sysv_msg.c revision 129882
12729Sdfr/* 22729Sdfr * Implementation of SVID messages 32729Sdfr * 42729Sdfr * Author: Daniel Boulet 52729Sdfr * 62729Sdfr * Copyright 1993 Daniel Boulet and RTMX Inc. 72729Sdfr * 82729Sdfr * This system call was implemented by Daniel Boulet under contract from RTMX. 92729Sdfr * 102729Sdfr * Redistribution and use in source forms, with and without modification, 112729Sdfr * are permitted provided that this entire comment appears intact. 122729Sdfr * 132729Sdfr * Redistribution in binary form may occur without any restrictions. 142729Sdfr * Obviously, it would be nice if you gave credit where credit is due 152729Sdfr * but requiring it would be too onerous. 162729Sdfr * 172729Sdfr * This software is provided ``AS IS'' without any warranties of any kind. 182729Sdfr */ 192729Sdfr 20116182Sobrien#include <sys/cdefs.h> 21116182Sobrien__FBSDID("$FreeBSD: head/sys/kern/sysv_msg.c 129882 2004-05-30 20:34:58Z phk $"); 22116182Sobrien 2359839Speter#include "opt_sysvipc.h" 2459839Speter 252729Sdfr#include <sys/param.h> 262729Sdfr#include <sys/systm.h> 2711626Sbde#include <sys/sysproto.h> 282729Sdfr#include <sys/kernel.h> 292729Sdfr#include <sys/proc.h> 3082607Sdillon#include <sys/lock.h> 3182607Sdillon#include <sys/mutex.h> 32129882Sphk#include <sys/module.h> 332729Sdfr#include <sys/msg.h> 3469449Salfred#include <sys/syscall.h> 3511626Sbde#include <sys/sysent.h> 3659839Speter#include <sys/sysctl.h> 3759839Speter#include <sys/malloc.h> 3868024Srwatson#include <sys/jail.h> 392729Sdfr 4059839Speterstatic MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); 4159839Speter 4292723Salfredstatic void msginit(void); 4392723Salfredstatic int msgunload(void); 4492723Salfredstatic int sysvmsg_modload(struct module *, int, void *); 4510358Sjulian 46100523Salfred#ifdef MSG_DEBUG 47100523Salfred#define DPRINTF(a) printf a 48100523Salfred#else 49100523Salfred#define DPRINTF(a) 50100523Salfred#endif 512729Sdfr 5292723Salfredstatic void msg_freehdr(struct msg *msghdr); 532729Sdfr 5411626Sbde/* XXX casting to (sy_call_t *) is bogus, as usual. */ 5512819Sphkstatic sy_call_t *msgcalls[] = { 5611626Sbde (sy_call_t *)msgctl, (sy_call_t *)msgget, 5711626Sbde (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 5811626Sbde}; 592729Sdfr 6059839Speterstruct msg { 6159839Speter struct msg *msg_next; /* next msg in the chain */ 6259839Speter long msg_type; /* type of this message */ 6359839Speter /* >0 -> type of this message */ 6459839Speter /* 0 -> free header */ 6559839Speter u_short msg_ts; /* size of this message */ 6659839Speter short msg_spot; /* location of start of msg in buffer */ 6759839Speter}; 6859839Speter 6959839Speter 7059839Speter#ifndef MSGSSZ 7159839Speter#define MSGSSZ 8 /* Each segment must be 2^N long */ 7259839Speter#endif 7359839Speter#ifndef MSGSEG 7459839Speter#define MSGSEG 2048 /* must be less than 32767 */ 7559839Speter#endif 7659839Speter#define MSGMAX (MSGSSZ*MSGSEG) 7759839Speter#ifndef MSGMNB 7859839Speter#define MSGMNB 2048 /* max # of bytes in a queue */ 7959839Speter#endif 8059839Speter#ifndef MSGMNI 8159839Speter#define MSGMNI 40 8259839Speter#endif 8359839Speter#ifndef MSGTQL 8459839Speter#define MSGTQL 40 8559839Speter#endif 8659839Speter 8759839Speter/* 8859839Speter * Based on the configuration parameters described in an SVR2 (yes, two) 8959839Speter * config(1m) man page. 9059839Speter * 9159839Speter * Each message is broken up and stored in segments that are msgssz bytes 9259839Speter * long. For efficiency reasons, this should be a power of two. Also, 9359839Speter * it doesn't make sense if it is less than 8 or greater than about 256. 9459839Speter * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of 9559839Speter * two between 8 and 1024 inclusive (and panic's if it isn't). 9659839Speter */ 9759839Speterstruct msginfo msginfo = { 9859839Speter MSGMAX, /* max chars in a message */ 9959839Speter MSGMNI, /* # of message queue identifiers */ 10059839Speter MSGMNB, /* max chars in a queue */ 10159839Speter MSGTQL, /* max messages in system */ 10259839Speter MSGSSZ, /* size of a message segment */ 10359839Speter /* (must be small power of 2 greater than 4) */ 10459839Speter MSGSEG /* number of message segments */ 10559839Speter}; 10659839Speter 10759839Speter/* 10859839Speter * macros to convert between msqid_ds's and msqid's. 10959839Speter * (specific to this implementation) 11059839Speter */ 11159839Speter#define MSQID(ix,ds) ((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000)) 11259839Speter#define MSQID_IX(id) ((id) & 0xffff) 11359839Speter#define MSQID_SEQ(id) (((id) >> 16) & 0xffff) 11459839Speter 11559839Speter/* 11659839Speter * The rest of this file is specific to this particular implementation. 11759839Speter */ 11859839Speter 11959839Speterstruct msgmap { 12059839Speter short next; /* next segment in buffer */ 12159839Speter /* -1 -> available */ 12259839Speter /* 0..(MSGSEG-1) -> index of next segment */ 12359839Speter}; 12459839Speter 12559839Speter#define MSG_LOCKED 01000 /* Is this msqid_ds locked? */ 12659839Speter 12712819Sphkstatic int nfree_msgmaps; /* # of free map entries */ 12812819Sphkstatic short free_msgmaps; /* head of linked list of free map entries */ 12959839Speterstatic struct msg *free_msghdrs;/* list of free msg headers */ 13059839Speterstatic char *msgpool; /* MSGMAX byte long msg buffer pool */ 13159839Speterstatic struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 13259839Speterstatic struct msg *msghdrs; /* MSGTQL msg headers */ 13359839Speterstatic struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 134101772Salfredstatic struct mtx msq_mtx; /* global mutex for message queues. */ 1352729Sdfr 13659839Speterstatic void 13769449Salfredmsginit() 1382729Sdfr{ 1392729Sdfr register int i; 1402729Sdfr 14183765Smr TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg); 14283765Smr TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz); 14383765Smr msginfo.msgmax = msginfo.msgseg * msginfo.msgssz; 14483765Smr TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni); 14583765Smr 146111119Simp msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK); 14759839Speter if (msgpool == NULL) 14859839Speter panic("msgpool is NULL"); 149111119Simp msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK); 15059839Speter if (msgmaps == NULL) 15159839Speter panic("msgmaps is NULL"); 152111119Simp msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK); 15359839Speter if (msghdrs == NULL) 15459839Speter panic("msghdrs is NULL"); 155111119Simp msqids = malloc(sizeof(struct msqid_ds) * msginfo.msgmni, M_MSG, M_WAITOK); 15659839Speter if (msqids == NULL) 15759839Speter panic("msqids is NULL"); 15859839Speter 1592729Sdfr /* 1602729Sdfr * msginfo.msgssz should be a power of two for efficiency reasons. 1612729Sdfr * It is also pretty silly if msginfo.msgssz is less than 8 1622729Sdfr * or greater than about 256 so ... 1632729Sdfr */ 1642729Sdfr 1652729Sdfr i = 8; 1662729Sdfr while (i < 1024 && i != msginfo.msgssz) 1672729Sdfr i <<= 1; 1682729Sdfr if (i != msginfo.msgssz) { 169100523Salfred DPRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 170100523Salfred msginfo.msgssz)); 1712729Sdfr panic("msginfo.msgssz not a small power of 2"); 1722729Sdfr } 1732729Sdfr 1742729Sdfr if (msginfo.msgseg > 32767) { 175100523Salfred DPRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 1762729Sdfr panic("msginfo.msgseg > 32767"); 1772729Sdfr } 1782729Sdfr 1792729Sdfr if (msgmaps == NULL) 1802729Sdfr panic("msgmaps is NULL"); 1812729Sdfr 1822729Sdfr for (i = 0; i < msginfo.msgseg; i++) { 1832729Sdfr if (i > 0) 1842729Sdfr msgmaps[i-1].next = i; 1852729Sdfr msgmaps[i].next = -1; /* implies entry is available */ 1862729Sdfr } 1872729Sdfr free_msgmaps = 0; 1882729Sdfr nfree_msgmaps = msginfo.msgseg; 1892729Sdfr 1902729Sdfr if (msghdrs == NULL) 1912729Sdfr panic("msghdrs is NULL"); 1922729Sdfr 1932729Sdfr for (i = 0; i < msginfo.msgtql; i++) { 1942729Sdfr msghdrs[i].msg_type = 0; 1952729Sdfr if (i > 0) 1962729Sdfr msghdrs[i-1].msg_next = &msghdrs[i]; 1972729Sdfr msghdrs[i].msg_next = NULL; 1982729Sdfr } 1992729Sdfr free_msghdrs = &msghdrs[0]; 2002729Sdfr 2012729Sdfr if (msqids == NULL) 2022729Sdfr panic("msqids is NULL"); 2032729Sdfr 2042729Sdfr for (i = 0; i < msginfo.msgmni; i++) { 2052729Sdfr msqids[i].msg_qbytes = 0; /* implies entry is available */ 2062729Sdfr msqids[i].msg_perm.seq = 0; /* reset to a known value */ 20766085Speter msqids[i].msg_perm.mode = 0; 2082729Sdfr } 209101772Salfred mtx_init(&msq_mtx, "msq", NULL, MTX_DEF); 2102729Sdfr} 2112729Sdfr 21269449Salfredstatic int 21369449Salfredmsgunload() 21469449Salfred{ 21569449Salfred struct msqid_ds *msqptr; 21669449Salfred int msqid; 21769449Salfred 21869449Salfred for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 21969449Salfred /* 22069449Salfred * Look for an unallocated and unlocked msqid_ds. 22169449Salfred * msqid_ds's can be locked by msgsnd or msgrcv while 22269449Salfred * they are copying the message in/out. We can't 22369449Salfred * re-use the entry until they release it. 22469449Salfred */ 22569449Salfred msqptr = &msqids[msqid]; 22669449Salfred if (msqptr->msg_qbytes != 0 || 22769449Salfred (msqptr->msg_perm.mode & MSG_LOCKED) != 0) 22869449Salfred break; 22969449Salfred } 23069449Salfred if (msqid != msginfo.msgmni) 23169449Salfred return (EBUSY); 23269449Salfred 23369449Salfred free(msgpool, M_MSG); 23469449Salfred free(msgmaps, M_MSG); 23569449Salfred free(msghdrs, M_MSG); 23669449Salfred free(msqids, M_MSG); 237101772Salfred mtx_destroy(&msq_mtx); 23869449Salfred return (0); 23969449Salfred} 24069449Salfred 24169449Salfred 24269449Salfredstatic int 24369449Salfredsysvmsg_modload(struct module *module, int cmd, void *arg) 24469449Salfred{ 24569449Salfred int error = 0; 24669449Salfred 24769449Salfred switch (cmd) { 24869449Salfred case MOD_LOAD: 24969449Salfred msginit(); 25069449Salfred break; 25169449Salfred case MOD_UNLOAD: 25269449Salfred error = msgunload(); 25369449Salfred break; 25469449Salfred case MOD_SHUTDOWN: 25569449Salfred break; 25669449Salfred default: 25769449Salfred error = EINVAL; 25869449Salfred break; 25969449Salfred } 26069449Salfred return (error); 26169449Salfred} 26269449Salfred 26371038Sdesstatic moduledata_t sysvmsg_mod = { 26471038Sdes "sysvmsg", 26569449Salfred &sysvmsg_modload, 26669449Salfred NULL 26769449Salfred}; 26869449Salfred 26988633SalfredSYSCALL_MODULE_HELPER(msgsys); 27088633SalfredSYSCALL_MODULE_HELPER(msgctl); 27188633SalfredSYSCALL_MODULE_HELPER(msgget); 27288633SalfredSYSCALL_MODULE_HELPER(msgsnd); 27388633SalfredSYSCALL_MODULE_HELPER(msgrcv); 27469449Salfred 27571038SdesDECLARE_MODULE(sysvmsg, sysvmsg_mod, 27669449Salfred SI_SUB_SYSV_MSG, SI_ORDER_FIRST); 27771038SdesMODULE_VERSION(sysvmsg, 1); 27869449Salfred 2792729Sdfr/* 2802729Sdfr * Entry point for all MSG calls 28182607Sdillon * 28282607Sdillon * MPSAFE 2832729Sdfr */ 2842729Sdfrint 28583366Sjulianmsgsys(td, uap) 28683366Sjulian struct thread *td; 28711626Sbde /* XXX actually varargs. */ 28811626Sbde struct msgsys_args /* { 289118615Snectar int which; 29011626Sbde int a2; 29111626Sbde int a3; 29211626Sbde int a4; 29311626Sbde int a5; 29411626Sbde int a6; 29511626Sbde } */ *uap; 2962729Sdfr{ 29782607Sdillon int error; 2982729Sdfr 29991703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 30091703Sjhb return (ENOSYS); 301118615Snectar if (uap->which < 0 || 302118615Snectar uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) 30391703Sjhb return (EINVAL); 30483366Sjulian error = (*msgcalls[uap->which])(td, &uap->a2); 30582607Sdillon return (error); 3062729Sdfr} 3072729Sdfr 3082729Sdfrstatic void 3092729Sdfrmsg_freehdr(msghdr) 3102729Sdfr struct msg *msghdr; 3112729Sdfr{ 3122729Sdfr while (msghdr->msg_ts > 0) { 3132729Sdfr short next; 3142729Sdfr if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 3152729Sdfr panic("msghdr->msg_spot out of range"); 3162729Sdfr next = msgmaps[msghdr->msg_spot].next; 3172729Sdfr msgmaps[msghdr->msg_spot].next = free_msgmaps; 3182729Sdfr free_msgmaps = msghdr->msg_spot; 3192729Sdfr nfree_msgmaps++; 3202729Sdfr msghdr->msg_spot = next; 3212729Sdfr if (msghdr->msg_ts >= msginfo.msgssz) 3222729Sdfr msghdr->msg_ts -= msginfo.msgssz; 3232729Sdfr else 3242729Sdfr msghdr->msg_ts = 0; 3252729Sdfr } 3262729Sdfr if (msghdr->msg_spot != -1) 3272729Sdfr panic("msghdr->msg_spot != -1"); 3282729Sdfr msghdr->msg_next = free_msghdrs; 3292729Sdfr free_msghdrs = msghdr; 3302729Sdfr} 3312729Sdfr 33212866Speter#ifndef _SYS_SYSPROTO_H_ 3332729Sdfrstruct msgctl_args { 3342729Sdfr int msqid; 3352729Sdfr int cmd; 33612866Speter struct msqid_ds *buf; 3372729Sdfr}; 33812866Speter#endif 3392729Sdfr 34082607Sdillon/* 34182607Sdillon * MPSAFE 34282607Sdillon */ 34312866Speterint 34483366Sjulianmsgctl(td, uap) 34583366Sjulian struct thread *td; 3462729Sdfr register struct msgctl_args *uap; 3472729Sdfr{ 3482729Sdfr int msqid = uap->msqid; 3492729Sdfr int cmd = uap->cmd; 35012866Speter struct msqid_ds *user_msqptr = uap->buf; 35182607Sdillon int rval, error; 3522729Sdfr struct msqid_ds msqbuf; 3532729Sdfr register struct msqid_ds *msqptr; 3542729Sdfr 355100523Salfred DPRINTF(("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr)); 35691703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 35791703Sjhb return (ENOSYS); 35891703Sjhb 3592729Sdfr msqid = IPCID_TO_IX(msqid); 3602729Sdfr 3612729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 362100523Salfred DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 363100523Salfred msginfo.msgmni)); 364101772Salfred return (EINVAL); 3652729Sdfr } 366101772Salfred if (cmd == IPC_SET && 367101772Salfred (error = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0) 368101772Salfred return (error); 3692729Sdfr 3702729Sdfr msqptr = &msqids[msqid]; 3712729Sdfr 372101772Salfred mtx_lock(&msq_mtx); 3732729Sdfr if (msqptr->msg_qbytes == 0) { 374100523Salfred DPRINTF(("no such msqid\n")); 37582607Sdillon error = EINVAL; 37682607Sdillon goto done2; 3772729Sdfr } 3782729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 379100523Salfred DPRINTF(("wrong sequence number\n")); 38082607Sdillon error = EINVAL; 38182607Sdillon goto done2; 3822729Sdfr } 3832729Sdfr 38482607Sdillon error = 0; 3852729Sdfr rval = 0; 3862729Sdfr 3872729Sdfr switch (cmd) { 3882729Sdfr 3892729Sdfr case IPC_RMID: 3902729Sdfr { 3912729Sdfr struct msg *msghdr; 39283366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 39382607Sdillon goto done2; 3942729Sdfr /* Free the message headers */ 3952729Sdfr msghdr = msqptr->msg_first; 3962729Sdfr while (msghdr != NULL) { 3972729Sdfr struct msg *msghdr_tmp; 3982729Sdfr 3992729Sdfr /* Free the segments of each message */ 4002729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 4012729Sdfr msqptr->msg_qnum--; 4022729Sdfr msghdr_tmp = msghdr; 4032729Sdfr msghdr = msghdr->msg_next; 4042729Sdfr msg_freehdr(msghdr_tmp); 4052729Sdfr } 4062729Sdfr 4072729Sdfr if (msqptr->msg_cbytes != 0) 4082729Sdfr panic("msg_cbytes is screwed up"); 4092729Sdfr if (msqptr->msg_qnum != 0) 4102729Sdfr panic("msg_qnum is screwed up"); 4112729Sdfr 4122729Sdfr msqptr->msg_qbytes = 0; /* Mark it as free */ 4132729Sdfr 414100511Salfred wakeup(msqptr); 4152729Sdfr } 4162729Sdfr 4172729Sdfr break; 4182729Sdfr 4192729Sdfr case IPC_SET: 42083366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 42182607Sdillon goto done2; 42243426Sphk if (msqbuf.msg_qbytes > msqptr->msg_qbytes) { 42393593Sjhb error = suser(td); 42482607Sdillon if (error) 42582607Sdillon goto done2; 42643426Sphk } 4272729Sdfr if (msqbuf.msg_qbytes > msginfo.msgmnb) { 428100523Salfred DPRINTF(("can't increase msg_qbytes beyond %d" 429100523Salfred "(truncating)\n", msginfo.msgmnb)); 4302729Sdfr msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 4312729Sdfr } 4322729Sdfr if (msqbuf.msg_qbytes == 0) { 433100523Salfred DPRINTF(("can't reduce msg_qbytes to 0\n")); 43482607Sdillon error = EINVAL; /* non-standard errno! */ 43582607Sdillon goto done2; 4362729Sdfr } 4372729Sdfr msqptr->msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */ 4382729Sdfr msqptr->msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */ 4392729Sdfr msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 4402729Sdfr (msqbuf.msg_perm.mode & 0777); 4412729Sdfr msqptr->msg_qbytes = msqbuf.msg_qbytes; 44234961Sphk msqptr->msg_ctime = time_second; 4432729Sdfr break; 4442729Sdfr 4452729Sdfr case IPC_STAT: 44683366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 447100523Salfred DPRINTF(("requester doesn't have read access\n")); 44882607Sdillon goto done2; 4492729Sdfr } 4502729Sdfr break; 4512729Sdfr 4522729Sdfr default: 453100523Salfred DPRINTF(("invalid command %d\n", cmd)); 45482607Sdillon error = EINVAL; 45582607Sdillon goto done2; 4562729Sdfr } 4572729Sdfr 45882607Sdillon if (error == 0) 45983366Sjulian td->td_retval[0] = rval; 46082607Sdillondone2: 461101772Salfred mtx_unlock(&msq_mtx); 462101772Salfred if (cmd == IPC_STAT && error == 0) 463101772Salfred error = copyout(msqptr, user_msqptr, sizeof(struct msqid_ds)); 46482607Sdillon return(error); 4652729Sdfr} 4662729Sdfr 46712866Speter#ifndef _SYS_SYSPROTO_H_ 4682729Sdfrstruct msgget_args { 4692729Sdfr key_t key; 4702729Sdfr int msgflg; 4712729Sdfr}; 47212866Speter#endif 4732729Sdfr 47482607Sdillon/* 47582607Sdillon * MPSAFE 47682607Sdillon */ 47712866Speterint 47883366Sjulianmsgget(td, uap) 47983366Sjulian struct thread *td; 4802729Sdfr register struct msgget_args *uap; 4812729Sdfr{ 48282607Sdillon int msqid, error = 0; 4832729Sdfr int key = uap->key; 4842729Sdfr int msgflg = uap->msgflg; 48591703Sjhb struct ucred *cred = td->td_ucred; 4862836Sdg register struct msqid_ds *msqptr = NULL; 4872729Sdfr 488100523Salfred DPRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 4892729Sdfr 49091703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 49191703Sjhb return (ENOSYS); 49291703Sjhb 493101772Salfred mtx_lock(&msq_mtx); 4942729Sdfr if (key != IPC_PRIVATE) { 4952729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 4962729Sdfr msqptr = &msqids[msqid]; 4972729Sdfr if (msqptr->msg_qbytes != 0 && 4982729Sdfr msqptr->msg_perm.key == key) 4992729Sdfr break; 5002729Sdfr } 5012729Sdfr if (msqid < msginfo.msgmni) { 502100523Salfred DPRINTF(("found public key\n")); 5032729Sdfr if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 504100523Salfred DPRINTF(("not exclusive\n")); 50582607Sdillon error = EEXIST; 50682607Sdillon goto done2; 5072729Sdfr } 508122201Srwatson if ((error = ipcperm(td, &msqptr->msg_perm, msgflg & 0700))) { 509100523Salfred DPRINTF(("requester doesn't have 0%o access\n", 510100523Salfred msgflg & 0700)); 51182607Sdillon goto done2; 5122729Sdfr } 5132729Sdfr goto found; 5142729Sdfr } 5152729Sdfr } 5162729Sdfr 517100523Salfred DPRINTF(("need to allocate the msqid_ds\n")); 5182729Sdfr if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 5192729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 5202729Sdfr /* 5212729Sdfr * Look for an unallocated and unlocked msqid_ds. 5222729Sdfr * msqid_ds's can be locked by msgsnd or msgrcv while 5232729Sdfr * they are copying the message in/out. We can't 5242729Sdfr * re-use the entry until they release it. 5252729Sdfr */ 5262729Sdfr msqptr = &msqids[msqid]; 5272729Sdfr if (msqptr->msg_qbytes == 0 && 5282729Sdfr (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 5292729Sdfr break; 5302729Sdfr } 5312729Sdfr if (msqid == msginfo.msgmni) { 532100523Salfred DPRINTF(("no more msqid_ds's available\n")); 53382607Sdillon error = ENOSPC; 53482607Sdillon goto done2; 5352729Sdfr } 536100523Salfred DPRINTF(("msqid %d is available\n", msqid)); 5372729Sdfr msqptr->msg_perm.key = key; 5382729Sdfr msqptr->msg_perm.cuid = cred->cr_uid; 5392729Sdfr msqptr->msg_perm.uid = cred->cr_uid; 5402729Sdfr msqptr->msg_perm.cgid = cred->cr_gid; 5412729Sdfr msqptr->msg_perm.gid = cred->cr_gid; 5422729Sdfr msqptr->msg_perm.mode = (msgflg & 0777); 5432729Sdfr /* Make sure that the returned msqid is unique */ 544107896Smaxim msqptr->msg_perm.seq = (msqptr->msg_perm.seq + 1) & 0x7fff; 5452729Sdfr msqptr->msg_first = NULL; 5462729Sdfr msqptr->msg_last = NULL; 5472729Sdfr msqptr->msg_cbytes = 0; 5482729Sdfr msqptr->msg_qnum = 0; 5492729Sdfr msqptr->msg_qbytes = msginfo.msgmnb; 5502729Sdfr msqptr->msg_lspid = 0; 5512729Sdfr msqptr->msg_lrpid = 0; 5522729Sdfr msqptr->msg_stime = 0; 5532729Sdfr msqptr->msg_rtime = 0; 55434961Sphk msqptr->msg_ctime = time_second; 5552729Sdfr } else { 556100523Salfred DPRINTF(("didn't find it and wasn't asked to create it\n")); 55782607Sdillon error = ENOENT; 55882607Sdillon goto done2; 5592729Sdfr } 5602729Sdfr 5612729Sdfrfound: 5622729Sdfr /* Construct the unique msqid */ 56383366Sjulian td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 56482607Sdillondone2: 565101772Salfred mtx_unlock(&msq_mtx); 56682607Sdillon return (error); 5672729Sdfr} 5682729Sdfr 56912866Speter#ifndef _SYS_SYSPROTO_H_ 5702729Sdfrstruct msgsnd_args { 5712729Sdfr int msqid; 572109895Salfred const void *msgp; 5732729Sdfr size_t msgsz; 5742729Sdfr int msgflg; 5752729Sdfr}; 57612866Speter#endif 5772729Sdfr 57882607Sdillon/* 57982607Sdillon * MPSAFE 58082607Sdillon */ 58112866Speterint 58283366Sjulianmsgsnd(td, uap) 58383366Sjulian struct thread *td; 5842729Sdfr register struct msgsnd_args *uap; 5852729Sdfr{ 5862729Sdfr int msqid = uap->msqid; 587109895Salfred const void *user_msgp = uap->msgp; 5882729Sdfr size_t msgsz = uap->msgsz; 5892729Sdfr int msgflg = uap->msgflg; 59082607Sdillon int segs_needed, error = 0; 5912729Sdfr register struct msqid_ds *msqptr; 5922729Sdfr register struct msg *msghdr; 5932729Sdfr short next; 5942729Sdfr 595100523Salfred DPRINTF(("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 596100523Salfred msgflg)); 59791703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 59891703Sjhb return (ENOSYS); 59991703Sjhb 600101772Salfred mtx_lock(&msq_mtx); 6012729Sdfr msqid = IPCID_TO_IX(msqid); 6022729Sdfr 6032729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 604100523Salfred DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 605100523Salfred msginfo.msgmni)); 60682607Sdillon error = EINVAL; 60782607Sdillon goto done2; 6082729Sdfr } 6092729Sdfr 6102729Sdfr msqptr = &msqids[msqid]; 6112729Sdfr if (msqptr->msg_qbytes == 0) { 612100523Salfred DPRINTF(("no such message queue id\n")); 61382607Sdillon error = EINVAL; 61482607Sdillon goto done2; 6152729Sdfr } 6162729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 617100523Salfred DPRINTF(("wrong sequence number\n")); 61882607Sdillon error = EINVAL; 61982607Sdillon goto done2; 6202729Sdfr } 6212729Sdfr 62283366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_W))) { 623100523Salfred DPRINTF(("requester doesn't have write access\n")); 62482607Sdillon goto done2; 6252729Sdfr } 6262729Sdfr 6272729Sdfr segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 628100523Salfred DPRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 629100523Salfred segs_needed)); 6302729Sdfr for (;;) { 6312729Sdfr int need_more_resources = 0; 6322729Sdfr 6332729Sdfr /* 6342729Sdfr * check msgsz 6352729Sdfr * (inside this loop in case msg_qbytes changes while we sleep) 6362729Sdfr */ 6372729Sdfr 6382836Sdg if (msgsz > msqptr->msg_qbytes) { 639100523Salfred DPRINTF(("msgsz > msqptr->msg_qbytes\n")); 64082607Sdillon error = EINVAL; 64182607Sdillon goto done2; 6422729Sdfr } 6432729Sdfr 6442729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) { 645100523Salfred DPRINTF(("msqid is locked\n")); 6462729Sdfr need_more_resources = 1; 6472729Sdfr } 6482729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) { 649100523Salfred DPRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 6502729Sdfr need_more_resources = 1; 6512729Sdfr } 6522729Sdfr if (segs_needed > nfree_msgmaps) { 653100523Salfred DPRINTF(("segs_needed > nfree_msgmaps\n")); 6542729Sdfr need_more_resources = 1; 6552729Sdfr } 6562729Sdfr if (free_msghdrs == NULL) { 657100523Salfred DPRINTF(("no more msghdrs\n")); 6582729Sdfr need_more_resources = 1; 6592729Sdfr } 6602729Sdfr 6612729Sdfr if (need_more_resources) { 6622729Sdfr int we_own_it; 6632729Sdfr 6642729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 665100523Salfred DPRINTF(("need more resources but caller " 666100523Salfred "doesn't want to wait\n")); 66782607Sdillon error = EAGAIN; 66882607Sdillon goto done2; 6692729Sdfr } 6702729Sdfr 6712729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 672100523Salfred DPRINTF(("we don't own the msqid_ds\n")); 6732729Sdfr we_own_it = 0; 6742729Sdfr } else { 6752729Sdfr /* Force later arrivals to wait for our 6762729Sdfr request */ 677100523Salfred DPRINTF(("we own the msqid_ds\n")); 6782729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 6792729Sdfr we_own_it = 1; 6802729Sdfr } 681100523Salfred DPRINTF(("goodnight\n")); 682101772Salfred error = msleep(msqptr, &msq_mtx, (PZERO - 4) | PCATCH, 6832729Sdfr "msgwait", 0); 684100523Salfred DPRINTF(("good morning, error=%d\n", error)); 6852729Sdfr if (we_own_it) 6862729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 68782607Sdillon if (error != 0) { 688100523Salfred DPRINTF(("msgsnd: interrupted system call\n")); 68982607Sdillon error = EINTR; 69082607Sdillon goto done2; 6912729Sdfr } 6922729Sdfr 6932729Sdfr /* 6942729Sdfr * Make sure that the msq queue still exists 6952729Sdfr */ 6962729Sdfr 6972729Sdfr if (msqptr->msg_qbytes == 0) { 698100523Salfred DPRINTF(("msqid deleted\n")); 69982607Sdillon error = EIDRM; 70082607Sdillon goto done2; 7012729Sdfr } 7022729Sdfr 7032729Sdfr } else { 704100523Salfred DPRINTF(("got all the resources that we need\n")); 7052729Sdfr break; 7062729Sdfr } 7072729Sdfr } 7082729Sdfr 7092729Sdfr /* 7102729Sdfr * We have the resources that we need. 7112729Sdfr * Make sure! 7122729Sdfr */ 7132729Sdfr 7142729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) 7152729Sdfr panic("msg_perm.mode & MSG_LOCKED"); 7162729Sdfr if (segs_needed > nfree_msgmaps) 7172729Sdfr panic("segs_needed > nfree_msgmaps"); 7182729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) 7192729Sdfr panic("msgsz + msg_cbytes > msg_qbytes"); 7202729Sdfr if (free_msghdrs == NULL) 7212729Sdfr panic("no more msghdrs"); 7222729Sdfr 7232729Sdfr /* 7242729Sdfr * Re-lock the msqid_ds in case we page-fault when copying in the 7252729Sdfr * message 7262729Sdfr */ 7272729Sdfr 7282729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 7292729Sdfr panic("msqid_ds is already locked"); 7302729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 7312729Sdfr 7322729Sdfr /* 7332729Sdfr * Allocate a message header 7342729Sdfr */ 7352729Sdfr 7362729Sdfr msghdr = free_msghdrs; 7372729Sdfr free_msghdrs = msghdr->msg_next; 7382729Sdfr msghdr->msg_spot = -1; 7392729Sdfr msghdr->msg_ts = msgsz; 7402729Sdfr 7412729Sdfr /* 7422729Sdfr * Allocate space for the message 7432729Sdfr */ 7442729Sdfr 7452729Sdfr while (segs_needed > 0) { 7462729Sdfr if (nfree_msgmaps <= 0) 7472729Sdfr panic("not enough msgmaps"); 7482729Sdfr if (free_msgmaps == -1) 7492729Sdfr panic("nil free_msgmaps"); 7502729Sdfr next = free_msgmaps; 7512729Sdfr if (next <= -1) 7522729Sdfr panic("next too low #1"); 7532729Sdfr if (next >= msginfo.msgseg) 7542729Sdfr panic("next out of range #1"); 755100523Salfred DPRINTF(("allocating segment %d to message\n", next)); 7562729Sdfr free_msgmaps = msgmaps[next].next; 7572729Sdfr nfree_msgmaps--; 7582729Sdfr msgmaps[next].next = msghdr->msg_spot; 7592729Sdfr msghdr->msg_spot = next; 7602729Sdfr segs_needed--; 7612729Sdfr } 7622729Sdfr 7632729Sdfr /* 7642729Sdfr * Copy in the message type 7652729Sdfr */ 7662729Sdfr 767101772Salfred mtx_unlock(&msq_mtx); 76882607Sdillon if ((error = copyin(user_msgp, &msghdr->msg_type, 7692729Sdfr sizeof(msghdr->msg_type))) != 0) { 770101772Salfred mtx_lock(&msq_mtx); 771100523Salfred DPRINTF(("error %d copying the message type\n", error)); 7722729Sdfr msg_freehdr(msghdr); 7732729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 774100511Salfred wakeup(msqptr); 77582607Sdillon goto done2; 7762729Sdfr } 777101772Salfred mtx_lock(&msq_mtx); 778109906Salfred user_msgp = (const char *)user_msgp + sizeof(msghdr->msg_type); 7792729Sdfr 7802729Sdfr /* 7812729Sdfr * Validate the message type 7822729Sdfr */ 7832729Sdfr 7842729Sdfr if (msghdr->msg_type < 1) { 7852729Sdfr msg_freehdr(msghdr); 7862729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 787100511Salfred wakeup(msqptr); 788100523Salfred DPRINTF(("mtype (%d) < 1\n", msghdr->msg_type)); 78982607Sdillon error = EINVAL; 79082607Sdillon goto done2; 7912729Sdfr } 7922729Sdfr 7932729Sdfr /* 7942729Sdfr * Copy in the message body 7952729Sdfr */ 7962729Sdfr 7972729Sdfr next = msghdr->msg_spot; 7982729Sdfr while (msgsz > 0) { 7992729Sdfr size_t tlen; 8002729Sdfr if (msgsz > msginfo.msgssz) 8012729Sdfr tlen = msginfo.msgssz; 8022729Sdfr else 8032729Sdfr tlen = msgsz; 8042729Sdfr if (next <= -1) 8052729Sdfr panic("next too low #2"); 8062729Sdfr if (next >= msginfo.msgseg) 8072729Sdfr panic("next out of range #2"); 808101772Salfred mtx_unlock(&msq_mtx); 80982607Sdillon if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 8102729Sdfr tlen)) != 0) { 811101772Salfred mtx_lock(&msq_mtx); 812100523Salfred DPRINTF(("error %d copying in message segment\n", 813100523Salfred error)); 8142729Sdfr msg_freehdr(msghdr); 8152729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 816100511Salfred wakeup(msqptr); 81782607Sdillon goto done2; 8182729Sdfr } 819101772Salfred mtx_lock(&msq_mtx); 8202729Sdfr msgsz -= tlen; 821109906Salfred user_msgp = (const char *)user_msgp + tlen; 8222729Sdfr next = msgmaps[next].next; 8232729Sdfr } 8242729Sdfr if (next != -1) 8252729Sdfr panic("didn't use all the msg segments"); 8262729Sdfr 8272729Sdfr /* 8282729Sdfr * We've got the message. Unlock the msqid_ds. 8292729Sdfr */ 8302729Sdfr 8312729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 8322729Sdfr 8332729Sdfr /* 8342729Sdfr * Make sure that the msqid_ds is still allocated. 8352729Sdfr */ 8362729Sdfr 8372729Sdfr if (msqptr->msg_qbytes == 0) { 8382729Sdfr msg_freehdr(msghdr); 839100511Salfred wakeup(msqptr); 84082607Sdillon error = EIDRM; 84182607Sdillon goto done2; 8422729Sdfr } 8432729Sdfr 8442729Sdfr /* 8452729Sdfr * Put the message into the queue 8462729Sdfr */ 8472729Sdfr 8482729Sdfr if (msqptr->msg_first == NULL) { 8492729Sdfr msqptr->msg_first = msghdr; 8502729Sdfr msqptr->msg_last = msghdr; 8512729Sdfr } else { 8522729Sdfr msqptr->msg_last->msg_next = msghdr; 8532729Sdfr msqptr->msg_last = msghdr; 8542729Sdfr } 8552729Sdfr msqptr->msg_last->msg_next = NULL; 8562729Sdfr 8572729Sdfr msqptr->msg_cbytes += msghdr->msg_ts; 8582729Sdfr msqptr->msg_qnum++; 85983366Sjulian msqptr->msg_lspid = td->td_proc->p_pid; 86034961Sphk msqptr->msg_stime = time_second; 8612729Sdfr 862100511Salfred wakeup(msqptr); 86383366Sjulian td->td_retval[0] = 0; 86482607Sdillondone2: 865101772Salfred mtx_unlock(&msq_mtx); 86682607Sdillon return (error); 8672729Sdfr} 8682729Sdfr 86912866Speter#ifndef _SYS_SYSPROTO_H_ 8702729Sdfrstruct msgrcv_args { 8712729Sdfr int msqid; 8722729Sdfr void *msgp; 8732729Sdfr size_t msgsz; 8742729Sdfr long msgtyp; 8752729Sdfr int msgflg; 8762729Sdfr}; 87712866Speter#endif 8782729Sdfr 87982607Sdillon/* 88082607Sdillon * MPSAFE 88182607Sdillon */ 88212866Speterint 88383366Sjulianmsgrcv(td, uap) 88483366Sjulian struct thread *td; 8852729Sdfr register struct msgrcv_args *uap; 8862729Sdfr{ 8872729Sdfr int msqid = uap->msqid; 8882729Sdfr void *user_msgp = uap->msgp; 8892729Sdfr size_t msgsz = uap->msgsz; 8902729Sdfr long msgtyp = uap->msgtyp; 8912729Sdfr int msgflg = uap->msgflg; 8922729Sdfr size_t len; 8932729Sdfr register struct msqid_ds *msqptr; 8942729Sdfr register struct msg *msghdr; 89582607Sdillon int error = 0; 8962729Sdfr short next; 8972729Sdfr 898100523Salfred DPRINTF(("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 899100523Salfred msgsz, msgtyp, msgflg)); 9002729Sdfr 90191703Sjhb if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 90291703Sjhb return (ENOSYS); 90391703Sjhb 9042729Sdfr msqid = IPCID_TO_IX(msqid); 9052729Sdfr 9062729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 907100523Salfred DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 908100523Salfred msginfo.msgmni)); 909101772Salfred return (EINVAL); 9102729Sdfr } 9112729Sdfr 9122729Sdfr msqptr = &msqids[msqid]; 913101772Salfred mtx_lock(&msq_mtx); 9142729Sdfr if (msqptr->msg_qbytes == 0) { 915100523Salfred DPRINTF(("no such message queue id\n")); 91682607Sdillon error = EINVAL; 91782607Sdillon goto done2; 9182729Sdfr } 9192729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 920100523Salfred DPRINTF(("wrong sequence number\n")); 92182607Sdillon error = EINVAL; 92282607Sdillon goto done2; 9232729Sdfr } 9242729Sdfr 92583366Sjulian if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 926100523Salfred DPRINTF(("requester doesn't have read access\n")); 92782607Sdillon goto done2; 9282729Sdfr } 9292729Sdfr 9302729Sdfr msghdr = NULL; 9312729Sdfr while (msghdr == NULL) { 9322729Sdfr if (msgtyp == 0) { 9332729Sdfr msghdr = msqptr->msg_first; 9342729Sdfr if (msghdr != NULL) { 9352729Sdfr if (msgsz < msghdr->msg_ts && 9362729Sdfr (msgflg & MSG_NOERROR) == 0) { 937100523Salfred DPRINTF(("first message on the queue " 938100523Salfred "is too big (want %d, got %d)\n", 939100523Salfred msgsz, msghdr->msg_ts)); 94082607Sdillon error = E2BIG; 94182607Sdillon goto done2; 9422729Sdfr } 9432729Sdfr if (msqptr->msg_first == msqptr->msg_last) { 9442729Sdfr msqptr->msg_first = NULL; 9452729Sdfr msqptr->msg_last = NULL; 9462729Sdfr } else { 9472729Sdfr msqptr->msg_first = msghdr->msg_next; 9482729Sdfr if (msqptr->msg_first == NULL) 9492729Sdfr panic("msg_first/last screwed up #1"); 9502729Sdfr } 9512729Sdfr } 9522729Sdfr } else { 9532729Sdfr struct msg *previous; 9542729Sdfr struct msg **prev; 9552729Sdfr 9562729Sdfr previous = NULL; 9572729Sdfr prev = &(msqptr->msg_first); 9582729Sdfr while ((msghdr = *prev) != NULL) { 9592729Sdfr /* 9602729Sdfr * Is this message's type an exact match or is 9612729Sdfr * this message's type less than or equal to 9622729Sdfr * the absolute value of a negative msgtyp? 9632729Sdfr * Note that the second half of this test can 9642729Sdfr * NEVER be true if msgtyp is positive since 9652729Sdfr * msg_type is always positive! 9662729Sdfr */ 9672729Sdfr 9682729Sdfr if (msgtyp == msghdr->msg_type || 9692729Sdfr msghdr->msg_type <= -msgtyp) { 970100523Salfred DPRINTF(("found message type %d, " 971100523Salfred "requested %d\n", 972100523Salfred msghdr->msg_type, msgtyp)); 9732729Sdfr if (msgsz < msghdr->msg_ts && 9742729Sdfr (msgflg & MSG_NOERROR) == 0) { 975100523Salfred DPRINTF(("requested message " 976100523Salfred "on the queue is too big " 977100523Salfred "(want %d, got %d)\n", 978100523Salfred msgsz, msghdr->msg_ts)); 97982607Sdillon error = E2BIG; 98082607Sdillon goto done2; 9812729Sdfr } 9822729Sdfr *prev = msghdr->msg_next; 9832729Sdfr if (msghdr == msqptr->msg_last) { 9842729Sdfr if (previous == NULL) { 9852729Sdfr if (prev != 9862729Sdfr &msqptr->msg_first) 9872729Sdfr panic("msg_first/last screwed up #2"); 9882729Sdfr msqptr->msg_first = 9892729Sdfr NULL; 9902729Sdfr msqptr->msg_last = 9912729Sdfr NULL; 9922729Sdfr } else { 9932729Sdfr if (prev == 9942729Sdfr &msqptr->msg_first) 9952729Sdfr panic("msg_first/last screwed up #3"); 9962729Sdfr msqptr->msg_last = 9972729Sdfr previous; 9982729Sdfr } 9992729Sdfr } 10002729Sdfr break; 10012729Sdfr } 10022729Sdfr previous = msghdr; 10032729Sdfr prev = &(msghdr->msg_next); 10042729Sdfr } 10052729Sdfr } 10062729Sdfr 10072729Sdfr /* 10082729Sdfr * We've either extracted the msghdr for the appropriate 10092729Sdfr * message or there isn't one. 10102729Sdfr * If there is one then bail out of this loop. 10112729Sdfr */ 10122729Sdfr 10132729Sdfr if (msghdr != NULL) 10142729Sdfr break; 10152729Sdfr 10162729Sdfr /* 10172729Sdfr * Hmph! No message found. Does the user want to wait? 10182729Sdfr */ 10192729Sdfr 10202729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 1021100523Salfred DPRINTF(("no appropriate message found (msgtyp=%d)\n", 1022100523Salfred msgtyp)); 10232729Sdfr /* The SVID says to return ENOMSG. */ 102482607Sdillon error = ENOMSG; 102582607Sdillon goto done2; 10262729Sdfr } 10272729Sdfr 10282729Sdfr /* 10292729Sdfr * Wait for something to happen 10302729Sdfr */ 10312729Sdfr 1032100523Salfred DPRINTF(("msgrcv: goodnight\n")); 1033101772Salfred error = msleep(msqptr, &msq_mtx, (PZERO - 4) | PCATCH, 1034101772Salfred "msgwait", 0); 1035100523Salfred DPRINTF(("msgrcv: good morning (error=%d)\n", error)); 10362729Sdfr 103782607Sdillon if (error != 0) { 1038100523Salfred DPRINTF(("msgsnd: interrupted system call\n")); 103982607Sdillon error = EINTR; 104082607Sdillon goto done2; 10412729Sdfr } 10422729Sdfr 10432729Sdfr /* 10442729Sdfr * Make sure that the msq queue still exists 10452729Sdfr */ 10462729Sdfr 10472729Sdfr if (msqptr->msg_qbytes == 0 || 10482729Sdfr msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 1049100523Salfred DPRINTF(("msqid deleted\n")); 105082607Sdillon error = EIDRM; 105182607Sdillon goto done2; 10522729Sdfr } 10532729Sdfr } 10542729Sdfr 10552729Sdfr /* 10562729Sdfr * Return the message to the user. 10572729Sdfr * 10582729Sdfr * First, do the bookkeeping (before we risk being interrupted). 10592729Sdfr */ 10602729Sdfr 10612729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 10622729Sdfr msqptr->msg_qnum--; 106383366Sjulian msqptr->msg_lrpid = td->td_proc->p_pid; 106434961Sphk msqptr->msg_rtime = time_second; 10652729Sdfr 10662729Sdfr /* 10672729Sdfr * Make msgsz the actual amount that we'll be returning. 10682729Sdfr * Note that this effectively truncates the message if it is too long 10692729Sdfr * (since msgsz is never increased). 10702729Sdfr */ 10712729Sdfr 1072100523Salfred DPRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 1073100523Salfred msghdr->msg_ts)); 10742729Sdfr if (msgsz > msghdr->msg_ts) 10752729Sdfr msgsz = msghdr->msg_ts; 10762729Sdfr 10772729Sdfr /* 10782729Sdfr * Return the type to the user. 10792729Sdfr */ 10802729Sdfr 1081101772Salfred mtx_unlock(&msq_mtx); 1082100511Salfred error = copyout(&(msghdr->msg_type), user_msgp, 10832729Sdfr sizeof(msghdr->msg_type)); 1084101772Salfred mtx_lock(&msq_mtx); 108582607Sdillon if (error != 0) { 1086100523Salfred DPRINTF(("error (%d) copying out message type\n", error)); 10872729Sdfr msg_freehdr(msghdr); 1088100511Salfred wakeup(msqptr); 108982607Sdillon goto done2; 10902729Sdfr } 109117971Sbde user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 10922729Sdfr 10932729Sdfr /* 10942729Sdfr * Return the segments to the user 10952729Sdfr */ 10962729Sdfr 10972729Sdfr next = msghdr->msg_spot; 10982729Sdfr for (len = 0; len < msgsz; len += msginfo.msgssz) { 10992729Sdfr size_t tlen; 11002729Sdfr 110145921Ssada if (msgsz - len > msginfo.msgssz) 11022729Sdfr tlen = msginfo.msgssz; 11032729Sdfr else 110445921Ssada tlen = msgsz - len; 11052729Sdfr if (next <= -1) 11062729Sdfr panic("next too low #3"); 11072729Sdfr if (next >= msginfo.msgseg) 11082729Sdfr panic("next out of range #3"); 1109101772Salfred mtx_unlock(&msq_mtx); 1110100511Salfred error = copyout(&msgpool[next * msginfo.msgssz], 11112729Sdfr user_msgp, tlen); 1112101772Salfred mtx_lock(&msq_mtx); 111382607Sdillon if (error != 0) { 1114100523Salfred DPRINTF(("error (%d) copying out message segment\n", 1115100523Salfred error)); 11162729Sdfr msg_freehdr(msghdr); 1117100511Salfred wakeup(msqptr); 111882607Sdillon goto done2; 11192729Sdfr } 112017971Sbde user_msgp = (char *)user_msgp + tlen; 11212729Sdfr next = msgmaps[next].next; 11222729Sdfr } 11232729Sdfr 11242729Sdfr /* 11252729Sdfr * Done, return the actual number of bytes copied out. 11262729Sdfr */ 11272729Sdfr 11282729Sdfr msg_freehdr(msghdr); 1129100511Salfred wakeup(msqptr); 113083366Sjulian td->td_retval[0] = msgsz; 113182607Sdillondone2: 1132101772Salfred mtx_unlock(&msq_mtx); 113382607Sdillon return (error); 11342729Sdfr} 113577461Sdd 113677461Sddstatic int 113777461Sddsysctl_msqids(SYSCTL_HANDLER_ARGS) 113877461Sdd{ 113977461Sdd 114077461Sdd return (SYSCTL_OUT(req, msqids, 114177461Sdd sizeof(struct msqid_ds) * msginfo.msgmni)); 114277461Sdd} 114377461Sdd 114477461SddSYSCTL_DECL(_kern_ipc); 114577461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, ""); 1146121307SsilbySYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RDTUN, &msginfo.msgmni, 0, ""); 114777461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RD, &msginfo.msgmnb, 0, ""); 114877461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RD, &msginfo.msgtql, 0, ""); 1149121307SsilbySYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RDTUN, &msginfo.msgssz, 0, ""); 1150121307SsilbySYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RDTUN, &msginfo.msgseg, 0, ""); 115177461SddSYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD, 115277461Sdd NULL, 0, sysctl_msqids, "", "Message queue IDs"); 1153