xref: /freebsd/sys/kern/sysv_msg.c (revision 896de692f8dca8089b52005b3c579825724358f0)
1c3aac50fSPeter Wemm /* $FreeBSD$ */
23d903220SDoug Rabson 
33d903220SDoug Rabson /*
43d903220SDoug Rabson  * Implementation of SVID messages
53d903220SDoug Rabson  *
63d903220SDoug Rabson  * Author:  Daniel Boulet
73d903220SDoug Rabson  *
83d903220SDoug Rabson  * Copyright 1993 Daniel Boulet and RTMX Inc.
93d903220SDoug Rabson  *
103d903220SDoug Rabson  * This system call was implemented by Daniel Boulet under contract from RTMX.
113d903220SDoug Rabson  *
123d903220SDoug Rabson  * Redistribution and use in source forms, with and without modification,
133d903220SDoug Rabson  * are permitted provided that this entire comment appears intact.
143d903220SDoug Rabson  *
153d903220SDoug Rabson  * Redistribution in binary form may occur without any restrictions.
163d903220SDoug Rabson  * Obviously, it would be nice if you gave credit where credit is due
173d903220SDoug Rabson  * but requiring it would be too onerous.
183d903220SDoug Rabson  *
193d903220SDoug Rabson  * This software is provided ``AS IS'' without any warranties of any kind.
203d903220SDoug Rabson  */
213d903220SDoug Rabson 
22ab063af9SPeter Wemm #include "opt_sysvipc.h"
23ab063af9SPeter Wemm 
243d903220SDoug Rabson #include <sys/param.h>
253d903220SDoug Rabson #include <sys/systm.h>
26725db531SBruce Evans #include <sys/sysproto.h>
273d903220SDoug Rabson #include <sys/kernel.h>
283d903220SDoug Rabson #include <sys/proc.h>
29b6a4b4f9SMatthew Dillon #include <sys/lock.h>
30b6a4b4f9SMatthew Dillon #include <sys/mutex.h>
313d903220SDoug Rabson #include <sys/msg.h>
3278525ce3SAlfred Perlstein #include <sys/syscall.h>
33725db531SBruce Evans #include <sys/sysent.h>
34ab063af9SPeter Wemm #include <sys/sysctl.h>
35ab063af9SPeter Wemm #include <sys/malloc.h>
36cb1f0db9SRobert Watson #include <sys/jail.h>
37ab063af9SPeter Wemm 
38ab063af9SPeter Wemm static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues");
393d903220SDoug Rabson 
4078525ce3SAlfred Perlstein static void msginit __P((void));
4178525ce3SAlfred Perlstein static int msgunload __P((void));
4278525ce3SAlfred Perlstein static int sysvmsg_modload __P((struct module *, int, void *));
432b14f991SJulian Elischer 
443d903220SDoug Rabson #define MSG_DEBUG
453d903220SDoug Rabson #undef MSG_DEBUG_OK
463d903220SDoug Rabson 
47725db531SBruce Evans static void msg_freehdr __P((struct msg *msghdr));
483d903220SDoug Rabson 
49725db531SBruce Evans /* XXX casting to (sy_call_t *) is bogus, as usual. */
5087b6de2bSPoul-Henning Kamp static sy_call_t *msgcalls[] = {
51725db531SBruce Evans 	(sy_call_t *)msgctl, (sy_call_t *)msgget,
52725db531SBruce Evans 	(sy_call_t *)msgsnd, (sy_call_t *)msgrcv
53725db531SBruce Evans };
543d903220SDoug Rabson 
55ab063af9SPeter Wemm struct msg {
56ab063af9SPeter Wemm 	struct	msg *msg_next;	/* next msg in the chain */
57ab063af9SPeter Wemm 	long	msg_type;	/* type of this message */
58ab063af9SPeter Wemm     				/* >0 -> type of this message */
59ab063af9SPeter Wemm     				/* 0 -> free header */
60ab063af9SPeter Wemm 	u_short	msg_ts;		/* size of this message */
61ab063af9SPeter Wemm 	short	msg_spot;	/* location of start of msg in buffer */
62ab063af9SPeter Wemm };
63ab063af9SPeter Wemm 
64ab063af9SPeter Wemm 
65ab063af9SPeter Wemm #ifndef MSGSSZ
66ab063af9SPeter Wemm #define MSGSSZ	8		/* Each segment must be 2^N long */
67ab063af9SPeter Wemm #endif
68ab063af9SPeter Wemm #ifndef MSGSEG
69ab063af9SPeter Wemm #define MSGSEG	2048		/* must be less than 32767 */
70ab063af9SPeter Wemm #endif
71ab063af9SPeter Wemm #define MSGMAX	(MSGSSZ*MSGSEG)
72ab063af9SPeter Wemm #ifndef MSGMNB
73ab063af9SPeter Wemm #define MSGMNB	2048		/* max # of bytes in a queue */
74ab063af9SPeter Wemm #endif
75ab063af9SPeter Wemm #ifndef MSGMNI
76ab063af9SPeter Wemm #define MSGMNI	40
77ab063af9SPeter Wemm #endif
78ab063af9SPeter Wemm #ifndef MSGTQL
79ab063af9SPeter Wemm #define MSGTQL	40
80ab063af9SPeter Wemm #endif
81ab063af9SPeter Wemm 
82ab063af9SPeter Wemm /*
83ab063af9SPeter Wemm  * Based on the configuration parameters described in an SVR2 (yes, two)
84ab063af9SPeter Wemm  * config(1m) man page.
85ab063af9SPeter Wemm  *
86ab063af9SPeter Wemm  * Each message is broken up and stored in segments that are msgssz bytes
87ab063af9SPeter Wemm  * long.  For efficiency reasons, this should be a power of two.  Also,
88ab063af9SPeter Wemm  * it doesn't make sense if it is less than 8 or greater than about 256.
89ab063af9SPeter Wemm  * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of
90ab063af9SPeter Wemm  * two between 8 and 1024 inclusive (and panic's if it isn't).
91ab063af9SPeter Wemm  */
92ab063af9SPeter Wemm struct msginfo msginfo = {
93ab063af9SPeter Wemm                 MSGMAX,         /* max chars in a message */
94ab063af9SPeter Wemm                 MSGMNI,         /* # of message queue identifiers */
95ab063af9SPeter Wemm                 MSGMNB,         /* max chars in a queue */
96ab063af9SPeter Wemm                 MSGTQL,         /* max messages in system */
97ab063af9SPeter Wemm                 MSGSSZ,         /* size of a message segment */
98ab063af9SPeter Wemm                 		/* (must be small power of 2 greater than 4) */
99ab063af9SPeter Wemm                 MSGSEG          /* number of message segments */
100ab063af9SPeter Wemm };
101ab063af9SPeter Wemm 
102ab063af9SPeter Wemm /*
103ab063af9SPeter Wemm  * macros to convert between msqid_ds's and msqid's.
104ab063af9SPeter Wemm  * (specific to this implementation)
105ab063af9SPeter Wemm  */
106ab063af9SPeter Wemm #define MSQID(ix,ds)	((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000))
107ab063af9SPeter Wemm #define MSQID_IX(id)	((id) & 0xffff)
108ab063af9SPeter Wemm #define MSQID_SEQ(id)	(((id) >> 16) & 0xffff)
109ab063af9SPeter Wemm 
110ab063af9SPeter Wemm /*
111ab063af9SPeter Wemm  * The rest of this file is specific to this particular implementation.
112ab063af9SPeter Wemm  */
113ab063af9SPeter Wemm 
114ab063af9SPeter Wemm struct msgmap {
115ab063af9SPeter Wemm 	short	next;		/* next segment in buffer */
116ab063af9SPeter Wemm     				/* -1 -> available */
117ab063af9SPeter Wemm     				/* 0..(MSGSEG-1) -> index of next segment */
118ab063af9SPeter Wemm };
119ab063af9SPeter Wemm 
120ab063af9SPeter Wemm #define MSG_LOCKED	01000	/* Is this msqid_ds locked? */
121ab063af9SPeter Wemm 
12287b6de2bSPoul-Henning Kamp static int nfree_msgmaps;	/* # of free map entries */
12387b6de2bSPoul-Henning Kamp static short free_msgmaps;	/* head of linked list of free map entries */
12487b6de2bSPoul-Henning Kamp static struct msg *free_msghdrs;/* list of free msg headers */
125ab063af9SPeter Wemm static char *msgpool;		/* MSGMAX byte long msg buffer pool */
126ab063af9SPeter Wemm static struct msgmap *msgmaps;	/* MSGSEG msgmap structures */
127ab063af9SPeter Wemm static struct msg *msghdrs;	/* MSGTQL msg headers */
128ab063af9SPeter Wemm static struct msqid_ds *msqids;	/* MSGMNI msqid_ds struct's */
1293d903220SDoug Rabson 
130ab063af9SPeter Wemm static void
13178525ce3SAlfred Perlstein msginit()
1323d903220SDoug Rabson {
1333d903220SDoug Rabson 	register int i;
1343d903220SDoug Rabson 
135896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg);
136896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz);
137896de692SMichael Reifenberger 	msginfo.msgmax = msginfo.msgseg * msginfo.msgssz;
138896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni);
139896de692SMichael Reifenberger 
140ab063af9SPeter Wemm 	msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK);
141ab063af9SPeter Wemm 	if (msgpool == NULL)
142ab063af9SPeter Wemm 		panic("msgpool is NULL");
143ab063af9SPeter Wemm 	msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK);
144ab063af9SPeter Wemm 	if (msgmaps == NULL)
145ab063af9SPeter Wemm 		panic("msgmaps is NULL");
146ab063af9SPeter Wemm 	msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK);
147ab063af9SPeter Wemm 	if (msghdrs == NULL)
148ab063af9SPeter Wemm 		panic("msghdrs is NULL");
149ab063af9SPeter Wemm 	msqids = malloc(sizeof(struct msqid_ds) * msginfo.msgmni, M_MSG, M_WAITOK);
150ab063af9SPeter Wemm 	if (msqids == NULL)
151ab063af9SPeter Wemm 		panic("msqids is NULL");
152ab063af9SPeter Wemm 
1533d903220SDoug Rabson 	/*
1543d903220SDoug Rabson 	 * msginfo.msgssz should be a power of two for efficiency reasons.
1553d903220SDoug Rabson 	 * It is also pretty silly if msginfo.msgssz is less than 8
1563d903220SDoug Rabson 	 * or greater than about 256 so ...
1573d903220SDoug Rabson 	 */
1583d903220SDoug Rabson 
1593d903220SDoug Rabson 	i = 8;
1603d903220SDoug Rabson 	while (i < 1024 && i != msginfo.msgssz)
1613d903220SDoug Rabson 		i <<= 1;
1623d903220SDoug Rabson     	if (i != msginfo.msgssz) {
1633d903220SDoug Rabson 		printf("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz,
1643d903220SDoug Rabson 		    msginfo.msgssz);
1653d903220SDoug Rabson 		panic("msginfo.msgssz not a small power of 2");
1663d903220SDoug Rabson 	}
1673d903220SDoug Rabson 
1683d903220SDoug Rabson 	if (msginfo.msgseg > 32767) {
1693d903220SDoug Rabson 		printf("msginfo.msgseg=%d\n", msginfo.msgseg);
1703d903220SDoug Rabson 		panic("msginfo.msgseg > 32767");
1713d903220SDoug Rabson 	}
1723d903220SDoug Rabson 
1733d903220SDoug Rabson 	if (msgmaps == NULL)
1743d903220SDoug Rabson 		panic("msgmaps is NULL");
1753d903220SDoug Rabson 
1763d903220SDoug Rabson 	for (i = 0; i < msginfo.msgseg; i++) {
1773d903220SDoug Rabson 		if (i > 0)
1783d903220SDoug Rabson 			msgmaps[i-1].next = i;
1793d903220SDoug Rabson 		msgmaps[i].next = -1;	/* implies entry is available */
1803d903220SDoug Rabson 	}
1813d903220SDoug Rabson 	free_msgmaps = 0;
1823d903220SDoug Rabson 	nfree_msgmaps = msginfo.msgseg;
1833d903220SDoug Rabson 
1843d903220SDoug Rabson 	if (msghdrs == NULL)
1853d903220SDoug Rabson 		panic("msghdrs is NULL");
1863d903220SDoug Rabson 
1873d903220SDoug Rabson 	for (i = 0; i < msginfo.msgtql; i++) {
1883d903220SDoug Rabson 		msghdrs[i].msg_type = 0;
1893d903220SDoug Rabson 		if (i > 0)
1903d903220SDoug Rabson 			msghdrs[i-1].msg_next = &msghdrs[i];
1913d903220SDoug Rabson 		msghdrs[i].msg_next = NULL;
1923d903220SDoug Rabson     	}
1933d903220SDoug Rabson 	free_msghdrs = &msghdrs[0];
1943d903220SDoug Rabson 
1953d903220SDoug Rabson 	if (msqids == NULL)
1963d903220SDoug Rabson 		panic("msqids is NULL");
1973d903220SDoug Rabson 
1983d903220SDoug Rabson 	for (i = 0; i < msginfo.msgmni; i++) {
1993d903220SDoug Rabson 		msqids[i].msg_qbytes = 0;	/* implies entry is available */
2003d903220SDoug Rabson 		msqids[i].msg_perm.seq = 0;	/* reset to a known value */
2016413a4bcSPeter Wemm 		msqids[i].msg_perm.mode = 0;
2023d903220SDoug Rabson 	}
2033d903220SDoug Rabson }
20478525ce3SAlfred Perlstein 
20578525ce3SAlfred Perlstein static int
20678525ce3SAlfred Perlstein msgunload()
20778525ce3SAlfred Perlstein {
20878525ce3SAlfred Perlstein 	struct msqid_ds *msqptr;
20978525ce3SAlfred Perlstein 	int msqid;
21078525ce3SAlfred Perlstein 
21178525ce3SAlfred Perlstein 	for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
21278525ce3SAlfred Perlstein 		/*
21378525ce3SAlfred Perlstein 		 * Look for an unallocated and unlocked msqid_ds.
21478525ce3SAlfred Perlstein 		 * msqid_ds's can be locked by msgsnd or msgrcv while
21578525ce3SAlfred Perlstein 		 * they are copying the message in/out.  We can't
21678525ce3SAlfred Perlstein 		 * re-use the entry until they release it.
21778525ce3SAlfred Perlstein 		 */
21878525ce3SAlfred Perlstein 		msqptr = &msqids[msqid];
21978525ce3SAlfred Perlstein 		if (msqptr->msg_qbytes != 0 ||
22078525ce3SAlfred Perlstein 		    (msqptr->msg_perm.mode & MSG_LOCKED) != 0)
22178525ce3SAlfred Perlstein 			break;
22278525ce3SAlfred Perlstein 	}
22378525ce3SAlfred Perlstein 	if (msqid != msginfo.msgmni)
22478525ce3SAlfred Perlstein 		return (EBUSY);
22578525ce3SAlfred Perlstein 
22678525ce3SAlfred Perlstein 	free(msgpool, M_MSG);
22778525ce3SAlfred Perlstein 	free(msgmaps, M_MSG);
22878525ce3SAlfred Perlstein 	free(msghdrs, M_MSG);
22978525ce3SAlfred Perlstein 	free(msqids, M_MSG);
23078525ce3SAlfred Perlstein 	return (0);
23178525ce3SAlfred Perlstein }
23278525ce3SAlfred Perlstein 
23378525ce3SAlfred Perlstein 
23478525ce3SAlfred Perlstein static int
23578525ce3SAlfred Perlstein sysvmsg_modload(struct module *module, int cmd, void *arg)
23678525ce3SAlfred Perlstein {
23778525ce3SAlfred Perlstein 	int error = 0;
23878525ce3SAlfred Perlstein 
23978525ce3SAlfred Perlstein 	switch (cmd) {
24078525ce3SAlfred Perlstein 	case MOD_LOAD:
24178525ce3SAlfred Perlstein 		msginit();
24278525ce3SAlfred Perlstein 		break;
24378525ce3SAlfred Perlstein 	case MOD_UNLOAD:
24478525ce3SAlfred Perlstein 		error = msgunload();
24578525ce3SAlfred Perlstein 		break;
24678525ce3SAlfred Perlstein 	case MOD_SHUTDOWN:
24778525ce3SAlfred Perlstein 		break;
24878525ce3SAlfred Perlstein 	default:
24978525ce3SAlfred Perlstein 		error = EINVAL;
25078525ce3SAlfred Perlstein 		break;
25178525ce3SAlfred Perlstein 	}
25278525ce3SAlfred Perlstein 	return (error);
25378525ce3SAlfred Perlstein }
25478525ce3SAlfred Perlstein 
255faa784b7SDag-Erling Smørgrav static moduledata_t sysvmsg_mod = {
256faa784b7SDag-Erling Smørgrav 	"sysvmsg",
25778525ce3SAlfred Perlstein 	&sysvmsg_modload,
25878525ce3SAlfred Perlstein 	NULL
25978525ce3SAlfred Perlstein };
26078525ce3SAlfred Perlstein 
26189b54bffSAlfred Perlstein SYSCALL_MODULE_HELPER(msgsys, 6);
26278525ce3SAlfred Perlstein SYSCALL_MODULE_HELPER(msgctl, 3);
26378525ce3SAlfred Perlstein SYSCALL_MODULE_HELPER(msgget, 2);
26478525ce3SAlfred Perlstein SYSCALL_MODULE_HELPER(msgsnd, 4);
26578525ce3SAlfred Perlstein SYSCALL_MODULE_HELPER(msgrcv, 5);
26678525ce3SAlfred Perlstein 
267faa784b7SDag-Erling Smørgrav DECLARE_MODULE(sysvmsg, sysvmsg_mod,
26878525ce3SAlfred Perlstein 	SI_SUB_SYSV_MSG, SI_ORDER_FIRST);
269faa784b7SDag-Erling Smørgrav MODULE_VERSION(sysvmsg, 1);
2703d903220SDoug Rabson 
2713d903220SDoug Rabson /*
2723d903220SDoug Rabson  * Entry point for all MSG calls
273b6a4b4f9SMatthew Dillon  *
274b6a4b4f9SMatthew Dillon  * MPSAFE
2753d903220SDoug Rabson  */
2763d903220SDoug Rabson int
277b40ce416SJulian Elischer msgsys(td, uap)
278b40ce416SJulian Elischer 	struct thread *td;
279725db531SBruce Evans 	/* XXX actually varargs. */
280725db531SBruce Evans 	struct msgsys_args /* {
281725db531SBruce Evans 		u_int	which;
282725db531SBruce Evans 		int	a2;
283725db531SBruce Evans 		int	a3;
284725db531SBruce Evans 		int	a4;
285725db531SBruce Evans 		int	a5;
286725db531SBruce Evans 		int	a6;
287725db531SBruce Evans 	} */ *uap;
2883d903220SDoug Rabson {
289b6a4b4f9SMatthew Dillon 	int error;
2903d903220SDoug Rabson 
291b6a4b4f9SMatthew Dillon 	mtx_lock(&Giant);
292b40ce416SJulian Elischer 	if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) {
293b6a4b4f9SMatthew Dillon 		error = ENOSYS;
294b6a4b4f9SMatthew Dillon 		goto done2;
295b6a4b4f9SMatthew Dillon 	}
296b6a4b4f9SMatthew Dillon 	if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) {
297b6a4b4f9SMatthew Dillon 		error = EINVAL;
298b6a4b4f9SMatthew Dillon 		goto done2;
299b6a4b4f9SMatthew Dillon 	}
300b40ce416SJulian Elischer 	error = (*msgcalls[uap->which])(td, &uap->a2);
301b6a4b4f9SMatthew Dillon done2:
302b6a4b4f9SMatthew Dillon 	mtx_unlock(&Giant);
303b6a4b4f9SMatthew Dillon 	return (error);
3043d903220SDoug Rabson }
3053d903220SDoug Rabson 
3063d903220SDoug Rabson static void
3073d903220SDoug Rabson msg_freehdr(msghdr)
3083d903220SDoug Rabson 	struct msg *msghdr;
3093d903220SDoug Rabson {
3103d903220SDoug Rabson 	while (msghdr->msg_ts > 0) {
3113d903220SDoug Rabson 		short next;
3123d903220SDoug Rabson 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)
3133d903220SDoug Rabson 			panic("msghdr->msg_spot out of range");
3143d903220SDoug Rabson 		next = msgmaps[msghdr->msg_spot].next;
3153d903220SDoug Rabson 		msgmaps[msghdr->msg_spot].next = free_msgmaps;
3163d903220SDoug Rabson 		free_msgmaps = msghdr->msg_spot;
3173d903220SDoug Rabson 		nfree_msgmaps++;
3183d903220SDoug Rabson 		msghdr->msg_spot = next;
3193d903220SDoug Rabson 		if (msghdr->msg_ts >= msginfo.msgssz)
3203d903220SDoug Rabson 			msghdr->msg_ts -= msginfo.msgssz;
3213d903220SDoug Rabson 		else
3223d903220SDoug Rabson 			msghdr->msg_ts = 0;
3233d903220SDoug Rabson 	}
3243d903220SDoug Rabson 	if (msghdr->msg_spot != -1)
3253d903220SDoug Rabson 		panic("msghdr->msg_spot != -1");
3263d903220SDoug Rabson 	msghdr->msg_next = free_msghdrs;
3273d903220SDoug Rabson 	free_msghdrs = msghdr;
3283d903220SDoug Rabson }
3293d903220SDoug Rabson 
330b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
3313d903220SDoug Rabson struct msgctl_args {
3323d903220SDoug Rabson 	int	msqid;
3333d903220SDoug Rabson 	int	cmd;
334b5d5c0c9SPeter Wemm 	struct	msqid_ds *buf;
3353d903220SDoug Rabson };
336b5d5c0c9SPeter Wemm #endif
3373d903220SDoug Rabson 
338b6a4b4f9SMatthew Dillon /*
339b6a4b4f9SMatthew Dillon  * MPSAFE
340b6a4b4f9SMatthew Dillon  */
341b5d5c0c9SPeter Wemm int
342b40ce416SJulian Elischer msgctl(td, uap)
343b40ce416SJulian Elischer 	struct thread *td;
3443d903220SDoug Rabson 	register struct msgctl_args *uap;
3453d903220SDoug Rabson {
3463d903220SDoug Rabson 	int msqid = uap->msqid;
3473d903220SDoug Rabson 	int cmd = uap->cmd;
348b5d5c0c9SPeter Wemm 	struct msqid_ds *user_msqptr = uap->buf;
349b6a4b4f9SMatthew Dillon 	int rval, error;
3503d903220SDoug Rabson 	struct msqid_ds msqbuf;
3513d903220SDoug Rabson 	register struct msqid_ds *msqptr;
3523d903220SDoug Rabson 
3533d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3543d903220SDoug Rabson 	printf("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr);
3553d903220SDoug Rabson #endif
356b6a4b4f9SMatthew Dillon 	mtx_lock(&Giant);
357b40ce416SJulian Elischer 	if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) {
358b6a4b4f9SMatthew Dillon 		error = ENOSYS;
359b6a4b4f9SMatthew Dillon 		goto done2;
360b6a4b4f9SMatthew Dillon 	}
361cb1f0db9SRobert Watson 
3623d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
3633d903220SDoug Rabson 
3643d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
3653d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3663d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
3673d903220SDoug Rabson 		    msginfo.msgmni);
3683d903220SDoug Rabson #endif
369b6a4b4f9SMatthew Dillon 		error = EINVAL;
370b6a4b4f9SMatthew Dillon 		goto done2;
3713d903220SDoug Rabson 	}
3723d903220SDoug Rabson 
3733d903220SDoug Rabson 	msqptr = &msqids[msqid];
3743d903220SDoug Rabson 
3753d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
3763d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3773d903220SDoug Rabson 		printf("no such msqid\n");
3783d903220SDoug Rabson #endif
379b6a4b4f9SMatthew Dillon 		error = EINVAL;
380b6a4b4f9SMatthew Dillon 		goto done2;
3813d903220SDoug Rabson 	}
3823d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
3833d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3843d903220SDoug Rabson 		printf("wrong sequence number\n");
3853d903220SDoug Rabson #endif
386b6a4b4f9SMatthew Dillon 		error = EINVAL;
387b6a4b4f9SMatthew Dillon 		goto done2;
3883d903220SDoug Rabson 	}
3893d903220SDoug Rabson 
390b6a4b4f9SMatthew Dillon 	error = 0;
3913d903220SDoug Rabson 	rval = 0;
3923d903220SDoug Rabson 
3933d903220SDoug Rabson 	switch (cmd) {
3943d903220SDoug Rabson 
3953d903220SDoug Rabson 	case IPC_RMID:
3963d903220SDoug Rabson 	{
3973d903220SDoug Rabson 		struct msg *msghdr;
398b40ce416SJulian Elischer 		if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M)))
399b6a4b4f9SMatthew Dillon 			goto done2;
4003d903220SDoug Rabson 		/* Free the message headers */
4013d903220SDoug Rabson 		msghdr = msqptr->msg_first;
4023d903220SDoug Rabson 		while (msghdr != NULL) {
4033d903220SDoug Rabson 			struct msg *msghdr_tmp;
4043d903220SDoug Rabson 
4053d903220SDoug Rabson 			/* Free the segments of each message */
4063d903220SDoug Rabson 			msqptr->msg_cbytes -= msghdr->msg_ts;
4073d903220SDoug Rabson 			msqptr->msg_qnum--;
4083d903220SDoug Rabson 			msghdr_tmp = msghdr;
4093d903220SDoug Rabson 			msghdr = msghdr->msg_next;
4103d903220SDoug Rabson 			msg_freehdr(msghdr_tmp);
4113d903220SDoug Rabson 		}
4123d903220SDoug Rabson 
4133d903220SDoug Rabson 		if (msqptr->msg_cbytes != 0)
4143d903220SDoug Rabson 			panic("msg_cbytes is screwed up");
4153d903220SDoug Rabson 		if (msqptr->msg_qnum != 0)
4163d903220SDoug Rabson 			panic("msg_qnum is screwed up");
4173d903220SDoug Rabson 
4183d903220SDoug Rabson 		msqptr->msg_qbytes = 0;	/* Mark it as free */
4193d903220SDoug Rabson 
4203d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
4213d903220SDoug Rabson 	}
4223d903220SDoug Rabson 
4233d903220SDoug Rabson 		break;
4243d903220SDoug Rabson 
4253d903220SDoug Rabson 	case IPC_SET:
426b40ce416SJulian Elischer 		if ((error = ipcperm(td, &msqptr->msg_perm, IPC_M)))
427b6a4b4f9SMatthew Dillon 			goto done2;
428b6a4b4f9SMatthew Dillon 		if ((error = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0)
429b6a4b4f9SMatthew Dillon 			goto done2;
43057c90d6fSPoul-Henning Kamp 		if (msqbuf.msg_qbytes > msqptr->msg_qbytes) {
431b40ce416SJulian Elischer 			error = suser_td(td);
432b6a4b4f9SMatthew Dillon 			if (error)
433b6a4b4f9SMatthew Dillon 				goto done2;
43457c90d6fSPoul-Henning Kamp 		}
4353d903220SDoug Rabson 		if (msqbuf.msg_qbytes > msginfo.msgmnb) {
4363d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4373d903220SDoug Rabson 			printf("can't increase msg_qbytes beyond %d (truncating)\n",
4383d903220SDoug Rabson 			    msginfo.msgmnb);
4393d903220SDoug Rabson #endif
4403d903220SDoug Rabson 			msqbuf.msg_qbytes = msginfo.msgmnb;	/* silently restrict qbytes to system limit */
4413d903220SDoug Rabson 		}
4423d903220SDoug Rabson 		if (msqbuf.msg_qbytes == 0) {
4433d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4443d903220SDoug Rabson 			printf("can't reduce msg_qbytes to 0\n");
4453d903220SDoug Rabson #endif
446b6a4b4f9SMatthew Dillon 			error = EINVAL;		/* non-standard errno! */
447b6a4b4f9SMatthew Dillon 			goto done2;
4483d903220SDoug Rabson 		}
4493d903220SDoug Rabson 		msqptr->msg_perm.uid = msqbuf.msg_perm.uid;	/* change the owner */
4503d903220SDoug Rabson 		msqptr->msg_perm.gid = msqbuf.msg_perm.gid;	/* change the owner */
4513d903220SDoug Rabson 		msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) |
4523d903220SDoug Rabson 		    (msqbuf.msg_perm.mode & 0777);
4533d903220SDoug Rabson 		msqptr->msg_qbytes = msqbuf.msg_qbytes;
454227ee8a1SPoul-Henning Kamp 		msqptr->msg_ctime = time_second;
4553d903220SDoug Rabson 		break;
4563d903220SDoug Rabson 
4573d903220SDoug Rabson 	case IPC_STAT:
458b40ce416SJulian Elischer 		if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) {
4593d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4603d903220SDoug Rabson 			printf("requester doesn't have read access\n");
4613d903220SDoug Rabson #endif
462b6a4b4f9SMatthew Dillon 			goto done2;
4633d903220SDoug Rabson 		}
464b6a4b4f9SMatthew Dillon 		error = copyout((caddr_t)msqptr, user_msqptr,
4653d903220SDoug Rabson 		    sizeof(struct msqid_ds));
4663d903220SDoug Rabson 		break;
4673d903220SDoug Rabson 
4683d903220SDoug Rabson 	default:
4693d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4703d903220SDoug Rabson 		printf("invalid command %d\n", cmd);
4713d903220SDoug Rabson #endif
472b6a4b4f9SMatthew Dillon 		error = EINVAL;
473b6a4b4f9SMatthew Dillon 		goto done2;
4743d903220SDoug Rabson 	}
4753d903220SDoug Rabson 
476b6a4b4f9SMatthew Dillon 	if (error == 0)
477b40ce416SJulian Elischer 		td->td_retval[0] = rval;
478b6a4b4f9SMatthew Dillon done2:
479b6a4b4f9SMatthew Dillon 	mtx_unlock(&Giant);
480b6a4b4f9SMatthew Dillon 	return(error);
4813d903220SDoug Rabson }
4823d903220SDoug Rabson 
483b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
4843d903220SDoug Rabson struct msgget_args {
4853d903220SDoug Rabson 	key_t	key;
4863d903220SDoug Rabson 	int	msgflg;
4873d903220SDoug Rabson };
488b5d5c0c9SPeter Wemm #endif
4893d903220SDoug Rabson 
490b6a4b4f9SMatthew Dillon /*
491b6a4b4f9SMatthew Dillon  * MPSAFE
492b6a4b4f9SMatthew Dillon  */
493b5d5c0c9SPeter Wemm int
494b40ce416SJulian Elischer msgget(td, uap)
495b40ce416SJulian Elischer 	struct thread *td;
4963d903220SDoug Rabson 	register struct msgget_args *uap;
4973d903220SDoug Rabson {
498b6a4b4f9SMatthew Dillon 	int msqid, error = 0;
4993d903220SDoug Rabson 	int key = uap->key;
5003d903220SDoug Rabson 	int msgflg = uap->msgflg;
501b40ce416SJulian Elischer 	struct ucred *cred = td->td_proc->p_ucred;
502789668e2SDavid Greenman 	register struct msqid_ds *msqptr = NULL;
5033d903220SDoug Rabson 
5043d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5053d903220SDoug Rabson 	printf("msgget(0x%x, 0%o)\n", key, msgflg);
5063d903220SDoug Rabson #endif
5073d903220SDoug Rabson 
508b6a4b4f9SMatthew Dillon 	mtx_lock(&Giant);
509b40ce416SJulian Elischer 	if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) {
510b6a4b4f9SMatthew Dillon 		error = ENOSYS;
511b6a4b4f9SMatthew Dillon 		goto done2;
512b6a4b4f9SMatthew Dillon 	}
513cb1f0db9SRobert Watson 
5143d903220SDoug Rabson 	if (key != IPC_PRIVATE) {
5153d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
5163d903220SDoug Rabson 			msqptr = &msqids[msqid];
5173d903220SDoug Rabson 			if (msqptr->msg_qbytes != 0 &&
5183d903220SDoug Rabson 			    msqptr->msg_perm.key == key)
5193d903220SDoug Rabson 				break;
5203d903220SDoug Rabson 		}
5213d903220SDoug Rabson 		if (msqid < msginfo.msgmni) {
5223d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5233d903220SDoug Rabson 			printf("found public key\n");
5243d903220SDoug Rabson #endif
5253d903220SDoug Rabson 			if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
5263d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5273d903220SDoug Rabson 				printf("not exclusive\n");
5283d903220SDoug Rabson #endif
529b6a4b4f9SMatthew Dillon 				error = EEXIST;
530b6a4b4f9SMatthew Dillon 				goto done2;
5313d903220SDoug Rabson 			}
532b40ce416SJulian Elischer 			if ((error = ipcperm(td, &msqptr->msg_perm, msgflg & 0700 ))) {
5333d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5343d903220SDoug Rabson 				printf("requester doesn't have 0%o access\n",
5353d903220SDoug Rabson 				    msgflg & 0700);
5363d903220SDoug Rabson #endif
537b6a4b4f9SMatthew Dillon 				goto done2;
5383d903220SDoug Rabson 			}
5393d903220SDoug Rabson 			goto found;
5403d903220SDoug Rabson 		}
5413d903220SDoug Rabson 	}
5423d903220SDoug Rabson 
5433d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5443d903220SDoug Rabson 	printf("need to allocate the msqid_ds\n");
5453d903220SDoug Rabson #endif
5463d903220SDoug Rabson 	if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
5473d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
5483d903220SDoug Rabson 			/*
5493d903220SDoug Rabson 			 * Look for an unallocated and unlocked msqid_ds.
5503d903220SDoug Rabson 			 * msqid_ds's can be locked by msgsnd or msgrcv while
5513d903220SDoug Rabson 			 * they are copying the message in/out.  We can't
5523d903220SDoug Rabson 			 * re-use the entry until they release it.
5533d903220SDoug Rabson 			 */
5543d903220SDoug Rabson 			msqptr = &msqids[msqid];
5553d903220SDoug Rabson 			if (msqptr->msg_qbytes == 0 &&
5563d903220SDoug Rabson 			    (msqptr->msg_perm.mode & MSG_LOCKED) == 0)
5573d903220SDoug Rabson 				break;
5583d903220SDoug Rabson 		}
5593d903220SDoug Rabson 		if (msqid == msginfo.msgmni) {
5603d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5613d903220SDoug Rabson 			printf("no more msqid_ds's available\n");
5623d903220SDoug Rabson #endif
563b6a4b4f9SMatthew Dillon 			error = ENOSPC;
564b6a4b4f9SMatthew Dillon 			goto done2;
5653d903220SDoug Rabson 		}
5663d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5673d903220SDoug Rabson 		printf("msqid %d is available\n", msqid);
5683d903220SDoug Rabson #endif
5693d903220SDoug Rabson 		msqptr->msg_perm.key = key;
5703d903220SDoug Rabson 		msqptr->msg_perm.cuid = cred->cr_uid;
5713d903220SDoug Rabson 		msqptr->msg_perm.uid = cred->cr_uid;
5723d903220SDoug Rabson 		msqptr->msg_perm.cgid = cred->cr_gid;
5733d903220SDoug Rabson 		msqptr->msg_perm.gid = cred->cr_gid;
5743d903220SDoug Rabson 		msqptr->msg_perm.mode = (msgflg & 0777);
5753d903220SDoug Rabson 		/* Make sure that the returned msqid is unique */
5763d903220SDoug Rabson 		msqptr->msg_perm.seq++;
5773d903220SDoug Rabson 		msqptr->msg_first = NULL;
5783d903220SDoug Rabson 		msqptr->msg_last = NULL;
5793d903220SDoug Rabson 		msqptr->msg_cbytes = 0;
5803d903220SDoug Rabson 		msqptr->msg_qnum = 0;
5813d903220SDoug Rabson 		msqptr->msg_qbytes = msginfo.msgmnb;
5823d903220SDoug Rabson 		msqptr->msg_lspid = 0;
5833d903220SDoug Rabson 		msqptr->msg_lrpid = 0;
5843d903220SDoug Rabson 		msqptr->msg_stime = 0;
5853d903220SDoug Rabson 		msqptr->msg_rtime = 0;
586227ee8a1SPoul-Henning Kamp 		msqptr->msg_ctime = time_second;
5873d903220SDoug Rabson 	} else {
5883d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5893d903220SDoug Rabson 		printf("didn't find it and wasn't asked to create it\n");
5903d903220SDoug Rabson #endif
591b6a4b4f9SMatthew Dillon 		error = ENOENT;
592b6a4b4f9SMatthew Dillon 		goto done2;
5933d903220SDoug Rabson 	}
5943d903220SDoug Rabson 
5953d903220SDoug Rabson found:
5963d903220SDoug Rabson 	/* Construct the unique msqid */
597b40ce416SJulian Elischer 	td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm);
598b6a4b4f9SMatthew Dillon done2:
599b6a4b4f9SMatthew Dillon 	mtx_unlock(&Giant);
600b6a4b4f9SMatthew Dillon 	return (error);
6013d903220SDoug Rabson }
6023d903220SDoug Rabson 
603b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
6043d903220SDoug Rabson struct msgsnd_args {
6053d903220SDoug Rabson 	int	msqid;
606b5d5c0c9SPeter Wemm 	void	*msgp;
6073d903220SDoug Rabson 	size_t	msgsz;
6083d903220SDoug Rabson 	int	msgflg;
6093d903220SDoug Rabson };
610b5d5c0c9SPeter Wemm #endif
6113d903220SDoug Rabson 
612b6a4b4f9SMatthew Dillon /*
613b6a4b4f9SMatthew Dillon  * MPSAFE
614b6a4b4f9SMatthew Dillon  */
615b5d5c0c9SPeter Wemm int
616b40ce416SJulian Elischer msgsnd(td, uap)
617b40ce416SJulian Elischer 	struct thread *td;
6183d903220SDoug Rabson 	register struct msgsnd_args *uap;
6193d903220SDoug Rabson {
6203d903220SDoug Rabson 	int msqid = uap->msqid;
621b5d5c0c9SPeter Wemm 	void *user_msgp = uap->msgp;
6223d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
6233d903220SDoug Rabson 	int msgflg = uap->msgflg;
624b6a4b4f9SMatthew Dillon 	int segs_needed, error = 0;
6253d903220SDoug Rabson 	register struct msqid_ds *msqptr;
6263d903220SDoug Rabson 	register struct msg *msghdr;
6273d903220SDoug Rabson 	short next;
6283d903220SDoug Rabson 
6293d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6303d903220SDoug Rabson 	printf("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz,
6313d903220SDoug Rabson 	    msgflg);
6323d903220SDoug Rabson #endif
633b6a4b4f9SMatthew Dillon 	mtx_lock(&Giant);
634b40ce416SJulian Elischer 	if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) {
635b6a4b4f9SMatthew Dillon 		error = ENOSYS;
636b6a4b4f9SMatthew Dillon 		goto done2;
637b6a4b4f9SMatthew Dillon 	}
638cb1f0db9SRobert Watson 
6393d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
6403d903220SDoug Rabson 
6413d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
6423d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6433d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
6443d903220SDoug Rabson 		    msginfo.msgmni);
6453d903220SDoug Rabson #endif
646b6a4b4f9SMatthew Dillon 		error = EINVAL;
647b6a4b4f9SMatthew Dillon 		goto done2;
6483d903220SDoug Rabson 	}
6493d903220SDoug Rabson 
6503d903220SDoug Rabson 	msqptr = &msqids[msqid];
6513d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
6523d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6533d903220SDoug Rabson 		printf("no such message queue id\n");
6543d903220SDoug Rabson #endif
655b6a4b4f9SMatthew Dillon 		error = EINVAL;
656b6a4b4f9SMatthew Dillon 		goto done2;
6573d903220SDoug Rabson 	}
6583d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
6593d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6603d903220SDoug Rabson 		printf("wrong sequence number\n");
6613d903220SDoug Rabson #endif
662b6a4b4f9SMatthew Dillon 		error = EINVAL;
663b6a4b4f9SMatthew Dillon 		goto done2;
6643d903220SDoug Rabson 	}
6653d903220SDoug Rabson 
666b40ce416SJulian Elischer 	if ((error = ipcperm(td, &msqptr->msg_perm, IPC_W))) {
6673d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6683d903220SDoug Rabson 		printf("requester doesn't have write access\n");
6693d903220SDoug Rabson #endif
670b6a4b4f9SMatthew Dillon 		goto done2;
6713d903220SDoug Rabson 	}
6723d903220SDoug Rabson 
6733d903220SDoug Rabson 	segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
6743d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6753d903220SDoug Rabson 	printf("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz,
6763d903220SDoug Rabson 	    segs_needed);
6773d903220SDoug Rabson #endif
6783d903220SDoug Rabson 	for (;;) {
6793d903220SDoug Rabson 		int need_more_resources = 0;
6803d903220SDoug Rabson 
6813d903220SDoug Rabson 		/*
6823d903220SDoug Rabson 		 * check msgsz
6833d903220SDoug Rabson 		 * (inside this loop in case msg_qbytes changes while we sleep)
6843d903220SDoug Rabson 		 */
6853d903220SDoug Rabson 
686789668e2SDavid Greenman 		if (msgsz > msqptr->msg_qbytes) {
6873d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6883d903220SDoug Rabson 			printf("msgsz > msqptr->msg_qbytes\n");
6893d903220SDoug Rabson #endif
690b6a4b4f9SMatthew Dillon 			error = EINVAL;
691b6a4b4f9SMatthew Dillon 			goto done2;
6923d903220SDoug Rabson 		}
6933d903220SDoug Rabson 
6943d903220SDoug Rabson 		if (msqptr->msg_perm.mode & MSG_LOCKED) {
6953d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6963d903220SDoug Rabson 			printf("msqid is locked\n");
6973d903220SDoug Rabson #endif
6983d903220SDoug Rabson 			need_more_resources = 1;
6993d903220SDoug Rabson 		}
7003d903220SDoug Rabson 		if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) {
7013d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7023d903220SDoug Rabson 			printf("msgsz + msg_cbytes > msg_qbytes\n");
7033d903220SDoug Rabson #endif
7043d903220SDoug Rabson 			need_more_resources = 1;
7053d903220SDoug Rabson 		}
7063d903220SDoug Rabson 		if (segs_needed > nfree_msgmaps) {
7073d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7083d903220SDoug Rabson 			printf("segs_needed > nfree_msgmaps\n");
7093d903220SDoug Rabson #endif
7103d903220SDoug Rabson 			need_more_resources = 1;
7113d903220SDoug Rabson 		}
7123d903220SDoug Rabson 		if (free_msghdrs == NULL) {
7133d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7143d903220SDoug Rabson 			printf("no more msghdrs\n");
7153d903220SDoug Rabson #endif
7163d903220SDoug Rabson 			need_more_resources = 1;
7173d903220SDoug Rabson 		}
7183d903220SDoug Rabson 
7193d903220SDoug Rabson 		if (need_more_resources) {
7203d903220SDoug Rabson 			int we_own_it;
7213d903220SDoug Rabson 
7223d903220SDoug Rabson 			if ((msgflg & IPC_NOWAIT) != 0) {
7233d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7243d903220SDoug Rabson 				printf("need more resources but caller doesn't want to wait\n");
7253d903220SDoug Rabson #endif
726b6a4b4f9SMatthew Dillon 				error = EAGAIN;
727b6a4b4f9SMatthew Dillon 				goto done2;
7283d903220SDoug Rabson 			}
7293d903220SDoug Rabson 
7303d903220SDoug Rabson 			if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) {
7313d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7323d903220SDoug Rabson 				printf("we don't own the msqid_ds\n");
7333d903220SDoug Rabson #endif
7343d903220SDoug Rabson 				we_own_it = 0;
7353d903220SDoug Rabson 			} else {
7363d903220SDoug Rabson 				/* Force later arrivals to wait for our
7373d903220SDoug Rabson 				   request */
7383d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7393d903220SDoug Rabson 				printf("we own the msqid_ds\n");
7403d903220SDoug Rabson #endif
7413d903220SDoug Rabson 				msqptr->msg_perm.mode |= MSG_LOCKED;
7423d903220SDoug Rabson 				we_own_it = 1;
7433d903220SDoug Rabson 			}
7443d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7453d903220SDoug Rabson 			printf("goodnight\n");
7463d903220SDoug Rabson #endif
747b6a4b4f9SMatthew Dillon 			error = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH,
7483d903220SDoug Rabson 			    "msgwait", 0);
7493d903220SDoug Rabson #ifdef MSG_DEBUG_OK
750b6a4b4f9SMatthew Dillon 			printf("good morning, error=%d\n", error);
7513d903220SDoug Rabson #endif
7523d903220SDoug Rabson 			if (we_own_it)
7533d903220SDoug Rabson 				msqptr->msg_perm.mode &= ~MSG_LOCKED;
754b6a4b4f9SMatthew Dillon 			if (error != 0) {
7553d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7563d903220SDoug Rabson 				printf("msgsnd:  interrupted system call\n");
7573d903220SDoug Rabson #endif
758b6a4b4f9SMatthew Dillon 				error = EINTR;
759b6a4b4f9SMatthew Dillon 				goto done2;
7603d903220SDoug Rabson 			}
7613d903220SDoug Rabson 
7623d903220SDoug Rabson 			/*
7633d903220SDoug Rabson 			 * Make sure that the msq queue still exists
7643d903220SDoug Rabson 			 */
7653d903220SDoug Rabson 
7663d903220SDoug Rabson 			if (msqptr->msg_qbytes == 0) {
7673d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7683d903220SDoug Rabson 				printf("msqid deleted\n");
7693d903220SDoug Rabson #endif
770b6a4b4f9SMatthew Dillon 				error = EIDRM;
771b6a4b4f9SMatthew Dillon 				goto done2;
7723d903220SDoug Rabson 			}
7733d903220SDoug Rabson 
7743d903220SDoug Rabson 		} else {
7753d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7763d903220SDoug Rabson 			printf("got all the resources that we need\n");
7773d903220SDoug Rabson #endif
7783d903220SDoug Rabson 			break;
7793d903220SDoug Rabson 		}
7803d903220SDoug Rabson 	}
7813d903220SDoug Rabson 
7823d903220SDoug Rabson 	/*
7833d903220SDoug Rabson 	 * We have the resources that we need.
7843d903220SDoug Rabson 	 * Make sure!
7853d903220SDoug Rabson 	 */
7863d903220SDoug Rabson 
7873d903220SDoug Rabson 	if (msqptr->msg_perm.mode & MSG_LOCKED)
7883d903220SDoug Rabson 		panic("msg_perm.mode & MSG_LOCKED");
7893d903220SDoug Rabson 	if (segs_needed > nfree_msgmaps)
7903d903220SDoug Rabson 		panic("segs_needed > nfree_msgmaps");
7913d903220SDoug Rabson 	if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes)
7923d903220SDoug Rabson 		panic("msgsz + msg_cbytes > msg_qbytes");
7933d903220SDoug Rabson 	if (free_msghdrs == NULL)
7943d903220SDoug Rabson 		panic("no more msghdrs");
7953d903220SDoug Rabson 
7963d903220SDoug Rabson 	/*
7973d903220SDoug Rabson 	 * Re-lock the msqid_ds in case we page-fault when copying in the
7983d903220SDoug Rabson 	 * message
7993d903220SDoug Rabson 	 */
8003d903220SDoug Rabson 
8013d903220SDoug Rabson 	if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0)
8023d903220SDoug Rabson 		panic("msqid_ds is already locked");
8033d903220SDoug Rabson 	msqptr->msg_perm.mode |= MSG_LOCKED;
8043d903220SDoug Rabson 
8053d903220SDoug Rabson 	/*
8063d903220SDoug Rabson 	 * Allocate a message header
8073d903220SDoug Rabson 	 */
8083d903220SDoug Rabson 
8093d903220SDoug Rabson 	msghdr = free_msghdrs;
8103d903220SDoug Rabson 	free_msghdrs = msghdr->msg_next;
8113d903220SDoug Rabson 	msghdr->msg_spot = -1;
8123d903220SDoug Rabson 	msghdr->msg_ts = msgsz;
8133d903220SDoug Rabson 
8143d903220SDoug Rabson 	/*
8153d903220SDoug Rabson 	 * Allocate space for the message
8163d903220SDoug Rabson 	 */
8173d903220SDoug Rabson 
8183d903220SDoug Rabson 	while (segs_needed > 0) {
8193d903220SDoug Rabson 		if (nfree_msgmaps <= 0)
8203d903220SDoug Rabson 			panic("not enough msgmaps");
8213d903220SDoug Rabson 		if (free_msgmaps == -1)
8223d903220SDoug Rabson 			panic("nil free_msgmaps");
8233d903220SDoug Rabson 		next = free_msgmaps;
8243d903220SDoug Rabson 		if (next <= -1)
8253d903220SDoug Rabson 			panic("next too low #1");
8263d903220SDoug Rabson 		if (next >= msginfo.msgseg)
8273d903220SDoug Rabson 			panic("next out of range #1");
8283d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8293d903220SDoug Rabson 		printf("allocating segment %d to message\n", next);
8303d903220SDoug Rabson #endif
8313d903220SDoug Rabson 		free_msgmaps = msgmaps[next].next;
8323d903220SDoug Rabson 		nfree_msgmaps--;
8333d903220SDoug Rabson 		msgmaps[next].next = msghdr->msg_spot;
8343d903220SDoug Rabson 		msghdr->msg_spot = next;
8353d903220SDoug Rabson 		segs_needed--;
8363d903220SDoug Rabson 	}
8373d903220SDoug Rabson 
8383d903220SDoug Rabson 	/*
8393d903220SDoug Rabson 	 * Copy in the message type
8403d903220SDoug Rabson 	 */
8413d903220SDoug Rabson 
842b6a4b4f9SMatthew Dillon 	if ((error = copyin(user_msgp, &msghdr->msg_type,
8433d903220SDoug Rabson 	    sizeof(msghdr->msg_type))) != 0) {
8443d903220SDoug Rabson #ifdef MSG_DEBUG_OK
845b6a4b4f9SMatthew Dillon 		printf("error %d copying the message type\n", error);
8463d903220SDoug Rabson #endif
8473d903220SDoug Rabson 		msg_freehdr(msghdr);
8483d903220SDoug Rabson 		msqptr->msg_perm.mode &= ~MSG_LOCKED;
8493d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
850b6a4b4f9SMatthew Dillon 		goto done2;
8513d903220SDoug Rabson 	}
85209a8dfa2SBruce Evans 	user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type);
8533d903220SDoug Rabson 
8543d903220SDoug Rabson 	/*
8553d903220SDoug Rabson 	 * Validate the message type
8563d903220SDoug Rabson 	 */
8573d903220SDoug Rabson 
8583d903220SDoug Rabson 	if (msghdr->msg_type < 1) {
8593d903220SDoug Rabson 		msg_freehdr(msghdr);
8603d903220SDoug Rabson 		msqptr->msg_perm.mode &= ~MSG_LOCKED;
8613d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
8623d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8633d903220SDoug Rabson 		printf("mtype (%d) < 1\n", msghdr->msg_type);
8643d903220SDoug Rabson #endif
865b6a4b4f9SMatthew Dillon 		error = EINVAL;
866b6a4b4f9SMatthew Dillon 		goto done2;
8673d903220SDoug Rabson 	}
8683d903220SDoug Rabson 
8693d903220SDoug Rabson 	/*
8703d903220SDoug Rabson 	 * Copy in the message body
8713d903220SDoug Rabson 	 */
8723d903220SDoug Rabson 
8733d903220SDoug Rabson 	next = msghdr->msg_spot;
8743d903220SDoug Rabson 	while (msgsz > 0) {
8753d903220SDoug Rabson 		size_t tlen;
8763d903220SDoug Rabson 		if (msgsz > msginfo.msgssz)
8773d903220SDoug Rabson 			tlen = msginfo.msgssz;
8783d903220SDoug Rabson 		else
8793d903220SDoug Rabson 			tlen = msgsz;
8803d903220SDoug Rabson 		if (next <= -1)
8813d903220SDoug Rabson 			panic("next too low #2");
8823d903220SDoug Rabson 		if (next >= msginfo.msgseg)
8833d903220SDoug Rabson 			panic("next out of range #2");
884b6a4b4f9SMatthew Dillon 		if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz],
8853d903220SDoug Rabson 		    tlen)) != 0) {
8863d903220SDoug Rabson #ifdef MSG_DEBUG_OK
887b6a4b4f9SMatthew Dillon 			printf("error %d copying in message segment\n", error);
8883d903220SDoug Rabson #endif
8893d903220SDoug Rabson 			msg_freehdr(msghdr);
8903d903220SDoug Rabson 			msqptr->msg_perm.mode &= ~MSG_LOCKED;
8913d903220SDoug Rabson 			wakeup((caddr_t)msqptr);
892b6a4b4f9SMatthew Dillon 			goto done2;
8933d903220SDoug Rabson 		}
8943d903220SDoug Rabson 		msgsz -= tlen;
89509a8dfa2SBruce Evans 		user_msgp = (char *)user_msgp + tlen;
8963d903220SDoug Rabson 		next = msgmaps[next].next;
8973d903220SDoug Rabson 	}
8983d903220SDoug Rabson 	if (next != -1)
8993d903220SDoug Rabson 		panic("didn't use all the msg segments");
9003d903220SDoug Rabson 
9013d903220SDoug Rabson 	/*
9023d903220SDoug Rabson 	 * We've got the message.  Unlock the msqid_ds.
9033d903220SDoug Rabson 	 */
9043d903220SDoug Rabson 
9053d903220SDoug Rabson 	msqptr->msg_perm.mode &= ~MSG_LOCKED;
9063d903220SDoug Rabson 
9073d903220SDoug Rabson 	/*
9083d903220SDoug Rabson 	 * Make sure that the msqid_ds is still allocated.
9093d903220SDoug Rabson 	 */
9103d903220SDoug Rabson 
9113d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
9123d903220SDoug Rabson 		msg_freehdr(msghdr);
9133d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
914b6a4b4f9SMatthew Dillon 		error = EIDRM;
915b6a4b4f9SMatthew Dillon 		goto done2;
9163d903220SDoug Rabson 	}
9173d903220SDoug Rabson 
9183d903220SDoug Rabson 	/*
9193d903220SDoug Rabson 	 * Put the message into the queue
9203d903220SDoug Rabson 	 */
9213d903220SDoug Rabson 
9223d903220SDoug Rabson 	if (msqptr->msg_first == NULL) {
9233d903220SDoug Rabson 		msqptr->msg_first = msghdr;
9243d903220SDoug Rabson 		msqptr->msg_last = msghdr;
9253d903220SDoug Rabson 	} else {
9263d903220SDoug Rabson 		msqptr->msg_last->msg_next = msghdr;
9273d903220SDoug Rabson 		msqptr->msg_last = msghdr;
9283d903220SDoug Rabson 	}
9293d903220SDoug Rabson 	msqptr->msg_last->msg_next = NULL;
9303d903220SDoug Rabson 
9313d903220SDoug Rabson 	msqptr->msg_cbytes += msghdr->msg_ts;
9323d903220SDoug Rabson 	msqptr->msg_qnum++;
933b40ce416SJulian Elischer 	msqptr->msg_lspid = td->td_proc->p_pid;
934227ee8a1SPoul-Henning Kamp 	msqptr->msg_stime = time_second;
9353d903220SDoug Rabson 
9363d903220SDoug Rabson 	wakeup((caddr_t)msqptr);
937b40ce416SJulian Elischer 	td->td_retval[0] = 0;
938b6a4b4f9SMatthew Dillon done2:
939b6a4b4f9SMatthew Dillon 	mtx_unlock(&Giant);
940b6a4b4f9SMatthew Dillon 	return (error);
9413d903220SDoug Rabson }
9423d903220SDoug Rabson 
943b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
9443d903220SDoug Rabson struct msgrcv_args {
9453d903220SDoug Rabson 	int	msqid;
9463d903220SDoug Rabson 	void	*msgp;
9473d903220SDoug Rabson 	size_t	msgsz;
9483d903220SDoug Rabson 	long	msgtyp;
9493d903220SDoug Rabson 	int	msgflg;
9503d903220SDoug Rabson };
951b5d5c0c9SPeter Wemm #endif
9523d903220SDoug Rabson 
953b6a4b4f9SMatthew Dillon /*
954b6a4b4f9SMatthew Dillon  * MPSAFE
955b6a4b4f9SMatthew Dillon  */
956b5d5c0c9SPeter Wemm int
957b40ce416SJulian Elischer msgrcv(td, uap)
958b40ce416SJulian Elischer 	struct thread *td;
9593d903220SDoug Rabson 	register struct msgrcv_args *uap;
9603d903220SDoug Rabson {
9613d903220SDoug Rabson 	int msqid = uap->msqid;
9623d903220SDoug Rabson 	void *user_msgp = uap->msgp;
9633d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
9643d903220SDoug Rabson 	long msgtyp = uap->msgtyp;
9653d903220SDoug Rabson 	int msgflg = uap->msgflg;
9663d903220SDoug Rabson 	size_t len;
9673d903220SDoug Rabson 	register struct msqid_ds *msqptr;
9683d903220SDoug Rabson 	register struct msg *msghdr;
969b6a4b4f9SMatthew Dillon 	int error = 0;
9703d903220SDoug Rabson 	short next;
9713d903220SDoug Rabson 
9723d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9733d903220SDoug Rabson 	printf("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp,
9743d903220SDoug Rabson 	    msgsz, msgtyp, msgflg);
9753d903220SDoug Rabson #endif
9763d903220SDoug Rabson 
977b6a4b4f9SMatthew Dillon 	mtx_lock(&Giant);
978b40ce416SJulian Elischer 	if (!jail_sysvipc_allowed && jailed(td->td_proc->p_ucred)) {
979b6a4b4f9SMatthew Dillon 		error = ENOSYS;
980b6a4b4f9SMatthew Dillon 		goto done2;
981b6a4b4f9SMatthew Dillon 	}
982cb1f0db9SRobert Watson 
9833d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
9843d903220SDoug Rabson 
9853d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
9863d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9873d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
9883d903220SDoug Rabson 		    msginfo.msgmni);
9893d903220SDoug Rabson #endif
990b6a4b4f9SMatthew Dillon 		error = EINVAL;
991b6a4b4f9SMatthew Dillon 		goto done2;
9923d903220SDoug Rabson 	}
9933d903220SDoug Rabson 
9943d903220SDoug Rabson 	msqptr = &msqids[msqid];
9953d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
9963d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9973d903220SDoug Rabson 		printf("no such message queue id\n");
9983d903220SDoug Rabson #endif
999b6a4b4f9SMatthew Dillon 		error = EINVAL;
1000b6a4b4f9SMatthew Dillon 		goto done2;
10013d903220SDoug Rabson 	}
10023d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
10033d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10043d903220SDoug Rabson 		printf("wrong sequence number\n");
10053d903220SDoug Rabson #endif
1006b6a4b4f9SMatthew Dillon 		error = EINVAL;
1007b6a4b4f9SMatthew Dillon 		goto done2;
10083d903220SDoug Rabson 	}
10093d903220SDoug Rabson 
1010b40ce416SJulian Elischer 	if ((error = ipcperm(td, &msqptr->msg_perm, IPC_R))) {
10113d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10123d903220SDoug Rabson 		printf("requester doesn't have read access\n");
10133d903220SDoug Rabson #endif
1014b6a4b4f9SMatthew Dillon 		goto done2;
10153d903220SDoug Rabson 	}
10163d903220SDoug Rabson 
10173d903220SDoug Rabson 	msghdr = NULL;
10183d903220SDoug Rabson 	while (msghdr == NULL) {
10193d903220SDoug Rabson 		if (msgtyp == 0) {
10203d903220SDoug Rabson 			msghdr = msqptr->msg_first;
10213d903220SDoug Rabson 			if (msghdr != NULL) {
10223d903220SDoug Rabson 				if (msgsz < msghdr->msg_ts &&
10233d903220SDoug Rabson 				    (msgflg & MSG_NOERROR) == 0) {
10243d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10253d903220SDoug Rabson 					printf("first message on the queue is too big (want %d, got %d)\n",
10263d903220SDoug Rabson 					    msgsz, msghdr->msg_ts);
10273d903220SDoug Rabson #endif
1028b6a4b4f9SMatthew Dillon 					error = E2BIG;
1029b6a4b4f9SMatthew Dillon 					goto done2;
10303d903220SDoug Rabson 				}
10313d903220SDoug Rabson 				if (msqptr->msg_first == msqptr->msg_last) {
10323d903220SDoug Rabson 					msqptr->msg_first = NULL;
10333d903220SDoug Rabson 					msqptr->msg_last = NULL;
10343d903220SDoug Rabson 				} else {
10353d903220SDoug Rabson 					msqptr->msg_first = msghdr->msg_next;
10363d903220SDoug Rabson 					if (msqptr->msg_first == NULL)
10373d903220SDoug Rabson 						panic("msg_first/last screwed up #1");
10383d903220SDoug Rabson 				}
10393d903220SDoug Rabson 			}
10403d903220SDoug Rabson 		} else {
10413d903220SDoug Rabson 			struct msg *previous;
10423d903220SDoug Rabson 			struct msg **prev;
10433d903220SDoug Rabson 
10443d903220SDoug Rabson 			previous = NULL;
10453d903220SDoug Rabson 			prev = &(msqptr->msg_first);
10463d903220SDoug Rabson 			while ((msghdr = *prev) != NULL) {
10473d903220SDoug Rabson 				/*
10483d903220SDoug Rabson 				 * Is this message's type an exact match or is
10493d903220SDoug Rabson 				 * this message's type less than or equal to
10503d903220SDoug Rabson 				 * the absolute value of a negative msgtyp?
10513d903220SDoug Rabson 				 * Note that the second half of this test can
10523d903220SDoug Rabson 				 * NEVER be true if msgtyp is positive since
10533d903220SDoug Rabson 				 * msg_type is always positive!
10543d903220SDoug Rabson 				 */
10553d903220SDoug Rabson 
10563d903220SDoug Rabson 				if (msgtyp == msghdr->msg_type ||
10573d903220SDoug Rabson 				    msghdr->msg_type <= -msgtyp) {
10583d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10593d903220SDoug Rabson 					printf("found message type %d, requested %d\n",
10603d903220SDoug Rabson 					    msghdr->msg_type, msgtyp);
10613d903220SDoug Rabson #endif
10623d903220SDoug Rabson 					if (msgsz < msghdr->msg_ts &&
10633d903220SDoug Rabson 					    (msgflg & MSG_NOERROR) == 0) {
10643d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10653d903220SDoug Rabson 						printf("requested message on the queue is too big (want %d, got %d)\n",
10663d903220SDoug Rabson 						    msgsz, msghdr->msg_ts);
10673d903220SDoug Rabson #endif
1068b6a4b4f9SMatthew Dillon 						error = E2BIG;
1069b6a4b4f9SMatthew Dillon 						goto done2;
10703d903220SDoug Rabson 					}
10713d903220SDoug Rabson 					*prev = msghdr->msg_next;
10723d903220SDoug Rabson 					if (msghdr == msqptr->msg_last) {
10733d903220SDoug Rabson 						if (previous == NULL) {
10743d903220SDoug Rabson 							if (prev !=
10753d903220SDoug Rabson 							    &msqptr->msg_first)
10763d903220SDoug Rabson 								panic("msg_first/last screwed up #2");
10773d903220SDoug Rabson 							msqptr->msg_first =
10783d903220SDoug Rabson 							    NULL;
10793d903220SDoug Rabson 							msqptr->msg_last =
10803d903220SDoug Rabson 							    NULL;
10813d903220SDoug Rabson 						} else {
10823d903220SDoug Rabson 							if (prev ==
10833d903220SDoug Rabson 							    &msqptr->msg_first)
10843d903220SDoug Rabson 								panic("msg_first/last screwed up #3");
10853d903220SDoug Rabson 							msqptr->msg_last =
10863d903220SDoug Rabson 							    previous;
10873d903220SDoug Rabson 						}
10883d903220SDoug Rabson 					}
10893d903220SDoug Rabson 					break;
10903d903220SDoug Rabson 				}
10913d903220SDoug Rabson 				previous = msghdr;
10923d903220SDoug Rabson 				prev = &(msghdr->msg_next);
10933d903220SDoug Rabson 			}
10943d903220SDoug Rabson 		}
10953d903220SDoug Rabson 
10963d903220SDoug Rabson 		/*
10973d903220SDoug Rabson 		 * We've either extracted the msghdr for the appropriate
10983d903220SDoug Rabson 		 * message or there isn't one.
10993d903220SDoug Rabson 		 * If there is one then bail out of this loop.
11003d903220SDoug Rabson 		 */
11013d903220SDoug Rabson 
11023d903220SDoug Rabson 		if (msghdr != NULL)
11033d903220SDoug Rabson 			break;
11043d903220SDoug Rabson 
11053d903220SDoug Rabson 		/*
11063d903220SDoug Rabson 		 * Hmph!  No message found.  Does the user want to wait?
11073d903220SDoug Rabson 		 */
11083d903220SDoug Rabson 
11093d903220SDoug Rabson 		if ((msgflg & IPC_NOWAIT) != 0) {
11103d903220SDoug Rabson #ifdef MSG_DEBUG_OK
11113d903220SDoug Rabson 			printf("no appropriate message found (msgtyp=%d)\n",
11123d903220SDoug Rabson 			    msgtyp);
11133d903220SDoug Rabson #endif
11143d903220SDoug Rabson 			/* The SVID says to return ENOMSG. */
1115b6a4b4f9SMatthew Dillon 			error = ENOMSG;
1116b6a4b4f9SMatthew Dillon 			goto done2;
11173d903220SDoug Rabson 		}
11183d903220SDoug Rabson 
11193d903220SDoug Rabson 		/*
11203d903220SDoug Rabson 		 * Wait for something to happen
11213d903220SDoug Rabson 		 */
11223d903220SDoug Rabson 
11233d903220SDoug Rabson #ifdef MSG_DEBUG_OK
11243d903220SDoug Rabson 		printf("msgrcv:  goodnight\n");
11253d903220SDoug Rabson #endif
1126b6a4b4f9SMatthew Dillon 		error = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, "msgwait",
11273d903220SDoug Rabson 		    0);
11283d903220SDoug Rabson #ifdef MSG_DEBUG_OK
1129b6a4b4f9SMatthew Dillon 		printf("msgrcv:  good morning (error=%d)\n", error);
11303d903220SDoug Rabson #endif
11313d903220SDoug Rabson 
1132b6a4b4f9SMatthew Dillon 		if (error != 0) {
11333d903220SDoug Rabson #ifdef MSG_DEBUG_OK
11343d903220SDoug Rabson 			printf("msgsnd:  interrupted system call\n");
11353d903220SDoug Rabson #endif
1136b6a4b4f9SMatthew Dillon 			error = EINTR;
1137b6a4b4f9SMatthew Dillon 			goto done2;
11383d903220SDoug Rabson 		}
11393d903220SDoug Rabson 
11403d903220SDoug Rabson 		/*
11413d903220SDoug Rabson 		 * Make sure that the msq queue still exists
11423d903220SDoug Rabson 		 */
11433d903220SDoug Rabson 
11443d903220SDoug Rabson 		if (msqptr->msg_qbytes == 0 ||
11453d903220SDoug Rabson 		    msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
11463d903220SDoug Rabson #ifdef MSG_DEBUG_OK
11473d903220SDoug Rabson 			printf("msqid deleted\n");
11483d903220SDoug Rabson #endif
1149b6a4b4f9SMatthew Dillon 			error = EIDRM;
1150b6a4b4f9SMatthew Dillon 			goto done2;
11513d903220SDoug Rabson 		}
11523d903220SDoug Rabson 	}
11533d903220SDoug Rabson 
11543d903220SDoug Rabson 	/*
11553d903220SDoug Rabson 	 * Return the message to the user.
11563d903220SDoug Rabson 	 *
11573d903220SDoug Rabson 	 * First, do the bookkeeping (before we risk being interrupted).
11583d903220SDoug Rabson 	 */
11593d903220SDoug Rabson 
11603d903220SDoug Rabson 	msqptr->msg_cbytes -= msghdr->msg_ts;
11613d903220SDoug Rabson 	msqptr->msg_qnum--;
1162b40ce416SJulian Elischer 	msqptr->msg_lrpid = td->td_proc->p_pid;
1163227ee8a1SPoul-Henning Kamp 	msqptr->msg_rtime = time_second;
11643d903220SDoug Rabson 
11653d903220SDoug Rabson 	/*
11663d903220SDoug Rabson 	 * Make msgsz the actual amount that we'll be returning.
11673d903220SDoug Rabson 	 * Note that this effectively truncates the message if it is too long
11683d903220SDoug Rabson 	 * (since msgsz is never increased).
11693d903220SDoug Rabson 	 */
11703d903220SDoug Rabson 
11713d903220SDoug Rabson #ifdef MSG_DEBUG_OK
11723d903220SDoug Rabson 	printf("found a message, msgsz=%d, msg_ts=%d\n", msgsz,
11733d903220SDoug Rabson 	    msghdr->msg_ts);
11743d903220SDoug Rabson #endif
11753d903220SDoug Rabson 	if (msgsz > msghdr->msg_ts)
11763d903220SDoug Rabson 		msgsz = msghdr->msg_ts;
11773d903220SDoug Rabson 
11783d903220SDoug Rabson 	/*
11793d903220SDoug Rabson 	 * Return the type to the user.
11803d903220SDoug Rabson 	 */
11813d903220SDoug Rabson 
1182b6a4b4f9SMatthew Dillon 	error = copyout((caddr_t)&(msghdr->msg_type), user_msgp,
11833d903220SDoug Rabson 	    sizeof(msghdr->msg_type));
1184b6a4b4f9SMatthew Dillon 	if (error != 0) {
11853d903220SDoug Rabson #ifdef MSG_DEBUG_OK
1186b6a4b4f9SMatthew Dillon 		printf("error (%d) copying out message type\n", error);
11873d903220SDoug Rabson #endif
11883d903220SDoug Rabson 		msg_freehdr(msghdr);
11893d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
1190b6a4b4f9SMatthew Dillon 		goto done2;
11913d903220SDoug Rabson 	}
119209a8dfa2SBruce Evans 	user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type);
11933d903220SDoug Rabson 
11943d903220SDoug Rabson 	/*
11953d903220SDoug Rabson 	 * Return the segments to the user
11963d903220SDoug Rabson 	 */
11973d903220SDoug Rabson 
11983d903220SDoug Rabson 	next = msghdr->msg_spot;
11993d903220SDoug Rabson 	for (len = 0; len < msgsz; len += msginfo.msgssz) {
12003d903220SDoug Rabson 		size_t tlen;
12013d903220SDoug Rabson 
1202565592bdSSADA Kenji 		if (msgsz - len > msginfo.msgssz)
12033d903220SDoug Rabson 			tlen = msginfo.msgssz;
12043d903220SDoug Rabson 		else
1205565592bdSSADA Kenji 			tlen = msgsz - len;
12063d903220SDoug Rabson 		if (next <= -1)
12073d903220SDoug Rabson 			panic("next too low #3");
12083d903220SDoug Rabson 		if (next >= msginfo.msgseg)
12093d903220SDoug Rabson 			panic("next out of range #3");
1210b6a4b4f9SMatthew Dillon 		error = copyout((caddr_t)&msgpool[next * msginfo.msgssz],
12113d903220SDoug Rabson 		    user_msgp, tlen);
1212b6a4b4f9SMatthew Dillon 		if (error != 0) {
12133d903220SDoug Rabson #ifdef MSG_DEBUG_OK
12143d903220SDoug Rabson 			printf("error (%d) copying out message segment\n",
1215b6a4b4f9SMatthew Dillon 			    error);
12163d903220SDoug Rabson #endif
12173d903220SDoug Rabson 			msg_freehdr(msghdr);
12183d903220SDoug Rabson 			wakeup((caddr_t)msqptr);
1219b6a4b4f9SMatthew Dillon 			goto done2;
12203d903220SDoug Rabson 		}
122109a8dfa2SBruce Evans 		user_msgp = (char *)user_msgp + tlen;
12223d903220SDoug Rabson 		next = msgmaps[next].next;
12233d903220SDoug Rabson 	}
12243d903220SDoug Rabson 
12253d903220SDoug Rabson 	/*
12263d903220SDoug Rabson 	 * Done, return the actual number of bytes copied out.
12273d903220SDoug Rabson 	 */
12283d903220SDoug Rabson 
12293d903220SDoug Rabson 	msg_freehdr(msghdr);
12303d903220SDoug Rabson 	wakeup((caddr_t)msqptr);
1231b40ce416SJulian Elischer 	td->td_retval[0] = msgsz;
1232b6a4b4f9SMatthew Dillon done2:
1233b6a4b4f9SMatthew Dillon 	mtx_unlock(&Giant);
1234b6a4b4f9SMatthew Dillon 	return (error);
12353d903220SDoug Rabson }
1236a723c4e1SDima Dorfman 
1237a723c4e1SDima Dorfman static int
1238a723c4e1SDima Dorfman sysctl_msqids(SYSCTL_HANDLER_ARGS)
1239a723c4e1SDima Dorfman {
1240a723c4e1SDima Dorfman 
1241a723c4e1SDima Dorfman 	return (SYSCTL_OUT(req, msqids,
1242a723c4e1SDima Dorfman 	    sizeof(struct msqid_ds) * msginfo.msgmni));
1243a723c4e1SDima Dorfman }
1244a723c4e1SDima Dorfman 
1245a723c4e1SDima Dorfman SYSCTL_DECL(_kern_ipc);
1246a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, "");
1247a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RD, &msginfo.msgmni, 0, "");
1248a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RD, &msginfo.msgmnb, 0, "");
1249a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RD, &msginfo.msgtql, 0, "");
1250a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RD, &msginfo.msgssz, 0, "");
1251a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RD, &msginfo.msgseg, 0, "")
1252a723c4e1SDima Dorfman SYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD,
1253a723c4e1SDima Dorfman     NULL, 0, sysctl_msqids, "", "Message queue IDs");
1254