sysv_msg.c revision 1.32.2.3
1 /* $NetBSD: sysv_msg.c,v 1.32.2.3 2002/04/01 07:47:58 nathanw Exp $ */ 2 3 /*- 4 * Copyright (c) 1999 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.32.2.3 2002/04/01 07:47:58 nathanw Exp $"); 61 62 #define SYSVMSG 63 64 #include <sys/param.h> 65 #include <sys/kernel.h> 66 #include <sys/msg.h> 67 #include <sys/sysctl.h> 68 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */ 69 #include <sys/syscallargs.h> 70 71 #define MSG_DEBUG 72 #undef MSG_DEBUG_OK 73 74 #ifdef MSG_DEBUG_OK 75 #define MSG_PRINTF(a) printf a 76 #else 77 #define MSG_PRINTF(a) 78 #endif 79 80 int nfree_msgmaps; /* # of free map entries */ 81 short free_msgmaps; /* head of linked list of free map entries */ 82 struct __msg *free_msghdrs; /* list of free msg headers */ 83 char *msgpool; /* MSGMAX byte long msg buffer pool */ 84 struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 85 struct __msg *msghdrs; /* MSGTQL msg headers */ 86 struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 87 88 static void msg_freehdr __P((struct __msg *)); 89 90 void 91 msginit() 92 { 93 int i; 94 95 /* 96 * msginfo.msgssz should be a power of two for efficiency reasons. 97 * It is also pretty silly if msginfo.msgssz is less than 8 98 * or greater than about 256 so ... 99 */ 100 101 i = 8; 102 while (i < 1024 && i != msginfo.msgssz) 103 i <<= 1; 104 if (i != msginfo.msgssz) { 105 MSG_PRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 106 msginfo.msgssz)); 107 panic("msginfo.msgssz not a small power of 2"); 108 } 109 110 if (msginfo.msgseg > 32767) { 111 MSG_PRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 112 panic("msginfo.msgseg > 32767"); 113 } 114 115 if (msgmaps == NULL) 116 panic("msgmaps is NULL"); 117 118 for (i = 0; i < msginfo.msgseg; i++) { 119 if (i > 0) 120 msgmaps[i-1].next = i; 121 msgmaps[i].next = -1; /* implies entry is available */ 122 } 123 free_msgmaps = 0; 124 nfree_msgmaps = msginfo.msgseg; 125 126 if (msghdrs == NULL) 127 panic("msghdrs is NULL"); 128 129 for (i = 0; i < msginfo.msgtql; i++) { 130 msghdrs[i].msg_type = 0; 131 if (i > 0) 132 msghdrs[i-1].msg_next = &msghdrs[i]; 133 msghdrs[i].msg_next = NULL; 134 } 135 free_msghdrs = &msghdrs[0]; 136 137 if (msqids == NULL) 138 panic("msqids is NULL"); 139 140 for (i = 0; i < msginfo.msgmni; i++) { 141 msqids[i].msg_qbytes = 0; /* implies entry is available */ 142 msqids[i].msg_perm._seq = 0; /* reset to a known value */ 143 } 144 } 145 146 static void 147 msg_freehdr(msghdr) 148 struct __msg *msghdr; 149 { 150 while (msghdr->msg_ts > 0) { 151 short next; 152 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 153 panic("msghdr->msg_spot out of range"); 154 next = msgmaps[msghdr->msg_spot].next; 155 msgmaps[msghdr->msg_spot].next = free_msgmaps; 156 free_msgmaps = msghdr->msg_spot; 157 nfree_msgmaps++; 158 msghdr->msg_spot = next; 159 if (msghdr->msg_ts >= msginfo.msgssz) 160 msghdr->msg_ts -= msginfo.msgssz; 161 else 162 msghdr->msg_ts = 0; 163 } 164 if (msghdr->msg_spot != -1) 165 panic("msghdr->msg_spot != -1"); 166 msghdr->msg_next = free_msghdrs; 167 free_msghdrs = msghdr; 168 } 169 170 int 171 sys___msgctl13(l, v, retval) 172 struct lwp *l; 173 void *v; 174 register_t *retval; 175 { 176 struct sys___msgctl13_args /* { 177 syscallarg(int) msqid; 178 syscallarg(int) cmd; 179 syscallarg(struct msqid_ds *) buf; 180 } */ *uap = v; 181 struct proc *p = l->l_proc; 182 struct msqid_ds msqbuf; 183 int cmd, error; 184 185 cmd = SCARG(uap, cmd); 186 187 if (cmd == IPC_SET) { 188 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 189 if (error) 190 return (error); 191 } 192 193 error = msgctl1(p, SCARG(uap, msqid), cmd, 194 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 195 196 if (error == 0 && cmd == IPC_STAT) 197 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 198 199 return (error); 200 } 201 202 int 203 msgctl1(p, msqid, cmd, msqbuf) 204 struct proc *p; 205 int msqid; 206 int cmd; 207 struct msqid_ds *msqbuf; 208 { 209 struct ucred *cred = p->p_ucred; 210 struct msqid_ds *msqptr; 211 int error = 0, ix; 212 213 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 214 215 ix = IPCID_TO_IX(msqid); 216 217 if (ix < 0 || ix >= msginfo.msgmni) { 218 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 219 msginfo.msgmni)); 220 return (EINVAL); 221 } 222 223 msqptr = &msqids[ix]; 224 225 if (msqptr->msg_qbytes == 0) { 226 MSG_PRINTF(("no such msqid\n")); 227 return (EINVAL); 228 } 229 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 230 MSG_PRINTF(("wrong sequence number\n")); 231 return (EINVAL); 232 } 233 234 switch (cmd) { 235 case IPC_RMID: 236 { 237 struct __msg *msghdr; 238 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 239 return (error); 240 /* Free the message headers */ 241 msghdr = msqptr->_msg_first; 242 while (msghdr != NULL) { 243 struct __msg *msghdr_tmp; 244 245 /* Free the segments of each message */ 246 msqptr->_msg_cbytes -= msghdr->msg_ts; 247 msqptr->msg_qnum--; 248 msghdr_tmp = msghdr; 249 msghdr = msghdr->msg_next; 250 msg_freehdr(msghdr_tmp); 251 } 252 253 if (msqptr->_msg_cbytes != 0) 254 panic("msg_cbytes is screwed up"); 255 if (msqptr->msg_qnum != 0) 256 panic("msg_qnum is screwed up"); 257 258 msqptr->msg_qbytes = 0; /* Mark it as free */ 259 260 wakeup(msqptr); 261 } 262 break; 263 264 case IPC_SET: 265 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 266 return (error); 267 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && cred->cr_uid != 0) 268 return (EPERM); 269 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 270 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 271 "(truncating)\n", msginfo.msgmnb)); 272 /* silently restrict qbytes to system limit */ 273 msqbuf->msg_qbytes = msginfo.msgmnb; 274 } 275 if (msqbuf->msg_qbytes == 0) { 276 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 277 return (EINVAL); /* XXX non-standard errno! */ 278 } 279 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 280 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 281 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 282 (msqbuf->msg_perm.mode & 0777); 283 msqptr->msg_qbytes = msqbuf->msg_qbytes; 284 msqptr->msg_ctime = time.tv_sec; 285 break; 286 287 case IPC_STAT: 288 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 289 MSG_PRINTF(("requester doesn't have read access\n")); 290 return (error); 291 } 292 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 293 break; 294 295 default: 296 MSG_PRINTF(("invalid command %d\n", cmd)); 297 return (EINVAL); 298 } 299 300 return (error); 301 } 302 303 int 304 sys_msgget(l, v, retval) 305 struct lwp *l; 306 void *v; 307 register_t *retval; 308 { 309 struct sys_msgget_args /* { 310 syscallarg(key_t) key; 311 syscallarg(int) msgflg; 312 } */ *uap = v; 313 struct proc *p = l->l_proc; 314 int msqid, error; 315 int key = SCARG(uap, key); 316 int msgflg = SCARG(uap, msgflg); 317 struct ucred *cred = p->p_ucred; 318 struct msqid_ds *msqptr = NULL; 319 320 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 321 322 if (key != IPC_PRIVATE) { 323 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 324 msqptr = &msqids[msqid]; 325 if (msqptr->msg_qbytes != 0 && 326 msqptr->msg_perm._key == key) 327 break; 328 } 329 if (msqid < msginfo.msgmni) { 330 MSG_PRINTF(("found public key\n")); 331 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 332 MSG_PRINTF(("not exclusive\n")); 333 return(EEXIST); 334 } 335 if ((error = ipcperm(cred, &msqptr->msg_perm, 336 msgflg & 0700 ))) { 337 MSG_PRINTF(("requester doesn't have 0%o access\n", 338 msgflg & 0700)); 339 return (error); 340 } 341 goto found; 342 } 343 } 344 345 MSG_PRINTF(("need to allocate the msqid_ds\n")); 346 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 347 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 348 /* 349 * Look for an unallocated and unlocked msqid_ds. 350 * msqid_ds's can be locked by msgsnd or msgrcv while 351 * they are copying the message in/out. We can't 352 * re-use the entry until they release it. 353 */ 354 msqptr = &msqids[msqid]; 355 if (msqptr->msg_qbytes == 0 && 356 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 357 break; 358 } 359 if (msqid == msginfo.msgmni) { 360 MSG_PRINTF(("no more msqid_ds's available\n")); 361 return (ENOSPC); 362 } 363 MSG_PRINTF(("msqid %d is available\n", msqid)); 364 msqptr->msg_perm._key = key; 365 msqptr->msg_perm.cuid = cred->cr_uid; 366 msqptr->msg_perm.uid = cred->cr_uid; 367 msqptr->msg_perm.cgid = cred->cr_gid; 368 msqptr->msg_perm.gid = cred->cr_gid; 369 msqptr->msg_perm.mode = (msgflg & 0777); 370 /* Make sure that the returned msqid is unique */ 371 msqptr->msg_perm._seq++; 372 msqptr->_msg_first = NULL; 373 msqptr->_msg_last = NULL; 374 msqptr->_msg_cbytes = 0; 375 msqptr->msg_qnum = 0; 376 msqptr->msg_qbytes = msginfo.msgmnb; 377 msqptr->msg_lspid = 0; 378 msqptr->msg_lrpid = 0; 379 msqptr->msg_stime = 0; 380 msqptr->msg_rtime = 0; 381 msqptr->msg_ctime = time.tv_sec; 382 } else { 383 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 384 return (ENOENT); 385 } 386 387 found: 388 /* Construct the unique msqid */ 389 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 390 return (0); 391 } 392 393 int 394 sys_msgsnd(l, v, retval) 395 struct lwp *l; 396 void *v; 397 register_t *retval; 398 { 399 struct sys_msgsnd_args /* { 400 syscallarg(int) msqid; 401 syscallarg(const void *) msgp; 402 syscallarg(size_t) msgsz; 403 syscallarg(int) msgflg; 404 } */ *uap = v; 405 struct proc *p = l->l_proc; 406 int msqid = SCARG(uap, msqid); 407 const char *user_msgp = SCARG(uap, msgp); 408 size_t msgsz = SCARG(uap, msgsz); 409 int msgflg = SCARG(uap, msgflg); 410 int segs_needed, error; 411 struct ucred *cred = p->p_ucred; 412 struct msqid_ds *msqptr; 413 struct __msg *msghdr; 414 short next; 415 416 MSG_PRINTF(("call to msgsnd(%d, %p, %lld, %d)\n", msqid, user_msgp, 417 (long long)msgsz, msgflg)); 418 419 msqid = IPCID_TO_IX(msqid); 420 421 if (msqid < 0 || msqid >= msginfo.msgmni) { 422 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 423 msginfo.msgmni)); 424 return (EINVAL); 425 } 426 427 msqptr = &msqids[msqid]; 428 if (msqptr->msg_qbytes == 0) { 429 MSG_PRINTF(("no such message queue id\n")); 430 return (EINVAL); 431 } 432 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 433 MSG_PRINTF(("wrong sequence number\n")); 434 return (EINVAL); 435 } 436 437 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 438 MSG_PRINTF(("requester doesn't have write access\n")); 439 return (error); 440 } 441 442 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 443 MSG_PRINTF(("msgsz=%lld, msgssz=%d, segs_needed=%d\n", 444 (long long)msgsz, msginfo.msgssz, segs_needed)); 445 for (;;) { 446 int need_more_resources = 0; 447 448 /* 449 * check msgsz [cannot be negative since it is unsigned] 450 * (inside this loop in case msg_qbytes changes while we sleep) 451 */ 452 453 if (msgsz > msqptr->msg_qbytes) { 454 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 455 return (EINVAL); 456 } 457 458 if (msqptr->msg_perm.mode & MSG_LOCKED) { 459 MSG_PRINTF(("msqid is locked\n")); 460 need_more_resources = 1; 461 } 462 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 463 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 464 need_more_resources = 1; 465 } 466 if (segs_needed > nfree_msgmaps) { 467 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 468 need_more_resources = 1; 469 } 470 if (free_msghdrs == NULL) { 471 MSG_PRINTF(("no more msghdrs\n")); 472 need_more_resources = 1; 473 } 474 475 if (need_more_resources) { 476 int we_own_it; 477 478 if ((msgflg & IPC_NOWAIT) != 0) { 479 MSG_PRINTF(("need more resources but caller " 480 "doesn't want to wait\n")); 481 return (EAGAIN); 482 } 483 484 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 485 MSG_PRINTF(("we don't own the msqid_ds\n")); 486 we_own_it = 0; 487 } else { 488 /* Force later arrivals to wait for our 489 request */ 490 MSG_PRINTF(("we own the msqid_ds\n")); 491 msqptr->msg_perm.mode |= MSG_LOCKED; 492 we_own_it = 1; 493 } 494 MSG_PRINTF(("goodnight\n")); 495 error = tsleep(msqptr, (PZERO - 4) | PCATCH, 496 "msgwait", 0); 497 MSG_PRINTF(("good morning, error=%d\n", error)); 498 if (we_own_it) 499 msqptr->msg_perm.mode &= ~MSG_LOCKED; 500 if (error != 0) { 501 MSG_PRINTF(("msgsnd: interrupted system " 502 "call\n")); 503 return (EINTR); 504 } 505 506 /* 507 * Make sure that the msq queue still exists 508 */ 509 510 if (msqptr->msg_qbytes == 0) { 511 MSG_PRINTF(("msqid deleted\n")); 512 return (EIDRM); 513 } 514 } else { 515 MSG_PRINTF(("got all the resources that we need\n")); 516 break; 517 } 518 } 519 520 /* 521 * We have the resources that we need. 522 * Make sure! 523 */ 524 525 if (msqptr->msg_perm.mode & MSG_LOCKED) 526 panic("msg_perm.mode & MSG_LOCKED"); 527 if (segs_needed > nfree_msgmaps) 528 panic("segs_needed > nfree_msgmaps"); 529 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) 530 panic("msgsz + msg_cbytes > msg_qbytes"); 531 if (free_msghdrs == NULL) 532 panic("no more msghdrs"); 533 534 /* 535 * Re-lock the msqid_ds in case we page-fault when copying in the 536 * message 537 */ 538 539 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 540 panic("msqid_ds is already locked"); 541 msqptr->msg_perm.mode |= MSG_LOCKED; 542 543 /* 544 * Allocate a message header 545 */ 546 547 msghdr = free_msghdrs; 548 free_msghdrs = msghdr->msg_next; 549 msghdr->msg_spot = -1; 550 msghdr->msg_ts = msgsz; 551 552 /* 553 * Allocate space for the message 554 */ 555 556 while (segs_needed > 0) { 557 if (nfree_msgmaps <= 0) 558 panic("not enough msgmaps"); 559 if (free_msgmaps == -1) 560 panic("nil free_msgmaps"); 561 next = free_msgmaps; 562 if (next <= -1) 563 panic("next too low #1"); 564 if (next >= msginfo.msgseg) 565 panic("next out of range #1"); 566 MSG_PRINTF(("allocating segment %d to message\n", next)); 567 free_msgmaps = msgmaps[next].next; 568 nfree_msgmaps--; 569 msgmaps[next].next = msghdr->msg_spot; 570 msghdr->msg_spot = next; 571 segs_needed--; 572 } 573 574 /* 575 * Copy in the message type 576 */ 577 578 if ((error = copyin(user_msgp, &msghdr->msg_type, 579 sizeof(msghdr->msg_type))) != 0) { 580 MSG_PRINTF(("error %d copying the message type\n", error)); 581 msg_freehdr(msghdr); 582 msqptr->msg_perm.mode &= ~MSG_LOCKED; 583 wakeup(msqptr); 584 return (error); 585 } 586 user_msgp += sizeof(msghdr->msg_type); 587 588 /* 589 * Validate the message type 590 */ 591 592 if (msghdr->msg_type < 1) { 593 msg_freehdr(msghdr); 594 msqptr->msg_perm.mode &= ~MSG_LOCKED; 595 wakeup(msqptr); 596 MSG_PRINTF(("mtype (%ld) < 1\n", msghdr->msg_type)); 597 return (EINVAL); 598 } 599 600 /* 601 * Copy in the message body 602 */ 603 604 next = msghdr->msg_spot; 605 while (msgsz > 0) { 606 size_t tlen; 607 if (msgsz > msginfo.msgssz) 608 tlen = msginfo.msgssz; 609 else 610 tlen = msgsz; 611 if (next <= -1) 612 panic("next too low #2"); 613 if (next >= msginfo.msgseg) 614 panic("next out of range #2"); 615 if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 616 tlen)) != 0) { 617 MSG_PRINTF(("error %d copying in message segment\n", 618 error)); 619 msg_freehdr(msghdr); 620 msqptr->msg_perm.mode &= ~MSG_LOCKED; 621 wakeup(msqptr); 622 return (error); 623 } 624 msgsz -= tlen; 625 user_msgp += tlen; 626 next = msgmaps[next].next; 627 } 628 if (next != -1) 629 panic("didn't use all the msg segments"); 630 631 /* 632 * We've got the message. Unlock the msqid_ds. 633 */ 634 635 msqptr->msg_perm.mode &= ~MSG_LOCKED; 636 637 /* 638 * Make sure that the msqid_ds is still allocated. 639 */ 640 641 if (msqptr->msg_qbytes == 0) { 642 msg_freehdr(msghdr); 643 wakeup(msqptr); 644 return (EIDRM); 645 } 646 647 /* 648 * Put the message into the queue 649 */ 650 651 if (msqptr->_msg_first == NULL) { 652 msqptr->_msg_first = msghdr; 653 msqptr->_msg_last = msghdr; 654 } else { 655 msqptr->_msg_last->msg_next = msghdr; 656 msqptr->_msg_last = msghdr; 657 } 658 msqptr->_msg_last->msg_next = NULL; 659 660 msqptr->_msg_cbytes += msghdr->msg_ts; 661 msqptr->msg_qnum++; 662 msqptr->msg_lspid = p->p_pid; 663 msqptr->msg_stime = time.tv_sec; 664 665 wakeup(msqptr); 666 return (0); 667 } 668 669 int 670 sys_msgrcv(l, v, retval) 671 struct lwp *l; 672 void *v; 673 register_t *retval; 674 { 675 struct sys_msgrcv_args /* { 676 syscallarg(int) msqid; 677 syscallarg(void *) msgp; 678 syscallarg(size_t) msgsz; 679 syscallarg(long) msgtyp; 680 syscallarg(int) msgflg; 681 } */ *uap = v; 682 struct proc *p = l->l_proc; 683 int msqid = SCARG(uap, msqid); 684 char *user_msgp = SCARG(uap, msgp); 685 size_t msgsz = SCARG(uap, msgsz); 686 long msgtyp = SCARG(uap, msgtyp); 687 int msgflg = SCARG(uap, msgflg); 688 size_t len; 689 struct ucred *cred = p->p_ucred; 690 struct msqid_ds *msqptr; 691 struct __msg *msghdr; 692 int error; 693 short next; 694 695 MSG_PRINTF(("call to msgrcv(%d, %p, %lld, %ld, %d)\n", msqid, 696 user_msgp, (long long)msgsz, msgtyp, msgflg)); 697 698 msqid = IPCID_TO_IX(msqid); 699 700 if (msqid < 0 || msqid >= msginfo.msgmni) { 701 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 702 msginfo.msgmni)); 703 return (EINVAL); 704 } 705 706 msqptr = &msqids[msqid]; 707 if (msqptr->msg_qbytes == 0) { 708 MSG_PRINTF(("no such message queue id\n")); 709 return (EINVAL); 710 } 711 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 712 MSG_PRINTF(("wrong sequence number\n")); 713 return (EINVAL); 714 } 715 716 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 717 MSG_PRINTF(("requester doesn't have read access\n")); 718 return (error); 719 } 720 721 #if 0 722 /* cannot happen, msgsz is unsigned */ 723 if (msgsz < 0) { 724 MSG_PRINTF(("msgsz < 0\n")); 725 return (EINVAL); 726 } 727 #endif 728 729 msghdr = NULL; 730 while (msghdr == NULL) { 731 if (msgtyp == 0) { 732 msghdr = msqptr->_msg_first; 733 if (msghdr != NULL) { 734 if (msgsz < msghdr->msg_ts && 735 (msgflg & MSG_NOERROR) == 0) { 736 MSG_PRINTF(("first message on the " 737 "queue is too big " 738 "(want %lld, got %d)\n", 739 (long long)msgsz, msghdr->msg_ts)); 740 return (E2BIG); 741 } 742 if (msqptr->_msg_first == msqptr->_msg_last) { 743 msqptr->_msg_first = NULL; 744 msqptr->_msg_last = NULL; 745 } else { 746 msqptr->_msg_first = msghdr->msg_next; 747 if (msqptr->_msg_first == NULL) 748 panic("msg_first/last screwed " 749 "up #1"); 750 } 751 } 752 } else { 753 struct __msg *previous; 754 struct __msg **prev; 755 756 for (previous = NULL, prev = &msqptr->_msg_first; 757 (msghdr = *prev) != NULL; 758 previous = msghdr, prev = &msghdr->msg_next) { 759 /* 760 * Is this message's type an exact match or is 761 * this message's type less than or equal to 762 * the absolute value of a negative msgtyp? 763 * Note that the second half of this test can 764 * NEVER be true if msgtyp is positive since 765 * msg_type is always positive! 766 */ 767 768 if (msgtyp == msghdr->msg_type || 769 msghdr->msg_type <= -msgtyp) { 770 MSG_PRINTF(("found message type %ld, " 771 "requested %ld\n", 772 msghdr->msg_type, msgtyp)); 773 if (msgsz < msghdr->msg_ts && 774 (msgflg & MSG_NOERROR) == 0) { 775 MSG_PRINTF(("requested message " 776 "on the queue is too big " 777 "(want %lld, got %d)\n", 778 (long long)msgsz, 779 msghdr->msg_ts)); 780 return (E2BIG); 781 } 782 *prev = msghdr->msg_next; 783 if (msghdr == msqptr->_msg_last) { 784 if (previous == NULL) { 785 if (prev != 786 &msqptr->_msg_first) 787 panic("msg_first/last screwed up #2"); 788 msqptr->_msg_first = 789 NULL; 790 msqptr->_msg_last = 791 NULL; 792 } else { 793 if (prev == 794 &msqptr->_msg_first) 795 panic("msg_first/last screwed up #3"); 796 msqptr->_msg_last = 797 previous; 798 } 799 } 800 break; 801 } 802 } 803 } 804 805 /* 806 * We've either extracted the msghdr for the appropriate 807 * message or there isn't one. 808 * If there is one then bail out of this loop. 809 */ 810 811 if (msghdr != NULL) 812 break; 813 814 /* 815 * Hmph! No message found. Does the user want to wait? 816 */ 817 818 if ((msgflg & IPC_NOWAIT) != 0) { 819 MSG_PRINTF(("no appropriate message found (msgtyp=%ld)\n", 820 msgtyp)); 821 /* The SVID says to return ENOMSG. */ 822 #ifdef ENOMSG 823 return (ENOMSG); 824 #else 825 /* Unfortunately, BSD doesn't define that code yet! */ 826 return (EAGAIN); 827 #endif 828 } 829 830 /* 831 * Wait for something to happen 832 */ 833 834 MSG_PRINTF(("msgrcv: goodnight\n")); 835 error = tsleep(msqptr, (PZERO - 4) | PCATCH, "msgwait", 836 0); 837 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 838 839 if (error != 0) { 840 MSG_PRINTF(("msgsnd: interrupted system call\n")); 841 return (EINTR); 842 } 843 844 /* 845 * Make sure that the msq queue still exists 846 */ 847 848 if (msqptr->msg_qbytes == 0 || 849 msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 850 MSG_PRINTF(("msqid deleted\n")); 851 return (EIDRM); 852 } 853 } 854 855 /* 856 * Return the message to the user. 857 * 858 * First, do the bookkeeping (before we risk being interrupted). 859 */ 860 861 msqptr->_msg_cbytes -= msghdr->msg_ts; 862 msqptr->msg_qnum--; 863 msqptr->msg_lrpid = p->p_pid; 864 msqptr->msg_rtime = time.tv_sec; 865 866 /* 867 * Make msgsz the actual amount that we'll be returning. 868 * Note that this effectively truncates the message if it is too long 869 * (since msgsz is never increased). 870 */ 871 872 MSG_PRINTF(("found a message, msgsz=%lld, msg_ts=%d\n", 873 (long long)msgsz, msghdr->msg_ts)); 874 if (msgsz > msghdr->msg_ts) 875 msgsz = msghdr->msg_ts; 876 877 /* 878 * Return the type to the user. 879 */ 880 881 error = copyout(&msghdr->msg_type, user_msgp, sizeof(msghdr->msg_type)); 882 if (error != 0) { 883 MSG_PRINTF(("error (%d) copying out message type\n", error)); 884 msg_freehdr(msghdr); 885 wakeup(msqptr); 886 return (error); 887 } 888 user_msgp += sizeof(msghdr->msg_type); 889 890 /* 891 * Return the segments to the user 892 */ 893 894 next = msghdr->msg_spot; 895 for (len = 0; len < msgsz; len += msginfo.msgssz) { 896 size_t tlen; 897 898 if (msgsz - len > msginfo.msgssz) 899 tlen = msginfo.msgssz; 900 else 901 tlen = msgsz - len; 902 if (next <= -1) 903 panic("next too low #3"); 904 if (next >= msginfo.msgseg) 905 panic("next out of range #3"); 906 error = copyout(&msgpool[next * msginfo.msgssz], 907 user_msgp, tlen); 908 if (error != 0) { 909 MSG_PRINTF(("error (%d) copying out message segment\n", 910 error)); 911 msg_freehdr(msghdr); 912 wakeup(msqptr); 913 return (error); 914 } 915 user_msgp += tlen; 916 next = msgmaps[next].next; 917 } 918 919 /* 920 * Done, return the actual number of bytes copied out. 921 */ 922 923 msg_freehdr(msghdr); 924 wakeup(msqptr); 925 *retval = msgsz; 926 return (0); 927 } 928
Indexes created Wed Oct 01 13:09:50 GMT 2025