xref: /freebsd/sys/kern/sysv_msg.c (revision b5d5c0c9347403a164c5765bd145c2e7954a4f1c)
1b5d5c0c9SPeter Wemm /*	$Id: sysv_msg.c,v 1.10 1995/12/14 08:31:51 phk Exp $ */
23d903220SDoug Rabson 
33d903220SDoug Rabson /*
43d903220SDoug Rabson  * Implementation of SVID messages
53d903220SDoug Rabson  *
63d903220SDoug Rabson  * Author:  Daniel Boulet
73d903220SDoug Rabson  *
83d903220SDoug Rabson  * Copyright 1993 Daniel Boulet and RTMX Inc.
93d903220SDoug Rabson  *
103d903220SDoug Rabson  * This system call was implemented by Daniel Boulet under contract from RTMX.
113d903220SDoug Rabson  *
123d903220SDoug Rabson  * Redistribution and use in source forms, with and without modification,
133d903220SDoug Rabson  * are permitted provided that this entire comment appears intact.
143d903220SDoug Rabson  *
153d903220SDoug Rabson  * Redistribution in binary form may occur without any restrictions.
163d903220SDoug Rabson  * Obviously, it would be nice if you gave credit where credit is due
173d903220SDoug Rabson  * but requiring it would be too onerous.
183d903220SDoug Rabson  *
193d903220SDoug Rabson  * This software is provided ``AS IS'' without any warranties of any kind.
203d903220SDoug Rabson  */
213d903220SDoug Rabson 
223d903220SDoug Rabson #include <sys/param.h>
233d903220SDoug Rabson #include <sys/systm.h>
24725db531SBruce Evans #include <sys/sysproto.h>
253d903220SDoug Rabson #include <sys/kernel.h>
263d903220SDoug Rabson #include <sys/proc.h>
273d903220SDoug Rabson #include <sys/msg.h>
28725db531SBruce Evans #include <sys/sysent.h>
293d903220SDoug Rabson 
304590fd3aSDavid Greenman static void msginit __P((void *));
312b14f991SJulian Elischer SYSINIT(sysv_msg, SI_SUB_SYSV_MSG, SI_ORDER_FIRST, msginit, NULL)
322b14f991SJulian Elischer 
333d903220SDoug Rabson #define MSG_DEBUG
343d903220SDoug Rabson #undef MSG_DEBUG_OK
353d903220SDoug Rabson 
36b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
37725db531SBruce Evans struct msgctl_args;
38b5d5c0c9SPeter Wemm int msgctl __P((struct proc *p, struct msgctl_args *uap, int *retval));
39725db531SBruce Evans struct msgget_args;
40b5d5c0c9SPeter Wemm int msgget __P((struct proc *p, struct msgget_args *uap, int *retval));
41725db531SBruce Evans struct msgsnd_args;
42b5d5c0c9SPeter Wemm int msgsnd __P((struct proc *p, struct msgsnd_args *uap, int *retval));
43725db531SBruce Evans struct msgrcv_args;
44b5d5c0c9SPeter Wemm int msgrcv __P((struct proc *p, struct msgrcv_args *uap, int *retval));
45b5d5c0c9SPeter Wemm #endif
46725db531SBruce Evans static void msg_freehdr __P((struct msg *msghdr));
473d903220SDoug Rabson 
48725db531SBruce Evans /* XXX casting to (sy_call_t *) is bogus, as usual. */
4987b6de2bSPoul-Henning Kamp static sy_call_t *msgcalls[] = {
50725db531SBruce Evans 	(sy_call_t *)msgctl, (sy_call_t *)msgget,
51725db531SBruce Evans 	(sy_call_t *)msgsnd, (sy_call_t *)msgrcv
52725db531SBruce Evans };
533d903220SDoug Rabson 
5487b6de2bSPoul-Henning Kamp static int nfree_msgmaps;	/* # of free map entries */
5587b6de2bSPoul-Henning Kamp static short free_msgmaps;	/* head of linked list of free map entries */
5687b6de2bSPoul-Henning Kamp static struct msg *free_msghdrs;	/* list of free msg headers */
5728f8db14SBruce Evans char *msgpool;			/* MSGMAX byte long msg buffer pool */
5828f8db14SBruce Evans struct msgmap *msgmaps;		/* MSGSEG msgmap structures */
5928f8db14SBruce Evans struct msg *msghdrs;		/* MSGTQL msg headers */
6028f8db14SBruce Evans struct msqid_ds *msqids;	/* MSGMNI msqid_ds struct's */
613d903220SDoug Rabson 
62789668e2SDavid Greenman void
63725db531SBruce Evans msginit(dummy)
64725db531SBruce Evans 	void *dummy;
653d903220SDoug Rabson {
663d903220SDoug Rabson 	register int i;
673d903220SDoug Rabson 
683d903220SDoug Rabson 	/*
693d903220SDoug Rabson 	 * msginfo.msgssz should be a power of two for efficiency reasons.
703d903220SDoug Rabson 	 * It is also pretty silly if msginfo.msgssz is less than 8
713d903220SDoug Rabson 	 * or greater than about 256 so ...
723d903220SDoug Rabson 	 */
733d903220SDoug Rabson 
743d903220SDoug Rabson 	i = 8;
753d903220SDoug Rabson 	while (i < 1024 && i != msginfo.msgssz)
763d903220SDoug Rabson 		i <<= 1;
773d903220SDoug Rabson     	if (i != msginfo.msgssz) {
783d903220SDoug Rabson 		printf("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz,
793d903220SDoug Rabson 		    msginfo.msgssz);
803d903220SDoug Rabson 		panic("msginfo.msgssz not a small power of 2");
813d903220SDoug Rabson 	}
823d903220SDoug Rabson 
833d903220SDoug Rabson 	if (msginfo.msgseg > 32767) {
843d903220SDoug Rabson 		printf("msginfo.msgseg=%d\n", msginfo.msgseg);
853d903220SDoug Rabson 		panic("msginfo.msgseg > 32767");
863d903220SDoug Rabson 	}
873d903220SDoug Rabson 
883d903220SDoug Rabson 	if (msgmaps == NULL)
893d903220SDoug Rabson 		panic("msgmaps is NULL");
903d903220SDoug Rabson 
913d903220SDoug Rabson 	for (i = 0; i < msginfo.msgseg; i++) {
923d903220SDoug Rabson 		if (i > 0)
933d903220SDoug Rabson 			msgmaps[i-1].next = i;
943d903220SDoug Rabson 		msgmaps[i].next = -1;	/* implies entry is available */
953d903220SDoug Rabson 	}
963d903220SDoug Rabson 	free_msgmaps = 0;
973d903220SDoug Rabson 	nfree_msgmaps = msginfo.msgseg;
983d903220SDoug Rabson 
993d903220SDoug Rabson 	if (msghdrs == NULL)
1003d903220SDoug Rabson 		panic("msghdrs is NULL");
1013d903220SDoug Rabson 
1023d903220SDoug Rabson 	for (i = 0; i < msginfo.msgtql; i++) {
1033d903220SDoug Rabson 		msghdrs[i].msg_type = 0;
1043d903220SDoug Rabson 		if (i > 0)
1053d903220SDoug Rabson 			msghdrs[i-1].msg_next = &msghdrs[i];
1063d903220SDoug Rabson 		msghdrs[i].msg_next = NULL;
1073d903220SDoug Rabson     	}
1083d903220SDoug Rabson 	free_msghdrs = &msghdrs[0];
1093d903220SDoug Rabson 
1103d903220SDoug Rabson 	if (msqids == NULL)
1113d903220SDoug Rabson 		panic("msqids is NULL");
1123d903220SDoug Rabson 
1133d903220SDoug Rabson 	for (i = 0; i < msginfo.msgmni; i++) {
1143d903220SDoug Rabson 		msqids[i].msg_qbytes = 0;	/* implies entry is available */
1153d903220SDoug Rabson 		msqids[i].msg_perm.seq = 0;	/* reset to a known value */
1163d903220SDoug Rabson 	}
1173d903220SDoug Rabson }
1183d903220SDoug Rabson 
1193d903220SDoug Rabson /*
1203d903220SDoug Rabson  * Entry point for all MSG calls
1213d903220SDoug Rabson  */
1223d903220SDoug Rabson int
1233d903220SDoug Rabson msgsys(p, uap, retval)
124725db531SBruce Evans 	struct proc *p;
125725db531SBruce Evans 	/* XXX actually varargs. */
126725db531SBruce Evans 	struct msgsys_args /* {
127725db531SBruce Evans 		u_int	which;
128725db531SBruce Evans 		int	a2;
129725db531SBruce Evans 		int	a3;
130725db531SBruce Evans 		int	a4;
131725db531SBruce Evans 		int	a5;
132725db531SBruce Evans 		int	a6;
133725db531SBruce Evans 	} */ *uap;
1343d903220SDoug Rabson 	int *retval;
1353d903220SDoug Rabson {
1363d903220SDoug Rabson 
1373d903220SDoug Rabson 	if (uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0]))
1383d903220SDoug Rabson 		return (EINVAL);
139725db531SBruce Evans 	return ((*msgcalls[uap->which])(p, &uap->a2, retval));
1403d903220SDoug Rabson }
1413d903220SDoug Rabson 
1423d903220SDoug Rabson static void
1433d903220SDoug Rabson msg_freehdr(msghdr)
1443d903220SDoug Rabson 	struct msg *msghdr;
1453d903220SDoug Rabson {
1463d903220SDoug Rabson 	while (msghdr->msg_ts > 0) {
1473d903220SDoug Rabson 		short next;
1483d903220SDoug Rabson 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)
1493d903220SDoug Rabson 			panic("msghdr->msg_spot out of range");
1503d903220SDoug Rabson 		next = msgmaps[msghdr->msg_spot].next;
1513d903220SDoug Rabson 		msgmaps[msghdr->msg_spot].next = free_msgmaps;
1523d903220SDoug Rabson 		free_msgmaps = msghdr->msg_spot;
1533d903220SDoug Rabson 		nfree_msgmaps++;
1543d903220SDoug Rabson 		msghdr->msg_spot = next;
1553d903220SDoug Rabson 		if (msghdr->msg_ts >= msginfo.msgssz)
1563d903220SDoug Rabson 			msghdr->msg_ts -= msginfo.msgssz;
1573d903220SDoug Rabson 		else
1583d903220SDoug Rabson 			msghdr->msg_ts = 0;
1593d903220SDoug Rabson 	}
1603d903220SDoug Rabson 	if (msghdr->msg_spot != -1)
1613d903220SDoug Rabson 		panic("msghdr->msg_spot != -1");
1623d903220SDoug Rabson 	msghdr->msg_next = free_msghdrs;
1633d903220SDoug Rabson 	free_msghdrs = msghdr;
1643d903220SDoug Rabson }
1653d903220SDoug Rabson 
166b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
1673d903220SDoug Rabson struct msgctl_args {
1683d903220SDoug Rabson 	int	msqid;
1693d903220SDoug Rabson 	int	cmd;
170b5d5c0c9SPeter Wemm 	struct	msqid_ds *buf;
1713d903220SDoug Rabson };
172b5d5c0c9SPeter Wemm #endif
1733d903220SDoug Rabson 
174b5d5c0c9SPeter Wemm int
1753d903220SDoug Rabson msgctl(p, uap, retval)
1763d903220SDoug Rabson 	struct proc *p;
1773d903220SDoug Rabson 	register struct msgctl_args *uap;
1783d903220SDoug Rabson 	int *retval;
1793d903220SDoug Rabson {
1803d903220SDoug Rabson 	int msqid = uap->msqid;
1813d903220SDoug Rabson 	int cmd = uap->cmd;
182b5d5c0c9SPeter Wemm 	struct msqid_ds *user_msqptr = uap->buf;
1833d903220SDoug Rabson 	struct ucred *cred = p->p_ucred;
184797f2d22SPoul-Henning Kamp 	int rval, eval;
1853d903220SDoug Rabson 	struct msqid_ds msqbuf;
1863d903220SDoug Rabson 	register struct msqid_ds *msqptr;
1873d903220SDoug Rabson 
1883d903220SDoug Rabson #ifdef MSG_DEBUG_OK
1893d903220SDoug Rabson 	printf("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, user_msqptr);
1903d903220SDoug Rabson #endif
1913d903220SDoug Rabson 
1923d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
1933d903220SDoug Rabson 
1943d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
1953d903220SDoug Rabson #ifdef MSG_DEBUG_OK
1963d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
1973d903220SDoug Rabson 		    msginfo.msgmni);
1983d903220SDoug Rabson #endif
1993d903220SDoug Rabson 		return(EINVAL);
2003d903220SDoug Rabson 	}
2013d903220SDoug Rabson 
2023d903220SDoug Rabson 	msqptr = &msqids[msqid];
2033d903220SDoug Rabson 
2043d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
2053d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2063d903220SDoug Rabson 		printf("no such msqid\n");
2073d903220SDoug Rabson #endif
2083d903220SDoug Rabson 		return(EINVAL);
2093d903220SDoug Rabson 	}
2103d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
2113d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2123d903220SDoug Rabson 		printf("wrong sequence number\n");
2133d903220SDoug Rabson #endif
2143d903220SDoug Rabson 		return(EINVAL);
2153d903220SDoug Rabson 	}
2163d903220SDoug Rabson 
2173d903220SDoug Rabson 	eval = 0;
2183d903220SDoug Rabson 	rval = 0;
2193d903220SDoug Rabson 
2203d903220SDoug Rabson 	switch (cmd) {
2213d903220SDoug Rabson 
2223d903220SDoug Rabson 	case IPC_RMID:
2233d903220SDoug Rabson 	{
2243d903220SDoug Rabson 		struct msg *msghdr;
2253d903220SDoug Rabson 		if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_M)))
2263d903220SDoug Rabson 			return(eval);
2273d903220SDoug Rabson 		/* Free the message headers */
2283d903220SDoug Rabson 		msghdr = msqptr->msg_first;
2293d903220SDoug Rabson 		while (msghdr != NULL) {
2303d903220SDoug Rabson 			struct msg *msghdr_tmp;
2313d903220SDoug Rabson 
2323d903220SDoug Rabson 			/* Free the segments of each message */
2333d903220SDoug Rabson 			msqptr->msg_cbytes -= msghdr->msg_ts;
2343d903220SDoug Rabson 			msqptr->msg_qnum--;
2353d903220SDoug Rabson 			msghdr_tmp = msghdr;
2363d903220SDoug Rabson 			msghdr = msghdr->msg_next;
2373d903220SDoug Rabson 			msg_freehdr(msghdr_tmp);
2383d903220SDoug Rabson 		}
2393d903220SDoug Rabson 
2403d903220SDoug Rabson 		if (msqptr->msg_cbytes != 0)
2413d903220SDoug Rabson 			panic("msg_cbytes is screwed up");
2423d903220SDoug Rabson 		if (msqptr->msg_qnum != 0)
2433d903220SDoug Rabson 			panic("msg_qnum is screwed up");
2443d903220SDoug Rabson 
2453d903220SDoug Rabson 		msqptr->msg_qbytes = 0;	/* Mark it as free */
2463d903220SDoug Rabson 
2473d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
2483d903220SDoug Rabson 	}
2493d903220SDoug Rabson 
2503d903220SDoug Rabson 		break;
2513d903220SDoug Rabson 
2523d903220SDoug Rabson 	case IPC_SET:
2533d903220SDoug Rabson 		if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_M)))
2543d903220SDoug Rabson 			return(eval);
2553d903220SDoug Rabson 		if ((eval = copyin(user_msqptr, &msqbuf, sizeof(msqbuf))) != 0)
2563d903220SDoug Rabson 			return(eval);
2573d903220SDoug Rabson 		if (msqbuf.msg_qbytes > msqptr->msg_qbytes && cred->cr_uid != 0)
2583d903220SDoug Rabson 			return(EPERM);
2593d903220SDoug Rabson 		if (msqbuf.msg_qbytes > msginfo.msgmnb) {
2603d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2613d903220SDoug Rabson 			printf("can't increase msg_qbytes beyond %d (truncating)\n",
2623d903220SDoug Rabson 			    msginfo.msgmnb);
2633d903220SDoug Rabson #endif
2643d903220SDoug Rabson 			msqbuf.msg_qbytes = msginfo.msgmnb;	/* silently restrict qbytes to system limit */
2653d903220SDoug Rabson 		}
2663d903220SDoug Rabson 		if (msqbuf.msg_qbytes == 0) {
2673d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2683d903220SDoug Rabson 			printf("can't reduce msg_qbytes to 0\n");
2693d903220SDoug Rabson #endif
2703d903220SDoug Rabson 			return(EINVAL);		/* non-standard errno! */
2713d903220SDoug Rabson 		}
2723d903220SDoug Rabson 		msqptr->msg_perm.uid = msqbuf.msg_perm.uid;	/* change the owner */
2733d903220SDoug Rabson 		msqptr->msg_perm.gid = msqbuf.msg_perm.gid;	/* change the owner */
2743d903220SDoug Rabson 		msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) |
2753d903220SDoug Rabson 		    (msqbuf.msg_perm.mode & 0777);
2763d903220SDoug Rabson 		msqptr->msg_qbytes = msqbuf.msg_qbytes;
2773d903220SDoug Rabson 		msqptr->msg_ctime = time.tv_sec;
2783d903220SDoug Rabson 		break;
2793d903220SDoug Rabson 
2803d903220SDoug Rabson 	case IPC_STAT:
2813d903220SDoug Rabson 		if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_R))) {
2823d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2833d903220SDoug Rabson 			printf("requester doesn't have read access\n");
2843d903220SDoug Rabson #endif
2853d903220SDoug Rabson 			return(eval);
2863d903220SDoug Rabson 		}
2873d903220SDoug Rabson 		eval = copyout((caddr_t)msqptr, user_msqptr,
2883d903220SDoug Rabson 		    sizeof(struct msqid_ds));
2893d903220SDoug Rabson 		break;
2903d903220SDoug Rabson 
2913d903220SDoug Rabson 	default:
2923d903220SDoug Rabson #ifdef MSG_DEBUG_OK
2933d903220SDoug Rabson 		printf("invalid command %d\n", cmd);
2943d903220SDoug Rabson #endif
2953d903220SDoug Rabson 		return(EINVAL);
2963d903220SDoug Rabson 	}
2973d903220SDoug Rabson 
2983d903220SDoug Rabson 	if (eval == 0)
2993d903220SDoug Rabson 		*retval = rval;
3003d903220SDoug Rabson 	return(eval);
3013d903220SDoug Rabson }
3023d903220SDoug Rabson 
303b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
3043d903220SDoug Rabson struct msgget_args {
3053d903220SDoug Rabson 	key_t	key;
3063d903220SDoug Rabson 	int	msgflg;
3073d903220SDoug Rabson };
308b5d5c0c9SPeter Wemm #endif
3093d903220SDoug Rabson 
310b5d5c0c9SPeter Wemm int
3113d903220SDoug Rabson msgget(p, uap, retval)
3123d903220SDoug Rabson 	struct proc *p;
3133d903220SDoug Rabson 	register struct msgget_args *uap;
3143d903220SDoug Rabson 	int *retval;
3153d903220SDoug Rabson {
3163d903220SDoug Rabson 	int msqid, eval;
3173d903220SDoug Rabson 	int key = uap->key;
3183d903220SDoug Rabson 	int msgflg = uap->msgflg;
3193d903220SDoug Rabson 	struct ucred *cred = p->p_ucred;
320789668e2SDavid Greenman 	register struct msqid_ds *msqptr = NULL;
3213d903220SDoug Rabson 
3223d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3233d903220SDoug Rabson 	printf("msgget(0x%x, 0%o)\n", key, msgflg);
3243d903220SDoug Rabson #endif
3253d903220SDoug Rabson 
3263d903220SDoug Rabson 	if (key != IPC_PRIVATE) {
3273d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
3283d903220SDoug Rabson 			msqptr = &msqids[msqid];
3293d903220SDoug Rabson 			if (msqptr->msg_qbytes != 0 &&
3303d903220SDoug Rabson 			    msqptr->msg_perm.key == key)
3313d903220SDoug Rabson 				break;
3323d903220SDoug Rabson 		}
3333d903220SDoug Rabson 		if (msqid < msginfo.msgmni) {
3343d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3353d903220SDoug Rabson 			printf("found public key\n");
3363d903220SDoug Rabson #endif
3373d903220SDoug Rabson 			if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
3383d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3393d903220SDoug Rabson 				printf("not exclusive\n");
3403d903220SDoug Rabson #endif
3413d903220SDoug Rabson 				return(EEXIST);
3423d903220SDoug Rabson 			}
3433d903220SDoug Rabson 			if ((eval = ipcperm(cred, &msqptr->msg_perm, msgflg & 0700 ))) {
3443d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3453d903220SDoug Rabson 				printf("requester doesn't have 0%o access\n",
3463d903220SDoug Rabson 				    msgflg & 0700);
3473d903220SDoug Rabson #endif
3483d903220SDoug Rabson 				return(eval);
3493d903220SDoug Rabson 			}
3503d903220SDoug Rabson 			goto found;
3513d903220SDoug Rabson 		}
3523d903220SDoug Rabson 	}
3533d903220SDoug Rabson 
3543d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3553d903220SDoug Rabson 	printf("need to allocate the msqid_ds\n");
3563d903220SDoug Rabson #endif
3573d903220SDoug Rabson 	if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
3583d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
3593d903220SDoug Rabson 			/*
3603d903220SDoug Rabson 			 * Look for an unallocated and unlocked msqid_ds.
3613d903220SDoug Rabson 			 * msqid_ds's can be locked by msgsnd or msgrcv while
3623d903220SDoug Rabson 			 * they are copying the message in/out.  We can't
3633d903220SDoug Rabson 			 * re-use the entry until they release it.
3643d903220SDoug Rabson 			 */
3653d903220SDoug Rabson 			msqptr = &msqids[msqid];
3663d903220SDoug Rabson 			if (msqptr->msg_qbytes == 0 &&
3673d903220SDoug Rabson 			    (msqptr->msg_perm.mode & MSG_LOCKED) == 0)
3683d903220SDoug Rabson 				break;
3693d903220SDoug Rabson 		}
3703d903220SDoug Rabson 		if (msqid == msginfo.msgmni) {
3713d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3723d903220SDoug Rabson 			printf("no more msqid_ds's available\n");
3733d903220SDoug Rabson #endif
3743d903220SDoug Rabson 			return(ENOSPC);
3753d903220SDoug Rabson 		}
3763d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3773d903220SDoug Rabson 		printf("msqid %d is available\n", msqid);
3783d903220SDoug Rabson #endif
3793d903220SDoug Rabson 		msqptr->msg_perm.key = key;
3803d903220SDoug Rabson 		msqptr->msg_perm.cuid = cred->cr_uid;
3813d903220SDoug Rabson 		msqptr->msg_perm.uid = cred->cr_uid;
3823d903220SDoug Rabson 		msqptr->msg_perm.cgid = cred->cr_gid;
3833d903220SDoug Rabson 		msqptr->msg_perm.gid = cred->cr_gid;
3843d903220SDoug Rabson 		msqptr->msg_perm.mode = (msgflg & 0777);
3853d903220SDoug Rabson 		/* Make sure that the returned msqid is unique */
3863d903220SDoug Rabson 		msqptr->msg_perm.seq++;
3873d903220SDoug Rabson 		msqptr->msg_first = NULL;
3883d903220SDoug Rabson 		msqptr->msg_last = NULL;
3893d903220SDoug Rabson 		msqptr->msg_cbytes = 0;
3903d903220SDoug Rabson 		msqptr->msg_qnum = 0;
3913d903220SDoug Rabson 		msqptr->msg_qbytes = msginfo.msgmnb;
3923d903220SDoug Rabson 		msqptr->msg_lspid = 0;
3933d903220SDoug Rabson 		msqptr->msg_lrpid = 0;
3943d903220SDoug Rabson 		msqptr->msg_stime = 0;
3953d903220SDoug Rabson 		msqptr->msg_rtime = 0;
3963d903220SDoug Rabson 		msqptr->msg_ctime = time.tv_sec;
3973d903220SDoug Rabson 	} else {
3983d903220SDoug Rabson #ifdef MSG_DEBUG_OK
3993d903220SDoug Rabson 		printf("didn't find it and wasn't asked to create it\n");
4003d903220SDoug Rabson #endif
4013d903220SDoug Rabson 		return(ENOENT);
4023d903220SDoug Rabson 	}
4033d903220SDoug Rabson 
4043d903220SDoug Rabson found:
4053d903220SDoug Rabson 	/* Construct the unique msqid */
4063d903220SDoug Rabson 	*retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm);
4073d903220SDoug Rabson 	return(0);
4083d903220SDoug Rabson }
4093d903220SDoug Rabson 
410b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
4113d903220SDoug Rabson struct msgsnd_args {
4123d903220SDoug Rabson 	int	msqid;
413b5d5c0c9SPeter Wemm 	void	*msgp;
4143d903220SDoug Rabson 	size_t	msgsz;
4153d903220SDoug Rabson 	int	msgflg;
4163d903220SDoug Rabson };
417b5d5c0c9SPeter Wemm #endif
4183d903220SDoug Rabson 
419b5d5c0c9SPeter Wemm int
4203d903220SDoug Rabson msgsnd(p, uap, retval)
4213d903220SDoug Rabson 	struct proc *p;
4223d903220SDoug Rabson 	register struct msgsnd_args *uap;
4233d903220SDoug Rabson 	int *retval;
4243d903220SDoug Rabson {
4253d903220SDoug Rabson 	int msqid = uap->msqid;
426b5d5c0c9SPeter Wemm 	void *user_msgp = uap->msgp;
4273d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
4283d903220SDoug Rabson 	int msgflg = uap->msgflg;
4293d903220SDoug Rabson 	int segs_needed, eval;
4303d903220SDoug Rabson 	struct ucred *cred = p->p_ucred;
4313d903220SDoug Rabson 	register struct msqid_ds *msqptr;
4323d903220SDoug Rabson 	register struct msg *msghdr;
4333d903220SDoug Rabson 	short next;
4343d903220SDoug Rabson 
4353d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4363d903220SDoug Rabson 	printf("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz,
4373d903220SDoug Rabson 	    msgflg);
4383d903220SDoug Rabson #endif
4393d903220SDoug Rabson 
4403d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
4413d903220SDoug Rabson 
4423d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
4433d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4443d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
4453d903220SDoug Rabson 		    msginfo.msgmni);
4463d903220SDoug Rabson #endif
4473d903220SDoug Rabson 		return(EINVAL);
4483d903220SDoug Rabson 	}
4493d903220SDoug Rabson 
4503d903220SDoug Rabson 	msqptr = &msqids[msqid];
4513d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
4523d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4533d903220SDoug Rabson 		printf("no such message queue id\n");
4543d903220SDoug Rabson #endif
4553d903220SDoug Rabson 		return(EINVAL);
4563d903220SDoug Rabson 	}
4573d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
4583d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4593d903220SDoug Rabson 		printf("wrong sequence number\n");
4603d903220SDoug Rabson #endif
4613d903220SDoug Rabson 		return(EINVAL);
4623d903220SDoug Rabson 	}
4633d903220SDoug Rabson 
4643d903220SDoug Rabson 	if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_W))) {
4653d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4663d903220SDoug Rabson 		printf("requester doesn't have write access\n");
4673d903220SDoug Rabson #endif
4683d903220SDoug Rabson 		return(eval);
4693d903220SDoug Rabson 	}
4703d903220SDoug Rabson 
4713d903220SDoug Rabson 	segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
4723d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4733d903220SDoug Rabson 	printf("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz,
4743d903220SDoug Rabson 	    segs_needed);
4753d903220SDoug Rabson #endif
4763d903220SDoug Rabson 	for (;;) {
4773d903220SDoug Rabson 		int need_more_resources = 0;
4783d903220SDoug Rabson 
4793d903220SDoug Rabson 		/*
4803d903220SDoug Rabson 		 * check msgsz
4813d903220SDoug Rabson 		 * (inside this loop in case msg_qbytes changes while we sleep)
4823d903220SDoug Rabson 		 */
4833d903220SDoug Rabson 
484789668e2SDavid Greenman 		if (msgsz > msqptr->msg_qbytes) {
4853d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4863d903220SDoug Rabson 			printf("msgsz > msqptr->msg_qbytes\n");
4873d903220SDoug Rabson #endif
4883d903220SDoug Rabson 			return(EINVAL);
4893d903220SDoug Rabson 		}
4903d903220SDoug Rabson 
4913d903220SDoug Rabson 		if (msqptr->msg_perm.mode & MSG_LOCKED) {
4923d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4933d903220SDoug Rabson 			printf("msqid is locked\n");
4943d903220SDoug Rabson #endif
4953d903220SDoug Rabson 			need_more_resources = 1;
4963d903220SDoug Rabson 		}
4973d903220SDoug Rabson 		if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes) {
4983d903220SDoug Rabson #ifdef MSG_DEBUG_OK
4993d903220SDoug Rabson 			printf("msgsz + msg_cbytes > msg_qbytes\n");
5003d903220SDoug Rabson #endif
5013d903220SDoug Rabson 			need_more_resources = 1;
5023d903220SDoug Rabson 		}
5033d903220SDoug Rabson 		if (segs_needed > nfree_msgmaps) {
5043d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5053d903220SDoug Rabson 			printf("segs_needed > nfree_msgmaps\n");
5063d903220SDoug Rabson #endif
5073d903220SDoug Rabson 			need_more_resources = 1;
5083d903220SDoug Rabson 		}
5093d903220SDoug Rabson 		if (free_msghdrs == NULL) {
5103d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5113d903220SDoug Rabson 			printf("no more msghdrs\n");
5123d903220SDoug Rabson #endif
5133d903220SDoug Rabson 			need_more_resources = 1;
5143d903220SDoug Rabson 		}
5153d903220SDoug Rabson 
5163d903220SDoug Rabson 		if (need_more_resources) {
5173d903220SDoug Rabson 			int we_own_it;
5183d903220SDoug Rabson 
5193d903220SDoug Rabson 			if ((msgflg & IPC_NOWAIT) != 0) {
5203d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5213d903220SDoug Rabson 				printf("need more resources but caller doesn't want to wait\n");
5223d903220SDoug Rabson #endif
5233d903220SDoug Rabson 				return(EAGAIN);
5243d903220SDoug Rabson 			}
5253d903220SDoug Rabson 
5263d903220SDoug Rabson 			if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) {
5273d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5283d903220SDoug Rabson 				printf("we don't own the msqid_ds\n");
5293d903220SDoug Rabson #endif
5303d903220SDoug Rabson 				we_own_it = 0;
5313d903220SDoug Rabson 			} else {
5323d903220SDoug Rabson 				/* Force later arrivals to wait for our
5333d903220SDoug Rabson 				   request */
5343d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5353d903220SDoug Rabson 				printf("we own the msqid_ds\n");
5363d903220SDoug Rabson #endif
5373d903220SDoug Rabson 				msqptr->msg_perm.mode |= MSG_LOCKED;
5383d903220SDoug Rabson 				we_own_it = 1;
5393d903220SDoug Rabson 			}
5403d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5413d903220SDoug Rabson 			printf("goodnight\n");
5423d903220SDoug Rabson #endif
5433d903220SDoug Rabson 			eval = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH,
5443d903220SDoug Rabson 			    "msgwait", 0);
5453d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5463d903220SDoug Rabson 			printf("good morning, eval=%d\n", eval);
5473d903220SDoug Rabson #endif
5483d903220SDoug Rabson 			if (we_own_it)
5493d903220SDoug Rabson 				msqptr->msg_perm.mode &= ~MSG_LOCKED;
5503d903220SDoug Rabson 			if (eval != 0) {
5513d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5523d903220SDoug Rabson 				printf("msgsnd:  interrupted system call\n");
5533d903220SDoug Rabson #endif
5543d903220SDoug Rabson 				return(EINTR);
5553d903220SDoug Rabson 			}
5563d903220SDoug Rabson 
5573d903220SDoug Rabson 			/*
5583d903220SDoug Rabson 			 * Make sure that the msq queue still exists
5593d903220SDoug Rabson 			 */
5603d903220SDoug Rabson 
5613d903220SDoug Rabson 			if (msqptr->msg_qbytes == 0) {
5623d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5633d903220SDoug Rabson 				printf("msqid deleted\n");
5643d903220SDoug Rabson #endif
5653d903220SDoug Rabson 				/* The SVID says to return EIDRM. */
5663d903220SDoug Rabson #ifdef EIDRM
5673d903220SDoug Rabson 				return(EIDRM);
5683d903220SDoug Rabson #else
5693d903220SDoug Rabson 				/* Unfortunately, BSD doesn't define that code
5703d903220SDoug Rabson 				   yet! */
5713d903220SDoug Rabson 				return(EINVAL);
5723d903220SDoug Rabson #endif
5733d903220SDoug Rabson 			}
5743d903220SDoug Rabson 
5753d903220SDoug Rabson 		} else {
5763d903220SDoug Rabson #ifdef MSG_DEBUG_OK
5773d903220SDoug Rabson 			printf("got all the resources that we need\n");
5783d903220SDoug Rabson #endif
5793d903220SDoug Rabson 			break;
5803d903220SDoug Rabson 		}
5813d903220SDoug Rabson 	}
5823d903220SDoug Rabson 
5833d903220SDoug Rabson 	/*
5843d903220SDoug Rabson 	 * We have the resources that we need.
5853d903220SDoug Rabson 	 * Make sure!
5863d903220SDoug Rabson 	 */
5873d903220SDoug Rabson 
5883d903220SDoug Rabson 	if (msqptr->msg_perm.mode & MSG_LOCKED)
5893d903220SDoug Rabson 		panic("msg_perm.mode & MSG_LOCKED");
5903d903220SDoug Rabson 	if (segs_needed > nfree_msgmaps)
5913d903220SDoug Rabson 		panic("segs_needed > nfree_msgmaps");
5923d903220SDoug Rabson 	if (msgsz + msqptr->msg_cbytes > msqptr->msg_qbytes)
5933d903220SDoug Rabson 		panic("msgsz + msg_cbytes > msg_qbytes");
5943d903220SDoug Rabson 	if (free_msghdrs == NULL)
5953d903220SDoug Rabson 		panic("no more msghdrs");
5963d903220SDoug Rabson 
5973d903220SDoug Rabson 	/*
5983d903220SDoug Rabson 	 * Re-lock the msqid_ds in case we page-fault when copying in the
5993d903220SDoug Rabson 	 * message
6003d903220SDoug Rabson 	 */
6013d903220SDoug Rabson 
6023d903220SDoug Rabson 	if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0)
6033d903220SDoug Rabson 		panic("msqid_ds is already locked");
6043d903220SDoug Rabson 	msqptr->msg_perm.mode |= MSG_LOCKED;
6053d903220SDoug Rabson 
6063d903220SDoug Rabson 	/*
6073d903220SDoug Rabson 	 * Allocate a message header
6083d903220SDoug Rabson 	 */
6093d903220SDoug Rabson 
6103d903220SDoug Rabson 	msghdr = free_msghdrs;
6113d903220SDoug Rabson 	free_msghdrs = msghdr->msg_next;
6123d903220SDoug Rabson 	msghdr->msg_spot = -1;
6133d903220SDoug Rabson 	msghdr->msg_ts = msgsz;
6143d903220SDoug Rabson 
6153d903220SDoug Rabson 	/*
6163d903220SDoug Rabson 	 * Allocate space for the message
6173d903220SDoug Rabson 	 */
6183d903220SDoug Rabson 
6193d903220SDoug Rabson 	while (segs_needed > 0) {
6203d903220SDoug Rabson 		if (nfree_msgmaps <= 0)
6213d903220SDoug Rabson 			panic("not enough msgmaps");
6223d903220SDoug Rabson 		if (free_msgmaps == -1)
6233d903220SDoug Rabson 			panic("nil free_msgmaps");
6243d903220SDoug Rabson 		next = free_msgmaps;
6253d903220SDoug Rabson 		if (next <= -1)
6263d903220SDoug Rabson 			panic("next too low #1");
6273d903220SDoug Rabson 		if (next >= msginfo.msgseg)
6283d903220SDoug Rabson 			panic("next out of range #1");
6293d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6303d903220SDoug Rabson 		printf("allocating segment %d to message\n", next);
6313d903220SDoug Rabson #endif
6323d903220SDoug Rabson 		free_msgmaps = msgmaps[next].next;
6333d903220SDoug Rabson 		nfree_msgmaps--;
6343d903220SDoug Rabson 		msgmaps[next].next = msghdr->msg_spot;
6353d903220SDoug Rabson 		msghdr->msg_spot = next;
6363d903220SDoug Rabson 		segs_needed--;
6373d903220SDoug Rabson 	}
6383d903220SDoug Rabson 
6393d903220SDoug Rabson 	/*
6403d903220SDoug Rabson 	 * Copy in the message type
6413d903220SDoug Rabson 	 */
6423d903220SDoug Rabson 
6433d903220SDoug Rabson 	if ((eval = copyin(user_msgp, &msghdr->msg_type,
6443d903220SDoug Rabson 	    sizeof(msghdr->msg_type))) != 0) {
6453d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6463d903220SDoug Rabson 		printf("error %d copying the message type\n", eval);
6473d903220SDoug Rabson #endif
6483d903220SDoug Rabson 		msg_freehdr(msghdr);
6493d903220SDoug Rabson 		msqptr->msg_perm.mode &= ~MSG_LOCKED;
6503d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
6513d903220SDoug Rabson 		return(eval);
6523d903220SDoug Rabson 	}
6533d903220SDoug Rabson 	user_msgp += sizeof(msghdr->msg_type);
6543d903220SDoug Rabson 
6553d903220SDoug Rabson 	/*
6563d903220SDoug Rabson 	 * Validate the message type
6573d903220SDoug Rabson 	 */
6583d903220SDoug Rabson 
6593d903220SDoug Rabson 	if (msghdr->msg_type < 1) {
6603d903220SDoug Rabson 		msg_freehdr(msghdr);
6613d903220SDoug Rabson 		msqptr->msg_perm.mode &= ~MSG_LOCKED;
6623d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
6633d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6643d903220SDoug Rabson 		printf("mtype (%d) < 1\n", msghdr->msg_type);
6653d903220SDoug Rabson #endif
6663d903220SDoug Rabson 		return(EINVAL);
6673d903220SDoug Rabson 	}
6683d903220SDoug Rabson 
6693d903220SDoug Rabson 	/*
6703d903220SDoug Rabson 	 * Copy in the message body
6713d903220SDoug Rabson 	 */
6723d903220SDoug Rabson 
6733d903220SDoug Rabson 	next = msghdr->msg_spot;
6743d903220SDoug Rabson 	while (msgsz > 0) {
6753d903220SDoug Rabson 		size_t tlen;
6763d903220SDoug Rabson 		if (msgsz > msginfo.msgssz)
6773d903220SDoug Rabson 			tlen = msginfo.msgssz;
6783d903220SDoug Rabson 		else
6793d903220SDoug Rabson 			tlen = msgsz;
6803d903220SDoug Rabson 		if (next <= -1)
6813d903220SDoug Rabson 			panic("next too low #2");
6823d903220SDoug Rabson 		if (next >= msginfo.msgseg)
6833d903220SDoug Rabson 			panic("next out of range #2");
6843d903220SDoug Rabson 		if ((eval = copyin(user_msgp, &msgpool[next * msginfo.msgssz],
6853d903220SDoug Rabson 		    tlen)) != 0) {
6863d903220SDoug Rabson #ifdef MSG_DEBUG_OK
6873d903220SDoug Rabson 			printf("error %d copying in message segment\n", eval);
6883d903220SDoug Rabson #endif
6893d903220SDoug Rabson 			msg_freehdr(msghdr);
6903d903220SDoug Rabson 			msqptr->msg_perm.mode &= ~MSG_LOCKED;
6913d903220SDoug Rabson 			wakeup((caddr_t)msqptr);
6923d903220SDoug Rabson 			return(eval);
6933d903220SDoug Rabson 		}
6943d903220SDoug Rabson 		msgsz -= tlen;
6953d903220SDoug Rabson 		user_msgp += tlen;
6963d903220SDoug Rabson 		next = msgmaps[next].next;
6973d903220SDoug Rabson 	}
6983d903220SDoug Rabson 	if (next != -1)
6993d903220SDoug Rabson 		panic("didn't use all the msg segments");
7003d903220SDoug Rabson 
7013d903220SDoug Rabson 	/*
7023d903220SDoug Rabson 	 * We've got the message.  Unlock the msqid_ds.
7033d903220SDoug Rabson 	 */
7043d903220SDoug Rabson 
7053d903220SDoug Rabson 	msqptr->msg_perm.mode &= ~MSG_LOCKED;
7063d903220SDoug Rabson 
7073d903220SDoug Rabson 	/*
7083d903220SDoug Rabson 	 * Make sure that the msqid_ds is still allocated.
7093d903220SDoug Rabson 	 */
7103d903220SDoug Rabson 
7113d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
7123d903220SDoug Rabson 		msg_freehdr(msghdr);
7133d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
7143d903220SDoug Rabson 		/* The SVID says to return EIDRM. */
7153d903220SDoug Rabson #ifdef EIDRM
7163d903220SDoug Rabson 		return(EIDRM);
7173d903220SDoug Rabson #else
7183d903220SDoug Rabson 		/* Unfortunately, BSD doesn't define that code yet! */
7193d903220SDoug Rabson 		return(EINVAL);
7203d903220SDoug Rabson #endif
7213d903220SDoug Rabson 	}
7223d903220SDoug Rabson 
7233d903220SDoug Rabson 	/*
7243d903220SDoug Rabson 	 * Put the message into the queue
7253d903220SDoug Rabson 	 */
7263d903220SDoug Rabson 
7273d903220SDoug Rabson 	if (msqptr->msg_first == NULL) {
7283d903220SDoug Rabson 		msqptr->msg_first = msghdr;
7293d903220SDoug Rabson 		msqptr->msg_last = msghdr;
7303d903220SDoug Rabson 	} else {
7313d903220SDoug Rabson 		msqptr->msg_last->msg_next = msghdr;
7323d903220SDoug Rabson 		msqptr->msg_last = msghdr;
7333d903220SDoug Rabson 	}
7343d903220SDoug Rabson 	msqptr->msg_last->msg_next = NULL;
7353d903220SDoug Rabson 
7363d903220SDoug Rabson 	msqptr->msg_cbytes += msghdr->msg_ts;
7373d903220SDoug Rabson 	msqptr->msg_qnum++;
7383d903220SDoug Rabson 	msqptr->msg_lspid = p->p_pid;
7393d903220SDoug Rabson 	msqptr->msg_stime = time.tv_sec;
7403d903220SDoug Rabson 
7413d903220SDoug Rabson 	wakeup((caddr_t)msqptr);
7423d903220SDoug Rabson 	*retval = 0;
7433d903220SDoug Rabson 	return(0);
7443d903220SDoug Rabson }
7453d903220SDoug Rabson 
746b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
7473d903220SDoug Rabson struct msgrcv_args {
7483d903220SDoug Rabson 	int	msqid;
7493d903220SDoug Rabson 	void	*msgp;
7503d903220SDoug Rabson 	size_t	msgsz;
7513d903220SDoug Rabson 	long	msgtyp;
7523d903220SDoug Rabson 	int	msgflg;
7533d903220SDoug Rabson };
754b5d5c0c9SPeter Wemm #endif
7553d903220SDoug Rabson 
756b5d5c0c9SPeter Wemm int
7573d903220SDoug Rabson msgrcv(p, uap, retval)
7583d903220SDoug Rabson 	struct proc *p;
7593d903220SDoug Rabson 	register struct msgrcv_args *uap;
7603d903220SDoug Rabson 	int *retval;
7613d903220SDoug Rabson {
7623d903220SDoug Rabson 	int msqid = uap->msqid;
7633d903220SDoug Rabson 	void *user_msgp = uap->msgp;
7643d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
7653d903220SDoug Rabson 	long msgtyp = uap->msgtyp;
7663d903220SDoug Rabson 	int msgflg = uap->msgflg;
7673d903220SDoug Rabson 	size_t len;
7683d903220SDoug Rabson 	struct ucred *cred = p->p_ucred;
7693d903220SDoug Rabson 	register struct msqid_ds *msqptr;
7703d903220SDoug Rabson 	register struct msg *msghdr;
7713d903220SDoug Rabson 	int eval;
7723d903220SDoug Rabson 	short next;
7733d903220SDoug Rabson 
7743d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7753d903220SDoug Rabson 	printf("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp,
7763d903220SDoug Rabson 	    msgsz, msgtyp, msgflg);
7773d903220SDoug Rabson #endif
7783d903220SDoug Rabson 
7793d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
7803d903220SDoug Rabson 
7813d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
7823d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7833d903220SDoug Rabson 		printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
7843d903220SDoug Rabson 		    msginfo.msgmni);
7853d903220SDoug Rabson #endif
7863d903220SDoug Rabson 		return(EINVAL);
7873d903220SDoug Rabson 	}
7883d903220SDoug Rabson 
7893d903220SDoug Rabson 	msqptr = &msqids[msqid];
7903d903220SDoug Rabson 	if (msqptr->msg_qbytes == 0) {
7913d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7923d903220SDoug Rabson 		printf("no such message queue id\n");
7933d903220SDoug Rabson #endif
7943d903220SDoug Rabson 		return(EINVAL);
7953d903220SDoug Rabson 	}
7963d903220SDoug Rabson 	if (msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
7973d903220SDoug Rabson #ifdef MSG_DEBUG_OK
7983d903220SDoug Rabson 		printf("wrong sequence number\n");
7993d903220SDoug Rabson #endif
8003d903220SDoug Rabson 		return(EINVAL);
8013d903220SDoug Rabson 	}
8023d903220SDoug Rabson 
8033d903220SDoug Rabson 	if ((eval = ipcperm(cred, &msqptr->msg_perm, IPC_R))) {
8043d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8053d903220SDoug Rabson 		printf("requester doesn't have read access\n");
8063d903220SDoug Rabson #endif
8073d903220SDoug Rabson 		return(eval);
8083d903220SDoug Rabson 	}
8093d903220SDoug Rabson 
8103d903220SDoug Rabson 	msghdr = NULL;
8113d903220SDoug Rabson 	while (msghdr == NULL) {
8123d903220SDoug Rabson 		if (msgtyp == 0) {
8133d903220SDoug Rabson 			msghdr = msqptr->msg_first;
8143d903220SDoug Rabson 			if (msghdr != NULL) {
8153d903220SDoug Rabson 				if (msgsz < msghdr->msg_ts &&
8163d903220SDoug Rabson 				    (msgflg & MSG_NOERROR) == 0) {
8173d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8183d903220SDoug Rabson 					printf("first message on the queue is too big (want %d, got %d)\n",
8193d903220SDoug Rabson 					    msgsz, msghdr->msg_ts);
8203d903220SDoug Rabson #endif
8213d903220SDoug Rabson 					return(E2BIG);
8223d903220SDoug Rabson 				}
8233d903220SDoug Rabson 				if (msqptr->msg_first == msqptr->msg_last) {
8243d903220SDoug Rabson 					msqptr->msg_first = NULL;
8253d903220SDoug Rabson 					msqptr->msg_last = NULL;
8263d903220SDoug Rabson 				} else {
8273d903220SDoug Rabson 					msqptr->msg_first = msghdr->msg_next;
8283d903220SDoug Rabson 					if (msqptr->msg_first == NULL)
8293d903220SDoug Rabson 						panic("msg_first/last screwed up #1");
8303d903220SDoug Rabson 				}
8313d903220SDoug Rabson 			}
8323d903220SDoug Rabson 		} else {
8333d903220SDoug Rabson 			struct msg *previous;
8343d903220SDoug Rabson 			struct msg **prev;
8353d903220SDoug Rabson 
8363d903220SDoug Rabson 			previous = NULL;
8373d903220SDoug Rabson 			prev = &(msqptr->msg_first);
8383d903220SDoug Rabson 			while ((msghdr = *prev) != NULL) {
8393d903220SDoug Rabson 				/*
8403d903220SDoug Rabson 				 * Is this message's type an exact match or is
8413d903220SDoug Rabson 				 * this message's type less than or equal to
8423d903220SDoug Rabson 				 * the absolute value of a negative msgtyp?
8433d903220SDoug Rabson 				 * Note that the second half of this test can
8443d903220SDoug Rabson 				 * NEVER be true if msgtyp is positive since
8453d903220SDoug Rabson 				 * msg_type is always positive!
8463d903220SDoug Rabson 				 */
8473d903220SDoug Rabson 
8483d903220SDoug Rabson 				if (msgtyp == msghdr->msg_type ||
8493d903220SDoug Rabson 				    msghdr->msg_type <= -msgtyp) {
8503d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8513d903220SDoug Rabson 					printf("found message type %d, requested %d\n",
8523d903220SDoug Rabson 					    msghdr->msg_type, msgtyp);
8533d903220SDoug Rabson #endif
8543d903220SDoug Rabson 					if (msgsz < msghdr->msg_ts &&
8553d903220SDoug Rabson 					    (msgflg & MSG_NOERROR) == 0) {
8563d903220SDoug Rabson #ifdef MSG_DEBUG_OK
8573d903220SDoug Rabson 						printf("requested message on the queue is too big (want %d, got %d)\n",
8583d903220SDoug Rabson 						    msgsz, msghdr->msg_ts);
8593d903220SDoug Rabson #endif
8603d903220SDoug Rabson 						return(E2BIG);
8613d903220SDoug Rabson 					}
8623d903220SDoug Rabson 					*prev = msghdr->msg_next;
8633d903220SDoug Rabson 					if (msghdr == msqptr->msg_last) {
8643d903220SDoug Rabson 						if (previous == NULL) {
8653d903220SDoug Rabson 							if (prev !=
8663d903220SDoug Rabson 							    &msqptr->msg_first)
8673d903220SDoug Rabson 								panic("msg_first/last screwed up #2");
8683d903220SDoug Rabson 							msqptr->msg_first =
8693d903220SDoug Rabson 							    NULL;
8703d903220SDoug Rabson 							msqptr->msg_last =
8713d903220SDoug Rabson 							    NULL;
8723d903220SDoug Rabson 						} else {
8733d903220SDoug Rabson 							if (prev ==
8743d903220SDoug Rabson 							    &msqptr->msg_first)
8753d903220SDoug Rabson 								panic("msg_first/last screwed up #3");
8763d903220SDoug Rabson 							msqptr->msg_last =
8773d903220SDoug Rabson 							    previous;
8783d903220SDoug Rabson 						}
8793d903220SDoug Rabson 					}
8803d903220SDoug Rabson 					break;
8813d903220SDoug Rabson 				}
8823d903220SDoug Rabson 				previous = msghdr;
8833d903220SDoug Rabson 				prev = &(msghdr->msg_next);
8843d903220SDoug Rabson 			}
8853d903220SDoug Rabson 		}
8863d903220SDoug Rabson 
8873d903220SDoug Rabson 		/*
8883d903220SDoug Rabson 		 * We've either extracted the msghdr for the appropriate
8893d903220SDoug Rabson 		 * message or there isn't one.
8903d903220SDoug Rabson 		 * If there is one then bail out of this loop.
8913d903220SDoug Rabson 		 */
8923d903220SDoug Rabson 
8933d903220SDoug Rabson 		if (msghdr != NULL)
8943d903220SDoug Rabson 			break;
8953d903220SDoug Rabson 
8963d903220SDoug Rabson 		/*
8973d903220SDoug Rabson 		 * Hmph!  No message found.  Does the user want to wait?
8983d903220SDoug Rabson 		 */
8993d903220SDoug Rabson 
9003d903220SDoug Rabson 		if ((msgflg & IPC_NOWAIT) != 0) {
9013d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9023d903220SDoug Rabson 			printf("no appropriate message found (msgtyp=%d)\n",
9033d903220SDoug Rabson 			    msgtyp);
9043d903220SDoug Rabson #endif
9053d903220SDoug Rabson 			/* The SVID says to return ENOMSG. */
9063d903220SDoug Rabson #ifdef ENOMSG
9073d903220SDoug Rabson 			return(ENOMSG);
9083d903220SDoug Rabson #else
9093d903220SDoug Rabson 			/* Unfortunately, BSD doesn't define that code yet! */
9103d903220SDoug Rabson 			return(EAGAIN);
9113d903220SDoug Rabson #endif
9123d903220SDoug Rabson 		}
9133d903220SDoug Rabson 
9143d903220SDoug Rabson 		/*
9153d903220SDoug Rabson 		 * Wait for something to happen
9163d903220SDoug Rabson 		 */
9173d903220SDoug Rabson 
9183d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9193d903220SDoug Rabson 		printf("msgrcv:  goodnight\n");
9203d903220SDoug Rabson #endif
9213d903220SDoug Rabson 		eval = tsleep((caddr_t)msqptr, (PZERO - 4) | PCATCH, "msgwait",
9223d903220SDoug Rabson 		    0);
9233d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9243d903220SDoug Rabson 		printf("msgrcv:  good morning (eval=%d)\n", eval);
9253d903220SDoug Rabson #endif
9263d903220SDoug Rabson 
9273d903220SDoug Rabson 		if (eval != 0) {
9283d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9293d903220SDoug Rabson 			printf("msgsnd:  interrupted system call\n");
9303d903220SDoug Rabson #endif
9313d903220SDoug Rabson 			return(EINTR);
9323d903220SDoug Rabson 		}
9333d903220SDoug Rabson 
9343d903220SDoug Rabson 		/*
9353d903220SDoug Rabson 		 * Make sure that the msq queue still exists
9363d903220SDoug Rabson 		 */
9373d903220SDoug Rabson 
9383d903220SDoug Rabson 		if (msqptr->msg_qbytes == 0 ||
9393d903220SDoug Rabson 		    msqptr->msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
9403d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9413d903220SDoug Rabson 			printf("msqid deleted\n");
9423d903220SDoug Rabson #endif
9433d903220SDoug Rabson 			/* The SVID says to return EIDRM. */
9443d903220SDoug Rabson #ifdef EIDRM
9453d903220SDoug Rabson 			return(EIDRM);
9463d903220SDoug Rabson #else
9473d903220SDoug Rabson 			/* Unfortunately, BSD doesn't define that code yet! */
9483d903220SDoug Rabson 			return(EINVAL);
9493d903220SDoug Rabson #endif
9503d903220SDoug Rabson 		}
9513d903220SDoug Rabson 	}
9523d903220SDoug Rabson 
9533d903220SDoug Rabson 	/*
9543d903220SDoug Rabson 	 * Return the message to the user.
9553d903220SDoug Rabson 	 *
9563d903220SDoug Rabson 	 * First, do the bookkeeping (before we risk being interrupted).
9573d903220SDoug Rabson 	 */
9583d903220SDoug Rabson 
9593d903220SDoug Rabson 	msqptr->msg_cbytes -= msghdr->msg_ts;
9603d903220SDoug Rabson 	msqptr->msg_qnum--;
9613d903220SDoug Rabson 	msqptr->msg_lrpid = p->p_pid;
9623d903220SDoug Rabson 	msqptr->msg_rtime = time.tv_sec;
9633d903220SDoug Rabson 
9643d903220SDoug Rabson 	/*
9653d903220SDoug Rabson 	 * Make msgsz the actual amount that we'll be returning.
9663d903220SDoug Rabson 	 * Note that this effectively truncates the message if it is too long
9673d903220SDoug Rabson 	 * (since msgsz is never increased).
9683d903220SDoug Rabson 	 */
9693d903220SDoug Rabson 
9703d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9713d903220SDoug Rabson 	printf("found a message, msgsz=%d, msg_ts=%d\n", msgsz,
9723d903220SDoug Rabson 	    msghdr->msg_ts);
9733d903220SDoug Rabson #endif
9743d903220SDoug Rabson 	if (msgsz > msghdr->msg_ts)
9753d903220SDoug Rabson 		msgsz = msghdr->msg_ts;
9763d903220SDoug Rabson 
9773d903220SDoug Rabson 	/*
9783d903220SDoug Rabson 	 * Return the type to the user.
9793d903220SDoug Rabson 	 */
9803d903220SDoug Rabson 
9813d903220SDoug Rabson 	eval = copyout((caddr_t)&(msghdr->msg_type), user_msgp,
9823d903220SDoug Rabson 	    sizeof(msghdr->msg_type));
9833d903220SDoug Rabson 	if (eval != 0) {
9843d903220SDoug Rabson #ifdef MSG_DEBUG_OK
9853d903220SDoug Rabson 		printf("error (%d) copying out message type\n", eval);
9863d903220SDoug Rabson #endif
9873d903220SDoug Rabson 		msg_freehdr(msghdr);
9883d903220SDoug Rabson 		wakeup((caddr_t)msqptr);
9893d903220SDoug Rabson 		return(eval);
9903d903220SDoug Rabson 	}
9913d903220SDoug Rabson 	user_msgp += sizeof(msghdr->msg_type);
9923d903220SDoug Rabson 
9933d903220SDoug Rabson 	/*
9943d903220SDoug Rabson 	 * Return the segments to the user
9953d903220SDoug Rabson 	 */
9963d903220SDoug Rabson 
9973d903220SDoug Rabson 	next = msghdr->msg_spot;
9983d903220SDoug Rabson 	for (len = 0; len < msgsz; len += msginfo.msgssz) {
9993d903220SDoug Rabson 		size_t tlen;
10003d903220SDoug Rabson 
10013d903220SDoug Rabson 		if (msgsz > msginfo.msgssz)
10023d903220SDoug Rabson 			tlen = msginfo.msgssz;
10033d903220SDoug Rabson 		else
10043d903220SDoug Rabson 			tlen = msgsz;
10053d903220SDoug Rabson 		if (next <= -1)
10063d903220SDoug Rabson 			panic("next too low #3");
10073d903220SDoug Rabson 		if (next >= msginfo.msgseg)
10083d903220SDoug Rabson 			panic("next out of range #3");
10093d903220SDoug Rabson 		eval = copyout((caddr_t)&msgpool[next * msginfo.msgssz],
10103d903220SDoug Rabson 		    user_msgp, tlen);
10113d903220SDoug Rabson 		if (eval != 0) {
10123d903220SDoug Rabson #ifdef MSG_DEBUG_OK
10133d903220SDoug Rabson 			printf("error (%d) copying out message segment\n",
10143d903220SDoug Rabson 			    eval);
10153d903220SDoug Rabson #endif
10163d903220SDoug Rabson 			msg_freehdr(msghdr);
10173d903220SDoug Rabson 			wakeup((caddr_t)msqptr);
10183d903220SDoug Rabson 			return(eval);
10193d903220SDoug Rabson 		}
10203d903220SDoug Rabson 		user_msgp += tlen;
10213d903220SDoug Rabson 		next = msgmaps[next].next;
10223d903220SDoug Rabson 	}
10233d903220SDoug Rabson 
10243d903220SDoug Rabson 	/*
10253d903220SDoug Rabson 	 * Done, return the actual number of bytes copied out.
10263d903220SDoug Rabson 	 */
10273d903220SDoug Rabson 
10283d903220SDoug Rabson 	msg_freehdr(msghdr);
10293d903220SDoug Rabson 	wakeup((caddr_t)msqptr);
10303d903220SDoug Rabson 	*retval = msgsz;
10313d903220SDoug Rabson 	return(0);
10323d903220SDoug Rabson }
1033