sysv_msg.c revision 82607
150477Speter/* $FreeBSD: head/sys/kern/sysv_msg.c 82607 2001-08-31 00:02:18Z dillon $ */ 22729Sdfr 32729Sdfr/* 42729Sdfr * Implementation of SVID messages 52729Sdfr * 62729Sdfr * Author: Daniel Boulet 72729Sdfr * 82729Sdfr * Copyright 1993 Daniel Boulet and RTMX Inc. 92729Sdfr * 102729Sdfr * This system call was implemented by Daniel Boulet under contract from RTMX. 112729Sdfr * 122729Sdfr * Redistribution and use in source forms, with and without modification, 132729Sdfr * are permitted provided that this entire comment appears intact. 142729Sdfr * 152729Sdfr * Redistribution in binary form may occur without any restrictions. 162729Sdfr * Obviously, it would be nice if you gave credit where credit is due 172729Sdfr * but requiring it would be too onerous. 182729Sdfr * 192729Sdfr * This software is provided ``AS IS'' without any warranties of any kind. 202729Sdfr */ 212729Sdfr 2259839Speter#include "opt_sysvipc.h" 2359839Speter 242729Sdfr#include <sys/param.h> 252729Sdfr#include <sys/systm.h> 2611626Sbde#include <sys/sysproto.h> 272729Sdfr#include <sys/kernel.h> 282729Sdfr#include <sys/proc.h> 2982607Sdillon#include <sys/lock.h> 3082607Sdillon#include <sys/mutex.h> 312729Sdfr#include <sys/msg.h> 3269449Salfred#include <sys/syscall.h> 3311626Sbde#include <sys/sysent.h> 3459839Speter#include <sys/sysctl.h> 3559839Speter#include <sys/malloc.h> 3668024Srwatson#include <sys/jail.h> 372729Sdfr 3859839Speterstatic MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); 3959839Speter 4069449Salfredstatic void msginit __P((void)); 4169449Salfredstatic int msgunload __P((void)); 4269449Salfredstatic int sysvmsg_modload __P((struct module *, int, void *)); 4310358Sjulian 442729Sdfr#define MSG_DEBUG 452729Sdfr#undef MSG_DEBUG_OK 462729Sdfr 4711626Sbdestatic void msg_freehdr __P((struct msg *msghdr)); 482729Sdfr 4911626Sbde/* XXX casting to (sy_call_t *) is bogus, as usual. */ 5012819Sphkstatic sy_call_t *msgcalls[] = { 5111626Sbde (sy_call_t *)msgctl, (sy_call_t *)msgget, 5211626Sbde (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 5311626Sbde}; 542729Sdfr 5559839Speterstruct msg { 5659839Speter struct msg *msg_next; /* next msg in the chain */ 5759839Speter long msg_type; /* type of this message */ 5859839Speter /* >0 -> type of this message */ 5959839Speter /* 0 -> free header */ 6059839Speter u_short msg_ts; /* size of this message */ 6159839Speter short msg_spot; /* location of start of msg in buffer */ 6259839Speter}; 6359839Speter 6459839Speter 6559839Speter#ifndef MSGSSZ 6659839Speter#define MSGSSZ 8 /* Each segment must be 2^N long */ 6759839Speter#endif 6859839Speter#ifndef MSGSEG 6959839Speter#define MSGSEG 2048 /* must be less than 32767 */ 7059839Speter#endif 7159839Speter#define MSGMAX (MSGSSZ*MSGSEG) 7259839Speter#ifndef MSGMNB 7359839Speter#define MSGMNB 2048 /* max # of bytes in a queue */ 7459839Speter#endif 7559839Speter#ifndef MSGMNI 7659839Speter#define MSGMNI 40 7759839Speter#endif 7859839Speter#ifndef MSGTQL 7959839Speter#define MSGTQL 40 8059839Speter#endif 8159839Speter 8259839Speter/* 8359839Speter * Based on the configuration parameters described in an SVR2 (yes, two) 8459839Speter * config(1m) man page. 8559839Speter * 8659839Speter * Each message is broken up and stored in segments that are msgssz bytes 8759839Speter * long. For efficiency reasons, this should be a power of two. Also, 8859839Speter * it doesn't make sense if it is less than 8 or greater than about 256. 8959839Speter * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of 9059839Speter * two between 8 and 1024 inclusive (and panic's if it isn't). 9159839Speter */ 9259839Speterstruct msginfo msginfo = { 9359839Speter MSGMAX, /* max chars in a message */ 9459839Speter MSGMNI, /* # of message queue identifiers */ 9559839Speter MSGMNB, /* max chars in a queue */ 9659839Speter MSGTQL, /* max messages in system */ 9759839Speter MSGSSZ, /* size of a message segment */ 9859839Speter /* (must be small power of 2 greater than 4) */ 9959839Speter MSGSEG /* number of message segments */ 10059839Speter}; 10159839Speter 10259839Speter/* 10359839Speter * macros to convert between msqid_ds's and msqid's. 10459839Speter * (specific to this implementation) 10559839Speter */ 10659839Speter#define MSQID(ix,ds) ((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000)) 10759839Speter#define MSQID_IX(id) ((id) & 0xffff) 10859839Speter#define MSQID_SEQ(id) (((id) >> 16) & 0xffff) 10959839Speter 11059839Speter/* 11159839Speter * The rest of this file is specific to this particular implementation. 11259839Speter */ 11359839Speter 11459839Speterstruct msgmap { 11559839Speter short next; /* next segment in buffer */ 11659839Speter /* -1 -> available */ 11759839Speter /* 0..(MSGSEG-1) -> index of next segment */ 11859839Speter}; 11959839Speter 12059839Speter#define MSG_LOCKED 01000 /* Is this msqid_ds locked? */ 12159839Speter 12212819Sphkstatic int nfree_msgmaps; /* # of free map entries */ 12312819Sphkstatic short free_msgmaps; /* head of linked list of free map entries */ 12459839Speterstatic struct msg *free_msghdrs;/* list of free msg headers */ 12559839Speterstatic char *msgpool; /* MSGMAX byte long msg buffer pool */ 12659839Speterstatic struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 12759839Speterstatic struct msg *msghdrs; /* MSGTQL msg headers */ 12859839Speterstatic struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 1292729Sdfr 13059839Speterstatic void 13169449Salfredmsginit() 1322729Sdfr{ 1332729Sdfr register int i; 1342729Sdfr 13559839Speter msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK); 13659839Speter if (msgpool == NULL) 13759839Speter panic("msgpool is NULL"); 13859839Speter msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK); 13959839Speter if (msgmaps == NULL) 14059839Speter panic("msgmaps is NULL"); 14159839Speter msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK); 14259839Speter if (msghdrs == NULL) 14359839Speter panic("msghdrs is NULL"); 14459839Speter msqids = malloc(sizeof(struct msqid_ds) * msginfo.msgmni, M_MSG, M_WAITOK); 14559839Speter if (msqids == NULL) 14659839Speter panic("msqids is NULL"); 14759839Speter 1482729Sdfr /* 1492729Sdfr * msginfo.msgssz should be a power of two for efficiency reasons. 1502729Sdfr * It is also pretty silly if msginfo.msgssz is less than 8 1512729Sdfr * or greater than about 256 so ... 1522729Sdfr */ 1532729Sdfr 1542729Sdfr i = 8; 1552729Sdfr while (i < 1024 && i != msginfo.msgssz) 1562729Sdfr i <<= 1; 1572729Sdfr if (i != msginfo.msgssz) { 1582729Sdfr printf("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 1592729Sdfr msginfo.msgssz); 1602729Sdfr panic("msginfo.msgssz not a small power of 2"); 1612729Sdfr } 1622729Sdfr 1632729Sdfr if (msginfo.msgseg > 32767) { 1642729Sdfr printf("msginfo.msgseg=%d\n", msginfo.msgseg); 1652729Sdfr panic("msginfo.msgseg > 32767"); 1662729Sdfr } 1672729Sdfr 1682729Sdfr if (msgmaps == NULL) 1692729Sdfr panic("msgmaps is NULL"); 1702729Sdfr 1712729Sdfr for (i = 0; i < msginfo.msgseg; i++) { 1722729Sdfr if (i > 0) 1732729Sdfr msgmaps[i-1].next = i; 1742729Sdfr msgmaps[i].next = -1; /* implies entry is available */ 1752729Sdfr } 1762729Sdfr free_msgmaps = 0; 1772729Sdfr nfree_msgmaps = msginfo.msgseg; 1782729Sdfr 1792729Sdfr if (msghdrs == NULL) 1802729Sdfr panic("msghdrs is NULL"); 1812729Sdfr 1822729Sdfr for (i = 0; i < msginfo.msgtql; i++) { 1832729Sdfr msghdrs[i].msg_type = 0; 1842729Sdfr if (i > 0) 1852729Sdfr msghdrs[i-1].msg_next = &msghdrs[i]; 1862729Sdfr msghdrs[i].msg_next = NULL; 1872729Sdfr } 1882729Sdfr free_msghdrs = &msghdrs[0]; 1892729Sdfr 1902729Sdfr if (msqids == NULL) 1912729Sdfr panic("msqids is NULL"); 1922729Sdfr 1932729Sdfr for (i = 0; i < msginfo.msgmni; i++) { 1942729Sdfr msqids[i].msg_qbytes = 0; /* implies entry is available */ 1952729Sdfr msqids[i].msg_perm.seq = 0; /* reset to a known value */ 19666085Speter msqids[i].msg_perm.mode = 0; 1972729Sdfr } 1982729Sdfr} 1992729Sdfr 20069449Salfredstatic int 20169449Salfredmsgunload() 20269449Salfred{ 20369449Salfred struct msqid_ds *msqptr; 20469449Salfred int msqid; 20569449Salfred 20669449Salfred for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 20769449Salfred /* 20869449Salfred * Look for an unallocated and unlocked msqid_ds. 20969449Salfred * msqid_ds's can be locked by msgsnd or msgrcv while 21069449Salfred * they are copying the message in/out. We can't 21169449Salfred * re-use the entry until they release it. 21269449Salfred */ 21369449Salfred msqptr = &msqids[msqid]; 21469449Salfred if (msqptr->msg_qbytes != 0 || 21569449Salfred (msqptr->msg_perm.mode & MSG_LOCKED) != 0) 21669449Salfred break; 21769449Salfred } 21869449Salfred if (msqid != msginfo.msgmni) 21969449Salfred return (EBUSY); 22069449Salfred 22169449Salfred free(msgpool, M_MSG); 22269449Salfred free(msgmaps, M_MSG); 22369449Salfred free(msghdrs, M_MSG); 22469449Salfred free(msqids, M_MSG); 22569449Salfred return (0); 22669449Salfred} 22769449Salfred 22869449Salfred 22969449Salfredstatic int 23069449Salfredsysvmsg_modload(struct module *module, int cmd, void *arg) 23169449Salfred{ 23269449Salfred int error = 0; 23369449Salfred 23469449Salfred switch (cmd) { 23569449Salfred case MOD_LOAD: 23669449Salfred msginit(); 23769449Salfred break; 23869449Salfred case MOD_UNLOAD: 23969449Salfred error = msgunload(); 24069449Salfred break; 24169449Salfred case MOD_SHUTDOWN: 24269449Salfred break; 24369449Salfred default: 24469449Salfred error = EINVAL; 24569449Salfred break; 24669449Salfred } 24769449Salfred return (error); 24869449Salfred} 24969449Salfred 25071038Sdesstatic moduledata_t sysvmsg_mod = { 25171038Sdes "sysvmsg", 25269449Salfred &sysvmsg_modload, 25369449Salfred NULL 25469449Salfred}; 25569449Salfred 25669644SalfredSYSCALL_MODULE_HELPER(msgsys, 6); 25769449SalfredSYSCALL_MODULE_HELPER(msgctl, 3); 25869449SalfredSYSCALL_MODULE_HELPER(msgget, 2); 25969449SalfredSYSCALL_MODULE_HELPER(msgsnd, 4); 26069449SalfredSYSCALL_MODULE_HELPER(msgrcv, 5); 26169449Salfred 26271038SdesDECLARE_MODULE(sysvmsg, sysvmsg_mod, 26369449Salfred SI_SUB_SYSV_MSG, SI_ORDER_FIRST); 26471038SdesMODULE_VERSION(sysvmsg, 1); 26569449Salfred 2662729Sdfr/* 2672729Sdfr * Entry point for all MSG calls 26882607Sdillon * 26982607Sdillon * MPSAFE 2702729Sdfr */ 2712729Sdfrint 27230994Sphkmsgsys(p, uap) 27311626Sbde struct proc *p; 27411626Sbde /* XXX actually varargs. */ 27511626Sbde struct msgsys_args /* { 27611626Sbde u_int which; 27711626Sbde int a2; 27811626Sbde int a3; 27911626Sbde int a4; 28011626Sbde int a5; 28111626Sbde int a6; 28211626Sbde } */ *uap; 2832729Sdfr{ 28482607Sdillon int error; 2852729Sdfr 28682607Sdillon mtx_lock(&Giant); 28768024Srwatson 28882607Sdillon if (!jail_sysvipc_allowed && jailed(p->p_ucred)) { 28982607Sdillon error = ENOSYS; 29082607Sdillon goto done2; 29182607Sdillon } 29282607Sdillon if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) { 29382607Sdillon error = EINVAL; 29482607Sdillon goto done2; 29582607Sdillon } 29682607Sdillon error = (*msgcalls[uap->which])(p, &uap->a2); 29782607Sdillondone2: 29882607Sdillon mtx_unlock(&Giant); 29982607Sdillon return (error); 3002729Sdfr} 3012729Sdfr 3022729Sdfrstatic void 3032729Sdfrmsg_freehdr(msghdr) 3042729Sdfr struct msg *msghdr; 3052729Sdfr{ 3062729Sdfr while (msghdr->msg_ts > 0) { 3072729Sdfr short next; 3082729Sdfr if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 3092729Sdfr panic("msghdr->msg_spot out of range"); 3102729Sdfr next = msgmaps[msghdr->msg_spot].next; 3112729Sdfr msgmaps[msghdr->msg_spot].next = free_msgmaps; 3122729Sdfr free_msgmaps = msghdr->msg_spot; 3132729Sdfr nfree_msgmaps++; 3142729Sdfr msghdr->msg_spot = next; 3152729Sdfr if (msghdr->msg_ts >= msginfo.msgssz) 3162729Sdfr msghdr->msg_ts -= msginfo.msgssz; 3172729Sdfr else 3182729Sdfr msghdr->msg_ts = 0; 3192729Sdfr } 3202729Sdfr if (msghdr->msg_spot != -1) 3212729Sdfr panic("msghdr->msg_spot != -1"); 3222729Sdfr msghdr->msg_next = free_msghdrs; 3232729Sdfr free_msghdrs = msghdr; 3242729Sdfr} 3252729Sdfr 32612866Speter#ifndef _SYS_SYSPROTO_H_ 3272729Sdfrstruct msgctl_args { 3282729Sdfr int msqid; 3292729Sdfr int cmd; 33012866Speter struct msqid_ds *buf; 3312729Sdfr}; 33212866Speter#endif 3332729Sdfr 33482607Sdillon/* 33582607Sdillon * MPSAFE 33682607Sdillon */ 33712866Speterint 33830994Sphkmsgctl(p, uap) 3392729Sdfr struct proc *p; 3402729Sdfr register struct msgctl_args *uap; 3412729Sdfr{ 3422729Sdfr int msqid = uap->msqid; 3432729Sdfr int cmd = uap->cmd; 34412866Speter struct msqid_ds *user_msqptr = uap->buf; 34582607Sdillon int rval, error; 3462729Sdfr struct msqid_ds msqbuf; 3472729Sdfr register struct msqid_ds *msqptr; 3482729Sdfr 3492729Sdfr#ifdef MSG_DEBUG_OK 3502729Sdfr printf("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr); 3512729Sdfr#endif 35282607Sdillon mtx_lock(&Giant); 3532729Sdfr 35482607Sdillon if (!jail_sysvipc_allowed && jailed(p->p_ucred)) { 35582607Sdillon error = ENOSYS; 35682607Sdillon goto done2; 35782607Sdillon } 35868024Srwatson 3592729Sdfr msqid = IPCID_TO_IX(msqid); 3602729Sdfr 3612729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 3622729Sdfr#ifdef MSG_DEBUG_OK 3632729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 3642729Sdfr msginfo.msgmni); 3652729Sdfr#endif 36682607Sdillon error = EINVAL; 36782607Sdillon goto done2; 3682729Sdfr } 3692729Sdfr 3702729Sdfr msqptr = &msqids[msqid]; 3712729Sdfr 3722729Sdfr if (msqptr->msg_qbytes == 0) { 3732729Sdfr#ifdef MSG_DEBUG_OK 3742729Sdfr printf("no such msqid\n"); 3752729Sdfr#endif 37682607Sdillon error = EINVAL; 37782607Sdillon goto done2; 3782729Sdfr } 3792729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 3802729Sdfr#ifdef MSG_DEBUG_OK 3812729Sdfr printf("wrong sequence number\n"); 3822729Sdfr#endif 38382607Sdillon error = EINVAL; 38482607Sdillon goto done2; 3852729Sdfr } 3862729Sdfr 38782607Sdillon error = 0; 3882729Sdfr rval = 0; 3892729Sdfr 3902729Sdfr switch (cmd) { 3912729Sdfr 3922729Sdfr case IPC_RMID: 3932729Sdfr { 3942729Sdfr struct msg *msghdr; 39582607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, IPC_M))) 39682607Sdillon goto done2; 3972729Sdfr /* Free the message headers */ 3982729Sdfr msghdr = msqptr->msg_first; 3992729Sdfr while (msghdr != NULL) { 4002729Sdfr struct msg *msghdr_tmp; 4012729Sdfr 4022729Sdfr /* Free the segments of each message */ 4032729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 4042729Sdfr msqptr->msg_qnum--; 4052729Sdfr msghdr_tmp = msghdr; 4062729Sdfr msghdr = msghdr->msg_next; 4072729Sdfr msg_freehdr(msghdr_tmp); 4082729Sdfr } 4092729Sdfr 4102729Sdfr if (msqptr->msg_cbytes != 0) 4112729Sdfr panic("msg_cbytes is screwed up"); 4122729Sdfr if (msqptr->msg_qnum != 0) 4132729Sdfr panic("msg_qnum is screwed up"); 4142729Sdfr 4152729Sdfr msqptr->msg_qbytes = 0; /* Mark it as free */ 4162729Sdfr 4172729Sdfr wakeup((caddr_t)msqptr); 4182729Sdfr } 4192729Sdfr 4202729Sdfr break; 4212729Sdfr 4222729Sdfr case IPC_SET: 42382607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, IPC_M))) 42482607Sdillon goto done2; 42582607Sdillon if ((error = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0) 42682607Sdillon goto done2; 42743426Sphk if (msqbuf.msg_qbytes > msqptr->msg_qbytes) { 42882607Sdillon error = suser(p); 42982607Sdillon if (error) 43082607Sdillon goto done2; 43143426Sphk } 4322729Sdfr if (msqbuf.msg_qbytes > msginfo.msgmnb) { 4332729Sdfr#ifdef MSG_DEBUG_OK 4342729Sdfr printf("can't increase msg_qbytes beyond %d (truncating)\n", 4352729Sdfr msginfo.msgmnb); 4362729Sdfr#endif 4372729Sdfr msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 4382729Sdfr } 4392729Sdfr if (msqbuf.msg_qbytes == 0) { 4402729Sdfr#ifdef MSG_DEBUG_OK 4412729Sdfr printf("can't reduce msg_qbytes to 0\n"); 4422729Sdfr#endif 44382607Sdillon error = EINVAL; /* non-standard errno! */ 44482607Sdillon goto done2; 4452729Sdfr } 4462729Sdfr msqptr->msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */ 4472729Sdfr msqptr->msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */ 4482729Sdfr msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 4492729Sdfr (msqbuf.msg_perm.mode & 0777); 4502729Sdfr msqptr->msg_qbytes = msqbuf.msg_qbytes; 45134961Sphk msqptr->msg_ctime = time_second; 4522729Sdfr break; 4532729Sdfr 4542729Sdfr case IPC_STAT: 45582607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, IPC_R))) { 4562729Sdfr#ifdef MSG_DEBUG_OK 4572729Sdfr printf("requester doesn't have read access\n"); 4582729Sdfr#endif 45982607Sdillon goto done2; 4602729Sdfr } 46182607Sdillon error = copyout((caddr_t)msqptr, user_msqptr, 4622729Sdfr sizeof(struct msqid_ds)); 4632729Sdfr break; 4642729Sdfr 4652729Sdfr default: 4662729Sdfr#ifdef MSG_DEBUG_OK 4672729Sdfr printf("invalid command %d\n", cmd); 4682729Sdfr#endif 46982607Sdillon error = EINVAL; 47082607Sdillon goto done2; 4712729Sdfr } 4722729Sdfr 47382607Sdillon if (error == 0) 47430994Sphk p->p_retval[0] = rval; 47582607Sdillondone2: 47682607Sdillon mtx_unlock(&Giant); 47782607Sdillon return(error); 4782729Sdfr} 4792729Sdfr 48012866Speter#ifndef _SYS_SYSPROTO_H_ 4812729Sdfrstruct msgget_args { 4822729Sdfr key_t key; 4832729Sdfr int msgflg; 4842729Sdfr}; 48512866Speter#endif 4862729Sdfr 48782607Sdillon/* 48882607Sdillon * MPSAFE 48982607Sdillon */ 49012866Speterint 49130994Sphkmsgget(p, uap) 4922729Sdfr struct proc *p; 4932729Sdfr register struct msgget_args *uap; 4942729Sdfr{ 49582607Sdillon int msqid, error = 0; 4962729Sdfr int key = uap->key; 4972729Sdfr int msgflg = uap->msgflg; 4982729Sdfr struct ucred *cred = p->p_ucred; 4992836Sdg register struct msqid_ds *msqptr = NULL; 5002729Sdfr 5012729Sdfr#ifdef MSG_DEBUG_OK 5022729Sdfr printf("msgget(0x%x, 0%o)\n", key, msgflg); 5032729Sdfr#endif 5042729Sdfr 50582607Sdillon mtx_lock(&Giant); 50668024Srwatson 50782607Sdillon if (!jail_sysvipc_allowed && jailed(p->p_ucred)) { 50882607Sdillon error = ENOSYS; 50982607Sdillon goto done2; 51082607Sdillon } 51182607Sdillon 5122729Sdfr if (key != IPC_PRIVATE) { 5132729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 5142729Sdfr msqptr = &msqids[msqid]; 5152729Sdfr if (msqptr->msg_qbytes != 0 && 5162729Sdfr msqptr->msg_perm.key == key) 5172729Sdfr break; 5182729Sdfr } 5192729Sdfr if (msqid < msginfo.msgmni) { 5202729Sdfr#ifdef MSG_DEBUG_OK 5212729Sdfr printf("found public key\n"); 5222729Sdfr#endif 5232729Sdfr if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 5242729Sdfr#ifdef MSG_DEBUG_OK 5252729Sdfr printf("not exclusive\n"); 5262729Sdfr#endif 52782607Sdillon error = EEXIST; 52882607Sdillon goto done2; 5292729Sdfr } 53082607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, msgflg & 0700 ))) { 5312729Sdfr#ifdef MSG_DEBUG_OK 5322729Sdfr printf("requester doesn't have 0%o access\n", 5332729Sdfr msgflg & 0700); 5342729Sdfr#endif 53582607Sdillon goto done2; 5362729Sdfr } 5372729Sdfr goto found; 5382729Sdfr } 5392729Sdfr } 5402729Sdfr 5412729Sdfr#ifdef MSG_DEBUG_OK 5422729Sdfr printf("need to allocate the msqid_ds\n"); 5432729Sdfr#endif 5442729Sdfr if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 5452729Sdfr for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 5462729Sdfr /* 5472729Sdfr * Look for an unallocated and unlocked msqid_ds. 5482729Sdfr * msqid_ds's can be locked by msgsnd or msgrcv while 5492729Sdfr * they are copying the message in/out. We can't 5502729Sdfr * re-use the entry until they release it. 5512729Sdfr */ 5522729Sdfr msqptr = &msqids[msqid]; 5532729Sdfr if (msqptr->msg_qbytes == 0 && 5542729Sdfr (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 5552729Sdfr break; 5562729Sdfr } 5572729Sdfr if (msqid == msginfo.msgmni) { 5582729Sdfr#ifdef MSG_DEBUG_OK 5592729Sdfr printf("no more msqid_ds's available\n"); 5602729Sdfr#endif 56182607Sdillon error = ENOSPC; 56282607Sdillon goto done2; 5632729Sdfr } 5642729Sdfr#ifdef MSG_DEBUG_OK 5652729Sdfr printf("msqid %d is available\n", msqid); 5662729Sdfr#endif 5672729Sdfr msqptr->msg_perm.key = key; 5682729Sdfr msqptr->msg_perm.cuid = cred->cr_uid; 5692729Sdfr msqptr->msg_perm.uid = cred->cr_uid; 5702729Sdfr msqptr->msg_perm.cgid = cred->cr_gid; 5712729Sdfr msqptr->msg_perm.gid = cred->cr_gid; 5722729Sdfr msqptr->msg_perm.mode = (msgflg & 0777); 5732729Sdfr /* Make sure that the returned msqid is unique */ 5742729Sdfr msqptr->msg_perm.seq++; 5752729Sdfr msqptr->msg_first = NULL; 5762729Sdfr msqptr->msg_last = NULL; 5772729Sdfr msqptr->msg_cbytes = 0; 5782729Sdfr msqptr->msg_qnum = 0; 5792729Sdfr msqptr->msg_qbytes = msginfo.msgmnb; 5802729Sdfr msqptr->msg_lspid = 0; 5812729Sdfr msqptr->msg_lrpid = 0; 5822729Sdfr msqptr->msg_stime = 0; 5832729Sdfr msqptr->msg_rtime = 0; 58434961Sphk msqptr->msg_ctime = time_second; 5852729Sdfr } else { 5862729Sdfr#ifdef MSG_DEBUG_OK 5872729Sdfr printf("didn't find it and wasn't asked to create it\n"); 5882729Sdfr#endif 58982607Sdillon error = ENOENT; 59082607Sdillon goto done2; 5912729Sdfr } 5922729Sdfr 5932729Sdfrfound: 5942729Sdfr /* Construct the unique msqid */ 59530994Sphk p->p_retval[0] = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 59682607Sdillondone2: 59782607Sdillon mtx_unlock(&Giant); 59882607Sdillon return (error); 5992729Sdfr} 6002729Sdfr 60112866Speter#ifndef _SYS_SYSPROTO_H_ 6022729Sdfrstruct msgsnd_args { 6032729Sdfr int msqid; 60412866Speter void *msgp; 6052729Sdfr size_t msgsz; 6062729Sdfr int msgflg; 6072729Sdfr}; 60812866Speter#endif 6092729Sdfr 61082607Sdillon/* 61182607Sdillon * MPSAFE 61282607Sdillon */ 61312866Speterint 61430994Sphkmsgsnd(p, uap) 6152729Sdfr struct proc *p; 6162729Sdfr register struct msgsnd_args *uap; 6172729Sdfr{ 6182729Sdfr int msqid = uap->msqid; 61912866Speter void *user_msgp = uap->msgp; 6202729Sdfr size_t msgsz = uap->msgsz; 6212729Sdfr int msgflg = uap->msgflg; 62282607Sdillon int segs_needed, error = 0; 6232729Sdfr register struct msqid_ds *msqptr; 6242729Sdfr register struct msg *msghdr; 6252729Sdfr short next; 6262729Sdfr 6272729Sdfr#ifdef MSG_DEBUG_OK 6282729Sdfr printf("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 6292729Sdfr msgflg); 6302729Sdfr#endif 63182607Sdillon mtx_lock(&Giant); 6322729Sdfr 63382607Sdillon if (!jail_sysvipc_allowed && jailed(p->p_ucred)) { 63482607Sdillon error = ENOSYS; 63582607Sdillon goto done2; 63682607Sdillon } 63768024Srwatson 6382729Sdfr msqid = IPCID_TO_IX(msqid); 6392729Sdfr 6402729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 6412729Sdfr#ifdef MSG_DEBUG_OK 6422729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 6432729Sdfr msginfo.msgmni); 6442729Sdfr#endif 64582607Sdillon error = EINVAL; 64682607Sdillon goto done2; 6472729Sdfr } 6482729Sdfr 6492729Sdfr msqptr = &msqids[msqid]; 6502729Sdfr if (msqptr->msg_qbytes == 0) { 6512729Sdfr#ifdef MSG_DEBUG_OK 6522729Sdfr printf("no such message queue id\n"); 6532729Sdfr#endif 65482607Sdillon error = EINVAL; 65582607Sdillon goto done2; 6562729Sdfr } 6572729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 6582729Sdfr#ifdef MSG_DEBUG_OK 6592729Sdfr printf("wrong sequence number\n"); 6602729Sdfr#endif 66182607Sdillon error = EINVAL; 66282607Sdillon goto done2; 6632729Sdfr } 6642729Sdfr 66582607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, IPC_W))) { 6662729Sdfr#ifdef MSG_DEBUG_OK 6672729Sdfr printf("requester doesn't have write access\n"); 6682729Sdfr#endif 66982607Sdillon goto done2; 6702729Sdfr } 6712729Sdfr 6722729Sdfr segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 6732729Sdfr#ifdef MSG_DEBUG_OK 6742729Sdfr printf("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 6752729Sdfr segs_needed); 6762729Sdfr#endif 6772729Sdfr for (;;) { 6782729Sdfr int need_more_resources = 0; 6792729Sdfr 6802729Sdfr /* 6812729Sdfr * check msgsz 6822729Sdfr * (inside this loop in case msg_qbytes changes while we sleep) 6832729Sdfr */ 6842729Sdfr 6852836Sdg if (msgsz > msqptr->msg_qbytes) { 6862729Sdfr#ifdef MSG_DEBUG_OK 6872729Sdfr printf("msgsz > msqptr->msg_qbytes\n"); 6882729Sdfr#endif 68982607Sdillon error = EINVAL; 69082607Sdillon goto done2; 6912729Sdfr } 6922729Sdfr 6932729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) { 6942729Sdfr#ifdef MSG_DEBUG_OK 6952729Sdfr printf("msqid is locked\n"); 6962729Sdfr#endif 6972729Sdfr need_more_resources = 1; 6982729Sdfr } 6992729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) { 7002729Sdfr#ifdef MSG_DEBUG_OK 7012729Sdfr printf("msgsz + msg_cbytes > msg_qbytes\n"); 7022729Sdfr#endif 7032729Sdfr need_more_resources = 1; 7042729Sdfr } 7052729Sdfr if (segs_needed > nfree_msgmaps) { 7062729Sdfr#ifdef MSG_DEBUG_OK 7072729Sdfr printf("segs_needed > nfree_msgmaps\n"); 7082729Sdfr#endif 7092729Sdfr need_more_resources = 1; 7102729Sdfr } 7112729Sdfr if (free_msghdrs == NULL) { 7122729Sdfr#ifdef MSG_DEBUG_OK 7132729Sdfr printf("no more msghdrs\n"); 7142729Sdfr#endif 7152729Sdfr need_more_resources = 1; 7162729Sdfr } 7172729Sdfr 7182729Sdfr if (need_more_resources) { 7192729Sdfr int we_own_it; 7202729Sdfr 7212729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 7222729Sdfr#ifdef MSG_DEBUG_OK 7232729Sdfr printf("need more resources but caller doesn't want to wait\n"); 7242729Sdfr#endif 72582607Sdillon error = EAGAIN; 72682607Sdillon goto done2; 7272729Sdfr } 7282729Sdfr 7292729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 7302729Sdfr#ifdef MSG_DEBUG_OK 7312729Sdfr printf("we don't own the msqid_ds\n"); 7322729Sdfr#endif 7332729Sdfr we_own_it = 0; 7342729Sdfr } else { 7352729Sdfr /* Force later arrivals to wait for our 7362729Sdfr request */ 7372729Sdfr#ifdef MSG_DEBUG_OK 7382729Sdfr printf("we own the msqid_ds\n"); 7392729Sdfr#endif 7402729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 7412729Sdfr we_own_it = 1; 7422729Sdfr } 7432729Sdfr#ifdef MSG_DEBUG_OK 7442729Sdfr printf("goodnight\n"); 7452729Sdfr#endif 74682607Sdillon error = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, 7472729Sdfr "msgwait", 0); 7482729Sdfr#ifdef MSG_DEBUG_OK 74982607Sdillon printf("good morning, error=%d\n", error); 7502729Sdfr#endif 7512729Sdfr if (we_own_it) 7522729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 75382607Sdillon if (error != 0) { 7542729Sdfr#ifdef MSG_DEBUG_OK 7552729Sdfr printf("msgsnd: interrupted system call\n"); 7562729Sdfr#endif 75782607Sdillon error = EINTR; 75882607Sdillon goto done2; 7592729Sdfr } 7602729Sdfr 7612729Sdfr /* 7622729Sdfr * Make sure that the msq queue still exists 7632729Sdfr */ 7642729Sdfr 7652729Sdfr if (msqptr->msg_qbytes == 0) { 7662729Sdfr#ifdef MSG_DEBUG_OK 7672729Sdfr printf("msqid deleted\n"); 7682729Sdfr#endif 76982607Sdillon error = EIDRM; 77082607Sdillon goto done2; 7712729Sdfr } 7722729Sdfr 7732729Sdfr } else { 7742729Sdfr#ifdef MSG_DEBUG_OK 7752729Sdfr printf("got all the resources that we need\n"); 7762729Sdfr#endif 7772729Sdfr break; 7782729Sdfr } 7792729Sdfr } 7802729Sdfr 7812729Sdfr /* 7822729Sdfr * We have the resources that we need. 7832729Sdfr * Make sure! 7842729Sdfr */ 7852729Sdfr 7862729Sdfr if (msqptr->msg_perm.mode & MSG_LOCKED) 7872729Sdfr panic("msg_perm.mode & MSG_LOCKED"); 7882729Sdfr if (segs_needed > nfree_msgmaps) 7892729Sdfr panic("segs_needed > nfree_msgmaps"); 7902729Sdfr if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) 7912729Sdfr panic("msgsz + msg_cbytes > msg_qbytes"); 7922729Sdfr if (free_msghdrs == NULL) 7932729Sdfr panic("no more msghdrs"); 7942729Sdfr 7952729Sdfr /* 7962729Sdfr * Re-lock the msqid_ds in case we page-fault when copying in the 7972729Sdfr * message 7982729Sdfr */ 7992729Sdfr 8002729Sdfr if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 8012729Sdfr panic("msqid_ds is already locked"); 8022729Sdfr msqptr->msg_perm.mode |= MSG_LOCKED; 8032729Sdfr 8042729Sdfr /* 8052729Sdfr * Allocate a message header 8062729Sdfr */ 8072729Sdfr 8082729Sdfr msghdr = free_msghdrs; 8092729Sdfr free_msghdrs = msghdr->msg_next; 8102729Sdfr msghdr->msg_spot = -1; 8112729Sdfr msghdr->msg_ts = msgsz; 8122729Sdfr 8132729Sdfr /* 8142729Sdfr * Allocate space for the message 8152729Sdfr */ 8162729Sdfr 8172729Sdfr while (segs_needed > 0) { 8182729Sdfr if (nfree_msgmaps <= 0) 8192729Sdfr panic("not enough msgmaps"); 8202729Sdfr if (free_msgmaps == -1) 8212729Sdfr panic("nil free_msgmaps"); 8222729Sdfr next = free_msgmaps; 8232729Sdfr if (next <= -1) 8242729Sdfr panic("next too low #1"); 8252729Sdfr if (next >= msginfo.msgseg) 8262729Sdfr panic("next out of range #1"); 8272729Sdfr#ifdef MSG_DEBUG_OK 8282729Sdfr printf("allocating segment %d to message\n", next); 8292729Sdfr#endif 8302729Sdfr free_msgmaps = msgmaps[next].next; 8312729Sdfr nfree_msgmaps--; 8322729Sdfr msgmaps[next].next = msghdr->msg_spot; 8332729Sdfr msghdr->msg_spot = next; 8342729Sdfr segs_needed--; 8352729Sdfr } 8362729Sdfr 8372729Sdfr /* 8382729Sdfr * Copy in the message type 8392729Sdfr */ 8402729Sdfr 84182607Sdillon if ((error = copyin(user_msgp, &msghdr->msg_type, 8422729Sdfr sizeof(msghdr->msg_type))) != 0) { 8432729Sdfr#ifdef MSG_DEBUG_OK 84482607Sdillon printf("error %d copying the message type\n", error); 8452729Sdfr#endif 8462729Sdfr msg_freehdr(msghdr); 8472729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 8482729Sdfr wakeup((caddr_t)msqptr); 84982607Sdillon goto done2; 8502729Sdfr } 85117971Sbde user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 8522729Sdfr 8532729Sdfr /* 8542729Sdfr * Validate the message type 8552729Sdfr */ 8562729Sdfr 8572729Sdfr if (msghdr->msg_type < 1) { 8582729Sdfr msg_freehdr(msghdr); 8592729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 8602729Sdfr wakeup((caddr_t)msqptr); 8612729Sdfr#ifdef MSG_DEBUG_OK 8622729Sdfr printf("mtype (%d) < 1\n", msghdr->msg_type); 8632729Sdfr#endif 86482607Sdillon error = EINVAL; 86582607Sdillon goto done2; 8662729Sdfr } 8672729Sdfr 8682729Sdfr /* 8692729Sdfr * Copy in the message body 8702729Sdfr */ 8712729Sdfr 8722729Sdfr next = msghdr->msg_spot; 8732729Sdfr while (msgsz > 0) { 8742729Sdfr size_t tlen; 8752729Sdfr if (msgsz > msginfo.msgssz) 8762729Sdfr tlen = msginfo.msgssz; 8772729Sdfr else 8782729Sdfr tlen = msgsz; 8792729Sdfr if (next <= -1) 8802729Sdfr panic("next too low #2"); 8812729Sdfr if (next >= msginfo.msgseg) 8822729Sdfr panic("next out of range #2"); 88382607Sdillon if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 8842729Sdfr tlen)) != 0) { 8852729Sdfr#ifdef MSG_DEBUG_OK 88682607Sdillon printf("error %d copying in message segment\n", error); 8872729Sdfr#endif 8882729Sdfr msg_freehdr(msghdr); 8892729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 8902729Sdfr wakeup((caddr_t)msqptr); 89182607Sdillon goto done2; 8922729Sdfr } 8932729Sdfr msgsz -= tlen; 89417971Sbde user_msgp = (char *)user_msgp + tlen; 8952729Sdfr next = msgmaps[next].next; 8962729Sdfr } 8972729Sdfr if (next != -1) 8982729Sdfr panic("didn't use all the msg segments"); 8992729Sdfr 9002729Sdfr /* 9012729Sdfr * We've got the message. Unlock the msqid_ds. 9022729Sdfr */ 9032729Sdfr 9042729Sdfr msqptr->msg_perm.mode &= ~MSG_LOCKED; 9052729Sdfr 9062729Sdfr /* 9072729Sdfr * Make sure that the msqid_ds is still allocated. 9082729Sdfr */ 9092729Sdfr 9102729Sdfr if (msqptr->msg_qbytes == 0) { 9112729Sdfr msg_freehdr(msghdr); 9122729Sdfr wakeup((caddr_t)msqptr); 91382607Sdillon error = EIDRM; 91482607Sdillon goto done2; 9152729Sdfr } 9162729Sdfr 9172729Sdfr /* 9182729Sdfr * Put the message into the queue 9192729Sdfr */ 9202729Sdfr 9212729Sdfr if (msqptr->msg_first == NULL) { 9222729Sdfr msqptr->msg_first = msghdr; 9232729Sdfr msqptr->msg_last = msghdr; 9242729Sdfr } else { 9252729Sdfr msqptr->msg_last->msg_next = msghdr; 9262729Sdfr msqptr->msg_last = msghdr; 9272729Sdfr } 9282729Sdfr msqptr->msg_last->msg_next = NULL; 9292729Sdfr 9302729Sdfr msqptr->msg_cbytes += msghdr->msg_ts; 9312729Sdfr msqptr->msg_qnum++; 9322729Sdfr msqptr->msg_lspid = p->p_pid; 93334961Sphk msqptr->msg_stime = time_second; 9342729Sdfr 9352729Sdfr wakeup((caddr_t)msqptr); 93630994Sphk p->p_retval[0] = 0; 93782607Sdillondone2: 93882607Sdillon mtx_unlock(&Giant); 93982607Sdillon return (error); 9402729Sdfr} 9412729Sdfr 94212866Speter#ifndef _SYS_SYSPROTO_H_ 9432729Sdfrstruct msgrcv_args { 9442729Sdfr int msqid; 9452729Sdfr void *msgp; 9462729Sdfr size_t msgsz; 9472729Sdfr long msgtyp; 9482729Sdfr int msgflg; 9492729Sdfr}; 95012866Speter#endif 9512729Sdfr 95282607Sdillon/* 95382607Sdillon * MPSAFE 95482607Sdillon */ 95512866Speterint 95630994Sphkmsgrcv(p, uap) 9572729Sdfr struct proc *p; 9582729Sdfr register struct msgrcv_args *uap; 9592729Sdfr{ 9602729Sdfr int msqid = uap->msqid; 9612729Sdfr void *user_msgp = uap->msgp; 9622729Sdfr size_t msgsz = uap->msgsz; 9632729Sdfr long msgtyp = uap->msgtyp; 9642729Sdfr int msgflg = uap->msgflg; 9652729Sdfr size_t len; 9662729Sdfr register struct msqid_ds *msqptr; 9672729Sdfr register struct msg *msghdr; 96882607Sdillon int error = 0; 9692729Sdfr short next; 9702729Sdfr 9712729Sdfr#ifdef MSG_DEBUG_OK 9722729Sdfr printf("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 9732729Sdfr msgsz, msgtyp, msgflg); 9742729Sdfr#endif 9752729Sdfr 97682607Sdillon mtx_lock(&Giant); 97768024Srwatson 97882607Sdillon if (!jail_sysvipc_allowed && jailed(p->p_ucred)) { 97982607Sdillon error = ENOSYS; 98082607Sdillon goto done2; 98182607Sdillon } 98282607Sdillon 9832729Sdfr msqid = IPCID_TO_IX(msqid); 9842729Sdfr 9852729Sdfr if (msqid < 0 || msqid >= msginfo.msgmni) { 9862729Sdfr#ifdef MSG_DEBUG_OK 9872729Sdfr printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 9882729Sdfr msginfo.msgmni); 9892729Sdfr#endif 99082607Sdillon error = EINVAL; 99182607Sdillon goto done2; 9922729Sdfr } 9932729Sdfr 9942729Sdfr msqptr = &msqids[msqid]; 9952729Sdfr if (msqptr->msg_qbytes == 0) { 9962729Sdfr#ifdef MSG_DEBUG_OK 9972729Sdfr printf("no such message queue id\n"); 9982729Sdfr#endif 99982607Sdillon error = EINVAL; 100082607Sdillon goto done2; 10012729Sdfr } 10022729Sdfr if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 10032729Sdfr#ifdef MSG_DEBUG_OK 10042729Sdfr printf("wrong sequence number\n"); 10052729Sdfr#endif 100682607Sdillon error = EINVAL; 100782607Sdillon goto done2; 10082729Sdfr } 10092729Sdfr 101082607Sdillon if ((error = ipcperm(p, &msqptr->msg_perm, IPC_R))) { 10112729Sdfr#ifdef MSG_DEBUG_OK 10122729Sdfr printf("requester doesn't have read access\n"); 10132729Sdfr#endif 101482607Sdillon goto done2; 10152729Sdfr } 10162729Sdfr 10172729Sdfr msghdr = NULL; 10182729Sdfr while (msghdr == NULL) { 10192729Sdfr if (msgtyp == 0) { 10202729Sdfr msghdr = msqptr->msg_first; 10212729Sdfr if (msghdr != NULL) { 10222729Sdfr if (msgsz < msghdr->msg_ts && 10232729Sdfr (msgflg & MSG_NOERROR) == 0) { 10242729Sdfr#ifdef MSG_DEBUG_OK 10252729Sdfr printf("first message on the queue is too big (want %d, got %d)\n", 10262729Sdfr msgsz, msghdr->msg_ts); 10272729Sdfr#endif 102882607Sdillon error = E2BIG; 102982607Sdillon goto done2; 10302729Sdfr } 10312729Sdfr if (msqptr->msg_first == msqptr->msg_last) { 10322729Sdfr msqptr->msg_first = NULL; 10332729Sdfr msqptr->msg_last = NULL; 10342729Sdfr } else { 10352729Sdfr msqptr->msg_first = msghdr->msg_next; 10362729Sdfr if (msqptr->msg_first == NULL) 10372729Sdfr panic("msg_first/last screwed up #1"); 10382729Sdfr } 10392729Sdfr } 10402729Sdfr } else { 10412729Sdfr struct msg *previous; 10422729Sdfr struct msg **prev; 10432729Sdfr 10442729Sdfr previous = NULL; 10452729Sdfr prev = &(msqptr->msg_first); 10462729Sdfr while ((msghdr = *prev) != NULL) { 10472729Sdfr /* 10482729Sdfr * Is this message's type an exact match or is 10492729Sdfr * this message's type less than or equal to 10502729Sdfr * the absolute value of a negative msgtyp? 10512729Sdfr * Note that the second half of this test can 10522729Sdfr * NEVER be true if msgtyp is positive since 10532729Sdfr * msg_type is always positive! 10542729Sdfr */ 10552729Sdfr 10562729Sdfr if (msgtyp == msghdr->msg_type || 10572729Sdfr msghdr->msg_type <= -msgtyp) { 10582729Sdfr#ifdef MSG_DEBUG_OK 10592729Sdfr printf("found message type %d, requested %d\n", 10602729Sdfr msghdr->msg_type, msgtyp); 10612729Sdfr#endif 10622729Sdfr if (msgsz < msghdr->msg_ts && 10632729Sdfr (msgflg & MSG_NOERROR) == 0) { 10642729Sdfr#ifdef MSG_DEBUG_OK 10652729Sdfr printf("requested message on the queue is too big (want %d, got %d)\n", 10662729Sdfr msgsz, msghdr->msg_ts); 10672729Sdfr#endif 106882607Sdillon error = E2BIG; 106982607Sdillon goto done2; 10702729Sdfr } 10712729Sdfr *prev = msghdr->msg_next; 10722729Sdfr if (msghdr == msqptr->msg_last) { 10732729Sdfr if (previous == NULL) { 10742729Sdfr if (prev != 10752729Sdfr &msqptr->msg_first) 10762729Sdfr panic("msg_first/last screwed up #2"); 10772729Sdfr msqptr->msg_first = 10782729Sdfr NULL; 10792729Sdfr msqptr->msg_last = 10802729Sdfr NULL; 10812729Sdfr } else { 10822729Sdfr if (prev == 10832729Sdfr &msqptr->msg_first) 10842729Sdfr panic("msg_first/last screwed up #3"); 10852729Sdfr msqptr->msg_last = 10862729Sdfr previous; 10872729Sdfr } 10882729Sdfr } 10892729Sdfr break; 10902729Sdfr } 10912729Sdfr previous = msghdr; 10922729Sdfr prev = &(msghdr->msg_next); 10932729Sdfr } 10942729Sdfr } 10952729Sdfr 10962729Sdfr /* 10972729Sdfr * We've either extracted the msghdr for the appropriate 10982729Sdfr * message or there isn't one. 10992729Sdfr * If there is one then bail out of this loop. 11002729Sdfr */ 11012729Sdfr 11022729Sdfr if (msghdr != NULL) 11032729Sdfr break; 11042729Sdfr 11052729Sdfr /* 11062729Sdfr * Hmph! No message found. Does the user want to wait? 11072729Sdfr */ 11082729Sdfr 11092729Sdfr if ((msgflg & IPC_NOWAIT) != 0) { 11102729Sdfr#ifdef MSG_DEBUG_OK 11112729Sdfr printf("no appropriate message found (msgtyp=%d)\n", 11122729Sdfr msgtyp); 11132729Sdfr#endif 11142729Sdfr /* The SVID says to return ENOMSG. */ 111582607Sdillon error = ENOMSG; 111682607Sdillon goto done2; 11172729Sdfr } 11182729Sdfr 11192729Sdfr /* 11202729Sdfr * Wait for something to happen 11212729Sdfr */ 11222729Sdfr 11232729Sdfr#ifdef MSG_DEBUG_OK 11242729Sdfr printf("msgrcv: goodnight\n"); 11252729Sdfr#endif 112682607Sdillon error = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, "msgwait", 11272729Sdfr 0); 11282729Sdfr#ifdef MSG_DEBUG_OK 112982607Sdillon printf("msgrcv: good morning (error=%d)\n", error); 11302729Sdfr#endif 11312729Sdfr 113282607Sdillon if (error != 0) { 11332729Sdfr#ifdef MSG_DEBUG_OK 11342729Sdfr printf("msgsnd: interrupted system call\n"); 11352729Sdfr#endif 113682607Sdillon error = EINTR; 113782607Sdillon goto done2; 11382729Sdfr } 11392729Sdfr 11402729Sdfr /* 11412729Sdfr * Make sure that the msq queue still exists 11422729Sdfr */ 11432729Sdfr 11442729Sdfr if (msqptr->msg_qbytes == 0 || 11452729Sdfr msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 11462729Sdfr#ifdef MSG_DEBUG_OK 11472729Sdfr printf("msqid deleted\n"); 11482729Sdfr#endif 114982607Sdillon error = EIDRM; 115082607Sdillon goto done2; 11512729Sdfr } 11522729Sdfr } 11532729Sdfr 11542729Sdfr /* 11552729Sdfr * Return the message to the user. 11562729Sdfr * 11572729Sdfr * First, do the bookkeeping (before we risk being interrupted). 11582729Sdfr */ 11592729Sdfr 11602729Sdfr msqptr->msg_cbytes -= msghdr->msg_ts; 11612729Sdfr msqptr->msg_qnum--; 11622729Sdfr msqptr->msg_lrpid = p->p_pid; 116334961Sphk msqptr->msg_rtime = time_second; 11642729Sdfr 11652729Sdfr /* 11662729Sdfr * Make msgsz the actual amount that we'll be returning. 11672729Sdfr * Note that this effectively truncates the message if it is too long 11682729Sdfr * (since msgsz is never increased). 11692729Sdfr */ 11702729Sdfr 11712729Sdfr#ifdef MSG_DEBUG_OK 11722729Sdfr printf("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 11732729Sdfr msghdr->msg_ts); 11742729Sdfr#endif 11752729Sdfr if (msgsz > msghdr->msg_ts) 11762729Sdfr msgsz = msghdr->msg_ts; 11772729Sdfr 11782729Sdfr /* 11792729Sdfr * Return the type to the user. 11802729Sdfr */ 11812729Sdfr 118282607Sdillon error = copyout((caddr_t)&(msghdr->msg_type), user_msgp, 11832729Sdfr sizeof(msghdr->msg_type)); 118482607Sdillon if (error != 0) { 11852729Sdfr#ifdef MSG_DEBUG_OK 118682607Sdillon printf("error (%d) copying out message type\n", error); 11872729Sdfr#endif 11882729Sdfr msg_freehdr(msghdr); 11892729Sdfr wakeup((caddr_t)msqptr); 119082607Sdillon goto done2; 11912729Sdfr } 119217971Sbde user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 11932729Sdfr 11942729Sdfr /* 11952729Sdfr * Return the segments to the user 11962729Sdfr */ 11972729Sdfr 11982729Sdfr next = msghdr->msg_spot; 11992729Sdfr for (len = 0; len < msgsz; len += msginfo.msgssz) { 12002729Sdfr size_t tlen; 12012729Sdfr 120245921Ssada if (msgsz - len > msginfo.msgssz) 12032729Sdfr tlen = msginfo.msgssz; 12042729Sdfr else 120545921Ssada tlen = msgsz - len; 12062729Sdfr if (next <= -1) 12072729Sdfr panic("next too low #3"); 12082729Sdfr if (next >= msginfo.msgseg) 12092729Sdfr panic("next out of range #3"); 121082607Sdillon error = copyout((caddr_t)&msgpool[next * msginfo.msgssz], 12112729Sdfr user_msgp, tlen); 121282607Sdillon if (error != 0) { 12132729Sdfr#ifdef MSG_DEBUG_OK 12142729Sdfr printf("error (%d) copying out message segment\n", 121582607Sdillon error); 12162729Sdfr#endif 12172729Sdfr msg_freehdr(msghdr); 12182729Sdfr wakeup((caddr_t)msqptr); 121982607Sdillon goto done2; 12202729Sdfr } 122117971Sbde user_msgp = (char *)user_msgp + tlen; 12222729Sdfr next = msgmaps[next].next; 12232729Sdfr } 12242729Sdfr 12252729Sdfr /* 12262729Sdfr * Done, return the actual number of bytes copied out. 12272729Sdfr */ 12282729Sdfr 12292729Sdfr msg_freehdr(msghdr); 12302729Sdfr wakeup((caddr_t)msqptr); 123130994Sphk p->p_retval[0] = msgsz; 123282607Sdillondone2: 123382607Sdillon mtx_unlock(&Giant); 123482607Sdillon return (error); 12352729Sdfr} 123677461Sdd 123777461Sddstatic int 123877461Sddsysctl_msqids(SYSCTL_HANDLER_ARGS) 123977461Sdd{ 124077461Sdd 124177461Sdd return (SYSCTL_OUT(req, msqids, 124277461Sdd sizeof(struct msqid_ds) * msginfo.msgmni)); 124377461Sdd} 124477461Sdd 124577461SddSYSCTL_DECL(_kern_ipc); 124677461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, ""); 124777461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RD, &msginfo.msgmni, 0, ""); 124877461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RD, &msginfo.msgmnb, 0, ""); 124977461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RD, &msginfo.msgtql, 0, ""); 125077461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RD, &msginfo.msgssz, 0, ""); 125177461SddSYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RD, &msginfo.msgseg, 0, "") 125277461SddSYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD, 125377461Sdd NULL, 0, sysctl_msqids, "", "Message queue IDs"); 1254