MSG_DEBUG_OK 6562729Sdfr printf("mtype (%d) < 1\n", msghdr->msg_type); 6572729Sdfr#endif 6582729Sdfr return(EINVAL); 6592729Sdfr } 6602729Sdfr 6612729Sdfr /* 6622729Sdfr * Copy in the message body 6632729Sdfr */ 6642729Sdfr 6652729Sdfr next = msghdr->msg_spot; 6662729Sdfr while (msgsz > 0) { 6672729Sdfr size_t tlen; 6682729Sdfr if (msgsz > msginfo.msgssz) 6692729Sdfr tlen = msginfo.msgssz; 6702729Sdfr else 6712729Sdfr tlen = msgsz; 6722729Sdfr if (next <= -1) 6732729Sdfr panic("next too low #2"); 6742729Sdfr if (next >= msginfo.msgseg) 6752729Sdfr panic("next out of range #2"); 6762729Sdfr if ((eval = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 6772729Sdfr tlen)) != 0) { 6782729Sdfr#ifdef MSG_DEBUG_OK 6792729Sdfr printf("error %d copying in message segment\n", eval); 6802729Sdfr#endif 6812729Sdfr msg_freehdr(msghdr); 6822729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 6832729Sdfr wakeup((caddr_t)msqptr); 6842729Sdfr return(eval); 6852729Sdfr } 6862729Sdfr msgsz -= tlen; 6872729Sdfr user_msgp += tlen; 6882729Sdfr next = msgmaps[next].next; 6892729Sdfr } 6902729Sdfr if (next != -1) 6912729Sdfr panic("didn't use all the msg segments"); 6922729Sdfr 6932729Sdfr /* 6942729Sdfr * We've got the message. Unlock the msqid_ds. 6952729Sdfr */ 6962729Sdfr 6972729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 6982729Sdfr 6992729Sdfr /* 7002729Sdfr * Make sure that the msqid_ds is still allocated. 7012729Sdfr */ 7022729Sdfr 7032729Sdfr if (msqptr->msg_qbytes == 0) { 7042729Sdfr msg_freehdr(msghdr); 7052729Sdfr wakeup((caddr_t)msqptr); 7062729Sdfr /* The SVID says to return EIDRM. */ 7072729Sdfr#ifdef EIDRM 7082729Sdfr return(EIDRM); 7092729Sdfr#else 7102729Sdfr /* Unfortunately, BSD doesn't define that code yet! */ 7112729Sdfr return(EINVAL); 7122729Sdfr#endif 7132729Sdfr } 7142729Sdfr 7152729Sdfr /* 7162729Sdfr * Put the message into the queue 7172729Sdfr */ 7182729Sdfr 7192729Sdfr if (msqptr->msg_first == NULL) { 7202729Sdfr msqptr->msg_first = msghdr; 7212729Sdfr msqptr->msg_last = msghdr; 7222729Sdfr } else { 7232729Sdfr msqptr->msg_last->msg_next = msghdr; 7242729Sdfr msqptr->msg_last = msghdr; 7252729Sdfr } 7262729Sdfr msqptr->msg_last->msg_next = NULL; 7272729Sdfr 7282729Sdfr msqptr->msg_cbytes += msghdr->msg_ts; 7292729Sdfr msqptr->msg_qnum++; 7302729Sdfr msqptr->msg_lspid = p->p_pid; 7312729Sdfr msqptr->msg_stime = time.tv_sec; 7322729Sdfr 7332729Sdfr wakeup((caddr_t)msqptr); 7342729Sdfr *retval = 0; 7352729Sdfr return(0); 7362729Sdfr} 7372729Sdfr 7382729Sdfrstruct msgrcv_args { 7392729Sdfr int msqid; 7402729Sdfr void *msgp; 7412729Sdfr size_t msgsz; 7422729Sdfr long msgtyp; 7432729Sdfr int msgflg; 7442729Sdfr}; 7452729Sdfr 74611626Sbdestatic int 7472729Sdfrmsgrcv(p, uap, retval) 7482729Sdfr struct proc *p; 7492729Sdfr register struct msgrcv_args *uap; 7502729Sdfr int *retval; 7512729Sdfr{ 7522729Sdfr int msqid = uap->msqid; 7532729Sdfr void *user_msgp = uap->msgp; 7542729Sdfr size_t msgsz = uap->msgsz; 7552729Sdfr long msgtyp = uap->msgtyp; 7562729Sdfr int msgflg = uap->msgflg; 7572729Sdfr size_t len; 7582729Sdfr struct ucred *cred = p->p_ucred; 7592729Sdfr register struct msqid_ds *msqptr; 7602729Sdfr register struct msg *msghdr; 7612729Sdfr int eval; 7622729Sdfr short next; 7632729Sdfr 7642729Sdfr#ifdef MSG_DEBUG_OK 7652729Sdfr printf("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 7662729Sdfr msgsz, msgtyp, msgflg); 7672729Sdfr#endif 7682729Sdfr 7692729Sdfr msqid = IPCID_TO_IX(msqid); 7702729Sdfr 7712729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 7722729Sdfr#ifdef MSG_DEBUG_OK 7732729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 7742729Sdfr msginfo.msgmni); 7752729Sdfr#endif 7762729Sdfr return(EINVAL); 7772729Sdfr } 7782729Sdfr 7792729Sdfr msqptr = &msqids[msqid]; 7802729Sdfr if (msqptr->msg_qbytes == 0) { 7812729Sdfr#ifdef MSG_DEBUG_OK 7822729Sdfr printf("no such message queue id\n"); 7832729Sdfr#endif 7842729Sdfr return(EINVAL); 7852729Sdfr } 7862729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 7872729Sdfr#ifdef MSG_DEBUG_OK 7882729Sdfr printf("wrong sequence number\n"); 7892729Sdfr#endif 7902729Sdfr return(EINVAL); 7912729Sdfr } 7922729Sdfr 7932729Sdfr if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 7942729Sdfr#ifdef MSG_DEBUG_OK 7952729Sdfr printf("requester doesn't have read access\n"); 7962729Sdfr#endif 7972729Sdfr return(eval); 7982729Sdfr } 7992729Sdfr 8002729Sdfr msghdr = NULL; 8012729Sdfr while (msghdr == NULL) { 8022729Sdfr if (msgtyp == 0) { 8032729Sdfr msghdr = msqptr->msg_first; 8042729Sdfr if (msghdr != NULL) { 8052729Sdfr if (msgsz < msghdr->msg_ts && 8062729Sdfr (msgflg & MSG_NOERROR) == 0) { 8072729Sdfr#ifdef MSG_DEBUG_OK 8082729Sdfr printf("first message on the queue is too big (want %d, got %d)\n", 8092729Sdfr msgsz, msghdr->msg_ts); 8102729Sdfr#endif 8112729Sdfr return(E2BIG); 8122729Sdfr } 8132729Sdfr if (msqptr->msg_first == msqptr->msg_last) { 8142729Sdfr msqptr->msg_first = NULL; 8152729Sdfr msqptr->msg_last = NULL; 8162729Sdfr } else { 8172729Sdfr msqptr->msg_first = msghdr->msg_next; 8182729Sdfr if (msqptr->msg_first == NULL) 8192729Sdfr panic("msg_first/last screwed up #1"); 8202729Sdfr } 8212729Sdfr } 8222729Sdfr } else { 8232729Sdfr struct msg *previous; 8242729Sdfr struct msg **prev; 8252729Sdfr 8262729Sdfr previous = NULL; 8272729Sdfr prev = &(msqptr->msg_first); 8282729Sdfr while ((msghdr = *prev) != NULL) { 8292729Sdfr /* 8302729Sdfr * Is this message's type an exact match or is 8312729Sdfr * this message's type less than or equal to 8322729Sdfr * the absolute value of a negative msgtyp? 8332729Sdfr * Note that the second half of this test can 8342729Sdfr * NEVER be true if msgtyp is positive since 8352729Sdfr * msg_type is always positive! 8362729Sdfr */ 8372729Sdfr 8382729Sdfr if (msgtyp == msghdr->msg_type || 8392729Sdfr msghdr->msg_type <= -msgtyp) { 8402729Sdfr#ifdef MSG_DEBUG_OK 8412729Sdfr printf("found message type %d, requested %d\n", 8422729Sdfr msghdr->msg_type, msgtyp); 8432729Sdfr#endif 8442729Sdfr if (msgsz < msghdr->msg_ts && 8452729Sdfr (msgflg & MSG_NOERROR) == 0) { 8462729Sdfr#ifdef MSG_DEBUG_OK 8472729Sdfr printf("requested message on the queue is too big (want %d, got %d)\n", 8482729Sdfr msgsz, msghdr->msg_ts); 8492729Sdfr#endif 8502729Sdfr return(E2BIG); 8512729Sdfr } 8522729Sdfr *prev = msghdr->msg_next; 8532729Sdfr if (msghdr == msqptr->msg_last) { 8542729Sdfr if (previous == NULL) { 8552729Sdfr if (prev != 8562729Sdfr &msqptr->msg_first) 8572729Sdfr panic("msg_first/last screwed up #2"); 8582729Sdfr msqptr->msg_first = 8592729Sdfr NULL; 8602729Sdfr msqptr->msg_last = 8612729Sdfr NULL; 8622729Sdfr } else { 8632729Sdfr if (prev == 8642729Sdfr &msqptr->msg_first) 8652729Sdfr panic("msg_first/last screwed up #3"); 8662729Sdfr msqptr->msg_last = 8672729Sdfr previous; 8682729Sdfr } 8692729Sdfr } 8702729Sdfr break; 8712729Sdfr } 8722729Sdfr previous = msghdr; 8732729Sdfr prev = &(msghdr->msg_next); 8742729Sdfr } 8752729Sdfr } 8762729Sdfr 8772729Sdfr /* 8782729Sdfr * We've either extracted the msghdr for the appropriate 8792729Sdfr * message or there isn't one. 8802729Sdfr * If there is one then bail out of this loop. 8812729Sdfr */ 8822729Sdfr 8832729Sdfr if (msghdr != NULL) 8842729Sdfr break; 8852729Sdfr 8862729Sdfr /* 8872729Sdfr * Hmph! No message found. Does the user want to wait? 8882729Sdfr */ 8892729Sdfr 8902729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 8912729Sdfr#ifdef MSG_DEBUG_OK 8922729Sdfr printf("no appropriate message found (msgtyp=%d)\n", 8932729Sdfr msgtyp); 8942729Sdfr#endif 8952729Sdfr /* The SVID says to return ENOMSG. */ 8962729Sdfr#ifdef ENOMSG 8972729Sdfr return(ENOMSG); 8982729Sdfr#else 8992729Sdfr /* Unfortunately, BSD doesn't define that code yet! */ 9002729Sdfr return(EAGAIN); 9012729Sdfr#endif 9022729Sdfr } 9032729Sdfr 9042729Sdfr /* 9052729Sdfr * Wait for something to happen 9062729Sdfr */ 9072729Sdfr 9082729Sdfr#ifdef MSG_DEBUG_OK 9092729Sdfr printf("msgrcv: goodnight\n"); 9102729Sdfr#endif 9112729Sdfr eval = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, "msgwait", 9122729Sdfr 0); 9132729Sdfr#ifdef MSG_DEBUG_OK 9142729Sdfr printf("msgrcv: good morning (eval=%d)\n", eval); 9152729Sdfr#endif 9162729Sdfr 9172729Sdfr if (eval != 0) { 9182729Sdfr#ifdef MSG_DEBUG_OK 9192729Sdfr printf("msgsnd: interrupted system call\n"); 9202729Sdfr#endif 9212729Sdfr return(EINTR); 9222729Sdfr } 9232729Sdfr 9242729Sdfr /* 9252729Sdfr * Make sure that the msq queue still exists 9262729Sdfr */ 9272729Sdfr 9282729Sdfr if (msqptr->msg_qbytes == 0 || 9292729Sdfr msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 9302729Sdfr#ifdef MSG_DEBUG_OK 9312729Sdfr printf("msqid deleted\n"); 9322729Sdfr#endif 9332729Sdfr /* The SVID says to return EIDRM. */ 9342729Sdfr#ifdef EIDRM 9352729Sdfr return(EIDRM); 9362729Sdfr#else 9372729Sdfr /* Unfortunately, BSD doesn't define that code yet! */ 9382729Sdfr return(EINVAL); 9392729Sdfr#endif 9402729Sdfr } 9412729Sdfr } 9422729Sdfr 9432729Sdfr /* 9442729Sdfr * Return the message to the user. 9452729Sdfr * 9462729Sdfr * First, do the bookkeeping (before we risk being interrupted). 9472729Sdfr */ 9482729Sdfr 9492729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 9502729Sdfr msqptr->msg_qnum--; 9512729Sdfr msqptr->msg_lrpid = p->p_pid; 9522729Sdfr msqptr->msg_rtime = time.tv_sec; 9532729Sdfr 9542729Sdfr /* 9552729Sdfr * Make msgsz the actual amount that we'll be returning. 9562729Sdfr * Note that this effectively truncates the message if it is too long 9572729Sdfr * (since msgsz is never increased). 9582729Sdfr */ 9592729Sdfr 9602729Sdfr#ifdef MSG_DEBUG_OK 9612729Sdfr printf("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 9622729Sdfr msghdr->msg_ts); 9632729Sdfr#endif 9642729Sdfr if (msgsz > msghdr->msg_ts) 9652729Sdfr msgsz = msghdr->msg_ts; 9662729Sdfr 9672729Sdfr /* 9682729Sdfr * Return the type to the user. 9692729Sdfr */ 9702729Sdfr 9712729Sdfr eval = copyout((caddr_t)&(msghdr->msg_type), user_msgp, 9722729Sdfr sizeof(msghdr->msg_type)); 9732729Sdfr if (eval != 0) { 9742729Sdfr#ifdef MSG_DEBUG_OK 9752729Sdfr printf("error (%d) copying out message type\n", eval); 9762729Sdfr#endif 9772729Sdfr msg_freehdr(msghdr); 9782729Sdfr wakeup((caddr_t)msqptr); 9792729Sdfr return(eval); 9802729Sdfr } 9812729Sdfr user_msgp += sizeof(msghdr->msg_type); 9822729Sdfr 9832729Sdfr /* 9842729Sdfr * Return the segments to the user 9852729Sdfr */ 9862729Sdfr 9872729Sdfr next = msghdr->msg_spot; 9882729Sdfr for (len = 0; len < msgsz; len += msginfo.msgssz) { 9892729Sdfr size_t tlen; 9902729Sdfr 9912729Sdfr if (msgsz > msginfo.msgssz) 9922729Sdfr tlen = msginfo.msgssz; 9932729Sdfr else 9942729Sdfr tlen = msgsz; 9952729Sdfr if (next <= -1) 9962729Sdfr panic("next too low #3"); 9972729Sdfr if (next >= msginfo.msgseg) 9982729Sdfr panic("next out of range #3"); 9992729Sdfr eval = copyout((caddr_t)&msgpool[next * msginfo.msgssz], 10002729Sdfr user_msgp, tlen); 10012729Sdfr if (eval != 0) { 10022729Sdfr#ifdef MSG_DEBUG_OK 10032729Sdfr printf("error (%d) copying out message segment\n", 10042729Sdfr eval); 10052729Sdfr#endif 10062729Sdfr msg_freehdr(msghdr); 10072729Sdfr wakeup((caddr_t)msqptr); 10082729Sdfr return(eval); 10092729Sdfr } 10102729Sdfr user_msgp += tlen; 10112729Sdfr next = msgmaps[next].next; 10122729Sdfr } 10132729Sdfr 10142729Sdfr /* 10152729Sdfr * Done, return the actual number of bytes copied out. 10162729Sdfr */ 10172729Sdfr 10182729Sdfr msg_freehdr(msghdr); 10192729Sdfr wakeup((caddr_t)msqptr); 10202729Sdfr *retval = msgsz; 10212729Sdfr return(0); 10222729Sdfr} 1023