sysv_msg.c revision 1.44.4.4
1 /* $NetBSD: sysv_msg.c,v 1.44.4.4 2007/01/28 01:34:18 ad Exp $ */ 2 3 /*- 4 * Copyright (c) 1999, 2006, 2007 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center, and by Andrew Doran. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.44.4.4 2007/01/28 01:34:18 ad Exp $"); 61 62 #define SYSVMSG 63 64 #include <sys/param.h> 65 #include <sys/kernel.h> 66 #include <sys/msg.h> 67 #include <sys/sysctl.h> 68 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */ 69 #include <sys/sa.h> 70 #include <sys/syscallargs.h> 71 #include <sys/kauth.h> 72 73 #define MSG_DEBUG 74 #undef MSG_DEBUG_OK 75 76 #ifdef MSG_DEBUG_OK 77 #define MSG_PRINTF(a) printf a 78 #else 79 #define MSG_PRINTF(a) 80 #endif 81 82 static int nfree_msgmaps; /* # of free map entries */ 83 static short free_msgmaps; /* head of linked list of free map entries */ 84 static struct __msg *free_msghdrs; /* list of free msg headers */ 85 static char *msgpool; /* MSGMAX byte long msg buffer pool */ 86 static struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 87 static struct __msg *msghdrs; /* MSGTQL msg headers */ 88 89 kmsq_t *msqs; /* MSGMNI msqid_ds struct's */ 90 kmutex_t msgmutex; /* subsystem lock */ 91 92 static void msg_freehdr(struct __msg *); 93 94 void 95 msginit(void) 96 { 97 int i, sz; 98 vaddr_t v; 99 100 /* 101 * msginfo.msgssz should be a power of two for efficiency reasons. 102 * It is also pretty silly if msginfo.msgssz is less than 8 103 * or greater than about 256 so ... 104 */ 105 106 i = 8; 107 while (i < 1024 && i != msginfo.msgssz) 108 i <<= 1; 109 if (i != msginfo.msgssz) { 110 MSG_PRINTF(("msginfo.msgssz=%d (0x%x)\n", msginfo.msgssz, 111 msginfo.msgssz)); 112 panic("msginfo.msgssz not a small power of 2"); 113 } 114 115 if (msginfo.msgseg > 32767) { 116 MSG_PRINTF(("msginfo.msgseg=%d\n", msginfo.msgseg)); 117 panic("msginfo.msgseg > 32767"); 118 } 119 120 /* Allocate pageable memory for our structures */ 121 sz = msginfo.msgmax 122 + msginfo.msgseg * sizeof(struct msgmap) 123 + msginfo.msgtql * sizeof(struct __msg) 124 + msginfo.msgmni * sizeof(kmsq_t); 125 v = uvm_km_alloc(kernel_map, round_page(sz), 0, 126 UVM_KMF_WIRED|UVM_KMF_ZERO); 127 if (v == 0) 128 panic("sysv_msg: cannot allocate memory"); 129 msgpool = (void *)v; 130 msgmaps = (void *) (msgpool + msginfo.msgmax); 131 msghdrs = (void *) (msgmaps + msginfo.msgseg); 132 msqs = (void *) (msghdrs + msginfo.msgtql); 133 134 for (i = 0; i < msginfo.msgseg; i++) { 135 if (i > 0) 136 msgmaps[i-1].next = i; 137 msgmaps[i].next = -1; /* implies entry is available */ 138 } 139 free_msgmaps = 0; 140 nfree_msgmaps = msginfo.msgseg; 141 142 if (msghdrs == NULL) 143 panic("msghdrs is NULL"); 144 145 for (i = 0; i < msginfo.msgtql; i++) { 146 msghdrs[i].msg_type = 0; 147 if (i > 0) 148 msghdrs[i-1].msg_next = &msghdrs[i]; 149 msghdrs[i].msg_next = NULL; 150 } 151 free_msghdrs = &msghdrs[0]; 152 153 if (msqs == NULL) 154 panic("msqs is NULL"); 155 156 for (i = 0; i < msginfo.msgmni; i++) { 157 msqs[i].msq_u.msg_qbytes = 0; /* implies entry is available */ 158 msqs[i].msq_u.msg_perm._seq = 0;/* reset to a known value */ 159 cv_init(&msqs[i].msq_cv, "msgwait"); 160 } 161 162 mutex_init(&msgmutex, MUTEX_DEFAULT, IPL_NONE); 163 } 164 165 static void 166 msg_freehdr(struct __msg *msghdr) 167 { 168 169 KASSERT(mutex_owned(&msgmutex)); 170 171 while (msghdr->msg_ts > 0) { 172 short next; 173 if (msghdr->msg_spot < 0 || msghdr->msg_spot >= msginfo.msgseg) 174 panic("msghdr->msg_spot out of range"); 175 next = msgmaps[msghdr->msg_spot].next; 176 msgmaps[msghdr->msg_spot].next = free_msgmaps; 177 free_msgmaps = msghdr->msg_spot; 178 nfree_msgmaps++; 179 msghdr->msg_spot = next; 180 if (msghdr->msg_ts >= msginfo.msgssz) 181 msghdr->msg_ts -= msginfo.msgssz; 182 else 183 msghdr->msg_ts = 0; 184 } 185 if (msghdr->msg_spot != -1) 186 panic("msghdr->msg_spot != -1"); 187 msghdr->msg_next = free_msghdrs; 188 free_msghdrs = msghdr; 189 } 190 191 int 192 sys___msgctl13(struct lwp *l, void *v, register_t *retval) 193 { 194 struct sys___msgctl13_args /* { 195 syscallarg(int) msqid; 196 syscallarg(int) cmd; 197 syscallarg(struct msqid_ds *) buf; 198 } */ *uap = v; 199 struct msqid_ds msqbuf; 200 int cmd, error; 201 202 cmd = SCARG(uap, cmd); 203 204 if (cmd == IPC_SET) { 205 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 206 if (error) 207 return (error); 208 } 209 210 error = msgctl1(l, SCARG(uap, msqid), cmd, 211 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 212 213 if (error == 0 && cmd == IPC_STAT) 214 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 215 216 return (error); 217 } 218 219 int 220 msgctl1(struct lwp *l, int msqid, int cmd, struct msqid_ds *msqbuf) 221 { 222 kauth_cred_t cred = l->l_cred; 223 struct msqid_ds *msqptr; 224 kmsq_t *msq; 225 int error = 0, ix; 226 227 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 228 229 ix = IPCID_TO_IX(msqid); 230 231 mutex_enter(&msgmutex); 232 233 if (ix < 0 || ix >= msginfo.msgmni) { 234 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 235 msginfo.msgmni)); 236 error = EINVAL; 237 goto unlock; 238 } 239 240 msq = &msqs[ix]; 241 msqptr = &msq->msq_u; 242 243 if (msqptr->msg_qbytes == 0) { 244 MSG_PRINTF(("no such msqid\n")); 245 error = EINVAL; 246 goto unlock; 247 } 248 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 249 MSG_PRINTF(("wrong sequence number\n")); 250 error = EINVAL; 251 goto unlock; 252 } 253 254 switch (cmd) { 255 case IPC_RMID: 256 { 257 struct __msg *msghdr; 258 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 259 break; 260 /* Free the message headers */ 261 msghdr = msqptr->_msg_first; 262 while (msghdr != NULL) { 263 struct __msg *msghdr_tmp; 264 265 /* Free the segments of each message */ 266 msqptr->_msg_cbytes -= msghdr->msg_ts; 267 msqptr->msg_qnum--; 268 msghdr_tmp = msghdr; 269 msghdr = msghdr->msg_next; 270 msg_freehdr(msghdr_tmp); 271 } 272 273 if (msqptr->_msg_cbytes != 0) 274 panic("msg_cbytes is screwed up"); 275 if (msqptr->msg_qnum != 0) 276 panic("msg_qnum is screwed up"); 277 278 msqptr->msg_qbytes = 0; /* Mark it as free */ 279 280 cv_broadcast(&msq->msq_cv); 281 } 282 break; 283 284 case IPC_SET: 285 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 286 break; 287 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && 288 kauth_authorize_generic(cred, KAUTH_GENERIC_ISSUSER, 289 NULL) != 0) { 290 error = EPERM; 291 break; 292 } 293 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 294 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 295 "(truncating)\n", msginfo.msgmnb)); 296 /* silently restrict qbytes to system limit */ 297 msqbuf->msg_qbytes = msginfo.msgmnb; 298 } 299 if (msqbuf->msg_qbytes == 0) { 300 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 301 error = EINVAL; /* XXX non-standard errno! */ 302 break; 303 } 304 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 305 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 306 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 307 (msqbuf->msg_perm.mode & 0777); 308 msqptr->msg_qbytes = msqbuf->msg_qbytes; 309 msqptr->msg_ctime = time_second; 310 break; 311 312 case IPC_STAT: 313 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 314 MSG_PRINTF(("requester doesn't have read access\n")); 315 return (error); 316 } 317 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 318 break; 319 320 default: 321 MSG_PRINTF(("invalid command %d\n", cmd)); 322 error = EINVAL; 323 break; 324 } 325 326 unlock: 327 mutex_exit(&msgmutex); 328 return (error); 329 } 330 331 int 332 sys_msgget(struct lwp *l, void *v, register_t *retval) 333 { 334 struct sys_msgget_args /* { 335 syscallarg(key_t) key; 336 syscallarg(int) msgflg; 337 } */ *uap = v; 338 int msqid, error = 0; 339 int key = SCARG(uap, key); 340 int msgflg = SCARG(uap, msgflg); 341 kauth_cred_t cred = l->l_cred; 342 struct msqid_ds *msqptr = NULL; 343 kmsq_t *msq; 344 345 mutex_enter(&msgmutex); 346 347 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 348 349 if (key != IPC_PRIVATE) { 350 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 351 msq = &msqs[msqid]; 352 msqptr = &msq->msq_u; 353 if (msqptr->msg_qbytes != 0 && 354 msqptr->msg_perm._key == key) 355 break; 356 } 357 if (msqid < msginfo.msgmni) { 358 MSG_PRINTF(("found public key\n")); 359 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 360 MSG_PRINTF(("not exclusive\n")); 361 error = EEXIST; 362 goto unlock; 363 } 364 if ((error = ipcperm(cred, &msqptr->msg_perm, 365 msgflg & 0700 ))) { 366 MSG_PRINTF(("requester doesn't have 0%o access\n", 367 msgflg & 0700)); 368 goto unlock; 369 } 370 goto found; 371 } 372 } 373 374 MSG_PRINTF(("need to allocate the msqid_ds\n")); 375 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 376 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 377 /* 378 * Look for an unallocated and unlocked msqid_ds. 379 * msqid_ds's can be locked by msgsnd or msgrcv while 380 * they are copying the message in/out. We can't 381 * re-use the entry until they release it. 382 */ 383 msq = &msqs[msqid]; 384 msqptr = &msq->msq_u; 385 if (msqptr->msg_qbytes == 0 && 386 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 387 break; 388 } 389 if (msqid == msginfo.msgmni) { 390 MSG_PRINTF(("no more msqid_ds's available\n")); 391 error = ENOSPC; 392 goto unlock; 393 } 394 MSG_PRINTF(("msqid %d is available\n", msqid)); 395 msqptr->msg_perm._key = key; 396 msqptr->msg_perm.cuid = kauth_cred_geteuid(cred); 397 msqptr->msg_perm.uid = kauth_cred_geteuid(cred); 398 msqptr->msg_perm.cgid = kauth_cred_getegid(cred); 399 msqptr->msg_perm.gid = kauth_cred_getegid(cred); 400 msqptr->msg_perm.mode = (msgflg & 0777); 401 /* Make sure that the returned msqid is unique */ 402 msqptr->msg_perm._seq++; 403 msqptr->_msg_first = NULL; 404 msqptr->_msg_last = NULL; 405 msqptr->_msg_cbytes = 0; 406 msqptr->msg_qnum = 0; 407 msqptr->msg_qbytes = msginfo.msgmnb; 408 msqptr->msg_lspid = 0; 409 msqptr->msg_lrpid = 0; 410 msqptr->msg_stime = 0; 411 msqptr->msg_rtime = 0; 412 msqptr->msg_ctime = time_second; 413 } else { 414 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 415 error = ENOENT; 416 goto unlock; 417 } 418 419 found: 420 /* Construct the unique msqid */ 421 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 422 423 unlock: 424 mutex_exit(&msgmutex); 425 return (error); 426 } 427 428 int 429 sys_msgsnd(struct lwp *l, void *v, register_t *retval) 430 { 431 struct sys_msgsnd_args /* { 432 syscallarg(int) msqid; 433 syscallarg(const void *) msgp; 434 syscallarg(size_t) msgsz; 435 syscallarg(int) msgflg; 436 } */ *uap = v; 437 438 return msgsnd1(l, SCARG(uap, msqid), SCARG(uap, msgp), 439 SCARG(uap, msgsz), SCARG(uap, msgflg), sizeof(long), copyin); 440 } 441 442 int 443 msgsnd1(struct lwp *l, int msqidr, const char *user_msgp, size_t msgsz, 444 int msgflg, size_t typesz, copyin_t fetch_type) 445 { 446 int segs_needed, error = 0, msqid; 447 kauth_cred_t cred = l->l_cred; 448 struct msqid_ds *msqptr; 449 struct __msg *msghdr; 450 kmsq_t *msq; 451 short next; 452 453 MSG_PRINTF(("call to msgsnd(%d, %p, %lld, %d)\n", msqid, user_msgp, 454 (long long)msgsz, msgflg)); 455 456 msqid = IPCID_TO_IX(msqidr); 457 458 mutex_enter(&msgmutex); 459 460 if (msqid < 0 || msqid >= msginfo.msgmni) { 461 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 462 msginfo.msgmni)); 463 error = EINVAL; 464 goto unlock; 465 } 466 467 msq = &msqs[msqid]; 468 msqptr = &msq->msq_u; 469 470 if (msqptr->msg_qbytes == 0) { 471 MSG_PRINTF(("no such message queue id\n")); 472 error = EINVAL; 473 goto unlock; 474 } 475 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 476 MSG_PRINTF(("wrong sequence number\n")); 477 error = EINVAL; 478 goto unlock; 479 } 480 481 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 482 MSG_PRINTF(("requester doesn't have write access\n")); 483 goto unlock; 484 } 485 486 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 487 MSG_PRINTF(("msgsz=%lld, msgssz=%d, segs_needed=%d\n", 488 (long long)msgsz, msginfo.msgssz, segs_needed)); 489 for (;;) { 490 int need_more_resources = 0; 491 492 /* 493 * check msgsz [cannot be negative since it is unsigned] 494 * (inside this loop in case msg_qbytes changes while we sleep) 495 */ 496 497 if (msgsz > msqptr->msg_qbytes) { 498 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 499 error = EINVAL; 500 goto unlock; 501 } 502 503 if (msqptr->msg_perm.mode & MSG_LOCKED) { 504 MSG_PRINTF(("msqid is locked\n")); 505 need_more_resources = 1; 506 } 507 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 508 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 509 need_more_resources = 1; 510 } 511 if (segs_needed > nfree_msgmaps) { 512 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 513 need_more_resources = 1; 514 } 515 if (free_msghdrs == NULL) { 516 MSG_PRINTF(("no more msghdrs\n")); 517 need_more_resources = 1; 518 } 519 520 if (need_more_resources) { 521 int we_own_it; 522 523 if ((msgflg & IPC_NOWAIT) != 0) { 524 MSG_PRINTF(("need more resources but caller " 525 "doesn't want to wait\n")); 526 error = EAGAIN; 527 goto unlock; 528 } 529 530 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 531 MSG_PRINTF(("we don't own the msqid_ds\n")); 532 we_own_it = 0; 533 } else { 534 /* Force later arrivals to wait for our 535 request */ 536 MSG_PRINTF(("we own the msqid_ds\n")); 537 msqptr->msg_perm.mode |= MSG_LOCKED; 538 we_own_it = 1; 539 } 540 MSG_PRINTF(("goodnight\n")); 541 error = cv_wait_sig(&msq->msq_cv, &msgmutex); 542 MSG_PRINTF(("good morning, error=%d\n", error)); 543 if (we_own_it) 544 msqptr->msg_perm.mode &= ~MSG_LOCKED; 545 if (error != 0) { 546 MSG_PRINTF(("msgsnd: interrupted system " 547 "call\n")); 548 error = EINTR; 549 goto unlock; 550 } 551 552 /* 553 * Make sure that the msq queue still exists 554 */ 555 556 if (msqptr->msg_qbytes == 0) { 557 MSG_PRINTF(("msqid deleted\n")); 558 error = EIDRM; 559 goto unlock; 560 } 561 } else { 562 MSG_PRINTF(("got all the resources that we need\n")); 563 break; 564 } 565 } 566 567 /* 568 * We have the resources that we need. 569 * Make sure! 570 */ 571 572 if (msqptr->msg_perm.mode & MSG_LOCKED) 573 panic("msg_perm.mode & MSG_LOCKED"); 574 if (segs_needed > nfree_msgmaps) 575 panic("segs_needed > nfree_msgmaps"); 576 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) 577 panic("msgsz + msg_cbytes > msg_qbytes"); 578 if (free_msghdrs == NULL) 579 panic("no more msghdrs"); 580 581 /* 582 * Re-lock the msqid_ds in case we page-fault when copying in the 583 * message 584 */ 585 586 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) 587 panic("msqid_ds is already locked"); 588 msqptr->msg_perm.mode |= MSG_LOCKED; 589 590 /* 591 * Allocate a message header 592 */ 593 594 msghdr = free_msghdrs; 595 free_msghdrs = msghdr->msg_next; 596 msghdr->msg_spot = -1; 597 msghdr->msg_ts = msgsz; 598 599 /* 600 * Allocate space for the message 601 */ 602 603 while (segs_needed > 0) { 604 if (nfree_msgmaps <= 0) 605 panic("not enough msgmaps"); 606 if (free_msgmaps == -1) 607 panic("nil free_msgmaps"); 608 next = free_msgmaps; 609 if (next <= -1) 610 panic("next too low #1"); 611 if (next >= msginfo.msgseg) 612 panic("next out of range #1"); 613 MSG_PRINTF(("allocating segment %d to message\n", next)); 614 free_msgmaps = msgmaps[next].next; 615 nfree_msgmaps--; 616 msgmaps[next].next = msghdr->msg_spot; 617 msghdr->msg_spot = next; 618 segs_needed--; 619 } 620 621 /* 622 * Copy in the message type 623 */ 624 mutex_exit(&msgmutex); 625 error = (*fetch_type)(user_msgp, &msghdr->msg_type, typesz); 626 mutex_enter(&msgmutex); 627 if (error != 0) { 628 MSG_PRINTF(("error %d copying the message type\n", error)); 629 msg_freehdr(msghdr); 630 msqptr->msg_perm.mode &= ~MSG_LOCKED; 631 cv_broadcast(&msq->msq_cv); 632 goto unlock; 633 } 634 user_msgp += typesz; 635 636 /* 637 * Validate the message type 638 */ 639 640 if (msghdr->msg_type < 1) { 641 msg_freehdr(msghdr); 642 msqptr->msg_perm.mode &= ~MSG_LOCKED; 643 cv_broadcast(&msq->msq_cv); 644 MSG_PRINTF(("mtype (%ld) < 1\n", msghdr->msg_type)); 645 goto unlock; 646 } 647 648 /* 649 * Copy in the message body 650 */ 651 652 next = msghdr->msg_spot; 653 while (msgsz > 0) { 654 size_t tlen; 655 if (msgsz > msginfo.msgssz) 656 tlen = msginfo.msgssz; 657 else 658 tlen = msgsz; 659 if (next <= -1) 660 panic("next too low #2"); 661 if (next >= msginfo.msgseg) 662 panic("next out of range #2"); 663 mutex_exit(&msgmutex); 664 error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], tlen); 665 mutex_enter(&msgmutex); 666 if (error != 0) { 667 MSG_PRINTF(("error %d copying in message segment\n", 668 error)); 669 msg_freehdr(msghdr); 670 msqptr->msg_perm.mode &= ~MSG_LOCKED; 671 cv_broadcast(&msq->msq_cv); 672 goto unlock; 673 } 674 msgsz -= tlen; 675 user_msgp += tlen; 676 next = msgmaps[next].next; 677 } 678 if (next != -1) 679 panic("didn't use all the msg segments"); 680 681 /* 682 * We've got the message. Unlock the msqid_ds. 683 */ 684 685 msqptr->msg_perm.mode &= ~MSG_LOCKED; 686 687 /* 688 * Make sure that the msqid_ds is still allocated. 689 */ 690 691 if (msqptr->msg_qbytes == 0) { 692 msg_freehdr(msghdr); 693 cv_broadcast(&msq->msq_cv); 694 error = EIDRM; 695 goto unlock; 696 } 697 698 /* 699 * Put the message into the queue 700 */ 701 702 if (msqptr->_msg_first == NULL) { 703 msqptr->_msg_first = msghdr; 704 msqptr->_msg_last = msghdr; 705 } else { 706 msqptr->_msg_last->msg_next = msghdr; 707 msqptr->_msg_last = msghdr; 708 } 709 msqptr->_msg_last->msg_next = NULL; 710 711 msqptr->_msg_cbytes += msghdr->msg_ts; 712 msqptr->msg_qnum++; 713 msqptr->msg_lspid = l->l_proc->p_pid; 714 msqptr->msg_stime = time_second; 715 716 cv_broadcast(&msq->msq_cv); 717 718 unlock: 719 mutex_exit(&msgmutex); 720 return error; 721 } 722 723 int 724 sys_msgrcv(struct lwp *l, void *v, register_t *retval) 725 { 726 struct sys_msgrcv_args /* { 727 syscallarg(int) msqid; 728 syscallarg(void *) msgp; 729 syscallarg(size_t) msgsz; 730 syscallarg(long) msgtyp; 731 syscallarg(int) msgflg; 732 } */ *uap = v; 733 734 return msgrcv1(l, SCARG(uap, msqid), SCARG(uap, msgp), 735 SCARG(uap, msgsz), SCARG(uap, msgtyp), SCARG(uap, msgflg), 736 sizeof(long), copyout, retval); 737 } 738 739 int 740 msgrcv1(struct lwp *l, int msqidr, char *user_msgp, size_t msgsz, long msgtyp, 741 int msgflg, size_t typesz, copyout_t put_type, register_t *retval) 742 { 743 size_t len; 744 kauth_cred_t cred = l->l_cred; 745 struct msqid_ds *msqptr; 746 struct __msg *msghdr; 747 int error = 0, msqid; 748 kmsq_t *msq; 749 short next; 750 751 MSG_PRINTF(("call to msgrcv(%d, %p, %lld, %ld, %d)\n", msqid, 752 user_msgp, (long long)msgsz, msgtyp, msgflg)); 753 754 msqid = IPCID_TO_IX(msqidr); 755 756 mutex_enter(&msgmutex); 757 758 if (msqid < 0 || msqid >= msginfo.msgmni) { 759 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 760 msginfo.msgmni)); 761 error = EINVAL; 762 goto unlock; 763 } 764 765 msq = &msqs[msqid]; 766 msqptr = &msq->msq_u; 767 768 if (msqptr->msg_qbytes == 0) { 769 MSG_PRINTF(("no such message queue id\n")); 770 error = EINVAL; 771 goto unlock; 772 } 773 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 774 MSG_PRINTF(("wrong sequence number\n")); 775 error = EINVAL; 776 goto unlock; 777 } 778 779 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 780 MSG_PRINTF(("requester doesn't have read access\n")); 781 goto unlock; 782 } 783 784 #if 0 785 /* cannot happen, msgsz is unsigned */ 786 if (msgsz < 0) { 787 MSG_PRINTF(("msgsz < 0\n")); 788 error = EINVAL; 789 goto unlock; 790 } 791 #endif 792 793 msghdr = NULL; 794 while (msghdr == NULL) { 795 if (msgtyp == 0) { 796 msghdr = msqptr->_msg_first; 797 if (msghdr != NULL) { 798 if (msgsz < msghdr->msg_ts && 799 (msgflg & MSG_NOERROR) == 0) { 800 MSG_PRINTF(("first message on the " 801 "queue is too big " 802 "(want %lld, got %d)\n", 803 (long long)msgsz, msghdr->msg_ts)); 804 error = E2BIG; 805 goto unlock; 806 } 807 if (msqptr->_msg_first == msqptr->_msg_last) { 808 msqptr->_msg_first = NULL; 809 msqptr->_msg_last = NULL; 810 } else { 811 msqptr->_msg_first = msghdr->msg_next; 812 if (msqptr->_msg_first == NULL) 813 panic("msg_first/last screwed " 814 "up #1"); 815 } 816 } 817 } else { 818 struct __msg *previous; 819 struct __msg **prev; 820 821 for (previous = NULL, prev = &msqptr->_msg_first; 822 (msghdr = *prev) != NULL; 823 previous = msghdr, prev = &msghdr->msg_next) { 824 /* 825 * Is this message's type an exact match or is 826 * this message's type less than or equal to 827 * the absolute value of a negative msgtyp? 828 * Note that the second half of this test can 829 * NEVER be true if msgtyp is positive since 830 * msg_type is always positive! 831 */ 832 833 if (msgtyp == msghdr->msg_type || 834 msghdr->msg_type <= -msgtyp) { 835 MSG_PRINTF(("found message type %ld, " 836 "requested %ld\n", 837 msghdr->msg_type, msgtyp)); 838 if (msgsz < msghdr->msg_ts && 839 (msgflg & MSG_NOERROR) == 0) { 840 MSG_PRINTF(("requested message " 841 "on the queue is too big " 842 "(want %lld, got %d)\n", 843 (long long)msgsz, 844 msghdr->msg_ts)); 845 error = E2BIG; 846 goto unlock; 847 } 848 *prev = msghdr->msg_next; 849 if (msghdr == msqptr->_msg_last) { 850 if (previous == NULL) { 851 if (prev != 852 &msqptr->_msg_first) 853 panic("msg_first/last screwed up #2"); 854 msqptr->_msg_first = 855 NULL; 856 msqptr->_msg_last = 857 NULL; 858 } else { 859 if (prev == 860 &msqptr->_msg_first) 861 panic("msg_first/last screwed up #3"); 862 msqptr->_msg_last = 863 previous; 864 } 865 } 866 break; 867 } 868 } 869 } 870 871 /* 872 * We've either extracted the msghdr for the appropriate 873 * message or there isn't one. 874 * If there is one then bail out of this loop. 875 */ 876 877 if (msghdr != NULL) 878 break; 879 880 /* 881 * Hmph! No message found. Does the user want to wait? 882 */ 883 884 if ((msgflg & IPC_NOWAIT) != 0) { 885 MSG_PRINTF(("no appropriate message found (msgtyp=%ld)\n", 886 msgtyp)); 887 /* The SVID says to return ENOMSG. */ 888 #ifdef ENOMSG 889 error = ENOMSG; 890 #else 891 /* Unfortunately, BSD doesn't define that code yet! */ 892 error = EAGAIN; 893 #endif 894 goto unlock; 895 } 896 897 /* 898 * Wait for something to happen 899 */ 900 901 MSG_PRINTF(("msgrcv: goodnight\n")); 902 error = cv_wait_sig(&msq->msq_cv, &msgmutex); 903 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 904 905 if (error != 0) { 906 MSG_PRINTF(("msgsnd: interrupted system call\n")); 907 error = EINTR; 908 goto unlock; 909 } 910 911 /* 912 * Make sure that the msq queue still exists 913 */ 914 915 if (msqptr->msg_qbytes == 0 || 916 msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 917 MSG_PRINTF(("msqid deleted\n")); 918 error = EIDRM; 919 goto unlock; 920 } 921 } 922 923 /* 924 * Return the message to the user. 925 * 926 * First, do the bookkeeping (before we risk being interrupted). 927 */ 928 929 msqptr->_msg_cbytes -= msghdr->msg_ts; 930 msqptr->msg_qnum--; 931 msqptr->msg_lrpid = l->l_proc->p_pid; 932 msqptr->msg_rtime = time_second; 933 934 /* 935 * Make msgsz the actual amount that we'll be returning. 936 * Note that this effectively truncates the message if it is too long 937 * (since msgsz is never increased). 938 */ 939 940 MSG_PRINTF(("found a message, msgsz=%lld, msg_ts=%d\n", 941 (long long)msgsz, msghdr->msg_ts)); 942 if (msgsz > msghdr->msg_ts) 943 msgsz = msghdr->msg_ts; 944 945 /* 946 * Return the type to the user. 947 */ 948 mutex_exit(&msgmutex); 949 error = (*put_type)(&msghdr->msg_type, user_msgp, typesz); 950 mutex_enter(&msgmutex); 951 if (error != 0) { 952 MSG_PRINTF(("error (%d) copying out message type\n", error)); 953 msg_freehdr(msghdr); 954 cv_broadcast(&msq->msq_cv); 955 goto unlock; 956 } 957 user_msgp += typesz; 958 959 /* 960 * Return the segments to the user 961 */ 962 963 next = msghdr->msg_spot; 964 for (len = 0; len < msgsz; len += msginfo.msgssz) { 965 size_t tlen; 966 967 if (msgsz - len > msginfo.msgssz) 968 tlen = msginfo.msgssz; 969 else 970 tlen = msgsz - len; 971 if (next <= -1) 972 panic("next too low #3"); 973 if (next >= msginfo.msgseg) 974 panic("next out of range #3"); 975 mutex_exit(&msgmutex); 976 error = copyout(&msgpool[next * msginfo.msgssz], 977 user_msgp, tlen); 978 mutex_enter(&msgmutex); 979 if (error != 0) { 980 MSG_PRINTF(("error (%d) copying out message segment\n", 981 error)); 982 msg_freehdr(msghdr); 983 cv_broadcast(&msq->msq_cv); 984 goto unlock; 985 } 986 user_msgp += tlen; 987 next = msgmaps[next].next; 988 } 989 990 /* 991 * Done, return the actual number of bytes copied out. 992 */ 993 994 msg_freehdr(msghdr); 995 cv_broadcast(&msq->msq_cv); 996 *retval = msgsz; 997 998 unlock: 999 mutex_exit(&msgmutex); 1000 return error; 1001 } 1002
Indexes created Wed Oct 01 13:09:50 GMT 2025