sysv_msg.c revision 1.33
1 /* $NetBSD: sysv_msg.c,v 1.33 2001/11/12 15:25:25 lukem Exp $ */ 2 3 /*- 4 * Copyright (c) 1999 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.33 2001/11/12 15:25:25 lukem Exp $"); 61 62 #define SYSVMSG 63 64 #include <sys/param.h> 65 #include <sys/kernel.h> 66 #include <sys/msg.h> 67 #include <sys/sysctl.h> 68 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */ 69 #include <sys/syscallargs.h> 70 71 #define MSG_DEBUG 72 #undef MSG_DEBUG_OK 73 74 #ifdef MSG_DEBUG_OK 75 #define MSG_PRINTF(a) printf a 76 #else 77 #define MSG_PRINTF(a) 78 #endif 79 80 int nfree_msgmaps; /* # of free map entries */ 81 short free_msgmaps; /* head of linked list of free map entries */ 82 struct __msg *free_msghdrs; /* list of free msg headers */ 83 char *msgpool; /* MSGMAX byte long msg buffer pool */ 84 struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 85 struct __msg *msghdrs; /* MSGTQL msg headers */ 86 struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 87 88 static void msg_freehdr __P((struct __msg *)); 89 90 void 91 msginit() 92 { 93 int i; 94 95 /* 96 * msginfo.msgssz should be a power of two for efficiency reasons. 97 * It is also pretty silly if msginfo.msgssz is less than 8 98 * or greater than about 256 so ... 99 */ 100 101 i = 8; 102 while (i < 1024 && i != msginfo.msgssz) 103 i <<= 1; 104 if (i != msginfo.msgssz) { 105 MSG_PRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 106 msginfo.msgssz)); 107 panic("msginfo.msgssz not a small power of 2"); 108 } 109 110 if (msginfo.msgseg > 32767) { 111 MSG_PRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 112 panic("msginfo.msgseg > 32767"); 113 } 114 115 if (msgmaps == NULL) 116 panic("msgmaps is NULL"); 117 118 for (i = 0; i < msginfo.msgseg; i++) { 119 if (i > 0) 120 msgmaps[i-1].next = i; 121 msgmaps[i].next = -1; /* implies entry is available */ 122 } 123 free_msgmaps = 0; 124 nfree_msgmaps = msginfo.msgseg; 125 126 if (msghdrs == NULL) 127 panic("msghdrs is NULL"); 128 129 for (i = 0; i < msginfo.msgtql; i++) { 130 msghdrs[i].msg_type = 0; 131 if (i > 0) 132 msghdrs[i-1].msg_next = &msghdrs[i]; 133 msghdrs[i].msg_next = NULL; 134 } 135 free_msghdrs = &msghdrs[0]; 136 137 if (msqids == NULL) 138 panic("msqids is NULL"); 139 140 for (i = 0; i < msginfo.msgmni; i++) { 141 msqids[i].msg_qbytes = 0; /* implies entry is available */ 142 msqids[i].msg_perm._seq = 0; /* reset to a known value */ 143 } 144 } 145 146 static void 147 msg_freehdr(msghdr) 148 struct __msg *msghdr; 149 { 150 while (msghdr->msg_ts > 0) { 151 short next; 152 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 153 panic("msghdr->msg_spot out of range"); 154 next = msgmaps[msghdr->msg_spot].next; 155 msgmaps[msghdr->msg_spot].next = free_msgmaps; 156 free_msgmaps = msghdr->msg_spot; 157 nfree_msgmaps++; 158 msghdr->msg_spot = next; 159 if (msghdr->msg_ts >= msginfo.msgssz) 160 msghdr->msg_ts -= msginfo.msgssz; 161 else 162 msghdr->msg_ts = 0; 163 } 164 if (msghdr->msg_spot != -1) 165 panic("msghdr->msg_spot != -1"); 166 msghdr->msg_next = free_msghdrs; 167 free_msghdrs = msghdr; 168 } 169 170 int 171 sys___msgctl13(p, v, retval) 172 struct proc *p; 173 void *v; 174 register_t *retval; 175 { 176 struct sys___msgctl13_args /* { 177 syscallarg(int) msqid; 178 syscallarg(int) cmd; 179 syscallarg(struct msqid_ds *) buf; 180 } */ *uap = v; 181 struct msqid_ds msqbuf; 182 int cmd, error; 183 184 cmd = SCARG(uap, cmd); 185 186 if (cmd == IPC_SET) { 187 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 188 if (error) 189 return (error); 190 } 191 192 error = msgctl1(p, SCARG(uap, msqid), cmd, 193 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 194 195 if (error == 0 && cmd == IPC_STAT) 196 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 197 198 return (error); 199 } 200 201 int 202 msgctl1(p, msqid, cmd, msqbuf) 203 struct proc *p; 204 int msqid; 205 int cmd; 206 struct msqid_ds *msqbuf; 207 { 208 struct ucred *cred = p->p_ucred; 209 struct msqid_ds *msqptr; 210 int error = 0, ix; 211 212 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 213 214 ix = IPCID_TO_IX(msqid); 215 216 if (ix < 0 || ix >= msginfo.msgmni) { 217 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 218 msginfo.msgmni)); 219 return (EINVAL); 220 } 221 222 msqptr = &msqids[ix]; 223 224 if (msqptr->msg_qbytes == 0) { 225 MSG_PRINTF(("no such msqid\n")); 226 return (EINVAL); 227 } 228 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 229 MSG_PRINTF(("wrong sequence number\n")); 230 return (EINVAL); 231 } 232 233 switch (cmd) { 234 case IPC_RMID: 235 { 236 struct __msg *msghdr; 237 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 238 return (error); 239 /* Free the message headers */ 240 msghdr = msqptr->_msg_first; 241 while (msghdr != NULL) { 242 struct __msg *msghdr_tmp; 243 244 /* Free the segments of each message */ 245 msqptr->_msg_cbytes -= msghdr->msg_ts; 246 msqptr->msg_qnum--; 247 msghdr_tmp = msghdr; 248 msghdr = msghdr->msg_next; 249 msg_freehdr(msghdr_tmp); 250 } 251 252 if (msqptr->_msg_cbytes != 0) 253 panic("msg_cbytes is screwed up"); 254 if (msqptr->msg_qnum != 0) 255 panic("msg_qnum is screwed up"); 256 257 msqptr->msg_qbytes = 0; /* Mark it as free */ 258 259 wakeup(msqptr); 260 } 261 break; 262 263 case IPC_SET: 264 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 265 return (error); 266 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && cred->cr_uid != 0) 267 return (EPERM); 268 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 269 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 270 "(truncating)\n", msginfo.msgmnb)); 271 /* silently restrict qbytes to system limit */ 272 msqbuf->msg_qbytes = msginfo.msgmnb; 273 } 274 if (msqbuf->msg_qbytes == 0) { 275 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 276 return (EINVAL); /* XXX non-standard errno! */ 277 } 278 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 279 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 280 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 281 (msqbuf->msg_perm.mode & 0777); 282 msqptr->msg_qbytes = msqbuf->msg_qbytes; 283 msqptr->msg_ctime = time.tv_sec; 284 break; 285 286 case IPC_STAT: 287 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 288 MSG_PRINTF(("requester doesn't have read access\n")); 289 return (error); 290 } 291 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 292 break; 293 294 default: 295 MSG_PRINTF(("invalid command %d\n", cmd)); 296 return (EINVAL); 297 } 298 299 return (error); 300 } 301 302 int 303 sys_msgget(p, v, retval) 304 struct proc *p; 305 void *v; 306 register_t *retval; 307 { 308 struct sys_msgget_args /* { 309 syscallarg(key_t) key; 310 syscallarg(int) msgflg; 311 } */ *uap = v; 312 int msqid, error; 313 int key = SCARG(uap, key); 314 int msgflg = SCARG(uap, msgflg); 315 struct ucred *cred = p->p_ucred; 316 struct msqid_ds *msqptr = NULL; 317 318 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 319 320 if (key != IPC_PRIVATE) { 321 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 322 msqptr = &msqids[msqid]; 323 if (msqptr->msg_qbytes != 0 && 324 msqptr->msg_perm._key == key) 325 break; 326 } 327 if (msqid < msginfo.msgmni) { 328 MSG_PRINTF(("found public key\n")); 329 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 330 MSG_PRINTF(("not exclusive\n")); 331 return(EEXIST); 332 } 333 if ((error = ipcperm(cred, &msqptr->msg_perm, 334 msgflg & 0700 ))) { 335 MSG_PRINTF(("requester doesn't have 0%o access\n", 336 msgflg & 0700)); 337 return (error); 338 } 339 goto found; 340 } 341 } 342 343 MSG_PRINTF(("need to allocate the msqid_ds\n")); 344 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 345 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 346 /* 347 * Look for an unallocated and unlocked msqid_ds. 348 * msqid_ds's can be locked by msgsnd or msgrcv while 349 * they are copying the message in/out. We can't 350 * re-use the entry until they release it. 351 */ 352 msqptr = &msqids[msqid]; 353 if (msqptr->msg_qbytes == 0 && 354 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 355 break; 356 } 357 if (msqid == msginfo.msgmni) { 358 MSG_PRINTF(("no more msqid_ds's available\n")); 359 return (ENOSPC); 360 } 361 MSG_PRINTF(("msqid %d is available\n", msqid)); 362 msqptr->msg_perm._key = key; 363 msqptr->msg_perm.cuid = cred->cr_uid; 364 msqptr->msg_perm.uid = cred->cr_uid; 365 msqptr->msg_perm.cgid = cred->cr_gid; 366 msqptr->msg_perm.gid = cred->cr_gid; 367 msqptr->msg_perm.mode = (msgflg & 0777); 368 /* Make sure that the returned msqid is unique */ 369 msqptr->msg_perm._seq++; 370 msqptr->_msg_first = NULL; 371 msqptr->_msg_last = NULL; 372 msqptr->_msg_cbytes = 0; 373 msqptr->msg_qnum = 0; 374 msqptr->msg_qbytes = msginfo.msgmnb; 375 msqptr->msg_lspid = 0; 376 msqptr->msg_lrpid = 0; 377 msqptr->msg_stime = 0; 378 msqptr->msg_rtime = 0; 379 msqptr->msg_ctime = time.tv_sec; 380 } else { 381 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 382 return (ENOENT); 383 } 384 385 found: 386 /* Construct the unique msqid */ 387 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 388 return (0); 389 } 390 391 int 392 sys_msgsnd(p, v, retval) 393 struct proc *p; 394 void *v; 395 register_t *retval; 396 { 397 struct sys_msgsnd_args /* { 398 syscallarg(int) msqid; 399 syscallarg(const void *) msgp; 400 syscallarg(size_t) msgsz; 401 syscallarg(int) msgflg; 402 } */ *uap = v; 403 int msqid = SCARG(uap, msqid); 404 const char *user_msgp = SCARG(uap, msgp); 405 size_t msgsz = SCARG(uap, msgsz); 406 int msgflg = SCARG(uap, msgflg); 407 int segs_needed, error; 408 struct ucred *cred = p->p_ucred; 409 struct msqid_ds *msqptr; 410 struct __msg *msghdr; 411 short next; 412 413 MSG_PRINTF(("call to msgsnd(%d, %p, %d, %d)\n", msqid, user_msgp, msgsz, 414 msgflg)); 415 416 msqid = IPCID_TO_IX(msqid); 417 418 if (msqid < 0 || msqid >= msginfo.msgmni) { 419 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 420 msginfo.msgmni)); 421 return (EINVAL); 422 } 423 424 msqptr = &msqids[msqid]; 425 if (msqptr->msg_qbytes == 0) { 426 MSG_PRINTF(("no such message queue id\n")); 427 return (EINVAL); 428 } 429 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 430 MSG_PRINTF(("wrong sequence number\n")); 431 return (EINVAL); 432 } 433 434 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 435 MSG_PRINTF(("requester doesn't have write access\n")); 436 return (error); 437 } 438 439 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 440 MSG_PRINTF(("msgsz=%d, msgssz=%d, segs_needed=%d\n", msgsz, 441 msginfo.msgssz, segs_needed)); 442 for (;;) { 443 int need_more_resources = 0; 444 445 /* 446 * check msgsz [cannot be negative since it is unsigned] 447 * (inside this loop in case msg_qbytes changes while we sleep) 448 */ 449 450 if (msgsz > msqptr->msg_qbytes) { 451 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 452 return (EINVAL); 453 } 454 455 if (msqptr->msg_perm.mode & MSG_LOCKED) { 456 MSG_PRINTF(("msqid is locked\n")); 457 need_more_resources = 1; 458 } 459 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 460 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 461 need_more_resources = 1; 462 } 463 if (segs_needed > nfree_msgmaps) { 464 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 465 need_more_resources = 1; 466 } 467 if (free_msghdrs == NULL) { 468 MSG_PRINTF(("no more msghdrs\n")); 469 need_more_resources = 1; 470 } 471 472 if (need_more_resources) { 473 int we_own_it; 474 475 if ((msgflg & IPC_NOWAIT) != 0) { 476 MSG_PRINTF(("need more resources but caller " 477 "doesn't want to wait\n")); 478 return (EAGAIN); 479 } 480 481 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 482 MSG_PRINTF(("we don't own the msqid_ds\n")); 483 we_own_it = 0; 484 } else { 485 /* Force later arrivals to wait for our 486 request */ 487 MSG_PRINTF(("we own the msqid_ds\n")); 488 msqptr->msg_perm.mode |= MSG_LOCKED; 489 we_own_it = 1; 490 } 491 MSG_PRINTF(("goodnight\n")); 492 error = tsleep(msqptr, (PZERO - 4) | PCATCH, 493 "msgwait", 0); 494 MSG_PRINTF(("good morning, error=%d\n", error)); 495 if (we_own_it) 496 msqptr->msg_perm.mode &= ~MSG_LOCKED; 497 if (error != 0) { 498 MSG_PRINTF(("msgsnd: interrupted system " 499 "call\n")); 500 return (EINTR); 501 } 502 503 /* 504 * Make sure that the msq queue still exists 505 */ 506 507 if (msqptr->msg_qbytes == 0) { 508 MSG_PRINTF(("msqid deleted\n")); 509 return (EIDRM); 510 } 511 } else { 512 MSG_PRINTF(("got all the resources that we need\n")); 513 break; 514 } 515 } 516 517 /* 518 * We have the resources that we need. 519 * Make sure! 520 */ 521 522 if (msqptr->msg_perm.mode & MSG_LOCKED) 523 panic("msg_perm.mode & MSG_LOCKED"); 524 if (segs_needed > nfree_msgmaps) 525 panic("segs_needed > nfree_msgmaps"); 526 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) 527 panic("msgsz + msg_cbytes > msg_qbytes"); 528 if (free_msghdrs == NULL) 529 panic("no more msghdrs"); 530 531 /* 532 * Re-lock the msqid_ds in case we page-fault when copying in the 533 * message 534 */ 535 536 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 537 panic("msqid_ds is already locked"); 538 msqptr->msg_perm.mode |= MSG_LOCKED; 539 540 /* 541 * Allocate a message header 542 */ 543 544 msghdr = free_msghdrs; 545 free_msghdrs = msghdr->msg_next; 546 msghdr->msg_spot = -1; 547 msghdr->msg_ts = msgsz; 548 549 /* 550 * Allocate space for the message 551 */ 552 553 while (segs_needed > 0) { 554 if (nfree_msgmaps <= 0) 555 panic("not enough msgmaps"); 556 if (free_msgmaps == -1) 557 panic("nil free_msgmaps"); 558 next = free_msgmaps; 559 if (next <= -1) 560 panic("next too low #1"); 561 if (next >= msginfo.msgseg) 562 panic("next out of range #1"); 563 MSG_PRINTF(("allocating segment %d to message\n", next)); 564 free_msgmaps = msgmaps[next].next; 565 nfree_msgmaps--; 566 msgmaps[next].next = msghdr->msg_spot; 567 msghdr->msg_spot = next; 568 segs_needed--; 569 } 570 571 /* 572 * Copy in the message type 573 */ 574 575 if ((error = copyin(user_msgp, &msghdr->msg_type, 576 sizeof(msghdr->msg_type))) != 0) { 577 MSG_PRINTF(("error %d copying the message type\n", error)); 578 msg_freehdr(msghdr); 579 msqptr->msg_perm.mode &= ~MSG_LOCKED; 580 wakeup(msqptr); 581 return (error); 582 } 583 user_msgp += sizeof(msghdr->msg_type); 584 585 /* 586 * Validate the message type 587 */ 588 589 if (msghdr->msg_type < 1) { 590 msg_freehdr(msghdr); 591 msqptr->msg_perm.mode &= ~MSG_LOCKED; 592 wakeup(msqptr); 593 MSG_PRINTF(("mtype (%d) < 1\n", msghdr->msg_type)); 594 return (EINVAL); 595 } 596 597 /* 598 * Copy in the message body 599 */ 600 601 next = msghdr->msg_spot; 602 while (msgsz > 0) { 603 size_t tlen; 604 if (msgsz > msginfo.msgssz) 605 tlen = msginfo.msgssz; 606 else 607 tlen = msgsz; 608 if (next <= -1) 609 panic("next too low #2"); 610 if (next >= msginfo.msgseg) 611 panic("next out of range #2"); 612 if ((error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], 613 tlen)) != 0) { 614 MSG_PRINTF(("error %d copying in message segment\n", 615 error)); 616 msg_freehdr(msghdr); 617 msqptr->msg_perm.mode &= ~MSG_LOCKED; 618 wakeup(msqptr); 619 return (error); 620 } 621 msgsz -= tlen; 622 user_msgp += tlen; 623 next = msgmaps[next].next; 624 } 625 if (next != -1) 626 panic("didn't use all the msg segments"); 627 628 /* 629 * We've got the message. Unlock the msqid_ds. 630 */ 631 632 msqptr->msg_perm.mode &= ~MSG_LOCKED; 633 634 /* 635 * Make sure that the msqid_ds is still allocated. 636 */ 637 638 if (msqptr->msg_qbytes == 0) { 639 msg_freehdr(msghdr); 640 wakeup(msqptr); 641 return (EIDRM); 642 } 643 644 /* 645 * Put the message into the queue 646 */ 647 648 if (msqptr->_msg_first == NULL) { 649 msqptr->_msg_first = msghdr; 650 msqptr->_msg_last = msghdr; 651 } else { 652 msqptr->_msg_last->msg_next = msghdr; 653 msqptr->_msg_last = msghdr; 654 } 655 msqptr->_msg_last->msg_next = NULL; 656 657 msqptr->_msg_cbytes += msghdr->msg_ts; 658 msqptr->msg_qnum++; 659 msqptr->msg_lspid = p->p_pid; 660 msqptr->msg_stime = time.tv_sec; 661 662 wakeup(msqptr); 663 return (0); 664 } 665 666 int 667 sys_msgrcv(p, v, retval) 668 struct proc *p; 669 void *v; 670 register_t *retval; 671 { 672 struct sys_msgrcv_args /* { 673 syscallarg(int) msqid; 674 syscallarg(void *) msgp; 675 syscallarg(size_t) msgsz; 676 syscallarg(long) msgtyp; 677 syscallarg(int) msgflg; 678 } */ *uap = v; 679 int msqid = SCARG(uap, msqid); 680 char *user_msgp = SCARG(uap, msgp); 681 size_t msgsz = SCARG(uap, msgsz); 682 long msgtyp = SCARG(uap, msgtyp); 683 int msgflg = SCARG(uap, msgflg); 684 size_t len; 685 struct ucred *cred = p->p_ucred; 686 struct msqid_ds *msqptr; 687 struct __msg *msghdr; 688 int error; 689 short next; 690 691 MSG_PRINTF(("call to msgrcv(%d, %p, %d, %ld, %d)\n", msqid, user_msgp, 692 msgsz, msgtyp, msgflg)); 693 694 msqid = IPCID_TO_IX(msqid); 695 696 if (msqid < 0 || msqid >= msginfo.msgmni) { 697 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 698 msginfo.msgmni)); 699 return (EINVAL); 700 } 701 702 msqptr = &msqids[msqid]; 703 if (msqptr->msg_qbytes == 0) { 704 MSG_PRINTF(("no such message queue id\n")); 705 return (EINVAL); 706 } 707 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 708 MSG_PRINTF(("wrong sequence number\n")); 709 return (EINVAL); 710 } 711 712 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 713 MSG_PRINTF(("requester doesn't have read access\n")); 714 return (error); 715 } 716 717 #if 0 718 /* cannot happen, msgsz is unsigned */ 719 if (msgsz < 0) { 720 MSG_PRINTF(("msgsz < 0\n")); 721 return (EINVAL); 722 } 723 #endif 724 725 msghdr = NULL; 726 while (msghdr == NULL) { 727 if (msgtyp == 0) { 728 msghdr = msqptr->_msg_first; 729 if (msghdr != NULL) { 730 if (msgsz < msghdr->msg_ts && 731 (msgflg & MSG_NOERROR) == 0) { 732 MSG_PRINTF(("first message on the " 733 "queue is too big " 734 "(want %d, got %d)\n", 735 msgsz, msghdr->msg_ts)); 736 return (E2BIG); 737 } 738 if (msqptr->_msg_first == msqptr->_msg_last) { 739 msqptr->_msg_first = NULL; 740 msqptr->_msg_last = NULL; 741 } else { 742 msqptr->_msg_first = msghdr->msg_next; 743 if (msqptr->_msg_first == NULL) 744 panic("msg_first/last screwed " 745 "up #1"); 746 } 747 } 748 } else { 749 struct __msg *previous; 750 struct __msg **prev; 751 752 for (previous = NULL, prev = &msqptr->_msg_first; 753 (msghdr = *prev) != NULL; 754 previous = msghdr, prev = &msghdr->msg_next) { 755 /* 756 * Is this message's type an exact match or is 757 * this message's type less than or equal to 758 * the absolute value of a negative msgtyp? 759 * Note that the second half of this test can 760 * NEVER be true if msgtyp is positive since 761 * msg_type is always positive! 762 */ 763 764 if (msgtyp == msghdr->msg_type || 765 msghdr->msg_type <= -msgtyp) { 766 MSG_PRINTF(("found message type %d, " 767 "requested %d\n", 768 msghdr->msg_type, msgtyp)); 769 if (msgsz < msghdr->msg_ts && 770 (msgflg & MSG_NOERROR) == 0) { 771 MSG_PRINTF(("requested message " 772 "on the queue is too big " 773 "(want %d, got %d)\n", 774 msgsz, msghdr->msg_ts)); 775 return (E2BIG); 776 } 777 *prev = msghdr->msg_next; 778 if (msghdr == msqptr->_msg_last) { 779 if (previous == NULL) { 780 if (prev != 781 &msqptr->_msg_first) 782 panic("msg_first/last screwed up #2"); 783 msqptr->_msg_first = 784 NULL; 785 msqptr->_msg_last = 786 NULL; 787 } else { 788 if (prev == 789 &msqptr->_msg_first) 790 panic("msg_first/last screwed up #3"); 791 msqptr->_msg_last = 792 previous; 793 } 794 } 795 break; 796 } 797 } 798 } 799 800 /* 801 * We've either extracted the msghdr for the appropriate 802 * message or there isn't one. 803 * If there is one then bail out of this loop. 804 */ 805 806 if (msghdr != NULL) 807 break; 808 809 /* 810 * Hmph! No message found. Does the user want to wait? 811 */ 812 813 if ((msgflg & IPC_NOWAIT) != 0) { 814 MSG_PRINTF(("no appropriate message found (msgtyp=%d)\n", 815 msgtyp)); 816 /* The SVID says to return ENOMSG. */ 817 #ifdef ENOMSG 818 return (ENOMSG); 819 #else 820 /* Unfortunately, BSD doesn't define that code yet! */ 821 return (EAGAIN); 822 #endif 823 } 824 825 /* 826 * Wait for something to happen 827 */ 828 829 MSG_PRINTF(("msgrcv: goodnight\n")); 830 error = tsleep(msqptr, (PZERO - 4) | PCATCH, "msgwait", 831 0); 832 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 833 834 if (error != 0) { 835 MSG_PRINTF(("msgsnd: interrupted system call\n")); 836 return (EINTR); 837 } 838 839 /* 840 * Make sure that the msq queue still exists 841 */ 842 843 if (msqptr->msg_qbytes == 0 || 844 msqptr->msg_perm._seq != IPCID_TO_SEQ(SCARG(uap, msqid))) { 845 MSG_PRINTF(("msqid deleted\n")); 846 return (EIDRM); 847 } 848 } 849 850 /* 851 * Return the message to the user. 852 * 853 * First, do the bookkeeping (before we risk being interrupted). 854 */ 855 856 msqptr->_msg_cbytes -= msghdr->msg_ts; 857 msqptr->msg_qnum--; 858 msqptr->msg_lrpid = p->p_pid; 859 msqptr->msg_rtime = time.tv_sec; 860 861 /* 862 * Make msgsz the actual amount that we'll be returning. 863 * Note that this effectively truncates the message if it is too long 864 * (since msgsz is never increased). 865 */ 866 867 MSG_PRINTF(("found a message, msgsz=%d, msg_ts=%d\n", msgsz, 868 msghdr->msg_ts)); 869 if (msgsz > msghdr->msg_ts) 870 msgsz = msghdr->msg_ts; 871 872 /* 873 * Return the type to the user. 874 */ 875 876 error = copyout(&msghdr->msg_type, user_msgp, sizeof(msghdr->msg_type)); 877 if (error != 0) { 878 MSG_PRINTF(("error (%d) copying out message type\n", error)); 879 msg_freehdr(msghdr); 880 wakeup(msqptr); 881 return (error); 882 } 883 user_msgp += sizeof(msghdr->msg_type); 884 885 /* 886 * Return the segments to the user 887 */ 888 889 next = msghdr->msg_spot; 890 for (len = 0; len < msgsz; len += msginfo.msgssz) { 891 size_t tlen; 892 893 if (msgsz - len > msginfo.msgssz) 894 tlen = msginfo.msgssz; 895 else 896 tlen = msgsz - len; 897 if (next <= -1) 898 panic("next too low #3"); 899 if (next >= msginfo.msgseg) 900 panic("next out of range #3"); 901 error = copyout(&msgpool[next * msginfo.msgssz], 902 user_msgp, tlen); 903 if (error != 0) { 904 MSG_PRINTF(("error (%d) copying out message segment\n", 905 error)); 906 msg_freehdr(msghdr); 907 wakeup(msqptr); 908 return (error); 909 } 910 user_msgp += tlen; 911 next = msgmaps[next].next; 912 } 913 914 /* 915 * Done, return the actual number of bytes copied out. 916 */ 917 918 msg_freehdr(msghdr); 919 wakeup(msqptr); 920 *retval = msgsz; 921 return (0); 922 } 923
Indexes created Mon Sep 22 21:09:42 GMT 2025