sysv_msg.c revision 1.44.4.3
1 /* $NetBSD: sysv_msg.c,v 1.44.4.3 2007/01/12 01:04:07 ad Exp $ */ 2 3 /*- 4 * Copyright (c) 1999, 2006 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center, and by Andrew Doran. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.44.4.3 2007/01/12 01:04:07 ad Exp $"); 61 62 #define SYSVMSG 63 64 #include <sys/param.h> 65 #include <sys/kernel.h> 66 #include <sys/msg.h> 67 #include <sys/sysctl.h> 68 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */ 69 #include <sys/sa.h> 70 #include <sys/syscallargs.h> 71 #include <sys/kauth.h> 72 #include <sys/mutex.h> 73 74 #define MSG_DEBUG 75 #undef MSG_DEBUG_OK 76 77 #ifdef MSG_DEBUG_OK 78 #define MSG_PRINTF(a) printf a 79 #else 80 #define MSG_PRINTF(a) 81 #endif 82 83 static int nfree_msgmaps; /* # of free map entries */ 84 static short free_msgmaps; /* head of linked list of free map entries */ 85 static struct __msg *free_msghdrs; /* list of free msg headers */ 86 static char *msgpool; /* MSGMAX byte long msg buffer pool */ 87 static struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 88 static struct __msg *msghdrs; /* MSGTQL msg headers */ 89 struct msqid_ds *msqids; /* MSGMNI msqid_ds struct's */ 90 static kmutex_t msgmutex; 91 92 static void msg_freehdr(struct __msg *); 93 94 void 95 msginit(void) 96 { 97 int i, sz; 98 vaddr_t v; 99 100 /* 101 * msginfo.msgssz should be a power of two for efficiency reasons. 102 * It is also pretty silly if msginfo.msgssz is less than 8 103 * or greater than about 256 so ... 104 */ 105 106 i = 8; 107 while (i < 1024 && i != msginfo.msgssz) 108 i <<= 1; 109 if (i != msginfo.msgssz) { 110 MSG_PRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 111 msginfo.msgssz)); 112 panic("msginfo.msgssz not a small power of 2"); 113 } 114 115 if (msginfo.msgseg > 32767) { 116 MSG_PRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 117 panic("msginfo.msgseg > 32767"); 118 } 119 120 /* Allocate pageable memory for our structures */ 121 sz = msginfo.msgmax 122 + msginfo.msgseg * sizeof(struct msgmap) 123 + msginfo.msgtql * sizeof(struct __msg) 124 + msginfo.msgmni * sizeof(struct msqid_ds); 125 v = uvm_km_alloc(kernel_map, round_page(sz), 0, 126 UVM_KMF_WIRED|UVM_KMF_ZERO); 127 if (v == 0) 128 panic("sysv_msg: cannot allocate memory"); 129 msgpool = (void *)v; 130 msgmaps = (void *) (msgpool + msginfo.msgmax); 131 msghdrs = (void *) (msgmaps + msginfo.msgseg); 132 msqids = (void *) (msghdrs + msginfo.msgtql); 133 134 for (i = 0; i < msginfo.msgseg; i++) { 135 if (i > 0) 136 msgmaps[i-1].next = i; 137 msgmaps[i].next = -1; /* implies entry is available */ 138 } 139 free_msgmaps = 0; 140 nfree_msgmaps = msginfo.msgseg; 141 142 if (msghdrs == NULL) 143 panic("msghdrs is NULL"); 144 145 for (i = 0; i < msginfo.msgtql; i++) { 146 msghdrs[i].msg_type = 0; 147 if (i > 0) 148 msghdrs[i-1].msg_next = &msghdrs[i]; 149 msghdrs[i].msg_next = NULL; 150 } 151 free_msghdrs = &msghdrs[0]; 152 153 if (msqids == NULL) 154 panic("msqids is NULL"); 155 156 for (i = 0; i < msginfo.msgmni; i++) { 157 msqids[i].msg_qbytes = 0; /* implies entry is available */ 158 msqids[i].msg_perm._seq = 0; /* reset to a known value */ 159 } 160 161 mutex_init(&msgmutex, MUTEX_DEFAULT, IPL_NONE); 162 } 163 164 static void 165 msg_freehdr(struct __msg *msghdr) 166 { 167 168 KASSERT(mutex_owned(&msgmutex)); 169 170 while (msghdr->msg_ts > 0) { 171 short next; 172 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 173 panic("msghdr->msg_spot out of range"); 174 next = msgmaps[msghdr->msg_spot].next; 175 msgmaps[msghdr->msg_spot].next = free_msgmaps; 176 free_msgmaps = msghdr->msg_spot; 177 nfree_msgmaps++; 178 msghdr->msg_spot = next; 179 if (msghdr->msg_ts >= msginfo.msgssz) 180 msghdr->msg_ts -= msginfo.msgssz; 181 else 182 msghdr->msg_ts = 0; 183 } 184 if (msghdr->msg_spot != -1) 185 panic("msghdr->msg_spot != -1"); 186 msghdr->msg_next = free_msghdrs; 187 free_msghdrs = msghdr; 188 } 189 190 int 191 sys___msgctl13(struct lwp *l, void *v, register_t *retval) 192 { 193 struct sys___msgctl13_args /* { 194 syscallarg(int) msqid; 195 syscallarg(int) cmd; 196 syscallarg(struct msqid_ds *) buf; 197 } */ *uap = v; 198 struct msqid_ds msqbuf; 199 int cmd, error; 200 201 cmd = SCARG(uap, cmd); 202 203 if (cmd == IPC_SET) { 204 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 205 if (error) 206 return (error); 207 } 208 209 error = msgctl1(l, SCARG(uap, msqid), cmd, 210 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 211 212 if (error == 0 && cmd == IPC_STAT) 213 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 214 215 return (error); 216 } 217 218 int 219 msgctl1(struct lwp *l, int msqid, int cmd, struct msqid_ds *msqbuf) 220 { 221 kauth_cred_t cred = l->l_cred; 222 struct msqid_ds *msqptr; 223 int error = 0, ix; 224 225 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 226 227 ix = IPCID_TO_IX(msqid); 228 229 mutex_enter(&msgmutex); 230 231 if (ix < 0 || ix >= msginfo.msgmni) { 232 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 233 msginfo.msgmni)); 234 error = EINVAL; 235 goto unlock; 236 } 237 238 msqptr = &msqids[ix]; 239 240 if (msqptr->msg_qbytes == 0) { 241 MSG_PRINTF(("no such msqid\n")); 242 error = EINVAL; 243 goto unlock; 244 } 245 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 246 MSG_PRINTF(("wrong sequence number\n")); 247 error = EINVAL; 248 goto unlock; 249 } 250 251 switch (cmd) { 252 case IPC_RMID: 253 { 254 struct __msg *msghdr; 255 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 256 break; 257 /* Free the message headers */ 258 msghdr = msqptr->_msg_first; 259 while (msghdr != NULL) { 260 struct __msg *msghdr_tmp; 261 262 /* Free the segments of each message */ 263 msqptr->_msg_cbytes -= msghdr->msg_ts; 264 msqptr->msg_qnum--; 265 msghdr_tmp = msghdr; 266 msghdr = msghdr->msg_next; 267 msg_freehdr(msghdr_tmp); 268 } 269 270 if (msqptr->_msg_cbytes != 0) 271 panic("msg_cbytes is screwed up"); 272 if (msqptr->msg_qnum != 0) 273 panic("msg_qnum is screwed up"); 274 275 msqptr->msg_qbytes = 0; /* Mark it as free */ 276 277 wakeup(msqptr); 278 } 279 break; 280 281 case IPC_SET: 282 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 283 break; 284 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && 285 kauth_authorize_generic(cred, KAUTH_GENERIC_ISSUSER, 286 NULL) != 0) { 287 error = EPERM; 288 break; 289 } 290 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 291 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 292 "(truncating)\n", msginfo.msgmnb)); 293 /* silently restrict qbytes to system limit */ 294 msqbuf->msg_qbytes = msginfo.msgmnb; 295 } 296 if (msqbuf->msg_qbytes == 0) { 297 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 298 error = EINVAL; /* XXX non-standard errno! */ 299 break; 300 } 301 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 302 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 303 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 304 (msqbuf->msg_perm.mode & 0777); 305 msqptr->msg_qbytes = msqbuf->msg_qbytes; 306 msqptr->msg_ctime = time_second; 307 break; 308 309 case IPC_STAT: 310 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 311 MSG_PRINTF(("requester doesn't have read access\n")); 312 return (error); 313 } 314 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 315 break; 316 317 default: 318 MSG_PRINTF(("invalid command %d\n", cmd)); 319 error = EINVAL; 320 break; 321 } 322 323 unlock: 324 mutex_exit(&msgmutex); 325 return (error); 326 } 327 328 int 329 sys_msgget(struct lwp *l, void *v, register_t *retval) 330 { 331 struct sys_msgget_args /* { 332 syscallarg(key_t) key; 333 syscallarg(int) msgflg; 334 } */ *uap = v; 335 int msqid, error = 0; 336 int key = SCARG(uap, key); 337 int msgflg = SCARG(uap, msgflg); 338 kauth_cred_t cred = l->l_cred; 339 struct msqid_ds *msqptr = NULL; 340 341 mutex_enter(&msgmutex); 342 343 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 344 345 if (key != IPC_PRIVATE) { 346 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 347 msqptr = &msqids[msqid]; 348 if (msqptr->msg_qbytes != 0 && 349 msqptr->msg_perm._key == key) 350 break; 351 } 352 if (msqid < msginfo.msgmni) { 353 MSG_PRINTF(("found public key\n")); 354 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 355 MSG_PRINTF(("not exclusive\n")); 356 error = EEXIST; 357 goto unlock; 358 } 359 if ((error = ipcperm(cred, &msqptr->msg_perm, 360 msgflg & 0700 ))) { 361 MSG_PRINTF(("requester doesn't have 0%o access\n", 362 msgflg & 0700)); 363 goto unlock; 364 } 365 goto found; 366 } 367 } 368 369 MSG_PRINTF(("need to allocate the msqid_ds\n")); 370 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 371 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 372 /* 373 * Look for an unallocated and unlocked msqid_ds. 374 * msqid_ds's can be locked by msgsnd or msgrcv while 375 * they are copying the message in/out. We can't 376 * re-use the entry until they release it. 377 */ 378 msqptr = &msqids[msqid]; 379 if (msqptr->msg_qbytes == 0 && 380 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 381 break; 382 } 383 if (msqid == msginfo.msgmni) { 384 MSG_PRINTF(("no more msqid_ds's available\n")); 385 error = ENOSPC; 386 goto unlock; 387 } 388 MSG_PRINTF(("msqid %d is available\n", msqid)); 389 msqptr->msg_perm._key = key; 390 msqptr->msg_perm.cuid = kauth_cred_geteuid(cred); 391 msqptr->msg_perm.uid = kauth_cred_geteuid(cred); 392 msqptr->msg_perm.cgid = kauth_cred_getegid(cred); 393 msqptr->msg_perm.gid = kauth_cred_getegid(cred); 394 msqptr->msg_perm.mode = (msgflg & 0777); 395 /* Make sure that the returned msqid is unique */ 396 msqptr->msg_perm._seq++; 397 msqptr->_msg_first = NULL; 398 msqptr->_msg_last = NULL; 399 msqptr->_msg_cbytes = 0; 400 msqptr->msg_qnum = 0; 401 msqptr->msg_qbytes = msginfo.msgmnb; 402 msqptr->msg_lspid = 0; 403 msqptr->msg_lrpid = 0; 404 msqptr->msg_stime = 0; 405 msqptr->msg_rtime = 0; 406 msqptr->msg_ctime = time_second; 407 } else { 408 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 409 error = ENOENT; 410 goto unlock; 411 } 412 413 found: 414 /* Construct the unique msqid */ 415 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 416 417 unlock: 418 mutex_exit(&msgmutex); 419 return (error); 420 } 421 422 int 423 sys_msgsnd(struct lwp *l, void *v, register_t *retval) 424 { 425 struct sys_msgsnd_args /* { 426 syscallarg(int) msqid; 427 syscallarg(const void *) msgp; 428 syscallarg(size_t) msgsz; 429 syscallarg(int) msgflg; 430 } */ *uap = v; 431 432 return msgsnd1(l, SCARG(uap, msqid), SCARG(uap, msgp), 433 SCARG(uap, msgsz), SCARG(uap, msgflg), sizeof(long), copyin); 434 } 435 436 int 437 msgsnd1(struct lwp *l, int msqidr, const char *user_msgp, size_t msgsz, 438 int msgflg, size_t typesz, copyin_t fetch_type) 439 { 440 int segs_needed, error = 0, msqid; 441 kauth_cred_t cred = l->l_cred; 442 struct msqid_ds *msqptr; 443 struct __msg *msghdr; 444 short next; 445 446 MSG_PRINTF(("call to msgsnd(%d, %p, %lld, %d)\n", msqid, user_msgp, 447 (long long)msgsz, msgflg)); 448 449 msqid = IPCID_TO_IX(msqidr); 450 451 mutex_enter(&msgmutex); 452 453 if (msqid < 0 || msqid >= msginfo.msgmni) { 454 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 455 msginfo.msgmni)); 456 error = EINVAL; 457 goto unlock; 458 } 459 460 msqptr = &msqids[msqid]; 461 if (msqptr->msg_qbytes == 0) { 462 MSG_PRINTF(("no such message queue id\n")); 463 error = EINVAL; 464 goto unlock; 465 } 466 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 467 MSG_PRINTF(("wrong sequence number\n")); 468 error = EINVAL; 469 goto unlock; 470 } 471 472 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 473 MSG_PRINTF(("requester doesn't have write access\n")); 474 goto unlock; 475 } 476 477 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 478 MSG_PRINTF(("msgsz=%lld, msgssz=%d, segs_needed=%d\n", 479 (long long)msgsz, msginfo.msgssz, segs_needed)); 480 for (;;) { 481 int need_more_resources = 0; 482 483 /* 484 * check msgsz [cannot be negative since it is unsigned] 485 * (inside this loop in case msg_qbytes changes while we sleep) 486 */ 487 488 if (msgsz > msqptr->msg_qbytes) { 489 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 490 error = EINVAL; 491 goto unlock; 492 } 493 494 if (msqptr->msg_perm.mode & MSG_LOCKED) { 495 MSG_PRINTF(("msqid is locked\n")); 496 need_more_resources = 1; 497 } 498 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 499 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 500 need_more_resources = 1; 501 } 502 if (segs_needed > nfree_msgmaps) { 503 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 504 need_more_resources = 1; 505 } 506 if (free_msghdrs == NULL) { 507 MSG_PRINTF(("no more msghdrs\n")); 508 need_more_resources = 1; 509 } 510 511 if (need_more_resources) { 512 int we_own_it; 513 514 if ((msgflg & IPC_NOWAIT) != 0) { 515 MSG_PRINTF(("need more resources but caller " 516 "doesn't want to wait\n")); 517 error = EAGAIN; 518 goto unlock; 519 } 520 521 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 522 MSG_PRINTF(("we don't own the msqid_ds\n")); 523 we_own_it = 0; 524 } else { 525 /* Force later arrivals to wait for our 526 request */ 527 MSG_PRINTF(("we own the msqid_ds\n")); 528 msqptr->msg_perm.mode |= MSG_LOCKED; 529 we_own_it = 1; 530 } 531 MSG_PRINTF(("goodnight\n")); 532 error = mtsleep(msqptr, (PZERO - 4) | PCATCH, 533 "msgwait", 0, &msgmutex); 534 MSG_PRINTF(("good morning, error=%d\n", error)); 535 if (we_own_it) 536 msqptr->msg_perm.mode &= ~MSG_LOCKED; 537 if (error != 0) { 538 MSG_PRINTF(("msgsnd: interrupted system " 539 "call\n")); 540 error = EINTR; 541 goto unlock; 542 } 543 544 /* 545 * Make sure that the msq queue still exists 546 */ 547 548 if (msqptr->msg_qbytes == 0) { 549 MSG_PRINTF(("msqid deleted\n")); 550 error = EIDRM; 551 goto unlock; 552 } 553 } else { 554 MSG_PRINTF(("got all the resources that we need\n")); 555 break; 556 } 557 } 558 559 /* 560 * We have the resources that we need. 561 * Make sure! 562 */ 563 564 if (msqptr->msg_perm.mode & MSG_LOCKED) 565 panic("msg_perm.mode & MSG_LOCKED"); 566 if (segs_needed > nfree_msgmaps) 567 panic("segs_needed > nfree_msgmaps"); 568 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) 569 panic("msgsz + msg_cbytes > msg_qbytes"); 570 if (free_msghdrs == NULL) 571 panic("no more msghdrs"); 572 573 /* 574 * Re-lock the msqid_ds in case we page-fault when copying in the 575 * message 576 */ 577 578 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 579 panic("msqid_ds is already locked"); 580 msqptr->msg_perm.mode |= MSG_LOCKED; 581 582 /* 583 * Allocate a message header 584 */ 585 586 msghdr = free_msghdrs; 587 free_msghdrs = msghdr->msg_next; 588 msghdr->msg_spot = -1; 589 msghdr->msg_ts = msgsz; 590 591 /* 592 * Allocate space for the message 593 */ 594 595 while (segs_needed > 0) { 596 if (nfree_msgmaps <= 0) 597 panic("not enough msgmaps"); 598 if (free_msgmaps == -1) 599 panic("nil free_msgmaps"); 600 next = free_msgmaps; 601 if (next <= -1) 602 panic("next too low #1"); 603 if (next >= msginfo.msgseg) 604 panic("next out of range #1"); 605 MSG_PRINTF(("allocating segment %d to message\n", next)); 606 free_msgmaps = msgmaps[next].next; 607 nfree_msgmaps--; 608 msgmaps[next].next = msghdr->msg_spot; 609 msghdr->msg_spot = next; 610 segs_needed--; 611 } 612 613 /* 614 * Copy in the message type 615 */ 616 mutex_exit(&msgmutex); 617 error = (*fetch_type)(user_msgp, &msghdr->msg_type, typesz); 618 mutex_enter(&msgmutex); 619 if (error != 0) { 620 MSG_PRINTF(("error %d copying the message type\n", error)); 621 msg_freehdr(msghdr); 622 msqptr->msg_perm.mode &= ~MSG_LOCKED; 623 wakeup(msqptr); 624 goto unlock; 625 } 626 user_msgp += typesz; 627 628 /* 629 * Validate the message type 630 */ 631 632 if (msghdr->msg_type < 1) { 633 msg_freehdr(msghdr); 634 msqptr->msg_perm.mode &= ~MSG_LOCKED; 635 wakeup(msqptr); 636 MSG_PRINTF(("mtype (%ld) < 1\n", msghdr->msg_type)); 637 goto unlock; 638 } 639 640 /* 641 * Copy in the message body 642 */ 643 644 next = msghdr->msg_spot; 645 while (msgsz > 0) { 646 size_t tlen; 647 if (msgsz > msginfo.msgssz) 648 tlen = msginfo.msgssz; 649 else 650 tlen = msgsz; 651 if (next <= -1) 652 panic("next too low #2"); 653 if (next >= msginfo.msgseg) 654 panic("next out of range #2"); 655 mutex_exit(&msgmutex); 656 error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], tlen); 657 mutex_enter(&msgmutex); 658 if (error != 0) { 659 MSG_PRINTF(("error %d copying in message segment\n", 660 error)); 661 msg_freehdr(msghdr); 662 msqptr->msg_perm.mode &= ~MSG_LOCKED; 663 wakeup(msqptr); 664 goto unlock; 665 } 666 msgsz -= tlen; 667 user_msgp += tlen; 668 next = msgmaps[next].next; 669 } 670 if (next != -1) 671 panic("didn't use all the msg segments"); 672 673 /* 674 * We've got the message. Unlock the msqid_ds. 675 */ 676 677 msqptr->msg_perm.mode &= ~MSG_LOCKED; 678 679 /* 680 * Make sure that the msqid_ds is still allocated. 681 */ 682 683 if (msqptr->msg_qbytes == 0) { 684 msg_freehdr(msghdr); 685 wakeup(msqptr); 686 error = EIDRM; 687 goto unlock; 688 } 689 690 /* 691 * Put the message into the queue 692 */ 693 694 if (msqptr->_msg_first == NULL) { 695 msqptr->_msg_first = msghdr; 696 msqptr->_msg_last = msghdr; 697 } else { 698 msqptr->_msg_last->msg_next = msghdr; 699 msqptr->_msg_last = msghdr; 700 } 701 msqptr->_msg_last->msg_next = NULL; 702 703 msqptr->_msg_cbytes += msghdr->msg_ts; 704 msqptr->msg_qnum++; 705 msqptr->msg_lspid = l->l_proc->p_pid; 706 msqptr->msg_stime = time_second; 707 708 wakeup(msqptr); 709 710 unlock: 711 mutex_exit(&msgmutex); 712 return error; 713 } 714 715 int 716 sys_msgrcv(struct lwp *l, void *v, register_t *retval) 717 { 718 struct sys_msgrcv_args /* { 719 syscallarg(int) msqid; 720 syscallarg(void *) msgp; 721 syscallarg(size_t) msgsz; 722 syscallarg(long) msgtyp; 723 syscallarg(int) msgflg; 724 } */ *uap = v; 725 726 return msgrcv1(l, SCARG(uap, msqid), SCARG(uap, msgp), 727 SCARG(uap, msgsz), SCARG(uap, msgtyp), SCARG(uap, msgflg), 728 sizeof(long), copyout, retval); 729 } 730 731 int 732 msgrcv1(struct lwp *l, int msqidr, char *user_msgp, size_t msgsz, long msgtyp, 733 int msgflg, size_t typesz, copyout_t put_type, register_t *retval) 734 { 735 size_t len; 736 kauth_cred_t cred = l->l_cred; 737 struct msqid_ds *msqptr; 738 struct __msg *msghdr; 739 int error = 0, msqid; 740 short next; 741 742 MSG_PRINTF(("call to msgrcv(%d, %p, %lld, %ld, %d)\n", msqid, 743 user_msgp, (long long)msgsz, msgtyp, msgflg)); 744 745 msqid = IPCID_TO_IX(msqidr); 746 747 mutex_enter(&msgmutex); 748 749 if (msqid < 0 || msqid >= msginfo.msgmni) { 750 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 751 msginfo.msgmni)); 752 error = EINVAL; 753 goto unlock; 754 } 755 756 msqptr = &msqids[msqid]; 757 if (msqptr->msg_qbytes == 0) { 758 MSG_PRINTF(("no such message queue id\n")); 759 error = EINVAL; 760 goto unlock; 761 } 762 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 763 MSG_PRINTF(("wrong sequence number\n")); 764 error = EINVAL; 765 goto unlock; 766 } 767 768 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 769 MSG_PRINTF(("requester doesn't have read access\n")); 770 goto unlock; 771 } 772 773 #if 0 774 /* cannot happen, msgsz is unsigned */ 775 if (msgsz < 0) { 776 MSG_PRINTF(("msgsz < 0\n")); 777 error = EINVAL; 778 goto unlock; 779 } 780 #endif 781 782 msghdr = NULL; 783 while (msghdr == NULL) { 784 if (msgtyp == 0) { 785 msghdr = msqptr->_msg_first; 786 if (msghdr != NULL) { 787 if (msgsz < msghdr->msg_ts && 788 (msgflg & MSG_NOERROR) == 0) { 789 MSG_PRINTF(("first message on the " 790 "queue is too big " 791 "(want %lld, got %d)\n", 792 (long long)msgsz, msghdr->msg_ts)); 793 error = E2BIG; 794 goto unlock; 795 } 796 if (msqptr->_msg_first == msqptr->_msg_last) { 797 msqptr->_msg_first = NULL; 798 msqptr->_msg_last = NULL; 799 } else { 800 msqptr->_msg_first = msghdr->msg_next; 801 if (msqptr->_msg_first == NULL) 802 panic("msg_first/last screwed " 803 "up #1"); 804 } 805 } 806 } else { 807 struct __msg *previous; 808 struct __msg **prev; 809 810 for (previous = NULL, prev = &msqptr->_msg_first; 811 (msghdr = *prev) != NULL; 812 previous = msghdr, prev = &msghdr->msg_next) { 813 /* 814 * Is this message's type an exact match or is 815 * this message's type less than or equal to 816 * the absolute value of a negative msgtyp? 817 * Note that the second half of this test can 818 * NEVER be true if msgtyp is positive since 819 * msg_type is always positive! 820 */ 821 822 if (msgtyp == msghdr->msg_type || 823 msghdr->msg_type <= -msgtyp) { 824 MSG_PRINTF(("found message type %ld, " 825 "requested %ld\n", 826 msghdr->msg_type, msgtyp)); 827 if (msgsz < msghdr->msg_ts && 828 (msgflg & MSG_NOERROR) == 0) { 829 MSG_PRINTF(("requested message " 830 "on the queue is too big " 831 "(want %lld, got %d)\n", 832 (long long)msgsz, 833 msghdr->msg_ts)); 834 error = E2BIG; 835 goto unlock; 836 } 837 *prev = msghdr->msg_next; 838 if (msghdr == msqptr->_msg_last) { 839 if (previous == NULL) { 840 if (prev != 841 &msqptr->_msg_first) 842 panic("msg_first/last screwed up #2"); 843 msqptr->_msg_first = 844 NULL; 845 msqptr->_msg_last = 846 NULL; 847 } else { 848 if (prev == 849 &msqptr->_msg_first) 850 panic("msg_first/last screwed up #3"); 851 msqptr->_msg_last = 852 previous; 853 } 854 } 855 break; 856 } 857 } 858 } 859 860 /* 861 * We've either extracted the msghdr for the appropriate 862 * message or there isn't one. 863 * If there is one then bail out of this loop. 864 */ 865 866 if (msghdr != NULL) 867 break; 868 869 /* 870 * Hmph! No message found. Does the user want to wait? 871 */ 872 873 if ((msgflg & IPC_NOWAIT) != 0) { 874 MSG_PRINTF(("no appropriate message found (msgtyp=%ld)\n", 875 msgtyp)); 876 /* The SVID says to return ENOMSG. */ 877 #ifdef ENOMSG 878 error = ENOMSG; 879 #else 880 /* Unfortunately, BSD doesn't define that code yet! */ 881 error = EAGAIN; 882 #endif 883 goto unlock; 884 } 885 886 /* 887 * Wait for something to happen 888 */ 889 890 MSG_PRINTF(("msgrcv: goodnight\n")); 891 error = mtsleep(msqptr, (PZERO - 4) | PCATCH, "msgwait", 892 0, &msgmutex); 893 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 894 895 if (error != 0) { 896 MSG_PRINTF(("msgsnd: interrupted system call\n")); 897 error = EINTR; 898 goto unlock; 899 } 900 901 /* 902 * Make sure that the msq queue still exists 903 */ 904 905 if (msqptr->msg_qbytes == 0 || 906 msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 907 MSG_PRINTF(("msqid deleted\n")); 908 error = EIDRM; 909 goto unlock; 910 } 911 } 912 913 /* 914 * Return the message to the user. 915 * 916 * First, do the bookkeeping (before we risk being interrupted). 917 */ 918 919 msqptr->_msg_cbytes -= msghdr->msg_ts; 920 msqptr->msg_qnum--; 921 msqptr->msg_lrpid = l->l_proc->p_pid; 922 msqptr->msg_rtime = time_second; 923 924 /* 925 * Make msgsz the actual amount that we'll be returning. 926 * Note that this effectively truncates the message if it is too long 927 * (since msgsz is never increased). 928 */ 929 930 MSG_PRINTF(("found a message, msgsz=%lld, msg_ts=%d\n", 931 (long long)msgsz, msghdr->msg_ts)); 932 if (msgsz > msghdr->msg_ts) 933 msgsz = msghdr->msg_ts; 934 935 /* 936 * Return the type to the user. 937 */ 938 mutex_exit(&msgmutex); 939 error = (*put_type)(&msghdr->msg_type, user_msgp, typesz); 940 mutex_enter(&msgmutex); 941 if (error != 0) { 942 MSG_PRINTF(("error (%d) copying out message type\n", error)); 943 msg_freehdr(msghdr); 944 wakeup(msqptr); 945 goto unlock; 946 } 947 user_msgp += typesz; 948 949 /* 950 * Return the segments to the user 951 */ 952 953 next = msghdr->msg_spot; 954 for (len = 0; len < msgsz; len += msginfo.msgssz) { 955 size_t tlen; 956 957 if (msgsz - len > msginfo.msgssz) 958 tlen = msginfo.msgssz; 959 else 960 tlen = msgsz - len; 961 if (next <= -1) 962 panic("next too low #3"); 963 if (next >= msginfo.msgseg) 964 panic("next out of range #3"); 965 mutex_exit(&msgmutex); 966 error = copyout(&msgpool[next * msginfo.msgssz], 967 user_msgp, tlen); 968 mutex_enter(&msgmutex); 969 if (error != 0) { 970 MSG_PRINTF(("error (%d) copying out message segment\n", 971 error)); 972 msg_freehdr(msghdr); 973 wakeup(msqptr); 974 goto unlock; 975 } 976 user_msgp += tlen; 977 next = msgmaps[next].next; 978 } 979 980 /* 981 * Done, return the actual number of bytes copied out. 982 */ 983 984 msg_freehdr(msghdr); 985 wakeup(msqptr); 986 *retval = msgsz; 987 988 unlock: 989 mutex_exit(&msgmutex); 990 return error; 991 } 992
Indexes created Wed Oct 01 13:09:50 GMT 2025