xref: /freebsd/sys/kern/sysv_msg.c (revision aa0a1e58f0189b0fde359a8bda032887e72057fa)
1 /*-
2  * Implementation of SVID messages
3  *
4  * Author:  Daniel Boulet
5  *
6  * Copyright 1993 Daniel Boulet and RTMX Inc.
7  *
8  * This system call was implemented by Daniel Boulet under contract from RTMX.
9  *
10  * Redistribution and use in source forms, with and without modification,
11  * are permitted provided that this entire comment appears intact.
12  *
13  * Redistribution in binary form may occur without any restrictions.
14  * Obviously, it would be nice if you gave credit where credit is due
15  * but requiring it would be too onerous.
16  *
17  * This software is provided ``AS IS'' without any warranties of any kind.
18  */
19 /*-
20  * Copyright (c) 2003-2005 McAfee, Inc.
21  * All rights reserved.
22  *
23  * This software was developed for the FreeBSD Project in part by McAfee
24  * Research, the Security Research Division of McAfee, Inc under DARPA/SPAWAR
25  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS research
26  * program.
27  *
28  * Redistribution and use in source and binary forms, with or without
29  * modification, are permitted provided that the following conditions
30  * are met:
31  * 1. Redistributions of source code must retain the above copyright
32  *    notice, this list of conditions and the following disclaimer.
33  * 2. Redistributions in binary form must reproduce the above copyright
34  *    notice, this list of conditions and the following disclaimer in the
35  *    documentation and/or other materials provided with the distribution.
36  *
37  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
38  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
39  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
40  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
41  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
42  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
43  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
44  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
45  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
46  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
47  * SUCH DAMAGE.
48  */
49 
50 #include <sys/cdefs.h>
51 __FBSDID("$FreeBSD$");
52 
53 #include "opt_compat.h"
54 #include "opt_sysvipc.h"
55 
56 #include <sys/param.h>
57 #include <sys/systm.h>
58 #include <sys/sysproto.h>
59 #include <sys/kernel.h>
60 #include <sys/priv.h>
61 #include <sys/proc.h>
62 #include <sys/lock.h>
63 #include <sys/mutex.h>
64 #include <sys/module.h>
65 #include <sys/msg.h>
66 #include <sys/syscall.h>
67 #include <sys/syscallsubr.h>
68 #include <sys/sysent.h>
69 #include <sys/sysctl.h>
70 #include <sys/malloc.h>
71 #include <sys/jail.h>
72 
73 #include <security/mac/mac_framework.h>
74 
75 FEATURE(sysv_msg, "System V message queues support");
76 
77 static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues");
78 
79 static int msginit(void);
80 static int msgunload(void);
81 static int sysvmsg_modload(struct module *, int, void *);
82 
83 #ifdef MSG_DEBUG
84 #define DPRINTF(a)	printf a
85 #else
86 #define DPRINTF(a)	(void)0
87 #endif
88 
89 static void msg_freehdr(struct msg *msghdr);
90 
91 #ifndef MSGSSZ
92 #define MSGSSZ	8		/* Each segment must be 2^N long */
93 #endif
94 #ifndef MSGSEG
95 #define MSGSEG	2048		/* must be less than 32767 */
96 #endif
97 #define MSGMAX	(MSGSSZ*MSGSEG)
98 #ifndef MSGMNB
99 #define MSGMNB	2048		/* max # of bytes in a queue */
100 #endif
101 #ifndef MSGMNI
102 #define MSGMNI	40
103 #endif
104 #ifndef MSGTQL
105 #define MSGTQL	40
106 #endif
107 
108 /*
109  * Based on the configuration parameters described in an SVR2 (yes, two)
110  * config(1m) man page.
111  *
112  * Each message is broken up and stored in segments that are msgssz bytes
113  * long.  For efficiency reasons, this should be a power of two.  Also,
114  * it doesn't make sense if it is less than 8 or greater than about 256.
115  * Consequently, msginit in kern/sysv_msg.c checks that msgssz is a power of
116  * two between 8 and 1024 inclusive (and panic's if it isn't).
117  */
118 struct msginfo msginfo = {
119                 MSGMAX,         /* max chars in a message */
120                 MSGMNI,         /* # of message queue identifiers */
121                 MSGMNB,         /* max chars in a queue */
122                 MSGTQL,         /* max messages in system */
123                 MSGSSZ,         /* size of a message segment */
124                 		/* (must be small power of 2 greater than 4) */
125                 MSGSEG          /* number of message segments */
126 };
127 
128 /*
129  * macros to convert between msqid_ds's and msqid's.
130  * (specific to this implementation)
131  */
132 #define MSQID(ix,ds)	((ix) & 0xffff | (((ds).msg_perm.seq << 16) & 0xffff0000))
133 #define MSQID_IX(id)	((id) & 0xffff)
134 #define MSQID_SEQ(id)	(((id) >> 16) & 0xffff)
135 
136 /*
137  * The rest of this file is specific to this particular implementation.
138  */
139 
140 struct msgmap {
141 	short	next;		/* next segment in buffer */
142     				/* -1 -> available */
143     				/* 0..(MSGSEG-1) -> index of next segment */
144 };
145 
146 #define MSG_LOCKED	01000	/* Is this msqid_ds locked? */
147 
148 static int nfree_msgmaps;	/* # of free map entries */
149 static short free_msgmaps;	/* head of linked list of free map entries */
150 static struct msg *free_msghdrs;/* list of free msg headers */
151 static char *msgpool;		/* MSGMAX byte long msg buffer pool */
152 static struct msgmap *msgmaps;	/* MSGSEG msgmap structures */
153 static struct msg *msghdrs;	/* MSGTQL msg headers */
154 static struct msqid_kernel *msqids;	/* MSGMNI msqid_kernel struct's */
155 static struct mtx msq_mtx;	/* global mutex for message queues. */
156 
157 static struct syscall_helper_data msg_syscalls[] = {
158 	SYSCALL_INIT_HELPER(msgctl),
159 	SYSCALL_INIT_HELPER(msgget),
160 	SYSCALL_INIT_HELPER(msgsnd),
161 	SYSCALL_INIT_HELPER(msgrcv),
162 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
163     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
164 	SYSCALL_INIT_HELPER(msgsys),
165 	SYSCALL_INIT_HELPER(freebsd7_msgctl),
166 #endif
167 	SYSCALL_INIT_LAST
168 };
169 
170 #ifdef COMPAT_FREEBSD32
171 #include <compat/freebsd32/freebsd32.h>
172 #include <compat/freebsd32/freebsd32_ipc.h>
173 #include <compat/freebsd32/freebsd32_proto.h>
174 #include <compat/freebsd32/freebsd32_signal.h>
175 #include <compat/freebsd32/freebsd32_syscall.h>
176 #include <compat/freebsd32/freebsd32_util.h>
177 
178 static struct syscall_helper_data msg32_syscalls[] = {
179 	SYSCALL32_INIT_HELPER(freebsd32_msgctl),
180 	SYSCALL32_INIT_HELPER(freebsd32_msgsnd),
181 	SYSCALL32_INIT_HELPER(freebsd32_msgrcv),
182 	SYSCALL32_INIT_HELPER(msgget),
183 	SYSCALL32_INIT_HELPER(freebsd32_msgsys),
184 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
185     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
186 	SYSCALL32_INIT_HELPER(freebsd7_freebsd32_msgctl),
187 #endif
188 	SYSCALL_INIT_LAST
189 };
190 #endif
191 
192 static int
193 msginit()
194 {
195 	int i, error;
196 
197 	TUNABLE_INT_FETCH("kern.ipc.msgseg", &msginfo.msgseg);
198 	TUNABLE_INT_FETCH("kern.ipc.msgssz", &msginfo.msgssz);
199 	msginfo.msgmax = msginfo.msgseg * msginfo.msgssz;
200 	TUNABLE_INT_FETCH("kern.ipc.msgmni", &msginfo.msgmni);
201 	TUNABLE_INT_FETCH("kern.ipc.msgmnb", &msginfo.msgmnb);
202 	TUNABLE_INT_FETCH("kern.ipc.msgtql", &msginfo.msgtql);
203 
204 	msgpool = malloc(msginfo.msgmax, M_MSG, M_WAITOK);
205 	msgmaps = malloc(sizeof(struct msgmap) * msginfo.msgseg, M_MSG, M_WAITOK);
206 	msghdrs = malloc(sizeof(struct msg) * msginfo.msgtql, M_MSG, M_WAITOK);
207 	msqids = malloc(sizeof(struct msqid_kernel) * msginfo.msgmni, M_MSG,
208 	    M_WAITOK);
209 
210 	/*
211 	 * msginfo.msgssz should be a power of two for efficiency reasons.
212 	 * It is also pretty silly if msginfo.msgssz is less than 8
213 	 * or greater than about 256 so ...
214 	 */
215 
216 	i = 8;
217 	while (i < 1024 && i != msginfo.msgssz)
218 		i <<= 1;
219     	if (i != msginfo.msgssz) {
220 		DPRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz,
221 		    msginfo.msgssz));
222 		panic("msginfo.msgssz not a small power of 2");
223 	}
224 
225 	if (msginfo.msgseg > 32767) {
226 		DPRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg));
227 		panic("msginfo.msgseg > 32767");
228 	}
229 
230 	for (i = 0; i < msginfo.msgseg; i++) {
231 		if (i > 0)
232 			msgmaps[i-1].next = i;
233 		msgmaps[i].next = -1;	/* implies entry is available */
234 	}
235 	free_msgmaps = 0;
236 	nfree_msgmaps = msginfo.msgseg;
237 
238 	for (i = 0; i < msginfo.msgtql; i++) {
239 		msghdrs[i].msg_type = 0;
240 		if (i > 0)
241 			msghdrs[i-1].msg_next = &msghdrs[i];
242 		msghdrs[i].msg_next = NULL;
243 #ifdef MAC
244 		mac_sysvmsg_init(&msghdrs[i]);
245 #endif
246     	}
247 	free_msghdrs = &msghdrs[0];
248 
249 	for (i = 0; i < msginfo.msgmni; i++) {
250 		msqids[i].u.msg_qbytes = 0;	/* implies entry is available */
251 		msqids[i].u.msg_perm.seq = 0;	/* reset to a known value */
252 		msqids[i].u.msg_perm.mode = 0;
253 #ifdef MAC
254 		mac_sysvmsq_init(&msqids[i]);
255 #endif
256 	}
257 	mtx_init(&msq_mtx, "msq", NULL, MTX_DEF);
258 
259 	error = syscall_helper_register(msg_syscalls);
260 	if (error != 0)
261 		return (error);
262 #ifdef COMPAT_FREEBSD32
263 	error = syscall32_helper_register(msg32_syscalls);
264 	if (error != 0)
265 		return (error);
266 #endif
267 	return (0);
268 }
269 
270 static int
271 msgunload()
272 {
273 	struct msqid_kernel *msqkptr;
274 	int msqid;
275 #ifdef MAC
276 	int i;
277 #endif
278 
279 	syscall_helper_unregister(msg_syscalls);
280 #ifdef COMPAT_FREEBSD32
281 	syscall32_helper_unregister(msg32_syscalls);
282 #endif
283 
284 	for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
285 		/*
286 		 * Look for an unallocated and unlocked msqid_ds.
287 		 * msqid_ds's can be locked by msgsnd or msgrcv while
288 		 * they are copying the message in/out.  We can't
289 		 * re-use the entry until they release it.
290 		 */
291 		msqkptr = &msqids[msqid];
292 		if (msqkptr->u.msg_qbytes != 0 ||
293 		    (msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)
294 			break;
295 	}
296 	if (msqid != msginfo.msgmni)
297 		return (EBUSY);
298 
299 #ifdef MAC
300 	for (i = 0; i < msginfo.msgtql; i++)
301 		mac_sysvmsg_destroy(&msghdrs[i]);
302 	for (msqid = 0; msqid < msginfo.msgmni; msqid++)
303 		mac_sysvmsq_destroy(&msqids[msqid]);
304 #endif
305 	free(msgpool, M_MSG);
306 	free(msgmaps, M_MSG);
307 	free(msghdrs, M_MSG);
308 	free(msqids, M_MSG);
309 	mtx_destroy(&msq_mtx);
310 	return (0);
311 }
312 
313 
314 static int
315 sysvmsg_modload(struct module *module, int cmd, void *arg)
316 {
317 	int error = 0;
318 
319 	switch (cmd) {
320 	case MOD_LOAD:
321 		error = msginit();
322 		if (error != 0)
323 			msgunload();
324 		break;
325 	case MOD_UNLOAD:
326 		error = msgunload();
327 		break;
328 	case MOD_SHUTDOWN:
329 		break;
330 	default:
331 		error = EINVAL;
332 		break;
333 	}
334 	return (error);
335 }
336 
337 static moduledata_t sysvmsg_mod = {
338 	"sysvmsg",
339 	&sysvmsg_modload,
340 	NULL
341 };
342 
343 DECLARE_MODULE(sysvmsg, sysvmsg_mod, SI_SUB_SYSV_MSG, SI_ORDER_FIRST);
344 MODULE_VERSION(sysvmsg, 1);
345 
346 static void
347 msg_freehdr(msghdr)
348 	struct msg *msghdr;
349 {
350 	while (msghdr->msg_ts > 0) {
351 		short next;
352 		if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg)
353 			panic("msghdr->msg_spot out of range");
354 		next = msgmaps[msghdr->msg_spot].next;
355 		msgmaps[msghdr->msg_spot].next = free_msgmaps;
356 		free_msgmaps = msghdr->msg_spot;
357 		nfree_msgmaps++;
358 		msghdr->msg_spot = next;
359 		if (msghdr->msg_ts >= msginfo.msgssz)
360 			msghdr->msg_ts -= msginfo.msgssz;
361 		else
362 			msghdr->msg_ts = 0;
363 	}
364 	if (msghdr->msg_spot != -1)
365 		panic("msghdr->msg_spot != -1");
366 	msghdr->msg_next = free_msghdrs;
367 	free_msghdrs = msghdr;
368 #ifdef MAC
369 	mac_sysvmsg_cleanup(msghdr);
370 #endif
371 }
372 
373 #ifndef _SYS_SYSPROTO_H_
374 struct msgctl_args {
375 	int	msqid;
376 	int	cmd;
377 	struct	msqid_ds *buf;
378 };
379 #endif
380 int
381 msgctl(td, uap)
382 	struct thread *td;
383 	register struct msgctl_args *uap;
384 {
385 	int msqid = uap->msqid;
386 	int cmd = uap->cmd;
387 	struct msqid_ds msqbuf;
388 	int error;
389 
390 	DPRINTF(("call to msgctl(%d, %d, %p)\n", msqid, cmd, uap->buf));
391 	if (cmd == IPC_SET &&
392 	    (error = copyin(uap->buf, &msqbuf, sizeof(msqbuf))) != 0)
393 		return (error);
394 	error = kern_msgctl(td, msqid, cmd, &msqbuf);
395 	if (cmd == IPC_STAT && error == 0)
396 		error = copyout(&msqbuf, uap->buf, sizeof(struct msqid_ds));
397 	return (error);
398 }
399 
400 int
401 kern_msgctl(td, msqid, cmd, msqbuf)
402 	struct thread *td;
403 	int msqid;
404 	int cmd;
405 	struct msqid_ds *msqbuf;
406 {
407 	int rval, error, msqix;
408 	register struct msqid_kernel *msqkptr;
409 
410 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
411 		return (ENOSYS);
412 
413 	msqix = IPCID_TO_IX(msqid);
414 
415 	if (msqix < 0 || msqix >= msginfo.msgmni) {
416 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqix,
417 		    msginfo.msgmni));
418 		return (EINVAL);
419 	}
420 
421 	msqkptr = &msqids[msqix];
422 
423 	mtx_lock(&msq_mtx);
424 	if (msqkptr->u.msg_qbytes == 0) {
425 		DPRINTF(("no such msqid\n"));
426 		error = EINVAL;
427 		goto done2;
428 	}
429 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {
430 		DPRINTF(("wrong sequence number\n"));
431 		error = EINVAL;
432 		goto done2;
433 	}
434 #ifdef MAC
435 	error = mac_sysvmsq_check_msqctl(td->td_ucred, msqkptr, cmd);
436 	if (error != 0)
437 		goto done2;
438 #endif
439 
440 	error = 0;
441 	rval = 0;
442 
443 	switch (cmd) {
444 
445 	case IPC_RMID:
446 	{
447 		struct msg *msghdr;
448 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))
449 			goto done2;
450 
451 #ifdef MAC
452 		/*
453 		 * Check that the thread has MAC access permissions to
454 		 * individual msghdrs.  Note: We need to do this in a
455 		 * separate loop because the actual loop alters the
456 		 * msq/msghdr info as it progresses, and there is no going
457 		 * back if half the way through we discover that the
458 		 * thread cannot free a certain msghdr.  The msq will get
459 		 * into an inconsistent state.
460 		 */
461 		for (msghdr = msqkptr->u.msg_first; msghdr != NULL;
462 		    msghdr = msghdr->msg_next) {
463 			error = mac_sysvmsq_check_msgrmid(td->td_ucred, msghdr);
464 			if (error != 0)
465 				goto done2;
466 		}
467 #endif
468 
469 		/* Free the message headers */
470 		msghdr = msqkptr->u.msg_first;
471 		while (msghdr != NULL) {
472 			struct msg *msghdr_tmp;
473 
474 			/* Free the segments of each message */
475 			msqkptr->u.msg_cbytes -= msghdr->msg_ts;
476 			msqkptr->u.msg_qnum--;
477 			msghdr_tmp = msghdr;
478 			msghdr = msghdr->msg_next;
479 			msg_freehdr(msghdr_tmp);
480 		}
481 
482 		if (msqkptr->u.msg_cbytes != 0)
483 			panic("msg_cbytes is screwed up");
484 		if (msqkptr->u.msg_qnum != 0)
485 			panic("msg_qnum is screwed up");
486 
487 		msqkptr->u.msg_qbytes = 0;	/* Mark it as free */
488 
489 #ifdef MAC
490 		mac_sysvmsq_cleanup(msqkptr);
491 #endif
492 
493 		wakeup(msqkptr);
494 	}
495 
496 		break;
497 
498 	case IPC_SET:
499 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))
500 			goto done2;
501 		if (msqbuf->msg_qbytes > msqkptr->u.msg_qbytes) {
502 			error = priv_check(td, PRIV_IPC_MSGSIZE);
503 			if (error)
504 				goto done2;
505 		}
506 		if (msqbuf->msg_qbytes > msginfo.msgmnb) {
507 			DPRINTF(("can't increase msg_qbytes beyond %d"
508 			    "(truncating)\n", msginfo.msgmnb));
509 			msqbuf->msg_qbytes = msginfo.msgmnb;	/* silently restrict qbytes to system limit */
510 		}
511 		if (msqbuf->msg_qbytes == 0) {
512 			DPRINTF(("can't reduce msg_qbytes to 0\n"));
513 			error = EINVAL;		/* non-standard errno! */
514 			goto done2;
515 		}
516 		msqkptr->u.msg_perm.uid = msqbuf->msg_perm.uid;	/* change the owner */
517 		msqkptr->u.msg_perm.gid = msqbuf->msg_perm.gid;	/* change the owner */
518 		msqkptr->u.msg_perm.mode = (msqkptr->u.msg_perm.mode & ~0777) |
519 		    (msqbuf->msg_perm.mode & 0777);
520 		msqkptr->u.msg_qbytes = msqbuf->msg_qbytes;
521 		msqkptr->u.msg_ctime = time_second;
522 		break;
523 
524 	case IPC_STAT:
525 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {
526 			DPRINTF(("requester doesn't have read access\n"));
527 			goto done2;
528 		}
529 		*msqbuf = msqkptr->u;
530 		break;
531 
532 	default:
533 		DPRINTF(("invalid command %d\n", cmd));
534 		error = EINVAL;
535 		goto done2;
536 	}
537 
538 	if (error == 0)
539 		td->td_retval[0] = rval;
540 done2:
541 	mtx_unlock(&msq_mtx);
542 	return (error);
543 }
544 
545 #ifndef _SYS_SYSPROTO_H_
546 struct msgget_args {
547 	key_t	key;
548 	int	msgflg;
549 };
550 #endif
551 int
552 msgget(td, uap)
553 	struct thread *td;
554 	register struct msgget_args *uap;
555 {
556 	int msqid, error = 0;
557 	int key = uap->key;
558 	int msgflg = uap->msgflg;
559 	struct ucred *cred = td->td_ucred;
560 	register struct msqid_kernel *msqkptr = NULL;
561 
562 	DPRINTF(("msgget(0x%x, 0%o)\n", key, msgflg));
563 
564 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
565 		return (ENOSYS);
566 
567 	mtx_lock(&msq_mtx);
568 	if (key != IPC_PRIVATE) {
569 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
570 			msqkptr = &msqids[msqid];
571 			if (msqkptr->u.msg_qbytes != 0 &&
572 			    msqkptr->u.msg_perm.key == key)
573 				break;
574 		}
575 		if (msqid < msginfo.msgmni) {
576 			DPRINTF(("found public key\n"));
577 			if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
578 				DPRINTF(("not exclusive\n"));
579 				error = EEXIST;
580 				goto done2;
581 			}
582 			if ((error = ipcperm(td, &msqkptr->u.msg_perm,
583 			    msgflg & 0700))) {
584 				DPRINTF(("requester doesn't have 0%o access\n",
585 				    msgflg & 0700));
586 				goto done2;
587 			}
588 #ifdef MAC
589 			error = mac_sysvmsq_check_msqget(cred, msqkptr);
590 			if (error != 0)
591 				goto done2;
592 #endif
593 			goto found;
594 		}
595 	}
596 
597 	DPRINTF(("need to allocate the msqid_ds\n"));
598 	if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
599 		for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
600 			/*
601 			 * Look for an unallocated and unlocked msqid_ds.
602 			 * msqid_ds's can be locked by msgsnd or msgrcv while
603 			 * they are copying the message in/out.  We can't
604 			 * re-use the entry until they release it.
605 			 */
606 			msqkptr = &msqids[msqid];
607 			if (msqkptr->u.msg_qbytes == 0 &&
608 			    (msqkptr->u.msg_perm.mode & MSG_LOCKED) == 0)
609 				break;
610 		}
611 		if (msqid == msginfo.msgmni) {
612 			DPRINTF(("no more msqid_ds's available\n"));
613 			error = ENOSPC;
614 			goto done2;
615 		}
616 		DPRINTF(("msqid %d is available\n", msqid));
617 		msqkptr->u.msg_perm.key = key;
618 		msqkptr->u.msg_perm.cuid = cred->cr_uid;
619 		msqkptr->u.msg_perm.uid = cred->cr_uid;
620 		msqkptr->u.msg_perm.cgid = cred->cr_gid;
621 		msqkptr->u.msg_perm.gid = cred->cr_gid;
622 		msqkptr->u.msg_perm.mode = (msgflg & 0777);
623 		/* Make sure that the returned msqid is unique */
624 		msqkptr->u.msg_perm.seq = (msqkptr->u.msg_perm.seq + 1) & 0x7fff;
625 		msqkptr->u.msg_first = NULL;
626 		msqkptr->u.msg_last = NULL;
627 		msqkptr->u.msg_cbytes = 0;
628 		msqkptr->u.msg_qnum = 0;
629 		msqkptr->u.msg_qbytes = msginfo.msgmnb;
630 		msqkptr->u.msg_lspid = 0;
631 		msqkptr->u.msg_lrpid = 0;
632 		msqkptr->u.msg_stime = 0;
633 		msqkptr->u.msg_rtime = 0;
634 		msqkptr->u.msg_ctime = time_second;
635 #ifdef MAC
636 		mac_sysvmsq_create(cred, msqkptr);
637 #endif
638 	} else {
639 		DPRINTF(("didn't find it and wasn't asked to create it\n"));
640 		error = ENOENT;
641 		goto done2;
642 	}
643 
644 found:
645 	/* Construct the unique msqid */
646 	td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqkptr->u.msg_perm);
647 done2:
648 	mtx_unlock(&msq_mtx);
649 	return (error);
650 }
651 
652 #ifndef _SYS_SYSPROTO_H_
653 struct msgsnd_args {
654 	int	msqid;
655 	const void	*msgp;
656 	size_t	msgsz;
657 	int	msgflg;
658 };
659 #endif
660 int
661 kern_msgsnd(td, msqid, msgp, msgsz, msgflg, mtype)
662 	struct thread *td;
663 	int msqid;
664 	const void *msgp;	/* XXX msgp is actually mtext. */
665 	size_t msgsz;
666 	int msgflg;
667 	long mtype;
668 {
669 	int msqix, segs_needed, error = 0;
670 	register struct msqid_kernel *msqkptr;
671 	register struct msg *msghdr;
672 	short next;
673 
674 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
675 		return (ENOSYS);
676 
677 	mtx_lock(&msq_mtx);
678 	msqix = IPCID_TO_IX(msqid);
679 
680 	if (msqix < 0 || msqix >= msginfo.msgmni) {
681 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqix,
682 		    msginfo.msgmni));
683 		error = EINVAL;
684 		goto done2;
685 	}
686 
687 	msqkptr = &msqids[msqix];
688 	if (msqkptr->u.msg_qbytes == 0) {
689 		DPRINTF(("no such message queue id\n"));
690 		error = EINVAL;
691 		goto done2;
692 	}
693 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {
694 		DPRINTF(("wrong sequence number\n"));
695 		error = EINVAL;
696 		goto done2;
697 	}
698 
699 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_W))) {
700 		DPRINTF(("requester doesn't have write access\n"));
701 		goto done2;
702 	}
703 
704 #ifdef MAC
705 	error = mac_sysvmsq_check_msqsnd(td->td_ucred, msqkptr);
706 	if (error != 0)
707 		goto done2;
708 #endif
709 
710 	segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
711 	DPRINTF(("msgsz=%zu, msgssz=%d, segs_needed=%d\n", msgsz,
712 	    msginfo.msgssz, segs_needed));
713 	for (;;) {
714 		int need_more_resources = 0;
715 
716 		/*
717 		 * check msgsz
718 		 * (inside this loop in case msg_qbytes changes while we sleep)
719 		 */
720 
721 		if (msgsz > msqkptr->u.msg_qbytes) {
722 			DPRINTF(("msgsz > msqkptr->u.msg_qbytes\n"));
723 			error = EINVAL;
724 			goto done2;
725 		}
726 
727 		if (msqkptr->u.msg_perm.mode & MSG_LOCKED) {
728 			DPRINTF(("msqid is locked\n"));
729 			need_more_resources = 1;
730 		}
731 		if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) {
732 			DPRINTF(("msgsz + msg_cbytes > msg_qbytes\n"));
733 			need_more_resources = 1;
734 		}
735 		if (segs_needed > nfree_msgmaps) {
736 			DPRINTF(("segs_needed > nfree_msgmaps\n"));
737 			need_more_resources = 1;
738 		}
739 		if (free_msghdrs == NULL) {
740 			DPRINTF(("no more msghdrs\n"));
741 			need_more_resources = 1;
742 		}
743 
744 		if (need_more_resources) {
745 			int we_own_it;
746 
747 			if ((msgflg & IPC_NOWAIT) != 0) {
748 				DPRINTF(("need more resources but caller "
749 				    "doesn't want to wait\n"));
750 				error = EAGAIN;
751 				goto done2;
752 			}
753 
754 			if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) {
755 				DPRINTF(("we don't own the msqid_ds\n"));
756 				we_own_it = 0;
757 			} else {
758 				/* Force later arrivals to wait for our
759 				   request */
760 				DPRINTF(("we own the msqid_ds\n"));
761 				msqkptr->u.msg_perm.mode |= MSG_LOCKED;
762 				we_own_it = 1;
763 			}
764 			DPRINTF(("msgsnd:  goodnight\n"));
765 			error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,
766 			    "msgsnd", hz);
767 			DPRINTF(("msgsnd:  good morning, error=%d\n", error));
768 			if (we_own_it)
769 				msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
770 			if (error == EWOULDBLOCK) {
771 				DPRINTF(("msgsnd:  timed out\n"));
772 				continue;
773 			}
774 			if (error != 0) {
775 				DPRINTF(("msgsnd:  interrupted system call\n"));
776 				error = EINTR;
777 				goto done2;
778 			}
779 
780 			/*
781 			 * Make sure that the msq queue still exists
782 			 */
783 
784 			if (msqkptr->u.msg_qbytes == 0) {
785 				DPRINTF(("msqid deleted\n"));
786 				error = EIDRM;
787 				goto done2;
788 			}
789 
790 		} else {
791 			DPRINTF(("got all the resources that we need\n"));
792 			break;
793 		}
794 	}
795 
796 	/*
797 	 * We have the resources that we need.
798 	 * Make sure!
799 	 */
800 
801 	if (msqkptr->u.msg_perm.mode & MSG_LOCKED)
802 		panic("msg_perm.mode & MSG_LOCKED");
803 	if (segs_needed > nfree_msgmaps)
804 		panic("segs_needed > nfree_msgmaps");
805 	if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes)
806 		panic("msgsz + msg_cbytes > msg_qbytes");
807 	if (free_msghdrs == NULL)
808 		panic("no more msghdrs");
809 
810 	/*
811 	 * Re-lock the msqid_ds in case we page-fault when copying in the
812 	 * message
813 	 */
814 
815 	if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)
816 		panic("msqid_ds is already locked");
817 	msqkptr->u.msg_perm.mode |= MSG_LOCKED;
818 
819 	/*
820 	 * Allocate a message header
821 	 */
822 
823 	msghdr = free_msghdrs;
824 	free_msghdrs = msghdr->msg_next;
825 	msghdr->msg_spot = -1;
826 	msghdr->msg_ts = msgsz;
827 	msghdr->msg_type = mtype;
828 #ifdef MAC
829 	/*
830 	 * XXXMAC: Should the mac_sysvmsq_check_msgmsq check follow here
831 	 * immediately?  Or, should it be checked just before the msg is
832 	 * enqueued in the msgq (as it is done now)?
833 	 */
834 	mac_sysvmsg_create(td->td_ucred, msqkptr, msghdr);
835 #endif
836 
837 	/*
838 	 * Allocate space for the message
839 	 */
840 
841 	while (segs_needed > 0) {
842 		if (nfree_msgmaps <= 0)
843 			panic("not enough msgmaps");
844 		if (free_msgmaps == -1)
845 			panic("nil free_msgmaps");
846 		next = free_msgmaps;
847 		if (next <= -1)
848 			panic("next too low #1");
849 		if (next >= msginfo.msgseg)
850 			panic("next out of range #1");
851 		DPRINTF(("allocating segment %d to message\n", next));
852 		free_msgmaps = msgmaps[next].next;
853 		nfree_msgmaps--;
854 		msgmaps[next].next = msghdr->msg_spot;
855 		msghdr->msg_spot = next;
856 		segs_needed--;
857 	}
858 
859 	/*
860 	 * Validate the message type
861 	 */
862 
863 	if (msghdr->msg_type < 1) {
864 		msg_freehdr(msghdr);
865 		msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
866 		wakeup(msqkptr);
867 		DPRINTF(("mtype (%ld) < 1\n", msghdr->msg_type));
868 		error = EINVAL;
869 		goto done2;
870 	}
871 
872 	/*
873 	 * Copy in the message body
874 	 */
875 
876 	next = msghdr->msg_spot;
877 	while (msgsz > 0) {
878 		size_t tlen;
879 		if (msgsz > msginfo.msgssz)
880 			tlen = msginfo.msgssz;
881 		else
882 			tlen = msgsz;
883 		if (next <= -1)
884 			panic("next too low #2");
885 		if (next >= msginfo.msgseg)
886 			panic("next out of range #2");
887 		mtx_unlock(&msq_mtx);
888 		if ((error = copyin(msgp, &msgpool[next * msginfo.msgssz],
889 		    tlen)) != 0) {
890 			mtx_lock(&msq_mtx);
891 			DPRINTF(("error %d copying in message segment\n",
892 			    error));
893 			msg_freehdr(msghdr);
894 			msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
895 			wakeup(msqkptr);
896 			goto done2;
897 		}
898 		mtx_lock(&msq_mtx);
899 		msgsz -= tlen;
900 		msgp = (const char *)msgp + tlen;
901 		next = msgmaps[next].next;
902 	}
903 	if (next != -1)
904 		panic("didn't use all the msg segments");
905 
906 	/*
907 	 * We've got the message.  Unlock the msqid_ds.
908 	 */
909 
910 	msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;
911 
912 	/*
913 	 * Make sure that the msqid_ds is still allocated.
914 	 */
915 
916 	if (msqkptr->u.msg_qbytes == 0) {
917 		msg_freehdr(msghdr);
918 		wakeup(msqkptr);
919 		error = EIDRM;
920 		goto done2;
921 	}
922 
923 #ifdef MAC
924 	/*
925 	 * Note: Since the task/thread allocates the msghdr and usually
926 	 * primes it with its own MAC label, for a majority of policies, it
927 	 * won't be necessary to check whether the msghdr has access
928 	 * permissions to the msgq.  The mac_sysvmsq_check_msqsnd check would
929 	 * suffice in that case.  However, this hook may be required where
930 	 * individual policies derive a non-identical label for the msghdr
931 	 * from the current thread label and may want to check the msghdr
932 	 * enqueue permissions, along with read/write permissions to the
933 	 * msgq.
934 	 */
935 	error = mac_sysvmsq_check_msgmsq(td->td_ucred, msghdr, msqkptr);
936 	if (error != 0) {
937 		msg_freehdr(msghdr);
938 		wakeup(msqkptr);
939 		goto done2;
940 	}
941 #endif
942 
943 	/*
944 	 * Put the message into the queue
945 	 */
946 	if (msqkptr->u.msg_first == NULL) {
947 		msqkptr->u.msg_first = msghdr;
948 		msqkptr->u.msg_last = msghdr;
949 	} else {
950 		msqkptr->u.msg_last->msg_next = msghdr;
951 		msqkptr->u.msg_last = msghdr;
952 	}
953 	msqkptr->u.msg_last->msg_next = NULL;
954 
955 	msqkptr->u.msg_cbytes += msghdr->msg_ts;
956 	msqkptr->u.msg_qnum++;
957 	msqkptr->u.msg_lspid = td->td_proc->p_pid;
958 	msqkptr->u.msg_stime = time_second;
959 
960 	wakeup(msqkptr);
961 	td->td_retval[0] = 0;
962 done2:
963 	mtx_unlock(&msq_mtx);
964 	return (error);
965 }
966 
967 int
968 msgsnd(td, uap)
969 	struct thread *td;
970 	register struct msgsnd_args *uap;
971 {
972 	int error;
973 	long mtype;
974 
975 	DPRINTF(("call to msgsnd(%d, %p, %zu, %d)\n", uap->msqid, uap->msgp,
976 	    uap->msgsz, uap->msgflg));
977 
978 	if ((error = copyin(uap->msgp, &mtype, sizeof(mtype))) != 0) {
979 		DPRINTF(("error %d copying the message type\n", error));
980 		return (error);
981 	}
982 	return (kern_msgsnd(td, uap->msqid,
983 	    (const char *)uap->msgp + sizeof(mtype),
984 	    uap->msgsz, uap->msgflg, mtype));
985 }
986 
987 #ifndef _SYS_SYSPROTO_H_
988 struct msgrcv_args {
989 	int	msqid;
990 	void	*msgp;
991 	size_t	msgsz;
992 	long	msgtyp;
993 	int	msgflg;
994 };
995 #endif
996 int
997 kern_msgrcv(td, msqid, msgp, msgsz, msgtyp, msgflg, mtype)
998 	struct thread *td;
999 	int msqid;
1000 	void *msgp;	/* XXX msgp is actually mtext. */
1001 	size_t msgsz;
1002 	long msgtyp;
1003 	int msgflg;
1004 	long *mtype;
1005 {
1006 	size_t len;
1007 	register struct msqid_kernel *msqkptr;
1008 	register struct msg *msghdr;
1009 	int msqix, error = 0;
1010 	short next;
1011 
1012 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
1013 		return (ENOSYS);
1014 
1015 	msqix = IPCID_TO_IX(msqid);
1016 
1017 	if (msqix < 0 || msqix >= msginfo.msgmni) {
1018 		DPRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqix,
1019 		    msginfo.msgmni));
1020 		return (EINVAL);
1021 	}
1022 
1023 	msqkptr = &msqids[msqix];
1024 	mtx_lock(&msq_mtx);
1025 	if (msqkptr->u.msg_qbytes == 0) {
1026 		DPRINTF(("no such message queue id\n"));
1027 		error = EINVAL;
1028 		goto done2;
1029 	}
1030 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {
1031 		DPRINTF(("wrong sequence number\n"));
1032 		error = EINVAL;
1033 		goto done2;
1034 	}
1035 
1036 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {
1037 		DPRINTF(("requester doesn't have read access\n"));
1038 		goto done2;
1039 	}
1040 
1041 #ifdef MAC
1042 	error = mac_sysvmsq_check_msqrcv(td->td_ucred, msqkptr);
1043 	if (error != 0)
1044 		goto done2;
1045 #endif
1046 
1047 	msghdr = NULL;
1048 	while (msghdr == NULL) {
1049 		if (msgtyp == 0) {
1050 			msghdr = msqkptr->u.msg_first;
1051 			if (msghdr != NULL) {
1052 				if (msgsz < msghdr->msg_ts &&
1053 				    (msgflg & MSG_NOERROR) == 0) {
1054 					DPRINTF(("first message on the queue "
1055 					    "is too big (want %zu, got %d)\n",
1056 					    msgsz, msghdr->msg_ts));
1057 					error = E2BIG;
1058 					goto done2;
1059 				}
1060 #ifdef MAC
1061 				error = mac_sysvmsq_check_msgrcv(td->td_ucred,
1062 				    msghdr);
1063 				if (error != 0)
1064 					goto done2;
1065 #endif
1066 				if (msqkptr->u.msg_first == msqkptr->u.msg_last) {
1067 					msqkptr->u.msg_first = NULL;
1068 					msqkptr->u.msg_last = NULL;
1069 				} else {
1070 					msqkptr->u.msg_first = msghdr->msg_next;
1071 					if (msqkptr->u.msg_first == NULL)
1072 						panic("msg_first/last screwed up #1");
1073 				}
1074 			}
1075 		} else {
1076 			struct msg *previous;
1077 			struct msg **prev;
1078 
1079 			previous = NULL;
1080 			prev = &(msqkptr->u.msg_first);
1081 			while ((msghdr = *prev) != NULL) {
1082 				/*
1083 				 * Is this message's type an exact match or is
1084 				 * this message's type less than or equal to
1085 				 * the absolute value of a negative msgtyp?
1086 				 * Note that the second half of this test can
1087 				 * NEVER be true if msgtyp is positive since
1088 				 * msg_type is always positive!
1089 				 */
1090 
1091 				if (msgtyp == msghdr->msg_type ||
1092 				    msghdr->msg_type <= -msgtyp) {
1093 					DPRINTF(("found message type %ld, "
1094 					    "requested %ld\n",
1095 					    msghdr->msg_type, msgtyp));
1096 					if (msgsz < msghdr->msg_ts &&
1097 					    (msgflg & MSG_NOERROR) == 0) {
1098 						DPRINTF(("requested message "
1099 						    "on the queue is too big "
1100 						    "(want %zu, got %hu)\n",
1101 						    msgsz, msghdr->msg_ts));
1102 						error = E2BIG;
1103 						goto done2;
1104 					}
1105 #ifdef MAC
1106 					error = mac_sysvmsq_check_msgrcv(
1107 					    td->td_ucred, msghdr);
1108 					if (error != 0)
1109 						goto done2;
1110 #endif
1111 					*prev = msghdr->msg_next;
1112 					if (msghdr == msqkptr->u.msg_last) {
1113 						if (previous == NULL) {
1114 							if (prev !=
1115 							    &msqkptr->u.msg_first)
1116 								panic("msg_first/last screwed up #2");
1117 							msqkptr->u.msg_first =
1118 							    NULL;
1119 							msqkptr->u.msg_last =
1120 							    NULL;
1121 						} else {
1122 							if (prev ==
1123 							    &msqkptr->u.msg_first)
1124 								panic("msg_first/last screwed up #3");
1125 							msqkptr->u.msg_last =
1126 							    previous;
1127 						}
1128 					}
1129 					break;
1130 				}
1131 				previous = msghdr;
1132 				prev = &(msghdr->msg_next);
1133 			}
1134 		}
1135 
1136 		/*
1137 		 * We've either extracted the msghdr for the appropriate
1138 		 * message or there isn't one.
1139 		 * If there is one then bail out of this loop.
1140 		 */
1141 
1142 		if (msghdr != NULL)
1143 			break;
1144 
1145 		/*
1146 		 * Hmph!  No message found.  Does the user want to wait?
1147 		 */
1148 
1149 		if ((msgflg & IPC_NOWAIT) != 0) {
1150 			DPRINTF(("no appropriate message found (msgtyp=%ld)\n",
1151 			    msgtyp));
1152 			/* The SVID says to return ENOMSG. */
1153 			error = ENOMSG;
1154 			goto done2;
1155 		}
1156 
1157 		/*
1158 		 * Wait for something to happen
1159 		 */
1160 
1161 		DPRINTF(("msgrcv:  goodnight\n"));
1162 		error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,
1163 		    "msgrcv", 0);
1164 		DPRINTF(("msgrcv:  good morning (error=%d)\n", error));
1165 
1166 		if (error != 0) {
1167 			DPRINTF(("msgrcv:  interrupted system call\n"));
1168 			error = EINTR;
1169 			goto done2;
1170 		}
1171 
1172 		/*
1173 		 * Make sure that the msq queue still exists
1174 		 */
1175 
1176 		if (msqkptr->u.msg_qbytes == 0 ||
1177 		    msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {
1178 			DPRINTF(("msqid deleted\n"));
1179 			error = EIDRM;
1180 			goto done2;
1181 		}
1182 	}
1183 
1184 	/*
1185 	 * Return the message to the user.
1186 	 *
1187 	 * First, do the bookkeeping (before we risk being interrupted).
1188 	 */
1189 
1190 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;
1191 	msqkptr->u.msg_qnum--;
1192 	msqkptr->u.msg_lrpid = td->td_proc->p_pid;
1193 	msqkptr->u.msg_rtime = time_second;
1194 
1195 	/*
1196 	 * Make msgsz the actual amount that we'll be returning.
1197 	 * Note that this effectively truncates the message if it is too long
1198 	 * (since msgsz is never increased).
1199 	 */
1200 
1201 	DPRINTF(("found a message, msgsz=%zu, msg_ts=%hu\n", msgsz,
1202 	    msghdr->msg_ts));
1203 	if (msgsz > msghdr->msg_ts)
1204 		msgsz = msghdr->msg_ts;
1205 	*mtype = msghdr->msg_type;
1206 
1207 	/*
1208 	 * Return the segments to the user
1209 	 */
1210 
1211 	next = msghdr->msg_spot;
1212 	for (len = 0; len < msgsz; len += msginfo.msgssz) {
1213 		size_t tlen;
1214 
1215 		if (msgsz - len > msginfo.msgssz)
1216 			tlen = msginfo.msgssz;
1217 		else
1218 			tlen = msgsz - len;
1219 		if (next <= -1)
1220 			panic("next too low #3");
1221 		if (next >= msginfo.msgseg)
1222 			panic("next out of range #3");
1223 		mtx_unlock(&msq_mtx);
1224 		error = copyout(&msgpool[next * msginfo.msgssz], msgp, tlen);
1225 		mtx_lock(&msq_mtx);
1226 		if (error != 0) {
1227 			DPRINTF(("error (%d) copying out message segment\n",
1228 			    error));
1229 			msg_freehdr(msghdr);
1230 			wakeup(msqkptr);
1231 			goto done2;
1232 		}
1233 		msgp = (char *)msgp + tlen;
1234 		next = msgmaps[next].next;
1235 	}
1236 
1237 	/*
1238 	 * Done, return the actual number of bytes copied out.
1239 	 */
1240 
1241 	msg_freehdr(msghdr);
1242 	wakeup(msqkptr);
1243 	td->td_retval[0] = msgsz;
1244 done2:
1245 	mtx_unlock(&msq_mtx);
1246 	return (error);
1247 }
1248 
1249 int
1250 msgrcv(td, uap)
1251 	struct thread *td;
1252 	register struct msgrcv_args *uap;
1253 {
1254 	int error;
1255 	long mtype;
1256 
1257 	DPRINTF(("call to msgrcv(%d, %p, %zu, %ld, %d)\n", uap->msqid,
1258 	    uap->msgp, uap->msgsz, uap->msgtyp, uap->msgflg));
1259 
1260 	if ((error = kern_msgrcv(td, uap->msqid,
1261 	    (char *)uap->msgp + sizeof(mtype), uap->msgsz,
1262 	    uap->msgtyp, uap->msgflg, &mtype)) != 0)
1263 		return (error);
1264 	if ((error = copyout(&mtype, uap->msgp, sizeof(mtype))) != 0)
1265 		DPRINTF(("error %d copying the message type\n", error));
1266 	return (error);
1267 }
1268 
1269 static int
1270 sysctl_msqids(SYSCTL_HANDLER_ARGS)
1271 {
1272 
1273 	return (SYSCTL_OUT(req, msqids,
1274 	    sizeof(struct msqid_kernel) * msginfo.msgmni));
1275 }
1276 
1277 SYSCTL_INT(_kern_ipc, OID_AUTO, msgmax, CTLFLAG_RD, &msginfo.msgmax, 0,
1278     "Maximum message size");
1279 SYSCTL_INT(_kern_ipc, OID_AUTO, msgmni, CTLFLAG_RDTUN, &msginfo.msgmni, 0,
1280     "Number of message queue identifiers");
1281 SYSCTL_INT(_kern_ipc, OID_AUTO, msgmnb, CTLFLAG_RDTUN, &msginfo.msgmnb, 0,
1282     "Maximum number of bytes in a queue");
1283 SYSCTL_INT(_kern_ipc, OID_AUTO, msgtql, CTLFLAG_RDTUN, &msginfo.msgtql, 0,
1284     "Maximum number of messages in the system");
1285 SYSCTL_INT(_kern_ipc, OID_AUTO, msgssz, CTLFLAG_RDTUN, &msginfo.msgssz, 0,
1286     "Size of a message segment");
1287 SYSCTL_INT(_kern_ipc, OID_AUTO, msgseg, CTLFLAG_RDTUN, &msginfo.msgseg, 0,
1288     "Number of message segments");
1289 SYSCTL_PROC(_kern_ipc, OID_AUTO, msqids, CTLTYPE_OPAQUE | CTLFLAG_RD,
1290     NULL, 0, sysctl_msqids, "", "Message queue IDs");
1291 
1292 #ifdef COMPAT_FREEBSD32
1293 int
1294 freebsd32_msgsys(struct thread *td, struct freebsd32_msgsys_args *uap)
1295 {
1296 
1297 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1298     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1299 	switch (uap->which) {
1300 	case 0:
1301 		return (freebsd7_freebsd32_msgctl(td,
1302 		    (struct freebsd7_freebsd32_msgctl_args *)&uap->a2));
1303 	case 2:
1304 		return (freebsd32_msgsnd(td,
1305 		    (struct freebsd32_msgsnd_args *)&uap->a2));
1306 	case 3:
1307 		return (freebsd32_msgrcv(td,
1308 		    (struct freebsd32_msgrcv_args *)&uap->a2));
1309 	default:
1310 		return (msgsys(td, (struct msgsys_args *)uap));
1311 	}
1312 #else
1313 	return (nosys(td, NULL));
1314 #endif
1315 }
1316 
1317 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1318     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1319 int
1320 freebsd7_freebsd32_msgctl(struct thread *td,
1321     struct freebsd7_freebsd32_msgctl_args *uap)
1322 {
1323 	struct msqid_ds msqbuf;
1324 	struct msqid_ds32_old msqbuf32;
1325 	int error;
1326 
1327 	if (uap->cmd == IPC_SET) {
1328 		error = copyin(uap->buf, &msqbuf32, sizeof(msqbuf32));
1329 		if (error)
1330 			return (error);
1331 		freebsd32_ipcperm_old_in(&msqbuf32.msg_perm, &msqbuf.msg_perm);
1332 		PTRIN_CP(msqbuf32, msqbuf, msg_first);
1333 		PTRIN_CP(msqbuf32, msqbuf, msg_last);
1334 		CP(msqbuf32, msqbuf, msg_cbytes);
1335 		CP(msqbuf32, msqbuf, msg_qnum);
1336 		CP(msqbuf32, msqbuf, msg_qbytes);
1337 		CP(msqbuf32, msqbuf, msg_lspid);
1338 		CP(msqbuf32, msqbuf, msg_lrpid);
1339 		CP(msqbuf32, msqbuf, msg_stime);
1340 		CP(msqbuf32, msqbuf, msg_rtime);
1341 		CP(msqbuf32, msqbuf, msg_ctime);
1342 	}
1343 	error = kern_msgctl(td, uap->msqid, uap->cmd, &msqbuf);
1344 	if (error)
1345 		return (error);
1346 	if (uap->cmd == IPC_STAT) {
1347 		bzero(&msqbuf32, sizeof(msqbuf32));
1348 		freebsd32_ipcperm_old_out(&msqbuf.msg_perm, &msqbuf32.msg_perm);
1349 		PTROUT_CP(msqbuf, msqbuf32, msg_first);
1350 		PTROUT_CP(msqbuf, msqbuf32, msg_last);
1351 		CP(msqbuf, msqbuf32, msg_cbytes);
1352 		CP(msqbuf, msqbuf32, msg_qnum);
1353 		CP(msqbuf, msqbuf32, msg_qbytes);
1354 		CP(msqbuf, msqbuf32, msg_lspid);
1355 		CP(msqbuf, msqbuf32, msg_lrpid);
1356 		CP(msqbuf, msqbuf32, msg_stime);
1357 		CP(msqbuf, msqbuf32, msg_rtime);
1358 		CP(msqbuf, msqbuf32, msg_ctime);
1359 		error = copyout(&msqbuf32, uap->buf, sizeof(struct msqid_ds32));
1360 	}
1361 	return (error);
1362 }
1363 #endif
1364 
1365 int
1366 freebsd32_msgctl(struct thread *td, struct freebsd32_msgctl_args *uap)
1367 {
1368 	struct msqid_ds msqbuf;
1369 	struct msqid_ds32 msqbuf32;
1370 	int error;
1371 
1372 	if (uap->cmd == IPC_SET) {
1373 		error = copyin(uap->buf, &msqbuf32, sizeof(msqbuf32));
1374 		if (error)
1375 			return (error);
1376 		freebsd32_ipcperm_in(&msqbuf32.msg_perm, &msqbuf.msg_perm);
1377 		PTRIN_CP(msqbuf32, msqbuf, msg_first);
1378 		PTRIN_CP(msqbuf32, msqbuf, msg_last);
1379 		CP(msqbuf32, msqbuf, msg_cbytes);
1380 		CP(msqbuf32, msqbuf, msg_qnum);
1381 		CP(msqbuf32, msqbuf, msg_qbytes);
1382 		CP(msqbuf32, msqbuf, msg_lspid);
1383 		CP(msqbuf32, msqbuf, msg_lrpid);
1384 		CP(msqbuf32, msqbuf, msg_stime);
1385 		CP(msqbuf32, msqbuf, msg_rtime);
1386 		CP(msqbuf32, msqbuf, msg_ctime);
1387 	}
1388 	error = kern_msgctl(td, uap->msqid, uap->cmd, &msqbuf);
1389 	if (error)
1390 		return (error);
1391 	if (uap->cmd == IPC_STAT) {
1392 		freebsd32_ipcperm_out(&msqbuf.msg_perm, &msqbuf32.msg_perm);
1393 		PTROUT_CP(msqbuf, msqbuf32, msg_first);
1394 		PTROUT_CP(msqbuf, msqbuf32, msg_last);
1395 		CP(msqbuf, msqbuf32, msg_cbytes);
1396 		CP(msqbuf, msqbuf32, msg_qnum);
1397 		CP(msqbuf, msqbuf32, msg_qbytes);
1398 		CP(msqbuf, msqbuf32, msg_lspid);
1399 		CP(msqbuf, msqbuf32, msg_lrpid);
1400 		CP(msqbuf, msqbuf32, msg_stime);
1401 		CP(msqbuf, msqbuf32, msg_rtime);
1402 		CP(msqbuf, msqbuf32, msg_ctime);
1403 		error = copyout(&msqbuf32, uap->buf, sizeof(struct msqid_ds32));
1404 	}
1405 	return (error);
1406 }
1407 
1408 int
1409 freebsd32_msgsnd(struct thread *td, struct freebsd32_msgsnd_args *uap)
1410 {
1411 	const void *msgp;
1412 	long mtype;
1413 	int32_t mtype32;
1414 	int error;
1415 
1416 	msgp = PTRIN(uap->msgp);
1417 	if ((error = copyin(msgp, &mtype32, sizeof(mtype32))) != 0)
1418 		return (error);
1419 	mtype = mtype32;
1420 	return (kern_msgsnd(td, uap->msqid,
1421 	    (const char *)msgp + sizeof(mtype32),
1422 	    uap->msgsz, uap->msgflg, mtype));
1423 }
1424 
1425 int
1426 freebsd32_msgrcv(struct thread *td, struct freebsd32_msgrcv_args *uap)
1427 {
1428 	void *msgp;
1429 	long mtype;
1430 	int32_t mtype32;
1431 	int error;
1432 
1433 	msgp = PTRIN(uap->msgp);
1434 	if ((error = kern_msgrcv(td, uap->msqid,
1435 	    (char *)msgp + sizeof(mtype32), uap->msgsz,
1436 	    uap->msgtyp, uap->msgflg, &mtype)) != 0)
1437 		return (error);
1438 	mtype32 = (int32_t)mtype;
1439 	return (copyout(&mtype32, msgp, sizeof(mtype32)));
1440 }
1441 #endif
1442 
1443 #if defined(COMPAT_FREEBSD4) || defined(COMPAT_FREEBSD5) || \
1444     defined(COMPAT_FREEBSD6) || defined(COMPAT_FREEBSD7)
1445 
1446 /* XXX casting to (sy_call_t *) is bogus, as usual. */
1447 static sy_call_t *msgcalls[] = {
1448 	(sy_call_t *)freebsd7_msgctl, (sy_call_t *)msgget,
1449 	(sy_call_t *)msgsnd, (sy_call_t *)msgrcv
1450 };
1451 
1452 /*
1453  * Entry point for all MSG calls.
1454  */
1455 int
1456 msgsys(td, uap)
1457 	struct thread *td;
1458 	/* XXX actually varargs. */
1459 	struct msgsys_args /* {
1460 		int	which;
1461 		int	a2;
1462 		int	a3;
1463 		int	a4;
1464 		int	a5;
1465 		int	a6;
1466 	} */ *uap;
1467 {
1468 	int error;
1469 
1470 	if (!prison_allow(td->td_ucred, PR_ALLOW_SYSVIPC))
1471 		return (ENOSYS);
1472 	if (uap->which < 0 ||
1473 	    uap->which >= sizeof(msgcalls)/sizeof(msgcalls[0]))
1474 		return (EINVAL);
1475 	error = (*msgcalls[uap->which])(td, &uap->a2);
1476 	return (error);
1477 }
1478 
1479 #ifndef CP
1480 #define CP(src, dst, fld)	do { (dst).fld = (src).fld; } while (0)
1481 #endif
1482 
1483 #ifndef _SYS_SYSPROTO_H_
1484 struct freebsd7_msgctl_args {
1485 	int	msqid;
1486 	int	cmd;
1487 	struct	msqid_ds_old *buf;
1488 };
1489 #endif
1490 int
1491 freebsd7_msgctl(td, uap)
1492 	struct thread *td;
1493 	struct freebsd7_msgctl_args *uap;
1494 {
1495 	struct msqid_ds_old msqold;
1496 	struct msqid_ds msqbuf;
1497 	int error;
1498 
1499 	DPRINTF(("call to freebsd7_msgctl(%d, %d, %p)\n", uap->msqid, uap->cmd,
1500 	    uap->buf));
1501 	if (uap->cmd == IPC_SET) {
1502 		error = copyin(uap->buf, &msqold, sizeof(msqold));
1503 		if (error)
1504 			return (error);
1505 		ipcperm_old2new(&msqold.msg_perm, &msqbuf.msg_perm);
1506 		CP(msqold, msqbuf, msg_first);
1507 		CP(msqold, msqbuf, msg_last);
1508 		CP(msqold, msqbuf, msg_cbytes);
1509 		CP(msqold, msqbuf, msg_qnum);
1510 		CP(msqold, msqbuf, msg_qbytes);
1511 		CP(msqold, msqbuf, msg_lspid);
1512 		CP(msqold, msqbuf, msg_lrpid);
1513 		CP(msqold, msqbuf, msg_stime);
1514 		CP(msqold, msqbuf, msg_rtime);
1515 		CP(msqold, msqbuf, msg_ctime);
1516 	}
1517 	error = kern_msgctl(td, uap->msqid, uap->cmd, &msqbuf);
1518 	if (error)
1519 		return (error);
1520 	if (uap->cmd == IPC_STAT) {
1521 		bzero(&msqold, sizeof(msqold));
1522 		ipcperm_new2old(&msqbuf.msg_perm, &msqold.msg_perm);
1523 		CP(msqbuf, msqold, msg_first);
1524 		CP(msqbuf, msqold, msg_last);
1525 		CP(msqbuf, msqold, msg_cbytes);
1526 		CP(msqbuf, msqold, msg_qnum);
1527 		CP(msqbuf, msqold, msg_qbytes);
1528 		CP(msqbuf, msqold, msg_lspid);
1529 		CP(msqbuf, msqold, msg_lrpid);
1530 		CP(msqbuf, msqold, msg_stime);
1531 		CP(msqbuf, msqold, msg_rtime);
1532 		CP(msqbuf, msqold, msg_ctime);
1533 		error = copyout(&msqold, uap->buf, sizeof(struct msqid_ds_old));
1534 	}
1535 	return (error);
1536 }
1537 
1538 #undef CP
1539 
1540 #endif	/* COMPAT_FREEBSD4 || COMPAT_FREEBSD5 || COMPAT_FREEBSD6 ||
1541 	   COMPAT_FREEBSD7 */
1542