sysv_msg.c revision 107896
1112694Stegge/* $FreeBSD: head/sys/kern/sysv_msg.c 107896 2002-12-15 09:41:46Z maxim $ */ 2112694Stegge 3112694Stegge/* 4112694Stegge * Implementation of SVID messages 5112694Stegge * 6112694Stegge * Author: Daniel Boulet 7112694Stegge * 8112694Stegge * Copyright 1993 Daniel Boulet and RTMX Inc. 9112694Stegge * 10112694Stegge * This system call was implemented by Daniel Boulet under contract from RTMX. 11112694Stegge * 12112694Stegge * Redistribution and use in source forms, with and without modification, 13112694Stegge * are permitted provided that this entire comment appears intact. 14112694Stegge * 15112694Stegge * Redistribution in binary form may occur without any restrictions. 16112694Stegge * Obviously, it would be nice if you gave credit where credit is due 17112694Stegge * but requiring it would be too onerous. 18112694Stegge * 19112694Stegge * This software is provided ``AS IS'' without any warranties of any kind. 20112694Stegge */ 21112694Stegge 22112694Stegge#include "opt_sysvipc.h" 23112694Stegge 24112694Stegge#include <sys/param.h> 25112694Stegge#include <sys/systm.h> 26112694Stegge#include <sys/sysproto.h> 27112694Stegge#include <sys/kernel.h> 28112694Stegge#include <sys/proc.h> 29112694Stegge#include <sys/lock.h> 30112694Stegge#include <sys/mutex.h> 31112694Stegge#include <sys/msg.h> 32112694Stegge#include <sys/syscall.h> 33112694Stegge#include <sys/sysent.h> 34112694Stegge#include <sys/sysctl.h> 35114216Skan#include <sys/malloc.h> 36112694Stegge#include <sys/jail.h> 37112694Stegge 38112694Steggestatic MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); 39112694Stegge 40112694Steggestatic void msginit(void); 41112694Steggestatic int msgunload(void); 42112694Steggestatic int sysvmsg_modload(struct module *, int, void *); 43112694Stegge 44112694Stegge#ifdef MSG_DEBUG 45112694Stegge#define DPRINTF(a) printf a 46112694Stegge#else 47112694Stegge#define DPRINTF(a) 48112694Stegge#endif 49112694Stegge 50112694Steggestatic void msg_freehdr(struct msg *msghdr); 51112694Stegge 52112694Stegge/* XXX casting to (sy_call_t *) is bogus, as usual. */ 53112694Steggestatic sy_call_t *msgcalls[] = { 54112694Stegge (sy_call_t *)msgctl, (sy_call_t *)msgget, 55112694Stegge (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 56112694Stegge}; 57112694Stegge 58112694Steggestruct msg { 59112694Stegge struct msg *msg_next; /* next msg in the chain */ 60112694Stegge long msg_type; /* type of this message */ 61112694Stegge /* >0 -> type of this message */ 62112694Stegge /* 0 -> free header */ 63112694Stegge u_short msg_ts; /* size of this message */ 64112694Stegge short msg_spot; /* location of start of msg in buffer */ 65112694Stegge}; 66112694Stegge 67112694Stegge 68112694Stegge#ifndef MSGSSZ 69112694Stegge#define MSGSSZ 8 /* Each segment must be 2^N long */ 70112694Stegge#endif 71112694Stegge#ifndef MSGSEG 72112694Stegge#define MSGSEG 2048 /* must be less than 32767 */ 73112694Stegge#endif 74112694Stegge#define MSGMAX (MSGSSZ*MSGSEG) 75112694Stegge#ifndef MSGMNB 76112694Stegge#define MSGMNB 2048 /* max # of bytes in a queue */ 77112694Stegge#endif 78112694Stegge#ifndef MSGMNI 79112694Stegge#define MSGMNI 40 80112694Stegge#endif 81112694Stegge#ifndef MSGTQL 82112694Stegge#define MSGTQL 40 83112694Stegge#endif 84112694Stegge 85112694Stegge/* 86112694Stegge * Based on the configuration parameters described in an SVR2 (yes, two) 87112694Stegge * config(1m) man page. 88112694Stegge * 89112694Stegge * Each message is broken up and stored in segments that are msgssz bytes 90112694Stegge * long. For efficiency reasons, this should be a power of two. Also, 91112694Stegge * it doesn't make sense if it is less than 8 or greater than about 256. 92112694Stegge * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of 93112694Stegge * two between 8 and 1024 inclusive (and panic's if it isn't). 94112694Stegge */ 95112694Steggestruct msginfo msginfo = { 96112694Stegge MSGMAX, /* max chars in a message */ 97112694Stegge MSGMNI, /* # of message queue identifiers */ 98112694Stegge MSGMNB, /* max chars in a queue */ 99112694Stegge MSGTQL, /* max messages in system */ 100112694Stegge MSGSSZ, /* size of a message segment */ 101112694Stegge /* (must be small power of 2 greater than 4) */ 102112694Stegge MSGSEG /* number of message segments */ 103112694Stegge}; 104112694Stegge 105112694Stegge/* 106112694Stegge * macros to convert between msqid_ds's and msqid's. 107112694Stegge * (specific to this implementation) 108112694Stegge */ 109112694Stegge#define MSQID(ix,ds) ((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000)) 110112694Stegge#define MSQID_IX(id) ((id) & 0xffff) 111112694Stegge#define MSQID_SEQ(id) (((id) >> 16) & 0xffff) 112112694Stegge 113112694Stegge/* 114112694Stegge * The rest of this file is specific to this particular implementation. 115112694Stegge */ 116112694Stegge 117112694Steggestruct msgmap { 118112694Stegge short next; /* next segment in buffer */ 119112694Stegge /* -1 -> available */ 120112694Stegge /* 0..(MSGSEG-1) -> index of next segment */ 121112694Stegge}; 122112694Stegge 123112694Stegge#define MSG_LOCKED 01000 /* Is this msqid_ds locked? */ 124112694Stegge 125112694Steggestatic int nfree_msgmaps; /* # of free map entries */ 126112694Steggestatic short free_msgmaps; /* head of linked list of free map entries */ 127112694Steggestatic struct msg *free_msghdrs;/* list of free msg headers */ 128112694Steggestatic char *msgpool; /* MSGMAX byte long msg buffer pool */ 129112694Steggestatic struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 130112694Steggestatic struct msg *msghdrs; /* MSGTQL msg headers */ 131112694Steggestatic struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 132112694Steggestatic struct mtx msq_mtx; /* global mutex for message queues. */ 133112694Stegge 134112694Steggestatic void 135112694Steggemsginit() 136112694Stegge{ 137112694Stegge register int i; 138112694Stegge 139112694Stegge TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg); 140112694Stegge TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz); 141112694Stegge msginfo.msgmax = msginfo.msgseg * msginfo.msgssz; 142112694Stegge TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni); 143112694Stegge 144112694Stegge msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK); 145112694Stegge if (msgpool == NULL) 146112694Stegge panic("msgpool is NULL"); 147112694Stegge msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK); 148112694Stegge if (msgmaps == NULL) 149112694Stegge panic("msgmaps is NULL"); 150112694Stegge msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK); 151112694Stegge if (msghdrs == NULL) 152112694Stegge panic("msghdrs is NULL"); 153112694Stegge msqids = malloc(sizeof(struct msqid_ds) * msginfo.msgmni, M_MSG, M_WAITOK); 154112694Stegge if (msqids == NULL) 155112694Stegge panic("msqids is NULL"); 156112694Stegge 157112694Stegge /* 158112694Stegge * msginfo.msgssz should be a power of two for efficiency reasons. 159112694Stegge * It is also pretty silly if msginfo.msgssz is less than 8 160112694Stegge * or greater than about 256 so ... 161112694Stegge */ 162112694Stegge 163112694Stegge i = 8; 164112694Stegge while (i < 1024 && i != msginfo.msgssz) 165112694Stegge i <<= 1; 166112694Stegge if (i != msginfo.msgssz) { 167112694Stegge DPRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 168112694Stegge msginfo.msgssz)); 169112694Stegge panic("msginfo.msgssz not a small power of 2"); 170112694Stegge } 171112694Stegge 172112694Stegge if (msginfo.msgseg > 32767) { 173112694Stegge DPRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 174112694Stegge panic("msginfo.msgseg > 32767"); 175112694Stegge } 176112694Stegge 177112694Stegge if (msgmaps == NULL) 178112694Stegge panic("msgmaps is NULL"); 179112694Stegge 180112694Stegge for (i = 0; i < msginfo.msgseg; i++) { 181112694Stegge if (i > 0) 182112694Stegge msgmaps[i-1].next = i; 183112694Stegge msgmaps[i].next = -1; /* implies entry is available */ 184112694Stegge } 185112694Stegge free_msgmaps = 0; 186112694Stegge nfree_msgmaps = msginfo.msgseg; 187112694Stegge 188112694Stegge if (msghdrs == NULL) 189112694Stegge panic("msghdrs is NULL"); 190112694Stegge 191112694Stegge for (i = 0; i < msginfo.msgtql; i++) { 192112694Stegge msghdrs[i].msg_type = 0; 193112694Stegge if (i > 0) 194112694Stegge msghdrs[i-1].msg_next = &msghdrs[i]; 195112694Stegge msghdrs[i].msg_next = NULL; 196112694Stegge } 197112694Stegge free_msghdrs = &msghdrs[0]; 198112694Stegge 199112694Stegge if (msqids == NULL) 200112694Stegge panic("msqids is NULL"); 201112694Stegge 202112694Stegge for (i = 0; i < msginfo.msgmni; i++) { 203112694Stegge msqids[i].msg_qbytes = 0; /* implies entry is available */ 204112694Stegge msqids[i].msg_perm.seq = 0; /* reset to a known value */ 205112694Stegge msqids[i].msg_perm.mode = 0; 206112694Stegge } 207112694Stegge mtx_init(&msq_mtx, "msq", NULL, MTX_DEF); 208112694Stegge} 209112694Stegge 210112694Steggestatic int 211112694Steggemsgunload() 212112694Stegge{ 213112694Stegge struct msqid_ds *msqptr; 214112694Stegge int msqid; 215112694Stegge 216112694Stegge for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 217112694Stegge /* 218112694Stegge * Look for an unallocated and unlocked msqid_ds. 219112694Stegge * msqid_ds's can be locked by msgsnd or msgrcv while 220112694Stegge * they are copying the message in/out. We can't 221112694Stegge * re-use the entry until they release it. 222112694Stegge */ 223112694Stegge msqptr = &msqids[msqid]; 224112694Stegge if (msqptr->msg_qbytes != 0 || 225112694Stegge (msqptr->msg_perm.mode & MSG_LOCKED) != 0) 226112694Stegge break; 227112694Stegge } 228112694Stegge if (msqid != msginfo.msgmni) 229112694Stegge return (EBUSY); 230112694Stegge 231112694Stegge free(msgpool, M_MSG); 232112694Stegge free(msgmaps, M_MSG); 233112694Stegge free(msghdrs, M_MSG); 234112694Stegge free(msqids, M_MSG); 235112694Stegge mtx_destroy(&msq_mtx); 236112694Stegge return (0); 237112694Stegge} 238112694Stegge 239112694Stegge 240112694Steggestatic int 241112694Steggesysvmsg_modload(struct module *module, int cmd, void *arg) 242112694Stegge{ 243112694Stegge int error = 0; 244112694Stegge 245112694Stegge switch (cmd) { 246112694Stegge case MOD_LOAD: 247112724Stegge msginit(); 248112694Stegge break; 249112694Stegge case MOD_UNLOAD: 250112694Stegge error = msgunload(); 251112694Stegge break; 252112694Stegge case MOD_SHUTDOWN: 253112694Stegge break; 254112694Stegge default: 255112694Stegge error = EINVAL; 256112694Stegge break; 257112694Stegge } 258112694Stegge return (error); 259112694Stegge} 260112694Stegge 261112694Steggestatic moduledata_t sysvmsg_mod = { 262112694Stegge "sysvmsg", 263112694Stegge &sysvmsg_modload, 264112694Stegge NULL 265112694Stegge}; 266112694Stegge 267112694SteggeSYSCALL_MODULE_HELPER(msgsys); 268112694SteggeSYSCALL_MODULE_HELPER(msgctl); 269112694SteggeSYSCALL_MODULE_HELPER(msgget); 270112694SteggeSYSCALL_MODULE_HELPER(msgsnd); 271112694SteggeSYSCALL_MODULE_HELPER(msgrcv); 272112694Stegge 273112694SteggeDECLARE_MODULE(sysvmsg, sysvmsg_mod, 274112694Stegge SI_SUB_SYSV_MSG, SI_ORDER_FIRST); 275112694SteggeMODULE_VERSION(sysvmsg, 1); 276112694Stegge 277112694Stegge/* 278112694Stegge * Entry point for all MSG calls 279112694Stegge * 280112694Stegge * MPSAFE 281112694Stegge */ 282112694Steggeint 283112694Steggemsgsys(td, uap) 284112694Stegge struct thread *td; 285112694Stegge /* XXX actually varargs. */ 286112694Stegge struct msgsys_args /* { 287112694Stegge u_int which; 288112694Stegge int a2; 289112694Stegge int a3; 290112694Stegge int a4; 291112694Stegge int a5; 292112694Stegge int a6; 293112694Stegge } */ *uap; 294112694Stegge{ 295112694Stegge int error; 296112694Stegge 297112694Stegge if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 298112694Stegge return (ENOSYS); 299112694Stegge if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) 300112694Stegge return (EINVAL); 301112694Stegge error = (*msgcalls[uap->which])(td, &uap->a2); 302112694Stegge return (error); 303112694Stegge} 304112694Stegge 305112694Steggestatic void 306112694Steggemsg_freehdr(msghdr) 307112694Stegge struct msg *msghdr; 308112694Stegge{ 309112694Stegge while (msghdr->msg_ts > 0) { 310112694Stegge short next; 311112694Stegge if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 312112694Stegge panic("msghdr->msg_spot out of range"); 313112694Stegge next = msgmaps[msghdr->msg_spot].next; 314112694Stegge msgmaps[msghdr->msg_spot].next = free_msgmaps; 315112694Stegge free_msgmaps = msghdr->msg_spot; 316112694Stegge nfree_msgmaps++; 317112694Stegge msghdr->msg_spot = next; 318112694Stegge if (msghdr->msg_ts >= msginfo.msgssz) 319112694Stegge msghdr->msg_ts -= msginfo.msgssz; 320112694Stegge else 321112694Stegge msghdr->msg_ts = 0; 322112694Stegge } 323112694Stegge if (msghdr->msg_spot != -1) 324112694Stegge panic("msghdr->msg_spot != -1"); 325112694Stegge msghdr->msg_next = free_msghdrs; 326112694Stegge free_msghdrs = msghdr; 327112694Stegge} 328112694Stegge 329112694Stegge#ifndef _SYS_SYSPROTO_H_ 330112694Steggestruct msgctl_args { 331112694Stegge int msqid; 332112718Stegge int cmd; 333112694Stegge struct msqid_ds *buf; 334112694Stegge}; 335112694Stegge#endif 336112694Stegge 337112694Stegge/* 338112694Stegge * MPSAFE 339112694Stegge */ 340112694Steggeint 341112694Steggemsgctl(td, uap) 342112694Stegge struct thread *td; 343112694Stegge register struct msgctl_args *uap; 344112694Stegge{ 345112694Stegge int msqid = uap->msqid; 346112694Stegge int cmd = uap->cmd; 347112694Stegge struct msqid_ds *user_msqptr = uap->buf; 348112694Stegge int rval, error; 349112694Stegge struct msqid_ds msqbuf; 350112694Stegge register struct msqid_ds *msqptr; 351112694Stegge 352112694Stegge DPRINTF(("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr)); 353112694Stegge if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 354112694Stegge return (ENOSYS); 355112694Stegge 356112694Stegge msqid = IPCID_TO_IX(msqid); 357112694Stegge 358112694Stegge if (msqid < 0 || msqid >= msginfo.msgmni) { 359112694Stegge DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 360112694Stegge msginfo.msgmni)); 361112694Stegge return (EINVAL); 362112694Stegge } 363112694Stegge if (cmd == IPC_SET && 364112694Stegge (error = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0) 365112694Stegge return (error); 366112694Stegge 367112694Stegge msqptr = &msqids[msqid]; 368112694Stegge 369112694Stegge mtx_lock(&msq_mtx); 370112694Stegge if (msqptr->msg_qbytes == 0) { 371112694Stegge DPRINTF(("no such msqid\n")); 372112694Stegge error = EINVAL; 373112694Stegge goto done2; 374112694Stegge } 375112694Stegge if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 376112694Stegge DPRINTF(("wrong sequence number\n")); 377112694Stegge error = EINVAL; 378112694Stegge goto done2; 379112694Stegge } 380112694Stegge 381112694Stegge error = 0; 382112694Stegge rval = 0; 383112694Stegge 384112694Stegge switch (cmd) { 385112694Stegge 386112694Stegge case IPC_RMID: 387112694Stegge { 388112694Stegge struct msg *msghdr; 389112694Stegge if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 390112694Stegge goto done2; 391112694Stegge /* Free the message headers */ 392112694Stegge msghdr = msqptr->msg_first; 393112694Stegge while (msghdr != NULL) { 394112694Stegge struct msg *msghdr_tmp; 395112694Stegge 396112694Stegge /* Free the segments of each message */ 397112694Stegge msqptr->msg_cbytes -= msghdr->msg_ts; 398112694Stegge msqptr->msg_qnum--; 399112694Stegge msghdr_tmp = msghdr; 400112694Stegge msghdr = msghdr->msg_next; 401112694Stegge msg_freehdr(msghdr_tmp); 402112694Stegge } 403112694Stegge 404112718Stegge if (msqptr->msg_cbytes != 0) 405112694Stegge panic("msg_cbytes is screwed up"); 406112694Stegge if (msqptr->msg_qnum != 0) 407112694Stegge panic("msg_qnum is screwed up"); 408112694Stegge 409112694Stegge msqptr->msg_qbytes = 0; /* Mark it as free */ 410112694Stegge 411112694Stegge wakeup(msqptr); 412112694Stegge } 413112694Stegge 414112694Stegge break; 415112694Stegge 416112694Stegge case IPC_SET: 417112694Stegge if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M))) 418112694Stegge goto done2; 419112694Stegge if (msqbuf.msg_qbytes > msqptr->msg_qbytes) { 420112694Stegge error = suser(td); 421112694Stegge if (error) 422112694Stegge goto done2; 423112694Stegge } 424112694Stegge if (msqbuf.msg_qbytes > msginfo.msgmnb) { 425112694Stegge DPRINTF(("can't increase msg_qbytes beyond %d" 426112694Stegge "(truncating)\n", msginfo.msgmnb)); 427112694Stegge msqbuf.msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 428112694Stegge } 429112694Stegge if (msqbuf.msg_qbytes == 0) { 430112694Stegge DPRINTF(("can't reduce msg_qbytes to 0\n")); 431112694Stegge error = EINVAL; /* non-standard errno! */ 432112694Stegge goto done2; 433112694Stegge } 434112694Stegge msqptr->msg_perm.uid = msqbuf.msg_perm.uid; /* change the owner */ 435112694Stegge msqptr->msg_perm.gid = msqbuf.msg_perm.gid; /* change the owner */ 436112694Stegge msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 437112694Stegge (msqbuf.msg_perm.mode & 0777); 438112694Stegge msqptr->msg_qbytes = msqbuf.msg_qbytes; 439112694Stegge msqptr->msg_ctime = time_second; 440112694Stegge break; 441112694Stegge 442112694Stegge case IPC_STAT: 443112694Stegge if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 444112694Stegge DPRINTF(("requester doesn't have read access\n")); 445112694Stegge goto done2; 446112694Stegge } 447112694Stegge break; 448112694Stegge 449112694Stegge default: 450112694Stegge DPRINTF(("invalid command %d\n", cmd)); 451112694Stegge error = EINVAL; 452112694Stegge goto done2; 453112694Stegge } 454112694Stegge 455112694Stegge if (error == 0) 456112694Stegge td->td_retval[0] = rval; 457112694Steggedone2: 458112694Stegge mtx_unlock(&msq_mtx); 459112694Stegge if (cmd == IPC_STAT && error == 0) 460112694Stegge error = copyout(msqptr, user_msqptr, sizeof(struct msqid_ds)); 461112694Stegge return(error); 462112694Stegge} 463112694Stegge 464112694Stegge#ifndef _SYS_SYSPROTO_H_ 465112694Steggestruct msgget_args { 466112694Stegge key_t key; 467112694Stegge int msgflg; 468112694Stegge}; 469112694Stegge#endif 470112694Stegge 471112694Stegge/* 472112694Stegge * MPSAFE 473112694Stegge */ 474112694Steggeint 475112694Steggemsgget(td, uap) 476112694Stegge struct thread *td; 477112694Stegge register struct msgget_args *uap; 478112694Stegge{ 479112694Stegge int msqid, error = 0; 480112694Stegge int key = uap->key; 481112694Stegge int msgflg = uap->msgflg; 482112694Stegge struct ucred *cred = td->td_ucred; 483112694Stegge register struct msqid_ds *msqptr = NULL; 484112694Stegge 485112694Stegge DPRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 486112694Stegge 487112718Stegge if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 488112694Stegge return (ENOSYS); 489 490 mtx_lock(&msq_mtx); 491 if (key != IPC_PRIVATE) { 492 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 493 msqptr = &msqids[msqid]; 494 if (msqptr->msg_qbytes != 0 && 495 msqptr->msg_perm.key == key) 496 break; 497 } 498 if (msqid < msginfo.msgmni) { 499 DPRINTF(("found public key\n")); 500 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 501 DPRINTF(("not exclusive\n")); 502 error = EEXIST; 503 goto done2; 504 } 505 if ((error = ipcperm(td, &msqptr->msg_perm, msgflg & 0700 ))) { 506 DPRINTF(("requester doesn't have 0%o access\n", 507 msgflg & 0700)); 508 goto done2; 509 } 510 goto found; 511 } 512 } 513 514 DPRINTF(("need to allocate the msqid_ds\n")); 515 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 516 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 517 /* 518 * Look for an unallocated and unlocked msqid_ds. 519 * msqid_ds's can be locked by msgsnd or msgrcv while 520 * they are copying the message in/out. We can't 521 * re-use the entry until they release it. 522 */ 523 msqptr = &msqids[msqid]; 524 if (msqptr->msg_qbytes == 0 && 525 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 526 break; 527 } 528 if (msqid == msginfo.msgmni) { 529 DPRINTF(("no more msqid_ds's available\n")); 530 error = ENOSPC; 531 goto done2; 532 } 533 DPRINTF(("msqid %d is available\n", msqid)); 534 msqptr->msg_perm.key = key; 535 msqptr->msg_perm.cuid = cred->cr_uid; 536 msqptr->msg_perm.uid = cred->cr_uid; 537 msqptr->msg_perm.cgid = cred->cr_gid; 538 msqptr->msg_perm.gid = cred->cr_gid; 539 msqptr->msg_perm.mode = (msgflg & 0777); 540 /* Make sure that the returned msqid is unique */ 541 msqptr->msg_perm.seq = (msqptr->msg_perm.seq + 1) & 0x7fff; 542 msqptr->msg_first = NULL; 543 msqptr->msg_last = NULL; 544 msqptr->msg_cbytes = 0; 545 msqptr->msg_qnum = 0; 546 msqptr->msg_qbytes = msginfo.msgmnb; 547 msqptr->msg_lspid = 0; 548 msqptr->msg_lrpid = 0; 549 msqptr->msg_stime = 0; 550 msqptr->msg_rtime = 0; 551 msqptr->msg_ctime = time_second; 552 } else { 553 DPRINTF(("didn't find it and wasn't asked to create it\n")); 554 error = ENOENT; 555 goto done2; 556 } 557 558found: 559 /* Construct the unique msqid */ 560 td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 561done2: 562 mtx_unlock(&msq_mtx); 563 return (error); 564} 565 566#ifndef _SYS_SYSPROTO_H_ 567struct msgsnd_args { 568 int msqid; 569 void *msgp; 570 size_t msgsz; 571 int msgflg; 572}; 573#endif 574 575/* 576 * MPSAFE 577 */ 578int 579msgsnd(td, uap) 580 struct thread *td; 581 register struct msgsnd_args *uap; 582{ 583 int msqid = uap->msqid; 584 void *user_msgp = uap->msgp; 585 size_t msgsz = uap->msgsz; 586 int msgflg = uap->msgflg; 587 int segs_needed, error = 0; 588 register struct msqid_ds *msqptr; 589 register struct msg *msghdr; 590 short next; 591 592 DPRINTF(("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 593 msgflg)); 594 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 595 return (ENOSYS); 596 597 mtx_lock(&msq_mtx); 598 msqid = IPCID_TO_IX(msqid); 599 600 if (msqid < 0 || msqid >= msginfo.msgmni) { 601 DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 602 msginfo.msgmni)); 603 error = EINVAL; 604 goto done2; 605 } 606 607 msqptr = &msqids[msqid]; 608 if (msqptr->msg_qbytes == 0) { 609 DPRINTF(("no such message queue id\n")); 610 error = EINVAL; 611 goto done2; 612 } 613 if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 614 DPRINTF(("wrong sequence number\n")); 615 error = EINVAL; 616 goto done2; 617 } 618 619 if ((error = ipcperm(td, &msqptr->msg_perm, IPC_W))) { 620 DPRINTF(("requester doesn't have write access\n")); 621 goto done2; 622 } 623 624 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 625 DPRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 626 segs_needed)); 627 for (;;) { 628 int need_more_resources = 0; 629 630 /* 631 * check msgsz 632 * (inside this loop in case msg_qbytes changes while we sleep) 633 */ 634 635 if (msgsz > msqptr->msg_qbytes) { 636 DPRINTF(("msgsz > msqptr->msg_qbytes\n")); 637 error = EINVAL; 638 goto done2; 639 } 640 641 if (msqptr->msg_perm.mode & MSG_LOCKED) { 642 DPRINTF(("msqid is locked\n")); 643 need_more_resources = 1; 644 } 645 if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) { 646 DPRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 647 need_more_resources = 1; 648 } 649 if (segs_needed > nfree_msgmaps) { 650 DPRINTF(("segs_needed > nfree_msgmaps\n")); 651 need_more_resources = 1; 652 } 653 if (free_msghdrs == NULL) { 654 DPRINTF(("no more msghdrs\n")); 655 need_more_resources = 1; 656 } 657 658 if (need_more_resources) { 659 int we_own_it; 660 661 if ((msgflg & IPC_NOWAIT) != 0) { 662 DPRINTF(("need more resources but caller " 663 "doesn't want to wait\n")); 664 error = EAGAIN; 665 goto done2; 666 } 667 668 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 669 DPRINTF(("we don't own the msqid_ds\n")); 670 we_own_it = 0; 671 } else { 672 /* Force later arrivals to wait for our 673 request */ 674 DPRINTF(("we own the msqid_ds\n")); 675 msqptr->msg_perm.mode |= MSG_LOCKED; 676 we_own_it = 1; 677 } 678 DPRINTF(("goodnight\n")); 679 error = msleep(msqptr, &msq_mtx, (PZERO - 4) | PCATCH, 680 "msgwait", 0); 681 DPRINTF(("good morning, error=%d\n", error)); 682 if (we_own_it) 683 msqptr->msg_perm.mode &= ~MSG_LOCKED; 684 if (error != 0) { 685 DPRINTF(("msgsnd: interrupted system call\n")); 686 error = EINTR; 687 goto done2; 688 } 689 690 /* 691 * Make sure that the msq queue still exists 692 */ 693 694 if (msqptr->msg_qbytes == 0) { 695 DPRINTF(("msqid deleted\n")); 696 error = EIDRM; 697 goto done2; 698 } 699 700 } else { 701 DPRINTF(("got all the resources that we need\n")); 702 break; 703 } 704 } 705 706 /* 707 * We have the resources that we need. 708 * Make sure! 709 */ 710 711 if (msqptr->msg_perm.mode & MSG_LOCKED) 712 panic("msg_perm.mode & MSG_LOCKED"); 713 if (segs_needed > nfree_msgmaps) 714 panic("segs_needed > nfree_msgmaps"); 715 if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) 716 panic("msgsz + msg_cbytes > msg_qbytes"); 717 if (free_msghdrs == NULL) 718 panic("no more msghdrs"); 719 720 /* 721 * Re-lock the msqid_ds in case we page-fault when copying in the 722 * message 723 */ 724 725 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 726 panic("msqid_ds is already locked"); 727 msqptr->msg_perm.mode |= MSG_LOCKED; 728 729 /* 730 * Allocate a message header 731 */ 732 733 msghdr = free_msghdrs; 734 free_msghdrs = msghdr->msg_next; 735 msghdr->msg_spot = -1; 736 msghdr->msg_ts = msgsz; 737 738 /* 739 * Allocate space for the message 740 */ 741 742 while (segs_needed > 0) { 743 if (nfree_msgmaps <= 0) 744 panic("not enough msgmaps"); 745 if (free_msgmaps == -1) 746 panic("nil free_msgmaps"); 747 next = free_msgmaps; 748 if (next <= -1) 749 panic("next too low #1"); 750 if (next >= msginfo.msgseg) 751 panic("next out of range #1"); 752 DPRINTF(("allocating segment %d to message\n", next)); 753 free_msgmaps = msgmaps[next].next; 754 nfree_msgmaps--; 755 msgmaps[next].next = msghdr->msg_spot; 756 msghdr->msg_spot = next; 757 segs_needed--; 758 } 759 760 /* 761 * Copy in the message type 762 */ 763 764 mtx_unlock(&msq_mtx); 765 if ((error = copyin(user_msgp, &msghdr->msg_type, 766 sizeof(msghdr->msg_type))) != 0) { 767 mtx_lock(&msq_mtx); 768 DPRINTF(("error %d copying the message type\n", error)); 769 msg_freehdr(msghdr); 770 msqptr->msg_perm.mode &= ~MSG_LOCKED; 771 wakeup(msqptr); 772 goto done2; 773 } 774 mtx_lock(&msq_mtx); 775 user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 776 777 /* 778 * Validate the message type 779 */ 780 781 if (msghdr->msg_type < 1) { 782 msg_freehdr(msghdr); 783 msqptr->msg_perm.mode &= ~MSG_LOCKED; 784 wakeup(msqptr); 785 DPRINTF(("mtype (%d) < 1\n", msghdr->msg_type)); 786 error = EINVAL; 787 goto done2; 788 } 789 790 /* 791 * Copy in the message body 792 */ 793 794 next = msghdr->msg_spot; 795 while (msgsz > 0) { 796 size_t tlen; 797 if (msgsz > msginfo.msgssz) 798 tlen = msginfo.msgssz; 799 else 800 tlen = msgsz; 801 if (next <= -1) 802 panic("next too low #2"); 803 if (next >= msginfo.msgseg) 804 panic("next out of range #2"); 805 mtx_unlock(&msq_mtx); 806 if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 807 tlen)) != 0) { 808 mtx_lock(&msq_mtx); 809 DPRINTF(("error %d copying in message segment\n", 810 error)); 811 msg_freehdr(msghdr); 812 msqptr->msg_perm.mode &= ~MSG_LOCKED; 813 wakeup(msqptr); 814 goto done2; 815 } 816 mtx_lock(&msq_mtx); 817 msgsz -= tlen; 818 user_msgp = (char *)user_msgp + tlen; 819 next = msgmaps[next].next; 820 } 821 if (next != -1) 822 panic("didn't use all the msg segments"); 823 824 /* 825 * We've got the message. Unlock the msqid_ds. 826 */ 827 828 msqptr->msg_perm.mode &= ~MSG_LOCKED; 829 830 /* 831 * Make sure that the msqid_ds is still allocated. 832 */ 833 834 if (msqptr->msg_qbytes == 0) { 835 msg_freehdr(msghdr); 836 wakeup(msqptr); 837 error = EIDRM; 838 goto done2; 839 } 840 841 /* 842 * Put the message into the queue 843 */ 844 845 if (msqptr->msg_first == NULL) { 846 msqptr->msg_first = msghdr; 847 msqptr->msg_last = msghdr; 848 } else { 849 msqptr->msg_last->msg_next = msghdr; 850 msqptr->msg_last = msghdr; 851 } 852 msqptr->msg_last->msg_next = NULL; 853 854 msqptr->msg_cbytes += msghdr->msg_ts; 855 msqptr->msg_qnum++; 856 msqptr->msg_lspid = td->td_proc->p_pid; 857 msqptr->msg_stime = time_second; 858 859 wakeup(msqptr); 860 td->td_retval[0] = 0; 861done2: 862 mtx_unlock(&msq_mtx); 863 return (error); 864} 865 866#ifndef _SYS_SYSPROTO_H_ 867struct msgrcv_args { 868 int msqid; 869 void *msgp; 870 size_t msgsz; 871 long msgtyp; 872 int msgflg; 873}; 874#endif 875 876/* 877 * MPSAFE 878 */ 879int 880msgrcv(td, uap) 881 struct thread *td; 882 register struct msgrcv_args *uap; 883{ 884 int msqid = uap->msqid; 885 void *user_msgp = uap->msgp; 886 size_t msgsz = uap->msgsz; 887 long msgtyp = uap->msgtyp; 888 int msgflg = uap->msgflg; 889 size_t len; 890 register struct msqid_ds *msqptr; 891 register struct msg *msghdr; 892 int error = 0; 893 short next; 894 895 DPRINTF(("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 896 msgsz, msgtyp, msgflg)); 897 898 if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 899 return (ENOSYS); 900 901 msqid = IPCID_TO_IX(msqid); 902 903 if (msqid < 0 || msqid >= msginfo.msgmni) { 904 DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 905 msginfo.msgmni)); 906 return (EINVAL); 907 } 908 909 msqptr = &msqids[msqid]; 910 mtx_lock(&msq_mtx); 911 if (msqptr->msg_qbytes == 0) { 912 DPRINTF(("no such message queue id\n")); 913 error = EINVAL; 914 goto done2; 915 } 916 if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 917 DPRINTF(("wrong sequence number\n")); 918 error = EINVAL; 919 goto done2; 920 } 921 922 if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) { 923 DPRINTF(("requester doesn't have read access\n")); 924 goto done2; 925 } 926 927 msghdr = NULL; 928 while (msghdr == NULL) { 929 if (msgtyp == 0) { 930 msghdr = msqptr->msg_first; 931 if (msghdr != NULL) { 932 if (msgsz < msghdr->msg_ts && 933 (msgflg & MSG_NOERROR) == 0) { 934 DPRINTF(("first message on the queue " 935 "is too big (want %d, got %d)\n", 936 msgsz, msghdr->msg_ts)); 937 error = E2BIG; 938 goto done2; 939 } 940 if (msqptr->msg_first == msqptr->msg_last) { 941 msqptr->msg_first = NULL; 942 msqptr->msg_last = NULL; 943 } else { 944 msqptr->msg_first = msghdr->msg_next; 945 if (msqptr->msg_first == NULL) 946 panic("msg_first/last screwed up #1"); 947 } 948 } 949 } else { 950 struct msg *previous; 951 struct msg **prev; 952 953 previous = NULL; 954 prev = &(msqptr->msg_first); 955 while ((msghdr = *prev) != NULL) { 956 /* 957 * Is this message's type an exact match or is 958 * this message's type less than or equal to 959 * the absolute value of a negative msgtyp? 960 * Note that the second half of this test can 961 * NEVER be true if msgtyp is positive since 962 * msg_type is always positive! 963 */ 964 965 if (msgtyp == msghdr->msg_type || 966 msghdr->msg_type <= -msgtyp) { 967 DPRINTF(("found message type %d, " 968 "requested %d\n", 969 msghdr->msg_type, msgtyp)); 970 if (msgsz < msghdr->msg_ts && 971 (msgflg & MSG_NOERROR) == 0) { 972 DPRINTF(("requested message " 973 "on the queue is too big " 974 "(want %d, got %d)\n", 975 msgsz, msghdr->msg_ts)); 976 error = E2BIG; 977 goto done2; 978 } 979 *prev = msghdr->msg_next; 980 if (msghdr == msqptr->msg_last) { 981 if (previous == NULL) { 982 if (prev != 983 &msqptr->msg_first) 984 panic("msg_first/last screwed up #2"); 985 msqptr->msg_first = 986 NULL; 987 msqptr->msg_last = 988 NULL; 989 } else { 990 if (prev == 991 &msqptr->msg_first) 992 panic("msg_first/last screwed up #3"); 993 msqptr->msg_last = 994 previous; 995 } 996 } 997 break; 998 } 999 previous = msghdr; 1000 prev = &(msghdr->msg_next); 1001 } 1002 } 1003 1004 /* 1005 * We've either extracted the msghdr for the appropriate 1006 * message or there isn't one. 1007 * If there is one then bail out of this loop. 1008 */ 1009 1010 if (msghdr != NULL) 1011 break; 1012 1013 /* 1014 * Hmph! No message found. Does the user want to wait? 1015 */ 1016 1017 if ((msgflg & IPC_NOWAIT) != 0) { 1018 DPRINTF(("no appropriate message found (msgtyp=%d)\n", 1019 msgtyp)); 1020 /* The SVID says to return ENOMSG. */ 1021 error = ENOMSG; 1022 goto done2; 1023 } 1024 1025 /* 1026 * Wait for something to happen 1027 */ 1028 1029 DPRINTF(("msgrcv: goodnight\n")); 1030 error = msleep(msqptr, &msq_mtx, (PZERO - 4) | PCATCH, 1031 "msgwait", 0); 1032 DPRINTF(("msgrcv: good morning (error=%d)\n", error)); 1033 1034 if (error != 0) { 1035 DPRINTF(("msgsnd: interrupted system call\n")); 1036 error = EINTR; 1037 goto done2; 1038 } 1039 1040 /* 1041 * Make sure that the msq queue still exists 1042 */ 1043 1044 if (msqptr->msg_qbytes == 0 || 1045 msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 1046 DPRINTF(("msqid deleted\n")); 1047 error = EIDRM; 1048 goto done2; 1049 } 1050 } 1051 1052 /* 1053 * Return the message to the user. 1054 * 1055 * First, do the bookkeeping (before we risk being interrupted). 1056 */ 1057 1058 msqptr->msg_cbytes -= msghdr->msg_ts; 1059 msqptr->msg_qnum--; 1060 msqptr->msg_lrpid = td->td_proc->p_pid; 1061 msqptr->msg_rtime = time_second; 1062 1063 /* 1064 * Make msgsz the actual amount that we'll be returning. 1065 * Note that this effectively truncates the message if it is too long 1066 * (since msgsz is never increased). 1067 */ 1068 1069 DPRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 1070 msghdr->msg_ts)); 1071 if (msgsz > msghdr->msg_ts) 1072 msgsz = msghdr->msg_ts; 1073 1074 /* 1075 * Return the type to the user. 1076 */ 1077 1078 mtx_unlock(&msq_mtx); 1079 error = copyout(&(msghdr->msg_type), user_msgp, 1080 sizeof(msghdr->msg_type)); 1081 mtx_lock(&msq_mtx); 1082 if (error != 0) { 1083 DPRINTF(("error (%d) copying out message type\n", error)); 1084 msg_freehdr(msghdr); 1085 wakeup(msqptr); 1086 goto done2; 1087 } 1088 user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 1089 1090 /* 1091 * Return the segments to the user 1092 */ 1093 1094 next = msghdr->msg_spot; 1095 for (len = 0; len < msgsz; len += msginfo.msgssz) { 1096 size_t tlen; 1097 1098 if (msgsz - len > msginfo.msgssz) 1099 tlen = msginfo.msgssz; 1100 else 1101 tlen = msgsz - len; 1102 if (next <= -1) 1103 panic("next too low #3"); 1104 if (next >= msginfo.msgseg) 1105 panic("next out of range #3"); 1106 mtx_unlock(&msq_mtx); 1107 error = copyout(&msgpool[next * msginfo.msgssz], 1108 user_msgp, tlen); 1109 mtx_lock(&msq_mtx); 1110 if (error != 0) { 1111 DPRINTF(("error (%d) copying out message segment\n", 1112 error)); 1113 msg_freehdr(msghdr); 1114 wakeup(msqptr); 1115 goto done2; 1116 } 1117 user_msgp = (char *)user_msgp + tlen; 1118 next = msgmaps[next].next; 1119 } 1120 1121 /* 1122 * Done, return the actual number of bytes copied out. 1123 */ 1124 1125 msg_freehdr(msghdr); 1126 wakeup(msqptr); 1127 td->td_retval[0] = msgsz; 1128done2: 1129 mtx_unlock(&msq_mtx); 1130 return (error); 1131} 1132 1133static int 1134sysctl_msqids(SYSCTL_HANDLER_ARGS) 1135{ 1136 1137 return (SYSCTL_OUT(req, msqids, 1138 sizeof(struct msqid_ds) * msginfo.msgmni)); 1139} 1140 1141SYSCTL_DECL(_kern_ipc); 1142SYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, ""); 1143SYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RD, &msginfo.msgmni, 0, ""); 1144SYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RD, &msginfo.msgmnb, 0, ""); 1145SYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RD, &msginfo.msgtql, 0, ""); 1146SYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RD, &msginfo.msgssz, 0, ""); 1147SYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RD, &msginfo.msgseg, 0, ""); 1148SYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD, 1149 NULL, 0, sysctl_msqids, "", "Message queue IDs"); 1150