19454b2d8SWarner Losh /*- 23d903220SDoug Rabson * Implementation of SVID messages 33d903220SDoug Rabson * 43d903220SDoug Rabson * Author: Daniel Boulet 53d903220SDoug Rabson * 63d903220SDoug Rabson * Copyright 1993 Daniel Boulet and RTMX Inc. 73d903220SDoug Rabson * 83d903220SDoug Rabson * This system call was implemented by Daniel Boulet under contract from RTMX. 93d903220SDoug Rabson * 103d903220SDoug Rabson * Redistribution and use in source forms, with and without modification, 113d903220SDoug Rabson * are permitted provided that this entire comment appears intact. 123d903220SDoug Rabson * 133d903220SDoug Rabson * Redistribution in binary form may occur without any restrictions. 143d903220SDoug Rabson * Obviously, it would be nice if you gave credit where credit is due 153d903220SDoug Rabson * but requiring it would be too onerous. 163d903220SDoug Rabson * 173d903220SDoug Rabson * This software is provided ``AS IS'' without any warranties of any kind. 183d903220SDoug Rabson */ 19e6a543f8SRobert Watson /*- 20e6a543f8SRobert Watson * Copyright (c) 2003-2005 McAfee, Inc. 21e6a543f8SRobert Watson * All rights reserved. 22e6a543f8SRobert Watson * 23e6a543f8SRobert Watson * This software was developed for the FreeBSD Project in part by McAfee 24e6a543f8SRobert Watson * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR 25e6a543f8SRobert Watson * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research 26e6a543f8SRobert Watson * program. 27e6a543f8SRobert Watson * 28e6a543f8SRobert Watson * Redistribution and use in source and binary forms, with or without 29e6a543f8SRobert Watson * modification, are permitted provided that the following conditions 30e6a543f8SRobert Watson * are met: 31e6a543f8SRobert Watson * 1. Redistributions of source code must retain the above copyright 32e6a543f8SRobert Watson * notice, this list of conditions and the following disclaimer. 33e6a543f8SRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 34e6a543f8SRobert Watson * notice, this list of conditions and the following disclaimer in the 35e6a543f8SRobert Watson * documentation and/or other materials provided with the distribution. 36e6a543f8SRobert Watson * 37e6a543f8SRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 38e6a543f8SRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 39e6a543f8SRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 40e6a543f8SRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 41e6a543f8SRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 42e6a543f8SRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 43e6a543f8SRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 44e6a543f8SRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 45e6a543f8SRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 46e6a543f8SRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 47e6a543f8SRobert Watson * SUCH DAMAGE. 48e6a543f8SRobert Watson */ 493d903220SDoug Rabson 50677b542eSDavid E. O'Brien #include <sys/cdefs.h> 51677b542eSDavid E. O'Brien __FBSDID("$FreeBSD$"); 52677b542eSDavid E. O'Brien 53ab063af9SPeter Wemm #include "opt_sysvipc.h" 54e6a543f8SRobert Watson #include "opt_mac.h" 55ab063af9SPeter Wemm 563d903220SDoug Rabson #include <sys/param.h> 573d903220SDoug Rabson #include <sys/systm.h> 58725db531SBruce Evans #include <sys/sysproto.h> 593d903220SDoug Rabson #include <sys/kernel.h> 603d903220SDoug Rabson #include <sys/proc.h> 61b6a4b4f9SMatthew Dillon #include <sys/lock.h> 62e6a543f8SRobert Watson #include <sys/mac.h> 63b6a4b4f9SMatthew Dillon #include <sys/mutex.h> 6477409fe1SPoul-Henning Kamp #include <sys/module.h> 653d903220SDoug Rabson #include <sys/msg.h> 6678525ce3SAlfred Perlstein #include <sys/syscall.h> 67f4b6eb04SMaxim Sobolev #include <sys/syscallsubr.h> 68725db531SBruce Evans #include <sys/sysent.h> 69ab063af9SPeter Wemm #include <sys/sysctl.h> 70ab063af9SPeter Wemm #include <sys/malloc.h> 71cb1f0db9SRobert Watson #include <sys/jail.h> 72ab063af9SPeter Wemm 73ab063af9SPeter Wemm static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues"); 743d903220SDoug Rabson 754d77a549SAlfred Perlstein static void msginit(void); 764d77a549SAlfred Perlstein static int msgunload(void); 774d77a549SAlfred Perlstein static int sysvmsg_modload(struct module *, int, void *); 782b14f991SJulian Elischer 79fd6d9be4SAlfred Perlstein #ifdef MSG_DEBUG 80fd6d9be4SAlfred Perlstein #define DPRINTF(a) printf a 81fd6d9be4SAlfred Perlstein #else 82fd6d9be4SAlfred Perlstein #define DPRINTF(a) 83fd6d9be4SAlfred Perlstein #endif 84e6a543f8SRobert Watson #ifdef MAC_DEBUG 85e6a543f8SRobert Watson #define MPRINTF(a) printf a 86e6a543f8SRobert Watson #else 87e6a543f8SRobert Watson #define MPRINTF(a) 88e6a543f8SRobert Watson #endif 893d903220SDoug Rabson 904d77a549SAlfred Perlstein static void msg_freehdr(struct msg *msghdr); 913d903220SDoug Rabson 92725db531SBruce Evans /* XXX casting to (sy_call_t *) is bogus, as usual. */ 9387b6de2bSPoul-Henning Kamp static sy_call_t *msgcalls[] = { 94725db531SBruce Evans (sy_call_t *)msgctl, (sy_call_t *)msgget, 95725db531SBruce Evans (sy_call_t *)msgsnd, (sy_call_t *)msgrcv 96725db531SBruce Evans }; 973d903220SDoug Rabson 98ab063af9SPeter Wemm #ifndef MSGSSZ 99ab063af9SPeter Wemm #define MSGSSZ 8 /* Each segment must be 2^N long */ 100ab063af9SPeter Wemm #endif 101ab063af9SPeter Wemm #ifndef MSGSEG 102ab063af9SPeter Wemm #define MSGSEG 2048 /* must be less than 32767 */ 103ab063af9SPeter Wemm #endif 104ab063af9SPeter Wemm #define MSGMAX (MSGSSZ*MSGSEG) 105ab063af9SPeter Wemm #ifndef MSGMNB 106ab063af9SPeter Wemm #define MSGMNB 2048 /* max # of bytes in a queue */ 107ab063af9SPeter Wemm #endif 108ab063af9SPeter Wemm #ifndef MSGMNI 109ab063af9SPeter Wemm #define MSGMNI 40 110ab063af9SPeter Wemm #endif 111ab063af9SPeter Wemm #ifndef MSGTQL 112ab063af9SPeter Wemm #define MSGTQL 40 113ab063af9SPeter Wemm #endif 114ab063af9SPeter Wemm 115ab063af9SPeter Wemm /* 116ab063af9SPeter Wemm * Based on the configuration parameters described in an SVR2 (yes, two) 117ab063af9SPeter Wemm * config(1m) man page. 118ab063af9SPeter Wemm * 119ab063af9SPeter Wemm * Each message is broken up and stored in segments that are msgssz bytes 120ab063af9SPeter Wemm * long. For efficiency reasons, this should be a power of two. Also, 121ab063af9SPeter Wemm * it doesn't make sense if it is less than 8 or greater than about 256. 122ab063af9SPeter Wemm * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of 123ab063af9SPeter Wemm * two between 8 and 1024 inclusive (and panic's if it isn't). 124ab063af9SPeter Wemm */ 125ab063af9SPeter Wemm struct msginfo msginfo = { 126ab063af9SPeter Wemm MSGMAX, /* max chars in a message */ 127ab063af9SPeter Wemm MSGMNI, /* # of message queue identifiers */ 128ab063af9SPeter Wemm MSGMNB, /* max chars in a queue */ 129ab063af9SPeter Wemm MSGTQL, /* max messages in system */ 130ab063af9SPeter Wemm MSGSSZ, /* size of a message segment */ 131ab063af9SPeter Wemm /* (must be small power of 2 greater than 4) */ 132ab063af9SPeter Wemm MSGSEG /* number of message segments */ 133ab063af9SPeter Wemm }; 134ab063af9SPeter Wemm 135ab063af9SPeter Wemm /* 136ab063af9SPeter Wemm * macros to convert between msqid_ds's and msqid's. 137ab063af9SPeter Wemm * (specific to this implementation) 138ab063af9SPeter Wemm */ 139ab063af9SPeter Wemm #define MSQID(ix,ds) ((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000)) 140ab063af9SPeter Wemm #define MSQID_IX(id) ((id) & 0xffff) 141ab063af9SPeter Wemm #define MSQID_SEQ(id) (((id) >> 16) & 0xffff) 142ab063af9SPeter Wemm 143ab063af9SPeter Wemm /* 144ab063af9SPeter Wemm * The rest of this file is specific to this particular implementation. 145ab063af9SPeter Wemm */ 146ab063af9SPeter Wemm 147ab063af9SPeter Wemm struct msgmap { 148ab063af9SPeter Wemm short next; /* next segment in buffer */ 149ab063af9SPeter Wemm /* -1 -> available */ 150ab063af9SPeter Wemm /* 0..(MSGSEG-1) -> index of next segment */ 151ab063af9SPeter Wemm }; 152ab063af9SPeter Wemm 153ab063af9SPeter Wemm #define MSG_LOCKED 01000 /* Is this msqid_ds locked? */ 154ab063af9SPeter Wemm 15587b6de2bSPoul-Henning Kamp static int nfree_msgmaps; /* # of free map entries */ 15687b6de2bSPoul-Henning Kamp static short free_msgmaps; /* head of linked list of free map entries */ 15787b6de2bSPoul-Henning Kamp static struct msg *free_msghdrs;/* list of free msg headers */ 158ab063af9SPeter Wemm static char *msgpool; /* MSGMAX byte long msg buffer pool */ 159ab063af9SPeter Wemm static struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 160ab063af9SPeter Wemm static struct msg *msghdrs; /* MSGTQL msg headers */ 161921d05b9SRobert Watson static struct msqid_kernel *msqids; /* MSGMNI msqid_kernel struct's */ 1624b6ef3a1SAlfred Perlstein static struct mtx msq_mtx; /* global mutex for message queues. */ 1633d903220SDoug Rabson 164ab063af9SPeter Wemm static void 16578525ce3SAlfred Perlstein msginit() 1663d903220SDoug Rabson { 1673d903220SDoug Rabson register int i; 1683d903220SDoug Rabson 169896de692SMichael Reifenberger TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg); 170896de692SMichael Reifenberger TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz); 171896de692SMichael Reifenberger msginfo.msgmax = msginfo.msgseg * msginfo.msgssz; 172896de692SMichael Reifenberger TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni); 173b36aab85SRobert Watson TUNABLE_INT_FETCH("kern.ipc.msgmnb", &msginfo.msgmnb); 174b36aab85SRobert Watson TUNABLE_INT_FETCH("kern.ipc.msgtql", &msginfo.msgtql); 175896de692SMichael Reifenberger 176a163d034SWarner Losh msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK); 177ab063af9SPeter Wemm if (msgpool == NULL) 178ab063af9SPeter Wemm panic("msgpool is NULL"); 179a163d034SWarner Losh msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK); 180ab063af9SPeter Wemm if (msgmaps == NULL) 181ab063af9SPeter Wemm panic("msgmaps is NULL"); 182a163d034SWarner Losh msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK); 183ab063af9SPeter Wemm if (msghdrs == NULL) 184ab063af9SPeter Wemm panic("msghdrs is NULL"); 185921d05b9SRobert Watson msqids = malloc(sizeof(struct msqid_kernel) * msginfo.msgmni, M_MSG, 186921d05b9SRobert Watson M_WAITOK); 187ab063af9SPeter Wemm if (msqids == NULL) 188ab063af9SPeter Wemm panic("msqids is NULL"); 189ab063af9SPeter Wemm 1903d903220SDoug Rabson /* 1913d903220SDoug Rabson * msginfo.msgssz should be a power of two for efficiency reasons. 1923d903220SDoug Rabson * It is also pretty silly if msginfo.msgssz is less than 8 1933d903220SDoug Rabson * or greater than about 256 so ... 1943d903220SDoug Rabson */ 1953d903220SDoug Rabson 1963d903220SDoug Rabson i = 8; 1973d903220SDoug Rabson while (i < 1024 && i != msginfo.msgssz) 1983d903220SDoug Rabson i <<= 1; 1993d903220SDoug Rabson if (i != msginfo.msgssz) { 200fd6d9be4SAlfred Perlstein DPRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 201fd6d9be4SAlfred Perlstein msginfo.msgssz)); 2023d903220SDoug Rabson panic("msginfo.msgssz not a small power of 2"); 2033d903220SDoug Rabson } 2043d903220SDoug Rabson 2053d903220SDoug Rabson if (msginfo.msgseg > 32767) { 206fd6d9be4SAlfred Perlstein DPRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 2073d903220SDoug Rabson panic("msginfo.msgseg > 32767"); 2083d903220SDoug Rabson } 2093d903220SDoug Rabson 2103d903220SDoug Rabson if (msgmaps == NULL) 2113d903220SDoug Rabson panic("msgmaps is NULL"); 2123d903220SDoug Rabson 2133d903220SDoug Rabson for (i = 0; i < msginfo.msgseg; i++) { 2143d903220SDoug Rabson if (i > 0) 2153d903220SDoug Rabson msgmaps[i-1].next = i; 2163d903220SDoug Rabson msgmaps[i].next = -1; /* implies entry is available */ 2173d903220SDoug Rabson } 2183d903220SDoug Rabson free_msgmaps = 0; 2193d903220SDoug Rabson nfree_msgmaps = msginfo.msgseg; 2203d903220SDoug Rabson 2213d903220SDoug Rabson if (msghdrs == NULL) 2223d903220SDoug Rabson panic("msghdrs is NULL"); 2233d903220SDoug Rabson 2243d903220SDoug Rabson for (i = 0; i < msginfo.msgtql; i++) { 2253d903220SDoug Rabson msghdrs[i].msg_type = 0; 2263d903220SDoug Rabson if (i > 0) 2273d903220SDoug Rabson msghdrs[i-1].msg_next = &msghdrs[i]; 2283d903220SDoug Rabson msghdrs[i].msg_next = NULL; 229e6a543f8SRobert Watson #ifdef MAC 230e6a543f8SRobert Watson mac_init_sysv_msgmsg(&msghdrs[i]); 231e6a543f8SRobert Watson #endif 2323d903220SDoug Rabson } 2333d903220SDoug Rabson free_msghdrs = &msghdrs[0]; 2343d903220SDoug Rabson 2353d903220SDoug Rabson if (msqids == NULL) 2363d903220SDoug Rabson panic("msqids is NULL"); 2373d903220SDoug Rabson 2383d903220SDoug Rabson for (i = 0; i < msginfo.msgmni; i++) { 239921d05b9SRobert Watson msqids[i].u.msg_qbytes = 0; /* implies entry is available */ 240921d05b9SRobert Watson msqids[i].u.msg_perm.seq = 0; /* reset to a known value */ 241921d05b9SRobert Watson msqids[i].u.msg_perm.mode = 0; 242e6a543f8SRobert Watson #ifdef MAC 243e6a543f8SRobert Watson mac_init_sysv_msgqueue(&msqids[i]); 244e6a543f8SRobert Watson #endif 2453d903220SDoug Rabson } 2464b6ef3a1SAlfred Perlstein mtx_init(&msq_mtx, "msq", NULL, MTX_DEF); 2473d903220SDoug Rabson } 24878525ce3SAlfred Perlstein 24978525ce3SAlfred Perlstein static int 25078525ce3SAlfred Perlstein msgunload() 25178525ce3SAlfred Perlstein { 252921d05b9SRobert Watson struct msqid_kernel *msqkptr; 25378525ce3SAlfred Perlstein int msqid; 254e6a543f8SRobert Watson #ifdef MAC 255e6a543f8SRobert Watson int i; 256e6a543f8SRobert Watson #endif 25778525ce3SAlfred Perlstein 25878525ce3SAlfred Perlstein for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 25978525ce3SAlfred Perlstein /* 26078525ce3SAlfred Perlstein * Look for an unallocated and unlocked msqid_ds. 26178525ce3SAlfred Perlstein * msqid_ds's can be locked by msgsnd or msgrcv while 26278525ce3SAlfred Perlstein * they are copying the message in/out. We can't 26378525ce3SAlfred Perlstein * re-use the entry until they release it. 26478525ce3SAlfred Perlstein */ 265921d05b9SRobert Watson msqkptr = &msqids[msqid]; 266921d05b9SRobert Watson if (msqkptr->u.msg_qbytes != 0 || 267921d05b9SRobert Watson (msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) 26878525ce3SAlfred Perlstein break; 26978525ce3SAlfred Perlstein } 27078525ce3SAlfred Perlstein if (msqid != msginfo.msgmni) 27178525ce3SAlfred Perlstein return (EBUSY); 27278525ce3SAlfred Perlstein 273e6a543f8SRobert Watson #ifdef MAC 274e6a543f8SRobert Watson for (i = 0; i < msginfo.msgtql; i++) 275e6a543f8SRobert Watson mac_destroy_sysv_msgmsg(&msghdrs[i]); 276e6a543f8SRobert Watson for (msqid = 0; msqid < msginfo.msgmni; msqid++) 277e6a543f8SRobert Watson mac_destroy_sysv_msgqueue(&msqids[msqid]); 278e6a543f8SRobert Watson #endif 27978525ce3SAlfred Perlstein free(msgpool, M_MSG); 28078525ce3SAlfred Perlstein free(msgmaps, M_MSG); 28178525ce3SAlfred Perlstein free(msghdrs, M_MSG); 28278525ce3SAlfred Perlstein free(msqids, M_MSG); 2834b6ef3a1SAlfred Perlstein mtx_destroy(&msq_mtx); 28478525ce3SAlfred Perlstein return (0); 28578525ce3SAlfred Perlstein } 28678525ce3SAlfred Perlstein 28778525ce3SAlfred Perlstein 28878525ce3SAlfred Perlstein static int 28978525ce3SAlfred Perlstein sysvmsg_modload(struct module *module, int cmd, void *arg) 29078525ce3SAlfred Perlstein { 29178525ce3SAlfred Perlstein int error = 0; 29278525ce3SAlfred Perlstein 29378525ce3SAlfred Perlstein switch (cmd) { 29478525ce3SAlfred Perlstein case MOD_LOAD: 29578525ce3SAlfred Perlstein msginit(); 29678525ce3SAlfred Perlstein break; 29778525ce3SAlfred Perlstein case MOD_UNLOAD: 29878525ce3SAlfred Perlstein error = msgunload(); 29978525ce3SAlfred Perlstein break; 30078525ce3SAlfred Perlstein case MOD_SHUTDOWN: 30178525ce3SAlfred Perlstein break; 30278525ce3SAlfred Perlstein default: 30378525ce3SAlfred Perlstein error = EINVAL; 30478525ce3SAlfred Perlstein break; 30578525ce3SAlfred Perlstein } 30678525ce3SAlfred Perlstein return (error); 30778525ce3SAlfred Perlstein } 30878525ce3SAlfred Perlstein 309faa784b7SDag-Erling Smørgrav static moduledata_t sysvmsg_mod = { 310faa784b7SDag-Erling Smørgrav "sysvmsg", 31178525ce3SAlfred Perlstein &sysvmsg_modload, 31278525ce3SAlfred Perlstein NULL 31378525ce3SAlfred Perlstein }; 31478525ce3SAlfred Perlstein 31521d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgsys); 31621d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgctl); 31721d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgget); 31821d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgsnd); 31921d56e9cSAlfred Perlstein SYSCALL_MODULE_HELPER(msgrcv); 32078525ce3SAlfred Perlstein 321faa784b7SDag-Erling Smørgrav DECLARE_MODULE(sysvmsg, sysvmsg_mod, 32278525ce3SAlfred Perlstein SI_SUB_SYSV_MSG, SI_ORDER_FIRST); 323faa784b7SDag-Erling Smørgrav MODULE_VERSION(sysvmsg, 1); 3243d903220SDoug Rabson 3253d903220SDoug Rabson /* 3263d903220SDoug Rabson * Entry point for all MSG calls 327b6a4b4f9SMatthew Dillon * 328b6a4b4f9SMatthew Dillon * MPSAFE 3293d903220SDoug Rabson */ 3303d903220SDoug Rabson int 331b40ce416SJulian Elischer msgsys(td, uap) 332b40ce416SJulian Elischer struct thread *td; 333725db531SBruce Evans /* XXX actually varargs. */ 334725db531SBruce Evans struct msgsys_args /* { 33501b9dc96SJacques Vidrine int which; 336725db531SBruce Evans int a2; 337725db531SBruce Evans int a3; 338725db531SBruce Evans int a4; 339725db531SBruce Evans int a5; 340725db531SBruce Evans int a6; 341725db531SBruce Evans } */ *uap; 3423d903220SDoug Rabson { 343b6a4b4f9SMatthew Dillon int error; 3443d903220SDoug Rabson 345c6f55f33SJohn Baldwin if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 346c6f55f33SJohn Baldwin return (ENOSYS); 34701b9dc96SJacques Vidrine if (uap->which < 0 || 34801b9dc96SJacques Vidrine uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0])) 349c6f55f33SJohn Baldwin return (EINVAL); 350b40ce416SJulian Elischer error = (*msgcalls[uap->which])(td, &uap->a2); 351b6a4b4f9SMatthew Dillon return (error); 3523d903220SDoug Rabson } 3533d903220SDoug Rabson 3543d903220SDoug Rabson static void 3553d903220SDoug Rabson msg_freehdr(msghdr) 3563d903220SDoug Rabson struct msg *msghdr; 3573d903220SDoug Rabson { 3583d903220SDoug Rabson while (msghdr->msg_ts > 0) { 3593d903220SDoug Rabson short next; 3603d903220SDoug Rabson if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 3613d903220SDoug Rabson panic("msghdr->msg_spot out of range"); 3623d903220SDoug Rabson next = msgmaps[msghdr->msg_spot].next; 3633d903220SDoug Rabson msgmaps[msghdr->msg_spot].next = free_msgmaps; 3643d903220SDoug Rabson free_msgmaps = msghdr->msg_spot; 3653d903220SDoug Rabson nfree_msgmaps++; 3663d903220SDoug Rabson msghdr->msg_spot = next; 3673d903220SDoug Rabson if (msghdr->msg_ts >= msginfo.msgssz) 3683d903220SDoug Rabson msghdr->msg_ts -= msginfo.msgssz; 3693d903220SDoug Rabson else 3703d903220SDoug Rabson msghdr->msg_ts = 0; 3713d903220SDoug Rabson } 3723d903220SDoug Rabson if (msghdr->msg_spot != -1) 3733d903220SDoug Rabson panic("msghdr->msg_spot != -1"); 3743d903220SDoug Rabson msghdr->msg_next = free_msghdrs; 3753d903220SDoug Rabson free_msghdrs = msghdr; 376e6a543f8SRobert Watson #ifdef MAC 377e6a543f8SRobert Watson mac_cleanup_sysv_msgmsg(msghdr); 378e6a543f8SRobert Watson #endif 3793d903220SDoug Rabson } 3803d903220SDoug Rabson 381b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_ 3823d903220SDoug Rabson struct msgctl_args { 3833d903220SDoug Rabson int msqid; 3843d903220SDoug Rabson int cmd; 385b5d5c0c9SPeter Wemm struct msqid_ds *buf; 3863d903220SDoug Rabson }; 387b5d5c0c9SPeter Wemm #endif 3883d903220SDoug Rabson 389b6a4b4f9SMatthew Dillon /* 390b6a4b4f9SMatthew Dillon * MPSAFE 391b6a4b4f9SMatthew Dillon */ 392b5d5c0c9SPeter Wemm int 393b40ce416SJulian Elischer msgctl(td, uap) 394b40ce416SJulian Elischer struct thread *td; 3953d903220SDoug Rabson register struct msgctl_args *uap; 3963d903220SDoug Rabson { 3973d903220SDoug Rabson int msqid = uap->msqid; 3983d903220SDoug Rabson int cmd = uap->cmd; 3993d903220SDoug Rabson struct msqid_ds msqbuf; 400f4b6eb04SMaxim Sobolev struct msqid_ds *msqptr; 401f4b6eb04SMaxim Sobolev int error; 402f4b6eb04SMaxim Sobolev 403f4b6eb04SMaxim Sobolev DPRINTF(("call to msgctl(%d, %d, 0x%x)\n", msqid, cmd, uap->buf)); 404f4b6eb04SMaxim Sobolev if (cmd == IPC_SET && 405f4b6eb04SMaxim Sobolev (error = copyin(uap->buf, &msqbuf, sizeof(msqbuf))) != 0) 406f4b6eb04SMaxim Sobolev return (error); 407f4b6eb04SMaxim Sobolev error = kern_msgctl(td, msqid, cmd, &msqbuf, &msqptr); 408f4b6eb04SMaxim Sobolev if (cmd == IPC_STAT && error == 0) 409f4b6eb04SMaxim Sobolev error = copyout(msqptr, uap->buf, sizeof(struct msqid_ds)); 410f4b6eb04SMaxim Sobolev return (error); 411f4b6eb04SMaxim Sobolev } 412f4b6eb04SMaxim Sobolev 413f4b6eb04SMaxim Sobolev int 414f4b6eb04SMaxim Sobolev kern_msgctl(td, msqid, cmd, msqbuf, msqptr) 415f4b6eb04SMaxim Sobolev struct thread *td; 416f4b6eb04SMaxim Sobolev int msqid; 417f4b6eb04SMaxim Sobolev int cmd; 418f4b6eb04SMaxim Sobolev struct msqid_ds *msqbuf; 419f4b6eb04SMaxim Sobolev struct msqid_ds **msqptr; 420f4b6eb04SMaxim Sobolev { 421f4b6eb04SMaxim Sobolev int rval, error, msqix; 422921d05b9SRobert Watson register struct msqid_kernel *msqkptr; 4233d903220SDoug Rabson 424c6f55f33SJohn Baldwin if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 425c6f55f33SJohn Baldwin return (ENOSYS); 426cb1f0db9SRobert Watson 427f4b6eb04SMaxim Sobolev msqix = IPCID_TO_IX(msqid); 4283d903220SDoug Rabson 429f4b6eb04SMaxim Sobolev if (msqix < 0 || msqix >= msginfo.msgmni) { 430f4b6eb04SMaxim Sobolev DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqix, 431fd6d9be4SAlfred Perlstein msginfo.msgmni)); 4324b6ef3a1SAlfred Perlstein return (EINVAL); 4333d903220SDoug Rabson } 4343d903220SDoug Rabson 435f4b6eb04SMaxim Sobolev msqkptr = &msqids[msqix]; 4363d903220SDoug Rabson 4374b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 438921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0) { 439fd6d9be4SAlfred Perlstein DPRINTF(("no such msqid\n")); 440b6a4b4f9SMatthew Dillon error = EINVAL; 441b6a4b4f9SMatthew Dillon goto done2; 4423d903220SDoug Rabson } 443f4b6eb04SMaxim Sobolev if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) { 444fd6d9be4SAlfred Perlstein DPRINTF(("wrong sequence number\n")); 445b6a4b4f9SMatthew Dillon error = EINVAL; 446b6a4b4f9SMatthew Dillon goto done2; 4473d903220SDoug Rabson } 448e6a543f8SRobert Watson #ifdef MAC 449e6a543f8SRobert Watson error = mac_check_sysv_msqctl(td->td_ucred, msqkptr, cmd); 450e6a543f8SRobert Watson if (error != 0) { 451e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msqctl returned %d\n", error)); 452e6a543f8SRobert Watson goto done2; 453e6a543f8SRobert Watson } 454e6a543f8SRobert Watson #endif 4553d903220SDoug Rabson 456b6a4b4f9SMatthew Dillon error = 0; 4573d903220SDoug Rabson rval = 0; 4583d903220SDoug Rabson 4593d903220SDoug Rabson switch (cmd) { 4603d903220SDoug Rabson 4613d903220SDoug Rabson case IPC_RMID: 4623d903220SDoug Rabson { 4633d903220SDoug Rabson struct msg *msghdr; 464921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M))) 465b6a4b4f9SMatthew Dillon goto done2; 466921d05b9SRobert Watson 467e6a543f8SRobert Watson #ifdef MAC 468e6a543f8SRobert Watson /* 469e6a543f8SRobert Watson * Check that the thread has MAC access permissions to 470e6a543f8SRobert Watson * individual msghdrs. Note: We need to do this in a 471e6a543f8SRobert Watson * separate loop because the actual loop alters the 472e6a543f8SRobert Watson * msq/msghdr info as it progresses, and there is no going 473e6a543f8SRobert Watson * back if half the way through we discover that the 474e6a543f8SRobert Watson * thread cannot free a certain msghdr. The msq will get 475e6a543f8SRobert Watson * into an inconsistent state. 476e6a543f8SRobert Watson */ 477e6a543f8SRobert Watson for (msghdr = msqkptr->u.msg_first; msghdr != NULL; 478e6a543f8SRobert Watson msghdr = msghdr->msg_next) { 479e6a543f8SRobert Watson error = mac_check_sysv_msgrmid(td->td_ucred, msghdr); 480e6a543f8SRobert Watson if (error != 0) { 481e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msgrmid returned %d\n", 482e6a543f8SRobert Watson error)); 483e6a543f8SRobert Watson goto done2; 484e6a543f8SRobert Watson } 485e6a543f8SRobert Watson } 486e6a543f8SRobert Watson #endif 487e6a543f8SRobert Watson 4883d903220SDoug Rabson /* Free the message headers */ 489921d05b9SRobert Watson msghdr = msqkptr->u.msg_first; 4903d903220SDoug Rabson while (msghdr != NULL) { 4913d903220SDoug Rabson struct msg *msghdr_tmp; 4923d903220SDoug Rabson 4933d903220SDoug Rabson /* Free the segments of each message */ 494921d05b9SRobert Watson msqkptr->u.msg_cbytes -= msghdr->msg_ts; 495921d05b9SRobert Watson msqkptr->u.msg_qnum--; 4963d903220SDoug Rabson msghdr_tmp = msghdr; 4973d903220SDoug Rabson msghdr = msghdr->msg_next; 4983d903220SDoug Rabson msg_freehdr(msghdr_tmp); 4993d903220SDoug Rabson } 5003d903220SDoug Rabson 501921d05b9SRobert Watson if (msqkptr->u.msg_cbytes != 0) 5023d903220SDoug Rabson panic("msg_cbytes is screwed up"); 503921d05b9SRobert Watson if (msqkptr->u.msg_qnum != 0) 5043d903220SDoug Rabson panic("msg_qnum is screwed up"); 5053d903220SDoug Rabson 506921d05b9SRobert Watson msqkptr->u.msg_qbytes = 0; /* Mark it as free */ 5073d903220SDoug Rabson 508e6a543f8SRobert Watson #ifdef MAC 509e6a543f8SRobert Watson mac_cleanup_sysv_msgqueue(msqkptr); 510e6a543f8SRobert Watson #endif 511e6a543f8SRobert Watson 512921d05b9SRobert Watson wakeup(msqkptr); 5133d903220SDoug Rabson } 5143d903220SDoug Rabson 5153d903220SDoug Rabson break; 5163d903220SDoug Rabson 5173d903220SDoug Rabson case IPC_SET: 518921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M))) 519b6a4b4f9SMatthew Dillon goto done2; 520f4b6eb04SMaxim Sobolev if (msqbuf->msg_qbytes > msqkptr->u.msg_qbytes) { 52144731cabSJohn Baldwin error = suser(td); 522b6a4b4f9SMatthew Dillon if (error) 523b6a4b4f9SMatthew Dillon goto done2; 52457c90d6fSPoul-Henning Kamp } 525f4b6eb04SMaxim Sobolev if (msqbuf->msg_qbytes > msginfo.msgmnb) { 526fd6d9be4SAlfred Perlstein DPRINTF(("can't increase msg_qbytes beyond %d" 527fd6d9be4SAlfred Perlstein "(truncating)\n", msginfo.msgmnb)); 528f4b6eb04SMaxim Sobolev msqbuf->msg_qbytes = msginfo.msgmnb; /* silently restrict qbytes to system limit */ 5293d903220SDoug Rabson } 530f4b6eb04SMaxim Sobolev if (msqbuf->msg_qbytes == 0) { 531fd6d9be4SAlfred Perlstein DPRINTF(("can't reduce msg_qbytes to 0\n")); 532b6a4b4f9SMatthew Dillon error = EINVAL; /* non-standard errno! */ 533b6a4b4f9SMatthew Dillon goto done2; 5343d903220SDoug Rabson } 535f4b6eb04SMaxim Sobolev msqkptr->u.msg_perm.uid = msqbuf->msg_perm.uid; /* change the owner */ 536f4b6eb04SMaxim Sobolev msqkptr->u.msg_perm.gid = msqbuf->msg_perm.gid; /* change the owner */ 537921d05b9SRobert Watson msqkptr->u.msg_perm.mode = (msqkptr->u.msg_perm.mode & ~0777) | 538f4b6eb04SMaxim Sobolev (msqbuf->msg_perm.mode & 0777); 539f4b6eb04SMaxim Sobolev msqkptr->u.msg_qbytes = msqbuf->msg_qbytes; 540921d05b9SRobert Watson msqkptr->u.msg_ctime = time_second; 5413d903220SDoug Rabson break; 5423d903220SDoug Rabson 5433d903220SDoug Rabson case IPC_STAT: 544921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) { 545fd6d9be4SAlfred Perlstein DPRINTF(("requester doesn't have read access\n")); 546b6a4b4f9SMatthew Dillon goto done2; 5473d903220SDoug Rabson } 548f4b6eb04SMaxim Sobolev *msqptr = &(msqkptr->u); 5493d903220SDoug Rabson break; 5503d903220SDoug Rabson 5513d903220SDoug Rabson default: 552fd6d9be4SAlfred Perlstein DPRINTF(("invalid command %d\n", cmd)); 553b6a4b4f9SMatthew Dillon error = EINVAL; 554b6a4b4f9SMatthew Dillon goto done2; 5553d903220SDoug Rabson } 5563d903220SDoug Rabson 557b6a4b4f9SMatthew Dillon if (error == 0) 558b40ce416SJulian Elischer td->td_retval[0] = rval; 559b6a4b4f9SMatthew Dillon done2: 5604b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 561b6a4b4f9SMatthew Dillon return(error); 5623d903220SDoug Rabson } 5633d903220SDoug Rabson 564b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_ 5653d903220SDoug Rabson struct msgget_args { 5663d903220SDoug Rabson key_t key; 5673d903220SDoug Rabson int msgflg; 5683d903220SDoug Rabson }; 569b5d5c0c9SPeter Wemm #endif 5703d903220SDoug Rabson 571b6a4b4f9SMatthew Dillon /* 572b6a4b4f9SMatthew Dillon * MPSAFE 573b6a4b4f9SMatthew Dillon */ 574b5d5c0c9SPeter Wemm int 575b40ce416SJulian Elischer msgget(td, uap) 576b40ce416SJulian Elischer struct thread *td; 5773d903220SDoug Rabson register struct msgget_args *uap; 5783d903220SDoug Rabson { 579b6a4b4f9SMatthew Dillon int msqid, error = 0; 5803d903220SDoug Rabson int key = uap->key; 5813d903220SDoug Rabson int msgflg = uap->msgflg; 582c6f55f33SJohn Baldwin struct ucred *cred = td->td_ucred; 583921d05b9SRobert Watson register struct msqid_kernel *msqkptr = NULL; 5843d903220SDoug Rabson 585fd6d9be4SAlfred Perlstein DPRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 5863d903220SDoug Rabson 587c6f55f33SJohn Baldwin if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 588c6f55f33SJohn Baldwin return (ENOSYS); 589cb1f0db9SRobert Watson 5904b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 5913d903220SDoug Rabson if (key != IPC_PRIVATE) { 5923d903220SDoug Rabson for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 593921d05b9SRobert Watson msqkptr = &msqids[msqid]; 594921d05b9SRobert Watson if (msqkptr->u.msg_qbytes != 0 && 595921d05b9SRobert Watson msqkptr->u.msg_perm.key == key) 5963d903220SDoug Rabson break; 5973d903220SDoug Rabson } 5983d903220SDoug Rabson if (msqid < msginfo.msgmni) { 599fd6d9be4SAlfred Perlstein DPRINTF(("found public key\n")); 6003d903220SDoug Rabson if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 601fd6d9be4SAlfred Perlstein DPRINTF(("not exclusive\n")); 602b6a4b4f9SMatthew Dillon error = EEXIST; 603b6a4b4f9SMatthew Dillon goto done2; 6043d903220SDoug Rabson } 605921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, 606921d05b9SRobert Watson msgflg & 0700))) { 607fd6d9be4SAlfred Perlstein DPRINTF(("requester doesn't have 0%o access\n", 608fd6d9be4SAlfred Perlstein msgflg & 0700)); 609b6a4b4f9SMatthew Dillon goto done2; 6103d903220SDoug Rabson } 611e6a543f8SRobert Watson #ifdef MAC 612e6a543f8SRobert Watson error = mac_check_sysv_msqget(cred, msqkptr); 613e6a543f8SRobert Watson if (error != 0) { 614e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msqget returned %d\n", 615e6a543f8SRobert Watson error)); 616e6a543f8SRobert Watson goto done2; 617e6a543f8SRobert Watson } 618e6a543f8SRobert Watson #endif 6193d903220SDoug Rabson goto found; 6203d903220SDoug Rabson } 6213d903220SDoug Rabson } 6223d903220SDoug Rabson 623fd6d9be4SAlfred Perlstein DPRINTF(("need to allocate the msqid_ds\n")); 6243d903220SDoug Rabson if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 6253d903220SDoug Rabson for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 6263d903220SDoug Rabson /* 6273d903220SDoug Rabson * Look for an unallocated and unlocked msqid_ds. 6283d903220SDoug Rabson * msqid_ds's can be locked by msgsnd or msgrcv while 6293d903220SDoug Rabson * they are copying the message in/out. We can't 6303d903220SDoug Rabson * re-use the entry until they release it. 6313d903220SDoug Rabson */ 632921d05b9SRobert Watson msqkptr = &msqids[msqid]; 633921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0 && 634921d05b9SRobert Watson (msqkptr->u.msg_perm.mode & MSG_LOCKED) == 0) 6353d903220SDoug Rabson break; 6363d903220SDoug Rabson } 6373d903220SDoug Rabson if (msqid == msginfo.msgmni) { 638fd6d9be4SAlfred Perlstein DPRINTF(("no more msqid_ds's available\n")); 639b6a4b4f9SMatthew Dillon error = ENOSPC; 640b6a4b4f9SMatthew Dillon goto done2; 6413d903220SDoug Rabson } 642fd6d9be4SAlfred Perlstein DPRINTF(("msqid %d is available\n", msqid)); 643921d05b9SRobert Watson msqkptr->u.msg_perm.key = key; 644921d05b9SRobert Watson msqkptr->u.msg_perm.cuid = cred->cr_uid; 645921d05b9SRobert Watson msqkptr->u.msg_perm.uid = cred->cr_uid; 646921d05b9SRobert Watson msqkptr->u.msg_perm.cgid = cred->cr_gid; 647921d05b9SRobert Watson msqkptr->u.msg_perm.gid = cred->cr_gid; 648921d05b9SRobert Watson msqkptr->u.msg_perm.mode = (msgflg & 0777); 6493d903220SDoug Rabson /* Make sure that the returned msqid is unique */ 650921d05b9SRobert Watson msqkptr->u.msg_perm.seq = (msqkptr->u.msg_perm.seq + 1) & 0x7fff; 651921d05b9SRobert Watson msqkptr->u.msg_first = NULL; 652921d05b9SRobert Watson msqkptr->u.msg_last = NULL; 653921d05b9SRobert Watson msqkptr->u.msg_cbytes = 0; 654921d05b9SRobert Watson msqkptr->u.msg_qnum = 0; 655921d05b9SRobert Watson msqkptr->u.msg_qbytes = msginfo.msgmnb; 656921d05b9SRobert Watson msqkptr->u.msg_lspid = 0; 657921d05b9SRobert Watson msqkptr->u.msg_lrpid = 0; 658921d05b9SRobert Watson msqkptr->u.msg_stime = 0; 659921d05b9SRobert Watson msqkptr->u.msg_rtime = 0; 660921d05b9SRobert Watson msqkptr->u.msg_ctime = time_second; 661e6a543f8SRobert Watson #ifdef MAC 662e6a543f8SRobert Watson mac_create_sysv_msgqueue(cred, msqkptr); 663e6a543f8SRobert Watson #endif 6643d903220SDoug Rabson } else { 665fd6d9be4SAlfred Perlstein DPRINTF(("didn't find it and wasn't asked to create it\n")); 666b6a4b4f9SMatthew Dillon error = ENOENT; 667b6a4b4f9SMatthew Dillon goto done2; 6683d903220SDoug Rabson } 6693d903220SDoug Rabson 6703d903220SDoug Rabson found: 6713d903220SDoug Rabson /* Construct the unique msqid */ 672921d05b9SRobert Watson td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqkptr->u.msg_perm); 673b6a4b4f9SMatthew Dillon done2: 6744b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 675b6a4b4f9SMatthew Dillon return (error); 6763d903220SDoug Rabson } 6773d903220SDoug Rabson 678b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_ 6793d903220SDoug Rabson struct msgsnd_args { 6803d903220SDoug Rabson int msqid; 681b17c9cfaSAlfred Perlstein const void *msgp; 6823d903220SDoug Rabson size_t msgsz; 6833d903220SDoug Rabson int msgflg; 6843d903220SDoug Rabson }; 685b5d5c0c9SPeter Wemm #endif 6863d903220SDoug Rabson 687b6a4b4f9SMatthew Dillon /* 688b6a4b4f9SMatthew Dillon * MPSAFE 689b6a4b4f9SMatthew Dillon */ 690b5d5c0c9SPeter Wemm int 691b40ce416SJulian Elischer msgsnd(td, uap) 692b40ce416SJulian Elischer struct thread *td; 6933d903220SDoug Rabson register struct msgsnd_args *uap; 6943d903220SDoug Rabson { 6953d903220SDoug Rabson int msqid = uap->msqid; 696b17c9cfaSAlfred Perlstein const void *user_msgp = uap->msgp; 6973d903220SDoug Rabson size_t msgsz = uap->msgsz; 6983d903220SDoug Rabson int msgflg = uap->msgflg; 699b6a4b4f9SMatthew Dillon int segs_needed, error = 0; 700921d05b9SRobert Watson register struct msqid_kernel *msqkptr; 7013d903220SDoug Rabson register struct msg *msghdr; 7023d903220SDoug Rabson short next; 7033d903220SDoug Rabson 704fd6d9be4SAlfred Perlstein DPRINTF(("call to msgsnd(%d, 0x%x, %d, %d)\n", msqid, user_msgp, msgsz, 705fd6d9be4SAlfred Perlstein msgflg)); 706c6f55f33SJohn Baldwin if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 707c6f55f33SJohn Baldwin return (ENOSYS); 708cb1f0db9SRobert Watson 7094b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 7103d903220SDoug Rabson msqid = IPCID_TO_IX(msqid); 7113d903220SDoug Rabson 7123d903220SDoug Rabson if (msqid < 0 || msqid >= msginfo.msgmni) { 713fd6d9be4SAlfred Perlstein DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 714fd6d9be4SAlfred Perlstein msginfo.msgmni)); 715b6a4b4f9SMatthew Dillon error = EINVAL; 716b6a4b4f9SMatthew Dillon goto done2; 7173d903220SDoug Rabson } 7183d903220SDoug Rabson 719921d05b9SRobert Watson msqkptr = &msqids[msqid]; 720921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0) { 721fd6d9be4SAlfred Perlstein DPRINTF(("no such message queue id\n")); 722b6a4b4f9SMatthew Dillon error = EINVAL; 723b6a4b4f9SMatthew Dillon goto done2; 7243d903220SDoug Rabson } 725921d05b9SRobert Watson if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 726fd6d9be4SAlfred Perlstein DPRINTF(("wrong sequence number\n")); 727b6a4b4f9SMatthew Dillon error = EINVAL; 728b6a4b4f9SMatthew Dillon goto done2; 7293d903220SDoug Rabson } 7303d903220SDoug Rabson 731921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_W))) { 732fd6d9be4SAlfred Perlstein DPRINTF(("requester doesn't have write access\n")); 733b6a4b4f9SMatthew Dillon goto done2; 7343d903220SDoug Rabson } 7353d903220SDoug Rabson 736e6a543f8SRobert Watson #ifdef MAC 737e6a543f8SRobert Watson error = mac_check_sysv_msqsnd(td->td_ucred, msqkptr); 738e6a543f8SRobert Watson if (error != 0) { 739e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msqsnd returned %d\n", error)); 740e6a543f8SRobert Watson goto done2; 741e6a543f8SRobert Watson } 742e6a543f8SRobert Watson #endif 743e6a543f8SRobert Watson 7443d903220SDoug Rabson segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 745fd6d9be4SAlfred Perlstein DPRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, msginfo.msgssz, 746fd6d9be4SAlfred Perlstein segs_needed)); 7473d903220SDoug Rabson for (;;) { 7483d903220SDoug Rabson int need_more_resources = 0; 7493d903220SDoug Rabson 7503d903220SDoug Rabson /* 7513d903220SDoug Rabson * check msgsz 7523d903220SDoug Rabson * (inside this loop in case msg_qbytes changes while we sleep) 7533d903220SDoug Rabson */ 7543d903220SDoug Rabson 755921d05b9SRobert Watson if (msgsz > msqkptr->u.msg_qbytes) { 756921d05b9SRobert Watson DPRINTF(("msgsz > msqkptr->u.msg_qbytes\n")); 757b6a4b4f9SMatthew Dillon error = EINVAL; 758b6a4b4f9SMatthew Dillon goto done2; 7593d903220SDoug Rabson } 7603d903220SDoug Rabson 761921d05b9SRobert Watson if (msqkptr->u.msg_perm.mode & MSG_LOCKED) { 762fd6d9be4SAlfred Perlstein DPRINTF(("msqid is locked\n")); 7633d903220SDoug Rabson need_more_resources = 1; 7643d903220SDoug Rabson } 765921d05b9SRobert Watson if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) { 766fd6d9be4SAlfred Perlstein DPRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 7673d903220SDoug Rabson need_more_resources = 1; 7683d903220SDoug Rabson } 7693d903220SDoug Rabson if (segs_needed > nfree_msgmaps) { 770fd6d9be4SAlfred Perlstein DPRINTF(("segs_needed > nfree_msgmaps\n")); 7713d903220SDoug Rabson need_more_resources = 1; 7723d903220SDoug Rabson } 7733d903220SDoug Rabson if (free_msghdrs == NULL) { 774fd6d9be4SAlfred Perlstein DPRINTF(("no more msghdrs\n")); 7753d903220SDoug Rabson need_more_resources = 1; 7763d903220SDoug Rabson } 7773d903220SDoug Rabson 7783d903220SDoug Rabson if (need_more_resources) { 7793d903220SDoug Rabson int we_own_it; 7803d903220SDoug Rabson 7813d903220SDoug Rabson if ((msgflg & IPC_NOWAIT) != 0) { 782fd6d9be4SAlfred Perlstein DPRINTF(("need more resources but caller " 783fd6d9be4SAlfred Perlstein "doesn't want to wait\n")); 784b6a4b4f9SMatthew Dillon error = EAGAIN; 785b6a4b4f9SMatthew Dillon goto done2; 7863d903220SDoug Rabson } 7873d903220SDoug Rabson 788921d05b9SRobert Watson if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) { 789fd6d9be4SAlfred Perlstein DPRINTF(("we don't own the msqid_ds\n")); 7903d903220SDoug Rabson we_own_it = 0; 7913d903220SDoug Rabson } else { 7923d903220SDoug Rabson /* Force later arrivals to wait for our 7933d903220SDoug Rabson request */ 794fd6d9be4SAlfred Perlstein DPRINTF(("we own the msqid_ds\n")); 795921d05b9SRobert Watson msqkptr->u.msg_perm.mode |= MSG_LOCKED; 7963d903220SDoug Rabson we_own_it = 1; 7973d903220SDoug Rabson } 798fd6d9be4SAlfred Perlstein DPRINTF(("goodnight\n")); 799921d05b9SRobert Watson error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH, 8003d903220SDoug Rabson "msgwait", 0); 801fd6d9be4SAlfred Perlstein DPRINTF(("good morning, error=%d\n", error)); 8023d903220SDoug Rabson if (we_own_it) 803921d05b9SRobert Watson msqkptr->u.msg_perm.mode &= ~MSG_LOCKED; 804b6a4b4f9SMatthew Dillon if (error != 0) { 805fd6d9be4SAlfred Perlstein DPRINTF(("msgsnd: interrupted system call\n")); 806b6a4b4f9SMatthew Dillon error = EINTR; 807b6a4b4f9SMatthew Dillon goto done2; 8083d903220SDoug Rabson } 8093d903220SDoug Rabson 8103d903220SDoug Rabson /* 8113d903220SDoug Rabson * Make sure that the msq queue still exists 8123d903220SDoug Rabson */ 8133d903220SDoug Rabson 814921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0) { 815fd6d9be4SAlfred Perlstein DPRINTF(("msqid deleted\n")); 816b6a4b4f9SMatthew Dillon error = EIDRM; 817b6a4b4f9SMatthew Dillon goto done2; 8183d903220SDoug Rabson } 8193d903220SDoug Rabson 8203d903220SDoug Rabson } else { 821fd6d9be4SAlfred Perlstein DPRINTF(("got all the resources that we need\n")); 8223d903220SDoug Rabson break; 8233d903220SDoug Rabson } 8243d903220SDoug Rabson } 8253d903220SDoug Rabson 8263d903220SDoug Rabson /* 8273d903220SDoug Rabson * We have the resources that we need. 8283d903220SDoug Rabson * Make sure! 8293d903220SDoug Rabson */ 8303d903220SDoug Rabson 831921d05b9SRobert Watson if (msqkptr->u.msg_perm.mode & MSG_LOCKED) 8323d903220SDoug Rabson panic("msg_perm.mode & MSG_LOCKED"); 8333d903220SDoug Rabson if (segs_needed > nfree_msgmaps) 8343d903220SDoug Rabson panic("segs_needed > nfree_msgmaps"); 835921d05b9SRobert Watson if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) 8363d903220SDoug Rabson panic("msgsz + msg_cbytes > msg_qbytes"); 8373d903220SDoug Rabson if (free_msghdrs == NULL) 8383d903220SDoug Rabson panic("no more msghdrs"); 8393d903220SDoug Rabson 8403d903220SDoug Rabson /* 8413d903220SDoug Rabson * Re-lock the msqid_ds in case we page-fault when copying in the 8423d903220SDoug Rabson * message 8433d903220SDoug Rabson */ 8443d903220SDoug Rabson 845921d05b9SRobert Watson if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) 8463d903220SDoug Rabson panic("msqid_ds is already locked"); 847921d05b9SRobert Watson msqkptr->u.msg_perm.mode |= MSG_LOCKED; 8483d903220SDoug Rabson 8493d903220SDoug Rabson /* 8503d903220SDoug Rabson * Allocate a message header 8513d903220SDoug Rabson */ 8523d903220SDoug Rabson 8533d903220SDoug Rabson msghdr = free_msghdrs; 8543d903220SDoug Rabson free_msghdrs = msghdr->msg_next; 8553d903220SDoug Rabson msghdr->msg_spot = -1; 8563d903220SDoug Rabson msghdr->msg_ts = msgsz; 857e6a543f8SRobert Watson #ifdef MAC 858e6a543f8SRobert Watson /* 859e6a543f8SRobert Watson * XXXMAC: Should the mac_check_sysv_msgmsq check follow here 860e6a543f8SRobert Watson * immediately? Or, should it be checked just before the msg is 861e6a543f8SRobert Watson * enqueued in the msgq (as it is done now)? 862e6a543f8SRobert Watson */ 863e6a543f8SRobert Watson mac_create_sysv_msgmsg(td->td_ucred, msqkptr, msghdr); 864e6a543f8SRobert Watson #endif 8653d903220SDoug Rabson 8663d903220SDoug Rabson /* 8673d903220SDoug Rabson * Allocate space for the message 8683d903220SDoug Rabson */ 8693d903220SDoug Rabson 8703d903220SDoug Rabson while (segs_needed > 0) { 8713d903220SDoug Rabson if (nfree_msgmaps <= 0) 8723d903220SDoug Rabson panic("not enough msgmaps"); 8733d903220SDoug Rabson if (free_msgmaps == -1) 8743d903220SDoug Rabson panic("nil free_msgmaps"); 8753d903220SDoug Rabson next = free_msgmaps; 8763d903220SDoug Rabson if (next <= -1) 8773d903220SDoug Rabson panic("next too low #1"); 8783d903220SDoug Rabson if (next >= msginfo.msgseg) 8793d903220SDoug Rabson panic("next out of range #1"); 880fd6d9be4SAlfred Perlstein DPRINTF(("allocating segment %d to message\n", next)); 8813d903220SDoug Rabson free_msgmaps = msgmaps[next].next; 8823d903220SDoug Rabson nfree_msgmaps--; 8833d903220SDoug Rabson msgmaps[next].next = msghdr->msg_spot; 8843d903220SDoug Rabson msghdr->msg_spot = next; 8853d903220SDoug Rabson segs_needed--; 8863d903220SDoug Rabson } 8873d903220SDoug Rabson 8883d903220SDoug Rabson /* 8893d903220SDoug Rabson * Copy in the message type 8903d903220SDoug Rabson */ 8913d903220SDoug Rabson 8924b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 893b6a4b4f9SMatthew Dillon if ((error = copyin(user_msgp, &msghdr->msg_type, 8943d903220SDoug Rabson sizeof(msghdr->msg_type))) != 0) { 8954b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 896fd6d9be4SAlfred Perlstein DPRINTF(("error %d copying the message type\n", error)); 8973d903220SDoug Rabson msg_freehdr(msghdr); 898921d05b9SRobert Watson msqkptr->u.msg_perm.mode &= ~MSG_LOCKED; 899921d05b9SRobert Watson wakeup(msqkptr); 900b6a4b4f9SMatthew Dillon goto done2; 9013d903220SDoug Rabson } 9024b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 903ca315837SAlfred Perlstein user_msgp = (const char *)user_msgp + sizeof(msghdr->msg_type); 9043d903220SDoug Rabson 9053d903220SDoug Rabson /* 9063d903220SDoug Rabson * Validate the message type 9073d903220SDoug Rabson */ 9083d903220SDoug Rabson 9093d903220SDoug Rabson if (msghdr->msg_type < 1) { 9103d903220SDoug Rabson msg_freehdr(msghdr); 911921d05b9SRobert Watson msqkptr->u.msg_perm.mode &= ~MSG_LOCKED; 912921d05b9SRobert Watson wakeup(msqkptr); 913fd6d9be4SAlfred Perlstein DPRINTF(("mtype (%d) < 1\n", msghdr->msg_type)); 914b6a4b4f9SMatthew Dillon error = EINVAL; 915b6a4b4f9SMatthew Dillon goto done2; 9163d903220SDoug Rabson } 9173d903220SDoug Rabson 9183d903220SDoug Rabson /* 9193d903220SDoug Rabson * Copy in the message body 9203d903220SDoug Rabson */ 9213d903220SDoug Rabson 9223d903220SDoug Rabson next = msghdr->msg_spot; 9233d903220SDoug Rabson while (msgsz > 0) { 9243d903220SDoug Rabson size_t tlen; 9253d903220SDoug Rabson if (msgsz > msginfo.msgssz) 9263d903220SDoug Rabson tlen = msginfo.msgssz; 9273d903220SDoug Rabson else 9283d903220SDoug Rabson tlen = msgsz; 9293d903220SDoug Rabson if (next <= -1) 9303d903220SDoug Rabson panic("next too low #2"); 9313d903220SDoug Rabson if (next >= msginfo.msgseg) 9323d903220SDoug Rabson panic("next out of range #2"); 9334b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 934b6a4b4f9SMatthew Dillon if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 9353d903220SDoug Rabson tlen)) != 0) { 9364b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 937fd6d9be4SAlfred Perlstein DPRINTF(("error %d copying in message segment\n", 938fd6d9be4SAlfred Perlstein error)); 9393d903220SDoug Rabson msg_freehdr(msghdr); 940921d05b9SRobert Watson msqkptr->u.msg_perm.mode &= ~MSG_LOCKED; 941921d05b9SRobert Watson wakeup(msqkptr); 942b6a4b4f9SMatthew Dillon goto done2; 9433d903220SDoug Rabson } 9444b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 9453d903220SDoug Rabson msgsz -= tlen; 946ca315837SAlfred Perlstein user_msgp = (const char *)user_msgp + tlen; 9473d903220SDoug Rabson next = msgmaps[next].next; 9483d903220SDoug Rabson } 9493d903220SDoug Rabson if (next != -1) 9503d903220SDoug Rabson panic("didn't use all the msg segments"); 9513d903220SDoug Rabson 9523d903220SDoug Rabson /* 9533d903220SDoug Rabson * We've got the message. Unlock the msqid_ds. 9543d903220SDoug Rabson */ 9553d903220SDoug Rabson 956921d05b9SRobert Watson msqkptr->u.msg_perm.mode &= ~MSG_LOCKED; 9573d903220SDoug Rabson 9583d903220SDoug Rabson /* 9593d903220SDoug Rabson * Make sure that the msqid_ds is still allocated. 9603d903220SDoug Rabson */ 9613d903220SDoug Rabson 962921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0) { 9633d903220SDoug Rabson msg_freehdr(msghdr); 964921d05b9SRobert Watson wakeup(msqkptr); 965b6a4b4f9SMatthew Dillon error = EIDRM; 966b6a4b4f9SMatthew Dillon goto done2; 9673d903220SDoug Rabson } 9683d903220SDoug Rabson 969e6a543f8SRobert Watson #ifdef MAC 970e6a543f8SRobert Watson /* 971e6a543f8SRobert Watson * Note: Since the task/thread allocates the msghdr and usually 972e6a543f8SRobert Watson * primes it with its own MAC label, for a majority of policies, it 973e6a543f8SRobert Watson * won't be necessary to check whether the msghdr has access 974e6a543f8SRobert Watson * permissions to the msgq. The mac_check_sysv_msqsnd check would 975e6a543f8SRobert Watson * suffice in that case. However, this hook may be required where 976e6a543f8SRobert Watson * individual policies derive a non-identical label for the msghdr 977e6a543f8SRobert Watson * from the current thread label and may want to check the msghdr 978e6a543f8SRobert Watson * enqueue permissions, along with read/write permissions to the 979e6a543f8SRobert Watson * msgq. 980e6a543f8SRobert Watson */ 981e6a543f8SRobert Watson error = mac_check_sysv_msgmsq(td->td_ucred, msghdr, msqkptr); 982e6a543f8SRobert Watson if (error != 0) { 983e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msqmsq returned %d\n", error)); 984e6a543f8SRobert Watson msg_freehdr(msghdr); 985e6a543f8SRobert Watson wakeup(msqkptr); 986e6a543f8SRobert Watson goto done2; 987e6a543f8SRobert Watson } 988e6a543f8SRobert Watson #endif 989e6a543f8SRobert Watson 9903d903220SDoug Rabson /* 9913d903220SDoug Rabson * Put the message into the queue 9923d903220SDoug Rabson */ 993921d05b9SRobert Watson if (msqkptr->u.msg_first == NULL) { 994921d05b9SRobert Watson msqkptr->u.msg_first = msghdr; 995921d05b9SRobert Watson msqkptr->u.msg_last = msghdr; 9963d903220SDoug Rabson } else { 997921d05b9SRobert Watson msqkptr->u.msg_last->msg_next = msghdr; 998921d05b9SRobert Watson msqkptr->u.msg_last = msghdr; 9993d903220SDoug Rabson } 1000921d05b9SRobert Watson msqkptr->u.msg_last->msg_next = NULL; 10013d903220SDoug Rabson 1002921d05b9SRobert Watson msqkptr->u.msg_cbytes += msghdr->msg_ts; 1003921d05b9SRobert Watson msqkptr->u.msg_qnum++; 1004921d05b9SRobert Watson msqkptr->u.msg_lspid = td->td_proc->p_pid; 1005921d05b9SRobert Watson msqkptr->u.msg_stime = time_second; 10063d903220SDoug Rabson 1007921d05b9SRobert Watson wakeup(msqkptr); 1008b40ce416SJulian Elischer td->td_retval[0] = 0; 1009b6a4b4f9SMatthew Dillon done2: 10104b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 1011b6a4b4f9SMatthew Dillon return (error); 10123d903220SDoug Rabson } 10133d903220SDoug Rabson 1014b5d5c0c9SPeter Wemm #ifndef _SYS_SYSPROTO_H_ 10153d903220SDoug Rabson struct msgrcv_args { 10163d903220SDoug Rabson int msqid; 10173d903220SDoug Rabson void *msgp; 10183d903220SDoug Rabson size_t msgsz; 10193d903220SDoug Rabson long msgtyp; 10203d903220SDoug Rabson int msgflg; 10213d903220SDoug Rabson }; 1022b5d5c0c9SPeter Wemm #endif 10233d903220SDoug Rabson 1024b6a4b4f9SMatthew Dillon /* 1025b6a4b4f9SMatthew Dillon * MPSAFE 1026b6a4b4f9SMatthew Dillon */ 1027b5d5c0c9SPeter Wemm int 1028b40ce416SJulian Elischer msgrcv(td, uap) 1029b40ce416SJulian Elischer struct thread *td; 10303d903220SDoug Rabson register struct msgrcv_args *uap; 10313d903220SDoug Rabson { 10323d903220SDoug Rabson int msqid = uap->msqid; 10333d903220SDoug Rabson void *user_msgp = uap->msgp; 10343d903220SDoug Rabson size_t msgsz = uap->msgsz; 10353d903220SDoug Rabson long msgtyp = uap->msgtyp; 10363d903220SDoug Rabson int msgflg = uap->msgflg; 10373d903220SDoug Rabson size_t len; 1038921d05b9SRobert Watson register struct msqid_kernel *msqkptr; 10393d903220SDoug Rabson register struct msg *msghdr; 1040b6a4b4f9SMatthew Dillon int error = 0; 10413d903220SDoug Rabson short next; 10423d903220SDoug Rabson 1043fd6d9be4SAlfred Perlstein DPRINTF(("call to msgrcv(%d, 0x%x, %d, %ld, %d)\n", msqid, user_msgp, 1044fd6d9be4SAlfred Perlstein msgsz, msgtyp, msgflg)); 10453d903220SDoug Rabson 1046c6f55f33SJohn Baldwin if (!jail_sysvipc_allowed && jailed(td->td_ucred)) 1047c6f55f33SJohn Baldwin return (ENOSYS); 1048cb1f0db9SRobert Watson 10493d903220SDoug Rabson msqid = IPCID_TO_IX(msqid); 10503d903220SDoug Rabson 10513d903220SDoug Rabson if (msqid < 0 || msqid >= msginfo.msgmni) { 1052fd6d9be4SAlfred Perlstein DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 1053fd6d9be4SAlfred Perlstein msginfo.msgmni)); 10544b6ef3a1SAlfred Perlstein return (EINVAL); 10553d903220SDoug Rabson } 10563d903220SDoug Rabson 1057921d05b9SRobert Watson msqkptr = &msqids[msqid]; 10584b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 1059921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0) { 1060fd6d9be4SAlfred Perlstein DPRINTF(("no such message queue id\n")); 1061b6a4b4f9SMatthew Dillon error = EINVAL; 1062b6a4b4f9SMatthew Dillon goto done2; 10633d903220SDoug Rabson } 1064921d05b9SRobert Watson if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 1065fd6d9be4SAlfred Perlstein DPRINTF(("wrong sequence number\n")); 1066b6a4b4f9SMatthew Dillon error = EINVAL; 1067b6a4b4f9SMatthew Dillon goto done2; 10683d903220SDoug Rabson } 10693d903220SDoug Rabson 1070921d05b9SRobert Watson if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) { 1071fd6d9be4SAlfred Perlstein DPRINTF(("requester doesn't have read access\n")); 1072b6a4b4f9SMatthew Dillon goto done2; 10733d903220SDoug Rabson } 10743d903220SDoug Rabson 1075e6a543f8SRobert Watson #ifdef MAC 1076e6a543f8SRobert Watson error = mac_check_sysv_msqrcv(td->td_ucred, msqkptr); 1077e6a543f8SRobert Watson if (error != 0) { 1078e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msqrcv returned %d\n", error)); 1079e6a543f8SRobert Watson goto done2; 1080e6a543f8SRobert Watson } 1081e6a543f8SRobert Watson #endif 1082e6a543f8SRobert Watson 10833d903220SDoug Rabson msghdr = NULL; 10843d903220SDoug Rabson while (msghdr == NULL) { 10853d903220SDoug Rabson if (msgtyp == 0) { 1086921d05b9SRobert Watson msghdr = msqkptr->u.msg_first; 10873d903220SDoug Rabson if (msghdr != NULL) { 10883d903220SDoug Rabson if (msgsz < msghdr->msg_ts && 10893d903220SDoug Rabson (msgflg & MSG_NOERROR) == 0) { 1090fd6d9be4SAlfred Perlstein DPRINTF(("first message on the queue " 1091fd6d9be4SAlfred Perlstein "is too big (want %d, got %d)\n", 1092fd6d9be4SAlfred Perlstein msgsz, msghdr->msg_ts)); 1093b6a4b4f9SMatthew Dillon error = E2BIG; 1094b6a4b4f9SMatthew Dillon goto done2; 10953d903220SDoug Rabson } 1096e6a543f8SRobert Watson #ifdef MAC 1097e6a543f8SRobert Watson error = mac_check_sysv_msgrcv(td->td_ucred, 1098e6a543f8SRobert Watson msghdr); 1099e6a543f8SRobert Watson if (error != 0) { 1100e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_msgrcv " 1101e6a543f8SRobert Watson "returned %d\n", error)); 1102e6a543f8SRobert Watson goto done2; 1103e6a543f8SRobert Watson } 1104e6a543f8SRobert Watson #endif 1105921d05b9SRobert Watson if (msqkptr->u.msg_first == msqkptr->u.msg_last) { 1106921d05b9SRobert Watson msqkptr->u.msg_first = NULL; 1107921d05b9SRobert Watson msqkptr->u.msg_last = NULL; 11083d903220SDoug Rabson } else { 1109921d05b9SRobert Watson msqkptr->u.msg_first = msghdr->msg_next; 1110921d05b9SRobert Watson if (msqkptr->u.msg_first == NULL) 11113d903220SDoug Rabson panic("msg_first/last screwed up #1"); 11123d903220SDoug Rabson } 11133d903220SDoug Rabson } 11143d903220SDoug Rabson } else { 11153d903220SDoug Rabson struct msg *previous; 11163d903220SDoug Rabson struct msg **prev; 11173d903220SDoug Rabson 11183d903220SDoug Rabson previous = NULL; 1119921d05b9SRobert Watson prev = &(msqkptr->u.msg_first); 11203d903220SDoug Rabson while ((msghdr = *prev) != NULL) { 11213d903220SDoug Rabson /* 11223d903220SDoug Rabson * Is this message's type an exact match or is 11233d903220SDoug Rabson * this message's type less than or equal to 11243d903220SDoug Rabson * the absolute value of a negative msgtyp? 11253d903220SDoug Rabson * Note that the second half of this test can 11263d903220SDoug Rabson * NEVER be true if msgtyp is positive since 11273d903220SDoug Rabson * msg_type is always positive! 11283d903220SDoug Rabson */ 11293d903220SDoug Rabson 11303d903220SDoug Rabson if (msgtyp == msghdr->msg_type || 11313d903220SDoug Rabson msghdr->msg_type <= -msgtyp) { 1132fd6d9be4SAlfred Perlstein DPRINTF(("found message type %d, " 1133fd6d9be4SAlfred Perlstein "requested %d\n", 1134fd6d9be4SAlfred Perlstein msghdr->msg_type, msgtyp)); 11353d903220SDoug Rabson if (msgsz < msghdr->msg_ts && 11363d903220SDoug Rabson (msgflg & MSG_NOERROR) == 0) { 1137fd6d9be4SAlfred Perlstein DPRINTF(("requested message " 1138fd6d9be4SAlfred Perlstein "on the queue is too big " 1139fd6d9be4SAlfred Perlstein "(want %d, got %d)\n", 1140fd6d9be4SAlfred Perlstein msgsz, msghdr->msg_ts)); 1141b6a4b4f9SMatthew Dillon error = E2BIG; 1142b6a4b4f9SMatthew Dillon goto done2; 11433d903220SDoug Rabson } 1144e6a543f8SRobert Watson #ifdef MAC 1145e6a543f8SRobert Watson error = mac_check_sysv_msgrcv( 1146e6a543f8SRobert Watson td->td_ucred, msghdr); 1147e6a543f8SRobert Watson if (error != 0) { 1148e6a543f8SRobert Watson MPRINTF(("mac_check_sysv_" 1149e6a543f8SRobert Watson "msgrcv returned %d\n", 1150e6a543f8SRobert Watson error)); 1151e6a543f8SRobert Watson goto done2; 1152e6a543f8SRobert Watson } 1153e6a543f8SRobert Watson #endif 11543d903220SDoug Rabson *prev = msghdr->msg_next; 1155921d05b9SRobert Watson if (msghdr == msqkptr->u.msg_last) { 11563d903220SDoug Rabson if (previous == NULL) { 11573d903220SDoug Rabson if (prev != 1158921d05b9SRobert Watson &msqkptr->u.msg_first) 11593d903220SDoug Rabson panic("msg_first/last screwed up #2"); 1160921d05b9SRobert Watson msqkptr->u.msg_first = 11613d903220SDoug Rabson NULL; 1162921d05b9SRobert Watson msqkptr->u.msg_last = 11633d903220SDoug Rabson NULL; 11643d903220SDoug Rabson } else { 11653d903220SDoug Rabson if (prev == 1166921d05b9SRobert Watson &msqkptr->u.msg_first) 11673d903220SDoug Rabson panic("msg_first/last screwed up #3"); 1168921d05b9SRobert Watson msqkptr->u.msg_last = 11693d903220SDoug Rabson previous; 11703d903220SDoug Rabson } 11713d903220SDoug Rabson } 11723d903220SDoug Rabson break; 11733d903220SDoug Rabson } 11743d903220SDoug Rabson previous = msghdr; 11753d903220SDoug Rabson prev = &(msghdr->msg_next); 11763d903220SDoug Rabson } 11773d903220SDoug Rabson } 11783d903220SDoug Rabson 11793d903220SDoug Rabson /* 11803d903220SDoug Rabson * We've either extracted the msghdr for the appropriate 11813d903220SDoug Rabson * message or there isn't one. 11823d903220SDoug Rabson * If there is one then bail out of this loop. 11833d903220SDoug Rabson */ 11843d903220SDoug Rabson 11853d903220SDoug Rabson if (msghdr != NULL) 11863d903220SDoug Rabson break; 11873d903220SDoug Rabson 11883d903220SDoug Rabson /* 11893d903220SDoug Rabson * Hmph! No message found. Does the user want to wait? 11903d903220SDoug Rabson */ 11913d903220SDoug Rabson 11923d903220SDoug Rabson if ((msgflg & IPC_NOWAIT) != 0) { 1193fd6d9be4SAlfred Perlstein DPRINTF(("no appropriate message found (msgtyp=%d)\n", 1194fd6d9be4SAlfred Perlstein msgtyp)); 11953d903220SDoug Rabson /* The SVID says to return ENOMSG. */ 1196b6a4b4f9SMatthew Dillon error = ENOMSG; 1197b6a4b4f9SMatthew Dillon goto done2; 11983d903220SDoug Rabson } 11993d903220SDoug Rabson 12003d903220SDoug Rabson /* 12013d903220SDoug Rabson * Wait for something to happen 12023d903220SDoug Rabson */ 12033d903220SDoug Rabson 1204fd6d9be4SAlfred Perlstein DPRINTF(("msgrcv: goodnight\n")); 1205921d05b9SRobert Watson error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH, 12064b6ef3a1SAlfred Perlstein "msgwait", 0); 1207fd6d9be4SAlfred Perlstein DPRINTF(("msgrcv: good morning (error=%d)\n", error)); 12083d903220SDoug Rabson 1209b6a4b4f9SMatthew Dillon if (error != 0) { 1210fd6d9be4SAlfred Perlstein DPRINTF(("msgsnd: interrupted system call\n")); 1211b6a4b4f9SMatthew Dillon error = EINTR; 1212b6a4b4f9SMatthew Dillon goto done2; 12133d903220SDoug Rabson } 12143d903220SDoug Rabson 12153d903220SDoug Rabson /* 12163d903220SDoug Rabson * Make sure that the msq queue still exists 12173d903220SDoug Rabson */ 12183d903220SDoug Rabson 1219921d05b9SRobert Watson if (msqkptr->u.msg_qbytes == 0 || 1220921d05b9SRobert Watson msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(uap->msqid)) { 1221fd6d9be4SAlfred Perlstein DPRINTF(("msqid deleted\n")); 1222b6a4b4f9SMatthew Dillon error = EIDRM; 1223b6a4b4f9SMatthew Dillon goto done2; 12243d903220SDoug Rabson } 12253d903220SDoug Rabson } 12263d903220SDoug Rabson 12273d903220SDoug Rabson /* 12283d903220SDoug Rabson * Return the message to the user. 12293d903220SDoug Rabson * 12303d903220SDoug Rabson * First, do the bookkeeping (before we risk being interrupted). 12313d903220SDoug Rabson */ 12323d903220SDoug Rabson 1233921d05b9SRobert Watson msqkptr->u.msg_cbytes -= msghdr->msg_ts; 1234921d05b9SRobert Watson msqkptr->u.msg_qnum--; 1235921d05b9SRobert Watson msqkptr->u.msg_lrpid = td->td_proc->p_pid; 1236921d05b9SRobert Watson msqkptr->u.msg_rtime = time_second; 12373d903220SDoug Rabson 12383d903220SDoug Rabson /* 12393d903220SDoug Rabson * Make msgsz the actual amount that we'll be returning. 12403d903220SDoug Rabson * Note that this effectively truncates the message if it is too long 12413d903220SDoug Rabson * (since msgsz is never increased). 12423d903220SDoug Rabson */ 12433d903220SDoug Rabson 1244fd6d9be4SAlfred Perlstein DPRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 1245fd6d9be4SAlfred Perlstein msghdr->msg_ts)); 12463d903220SDoug Rabson if (msgsz > msghdr->msg_ts) 12473d903220SDoug Rabson msgsz = msghdr->msg_ts; 12483d903220SDoug Rabson 12493d903220SDoug Rabson /* 12503d903220SDoug Rabson * Return the type to the user. 12513d903220SDoug Rabson */ 12523d903220SDoug Rabson 12534b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 12542cc593fdSAlfred Perlstein error = copyout(&(msghdr->msg_type), user_msgp, 12553d903220SDoug Rabson sizeof(msghdr->msg_type)); 12564b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 1257b6a4b4f9SMatthew Dillon if (error != 0) { 1258fd6d9be4SAlfred Perlstein DPRINTF(("error (%d) copying out message type\n", error)); 12593d903220SDoug Rabson msg_freehdr(msghdr); 1260921d05b9SRobert Watson wakeup(msqkptr); 1261b6a4b4f9SMatthew Dillon goto done2; 12623d903220SDoug Rabson } 126309a8dfa2SBruce Evans user_msgp = (char *)user_msgp + sizeof(msghdr->msg_type); 12643d903220SDoug Rabson 12653d903220SDoug Rabson /* 12663d903220SDoug Rabson * Return the segments to the user 12673d903220SDoug Rabson */ 12683d903220SDoug Rabson 12693d903220SDoug Rabson next = msghdr->msg_spot; 12703d903220SDoug Rabson for (len = 0; len < msgsz; len += msginfo.msgssz) { 12713d903220SDoug Rabson size_t tlen; 12723d903220SDoug Rabson 1273565592bdSSADA Kenji if (msgsz - len > msginfo.msgssz) 12743d903220SDoug Rabson tlen = msginfo.msgssz; 12753d903220SDoug Rabson else 1276565592bdSSADA Kenji tlen = msgsz - len; 12773d903220SDoug Rabson if (next <= -1) 12783d903220SDoug Rabson panic("next too low #3"); 12793d903220SDoug Rabson if (next >= msginfo.msgseg) 12803d903220SDoug Rabson panic("next out of range #3"); 12814b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 12822cc593fdSAlfred Perlstein error = copyout(&msgpool[next * msginfo.msgssz], 12833d903220SDoug Rabson user_msgp, tlen); 12844b6ef3a1SAlfred Perlstein mtx_lock(&msq_mtx); 1285b6a4b4f9SMatthew Dillon if (error != 0) { 1286fd6d9be4SAlfred Perlstein DPRINTF(("error (%d) copying out message segment\n", 1287fd6d9be4SAlfred Perlstein error)); 12883d903220SDoug Rabson msg_freehdr(msghdr); 1289921d05b9SRobert Watson wakeup(msqkptr); 1290b6a4b4f9SMatthew Dillon goto done2; 12913d903220SDoug Rabson } 129209a8dfa2SBruce Evans user_msgp = (char *)user_msgp + tlen; 12933d903220SDoug Rabson next = msgmaps[next].next; 12943d903220SDoug Rabson } 12953d903220SDoug Rabson 12963d903220SDoug Rabson /* 12973d903220SDoug Rabson * Done, return the actual number of bytes copied out. 12983d903220SDoug Rabson */ 12993d903220SDoug Rabson 13003d903220SDoug Rabson msg_freehdr(msghdr); 1301921d05b9SRobert Watson wakeup(msqkptr); 1302b40ce416SJulian Elischer td->td_retval[0] = msgsz; 1303b6a4b4f9SMatthew Dillon done2: 13044b6ef3a1SAlfred Perlstein mtx_unlock(&msq_mtx); 1305b6a4b4f9SMatthew Dillon return (error); 13063d903220SDoug Rabson } 1307a723c4e1SDima Dorfman 1308a723c4e1SDima Dorfman static int 1309a723c4e1SDima Dorfman sysctl_msqids(SYSCTL_HANDLER_ARGS) 1310a723c4e1SDima Dorfman { 1311a723c4e1SDima Dorfman 1312a723c4e1SDima Dorfman return (SYSCTL_OUT(req, msqids, 1313921d05b9SRobert Watson sizeof(struct msqid_kernel) * msginfo.msgmni)); 1314a723c4e1SDima Dorfman } 1315a723c4e1SDima Dorfman 1316a723c4e1SDima Dorfman SYSCTL_DECL(_kern_ipc); 1317a723c4e1SDima Dorfman SYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0, ""); 1318184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RDTUN, &msginfo.msgmni, 0, ""); 1319b36aab85SRobert Watson SYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RDTUN, &msginfo.msgmnb, 0, ""); 1320b36aab85SRobert Watson SYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RDTUN, &msginfo.msgtql, 0, ""); 1321184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RDTUN, &msginfo.msgssz, 0, ""); 1322184dcdc7SMike Silbersack SYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RDTUN, &msginfo.msgseg, 0, ""); 1323a723c4e1SDima Dorfman SYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLFLAG_RD, 1324a723c4e1SDima Dorfman NULL, 0, sysctl_msqids, "", "Message queue IDs"); 1325