sysv_msg.c revision 1.49.10.1
1 /* $NetBSD: sysv_msg.c,v 1.49.10.1 2007/10/26 15:48:43 joerg Exp $ */ 2 3 /*- 4 * Copyright (c) 1999, 2006, 2007 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center, and by Andrew Doran. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by the NetBSD 22 * Foundation, Inc. and its contributors. 23 * 4. Neither the name of The NetBSD Foundation nor the names of its 24 * contributors may be used to endorse or promote products derived 25 * from this software without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 28 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 29 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 30 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 31 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 32 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 33 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 34 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 35 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 36 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 37 * POSSIBILITY OF SUCH DAMAGE. 38 */ 39 40 /* 41 * Implementation of SVID messages 42 * 43 * Author: Daniel Boulet 44 * 45 * Copyright 1993 Daniel Boulet and RTMX Inc. 46 * 47 * This system call was implemented by Daniel Boulet under contract from RTMX. 48 * 49 * Redistribution and use in source forms, with and without modification, 50 * are permitted provided that this entire comment appears intact. 51 * 52 * Redistribution in binary form may occur without any restrictions. 53 * Obviously, it would be nice if you gave credit where credit is due 54 * but requiring it would be too onerous. 55 * 56 * This software is provided ``AS IS'' without any warranties of any kind. 57 */ 58 59 #include <sys/cdefs.h> 60 __KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.49.10.1 2007/10/26 15:48:43 joerg Exp $"); 61 62 #define SYSVMSG 63 64 #include <sys/param.h> 65 #include <sys/kernel.h> 66 #include <sys/msg.h> 67 #include <sys/sysctl.h> 68 #include <sys/mount.h> /* XXX for <sys/syscallargs.h> */ 69 #include <sys/syscallargs.h> 70 #include <sys/kauth.h> 71 72 #define MSG_DEBUG 73 #undef MSG_DEBUG_OK 74 75 #ifdef MSG_DEBUG_OK 76 #define MSG_PRINTF(a) printf a 77 #else 78 #define MSG_PRINTF(a) 79 #endif 80 81 static int nfree_msgmaps; /* # of free map entries */ 82 static short free_msgmaps; /* head of linked list of free map entries */ 83 static struct __msg *free_msghdrs; /* list of free msg headers */ 84 static char *msgpool; /* MSGMAX byte long msg buffer pool */ 85 static struct msgmap *msgmaps; /* MSGSEG msgmap structures */ 86 static struct __msg *msghdrs; /* MSGTQL msg headers */ 87 88 kmsq_t *msqs; /* MSGMNI msqid_ds struct's */ 89 kmutex_t msgmutex; /* subsystem lock */ 90 91 static void msg_freehdr(struct __msg *); 92 93 void 94 msginit(void) 95 { 96 int i, sz; 97 vaddr_t v; 98 99 /* 100 * msginfo.msgssz should be a power of two for efficiency reasons. 101 * It is also pretty silly if msginfo.msgssz is less than 8 102 * or greater than about 256 so ... 103 */ 104 105 i = 8; 106 while (i < 1024 && i != msginfo.msgssz) 107 i <<= 1; 108 if (i != msginfo.msgssz) { 109 panic("msginfo.msgssz = %d, not a small power of 2", 110 msginfo.msgssz); 111 } 112 113 if (msginfo.msgseg > 32767) { 114 panic("msginfo.msgseg = %d > 32767", msginfo.msgseg); 115 } 116 117 /* Allocate pageable memory for our structures */ 118 sz = msginfo.msgmax + 119 msginfo.msgseg * sizeof(struct msgmap) + 120 msginfo.msgtql * sizeof(struct __msg) + 121 msginfo.msgmni * sizeof(kmsq_t); 122 v = uvm_km_alloc(kernel_map, round_page(sz), 0, 123 UVM_KMF_WIRED|UVM_KMF_ZERO); 124 if (v == 0) 125 panic("sysv_msg: cannot allocate memory"); 126 msgpool = (void *)v; 127 msgmaps = (void *)(msgpool + msginfo.msgmax); 128 msghdrs = (void *)(msgmaps + msginfo.msgseg); 129 msqs = (void *)(msghdrs + msginfo.msgtql); 130 131 for (i = 0; i < (msginfo.msgseg - 1); i++) 132 msgmaps[i].next = i + 1; 133 msgmaps[msginfo.msgseg - 1].next = -1; 134 135 free_msgmaps = 0; 136 nfree_msgmaps = msginfo.msgseg; 137 138 for (i = 0; i < (msginfo.msgtql - 1); i++) { 139 msghdrs[i].msg_type = 0; 140 msghdrs[i].msg_next = &msghdrs[i + 1]; 141 } 142 i = msginfo.msgtql - 1; 143 msghdrs[i].msg_type = 0; 144 msghdrs[i].msg_next = NULL; 145 free_msghdrs = &msghdrs[0]; 146 147 for (i = 0; i < msginfo.msgmni; i++) { 148 cv_init(&msqs[i].msq_cv, "msgwait"); 149 /* Implies entry is available */ 150 msqs[i].msq_u.msg_qbytes = 0; 151 /* Reset to a known value */ 152 msqs[i].msq_u.msg_perm._seq = 0; 153 } 154 155 mutex_init(&msgmutex, MUTEX_DEFAULT, IPL_NONE); 156 } 157 158 static void 159 msg_freehdr(struct __msg *msghdr) 160 { 161 162 KASSERT(mutex_owned(&msgmutex)); 163 164 while (msghdr->msg_ts > 0) { 165 short next; 166 KASSERT(msghdr->msg_spot >= 0); 167 KASSERT(msghdr->msg_spot < msginfo.msgseg); 168 169 next = msgmaps[msghdr->msg_spot].next; 170 msgmaps[msghdr->msg_spot].next = free_msgmaps; 171 free_msgmaps = msghdr->msg_spot; 172 nfree_msgmaps++; 173 msghdr->msg_spot = next; 174 if (msghdr->msg_ts >= msginfo.msgssz) 175 msghdr->msg_ts -= msginfo.msgssz; 176 else 177 msghdr->msg_ts = 0; 178 } 179 KASSERT(msghdr->msg_spot == -1); 180 msghdr->msg_next = free_msghdrs; 181 free_msghdrs = msghdr; 182 } 183 184 int 185 sys___msgctl13(struct lwp *l, void *v, register_t *retval) 186 { 187 struct sys___msgctl13_args /* { 188 syscallarg(int) msqid; 189 syscallarg(int) cmd; 190 syscallarg(struct msqid_ds *) buf; 191 } */ *uap = v; 192 struct msqid_ds msqbuf; 193 int cmd, error; 194 195 cmd = SCARG(uap, cmd); 196 197 if (cmd == IPC_SET) { 198 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf)); 199 if (error) 200 return (error); 201 } 202 203 error = msgctl1(l, SCARG(uap, msqid), cmd, 204 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL); 205 206 if (error == 0 && cmd == IPC_STAT) 207 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf)); 208 209 return (error); 210 } 211 212 int 213 msgctl1(struct lwp *l, int msqid, int cmd, struct msqid_ds *msqbuf) 214 { 215 kauth_cred_t cred = l->l_cred; 216 struct msqid_ds *msqptr; 217 kmsq_t *msq; 218 int error = 0, ix; 219 220 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd)); 221 222 ix = IPCID_TO_IX(msqid); 223 224 mutex_enter(&msgmutex); 225 226 if (ix < 0 || ix >= msginfo.msgmni) { 227 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix, 228 msginfo.msgmni)); 229 error = EINVAL; 230 goto unlock; 231 } 232 233 msq = &msqs[ix]; 234 msqptr = &msq->msq_u; 235 236 if (msqptr->msg_qbytes == 0) { 237 MSG_PRINTF(("no such msqid\n")); 238 error = EINVAL; 239 goto unlock; 240 } 241 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) { 242 MSG_PRINTF(("wrong sequence number\n")); 243 error = EINVAL; 244 goto unlock; 245 } 246 247 switch (cmd) { 248 case IPC_RMID: 249 { 250 struct __msg *msghdr; 251 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0) 252 break; 253 /* Free the message headers */ 254 msghdr = msqptr->_msg_first; 255 while (msghdr != NULL) { 256 struct __msg *msghdr_tmp; 257 258 /* Free the segments of each message */ 259 msqptr->_msg_cbytes -= msghdr->msg_ts; 260 msqptr->msg_qnum--; 261 msghdr_tmp = msghdr; 262 msghdr = msghdr->msg_next; 263 msg_freehdr(msghdr_tmp); 264 } 265 KASSERT(msqptr->_msg_cbytes == 0); 266 KASSERT(msqptr->msg_qnum == 0); 267 268 /* Mark it as free */ 269 msqptr->msg_qbytes = 0; 270 cv_broadcast(&msq->msq_cv); 271 } 272 break; 273 274 case IPC_SET: 275 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M))) 276 break; 277 if (msqbuf->msg_qbytes > msqptr->msg_qbytes && 278 kauth_authorize_generic(cred, KAUTH_GENERIC_ISSUSER, 279 NULL) != 0) { 280 error = EPERM; 281 break; 282 } 283 if (msqbuf->msg_qbytes > msginfo.msgmnb) { 284 MSG_PRINTF(("can't increase msg_qbytes beyond %d " 285 "(truncating)\n", msginfo.msgmnb)); 286 /* silently restrict qbytes to system limit */ 287 msqbuf->msg_qbytes = msginfo.msgmnb; 288 } 289 if (msqbuf->msg_qbytes == 0) { 290 MSG_PRINTF(("can't reduce msg_qbytes to 0\n")); 291 error = EINVAL; /* XXX non-standard errno! */ 292 break; 293 } 294 msqptr->msg_perm.uid = msqbuf->msg_perm.uid; 295 msqptr->msg_perm.gid = msqbuf->msg_perm.gid; 296 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) | 297 (msqbuf->msg_perm.mode & 0777); 298 msqptr->msg_qbytes = msqbuf->msg_qbytes; 299 msqptr->msg_ctime = time_second; 300 break; 301 302 case IPC_STAT: 303 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 304 MSG_PRINTF(("requester doesn't have read access\n")); 305 break; 306 } 307 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds)); 308 break; 309 310 default: 311 MSG_PRINTF(("invalid command %d\n", cmd)); 312 error = EINVAL; 313 break; 314 } 315 316 unlock: 317 mutex_exit(&msgmutex); 318 return (error); 319 } 320 321 int 322 sys_msgget(struct lwp *l, void *v, register_t *retval) 323 { 324 struct sys_msgget_args /* { 325 syscallarg(key_t) key; 326 syscallarg(int) msgflg; 327 } */ *uap = v; 328 int msqid, error = 0; 329 int key = SCARG(uap, key); 330 int msgflg = SCARG(uap, msgflg); 331 kauth_cred_t cred = l->l_cred; 332 struct msqid_ds *msqptr = NULL; 333 kmsq_t *msq; 334 335 mutex_enter(&msgmutex); 336 337 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg)); 338 339 if (key != IPC_PRIVATE) { 340 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 341 msq = &msqs[msqid]; 342 msqptr = &msq->msq_u; 343 if (msqptr->msg_qbytes != 0 && 344 msqptr->msg_perm._key == key) 345 break; 346 } 347 if (msqid < msginfo.msgmni) { 348 MSG_PRINTF(("found public key\n")); 349 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) { 350 MSG_PRINTF(("not exclusive\n")); 351 error = EEXIST; 352 goto unlock; 353 } 354 if ((error = ipcperm(cred, &msqptr->msg_perm, 355 msgflg & 0700 ))) { 356 MSG_PRINTF(("requester doesn't have 0%o access\n", 357 msgflg & 0700)); 358 goto unlock; 359 } 360 goto found; 361 } 362 } 363 364 MSG_PRINTF(("need to allocate the msqid_ds\n")); 365 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) { 366 for (msqid = 0; msqid < msginfo.msgmni; msqid++) { 367 /* 368 * Look for an unallocated and unlocked msqid_ds. 369 * msqid_ds's can be locked by msgsnd or msgrcv while 370 * they are copying the message in/out. We can't 371 * re-use the entry until they release it. 372 */ 373 msq = &msqs[msqid]; 374 msqptr = &msq->msq_u; 375 if (msqptr->msg_qbytes == 0 && 376 (msqptr->msg_perm.mode & MSG_LOCKED) == 0) 377 break; 378 } 379 if (msqid == msginfo.msgmni) { 380 MSG_PRINTF(("no more msqid_ds's available\n")); 381 error = ENOSPC; 382 goto unlock; 383 } 384 MSG_PRINTF(("msqid %d is available\n", msqid)); 385 msqptr->msg_perm._key = key; 386 msqptr->msg_perm.cuid = kauth_cred_geteuid(cred); 387 msqptr->msg_perm.uid = kauth_cred_geteuid(cred); 388 msqptr->msg_perm.cgid = kauth_cred_getegid(cred); 389 msqptr->msg_perm.gid = kauth_cred_getegid(cred); 390 msqptr->msg_perm.mode = (msgflg & 0777); 391 /* Make sure that the returned msqid is unique */ 392 msqptr->msg_perm._seq++; 393 msqptr->_msg_first = NULL; 394 msqptr->_msg_last = NULL; 395 msqptr->_msg_cbytes = 0; 396 msqptr->msg_qnum = 0; 397 msqptr->msg_qbytes = msginfo.msgmnb; 398 msqptr->msg_lspid = 0; 399 msqptr->msg_lrpid = 0; 400 msqptr->msg_stime = 0; 401 msqptr->msg_rtime = 0; 402 msqptr->msg_ctime = time_second; 403 } else { 404 MSG_PRINTF(("didn't find it and wasn't asked to create it\n")); 405 error = ENOENT; 406 goto unlock; 407 } 408 409 found: 410 /* Construct the unique msqid */ 411 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm); 412 413 unlock: 414 mutex_exit(&msgmutex); 415 return (error); 416 } 417 418 int 419 sys_msgsnd(struct lwp *l, void *v, register_t *retval) 420 { 421 struct sys_msgsnd_args /* { 422 syscallarg(int) msqid; 423 syscallarg(const void *) msgp; 424 syscallarg(size_t) msgsz; 425 syscallarg(int) msgflg; 426 } */ *uap = v; 427 428 return msgsnd1(l, SCARG(uap, msqid), SCARG(uap, msgp), 429 SCARG(uap, msgsz), SCARG(uap, msgflg), sizeof(long), copyin); 430 } 431 432 int 433 msgsnd1(struct lwp *l, int msqidr, const char *user_msgp, size_t msgsz, 434 int msgflg, size_t typesz, copyin_t fetch_type) 435 { 436 int segs_needed, error = 0, msqid; 437 kauth_cred_t cred = l->l_cred; 438 struct msqid_ds *msqptr; 439 struct __msg *msghdr; 440 kmsq_t *msq; 441 short next; 442 443 MSG_PRINTF(("call to msgsnd(%d, %p, %lld, %d)\n", msqid, user_msgp, 444 (long long)msgsz, msgflg)); 445 446 msqid = IPCID_TO_IX(msqidr); 447 448 mutex_enter(&msgmutex); 449 450 if (msqid < 0 || msqid >= msginfo.msgmni) { 451 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 452 msginfo.msgmni)); 453 error = EINVAL; 454 goto unlock; 455 } 456 457 msq = &msqs[msqid]; 458 msqptr = &msq->msq_u; 459 460 if (msqptr->msg_qbytes == 0) { 461 MSG_PRINTF(("no such message queue id\n")); 462 error = EINVAL; 463 goto unlock; 464 } 465 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 466 MSG_PRINTF(("wrong sequence number\n")); 467 error = EINVAL; 468 goto unlock; 469 } 470 471 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) { 472 MSG_PRINTF(("requester doesn't have write access\n")); 473 goto unlock; 474 } 475 476 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz; 477 MSG_PRINTF(("msgsz=%lld, msgssz=%d, segs_needed=%d\n", 478 (long long)msgsz, msginfo.msgssz, segs_needed)); 479 for (;;) { 480 int need_more_resources = 0; 481 482 /* 483 * check msgsz [cannot be negative since it is unsigned] 484 * (inside this loop in case msg_qbytes changes while we sleep) 485 */ 486 487 if (msgsz > msqptr->msg_qbytes) { 488 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n")); 489 error = EINVAL; 490 goto unlock; 491 } 492 493 if (msqptr->msg_perm.mode & MSG_LOCKED) { 494 MSG_PRINTF(("msqid is locked\n")); 495 need_more_resources = 1; 496 } 497 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) { 498 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n")); 499 need_more_resources = 1; 500 } 501 if (segs_needed > nfree_msgmaps) { 502 MSG_PRINTF(("segs_needed > nfree_msgmaps\n")); 503 need_more_resources = 1; 504 } 505 if (free_msghdrs == NULL) { 506 MSG_PRINTF(("no more msghdrs\n")); 507 need_more_resources = 1; 508 } 509 510 if (need_more_resources) { 511 int we_own_it; 512 513 if ((msgflg & IPC_NOWAIT) != 0) { 514 MSG_PRINTF(("need more resources but caller " 515 "doesn't want to wait\n")); 516 error = EAGAIN; 517 goto unlock; 518 } 519 520 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) { 521 MSG_PRINTF(("we don't own the msqid_ds\n")); 522 we_own_it = 0; 523 } else { 524 /* Force later arrivals to wait for our 525 request */ 526 MSG_PRINTF(("we own the msqid_ds\n")); 527 msqptr->msg_perm.mode |= MSG_LOCKED; 528 we_own_it = 1; 529 } 530 MSG_PRINTF(("goodnight\n")); 531 error = cv_wait_sig(&msq->msq_cv, &msgmutex); 532 MSG_PRINTF(("good morning, error=%d\n", error)); 533 if (we_own_it) 534 msqptr->msg_perm.mode &= ~MSG_LOCKED; 535 if (error != 0) { 536 MSG_PRINTF(("msgsnd: interrupted system " 537 "call\n")); 538 error = EINTR; 539 goto unlock; 540 } 541 542 /* 543 * Make sure that the msq queue still exists 544 */ 545 546 if (msqptr->msg_qbytes == 0) { 547 MSG_PRINTF(("msqid deleted\n")); 548 error = EIDRM; 549 goto unlock; 550 } 551 } else { 552 MSG_PRINTF(("got all the resources that we need\n")); 553 break; 554 } 555 } 556 557 /* 558 * We have the resources that we need. 559 * Make sure! 560 */ 561 562 KASSERT((msqptr->msg_perm.mode & MSG_LOCKED) == 0); 563 KASSERT(segs_needed <= nfree_msgmaps); 564 KASSERT(msgsz + msqptr->_msg_cbytes <= msqptr->msg_qbytes); 565 KASSERT(free_msghdrs != NULL); 566 567 /* 568 * Re-lock the msqid_ds in case we page-fault when copying in the 569 * message 570 */ 571 572 KASSERT((msqptr->msg_perm.mode & MSG_LOCKED) == 0); 573 msqptr->msg_perm.mode |= MSG_LOCKED; 574 575 /* 576 * Allocate a message header 577 */ 578 579 msghdr = free_msghdrs; 580 free_msghdrs = msghdr->msg_next; 581 msghdr->msg_spot = -1; 582 msghdr->msg_ts = msgsz; 583 584 /* 585 * Allocate space for the message 586 */ 587 588 while (segs_needed > 0) { 589 KASSERT(nfree_msgmaps > 0); 590 KASSERT(free_msgmaps != -1); 591 KASSERT(free_msgmaps < msginfo.msgseg); 592 593 next = free_msgmaps; 594 MSG_PRINTF(("allocating segment %d to message\n", next)); 595 free_msgmaps = msgmaps[next].next; 596 nfree_msgmaps--; 597 msgmaps[next].next = msghdr->msg_spot; 598 msghdr->msg_spot = next; 599 segs_needed--; 600 } 601 602 /* 603 * Copy in the message type 604 */ 605 mutex_exit(&msgmutex); 606 error = (*fetch_type)(user_msgp, &msghdr->msg_type, typesz); 607 mutex_enter(&msgmutex); 608 if (error != 0) { 609 MSG_PRINTF(("error %d copying the message type\n", error)); 610 msg_freehdr(msghdr); 611 msqptr->msg_perm.mode &= ~MSG_LOCKED; 612 cv_broadcast(&msq->msq_cv); 613 goto unlock; 614 } 615 user_msgp += typesz; 616 617 /* 618 * Validate the message type 619 */ 620 621 if (msghdr->msg_type < 1) { 622 msg_freehdr(msghdr); 623 msqptr->msg_perm.mode &= ~MSG_LOCKED; 624 cv_broadcast(&msq->msq_cv); 625 MSG_PRINTF(("mtype (%ld) < 1\n", msghdr->msg_type)); 626 goto unlock; 627 } 628 629 /* 630 * Copy in the message body 631 */ 632 633 next = msghdr->msg_spot; 634 while (msgsz > 0) { 635 size_t tlen; 636 KASSERT(next > -1); 637 KASSERT(next < msginfo.msgseg); 638 639 if (msgsz > msginfo.msgssz) 640 tlen = msginfo.msgssz; 641 else 642 tlen = msgsz; 643 mutex_exit(&msgmutex); 644 error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], tlen); 645 mutex_enter(&msgmutex); 646 if (error != 0) { 647 MSG_PRINTF(("error %d copying in message segment\n", 648 error)); 649 msg_freehdr(msghdr); 650 msqptr->msg_perm.mode &= ~MSG_LOCKED; 651 cv_broadcast(&msq->msq_cv); 652 goto unlock; 653 } 654 msgsz -= tlen; 655 user_msgp += tlen; 656 next = msgmaps[next].next; 657 } 658 KASSERT(next == -1); 659 660 /* 661 * We've got the message. Unlock the msqid_ds. 662 */ 663 664 msqptr->msg_perm.mode &= ~MSG_LOCKED; 665 666 /* 667 * Make sure that the msqid_ds is still allocated. 668 */ 669 670 if (msqptr->msg_qbytes == 0) { 671 msg_freehdr(msghdr); 672 cv_broadcast(&msq->msq_cv); 673 error = EIDRM; 674 goto unlock; 675 } 676 677 /* 678 * Put the message into the queue 679 */ 680 681 if (msqptr->_msg_first == NULL) { 682 msqptr->_msg_first = msghdr; 683 msqptr->_msg_last = msghdr; 684 } else { 685 msqptr->_msg_last->msg_next = msghdr; 686 msqptr->_msg_last = msghdr; 687 } 688 msqptr->_msg_last->msg_next = NULL; 689 690 msqptr->_msg_cbytes += msghdr->msg_ts; 691 msqptr->msg_qnum++; 692 msqptr->msg_lspid = l->l_proc->p_pid; 693 msqptr->msg_stime = time_second; 694 695 cv_broadcast(&msq->msq_cv); 696 697 unlock: 698 mutex_exit(&msgmutex); 699 return error; 700 } 701 702 int 703 sys_msgrcv(struct lwp *l, void *v, register_t *retval) 704 { 705 struct sys_msgrcv_args /* { 706 syscallarg(int) msqid; 707 syscallarg(void *) msgp; 708 syscallarg(size_t) msgsz; 709 syscallarg(long) msgtyp; 710 syscallarg(int) msgflg; 711 } */ *uap = v; 712 713 return msgrcv1(l, SCARG(uap, msqid), SCARG(uap, msgp), 714 SCARG(uap, msgsz), SCARG(uap, msgtyp), SCARG(uap, msgflg), 715 sizeof(long), copyout, retval); 716 } 717 718 int 719 msgrcv1(struct lwp *l, int msqidr, char *user_msgp, size_t msgsz, long msgtyp, 720 int msgflg, size_t typesz, copyout_t put_type, register_t *retval) 721 { 722 size_t len; 723 kauth_cred_t cred = l->l_cred; 724 struct msqid_ds *msqptr; 725 struct __msg *msghdr; 726 int error = 0, msqid; 727 kmsq_t *msq; 728 short next; 729 730 MSG_PRINTF(("call to msgrcv(%d, %p, %lld, %ld, %d)\n", msqid, 731 user_msgp, (long long)msgsz, msgtyp, msgflg)); 732 733 msqid = IPCID_TO_IX(msqidr); 734 735 mutex_enter(&msgmutex); 736 737 if (msqid < 0 || msqid >= msginfo.msgmni) { 738 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid, 739 msginfo.msgmni)); 740 error = EINVAL; 741 goto unlock; 742 } 743 744 msq = &msqs[msqid]; 745 msqptr = &msq->msq_u; 746 747 if (msqptr->msg_qbytes == 0) { 748 MSG_PRINTF(("no such message queue id\n")); 749 error = EINVAL; 750 goto unlock; 751 } 752 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 753 MSG_PRINTF(("wrong sequence number\n")); 754 error = EINVAL; 755 goto unlock; 756 } 757 758 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) { 759 MSG_PRINTF(("requester doesn't have read access\n")); 760 goto unlock; 761 } 762 763 msghdr = NULL; 764 while (msghdr == NULL) { 765 if (msgtyp == 0) { 766 msghdr = msqptr->_msg_first; 767 if (msghdr != NULL) { 768 if (msgsz < msghdr->msg_ts && 769 (msgflg & MSG_NOERROR) == 0) { 770 MSG_PRINTF(("first msg on the queue " 771 "is too big (want %lld, got %d)\n", 772 (long long)msgsz, msghdr->msg_ts)); 773 error = E2BIG; 774 goto unlock; 775 } 776 if (msqptr->_msg_first == msqptr->_msg_last) { 777 msqptr->_msg_first = NULL; 778 msqptr->_msg_last = NULL; 779 } else { 780 msqptr->_msg_first = msghdr->msg_next; 781 KASSERT(msqptr->_msg_first != NULL); 782 } 783 } 784 } else { 785 struct __msg *previous; 786 struct __msg **prev; 787 788 for (previous = NULL, prev = &msqptr->_msg_first; 789 (msghdr = *prev) != NULL; 790 previous = msghdr, prev = &msghdr->msg_next) { 791 /* 792 * Is this message's type an exact match or is 793 * this message's type less than or equal to 794 * the absolute value of a negative msgtyp? 795 * Note that the second half of this test can 796 * NEVER be true if msgtyp is positive since 797 * msg_type is always positive! 798 */ 799 800 if (msgtyp != msghdr->msg_type && 801 msghdr->msg_type > -msgtyp) 802 continue; 803 804 MSG_PRINTF(("found message type %ld, requested %ld\n", 805 msghdr->msg_type, msgtyp)); 806 if (msgsz < msghdr->msg_ts && 807 (msgflg & MSG_NOERROR) == 0) { 808 MSG_PRINTF(("requested message on the queue " 809 "is too big (want %lld, got %d)\n", 810 (long long)msgsz, msghdr->msg_ts)); 811 error = E2BIG; 812 goto unlock; 813 } 814 *prev = msghdr->msg_next; 815 if (msghdr != msqptr->_msg_last) 816 break; 817 if (previous == NULL) { 818 KASSERT(prev == &msqptr->_msg_first); 819 msqptr->_msg_first = NULL; 820 msqptr->_msg_last = NULL; 821 } else { 822 KASSERT(prev != &msqptr->_msg_first); 823 msqptr->_msg_last = previous; 824 } 825 break; 826 } 827 } 828 829 /* 830 * We've either extracted the msghdr for the appropriate 831 * message or there isn't one. 832 * If there is one then bail out of this loop. 833 */ 834 if (msghdr != NULL) 835 break; 836 837 /* 838 * Hmph! No message found. Does the user want to wait? 839 */ 840 841 if ((msgflg & IPC_NOWAIT) != 0) { 842 MSG_PRINTF(("no appropriate message found (msgtyp=%ld)\n", 843 msgtyp)); 844 error = ENOMSG; 845 goto unlock; 846 } 847 848 /* 849 * Wait for something to happen 850 */ 851 852 MSG_PRINTF(("msgrcv: goodnight\n")); 853 error = cv_wait_sig(&msq->msq_cv, &msgmutex); 854 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error)); 855 856 if (error != 0) { 857 MSG_PRINTF(("msgsnd: interrupted system call\n")); 858 error = EINTR; 859 goto unlock; 860 } 861 862 /* 863 * Make sure that the msq queue still exists 864 */ 865 866 if (msqptr->msg_qbytes == 0 || 867 msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) { 868 MSG_PRINTF(("msqid deleted\n")); 869 error = EIDRM; 870 goto unlock; 871 } 872 } 873 874 /* 875 * Return the message to the user. 876 * 877 * First, do the bookkeeping (before we risk being interrupted). 878 */ 879 880 msqptr->_msg_cbytes -= msghdr->msg_ts; 881 msqptr->msg_qnum--; 882 msqptr->msg_lrpid = l->l_proc->p_pid; 883 msqptr->msg_rtime = time_second; 884 885 /* 886 * Make msgsz the actual amount that we'll be returning. 887 * Note that this effectively truncates the message if it is too long 888 * (since msgsz is never increased). 889 */ 890 891 MSG_PRINTF(("found a message, msgsz=%lld, msg_ts=%d\n", 892 (long long)msgsz, msghdr->msg_ts)); 893 if (msgsz > msghdr->msg_ts) 894 msgsz = msghdr->msg_ts; 895 896 /* 897 * Return the type to the user. 898 */ 899 mutex_exit(&msgmutex); 900 error = (*put_type)(&msghdr->msg_type, user_msgp, typesz); 901 mutex_enter(&msgmutex); 902 if (error != 0) { 903 MSG_PRINTF(("error (%d) copying out message type\n", error)); 904 msg_freehdr(msghdr); 905 cv_broadcast(&msq->msq_cv); 906 goto unlock; 907 } 908 user_msgp += typesz; 909 910 /* 911 * Return the segments to the user 912 */ 913 914 next = msghdr->msg_spot; 915 for (len = 0; len < msgsz; len += msginfo.msgssz) { 916 size_t tlen; 917 KASSERT(next > -1); 918 KASSERT(next < msginfo.msgseg); 919 920 if (msgsz - len > msginfo.msgssz) 921 tlen = msginfo.msgssz; 922 else 923 tlen = msgsz - len; 924 mutex_exit(&msgmutex); 925 error = copyout(&msgpool[next * msginfo.msgssz], 926 user_msgp, tlen); 927 mutex_enter(&msgmutex); 928 if (error != 0) { 929 MSG_PRINTF(("error (%d) copying out message segment\n", 930 error)); 931 msg_freehdr(msghdr); 932 cv_broadcast(&msq->msq_cv); 933 goto unlock; 934 } 935 user_msgp += tlen; 936 next = msgmaps[next].next; 937 } 938 939 /* 940 * Done, return the actual number of bytes copied out. 941 */ 942 943 msg_freehdr(msghdr); 944 cv_broadcast(&msq->msq_cv); 945 *retval = msgsz; 946 947 unlock: 948 mutex_exit(&msgmutex); 949 return error; 950 } 951
Indexes created Wed Oct 01 13:09:50 GMT 2025