sysv_msg.c revision 1.28
1 /* $NetBSD: sysv_msg.c,v 1.28 2000/04/12 13:08:26 simonb Exp $ */ 2 3 /*- 4 * Copyright (c) 1999 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #define SYSVMSG 60 61 #include <sys/param.h> 62 #include <sys/systm.h> 63 #include <sys/kernel.h> 64 #include <sys/proc.h> 65 #include <sys/msg.h> 66 #include <sys/malloc.h> 67 68 #include <sys/mount.h> 69 #include <sys/syscallargs.h> 70 71 #define MSG_DEBUG 72 #undef MSG_DEBUG_OK 73 74 #ifdef MSG_DEBUG_OK 75 #define MSG_PRINTF(a) printf a 76 #else 77 #define MSG_PRINTF(a) 78 #endif 79 80 int nfree_msgmaps; /* # of free map entries */ 81 short free_msgmaps; /* head of linked list of free map entries */ 82 struct __msg *free_msghdrs; /* list of free msg headers */ 83 84 static void msg_freehdr __P((struct __msg *)); 85 86 void 87 msginit() 88 { 89 int i; 90 91 /* 92 * msginfo.msgssz should be a power of two for efficiency reasons. 93 * It is also pretty silly if msginfo.msgssz is less than 8 94 * or greater than about 256 so ... 95 */ 96 97 i = 8; 98 while (i < 1024 && i != msginfo.msgssz) 99 i <<= 1; 100 if (i != msginfo.msgssz) { 101 MSG_PRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 102 msginfo.msgssz)); 103 panic("msginfo.msgssz not a small power of 2"); 104 } 105 106 if (msginfo.msgseg > 32767) { 107 MSG_PRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 108 panic("msginfo.msgseg > 32767"); 109 } 110 111 if (msgmaps == NULL) 112 panic("msgmaps is NULL"); 113 114 for (i = 0; i < msginfo.msgseg; i++) { 115 if (i > 0) 116 msgmaps[i-1].next = i; 117 msgmaps[i].next = -1; /* implies entry is available */ 118 } 119 free_msgmaps = 0; 120 nfree_msgmaps = msginfo.msgseg; 121 122 if (msghdrs == NULL) 123 panic("msghdrs is NULL"); 124 125 for (i = 0; i < msginfo.msgtql; i++) { 126 msghdrs[i].msg_type = 0; 127 if (i > 0) 128 msghdrs[i-1].msg_next = &msghdrs[i]; 129 msghdrs[i].msg_next = NULL; 130 } 131 free_msghdrs = &msghdrs[0]; 132 133 if (msqids == NULL) 134 panic("msqids is NULL"); 135 136 for (i = 0; i < msginfo.msgmni; i++) { 137 msqids[i].msg_qbytes = 0; /* implies entry is available */ 138 msqids[i].msg_perm._seq = 0; /* reset to a known value */ 139 } 140 } 141 142 static void 143 msg_freehdr(msghdr) 144 struct __msg *msghdr; 145 { 146 while (msghdr->msg_ts > 0) { 147 short next; 148 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 149 panic("msghdr->msg_spot out of range"); 150 next = msgmaps[msghdr->msg_spot].next; 151 msgmaps[msghdr->msg_spot].next = free_msgmaps; 152 free_msgmaps = msghdr->msg_spot; 153 nfree_msgmaps++; 154 msghdr->msg_spot = next; 155 if (msghdr->msg_ts >= msginfo.msgssz) 156 msghdr->msg_ts -= msginfo.msgssz; 157 else 158 msghdr->msg_ts = 0; 159 } 160 if (msghdr->msg_spot != -1) 161 panic("msghdr->msg_spot != -1"); 162 msghdr->msg_next = free_msghdrs; 163 free_msghdrs = msghdr; 164 } 165 166 int 167 sys___msgctl13(p, v, retval) 168 struct proc *p; 169 void *v; 170 register_t *retval; 171 { 172 struct sys___msgctl13_args /* { 173 syscallarg(int) msqid; 174 syscallarg(int) cmd; 175 syscallarg(struct msqid_ds *) buf; 176 } */ *uap = v; 177 struct msqid_ds msqbuf; 178 int cmd, error; 179 180 cmd = SCARG(uap, cmd); 181 182 if (cmd == IPC_SET) { 183 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 184 if (error) 185 return (error); 186 } 187 188 error = msgctl1(p, SCARG(uap, msqid), cmd, 189 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 190 191 if (error == 0 && cmd == IPC_STAT) 192 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 193 194 return (error); 195 } 196 197 int 198 msgctl1(p, msqid, cmd, msqbuf) 199 struct proc *p; 200 int msqid; 201 int cmd; 202 struct msqid_ds *msqbuf; 203 { 204 struct ucred *cred = p->p_ucred; 205 struct msqid_ds *msqptr; 206 int error = 0, ix; 207 208 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 209 210 ix = IPCID_TO_IX(msqid); 211 212 if (ix < 0 || ix >= msginfo.msgmni) { 213 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 214 msginfo.msgmni)); 215 return (EINVAL); 216 } 217 218 msqptr = &msqids[ix]; 219 220 if (msqptr->msg_qbytes == 0) { 221 MSG_PRINTF(("no such msqid\n")); 222 return (EINVAL); 223 } 224 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 225 MSG_PRINTF(("wrong sequence number\n")); 226 return (EINVAL); 227 } 228 229 switch (cmd) { 230 case IPC_RMID: 231 { 232 struct __msg *msghdr; 233 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 234 return (error); 235 /* Free the message headers */ 236 msghdr = msqptr->_msg_first; 237 while (msghdr != NULL) { 238 struct __msg *msghdr_tmp; 239 240 /* Free the segments of each message */ 241 msqptr->_msg_cbytes -= msghdr->msg_ts; 242 msqptr->msg_qnum--; 243 msghdr_tmp = msghdr; 244 msghdr = msghdr->msg_next; 245 msg_freehdr(msghdr_tmp); 246 } 247 248 if (msqptr->_msg_cbytes != 0) 249 panic("msg_cbytes is screwed up"); 250 if (msqptr->msg_qnum != 0) 251 panic("msg_qnum is screwed up"); 252 253 msqptr->msg_qbytes = 0; /* Mark it as free */ 254 255 wakeup(msqptr); 256 } 257 break; 258 259 case IPC_SET: 260 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 261 return (error); 262 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && cred->cr_uid != 0) 263 return (EPERM); 264 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 265 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 266 "(truncating)\n", msginfo.msgmnb)); 267 /* silently restrict qbytes to system limit */ 268 msqbuf->msg_qbytes = msginfo.msgmnb; 269 } 270 if (msqbuf->msg_qbytes == 0) { 271 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 272 return (EINVAL); /* XXX non-standard errno! */ 273 } 274 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 275 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 276 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 277 (msqbuf->msg_perm.mode & 0777); 278 msqptr->msg_qbytes = msqbuf->msg_qbytes; 279 msqptr->msg_ctime = time.tv_sec; 280 break; 281 282 case IPC_STAT: 283 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 284 MSG_PRINTF(("requester doesn't have read access\n")); 285 return (error); 286 } 287 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 288 break; 289 290 default: 291 MSG_PRINTF(("invalid command %d\n", cmd)); 292 return (EINVAL); 293 } 294 295 return (error); 296 } 297 298 int 299 sys_msgget(p, v, retval) 300 struct proc *p; 301 void *v; 302 register_t *retval; 303 { 304 struct sys_msgget_args /* { 305 syscallarg(key_t) key; 306 syscallarg(int) msgflg; 307 } */ *uap = v; 308 int msqid, error; 309 int key = SCARG(uap, key); 310 int msgflg = SCARG(uap, msgflg); 311 struct ucred *cred = p->p_ucred; 312 struct msqid_ds *msqptr = NULL; 313 314 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 315 316 if (key != IPC_PRIVATE) { 317 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 318 msqptr = &msqids[msqid]; 319 if (msqptr->msg_qbytes != 0 && 320 msqptr->msg_perm._key == key) 321 break; 322 } 323 if (msqid < msginfo.msgmni) { 324 MSG_PRINTF(("found public key\n")); 325 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 326 MSG_PRINTF(("not exclusive\n")); 327 return(EEXIST); 328 } 329 if ((error = ipcperm(cred, &msqptr->msg_perm, 330 msgflg & 0700 ))) { 331 MSG_PRINTF(("requester doesn't have 0%o access\n", 332 msgflg & 0700)); 333 return (error); 334 } 335 goto found; 336 } 337 } 338 339 MSG_PRINTF(("need to allocate the msqid_ds\n")); 340 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 341 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 342 /* 343 * Look for an unallocated and unlocked msqid_ds. 344 * msqid_ds's can be locked by msgsnd or msgrcv while 345 * they are copying the message in/out. We can't 346 * re-use the entry until they release it. 347 */ 348 msqptr = &msqids[msqid]; 349 if (msqptr->msg_qbytes == 0 && 350 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 351 break; 352 } 353 if (msqid == msginfo.msgmni) { 354 MSG_PRINTF(("no more msqid_ds's available\n")); 355 return (ENOSPC); 356 } 357 MSG_PRINTF(("msqid %d is available\n", msqid)); 358 msqptr->msg_perm._key = key; 359 msqptr->msg_perm.cuid = cred->cr_uid; 360 msqptr->msg_perm.uid = cred->cr_uid; 361 msqptr->msg_perm.cgid = cred->cr_gid; 362 msqptr->msg_perm.gid = cred->cr_gid; 363 msqptr->msg_perm.mode = (msgflg & 0777); 364 /* Make sure that the returned msqid is unique */ 365 msqptr->msg_perm._seq++; 366 msqptr->_msg_first = NULL; 367 msqptr->_msg_last = NULL; 368 msqptr->_msg_cbytes = 0; 369 msqptr->msg_qnum = 0; 370 msqptr->msg_qbytes = msginfo.msgmnb; 371 msqptr->msg_lspid = 0; 372 msqptr->msg_lrpid = 0; 373 msqptr->msg_stime = 0; 374 msqptr->msg_rtime = 0; 375 msqptr->msg_ctime = time.tv_sec; 376 } else { 377 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 378 return (ENOENT); 379 } 380 381 found: 382 /* Construct the unique msqid */ 383 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 384 return (0); 385 } 386 387 int 388 sys_msgsnd(p, v, retval) 389 struct proc *p; 390 void *v; 391 register_t *retval; 392 { 393 struct sys_msgsnd_args /* { 394 syscallarg(int) msqid; 395 syscallarg(const void *) msgp; 396 syscallarg(size_t) msgsz; 397 syscallarg(int) msgflg; 398 } */ *uap = v; 399 int msqid = SCARG(uap, msqid); 400 const char *user_msgp = SCARG(uap, msgp); 401 size_t msgsz = SCARG(uap, msgsz); 402 int msgflg = SCARG(uap, msgflg); 403 int segs_needed, error; 404 struct ucred *cred = p->p_ucred; 405 struct msqid_ds *msqptr; 406 struct __msg *msghdr; 407 short next; 408 409 MSG_PRINTF(("call to msgsnd(%d, %p, %d, %d)\n", msqid, user_msgp, msgsz, 410 msgflg)); 411 412 msqid = IPCID_TO_IX(msqid); 413 414 if (msqid < 0 || msqid >= msginfo.msgmni) { 415 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 416 msginfo.msgmni)); 417 return (EINVAL); 418 } 419 420 msqptr = &msqids[msqid]; 421 if (msqptr->msg_qbytes == 0) { 422 MSG_PRINTF(("no such message queue id\n")); 423 return (EINVAL); 424 } 425 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 426 MSG_PRINTF(("wrong sequence number\n")); 427 return (EINVAL); 428 } 429 430 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 431 MSG_PRINTF(("requester doesn't have write access\n")); 432 return (error); 433 } 434 435 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 436 MSG_PRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, 437 msginfo.msgssz, segs_needed)); 438 for (;;) { 439 int need_more_resources = 0; 440 441 /* 442 * check msgsz [cannot be negative since it is unsigned] 443 * (inside this loop in case msg_qbytes changes while we sleep) 444 */ 445 446 if (msgsz > msqptr->msg_qbytes) { 447 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 448 return (EINVAL); 449 } 450 451 if (msqptr->msg_perm.mode & MSG_LOCKED) { 452 MSG_PRINTF(("msqid is locked\n")); 453 need_more_resources = 1; 454 } 455 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 456 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 457 need_more_resources = 1; 458 } 459 if (segs_needed > nfree_msgmaps) { 460 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 461 need_more_resources = 1; 462 } 463 if (free_msghdrs == NULL) { 464 MSG_PRINTF(("no more msghdrs\n")); 465 need_more_resources = 1; 466 } 467 468 if (need_more_resources) { 469 int we_own_it; 470 471 if ((msgflg & IPC_NOWAIT) != 0) { 472 MSG_PRINTF(("need more resources but caller " 473 "doesn't want to wait\n")); 474 return (EAGAIN); 475 } 476 477 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 478 MSG_PRINTF(("we don't own the msqid_ds\n")); 479 we_own_it = 0; 480 } else { 481 /* Force later arrivals to wait for our 482 request */ 483 MSG_PRINTF(("we own the msqid_ds\n")); 484 msqptr->msg_perm.mode |= MSG_LOCKED; 485 we_own_it = 1; 486 } 487 MSG_PRINTF(("goodnight\n")); 488 error = tsleep(msqptr, (PZERO - 4) | PCATCH, 489 "msgwait", 0); 490 MSG_PRINTF(("good morning, error=%d\n", error)); 491 if (we_own_it) 492 msqptr->msg_perm.mode &= ~MSG_LOCKED; 493 if (error != 0) { 494 MSG_PRINTF(("msgsnd: interrupted system " 495 "call\n")); 496 return (EINTR); 497 } 498 499 /* 500 * Make sure that the msq queue still exists 501 */ 502 503 if (msqptr->msg_qbytes == 0) { 504 MSG_PRINTF(("msqid deleted\n")); 505 return (EIDRM); 506 } 507 } else { 508 MSG_PRINTF(("got all the resources that we need\n")); 509 break; 510 } 511 } 512 513 /* 514 * We have the resources that we need. 515 * Make sure! 516 */ 517 518 if (msqptr->msg_perm.mode & MSG_LOCKED) 519 panic("msg_perm.mode & MSG_LOCKED"); 520 if (segs_needed > nfree_msgmaps) 521 panic("segs_needed > nfree_msgmaps"); 522 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) 523 panic("msgsz + msg_cbytes > msg_qbytes"); 524 if (free_msghdrs == NULL) 525 panic("no more msghdrs"); 526 527 /* 528 * Re-lock the msqid_ds in case we page-fault when copying in the 529 * message 530 */ 531 532 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 533 panic("msqid_ds is already locked"); 534 msqptr->msg_perm.mode |= MSG_LOCKED; 535 536 /* 537 * Allocate a message header 538 */ 539 540 msghdr = free_msghdrs; 541 free_msghdrs = msghdr->msg_next; 542 msghdr->msg_spot = -1; 543 msghdr->msg_ts = msgsz; 544 545 /* 546 * Allocate space for the message 547 */ 548 549 while (segs_needed > 0) { 550 if (nfree_msgmaps <= 0) 551 panic("not enough msgmaps"); 552 if (free_msgmaps == -1) 553 panic("nil free_msgmaps"); 554 next = free_msgmaps; 555 if (next <= -1) 556 panic("next too low #1"); 557 if (next >= msginfo.msgseg) 558 panic("next out of range #1"); 559 MSG_PRINTF(("allocating segment %d to message\n", next)); 560 free_msgmaps = msgmaps[next].next; 561 nfree_msgmaps--; 562 msgmaps[next].next = msghdr->msg_spot; 563 msghdr->msg_spot = next; 564 segs_needed--; 565 } 566 567 /* 568 * Copy in the message type 569 */ 570 571 if ((error = copyin(user_msgp, &msghdr->msg_type, 572 sizeof(msghdr->msg_type))) != 0) { 573 MSG_PRINTF(("error %d copying the message type\n", error)); 574 msg_freehdr(msghdr); 575 msqptr->msg_perm.mode &= ~MSG_LOCKED; 576 wakeup(msqptr); 577 return (error); 578 } 579 user_msgp += sizeof(msghdr->msg_type); 580 581 /* 582 * Validate the message type 583 */ 584 585 if (msghdr->msg_type < 1) { 586 msg_freehdr(msghdr); 587 msqptr->msg_perm.mode &= ~MSG_LOCKED; 588 wakeup(msqptr); 589 MSG_PRINTF(("mtype (%d) < 1\n", msghdr->msg_type)); 590 return (EINVAL); 591 } 592 593 /* 594 * Copy in the message body 595 */ 596 597 next = msghdr->msg_spot; 598 while (msgsz > 0) { 599 size_t tlen; 600 if (msgsz > msginfo.msgssz) 601 tlen = msginfo.msgssz; 602 else 603 tlen = msgsz; 604 if (next <= -1) 605 panic("next too low #2"); 606 if (next >= msginfo.msgseg) 607 panic("next out of range #2"); 608 if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 609 tlen)) != 0) { 610 MSG_PRINTF(("error %d copying in message segment\n", 611 error)); 612 msg_freehdr(msghdr); 613 msqptr->msg_perm.mode &= ~MSG_LOCKED; 614 wakeup(msqptr); 615 return (error); 616 } 617 msgsz -= tlen; 618 user_msgp += tlen; 619 next = msgmaps[next].next; 620 } 621 if (next != -1) 622 panic("didn't use all the msg segments"); 623 624 /* 625 * We've got the message. Unlock the msqid_ds. 626 */ 627 628 msqptr->msg_perm.mode &= ~MSG_LOCKED; 629 630 /* 631 * Make sure that the msqid_ds is still allocated. 632 */ 633 634 if (msqptr->msg_qbytes == 0) { 635 msg_freehdr(msghdr); 636 wakeup(msqptr); 637 return (EIDRM); 638 } 639 640 /* 641 * Put the message into the queue 642 */ 643 644 if (msqptr->_msg_first == NULL) { 645 msqptr->_msg_first = msghdr; 646 msqptr->_msg_last = msghdr; 647 } else { 648 msqptr->_msg_last->msg_next = msghdr; 649 msqptr->_msg_last = msghdr; 650 } 651 msqptr->_msg_last->msg_next = NULL; 652 653 msqptr->_msg_cbytes += msghdr->msg_ts; 654 msqptr->msg_qnum++; 655 msqptr->msg_lspid = p->p_pid; 656 msqptr->msg_stime = time.tv_sec; 657 658 wakeup(msqptr); 659 return (0); 660 } 661 662 int 663 sys_msgrcv(p, v, retval) 664 struct proc *p; 665 void *v; 666 register_t *retval; 667 { 668 struct sys_msgrcv_args /* { 669 syscallarg(int) msqid; 670 syscallarg(void *) msgp; 671 syscallarg(size_t) msgsz; 672 syscallarg(long) msgtyp; 673 syscallarg(int) msgflg; 674 } */ *uap = v; 675 int msqid = SCARG(uap, msqid); 676 char *user_msgp = SCARG(uap, msgp); 677 size_t msgsz = SCARG(uap, msgsz); 678 long msgtyp = SCARG(uap, msgtyp); 679 int msgflg = SCARG(uap, msgflg); 680 size_t len; 681 struct ucred *cred = p->p_ucred; 682 struct msqid_ds *msqptr; 683 struct __msg *msghdr; 684 int error; 685 short next; 686 687 MSG_PRINTF(("call to msgrcv(%d, %p, %d, %ld, %d)\n", msqid, user_msgp, 688 msgsz, msgtyp, msgflg)); 689 690 msqid = IPCID_TO_IX(msqid); 691 692 if (msqid < 0 || msqid >= msginfo.msgmni) { 693 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 694 msginfo.msgmni)); 695 return (EINVAL); 696 } 697 698 msqptr = &msqids[msqid]; 699 if (msqptr->msg_qbytes == 0) { 700 MSG_PRINTF(("no such message queue id\n")); 701 return (EINVAL); 702 } 703 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 704 MSG_PRINTF(("wrong sequence number\n")); 705 return (EINVAL); 706 } 707 708 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 709 MSG_PRINTF(("requester doesn't have read access\n")); 710 return (error); 711 } 712 713 #if 0 714 /* cannot happen, msgsz is unsigned */ 715 if (msgsz < 0) { 716 MSG_PRINTF(("msgsz < 0\n")); 717 return (EINVAL); 718 } 719 #endif 720 721 msghdr = NULL; 722 while (msghdr == NULL) { 723 if (msgtyp == 0) { 724 msghdr = msqptr->_msg_first; 725 if (msghdr != NULL) { 726 if (msgsz < msghdr->msg_ts && 727 (msgflg & MSG_NOERROR) == 0) { 728 MSG_PRINTF(("first message on the " 729 "queue is too big " 730 "(want %d, got %d)\n", 731 msgsz, msghdr->msg_ts)); 732 return (E2BIG); 733 } 734 if (msqptr->_msg_first == msqptr->_msg_last) { 735 msqptr->_msg_first = NULL; 736 msqptr->_msg_last = NULL; 737 } else { 738 msqptr->_msg_first = msghdr->msg_next; 739 if (msqptr->_msg_first == NULL) 740 panic("msg_first/last screwed " 741 "up #1"); 742 } 743 } 744 } else { 745 struct __msg *previous; 746 struct __msg **prev; 747 748 for (previous = NULL, prev = &msqptr->_msg_first; 749 (msghdr = *prev) != NULL; 750 previous = msghdr, prev = &msghdr->msg_next) { 751 /* 752 * Is this message's type an exact match or is 753 * this message's type less than or equal to 754 * the absolute value of a negative msgtyp? 755 * Note that the second half of this test can 756 * NEVER be true if msgtyp is positive since 757 * msg_type is always positive! 758 */ 759 760 if (msgtyp == msghdr->msg_type || 761 msghdr->msg_type <= -msgtyp) { 762 MSG_PRINTF(("found message type %d, " 763 "requested %d\n", 764 msghdr->msg_type, msgtyp)); 765 if (msgsz < msghdr->msg_ts && 766 (msgflg & MSG_NOERROR) == 0) { 767 MSG_PRINTF(("requested message " 768 "on the queue is too big " 769 "(want %d, got %d)\n", 770 msgsz, msghdr->msg_ts)); 771 return (E2BIG); 772 } 773 *prev = msghdr->msg_next; 774 if (msghdr == msqptr->_msg_last) { 775 if (previous == NULL) { 776 if (prev != 777 &msqptr->_msg_first) 778 panic("msg_first/last screwed up #2"); 779 msqptr->_msg_first = 780 NULL; 781 msqptr->_msg_last = 782 NULL; 783 } else { 784 if (prev == 785 &msqptr->_msg_first) 786 panic("msg_first/last screwed up #3"); 787 msqptr->_msg_last = 788 previous; 789 } 790 } 791 break; 792 } 793 } 794 } 795 796 /* 797 * We've either extracted the msghdr for the appropriate 798 * message or there isn't one. 799 * If there is one then bail out of this loop. 800 */ 801 802 if (msghdr != NULL) 803 break; 804 805 /* 806 * Hmph! No message found. Does the user want to wait? 807 */ 808 809 if ((msgflg & IPC_NOWAIT) != 0) { 810 MSG_PRINTF(("no appropriate message found (msgtyp=%d)\n", 811 msgtyp)); 812 /* The SVID says to return ENOMSG. */ 813 #ifdef ENOMSG 814 return (ENOMSG); 815 #else 816 /* Unfortunately, BSD doesn't define that code yet! */ 817 return (EAGAIN); 818 #endif 819 } 820 821 /* 822 * Wait for something to happen 823 */ 824 825 MSG_PRINTF(("msgrcv: goodnight\n")); 826 error = tsleep(msqptr, (PZERO - 4) | PCATCH, "msgwait", 827 0); 828 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 829 830 if (error != 0) { 831 MSG_PRINTF(("msgsnd: interrupted system call\n")); 832 return (EINTR); 833 } 834 835 /* 836 * Make sure that the msq queue still exists 837 */ 838 839 if (msqptr->msg_qbytes == 0 || 840 msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 841 MSG_PRINTF(("msqid deleted\n")); 842 return (EIDRM); 843 } 844 } 845 846 /* 847 * Return the message to the user. 848 * 849 * First, do the bookkeeping (before we risk being interrupted). 850 */ 851 852 msqptr->_msg_cbytes -= msghdr->msg_ts; 853 msqptr->msg_qnum--; 854 msqptr->msg_lrpid = p->p_pid; 855 msqptr->msg_rtime = time.tv_sec; 856 857 /* 858 * Make msgsz the actual amount that we'll be returning. 859 * Note that this effectively truncates the message if it is too long 860 * (since msgsz is never increased). 861 */ 862 863 MSG_PRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 864 msghdr->msg_ts)); 865 if (msgsz > msghdr->msg_ts) 866 msgsz = msghdr->msg_ts; 867 868 /* 869 * Return the type to the user. 870 */ 871 872 error = copyout(&msghdr->msg_type, user_msgp, sizeof(msghdr->msg_type)); 873 if (error != 0) { 874 MSG_PRINTF(("error (%d) copying out message type\n", error)); 875 msg_freehdr(msghdr); 876 wakeup(msqptr); 877 return (error); 878 } 879 user_msgp += sizeof(msghdr->msg_type); 880 881 /* 882 * Return the segments to the user 883 */ 884 885 next = msghdr->msg_spot; 886 for (len = 0; len < msgsz; len += msginfo.msgssz) { 887 size_t tlen; 888 889 if (msgsz - len > msginfo.msgssz) 890 tlen = msginfo.msgssz; 891 else 892 tlen = msgsz - len; 893 if (next <= -1) 894 panic("next too low #3"); 895 if (next >= msginfo.msgseg) 896 panic("next out of range #3"); 897 error = copyout(&msgpool[next * msginfo.msgssz], 898 user_msgp, tlen); 899 if (error != 0) { 900 MSG_PRINTF(("error (%d) copying out message segment\n", 901 error)); 902 msg_freehdr(msghdr); 903 wakeup(msqptr); 904 return (error); 905 } 906 user_msgp += tlen; 907 next = msgmaps[next].next; 908 } 909 910 /* 911 * Done, return the actual number of bytes copied out. 912 */ 913 914 msg_freehdr(msghdr); 915 wakeup(msqptr); 916 *retval = msgsz; 917 return (0); 918 } 919
Indexes created Wed Oct 01 13:09:50 GMT 2025