xref: /freebsd/sys/kern/sysv_msg.c (revision f4b6eb045fa7cefa3062479048dea9f5d397f276)
19454b2d8SWarner Losh /*-
23d903220SDoug Rabson  * Implementation of SVID messages
33d903220SDoug Rabson  *
43d903220SDoug Rabson  * Author:  Daniel Boulet
53d903220SDoug Rabson  *
63d903220SDoug Rabson  * Copyright 1993 Daniel Boulet and RTMX Inc.
73d903220SDoug Rabson  *
83d903220SDoug Rabson  * This system call was implemented by Daniel Boulet under contract from RTMX.
93d903220SDoug Rabson  *
103d903220SDoug Rabson  * Redistribution and use in source forms, with and without modification,
113d903220SDoug Rabson  * are permitted provided that this entire comment appears intact.
123d903220SDoug Rabson  *
133d903220SDoug Rabson  * Redistribution in binary form may occur without any restrictions.
143d903220SDoug Rabson  * Obviously, it would be nice if you gave credit where credit is due
153d903220SDoug Rabson  * but requiring it would be too onerous.
163d903220SDoug Rabson  *
173d903220SDoug Rabson  * This software is provided ``AS IS'' without any warranties of any kind.
183d903220SDoug Rabson  */
19e6a543f8SRobert Watson /*-
20e6a543f8SRobert Watson  * Copyright (c) 2003-2005 McAfee, Inc.
21e6a543f8SRobert Watson  * All rights reserved.
22e6a543f8SRobert Watson  *
23e6a543f8SRobert Watson  * This software was developed for the FreeBSD Project in part by McAfee
24e6a543f8SRobert Watson  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
25e6a543f8SRobert Watson  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
26e6a543f8SRobert Watson  * program.
27e6a543f8SRobert Watson  *
28e6a543f8SRobert Watson  * Redistribution and use in source and binary forms, with or without
29e6a543f8SRobert Watson  * modification, are permitted provided that the following conditions
30e6a543f8SRobert Watson  * are met:
31e6a543f8SRobert Watson  * 1. Redistributions of source code must retain the above copyright
32e6a543f8SRobert Watson  *    notice, this list of conditions and the following disclaimer.
33e6a543f8SRobert Watson  * 2. Redistributions in binary form must reproduce the above copyright
34e6a543f8SRobert Watson  *    notice, this list of conditions and the following disclaimer in the
35e6a543f8SRobert Watson  *    documentation and/or other materials provided with the distribution.
36e6a543f8SRobert Watson  *
37e6a543f8SRobert Watson  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
38e6a543f8SRobert Watson  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
39e6a543f8SRobert Watson  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
40e6a543f8SRobert Watson  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
41e6a543f8SRobert Watson  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
42e6a543f8SRobert Watson  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
43e6a543f8SRobert Watson  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44e6a543f8SRobert Watson  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
45e6a543f8SRobert Watson  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
46e6a543f8SRobert Watson  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47e6a543f8SRobert Watson  * SUCH DAMAGE.
48e6a543f8SRobert Watson  */
493d903220SDoug Rabson 
50677b542eSDavid E. O'Brien #include <sys/cdefs.h>
51677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$");
52677b542eSDavid E. O'Brien 
53ab063af9SPeter Wemm #include "opt_sysvipc.h"
54e6a543f8SRobert Watson #include "opt_mac.h"
55ab063af9SPeter Wemm 
563d903220SDoug Rabson #include <sys/param.h>
573d903220SDoug Rabson #include <sys/systm.h>
58725db531SBruce Evans #include <sys/sysproto.h>
593d903220SDoug Rabson #include <sys/kernel.h>
603d903220SDoug Rabson #include <sys/proc.h>
61b6a4b4f9SMatthew Dillon #include <sys/lock.h>
62e6a543f8SRobert Watson #include <sys/mac.h>
63b6a4b4f9SMatthew Dillon #include <sys/mutex.h>
6477409fe1SPoul-Henning Kamp #include <sys/module.h>
653d903220SDoug Rabson #include <sys/msg.h>
6678525ce3SAlfred Perlstein #include <sys/syscall.h>
67f4b6eb04SMaxim Sobolev #include <sys/syscallsubr.h>
68725db531SBruce Evans #include <sys/sysent.h>
69ab063af9SPeter Wemm #include <sys/sysctl.h>
70ab063af9SPeter Wemm #include <sys/malloc.h>
71cb1f0db9SRobert Watson #include <sys/jail.h>
72ab063af9SPeter Wemm 
73ab063af9SPeter Wemm static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues");
743d903220SDoug Rabson 
754d77a549SAlfred Perlstein static void msginit(void);
764d77a549SAlfred Perlstein static int msgunload(void);
774d77a549SAlfred Perlstein static int sysvmsg_modload(struct module *, int, void *);
782b14f991SJulian Elischer 
79fd6d9be4SAlfred Perlstein #ifdef MSG_DEBUG
80fd6d9be4SAlfred Perlstein #define DPRINTF(a)	printf a
81fd6d9be4SAlfred Perlstein #else
82fd6d9be4SAlfred Perlstein #define DPRINTF(a)
83fd6d9be4SAlfred Perlstein #endif
84e6a543f8SRobert Watson #ifdef MAC_DEBUG
85e6a543f8SRobert Watson #define MPRINTF(a)	printf a
86e6a543f8SRobert Watson #else
87e6a543f8SRobert Watson #define MPRINTF(a)
88e6a543f8SRobert Watson #endif
893d903220SDoug Rabson 
904d77a549SAlfred Perlstein static void msg_freehdr(struct msg *msghdr);
913d903220SDoug Rabson 
92725db531SBruce Evans /* XXX casting to (sy_call_t *) is bogus, as usual. */
9387b6de2bSPoul-Henning Kamp static sy_call_t *msgcalls[] = {
94725db531SBruce Evans 	(sy_call_t *)msgctl, (sy_call_t *)msgget,
95725db531SBruce Evans 	(sy_call_t *)msgsnd, (sy_call_t *)msgrcv
96725db531SBruce Evans };
973d903220SDoug Rabson 
98ab063af9SPeter Wemm #ifndef MSGSSZ
99ab063af9SPeter Wemm #define MSGSSZ	8		/* Each segment must be 2^N long */
100ab063af9SPeter Wemm #endif
101ab063af9SPeter Wemm #ifndef MSGSEG
102ab063af9SPeter Wemm #define MSGSEG	2048		/* must be less than 32767 */
103ab063af9SPeter Wemm #endif
104ab063af9SPeter Wemm #define MSGMAX	(MSGSSZ*MSGSEG)
105ab063af9SPeter Wemm #ifndef MSGMNB
106ab063af9SPeter Wemm #define MSGMNB	2048		/* max # of bytes in a queue */
107ab063af9SPeter Wemm #endif
108ab063af9SPeter Wemm #ifndef MSGMNI
109ab063af9SPeter Wemm #define MSGMNI	40
110ab063af9SPeter Wemm #endif
111ab063af9SPeter Wemm #ifndef MSGTQL
112ab063af9SPeter Wemm #define MSGTQL	40
113ab063af9SPeter Wemm #endif
114ab063af9SPeter Wemm 
115ab063af9SPeter Wemm /*
116ab063af9SPeter Wemm  * Based on the configuration parameters described in an SVR2 (yes, two)
117ab063af9SPeter Wemm  * config(1m) man page.
118ab063af9SPeter Wemm  *
119ab063af9SPeter Wemm  * Each message is broken up and stored in segments that are msgssz bytes
120ab063af9SPeter Wemm  * long.  For efficiency reasons, this should be a power of two.  Also,
121ab063af9SPeter Wemm  * it doesn't make sense if it is less than 8 or greater than about 256.
122ab063af9SPeter Wemm  * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of
123ab063af9SPeter Wemm  * two between 8 and 1024 inclusive (and panic's if it isn't).
124ab063af9SPeter Wemm  */
125ab063af9SPeter Wemm struct msginfo msginfo = {
126ab063af9SPeter Wemm                 MSGMAX,         /* max chars in a message */
127ab063af9SPeter Wemm                 MSGMNI,         /* # of message queue identifiers */
128ab063af9SPeter Wemm                 MSGMNB,         /* max chars in a queue */
129ab063af9SPeter Wemm                 MSGTQL,         /* max messages in system */
130ab063af9SPeter Wemm                 MSGSSZ,         /* size of a message segment */
131ab063af9SPeter Wemm                 		/* (must be small power of 2 greater than 4) */
132ab063af9SPeter Wemm                 MSGSEG          /* number of message segments */
133ab063af9SPeter Wemm };
134ab063af9SPeter Wemm 
135ab063af9SPeter Wemm /*
136ab063af9SPeter Wemm  * macros to convert between msqid_ds's and msqid's.
137ab063af9SPeter Wemm  * (specific to this implementation)
138ab063af9SPeter Wemm  */
139ab063af9SPeter Wemm #define MSQID(ix,ds)	((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000))
140ab063af9SPeter Wemm #define MSQID_IX(id)	((id) & 0xffff)
141ab063af9SPeter Wemm #define MSQID_SEQ(id)	(((id) >> 16) & 0xffff)
142ab063af9SPeter Wemm 
143ab063af9SPeter Wemm /*
144ab063af9SPeter Wemm  * The rest of this file is specific to this particular implementation.
145ab063af9SPeter Wemm  */
146ab063af9SPeter Wemm 
147ab063af9SPeter Wemm struct msgmap {
148ab063af9SPeter Wemm 	short	next;		/* next segment in buffer */
149ab063af9SPeter Wemm     				/* -1 -> available */
150ab063af9SPeter Wemm     				/* 0..(MSGSEG-1) -> index of next segment */
151ab063af9SPeter Wemm };
152ab063af9SPeter Wemm 
153ab063af9SPeter Wemm #define MSG_LOCKED	01000	/* Is this msqid_ds locked? */
154ab063af9SPeter Wemm 
15587b6de2bSPoul-Henning Kamp static int nfree_msgmaps;	/* # of free map entries */
15687b6de2bSPoul-Henning Kamp static short free_msgmaps;	/* head of linked list of free map entries */
15787b6de2bSPoul-Henning Kamp static struct msg *free_msghdrs;/* list of free msg headers */
158ab063af9SPeter Wemm static char *msgpool;		/* MSGMAX byte long msg buffer pool */
159ab063af9SPeter Wemm static struct msgmap *msgmaps;	/* MSGSEG msgmap structures */
160ab063af9SPeter Wemm static struct msg *msghdrs;	/* MSGTQL msg headers */
161921d05b9SRobert Watson static struct msqid_kernel *msqids;	/* MSGMNI msqid_kernel struct's */
1624b6ef3a1SAlfred Perlstein static struct mtx msq_mtx;	/* global mutex for message queues. */
1633d903220SDoug Rabson 
164ab063af9SPeter Wemm static void
16578525ce3SAlfred Perlstein msginit()
1663d903220SDoug Rabson {
1673d903220SDoug Rabson 	register int i;
1683d903220SDoug Rabson 
169896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg);
170896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz);
171896de692SMichael Reifenberger 	msginfo.msgmax = msginfo.msgseg * msginfo.msgssz;
172896de692SMichael Reifenberger 	TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni);
173b36aab85SRobert Watson 	TUNABLE_INT_FETCH("kern.ipc.msgmnb", &msginfo.msgmnb);
174b36aab85SRobert Watson 	TUNABLE_INT_FETCH("kern.ipc.msgtql", &msginfo.msgtql);
175896de692SMichael Reifenberger 
176a163d034SWarner Losh 	msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK);
177ab063af9SPeter Wemm 	if (msgpool == NULL)
178ab063af9SPeter Wemm 		panic("msgpool is NULL");
179a163d034SWarner Losh 	msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK);
180ab063af9SPeter Wemm 	if (msgmaps == NULL)
181ab063af9SPeter Wemm 		panic("msgmaps is NULL");
182a163d034SWarner Losh 	msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK);
183ab063af9SPeter Wemm 	if (msghdrs == NULL)
184ab063af9SPeter Wemm 		panic("msghdrs is NULL");
185921d05b9SRobert Watson 	msqids = malloc(sizeof(struct msqid_kernel) * msginfo.msgmni, M_MSG,
186921d05b9SRobert Watson 	    M_WAITOK);
187ab063af9SPeter Wemm 	if (msqids == NULL)
188ab063af9SPeter Wemm 		panic("msqids is NULL");
189ab063af9SPeter Wemm 
1903d903220SDoug Rabson 	/*
1913d903220SDoug Rabson 	 * msginfo.msgssz should be a power of two for efficiency reasons.
1923d903220SDoug Rabson 	 * It is also pretty silly if msginfo.msgssz is less than 8
1933d903220SDoug Rabson 	 * or greater than about 256 so ...
1943d903220SDoug Rabson 	 */
1953d903220SDoug Rabson 
1963d903220SDoug Rabson 	i = 8;
1973d903220SDoug Rabson 	while (i < 1024 && i != msginfo.msgssz)
1983d903220SDoug Rabson 		i <<= 1;
1993d903220SDoug Rabson     	if (i != msginfo.msgssz) {
200fd6d9be4SAlfred Perlstein 		DPRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz,
201fd6d9be4SAlfred Perlstein 		    msginfo.msgssz));
2023d903220SDoug Rabson 		panic("msginfo.msgssz not a small power of 2");
2033d903220SDoug Rabson 	}
2043d903220SDoug Rabson 
2053d903220SDoug Rabson 	if (msginfo.msgseg > 32767) {
206fd6d9be4SAlfred Perlstein 		DPRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg));
2073d903220SDoug Rabson 		panic("msginfo.msgseg > 32767");
2083d903220SDoug Rabson 	}
2093d903220SDoug Rabson 
2103d903220SDoug Rabson 	if (msgmaps == NULL)
2113d903220SDoug Rabson 		panic("msgmaps is NULL");
2123d903220SDoug Rabson 
2133d903220SDoug Rabson 	for (i = 0; i < msginfo.msgseg; i++) {
2143d903220SDoug Rabson 		if (i > 0)
2153d903220SDoug Rabson 			msgmaps[i-1].next = i;
2163d903220SDoug Rabson 		msgmaps[i].next = -1;	/* implies entry is available */
2173d903220SDoug Rabson 	}
2183d903220SDoug Rabson 	free_msgmaps = 0;
2193d903220SDoug Rabson 	nfree_msgmaps = msginfo.msgseg;
2203d903220SDoug Rabson 
2213d903220SDoug Rabson 	if (msghdrs == NULL)
2223d903220SDoug Rabson 		panic("msghdrs is NULL");
2233d903220SDoug Rabson 
2243d903220SDoug Rabson 	for (i = 0; i < msginfo.msgtql; i++) {
2253d903220SDoug Rabson 		msghdrs[i].msg_type = 0;
2263d903220SDoug Rabson 		if (i > 0)
2273d903220SDoug Rabson 			msghdrs[i-1].msg_next = &msghdrs[i];
2283d903220SDoug Rabson 		msghdrs[i].msg_next = NULL;
229e6a543f8SRobert Watson #ifdef MAC
230e6a543f8SRobert Watson 		mac_init_sysv_msgmsg(&msghdrs[i]);
231e6a543f8SRobert Watson #endif
2323d903220SDoug Rabson     	}
2333d903220SDoug Rabson 	free_msghdrs = &msghdrs[0];
2343d903220SDoug Rabson 
2353d903220SDoug Rabson 	if (msqids == NULL)
2363d903220SDoug Rabson 		panic("msqids is NULL");
2373d903220SDoug Rabson 
2383d903220SDoug Rabson 	for (i = 0; i < msginfo.msgmni; i++) {
239921d05b9SRobert Watson 		msqids[i].u.msg_qbytes = 0;	/* implies entry is available */
240921d05b9SRobert Watson 		msqids[i].u.msg_perm.seq = 0;	/* reset to a known value */
241921d05b9SRobert Watson 		msqids[i].u.msg_perm.mode = 0;
242e6a543f8SRobert Watson #ifdef MAC
243e6a543f8SRobert Watson 		mac_init_sysv_msgqueue(&msqids[i]);
244e6a543f8SRobert Watson #endif
2453d903220SDoug Rabson 	}
2464b6ef3a1SAlfred Perlstein 	mtx_init(&msq_mtx, "msq", NULL, MTX_DEF);
2473d903220SDoug Rabson }
24878525ce3SAlfred Perlstein 
24978525ce3SAlfred Perlstein static int
25078525ce3SAlfred Perlstein msgunload()
25178525ce3SAlfred Perlstein {
252921d05b9SRobert Watson 	struct msqid_kernel *msqkptr;
25378525ce3SAlfred Perlstein 	int msqid;
254e6a543f8SRobert Watson #ifdef MAC
255e6a543f8SRobert Watson 	int i;
256e6a543f8SRobert Watson #endif
25778525ce3SAlfred Perlstein 
25878525ce3SAlfred Perlstein 	for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
25978525ce3SAlfred Perlstein 		/*
26078525ce3SAlfred Perlstein 		 * Look for an unallocated and unlocked msqid_ds.
26178525ce3SAlfred Perlstein 		 * msqid_ds's can be locked by msgsnd or msgrcv while
26278525ce3SAlfred Perlstein 		 * they are copying the message in/out.  We can't
26378525ce3SAlfred Perlstein 		 * re-use the entry until they release it.
26478525ce3SAlfred Perlstein 		 */
265921d05b9SRobert Watson 		msqkptr = &msqids[msqid];
266921d05b9SRobert Watson 		if (msqkptr->u.msg_qbytes != 0 ||
267921d05b9SRobert Watson 		    (msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)
26878525ce3SAlfred Perlstein 			break;
26978525ce3SAlfred Perlstein 	}
27078525ce3SAlfred Perlstein 	if (msqid != msginfo.msgmni)
27178525ce3SAlfred Perlstein 		return (EBUSY);
27278525ce3SAlfred Perlstein 
273e6a543f8SRobert Watson #ifdef MAC
274e6a543f8SRobert Watson 	for (i = 0; i < msginfo.msgtql; i++)
275e6a543f8SRobert Watson 		mac_destroy_sysv_msgmsg(&msghdrs[i]);
276e6a543f8SRobert Watson 	for (msqid = 0; msqid < msginfo.msgmni; msqid++)
277e6a543f8SRobert Watson 		mac_destroy_sysv_msgqueue(&msqids[msqid]);
278e6a543f8SRobert Watson #endif
27978525ce3SAlfred Perlstein 	free(msgpool, M_MSG);
28078525ce3SAlfred Perlstein 	free(msgmaps, M_MSG);
28178525ce3SAlfred Perlstein 	free(msghdrs, M_MSG);
28278525ce3SAlfred Perlstein 	free(msqids, M_MSG);
2834b6ef3a1SAlfred Perlstein 	mtx_destroy(&msq_mtx);
28478525ce3SAlfred Perlstein 	return (0);
28578525ce3SAlfred Perlstein }
28678525ce3SAlfred Perlstein 
28778525ce3SAlfred Perlstein 
28878525ce3SAlfred Perlstein static int
28978525ce3SAlfred Perlstein sysvmsg_modload(struct module *module, int cmd, void *arg)
29078525ce3SAlfred Perlstein {
29178525ce3SAlfred Perlstein 	int error = 0;
29278525ce3SAlfred Perlstein 
29378525ce3SAlfred Perlstein 	switch (cmd) {
29478525ce3SAlfred Perlstein 	case MOD_LOAD:
29578525ce3SAlfred Perlstein 		msginit();
29678525ce3SAlfred Perlstein 		break;
29778525ce3SAlfred Perlstein 	case MOD_UNLOAD:
29878525ce3SAlfred Perlstein 		error = msgunload();
29978525ce3SAlfred Perlstein 		break;
30078525ce3SAlfred Perlstein 	case MOD_SHUTDOWN:
30178525ce3SAlfred Perlstein 		break;
30278525ce3SAlfred Perlstein 	default:
30378525ce3SAlfred Perlstein 		error = EINVAL;
30478525ce3SAlfred Perlstein 		break;
30578525ce3SAlfred Perlstein 	}
30678525ce3SAlfred Perlstein 	return (error);
30778525ce3SAlfred Perlstein }
30878525ce3SAlfred Perlstein 
309faa784b7SDag-Erling Smørgrav static moduledata_t sysvmsg_mod = {
310faa784b7SDag-Erling Smørgrav 	"sysvmsg",
31178525ce3SAlfred Perlstein 	&sysvmsg_modload,
31278525ce3SAlfred Perlstein 	NULL
31378525ce3SAlfred Perlstein };
31478525ce3SAlfred Perlstein 
31521d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgsys);
31621d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgctl);
31721d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgget);
31821d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgsnd);
31921d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgrcv);
32078525ce3SAlfred Perlstein 
321faa784b7SDag-Erling Smørgrav DECLARE_MODULE(sysvmsg, sysvmsg_mod,
32278525ce3SAlfred Perlstein 	SI_SUB_SYSV_MSG, SI_ORDER_FIRST);
323faa784b7SDag-Erling Smørgrav MODULE_VERSION(sysvmsg, 1);
3243d903220SDoug Rabson 
3253d903220SDoug Rabson /*
3263d903220SDoug Rabson  * Entry point for all MSG calls
327b6a4b4f9SMatthew Dillon  *
328b6a4b4f9SMatthew Dillon  * MPSAFE
3293d903220SDoug Rabson  */
3303d903220SDoug Rabson int
331b40ce416SJulian Elischer msgsys(td, uap)
332b40ce416SJulian Elischer 	struct thread *td;
333725db531SBruce Evans 	/* XXX actually varargs. */
334725db531SBruce Evans 	struct msgsys_args /* {
33501b9dc96SJacques Vidrine 		int	which;
336725db531SBruce Evans 		int	a2;
337725db531SBruce Evans 		int	a3;
338725db531SBruce Evans 		int	a4;
339725db531SBruce Evans 		int	a5;
340725db531SBruce Evans 		int	a6;
341725db531SBruce Evans 	} */ *uap;
3423d903220SDoug Rabson {
343b6a4b4f9SMatthew Dillon 	int error;
3443d903220SDoug Rabson 
345c6f55f33SJohn Baldwin 	if (!jail_sysvipc_allowed && jailed(td->td_ucred))
346c6f55f33SJohn Baldwin 		return (ENOSYS);
34701b9dc96SJacques Vidrine 	if (uap->which < 0 ||
34801b9dc96SJacques Vidrine 	    uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0]))
349c6f55f33SJohn Baldwin 		return (EINVAL);
350b40ce416SJulian Elischer 	error = (*msgcalls[uap->which])(td, &uap->a2);
351b6a4b4f9SMatthew Dillon 	return (error);
3523d903220SDoug Rabson }
3533d903220SDoug Rabson 
3543d903220SDoug Rabson static void
3553d903220SDoug Rabson msg_freehdr(msghdr)
3563d903220SDoug Rabson 	struct msg *msghdr;
3573d903220SDoug Rabson {
3583d903220SDoug Rabson 	while (msghdr->msg_ts > 0) {
3593d903220SDoug Rabson 		short next;
3603d903220SDoug Rabson 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)
3613d903220SDoug Rabson 			panic("msghdr->msg_spot out of range");
3623d903220SDoug Rabson 		next = msgmaps[msghdr->msg_spot].next;
3633d903220SDoug Rabson 		msgmaps[msghdr->msg_spot].next = free_msgmaps;
3643d903220SDoug Rabson 		free_msgmaps = msghdr->msg_spot;
3653d903220SDoug Rabson 		nfree_msgmaps++;
3663d903220SDoug Rabson 		msghdr->msg_spot = next;
3673d903220SDoug Rabson 		if (msghdr->msg_ts >= msginfo.msgssz)
3683d903220SDoug Rabson 			msghdr->msg_ts -= msginfo.msgssz;
3693d903220SDoug Rabson 		else
3703d903220SDoug Rabson 			msghdr->msg_ts = 0;
3713d903220SDoug Rabson 	}
3723d903220SDoug Rabson 	if (msghdr->msg_spot != -1)
3733d903220SDoug Rabson 		panic("msghdr->msg_spot != -1");
3743d903220SDoug Rabson 	msghdr->msg_next = free_msghdrs;
3753d903220SDoug Rabson 	free_msghdrs = msghdr;
376e6a543f8SRobert Watson #ifdef MAC
377e6a543f8SRobert Watson 	mac_cleanup_sysv_msgmsg(msghdr);
378e6a543f8SRobert Watson #endif
3793d903220SDoug Rabson }
3803d903220SDoug Rabson 
381b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
3823d903220SDoug Rabson struct msgctl_args {
3833d903220SDoug Rabson 	int	msqid;
3843d903220SDoug Rabson 	int	cmd;
385b5d5c0c9SPeter Wemm 	struct	msqid_ds *buf;
3863d903220SDoug Rabson };
387b5d5c0c9SPeter Wemm #endif
3883d903220SDoug Rabson 
389b6a4b4f9SMatthew Dillon /*
390b6a4b4f9SMatthew Dillon  * MPSAFE
391b6a4b4f9SMatthew Dillon  */
392b5d5c0c9SPeter Wemm int
393b40ce416SJulian Elischer msgctl(td, uap)
394b40ce416SJulian Elischer 	struct thread *td;
3953d903220SDoug Rabson 	register struct msgctl_args *uap;
3963d903220SDoug Rabson {
3973d903220SDoug Rabson 	int msqid = uap->msqid;
3983d903220SDoug Rabson 	int cmd = uap->cmd;
3993d903220SDoug Rabson 	struct msqid_ds msqbuf;
400f4b6eb04SMaxim Sobolev 	struct msqid_ds *msqptr;
401f4b6eb04SMaxim Sobolev 	int error;
402f4b6eb04SMaxim Sobolev 
403f4b6eb04SMaxim Sobolev 	DPRINTF(("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, uap->buf));
404f4b6eb04SMaxim Sobolev 	if (cmd == IPC_SET &&
405f4b6eb04SMaxim Sobolev 	    (error = copyin(uap->buf, &msqbuf, sizeof(msqbuf))) != 0)
406f4b6eb04SMaxim Sobolev 		return (error);
407f4b6eb04SMaxim Sobolev 	error = kern_msgctl(td, msqid, cmd, &msqbuf, &msqptr);
408f4b6eb04SMaxim Sobolev 	if (cmd == IPC_STAT && error == 0)
409f4b6eb04SMaxim Sobolev 		error = copyout(msqptr, uap->buf, sizeof(struct msqid_ds));
410f4b6eb04SMaxim Sobolev 	return (error);
411f4b6eb04SMaxim Sobolev }
412f4b6eb04SMaxim Sobolev 
413f4b6eb04SMaxim Sobolev int
414f4b6eb04SMaxim Sobolev kern_msgctl(td, msqid, cmd, msqbuf, msqptr)
415f4b6eb04SMaxim Sobolev 	struct thread *td;
416f4b6eb04SMaxim Sobolev 	int msqid;
417f4b6eb04SMaxim Sobolev 	int cmd;
418f4b6eb04SMaxim Sobolev 	struct msqid_ds *msqbuf;
419f4b6eb04SMaxim Sobolev 	struct msqid_ds **msqptr;
420f4b6eb04SMaxim Sobolev {
421f4b6eb04SMaxim Sobolev 	int rval, error, msqix;
422921d05b9SRobert Watson 	register struct msqid_kernel *msqkptr;
4233d903220SDoug Rabson 
424c6f55f33SJohn Baldwin 	if (!jail_sysvipc_allowed && jailed(td->td_ucred))
425c6f55f33SJohn Baldwin 		return (ENOSYS);
426cb1f0db9SRobert Watson 
427f4b6eb04SMaxim Sobolev 	msqix = IPCID_TO_IX(msqid);
4283d903220SDoug Rabson 
429f4b6eb04SMaxim Sobolev 	if (msqix < 0 || msqix >= msginfo.msgmni) {
430f4b6eb04SMaxim Sobolev 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqix,
431fd6d9be4SAlfred Perlstein 		    msginfo.msgmni));
4324b6ef3a1SAlfred Perlstein 		return (EINVAL);
4333d903220SDoug Rabson 	}
4343d903220SDoug Rabson 
435f4b6eb04SMaxim Sobolev 	msqkptr = &msqids[msqix];
4363d903220SDoug Rabson 
4374b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
438921d05b9SRobert Watson 	if (msqkptr->u.msg_qbytes == 0) {
439fd6d9be4SAlfred Perlstein 		DPRINTF(("no such msqid\n"));
440b6a4b4f9SMatthew Dillon 		error = EINVAL;
441b6a4b4f9SMatthew Dillon 		goto done2;
4423d903220SDoug Rabson 	}
443f4b6eb04SMaxim Sobolev 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {
444fd6d9be4SAlfred Perlstein 		DPRINTF(("wrong sequence number\n"));
445b6a4b4f9SMatthew Dillon 		error = EINVAL;
446b6a4b4f9SMatthew Dillon 		goto done2;
4473d903220SDoug Rabson 	}
448e6a543f8SRobert Watson #ifdef MAC
449e6a543f8SRobert Watson 	error = mac_check_sysv_msqctl(td->td_ucred, msqkptr, cmd);
450e6a543f8SRobert Watson 	if (error != 0) {
451e6a543f8SRobert Watson 		MPRINTF(("mac_check_sysv_msqctl returned %d\n", error));
452e6a543f8SRobert Watson 		goto done2;
453e6a543f8SRobert Watson 	}
454e6a543f8SRobert Watson #endif
4553d903220SDoug Rabson 
456b6a4b4f9SMatthew Dillon 	error = 0;
4573d903220SDoug Rabson 	rval = 0;
4583d903220SDoug Rabson 
4593d903220SDoug Rabson 	switch (cmd) {
4603d903220SDoug Rabson 
4613d903220SDoug Rabson 	case IPC_RMID:
4623d903220SDoug Rabson 	{
4633d903220SDoug Rabson 		struct msg *msghdr;
464921d05b9SRobert Watson 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))
465b6a4b4f9SMatthew Dillon 			goto done2;
466921d05b9SRobert Watson 
467e6a543f8SRobert Watson #ifdef MAC
468e6a543f8SRobert Watson 		/*
469e6a543f8SRobert Watson 		 * Check that the thread has MAC access permissions to
470e6a543f8SRobert Watson 		 * individual msghdrs.  Note: We need to do this in a
471e6a543f8SRobert Watson 		 * separate loop because the actual loop alters the
472e6a543f8SRobert Watson 		 * msq/msghdr info as it progresses, and there is no going
473e6a543f8SRobert Watson 		 * back if half the way through we discover that the
474e6a543f8SRobert Watson 		 * thread cannot free a certain msghdr.  The msq will get
475e6a543f8SRobert Watson 		 * into an inconsistent state.
476e6a543f8SRobert Watson 		 */
477e6a543f8SRobert Watson 		for (msghdr = msqkptr->u.msg_first; msghdr != NULL;
478e6a543f8SRobert Watson 		    msghdr = msghdr->msg_next) {
479e6a543f8SRobert Watson 			error = mac_check_sysv_msgrmid(td->td_ucred, msghdr);
480e6a543f8SRobert Watson 			if (error != 0) {
481e6a543f8SRobert Watson 				MPRINTF(("mac_check_sysv_msgrmid returned %d\n",
482e6a543f8SRobert Watson 				    error));
483e6a543f8SRobert Watson 				goto done2;
484e6a543f8SRobert Watson 			}
485e6a543f8SRobert Watson 		}
486e6a543f8SRobert Watson #endif
487e6a543f8SRobert Watson 
4883d903220SDoug Rabson 		/* Free the message headers */
489921d05b9SRobert Watson 		msghdr = msqkptr->u.msg_first;
4903d903220SDoug Rabson 		while (msghdr != NULL) {
4913d903220SDoug Rabson 			struct msg *msghdr_tmp;
4923d903220SDoug Rabson 
4933d903220SDoug Rabson 			/* Free the segments of each message */
494921d05b9SRobert Watson 			msqkptr->u.msg_cbytes -= msghdr->msg_ts;
495921d05b9SRobert Watson 			msqkptr->u.msg_qnum--;
4963d903220SDoug Rabson 			msghdr_tmp = msghdr;
4973d903220SDoug Rabson 			msghdr = msghdr->msg_next;
4983d903220SDoug Rabson 			msg_freehdr(msghdr_tmp);
4993d903220SDoug Rabson 		}
5003d903220SDoug Rabson 
501921d05b9SRobert Watson 		if (msqkptr->u.msg_cbytes != 0)
5023d903220SDoug Rabson 			panic("msg_cbytes is screwed up");
503921d05b9SRobert Watson 		if (msqkptr->u.msg_qnum != 0)
5043d903220SDoug Rabson 			panic("msg_qnum is screwed up");
5053d903220SDoug Rabson 
506921d05b9SRobert Watson 		msqkptr->u.msg_qbytes = 0;	/* Mark it as free */
5073d903220SDoug Rabson 
508e6a543f8SRobert Watson #ifdef MAC
509e6a543f8SRobert Watson 		mac_cleanup_sysv_msgqueue(msqkptr);
510e6a543f8SRobert Watson #endif
511e6a543f8SRobert Watson 
512921d05b9SRobert Watson 		wakeup(msqkptr);
5133d903220SDoug Rabson 	}
5143d903220SDoug Rabson 
5153d903220SDoug Rabson 		break;
5163d903220SDoug Rabson 
5173d903220SDoug Rabson 	case IPC_SET:
518921d05b9SRobert Watson 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))
519b6a4b4f9SMatthew Dillon 			goto done2;
520f4b6eb04SMaxim Sobolev 		if (msqbuf->msg_qbytes > msqkptr->u.msg_qbytes) {
52144731cabSJohn Baldwin 			error = suser(td);
522b6a4b4f9SMatthew Dillon 			if (error)
523b6a4b4f9SMatthew Dillon 				goto done2;
52457c90d6fSPoul-Henning Kamp 		}
525f4b6eb04SMaxim Sobolev 		if (msqbuf->msg_qbytes > msginfo.msgmnb) {
526fd6d9be4SAlfred Perlstein 			DPRINTF(("can't increase msg_qbytes beyond %d"
527fd6d9be4SAlfred Perlstein 			    "(truncating)\n", msginfo.msgmnb));
528f4b6eb04SMaxim Sobolev 			msqbuf->msg_qbytes = msginfo.msgmnb;	/* silently restrict qbytes to system limit */
5293d903220SDoug Rabson 		}
530f4b6eb04SMaxim Sobolev 		if (msqbuf->msg_qbytes == 0) {
531fd6d9be4SAlfred Perlstein 			DPRINTF(("can't reduce msg_qbytes to 0\n"));
532b6a4b4f9SMatthew Dillon 			error = EINVAL;		/* non-standard errno! */
533b6a4b4f9SMatthew Dillon 			goto done2;
5343d903220SDoug Rabson 		}
535f4b6eb04SMaxim Sobolev 		msqkptr->u.msg_perm.uid = msqbuf->msg_perm.uid;	/* change the owner */
536f4b6eb04SMaxim Sobolev 		msqkptr->u.msg_perm.gid = msqbuf->msg_perm.gid;	/* change the owner */
537921d05b9SRobert Watson 		msqkptr->u.msg_perm.mode = (msqkptr->u.msg_perm.mode & ~0777) |
538f4b6eb04SMaxim Sobolev 		    (msqbuf->msg_perm.mode & 0777);
539f4b6eb04SMaxim Sobolev 		msqkptr->u.msg_qbytes = msqbuf->msg_qbytes;
540921d05b9SRobert Watson 		msqkptr->u.msg_ctime = time_second;
5413d903220SDoug Rabson 		break;
5423d903220SDoug Rabson 
5433d903220SDoug Rabson 	case IPC_STAT:
544921d05b9SRobert Watson 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {
545fd6d9be4SAlfred Perlstein 			DPRINTF(("requester doesn't have read access\n"));
546b6a4b4f9SMatthew Dillon 			goto done2;
5473d903220SDoug Rabson 		}
548f4b6eb04SMaxim Sobolev 		*msqptr = &(msqkptr->u);
5493d903220SDoug Rabson 		break;
5503d903220SDoug Rabson 
5513d903220SDoug Rabson 	default:
552fd6d9be4SAlfred Perlstein 		DPRINTF(("invalid command %d\n", cmd));
553b6a4b4f9SMatthew Dillon 		error = EINVAL;
554b6a4b4f9SMatthew Dillon 		goto done2;
5553d903220SDoug Rabson 	}
5563d903220SDoug Rabson 
557b6a4b4f9SMatthew Dillon 	if (error == 0)
558b40ce416SJulian Elischer 		td->td_retval[0] = rval;
559b6a4b4f9SMatthew Dillon done2:
5604b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
561b6a4b4f9SMatthew Dillon 	return(error);
5623d903220SDoug Rabson }
5633d903220SDoug Rabson 
564b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
5653d903220SDoug Rabson struct msgget_args {
5663d903220SDoug Rabson 	key_t	key;
5673d903220SDoug Rabson 	int	msgflg;
5683d903220SDoug Rabson };
569b5d5c0c9SPeter Wemm #endif
5703d903220SDoug Rabson 
571b6a4b4f9SMatthew Dillon /*
572b6a4b4f9SMatthew Dillon  * MPSAFE
573b6a4b4f9SMatthew Dillon  */
574b5d5c0c9SPeter Wemm int
575b40ce416SJulian Elischer msgget(td, uap)
576b40ce416SJulian Elischer 	struct thread *td;
5773d903220SDoug Rabson 	register struct msgget_args *uap;
5783d903220SDoug Rabson {
579b6a4b4f9SMatthew Dillon 	int msqid, error = 0;
5803d903220SDoug Rabson 	int key = uap->key;
5813d903220SDoug Rabson 	int msgflg = uap->msgflg;
582c6f55f33SJohn Baldwin 	struct ucred *cred = td->td_ucred;
583921d05b9SRobert Watson 	register struct msqid_kernel *msqkptr = NULL;
5843d903220SDoug Rabson 
585fd6d9be4SAlfred Perlstein 	DPRINTF(("msgget(0x%x, 0%o)\n", key, msgflg));
5863d903220SDoug Rabson 
587c6f55f33SJohn Baldwin 	if (!jail_sysvipc_allowed && jailed(td->td_ucred))
588c6f55f33SJohn Baldwin 		return (ENOSYS);
589cb1f0db9SRobert Watson 
5904b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
5913d903220SDoug Rabson 	if (key != IPC_PRIVATE) {
5923d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
593921d05b9SRobert Watson 			msqkptr = &msqids[msqid];
594921d05b9SRobert Watson 			if (msqkptr->u.msg_qbytes != 0 &&
595921d05b9SRobert Watson 			    msqkptr->u.msg_perm.key == key)
5963d903220SDoug Rabson 				break;
5973d903220SDoug Rabson 		}
5983d903220SDoug Rabson 		if (msqid < msginfo.msgmni) {
599fd6d9be4SAlfred Perlstein 			DPRINTF(("found public key\n"));
6003d903220SDoug Rabson 			if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
601fd6d9be4SAlfred Perlstein 				DPRINTF(("not exclusive\n"));
602b6a4b4f9SMatthew Dillon 				error = EEXIST;
603b6a4b4f9SMatthew Dillon 				goto done2;
6043d903220SDoug Rabson 			}
605921d05b9SRobert Watson 			if ((error = ipcperm(td, &msqkptr->u.msg_perm,
606921d05b9SRobert Watson 			    msgflg & 0700))) {
607fd6d9be4SAlfred Perlstein 				DPRINTF(("requester doesn't have 0%o access\n",
608fd6d9be4SAlfred Perlstein 				    msgflg & 0700));
609b6a4b4f9SMatthew Dillon 				goto done2;
6103d903220SDoug Rabson 			}
611e6a543f8SRobert Watson #ifdef MAC
612e6a543f8SRobert Watson 			error = mac_check_sysv_msqget(cred, msqkptr);
613e6a543f8SRobert Watson 			if (error != 0) {
614e6a543f8SRobert Watson 				MPRINTF(("mac_check_sysv_msqget returned %d\n",
615e6a543f8SRobert Watson 				    error));
616e6a543f8SRobert Watson 				goto done2;
617e6a543f8SRobert Watson 			}
618e6a543f8SRobert Watson #endif
6193d903220SDoug Rabson 			goto found;
6203d903220SDoug Rabson 		}
6213d903220SDoug Rabson 	}
6223d903220SDoug Rabson 
623fd6d9be4SAlfred Perlstein 	DPRINTF(("need to allocate the msqid_ds\n"));
6243d903220SDoug Rabson 	if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
6253d903220SDoug Rabson 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
6263d903220SDoug Rabson 			/*
6273d903220SDoug Rabson 			 * Look for an unallocated and unlocked msqid_ds.
6283d903220SDoug Rabson 			 * msqid_ds's can be locked by msgsnd or msgrcv while
6293d903220SDoug Rabson 			 * they are copying the message in/out.  We can't
6303d903220SDoug Rabson 			 * re-use the entry until they release it.
6313d903220SDoug Rabson 			 */
632921d05b9SRobert Watson 			msqkptr = &msqids[msqid];
633921d05b9SRobert Watson 			if (msqkptr->u.msg_qbytes == 0 &&
634921d05b9SRobert Watson 			    (msqkptr->u.msg_perm.mode & MSG_LOCKED) == 0)
6353d903220SDoug Rabson 				break;
6363d903220SDoug Rabson 		}
6373d903220SDoug Rabson 		if (msqid == msginfo.msgmni) {
638fd6d9be4SAlfred Perlstein 			DPRINTF(("no more msqid_ds's available\n"));
639b6a4b4f9SMatthew Dillon 			error = ENOSPC;
640b6a4b4f9SMatthew Dillon 			goto done2;
6413d903220SDoug Rabson 		}
642fd6d9be4SAlfred Perlstein 		DPRINTF(("msqid %d is available\n", msqid));
643921d05b9SRobert Watson 		msqkptr->u.msg_perm.key = key;
644921d05b9SRobert Watson 		msqkptr->u.msg_perm.cuid = cred->cr_uid;
645921d05b9SRobert Watson 		msqkptr->u.msg_perm.uid = cred->cr_uid;
646921d05b9SRobert Watson 		msqkptr->u.msg_perm.cgid = cred->cr_gid;
647921d05b9SRobert Watson 		msqkptr->u.msg_perm.gid = cred->cr_gid;
648921d05b9SRobert Watson 		msqkptr->u.msg_perm.mode = (msgflg & 0777);
6493d903220SDoug Rabson 		/* Make sure that the returned msqid is unique */
650921d05b9SRobert Watson 		msqkptr->u.msg_perm.seq = (msqkptr->u.msg_perm.seq + 1) & 0x7fff;
651921d05b9SRobert Watson 		msqkptr->u.msg_first = NULL;
652921d05b9SRobert Watson 		msqkptr->u.msg_last = NULL;
653921d05b9SRobert Watson 		msqkptr->u.msg_cbytes = 0;
654921d05b9SRobert Watson 		msqkptr->u.msg_qnum = 0;
655921d05b9SRobert Watson 		msqkptr->u.msg_qbytes = msginfo.msgmnb;
656921d05b9SRobert Watson 		msqkptr->u.msg_lspid = 0;
657921d05b9SRobert Watson 		msqkptr->u.msg_lrpid = 0;
658921d05b9SRobert Watson 		msqkptr->u.msg_stime = 0;
659921d05b9SRobert Watson 		msqkptr->u.msg_rtime = 0;
660921d05b9SRobert Watson 		msqkptr->u.msg_ctime = time_second;
661e6a543f8SRobert Watson #ifdef MAC
662e6a543f8SRobert Watson 		mac_create_sysv_msgqueue(cred, msqkptr);
663e6a543f8SRobert Watson #endif
6643d903220SDoug Rabson 	} else {
665fd6d9be4SAlfred Perlstein 		DPRINTF(("didn't find it and wasn't asked to create it\n"));
666b6a4b4f9SMatthew Dillon 		error = ENOENT;
667b6a4b4f9SMatthew Dillon 		goto done2;
6683d903220SDoug Rabson 	}
6693d903220SDoug Rabson 
6703d903220SDoug Rabson found:
6713d903220SDoug Rabson 	/* Construct the unique msqid */
672921d05b9SRobert Watson 	td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqkptr->u.msg_perm);
673b6a4b4f9SMatthew Dillon done2:
6744b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
675b6a4b4f9SMatthew Dillon 	return (error);
6763d903220SDoug Rabson }
6773d903220SDoug Rabson 
678b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
6793d903220SDoug Rabson struct msgsnd_args {
6803d903220SDoug Rabson 	int	msqid;
681b17c9cfaSAlfred Perlstein 	const void	*msgp;
6823d903220SDoug Rabson 	size_t	msgsz;
6833d903220SDoug Rabson 	int	msgflg;
6843d903220SDoug Rabson };
685b5d5c0c9SPeter Wemm #endif
6863d903220SDoug Rabson 
687b6a4b4f9SMatthew Dillon /*
688b6a4b4f9SMatthew Dillon  * MPSAFE
689b6a4b4f9SMatthew Dillon  */
690b5d5c0c9SPeter Wemm int
691b40ce416SJulian Elischer msgsnd(td, uap)
692b40ce416SJulian Elischer 	struct thread *td;
6933d903220SDoug Rabson 	register struct msgsnd_args *uap;
6943d903220SDoug Rabson {
6953d903220SDoug Rabson 	int msqid = uap->msqid;
696b17c9cfaSAlfred Perlstein 	const void *user_msgp = uap->msgp;
6973d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
6983d903220SDoug Rabson 	int msgflg = uap->msgflg;
699b6a4b4f9SMatthew Dillon 	int segs_needed, error = 0;
700921d05b9SRobert Watson 	register struct msqid_kernel *msqkptr;
7013d903220SDoug Rabson 	register struct msg *msghdr;
7023d903220SDoug Rabson 	short next;
7033d903220SDoug Rabson 
704fd6d9be4SAlfred Perlstein 	DPRINTF(("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz,
705fd6d9be4SAlfred Perlstein 	    msgflg));
706c6f55f33SJohn Baldwin 	if (!jail_sysvipc_allowed && jailed(td->td_ucred))
707c6f55f33SJohn Baldwin 		return (ENOSYS);
708cb1f0db9SRobert Watson 
7094b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
7103d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
7113d903220SDoug Rabson 
7123d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
713fd6d9be4SAlfred Perlstein 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
714fd6d9be4SAlfred Perlstein 		    msginfo.msgmni));
715b6a4b4f9SMatthew Dillon 		error = EINVAL;
716b6a4b4f9SMatthew Dillon 		goto done2;
7173d903220SDoug Rabson 	}
7183d903220SDoug Rabson 
719921d05b9SRobert Watson 	msqkptr = &msqids[msqid];
720921d05b9SRobert Watson 	if (msqkptr->u.msg_qbytes == 0) {
721fd6d9be4SAlfred Perlstein 		DPRINTF(("no such message queue id\n"));
722b6a4b4f9SMatthew Dillon 		error = EINVAL;
723b6a4b4f9SMatthew Dillon 		goto done2;
7243d903220SDoug Rabson 	}
725921d05b9SRobert Watson 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
726fd6d9be4SAlfred Perlstein 		DPRINTF(("wrong sequence number\n"));
727b6a4b4f9SMatthew Dillon 		error = EINVAL;
728b6a4b4f9SMatthew Dillon 		goto done2;
7293d903220SDoug Rabson 	}
7303d903220SDoug Rabson 
731921d05b9SRobert Watson 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_W))) {
732fd6d9be4SAlfred Perlstein 		DPRINTF(("requester doesn't have write access\n"));
733b6a4b4f9SMatthew Dillon 		goto done2;
7343d903220SDoug Rabson 	}
7353d903220SDoug Rabson 
736e6a543f8SRobert Watson #ifdef MAC
737e6a543f8SRobert Watson 	error = mac_check_sysv_msqsnd(td->td_ucred, msqkptr);
738e6a543f8SRobert Watson 	if (error != 0) {
739e6a543f8SRobert Watson 		MPRINTF(("mac_check_sysv_msqsnd returned %d\n", error));
740e6a543f8SRobert Watson 		goto done2;
741e6a543f8SRobert Watson 	}
742e6a543f8SRobert Watson #endif
743e6a543f8SRobert Watson 
7443d903220SDoug Rabson 	segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
745fd6d9be4SAlfred Perlstein 	DPRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz,
746fd6d9be4SAlfred Perlstein 	    segs_needed));
7473d903220SDoug Rabson 	for (;;) {
7483d903220SDoug Rabson 		int need_more_resources = 0;
7493d903220SDoug Rabson 
7503d903220SDoug Rabson 		/*
7513d903220SDoug Rabson 		 * check msgsz
7523d903220SDoug Rabson 		 * (inside this loop in case msg_qbytes changes while we sleep)
7533d903220SDoug Rabson 		 */
7543d903220SDoug Rabson 
755921d05b9SRobert Watson 		if (msgsz > msqkptr->u.msg_qbytes) {
756921d05b9SRobert Watson 			DPRINTF(("msgsz > msqkptr->u.msg_qbytes\n"));
757b6a4b4f9SMatthew Dillon 			error = EINVAL;
758b6a4b4f9SMatthew Dillon 			goto done2;
7593d903220SDoug Rabson 		}
7603d903220SDoug Rabson 
761921d05b9SRobert Watson 		if (msqkptr->u.msg_perm.mode & MSG_LOCKED) {
762fd6d9be4SAlfred Perlstein 			DPRINTF(("msqid is locked\n"));
7633d903220SDoug Rabson 			need_more_resources = 1;
7643d903220SDoug Rabson 		}
765921d05b9SRobert Watson 		if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) {
766fd6d9be4SAlfred Perlstein 			DPRINTF(("msgsz + msg_cbytes > msg_qbytes\n"));
7673d903220SDoug Rabson 			need_more_resources = 1;
7683d903220SDoug Rabson 		}
7693d903220SDoug Rabson 		if (segs_needed > nfree_msgmaps) {
770fd6d9be4SAlfred Perlstein 			DPRINTF(("segs_needed > nfree_msgmaps\n"));
7713d903220SDoug Rabson 			need_more_resources = 1;
7723d903220SDoug Rabson 		}
7733d903220SDoug Rabson 		if (free_msghdrs == NULL) {
774fd6d9be4SAlfred Perlstein 			DPRINTF(("no more msghdrs\n"));
7753d903220SDoug Rabson 			need_more_resources = 1;
7763d903220SDoug Rabson 		}
7773d903220SDoug Rabson 
7783d903220SDoug Rabson 		if (need_more_resources) {
7793d903220SDoug Rabson 			int we_own_it;
7803d903220SDoug Rabson 
7813d903220SDoug Rabson 			if ((msgflg & IPC_NOWAIT) != 0) {
782fd6d9be4SAlfred Perlstein 				DPRINTF(("need more resources but caller "
783fd6d9be4SAlfred Perlstein 				    "doesn't want to wait\n"));
784b6a4b4f9SMatthew Dillon 				error = EAGAIN;
785b6a4b4f9SMatthew Dillon 				goto done2;
7863d903220SDoug Rabson 			}
7873d903220SDoug Rabson 
788921d05b9SRobert Watson 			if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) {
789fd6d9be4SAlfred Perlstein 				DPRINTF(("we don't own the msqid_ds\n"));
7903d903220SDoug Rabson 				we_own_it = 0;
7913d903220SDoug Rabson 			} else {
7923d903220SDoug Rabson 				/* Force later arrivals to wait for our
7933d903220SDoug Rabson 				   request */
794fd6d9be4SAlfred Perlstein 				DPRINTF(("we own the msqid_ds\n"));
795921d05b9SRobert Watson 				msqkptr->u.msg_perm.mode |= MSG_LOCKED;
7963d903220SDoug Rabson 				we_own_it = 1;
7973d903220SDoug Rabson 			}
798fd6d9be4SAlfred Perlstein 			DPRINTF(("goodnight\n"));
799921d05b9SRobert Watson 			error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,
8003d903220SDoug Rabson 			    "msgwait", 0);
801fd6d9be4SAlfred Perlstein 			DPRINTF(("good morning, error=%d\n", error));
8023d903220SDoug Rabson 			if (we_own_it)
803921d05b9SRobert Watson 				msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
804b6a4b4f9SMatthew Dillon 			if (error != 0) {
805fd6d9be4SAlfred Perlstein 				DPRINTF(("msgsnd:  interrupted system call\n"));
806b6a4b4f9SMatthew Dillon 				error = EINTR;
807b6a4b4f9SMatthew Dillon 				goto done2;
8083d903220SDoug Rabson 			}
8093d903220SDoug Rabson 
8103d903220SDoug Rabson 			/*
8113d903220SDoug Rabson 			 * Make sure that the msq queue still exists
8123d903220SDoug Rabson 			 */
8133d903220SDoug Rabson 
814921d05b9SRobert Watson 			if (msqkptr->u.msg_qbytes == 0) {
815fd6d9be4SAlfred Perlstein 				DPRINTF(("msqid deleted\n"));
816b6a4b4f9SMatthew Dillon 				error = EIDRM;
817b6a4b4f9SMatthew Dillon 				goto done2;
8183d903220SDoug Rabson 			}
8193d903220SDoug Rabson 
8203d903220SDoug Rabson 		} else {
821fd6d9be4SAlfred Perlstein 			DPRINTF(("got all the resources that we need\n"));
8223d903220SDoug Rabson 			break;
8233d903220SDoug Rabson 		}
8243d903220SDoug Rabson 	}
8253d903220SDoug Rabson 
8263d903220SDoug Rabson 	/*
8273d903220SDoug Rabson 	 * We have the resources that we need.
8283d903220SDoug Rabson 	 * Make sure!
8293d903220SDoug Rabson 	 */
8303d903220SDoug Rabson 
831921d05b9SRobert Watson 	if (msqkptr->u.msg_perm.mode & MSG_LOCKED)
8323d903220SDoug Rabson 		panic("msg_perm.mode & MSG_LOCKED");
8333d903220SDoug Rabson 	if (segs_needed > nfree_msgmaps)
8343d903220SDoug Rabson 		panic("segs_needed > nfree_msgmaps");
835921d05b9SRobert Watson 	if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes)
8363d903220SDoug Rabson 		panic("msgsz + msg_cbytes > msg_qbytes");
8373d903220SDoug Rabson 	if (free_msghdrs == NULL)
8383d903220SDoug Rabson 		panic("no more msghdrs");
8393d903220SDoug Rabson 
8403d903220SDoug Rabson 	/*
8413d903220SDoug Rabson 	 * Re-lock the msqid_ds in case we page-fault when copying in the
8423d903220SDoug Rabson 	 * message
8433d903220SDoug Rabson 	 */
8443d903220SDoug Rabson 
845921d05b9SRobert Watson 	if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)
8463d903220SDoug Rabson 		panic("msqid_ds is already locked");
847921d05b9SRobert Watson 	msqkptr->u.msg_perm.mode |= MSG_LOCKED;
8483d903220SDoug Rabson 
8493d903220SDoug Rabson 	/*
8503d903220SDoug Rabson 	 * Allocate a message header
8513d903220SDoug Rabson 	 */
8523d903220SDoug Rabson 
8533d903220SDoug Rabson 	msghdr = free_msghdrs;
8543d903220SDoug Rabson 	free_msghdrs = msghdr->msg_next;
8553d903220SDoug Rabson 	msghdr->msg_spot = -1;
8563d903220SDoug Rabson 	msghdr->msg_ts = msgsz;
857e6a543f8SRobert Watson #ifdef MAC
858e6a543f8SRobert Watson 	/*
859e6a543f8SRobert Watson 	 * XXXMAC: Should the mac_check_sysv_msgmsq check follow here
860e6a543f8SRobert Watson 	 * immediately?  Or, should it be checked just before the msg is
861e6a543f8SRobert Watson 	 * enqueued in the msgq (as it is done now)?
862e6a543f8SRobert Watson 	 */
863e6a543f8SRobert Watson 	mac_create_sysv_msgmsg(td->td_ucred, msqkptr, msghdr);
864e6a543f8SRobert Watson #endif
8653d903220SDoug Rabson 
8663d903220SDoug Rabson 	/*
8673d903220SDoug Rabson 	 * Allocate space for the message
8683d903220SDoug Rabson 	 */
8693d903220SDoug Rabson 
8703d903220SDoug Rabson 	while (segs_needed > 0) {
8713d903220SDoug Rabson 		if (nfree_msgmaps <= 0)
8723d903220SDoug Rabson 			panic("not enough msgmaps");
8733d903220SDoug Rabson 		if (free_msgmaps == -1)
8743d903220SDoug Rabson 			panic("nil free_msgmaps");
8753d903220SDoug Rabson 		next = free_msgmaps;
8763d903220SDoug Rabson 		if (next <= -1)
8773d903220SDoug Rabson 			panic("next too low #1");
8783d903220SDoug Rabson 		if (next >= msginfo.msgseg)
8793d903220SDoug Rabson 			panic("next out of range #1");
880fd6d9be4SAlfred Perlstein 		DPRINTF(("allocating segment %d to message\n", next));
8813d903220SDoug Rabson 		free_msgmaps = msgmaps[next].next;
8823d903220SDoug Rabson 		nfree_msgmaps--;
8833d903220SDoug Rabson 		msgmaps[next].next = msghdr->msg_spot;
8843d903220SDoug Rabson 		msghdr->msg_spot = next;
8853d903220SDoug Rabson 		segs_needed--;
8863d903220SDoug Rabson 	}
8873d903220SDoug Rabson 
8883d903220SDoug Rabson 	/*
8893d903220SDoug Rabson 	 * Copy in the message type
8903d903220SDoug Rabson 	 */
8913d903220SDoug Rabson 
8924b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
893b6a4b4f9SMatthew Dillon 	if ((error = copyin(user_msgp, &msghdr->msg_type,
8943d903220SDoug Rabson 	    sizeof(msghdr->msg_type))) != 0) {
8954b6ef3a1SAlfred Perlstein 		mtx_lock(&msq_mtx);
896fd6d9be4SAlfred Perlstein 		DPRINTF(("error %d copying the message type\n", error));
8973d903220SDoug Rabson 		msg_freehdr(msghdr);
898921d05b9SRobert Watson 		msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
899921d05b9SRobert Watson 		wakeup(msqkptr);
900b6a4b4f9SMatthew Dillon 		goto done2;
9013d903220SDoug Rabson 	}
9024b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
903ca315837SAlfred Perlstein 	user_msgp = (const char *)user_msgp + sizeof(msghdr->msg_type);
9043d903220SDoug Rabson 
9053d903220SDoug Rabson 	/*
9063d903220SDoug Rabson 	 * Validate the message type
9073d903220SDoug Rabson 	 */
9083d903220SDoug Rabson 
9093d903220SDoug Rabson 	if (msghdr->msg_type < 1) {
9103d903220SDoug Rabson 		msg_freehdr(msghdr);
911921d05b9SRobert Watson 		msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
912921d05b9SRobert Watson 		wakeup(msqkptr);
913fd6d9be4SAlfred Perlstein 		DPRINTF(("mtype (%d) < 1\n", msghdr->msg_type));
914b6a4b4f9SMatthew Dillon 		error = EINVAL;
915b6a4b4f9SMatthew Dillon 		goto done2;
9163d903220SDoug Rabson 	}
9173d903220SDoug Rabson 
9183d903220SDoug Rabson 	/*
9193d903220SDoug Rabson 	 * Copy in the message body
9203d903220SDoug Rabson 	 */
9213d903220SDoug Rabson 
9223d903220SDoug Rabson 	next = msghdr->msg_spot;
9233d903220SDoug Rabson 	while (msgsz > 0) {
9243d903220SDoug Rabson 		size_t tlen;
9253d903220SDoug Rabson 		if (msgsz > msginfo.msgssz)
9263d903220SDoug Rabson 			tlen = msginfo.msgssz;
9273d903220SDoug Rabson 		else
9283d903220SDoug Rabson 			tlen = msgsz;
9293d903220SDoug Rabson 		if (next <= -1)
9303d903220SDoug Rabson 			panic("next too low #2");
9313d903220SDoug Rabson 		if (next >= msginfo.msgseg)
9323d903220SDoug Rabson 			panic("next out of range #2");
9334b6ef3a1SAlfred Perlstein 		mtx_unlock(&msq_mtx);
934b6a4b4f9SMatthew Dillon 		if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz],
9353d903220SDoug Rabson 		    tlen)) != 0) {
9364b6ef3a1SAlfred Perlstein 			mtx_lock(&msq_mtx);
937fd6d9be4SAlfred Perlstein 			DPRINTF(("error %d copying in message segment\n",
938fd6d9be4SAlfred Perlstein 			    error));
9393d903220SDoug Rabson 			msg_freehdr(msghdr);
940921d05b9SRobert Watson 			msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
941921d05b9SRobert Watson 			wakeup(msqkptr);
942b6a4b4f9SMatthew Dillon 			goto done2;
9433d903220SDoug Rabson 		}
9444b6ef3a1SAlfred Perlstein 		mtx_lock(&msq_mtx);
9453d903220SDoug Rabson 		msgsz -= tlen;
946ca315837SAlfred Perlstein 		user_msgp = (const char *)user_msgp + tlen;
9473d903220SDoug Rabson 		next = msgmaps[next].next;
9483d903220SDoug Rabson 	}
9493d903220SDoug Rabson 	if (next != -1)
9503d903220SDoug Rabson 		panic("didn't use all the msg segments");
9513d903220SDoug Rabson 
9523d903220SDoug Rabson 	/*
9533d903220SDoug Rabson 	 * We've got the message.  Unlock the msqid_ds.
9543d903220SDoug Rabson 	 */
9553d903220SDoug Rabson 
956921d05b9SRobert Watson 	msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
9573d903220SDoug Rabson 
9583d903220SDoug Rabson 	/*
9593d903220SDoug Rabson 	 * Make sure that the msqid_ds is still allocated.
9603d903220SDoug Rabson 	 */
9613d903220SDoug Rabson 
962921d05b9SRobert Watson 	if (msqkptr->u.msg_qbytes == 0) {
9633d903220SDoug Rabson 		msg_freehdr(msghdr);
964921d05b9SRobert Watson 		wakeup(msqkptr);
965b6a4b4f9SMatthew Dillon 		error = EIDRM;
966b6a4b4f9SMatthew Dillon 		goto done2;
9673d903220SDoug Rabson 	}
9683d903220SDoug Rabson 
969e6a543f8SRobert Watson #ifdef MAC
970e6a543f8SRobert Watson 	/*
971e6a543f8SRobert Watson 	 * Note: Since the task/thread allocates the msghdr and usually
972e6a543f8SRobert Watson 	 * primes it with its own MAC label, for a majority of policies, it
973e6a543f8SRobert Watson 	 * won't be necessary to check whether the msghdr has access
974e6a543f8SRobert Watson 	 * permissions to the msgq.  The mac_check_sysv_msqsnd check would
975e6a543f8SRobert Watson 	 * suffice in that case.  However, this hook may be required where
976e6a543f8SRobert Watson 	 * individual policies derive a non-identical label for the msghdr
977e6a543f8SRobert Watson 	 * from the current thread label and may want to check the msghdr
978e6a543f8SRobert Watson 	 * enqueue permissions, along with read/write permissions to the
979e6a543f8SRobert Watson 	 * msgq.
980e6a543f8SRobert Watson 	 */
981e6a543f8SRobert Watson 	error = mac_check_sysv_msgmsq(td->td_ucred, msghdr, msqkptr);
982e6a543f8SRobert Watson 	if (error != 0) {
983e6a543f8SRobert Watson 		MPRINTF(("mac_check_sysv_msqmsq returned %d\n", error));
984e6a543f8SRobert Watson 		msg_freehdr(msghdr);
985e6a543f8SRobert Watson 		wakeup(msqkptr);
986e6a543f8SRobert Watson 		goto done2;
987e6a543f8SRobert Watson 	}
988e6a543f8SRobert Watson #endif
989e6a543f8SRobert Watson 
9903d903220SDoug Rabson 	/*
9913d903220SDoug Rabson 	 * Put the message into the queue
9923d903220SDoug Rabson 	 */
993921d05b9SRobert Watson 	if (msqkptr->u.msg_first == NULL) {
994921d05b9SRobert Watson 		msqkptr->u.msg_first = msghdr;
995921d05b9SRobert Watson 		msqkptr->u.msg_last = msghdr;
9963d903220SDoug Rabson 	} else {
997921d05b9SRobert Watson 		msqkptr->u.msg_last->msg_next = msghdr;
998921d05b9SRobert Watson 		msqkptr->u.msg_last = msghdr;
9993d903220SDoug Rabson 	}
1000921d05b9SRobert Watson 	msqkptr->u.msg_last->msg_next = NULL;
10013d903220SDoug Rabson 
1002921d05b9SRobert Watson 	msqkptr->u.msg_cbytes += msghdr->msg_ts;
1003921d05b9SRobert Watson 	msqkptr->u.msg_qnum++;
1004921d05b9SRobert Watson 	msqkptr->u.msg_lspid = td->td_proc->p_pid;
1005921d05b9SRobert Watson 	msqkptr->u.msg_stime = time_second;
10063d903220SDoug Rabson 
1007921d05b9SRobert Watson 	wakeup(msqkptr);
1008b40ce416SJulian Elischer 	td->td_retval[0] = 0;
1009b6a4b4f9SMatthew Dillon done2:
10104b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
1011b6a4b4f9SMatthew Dillon 	return (error);
10123d903220SDoug Rabson }
10133d903220SDoug Rabson 
1014b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_
10153d903220SDoug Rabson struct msgrcv_args {
10163d903220SDoug Rabson 	int	msqid;
10173d903220SDoug Rabson 	void	*msgp;
10183d903220SDoug Rabson 	size_t	msgsz;
10193d903220SDoug Rabson 	long	msgtyp;
10203d903220SDoug Rabson 	int	msgflg;
10213d903220SDoug Rabson };
1022b5d5c0c9SPeter Wemm #endif
10233d903220SDoug Rabson 
1024b6a4b4f9SMatthew Dillon /*
1025b6a4b4f9SMatthew Dillon  * MPSAFE
1026b6a4b4f9SMatthew Dillon  */
1027b5d5c0c9SPeter Wemm int
1028b40ce416SJulian Elischer msgrcv(td, uap)
1029b40ce416SJulian Elischer 	struct thread *td;
10303d903220SDoug Rabson 	register struct msgrcv_args *uap;
10313d903220SDoug Rabson {
10323d903220SDoug Rabson 	int msqid = uap->msqid;
10333d903220SDoug Rabson 	void *user_msgp = uap->msgp;
10343d903220SDoug Rabson 	size_t msgsz = uap->msgsz;
10353d903220SDoug Rabson 	long msgtyp = uap->msgtyp;
10363d903220SDoug Rabson 	int msgflg = uap->msgflg;
10373d903220SDoug Rabson 	size_t len;
1038921d05b9SRobert Watson 	register struct msqid_kernel *msqkptr;
10393d903220SDoug Rabson 	register struct msg *msghdr;
1040b6a4b4f9SMatthew Dillon 	int error = 0;
10413d903220SDoug Rabson 	short next;
10423d903220SDoug Rabson 
1043fd6d9be4SAlfred Perlstein 	DPRINTF(("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp,
1044fd6d9be4SAlfred Perlstein 	    msgsz, msgtyp, msgflg));
10453d903220SDoug Rabson 
1046c6f55f33SJohn Baldwin 	if (!jail_sysvipc_allowed && jailed(td->td_ucred))
1047c6f55f33SJohn Baldwin 		return (ENOSYS);
1048cb1f0db9SRobert Watson 
10493d903220SDoug Rabson 	msqid = IPCID_TO_IX(msqid);
10503d903220SDoug Rabson 
10513d903220SDoug Rabson 	if (msqid < 0 || msqid >= msginfo.msgmni) {
1052fd6d9be4SAlfred Perlstein 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
1053fd6d9be4SAlfred Perlstein 		    msginfo.msgmni));
10544b6ef3a1SAlfred Perlstein 		return (EINVAL);
10553d903220SDoug Rabson 	}
10563d903220SDoug Rabson 
1057921d05b9SRobert Watson 	msqkptr = &msqids[msqid];
10584b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
1059921d05b9SRobert Watson 	if (msqkptr->u.msg_qbytes == 0) {
1060fd6d9be4SAlfred Perlstein 		DPRINTF(("no such message queue id\n"));
1061b6a4b4f9SMatthew Dillon 		error = EINVAL;
1062b6a4b4f9SMatthew Dillon 		goto done2;
10633d903220SDoug Rabson 	}
1064921d05b9SRobert Watson 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
1065fd6d9be4SAlfred Perlstein 		DPRINTF(("wrong sequence number\n"));
1066b6a4b4f9SMatthew Dillon 		error = EINVAL;
1067b6a4b4f9SMatthew Dillon 		goto done2;
10683d903220SDoug Rabson 	}
10693d903220SDoug Rabson 
1070921d05b9SRobert Watson 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {
1071fd6d9be4SAlfred Perlstein 		DPRINTF(("requester doesn't have read access\n"));
1072b6a4b4f9SMatthew Dillon 		goto done2;
10733d903220SDoug Rabson 	}
10743d903220SDoug Rabson 
1075e6a543f8SRobert Watson #ifdef MAC
1076e6a543f8SRobert Watson 	error = mac_check_sysv_msqrcv(td->td_ucred, msqkptr);
1077e6a543f8SRobert Watson 	if (error != 0) {
1078e6a543f8SRobert Watson 		MPRINTF(("mac_check_sysv_msqrcv returned %d\n", error));
1079e6a543f8SRobert Watson 		goto done2;
1080e6a543f8SRobert Watson 	}
1081e6a543f8SRobert Watson #endif
1082e6a543f8SRobert Watson 
10833d903220SDoug Rabson 	msghdr = NULL;
10843d903220SDoug Rabson 	while (msghdr == NULL) {
10853d903220SDoug Rabson 		if (msgtyp == 0) {
1086921d05b9SRobert Watson 			msghdr = msqkptr->u.msg_first;
10873d903220SDoug Rabson 			if (msghdr != NULL) {
10883d903220SDoug Rabson 				if (msgsz < msghdr->msg_ts &&
10893d903220SDoug Rabson 				    (msgflg & MSG_NOERROR) == 0) {
1090fd6d9be4SAlfred Perlstein 					DPRINTF(("first message on the queue "
1091fd6d9be4SAlfred Perlstein 					    "is too big (want %d, got %d)\n",
1092fd6d9be4SAlfred Perlstein 					    msgsz, msghdr->msg_ts));
1093b6a4b4f9SMatthew Dillon 					error = E2BIG;
1094b6a4b4f9SMatthew Dillon 					goto done2;
10953d903220SDoug Rabson 				}
1096e6a543f8SRobert Watson #ifdef MAC
1097e6a543f8SRobert Watson 				error = mac_check_sysv_msgrcv(td->td_ucred,
1098e6a543f8SRobert Watson 				    msghdr);
1099e6a543f8SRobert Watson 				if (error != 0) {
1100e6a543f8SRobert Watson 					MPRINTF(("mac_check_sysv_msgrcv "
1101e6a543f8SRobert Watson 					    "returned %d\n", error));
1102e6a543f8SRobert Watson 					goto done2;
1103e6a543f8SRobert Watson 				}
1104e6a543f8SRobert Watson #endif
1105921d05b9SRobert Watson 				if (msqkptr->u.msg_first == msqkptr->u.msg_last) {
1106921d05b9SRobert Watson 					msqkptr->u.msg_first = NULL;
1107921d05b9SRobert Watson 					msqkptr->u.msg_last = NULL;
11083d903220SDoug Rabson 				} else {
1109921d05b9SRobert Watson 					msqkptr->u.msg_first = msghdr->msg_next;
1110921d05b9SRobert Watson 					if (msqkptr->u.msg_first == NULL)
11113d903220SDoug Rabson 						panic("msg_first/last screwed up #1");
11123d903220SDoug Rabson 				}
11133d903220SDoug Rabson 			}
11143d903220SDoug Rabson 		} else {
11153d903220SDoug Rabson 			struct msg *previous;
11163d903220SDoug Rabson 			struct msg **prev;
11173d903220SDoug Rabson 
11183d903220SDoug Rabson 			previous = NULL;
1119921d05b9SRobert Watson 			prev = &(msqkptr->u.msg_first);
11203d903220SDoug Rabson 			while ((msghdr = *prev) != NULL) {
11213d903220SDoug Rabson 				/*
11223d903220SDoug Rabson 				 * Is this message's type an exact match or is
11233d903220SDoug Rabson 				 * this message's type less than or equal to
11243d903220SDoug Rabson 				 * the absolute value of a negative msgtyp?
11253d903220SDoug Rabson 				 * Note that the second half of this test can
11263d903220SDoug Rabson 				 * NEVER be true if msgtyp is positive since
11273d903220SDoug Rabson 				 * msg_type is always positive!
11283d903220SDoug Rabson 				 */
11293d903220SDoug Rabson 
11303d903220SDoug Rabson 				if (msgtyp == msghdr->msg_type ||
11313d903220SDoug Rabson 				    msghdr->msg_type <= -msgtyp) {
1132fd6d9be4SAlfred Perlstein 					DPRINTF(("found message type %d, "
1133fd6d9be4SAlfred Perlstein 					    "requested %d\n",
1134fd6d9be4SAlfred Perlstein 					    msghdr->msg_type, msgtyp));
11353d903220SDoug Rabson 					if (msgsz < msghdr->msg_ts &&
11363d903220SDoug Rabson 					    (msgflg & MSG_NOERROR) == 0) {
1137fd6d9be4SAlfred Perlstein 						DPRINTF(("requested message "
1138fd6d9be4SAlfred Perlstein 						    "on the queue is too big "
1139fd6d9be4SAlfred Perlstein 						    "(want %d, got %d)\n",
1140fd6d9be4SAlfred Perlstein 						    msgsz, msghdr->msg_ts));
1141b6a4b4f9SMatthew Dillon 						error = E2BIG;
1142b6a4b4f9SMatthew Dillon 						goto done2;
11433d903220SDoug Rabson 					}
1144e6a543f8SRobert Watson #ifdef MAC
1145e6a543f8SRobert Watson 					error = mac_check_sysv_msgrcv(
1146e6a543f8SRobert Watson 					    td->td_ucred, msghdr);
1147e6a543f8SRobert Watson 					if (error != 0) {
1148e6a543f8SRobert Watson 						MPRINTF(("mac_check_sysv_"
1149e6a543f8SRobert Watson 						    "msgrcv returned %d\n",
1150e6a543f8SRobert Watson 						    error));
1151e6a543f8SRobert Watson 						goto done2;
1152e6a543f8SRobert Watson 					}
1153e6a543f8SRobert Watson #endif
11543d903220SDoug Rabson 					*prev = msghdr->msg_next;
1155921d05b9SRobert Watson 					if (msghdr == msqkptr->u.msg_last) {
11563d903220SDoug Rabson 						if (previous == NULL) {
11573d903220SDoug Rabson 							if (prev !=
1158921d05b9SRobert Watson 							    &msqkptr->u.msg_first)
11593d903220SDoug Rabson 								panic("msg_first/last screwed up #2");
1160921d05b9SRobert Watson 							msqkptr->u.msg_first =
11613d903220SDoug Rabson 							    NULL;
1162921d05b9SRobert Watson 							msqkptr->u.msg_last =
11633d903220SDoug Rabson 							    NULL;
11643d903220SDoug Rabson 						} else {
11653d903220SDoug Rabson 							if (prev ==
1166921d05b9SRobert Watson 							    &msqkptr->u.msg_first)
11673d903220SDoug Rabson 								panic("msg_first/last screwed up #3");
1168921d05b9SRobert Watson 							msqkptr->u.msg_last =
11693d903220SDoug Rabson 							    previous;
11703d903220SDoug Rabson 						}
11713d903220SDoug Rabson 					}
11723d903220SDoug Rabson 					break;
11733d903220SDoug Rabson 				}
11743d903220SDoug Rabson 				previous = msghdr;
11753d903220SDoug Rabson 				prev = &(msghdr->msg_next);
11763d903220SDoug Rabson 			}
11773d903220SDoug Rabson 		}
11783d903220SDoug Rabson 
11793d903220SDoug Rabson 		/*
11803d903220SDoug Rabson 		 * We've either extracted the msghdr for the appropriate
11813d903220SDoug Rabson 		 * message or there isn't one.
11823d903220SDoug Rabson 		 * If there is one then bail out of this loop.
11833d903220SDoug Rabson 		 */
11843d903220SDoug Rabson 
11853d903220SDoug Rabson 		if (msghdr != NULL)
11863d903220SDoug Rabson 			break;
11873d903220SDoug Rabson 
11883d903220SDoug Rabson 		/*
11893d903220SDoug Rabson 		 * Hmph!  No message found.  Does the user want to wait?
11903d903220SDoug Rabson 		 */
11913d903220SDoug Rabson 
11923d903220SDoug Rabson 		if ((msgflg & IPC_NOWAIT) != 0) {
1193fd6d9be4SAlfred Perlstein 			DPRINTF(("no appropriate message found (msgtyp=%d)\n",
1194fd6d9be4SAlfred Perlstein 			    msgtyp));
11953d903220SDoug Rabson 			/* The SVID says to return ENOMSG. */
1196b6a4b4f9SMatthew Dillon 			error = ENOMSG;
1197b6a4b4f9SMatthew Dillon 			goto done2;
11983d903220SDoug Rabson 		}
11993d903220SDoug Rabson 
12003d903220SDoug Rabson 		/*
12013d903220SDoug Rabson 		 * Wait for something to happen
12023d903220SDoug Rabson 		 */
12033d903220SDoug Rabson 
1204fd6d9be4SAlfred Perlstein 		DPRINTF(("msgrcv:  goodnight\n"));
1205921d05b9SRobert Watson 		error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,
12064b6ef3a1SAlfred Perlstein 		    "msgwait", 0);
1207fd6d9be4SAlfred Perlstein 		DPRINTF(("msgrcv:  good morning (error=%d)\n", error));
12083d903220SDoug Rabson 
1209b6a4b4f9SMatthew Dillon 		if (error != 0) {
1210fd6d9be4SAlfred Perlstein 			DPRINTF(("msgsnd:  interrupted system call\n"));
1211b6a4b4f9SMatthew Dillon 			error = EINTR;
1212b6a4b4f9SMatthew Dillon 			goto done2;
12133d903220SDoug Rabson 		}
12143d903220SDoug Rabson 
12153d903220SDoug Rabson 		/*
12163d903220SDoug Rabson 		 * Make sure that the msq queue still exists
12173d903220SDoug Rabson 		 */
12183d903220SDoug Rabson 
1219921d05b9SRobert Watson 		if (msqkptr->u.msg_qbytes == 0 ||
1220921d05b9SRobert Watson 		    msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) {
1221fd6d9be4SAlfred Perlstein 			DPRINTF(("msqid deleted\n"));
1222b6a4b4f9SMatthew Dillon 			error = EIDRM;
1223b6a4b4f9SMatthew Dillon 			goto done2;
12243d903220SDoug Rabson 		}
12253d903220SDoug Rabson 	}
12263d903220SDoug Rabson 
12273d903220SDoug Rabson 	/*
12283d903220SDoug Rabson 	 * Return the message to the user.
12293d903220SDoug Rabson 	 *
12303d903220SDoug Rabson 	 * First, do the bookkeeping (before we risk being interrupted).
12313d903220SDoug Rabson 	 */
12323d903220SDoug Rabson 
1233921d05b9SRobert Watson 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;
1234921d05b9SRobert Watson 	msqkptr->u.msg_qnum--;
1235921d05b9SRobert Watson 	msqkptr->u.msg_lrpid = td->td_proc->p_pid;
1236921d05b9SRobert Watson 	msqkptr->u.msg_rtime = time_second;
12373d903220SDoug Rabson 
12383d903220SDoug Rabson 	/*
12393d903220SDoug Rabson 	 * Make msgsz the actual amount that we'll be returning.
12403d903220SDoug Rabson 	 * Note that this effectively truncates the message if it is too long
12413d903220SDoug Rabson 	 * (since msgsz is never increased).
12423d903220SDoug Rabson 	 */
12433d903220SDoug Rabson 
1244fd6d9be4SAlfred Perlstein 	DPRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz,
1245fd6d9be4SAlfred Perlstein 	    msghdr->msg_ts));
12463d903220SDoug Rabson 	if (msgsz > msghdr->msg_ts)
12473d903220SDoug Rabson 		msgsz = msghdr->msg_ts;
12483d903220SDoug Rabson 
12493d903220SDoug Rabson 	/*
12503d903220SDoug Rabson 	 * Return the type to the user.
12513d903220SDoug Rabson 	 */
12523d903220SDoug Rabson 
12534b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
12542cc593fdSAlfred Perlstein 	error = copyout(&(msghdr->msg_type), user_msgp,
12553d903220SDoug Rabson 	    sizeof(msghdr->msg_type));
12564b6ef3a1SAlfred Perlstein 	mtx_lock(&msq_mtx);
1257b6a4b4f9SMatthew Dillon 	if (error != 0) {
1258fd6d9be4SAlfred Perlstein 		DPRINTF(("error (%d) copying out message type\n", error));
12593d903220SDoug Rabson 		msg_freehdr(msghdr);
1260921d05b9SRobert Watson 		wakeup(msqkptr);
1261b6a4b4f9SMatthew Dillon 		goto done2;
12623d903220SDoug Rabson 	}
126309a8dfa2SBruce Evans 	user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type);
12643d903220SDoug Rabson 
12653d903220SDoug Rabson 	/*
12663d903220SDoug Rabson 	 * Return the segments to the user
12673d903220SDoug Rabson 	 */
12683d903220SDoug Rabson 
12693d903220SDoug Rabson 	next = msghdr->msg_spot;
12703d903220SDoug Rabson 	for (len = 0; len < msgsz; len += msginfo.msgssz) {
12713d903220SDoug Rabson 		size_t tlen;
12723d903220SDoug Rabson 
1273565592bdSSADA Kenji 		if (msgsz - len > msginfo.msgssz)
12743d903220SDoug Rabson 			tlen = msginfo.msgssz;
12753d903220SDoug Rabson 		else
1276565592bdSSADA Kenji 			tlen = msgsz - len;
12773d903220SDoug Rabson 		if (next <= -1)
12783d903220SDoug Rabson 			panic("next too low #3");
12793d903220SDoug Rabson 		if (next >= msginfo.msgseg)
12803d903220SDoug Rabson 			panic("next out of range #3");
12814b6ef3a1SAlfred Perlstein 		mtx_unlock(&msq_mtx);
12822cc593fdSAlfred Perlstein 		error = copyout(&msgpool[next * msginfo.msgssz],
12833d903220SDoug Rabson 		    user_msgp, tlen);
12844b6ef3a1SAlfred Perlstein 		mtx_lock(&msq_mtx);
1285b6a4b4f9SMatthew Dillon 		if (error != 0) {
1286fd6d9be4SAlfred Perlstein 			DPRINTF(("error (%d) copying out message segment\n",
1287fd6d9be4SAlfred Perlstein 			    error));
12883d903220SDoug Rabson 			msg_freehdr(msghdr);
1289921d05b9SRobert Watson 			wakeup(msqkptr);
1290b6a4b4f9SMatthew Dillon 			goto done2;
12913d903220SDoug Rabson 		}
129209a8dfa2SBruce Evans 		user_msgp = (char *)user_msgp + tlen;
12933d903220SDoug Rabson 		next = msgmaps[next].next;
12943d903220SDoug Rabson 	}
12953d903220SDoug Rabson 
12963d903220SDoug Rabson 	/*
12973d903220SDoug Rabson 	 * Done, return the actual number of bytes copied out.
12983d903220SDoug Rabson 	 */
12993d903220SDoug Rabson 
13003d903220SDoug Rabson 	msg_freehdr(msghdr);
1301921d05b9SRobert Watson 	wakeup(msqkptr);
1302b40ce416SJulian Elischer 	td->td_retval[0] = msgsz;
1303b6a4b4f9SMatthew Dillon done2:
13044b6ef3a1SAlfred Perlstein 	mtx_unlock(&msq_mtx);
1305b6a4b4f9SMatthew Dillon 	return (error);
13063d903220SDoug Rabson }
1307a723c4e1SDima Dorfman 
1308a723c4e1SDima Dorfman static int
1309a723c4e1SDima Dorfman sysctl_msqids(SYSCTL_HANDLER_ARGS)
1310a723c4e1SDima Dorfman {
1311a723c4e1SDima Dorfman 
1312a723c4e1SDima Dorfman 	return (SYSCTL_OUT(req, msqids,
1313921d05b9SRobert Watson 	    sizeof(struct msqid_kernel) * msginfo.msgmni));
1314a723c4e1SDima Dorfman }
1315a723c4e1SDima Dorfman 
1316a723c4e1SDima Dorfman SYSCTL_DECL(_kern_ipc);
1317a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, "");
1318184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RDTUN, &msginfo.msgmni, 0, "");
1319b36aab85SRobert Watson SYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RDTUN, &msginfo.msgmnb, 0, "");
1320b36aab85SRobert Watson SYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RDTUN, &msginfo.msgtql, 0, "");
1321184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RDTUN, &msginfo.msgssz, 0, "");
1322184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RDTUN, &msginfo.msgseg, 0, "");
1323a723c4e1SDima Dorfman SYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD,
1324a723c4e1SDima Dorfman     NULL, 0, sysctl_msqids, "", "Message queue IDs");
1325