1/* $NetBSD: sysv_msg.c,v 1.71 2016/09/05 14:13:50 christos Exp $ */
2
3/*-
4 * Copyright (c) 1999, 2006, 2007 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
9 * NASA Ames Research Center, and by Andrew Doran.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33/*
34 * Implementation of SVID messages
35 *
36 * Author: Daniel Boulet
37 *
38 * Copyright 1993 Daniel Boulet and RTMX Inc.
39 *
40 * This system call was implemented by Daniel Boulet under contract from RTMX.
41 *
42 * Redistribution and use in source forms, with and without modification,
43 * are permitted provided that this entire comment appears intact.
44 *
45 * Redistribution in binary form may occur without any restrictions.
46 * Obviously, it would be nice if you gave credit where credit is due
47 * but requiring it would be too onerous.
48 *
49 * This software is provided ``AS IS'' without any warranties of any kind.
50 */
51
52#include <sys/cdefs.h>
53__KERNEL_RCSID(0, "$NetBSD: sysv_msg.c,v 1.71 2016/09/05 14:13:50 christos Exp $");
54
55#ifdef _KERNEL_OPT
56#include "opt_sysv.h"
57#endif
58
59#include <sys/param.h>
60#include <sys/kernel.h>
61#include <sys/msg.h>
62#include <sys/sysctl.h>
63#include <sys/mount.h> /* XXX for <sys/syscallargs.h> */
64#include <sys/syscallargs.h>
65#include <sys/kauth.h>
66
67#define MSG_DEBUG
68#undef MSG_DEBUG_OK
69
70#ifdef MSG_DEBUG_OK
71#define MSG_PRINTF(a) printf a
72#else
73#define MSG_PRINTF(a)
74#endif
75
76static int nfree_msgmaps; /* # of free map entries */
77static short free_msgmaps; /* head of linked list of free map entries */
78static struct __msg *free_msghdrs; /* list of free msg headers */
79static char *msgpool; /* MSGMAX byte long msg buffer pool */
80static struct msgmap *msgmaps; /* MSGSEG msgmap structures */
81static struct __msg *msghdrs; /* MSGTQL msg headers */
82
83kmsq_t *msqs; /* MSGMNI msqid_ds struct's */
84kmutex_t msgmutex; /* subsystem lock */
85
86static u_int msg_waiters = 0; /* total number of msgrcv waiters */
87static bool msg_realloc_state;
88static kcondvar_t msg_realloc_cv;
89
90static void msg_freehdr(struct __msg *);
91
92extern int kern_has_sysvmsg;
93
94SYSCTL_SETUP_PROTO(sysctl_ipc_msg_setup);
95
96void
97msginit(struct sysctllog **clog)
98{
99 int i, sz;
100 vaddr_t v;
101
102 /*
103 * msginfo.msgssz should be a power of two for efficiency reasons.
104 * It is also pretty silly if msginfo.msgssz is less than 8
105 * or greater than about 256 so ...
106 */
107
108 i = 8;
109 while (i < 1024 && i != msginfo.msgssz)
110 i <<= 1;
111 if (i != msginfo.msgssz) {
112 panic("msginfo.msgssz = %d, not a small power of 2",
113 msginfo.msgssz);
114 }
115
116 if (msginfo.msgseg > 32767) {
117 panic("msginfo.msgseg = %d > 32767", msginfo.msgseg);
118 }
119
120 /* Allocate the wired memory for our structures */
121 sz = ALIGN(msginfo.msgmax) +
122 ALIGN(msginfo.msgseg * sizeof(struct msgmap)) +
123 ALIGN(msginfo.msgtql * sizeof(struct __msg)) +
124 ALIGN(msginfo.msgmni * sizeof(kmsq_t));
125 sz = round_page(sz);
126 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
127 if (v == 0)
128 panic("sysv_msg: cannot allocate memory");
129 msgpool = (void *)v;
130 msgmaps = (void *)((uintptr_t)msgpool + ALIGN(msginfo.msgmax));
131 msghdrs = (void *)((uintptr_t)msgmaps +
132 ALIGN(msginfo.msgseg * sizeof(struct msgmap)));
133 msqs = (void *)((uintptr_t)msghdrs +
134 ALIGN(msginfo.msgtql * sizeof(struct __msg)));
135
136 for (i = 0; i < (msginfo.msgseg - 1); i++)
137 msgmaps[i].next = i + 1;
138 msgmaps[msginfo.msgseg - 1].next = -1;
139
140 free_msgmaps = 0;
141 nfree_msgmaps = msginfo.msgseg;
142
143 for (i = 0; i < (msginfo.msgtql - 1); i++) {
144 msghdrs[i].msg_type = 0;
145 msghdrs[i].msg_next = &msghdrs[i + 1];
146 }
147 i = msginfo.msgtql - 1;
148 msghdrs[i].msg_type = 0;
149 msghdrs[i].msg_next = NULL;
150 free_msghdrs = &msghdrs[0];
151
152 for (i = 0; i < msginfo.msgmni; i++) {
153 cv_init(&msqs[i].msq_cv, "msgwait");
154 /* Implies entry is available */
155 msqs[i].msq_u.msg_qbytes = 0;
156 /* Reset to a known value */
157 msqs[i].msq_u.msg_perm._seq = 0;
158 }
159
160 mutex_init(&msgmutex, MUTEX_DEFAULT, IPL_NONE);
161 cv_init(&msg_realloc_cv, "msgrealc");
162 msg_realloc_state = false;
163
164 kern_has_sysvmsg = 1;
165
166#ifdef _MODULE
167 if (clog)
168 sysctl_ipc_msg_setup(clog);
169#endif
170}
171
172int
173msgfini(void)
174{
175 int i, sz;
176 vaddr_t v = (vaddr_t)msgpool;
177
178 mutex_enter(&msgmutex);
179 for (i = 0; i < msginfo.msgmni; i++) {
180 if (msqs[i].msq_u.msg_qbytes != 0) {
181 mutex_exit(&msgmutex);
182 return 1; /* queue not available, prevent unload! */
183 }
184 }
185/*
186 * Destroy all condvars and free the memory we're using
187 */
188 for (i = 0; i < msginfo.msgmni; i++) {
189 cv_destroy(&msqs[i].msq_cv);
190 }
191 sz = ALIGN(msginfo.msgmax) +
192 ALIGN(msginfo.msgseg * sizeof(struct msgmap)) +
193 ALIGN(msginfo.msgtql * sizeof(struct __msg)) +
194 ALIGN(msginfo.msgmni * sizeof(kmsq_t));
195 sz = round_page(sz);
196 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
197
198 cv_destroy(&msg_realloc_cv);
199 mutex_exit(&msgmutex);
200 mutex_destroy(&msgmutex);
201
202 kern_has_sysvmsg = 0;
203
204 return 0;
205}
206
207static int
208msgrealloc(int newmsgmni, int newmsgseg)
209{
210 struct msgmap *new_msgmaps;
211 struct __msg *new_msghdrs, *new_free_msghdrs;
212 char *old_msgpool, *new_msgpool;
213 kmsq_t *new_msqs;
214 vaddr_t v;
215 int i, sz, msqid, newmsgmax, new_nfree_msgmaps;
216 short new_free_msgmaps;
217
218 if (newmsgmni < 1 || newmsgseg < 1)
219 return EINVAL;
220
221 /* Allocate the wired memory for our structures */
222 newmsgmax = msginfo.msgssz * newmsgseg;
223 sz = ALIGN(newmsgmax) +
224 ALIGN(newmsgseg * sizeof(struct msgmap)) +
225 ALIGN(msginfo.msgtql * sizeof(struct __msg)) +
226 ALIGN(newmsgmni * sizeof(kmsq_t));
227 sz = round_page(sz);
228 v = uvm_km_alloc(kernel_map, sz, 0, UVM_KMF_WIRED|UVM_KMF_ZERO);
229 if (v == 0)
230 return ENOMEM;
231
232 mutex_enter(&msgmutex);
233 if (msg_realloc_state) {
234 mutex_exit(&msgmutex);
235 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
236 return EBUSY;
237 }
238 msg_realloc_state = true;
239 if (msg_waiters) {
240 /*
241 * Mark reallocation state, wake-up all waiters,
242 * and wait while they will all exit.
243 */
244 for (i = 0; i < msginfo.msgmni; i++)
245 cv_broadcast(&msqs[i].msq_cv);
246 while (msg_waiters)
247 cv_wait(&msg_realloc_cv, &msgmutex);
248 }
249 old_msgpool = msgpool;
250
251 /* We cannot reallocate less memory than we use */
252 i = 0;
253 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
254 struct msqid_ds *mptr;
255 kmsq_t *msq;
256
257 msq = &msqs[msqid];
258 mptr = &msq->msq_u;
259 if (mptr->msg_qbytes || (mptr->msg_perm.mode & MSG_LOCKED))
260 i = msqid;
261 }
262 if (i >= newmsgmni || (msginfo.msgseg - nfree_msgmaps) > newmsgseg) {
263 mutex_exit(&msgmutex);
264 uvm_km_free(kernel_map, v, sz, UVM_KMF_WIRED);
265 return EBUSY;
266 }
267
268 new_msgpool = (void *)v;
269 new_msgmaps = (void *)((uintptr_t)new_msgpool + ALIGN(newmsgmax));
270 new_msghdrs = (void *)((uintptr_t)new_msgmaps +
271 ALIGN(newmsgseg * sizeof(struct msgmap)));
272 new_msqs = (void *)((uintptr_t)new_msghdrs +
273 ALIGN(msginfo.msgtql * sizeof(struct __msg)));
274
275 /* Initialize the structures */
276 for (i = 0; i < (newmsgseg - 1); i++)
277 new_msgmaps[i].next = i + 1;
278 new_msgmaps[newmsgseg - 1].next = -1;
279 new_free_msgmaps = 0;
280 new_nfree_msgmaps = newmsgseg;
281
282 for (i = 0; i < (msginfo.msgtql - 1); i++) {
283 new_msghdrs[i].msg_type = 0;
284 new_msghdrs[i].msg_next = &new_msghdrs[i + 1];
285 }
286 i = msginfo.msgtql - 1;
287 new_msghdrs[i].msg_type = 0;
288 new_msghdrs[i].msg_next = NULL;
289 new_free_msghdrs = &new_msghdrs[0];
290
291 for (i = 0; i < newmsgmni; i++) {
292 new_msqs[i].msq_u.msg_qbytes = 0;
293 new_msqs[i].msq_u.msg_perm._seq = 0;
294 cv_init(&new_msqs[i].msq_cv, "msgwait");
295 }
296
297 /*
298 * Copy all message queue identifiers, message headers and buffer
299 * pools to the new memory location.
300 */
301 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
302 struct __msg *nmsghdr, *msghdr, *pmsghdr;
303 struct msqid_ds *nmptr, *mptr;
304 kmsq_t *nmsq, *msq;
305
306 msq = &msqs[msqid];
307 mptr = &msq->msq_u;
308
309 if (mptr->msg_qbytes == 0 &&
310 (mptr->msg_perm.mode & MSG_LOCKED) == 0)
311 continue;
312
313 nmsq = &new_msqs[msqid];
314 nmptr = &nmsq->msq_u;
315 memcpy(nmptr, mptr, sizeof(struct msqid_ds));
316
317 /*
318 * Go through the message headers, and and copy each
319 * one by taking the new ones, and thus defragmenting.
320 */
321 nmsghdr = pmsghdr = NULL;
322 msghdr = mptr->_msg_first;
323 while (msghdr) {
324 short nnext = 0, next;
325 u_short msgsz, segcnt;
326
327 /* Take an entry from the new list of free msghdrs */
328 nmsghdr = new_free_msghdrs;
329 KASSERT(nmsghdr != NULL);
330 new_free_msghdrs = nmsghdr->msg_next;
331
332 nmsghdr->msg_next = NULL;
333 if (pmsghdr) {
334 pmsghdr->msg_next = nmsghdr;
335 } else {
336 nmptr->_msg_first = nmsghdr;
337 pmsghdr = nmsghdr;
338 }
339 nmsghdr->msg_ts = msghdr->msg_ts;
340 nmsghdr->msg_spot = -1;
341
342 /* Compute the amount of segments and reserve them */
343 msgsz = msghdr->msg_ts;
344 segcnt = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
345 if (segcnt == 0)
346 continue;
347 while (segcnt--) {
348 nnext = new_free_msgmaps;
349 new_free_msgmaps = new_msgmaps[nnext].next;
350 new_nfree_msgmaps--;
351 new_msgmaps[nnext].next = nmsghdr->msg_spot;
352 nmsghdr->msg_spot = nnext;
353 }
354
355 /* Copy all segments */
356 KASSERT(nnext == nmsghdr->msg_spot);
357 next = msghdr->msg_spot;
358 while (msgsz > 0) {
359 size_t tlen;
360
361 if (msgsz >= msginfo.msgssz) {
362 tlen = msginfo.msgssz;
363 msgsz -= msginfo.msgssz;
364 } else {
365 tlen = msgsz;
366 msgsz = 0;
367 }
368
369 /* Copy the message buffer */
370 memcpy(&new_msgpool[nnext * msginfo.msgssz],
371 &msgpool[next * msginfo.msgssz], tlen);
372
373 /* Next entry of the map */
374 nnext = msgmaps[nnext].next;
375 next = msgmaps[next].next;
376 }
377
378 /* Next message header */
379 msghdr = msghdr->msg_next;
380 }
381 nmptr->_msg_last = nmsghdr;
382 }
383 KASSERT((msginfo.msgseg - nfree_msgmaps) ==
384 (newmsgseg - new_nfree_msgmaps));
385
386 sz = ALIGN(msginfo.msgmax) +
387 ALIGN(msginfo.msgseg * sizeof(struct msgmap)) +
388 ALIGN(msginfo.msgtql * sizeof(struct __msg)) +
389 ALIGN(msginfo.msgmni * sizeof(kmsq_t));
390 sz = round_page(sz);
391
392 for (i = 0; i < msginfo.msgmni; i++)
393 cv_destroy(&msqs[i].msq_cv);
394
395 /* Set the pointers and update the new values */
396 msgpool = new_msgpool;
397 msgmaps = new_msgmaps;
398 msghdrs = new_msghdrs;
399 msqs = new_msqs;
400
401 free_msghdrs = new_free_msghdrs;
402 free_msgmaps = new_free_msgmaps;
403 nfree_msgmaps = new_nfree_msgmaps;
404 msginfo.msgmni = newmsgmni;
405 msginfo.msgseg = newmsgseg;
406 msginfo.msgmax = newmsgmax;
407
408 /* Reallocation completed - notify all waiters, if any */
409 msg_realloc_state = false;
410 cv_broadcast(&msg_realloc_cv);
411 mutex_exit(&msgmutex);
412
413 uvm_km_free(kernel_map, (vaddr_t)old_msgpool, sz, UVM_KMF_WIRED);
414 return 0;
415}
416
417static void
418msg_freehdr(struct __msg *msghdr)
419{
420
421 KASSERT(mutex_owned(&msgmutex));
422
423 while (msghdr->msg_ts > 0) {
424 short next;
425 KASSERT(msghdr->msg_spot >= 0);
426 KASSERT(msghdr->msg_spot < msginfo.msgseg);
427
428 next = msgmaps[msghdr->msg_spot].next;
429 msgmaps[msghdr->msg_spot].next = free_msgmaps;
430 free_msgmaps = msghdr->msg_spot;
431 nfree_msgmaps++;
432 msghdr->msg_spot = next;
433 if (msghdr->msg_ts >= msginfo.msgssz)
434 msghdr->msg_ts -= msginfo.msgssz;
435 else
436 msghdr->msg_ts = 0;
437 }
438 KASSERT(msghdr->msg_spot == -1);
439 msghdr->msg_next = free_msghdrs;
440 free_msghdrs = msghdr;
441}
442
443int
444sys___msgctl50(struct lwp *l, const struct sys___msgctl50_args *uap,
445 register_t *retval)
446{
447 /* {
448 syscallarg(int) msqid;
449 syscallarg(int) cmd;
450 syscallarg(struct msqid_ds *) buf;
451 } */
452 struct msqid_ds msqbuf;
453 int cmd, error;
454
455 cmd = SCARG(uap, cmd);
456
457 if (cmd == IPC_SET) {
458 error = copyin(SCARG(uap, buf), &msqbuf, sizeof(msqbuf));
459 if (error)
460 return (error);
461 }
462
463 error = msgctl1(l, SCARG(uap, msqid), cmd,
464 (cmd == IPC_SET || cmd == IPC_STAT) ? &msqbuf : NULL);
465
466 if (error == 0 && cmd == IPC_STAT)
467 error = copyout(&msqbuf, SCARG(uap, buf), sizeof(msqbuf));
468
469 return (error);
470}
471
472int
473msgctl1(struct lwp *l, int msqid, int cmd, struct msqid_ds *msqbuf)
474{
475 kauth_cred_t cred = l->l_cred;
476 struct msqid_ds *msqptr;
477 kmsq_t *msq;
478 int error = 0, ix;
479
480 MSG_PRINTF(("call to msgctl1(%d, %d)\n", msqid, cmd));
481
482 ix = IPCID_TO_IX(msqid);
483
484 mutex_enter(&msgmutex);
485
486 if (ix < 0 || ix >= msginfo.msgmni) {
487 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", ix,
488 msginfo.msgmni));
489 error = EINVAL;
490 goto unlock;
491 }
492
493 msq = &msqs[ix];
494 msqptr = &msq->msq_u;
495
496 if (msqptr->msg_qbytes == 0) {
497 MSG_PRINTF(("no such msqid\n"));
498 error = EINVAL;
499 goto unlock;
500 }
501 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqid)) {
502 MSG_PRINTF(("wrong sequence number\n"));
503 error = EINVAL;
504 goto unlock;
505 }
506
507 switch (cmd) {
508 case IPC_RMID:
509 {
510 struct __msg *msghdr;
511 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)) != 0)
512 break;
513 /* Free the message headers */
514 msghdr = msqptr->_msg_first;
515 while (msghdr != NULL) {
516 struct __msg *msghdr_tmp;
517
518 /* Free the segments of each message */
519 msqptr->_msg_cbytes -= msghdr->msg_ts;
520 msqptr->msg_qnum--;
521 msghdr_tmp = msghdr;
522 msghdr = msghdr->msg_next;
523 msg_freehdr(msghdr_tmp);
524 }
525 KASSERT(msqptr->_msg_cbytes == 0);
526 KASSERT(msqptr->msg_qnum == 0);
527
528 /* Mark it as free */
529 msqptr->msg_qbytes = 0;
530 cv_broadcast(&msq->msq_cv);
531 }
532 break;
533
534 case IPC_SET:
535 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_M)))
536 break;
537 if (msqbuf->msg_qbytes > msqptr->msg_qbytes &&
538 kauth_authorize_system(cred, KAUTH_SYSTEM_SYSVIPC,
539 KAUTH_REQ_SYSTEM_SYSVIPC_MSGQ_OVERSIZE,
540 KAUTH_ARG(msqbuf->msg_qbytes),
541 KAUTH_ARG(msqptr->msg_qbytes), NULL) != 0) {
542 error = EPERM;
543 break;
544 }
545 if (msqbuf->msg_qbytes > msginfo.msgmnb) {
546 MSG_PRINTF(("can't increase msg_qbytes beyond %d "
547 "(truncating)\n", msginfo.msgmnb));
548 /* silently restrict qbytes to system limit */
549 msqbuf->msg_qbytes = msginfo.msgmnb;
550 }
551 if (msqbuf->msg_qbytes == 0) {
552 MSG_PRINTF(("can't reduce msg_qbytes to 0\n"));
553 error = EINVAL; /* XXX non-standard errno! */
554 break;
555 }
556 msqptr->msg_perm.uid = msqbuf->msg_perm.uid;
557 msqptr->msg_perm.gid = msqbuf->msg_perm.gid;
558 msqptr->msg_perm.mode = (msqptr->msg_perm.mode & ~0777) |
559 (msqbuf->msg_perm.mode & 0777);
560 msqptr->msg_qbytes = msqbuf->msg_qbytes;
561 msqptr->msg_ctime = time_second;
562 break;
563
564 case IPC_STAT:
565 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) {
566 MSG_PRINTF(("requester doesn't have read access\n"));
567 break;
568 }
569 memcpy(msqbuf, msqptr, sizeof(struct msqid_ds));
570 break;
571
572 default:
573 MSG_PRINTF(("invalid command %d\n", cmd));
574 error = EINVAL;
575 break;
576 }
577
578unlock:
579 mutex_exit(&msgmutex);
580 return (error);
581}
582
583int
584sys_msgget(struct lwp *l, const struct sys_msgget_args *uap, register_t *retval)
585{
586 /* {
587 syscallarg(key_t) key;
588 syscallarg(int) msgflg;
589 } */
590 int msqid, error = 0;
591 int key = SCARG(uap, key);
592 int msgflg = SCARG(uap, msgflg);
593 kauth_cred_t cred = l->l_cred;
594 struct msqid_ds *msqptr = NULL;
595 kmsq_t *msq;
596
597 mutex_enter(&msgmutex);
598
599 MSG_PRINTF(("msgget(0x%x, 0%o)\n", key, msgflg));
600
601 if (key != IPC_PRIVATE) {
602 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
603 msq = &msqs[msqid];
604 msqptr = &msq->msq_u;
605 if (msqptr->msg_qbytes != 0 &&
606 msqptr->msg_perm._key == key)
607 break;
608 }
609 if (msqid < msginfo.msgmni) {
610 MSG_PRINTF(("found public key\n"));
611 if ((msgflg & IPC_CREAT) && (msgflg & IPC_EXCL)) {
612 MSG_PRINTF(("not exclusive\n"));
613 error = EEXIST;
614 goto unlock;
615 }
616 if ((error = ipcperm(cred, &msqptr->msg_perm,
617 msgflg & 0700 ))) {
618 MSG_PRINTF(("requester doesn't have 0%o access\n",
619 msgflg & 0700));
620 goto unlock;
621 }
622 goto found;
623 }
624 }
625
626 MSG_PRINTF(("need to allocate the msqid_ds\n"));
627 if (key == IPC_PRIVATE || (msgflg & IPC_CREAT)) {
628 for (msqid = 0; msqid < msginfo.msgmni; msqid++) {
629 /*
630 * Look for an unallocated and unlocked msqid_ds.
631 * msqid_ds's can be locked by msgsnd or msgrcv while
632 * they are copying the message in/out. We can't
633 * re-use the entry until they release it.
634 */
635 msq = &msqs[msqid];
636 msqptr = &msq->msq_u;
637 if (msqptr->msg_qbytes == 0 &&
638 (msqptr->msg_perm.mode & MSG_LOCKED) == 0)
639 break;
640 }
641 if (msqid == msginfo.msgmni) {
642 MSG_PRINTF(("no more msqid_ds's available\n"));
643 error = ENOSPC;
644 goto unlock;
645 }
646 MSG_PRINTF(("msqid %d is available\n", msqid));
647 msqptr->msg_perm._key = key;
648 msqptr->msg_perm.cuid = kauth_cred_geteuid(cred);
649 msqptr->msg_perm.uid = kauth_cred_geteuid(cred);
650 msqptr->msg_perm.cgid = kauth_cred_getegid(cred);
651 msqptr->msg_perm.gid = kauth_cred_getegid(cred);
652 msqptr->msg_perm.mode = (msgflg & 0777);
653 /* Make sure that the returned msqid is unique */
654 msqptr->msg_perm._seq++;
655 msqptr->_msg_first = NULL;
656 msqptr->_msg_last = NULL;
657 msqptr->_msg_cbytes = 0;
658 msqptr->msg_qnum = 0;
659 msqptr->msg_qbytes = msginfo.msgmnb;
660 msqptr->msg_lspid = 0;
661 msqptr->msg_lrpid = 0;
662 msqptr->msg_stime = 0;
663 msqptr->msg_rtime = 0;
664 msqptr->msg_ctime = time_second;
665 } else {
666 MSG_PRINTF(("didn't find it and wasn't asked to create it\n"));
667 error = ENOENT;
668 goto unlock;
669 }
670
671found:
672 /* Construct the unique msqid */
673 *retval = IXSEQ_TO_IPCID(msqid, msqptr->msg_perm);
674
675unlock:
676 mutex_exit(&msgmutex);
677 return (error);
678}
679
680int
681sys_msgsnd(struct lwp *l, const struct sys_msgsnd_args *uap, register_t *retval)
682{
683 /* {
684 syscallarg(int) msqid;
685 syscallarg(const void *) msgp;
686 syscallarg(size_t) msgsz;
687 syscallarg(int) msgflg;
688 } */
689
690 return msgsnd1(l, SCARG(uap, msqid), SCARG(uap, msgp),
691 SCARG(uap, msgsz), SCARG(uap, msgflg), sizeof(long), copyin);
692}
693
694int
695msgsnd1(struct lwp *l, int msqidr, const char *user_msgp, size_t msgsz,
696 int msgflg, size_t typesz, copyin_t fetch_type)
697{
698 int segs_needed, error = 0, msqid;
699 kauth_cred_t cred = l->l_cred;
700 struct msqid_ds *msqptr;
701 struct __msg *msghdr;
702 kmsq_t *msq;
703 short next;
704
705 MSG_PRINTF(("call to msgsnd(%d, %p, %lld, %d)\n", msqidr,
706 user_msgp, (long long)msgsz, msgflg));
707
708 if ((ssize_t)msgsz < 0)
709 return EINVAL;
710
711restart:
712 msqid = IPCID_TO_IX(msqidr);
713
714 mutex_enter(&msgmutex);
715 /* In case of reallocation, we will wait for completion */
716 while (__predict_false(msg_realloc_state))
717 cv_wait(&msg_realloc_cv, &msgmutex);
718
719 if (msqid < 0 || msqid >= msginfo.msgmni) {
720 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
721 msginfo.msgmni));
722 error = EINVAL;
723 goto unlock;
724 }
725
726 msq = &msqs[msqid];
727 msqptr = &msq->msq_u;
728
729 if (msqptr->msg_qbytes == 0) {
730 MSG_PRINTF(("no such message queue id\n"));
731 error = EINVAL;
732 goto unlock;
733 }
734 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) {
735 MSG_PRINTF(("wrong sequence number\n"));
736 error = EINVAL;
737 goto unlock;
738 }
739
740 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_W))) {
741 MSG_PRINTF(("requester doesn't have write access\n"));
742 goto unlock;
743 }
744
745 segs_needed = (msgsz + msginfo.msgssz - 1) / msginfo.msgssz;
746 MSG_PRINTF(("msgsz=%lld, msgssz=%d, segs_needed=%d\n",
747 (long long)msgsz, msginfo.msgssz, segs_needed));
748 for (;;) {
749 int need_more_resources = 0;
750
751 /*
752 * check msgsz [cannot be negative since it is unsigned]
753 * (inside this loop in case msg_qbytes changes while we sleep)
754 */
755
756 if (msgsz > msqptr->msg_qbytes) {
757 MSG_PRINTF(("msgsz > msqptr->msg_qbytes\n"));
758 error = EINVAL;
759 goto unlock;
760 }
761
762 if (msqptr->msg_perm.mode & MSG_LOCKED) {
763 MSG_PRINTF(("msqid is locked\n"));
764 need_more_resources = 1;
765 }
766 if (msgsz + msqptr->_msg_cbytes > msqptr->msg_qbytes) {
767 MSG_PRINTF(("msgsz + msg_cbytes > msg_qbytes\n"));
768 need_more_resources = 1;
769 }
770 if (segs_needed > nfree_msgmaps) {
771 MSG_PRINTF(("segs_needed > nfree_msgmaps\n"));
772 need_more_resources = 1;
773 }
774 if (free_msghdrs == NULL) {
775 MSG_PRINTF(("no more msghdrs\n"));
776 need_more_resources = 1;
777 }
778
779 if (need_more_resources) {
780 int we_own_it;
781
782 if ((msgflg & IPC_NOWAIT) != 0) {
783 MSG_PRINTF(("need more resources but caller "
784 "doesn't want to wait\n"));
785 error = EAGAIN;
786 goto unlock;
787 }
788
789 if ((msqptr->msg_perm.mode & MSG_LOCKED) != 0) {
790 MSG_PRINTF(("we don't own the msqid_ds\n"));
791 we_own_it = 0;
792 } else {
793 /* Force later arrivals to wait for our
794 request */
795 MSG_PRINTF(("we own the msqid_ds\n"));
796 msqptr->msg_perm.mode |= MSG_LOCKED;
797 we_own_it = 1;
798 }
799
800 msg_waiters++;
801 MSG_PRINTF(("goodnight\n"));
802 error = cv_wait_sig(&msq->msq_cv, &msgmutex);
803 MSG_PRINTF(("good morning, error=%d\n", error));
804 msg_waiters--;
805
806 if (we_own_it)
807 msqptr->msg_perm.mode &= ~MSG_LOCKED;
808
809 /*
810 * In case of such state, notify reallocator and
811 * restart the call.
812 */
813 if (msg_realloc_state) {
814 cv_broadcast(&msg_realloc_cv);
815 mutex_exit(&msgmutex);
816 goto restart;
817 }
818
819 if (error != 0) {
820 MSG_PRINTF(("msgsnd: interrupted system "
821 "call\n"));
822 error = EINTR;
823 goto unlock;
824 }
825
826 /*
827 * Make sure that the msq queue still exists
828 */
829
830 if (msqptr->msg_qbytes == 0) {
831 MSG_PRINTF(("msqid deleted\n"));
832 error = EIDRM;
833 goto unlock;
834 }
835 } else {
836 MSG_PRINTF(("got all the resources that we need\n"));
837 break;
838 }
839 }
840
841 /*
842 * We have the resources that we need.
843 * Make sure!
844 */
845
846 KASSERT((msqptr->msg_perm.mode & MSG_LOCKED) == 0);
847 KASSERT(segs_needed <= nfree_msgmaps);
848 KASSERT(msgsz + msqptr->_msg_cbytes <= msqptr->msg_qbytes);
849 KASSERT(free_msghdrs != NULL);
850
851 /*
852 * Re-lock the msqid_ds in case we page-fault when copying in the
853 * message
854 */
855
856 KASSERT((msqptr->msg_perm.mode & MSG_LOCKED) == 0);
857 msqptr->msg_perm.mode |= MSG_LOCKED;
858
859 /*
860 * Allocate a message header
861 */
862
863 msghdr = free_msghdrs;
864 free_msghdrs = msghdr->msg_next;
865 msghdr->msg_spot = -1;
866 msghdr->msg_ts = msgsz;
867
868 /*
869 * Allocate space for the message
870 */
871
872 while (segs_needed > 0) {
873 KASSERT(nfree_msgmaps > 0);
874 KASSERT(free_msgmaps != -1);
875 KASSERT(free_msgmaps < msginfo.msgseg);
876
877 next = free_msgmaps;
878 MSG_PRINTF(("allocating segment %d to message\n", next));
879 free_msgmaps = msgmaps[next].next;
880 nfree_msgmaps--;
881 msgmaps[next].next = msghdr->msg_spot;
882 msghdr->msg_spot = next;
883 segs_needed--;
884 }
885
886 /*
887 * Copy in the message type
888 */
889 mutex_exit(&msgmutex);
890 error = (*fetch_type)(user_msgp, &msghdr->msg_type, typesz);
891 mutex_enter(&msgmutex);
892 if (error != 0) {
893 MSG_PRINTF(("error %d copying the message type\n", error));
894 msg_freehdr(msghdr);
895 msqptr->msg_perm.mode &= ~MSG_LOCKED;
896 cv_broadcast(&msq->msq_cv);
897 goto unlock;
898 }
899 user_msgp += typesz;
900
901 /*
902 * Validate the message type
903 */
904
905 if (msghdr->msg_type < 1) {
906 msg_freehdr(msghdr);
907 msqptr->msg_perm.mode &= ~MSG_LOCKED;
908 cv_broadcast(&msq->msq_cv);
909 MSG_PRINTF(("mtype (%ld) < 1\n", msghdr->msg_type));
910 error = EINVAL;
911 goto unlock;
912 }
913
914 /*
915 * Copy in the message body
916 */
917
918 next = msghdr->msg_spot;
919 while (msgsz > 0) {
920 size_t tlen;
921 KASSERT(next > -1);
922 KASSERT(next < msginfo.msgseg);
923
924 if (msgsz > msginfo.msgssz)
925 tlen = msginfo.msgssz;
926 else
927 tlen = msgsz;
928 mutex_exit(&msgmutex);
929 error = copyin(user_msgp, &msgpool[next * msginfo.msgssz], tlen);
930 mutex_enter(&msgmutex);
931 if (error != 0) {
932 MSG_PRINTF(("error %d copying in message segment\n",
933 error));
934 msg_freehdr(msghdr);
935 msqptr->msg_perm.mode &= ~MSG_LOCKED;
936 cv_broadcast(&msq->msq_cv);
937 goto unlock;
938 }
939 msgsz -= tlen;
940 user_msgp += tlen;
941 next = msgmaps[next].next;
942 }
943 KASSERT(next == -1);
944
945 /*
946 * We've got the message. Unlock the msqid_ds.
947 */
948
949 msqptr->msg_perm.mode &= ~MSG_LOCKED;
950
951 /*
952 * Make sure that the msqid_ds is still allocated.
953 */
954
955 if (msqptr->msg_qbytes == 0) {
956 msg_freehdr(msghdr);
957 cv_broadcast(&msq->msq_cv);
958 error = EIDRM;
959 goto unlock;
960 }
961
962 /*
963 * Put the message into the queue
964 */
965
966 if (msqptr->_msg_first == NULL) {
967 msqptr->_msg_first = msghdr;
968 msqptr->_msg_last = msghdr;
969 } else {
970 msqptr->_msg_last->msg_next = msghdr;
971 msqptr->_msg_last = msghdr;
972 }
973 msqptr->_msg_last->msg_next = NULL;
974
975 msqptr->_msg_cbytes += msghdr->msg_ts;
976 msqptr->msg_qnum++;
977 msqptr->msg_lspid = l->l_proc->p_pid;
978 msqptr->msg_stime = time_second;
979
980 cv_broadcast(&msq->msq_cv);
981
982unlock:
983 mutex_exit(&msgmutex);
984 return error;
985}
986
987int
988sys_msgrcv(struct lwp *l, const struct sys_msgrcv_args *uap, register_t *retval)
989{
990 /* {
991 syscallarg(int) msqid;
992 syscallarg(void *) msgp;
993 syscallarg(size_t) msgsz;
994 syscallarg(long) msgtyp;
995 syscallarg(int) msgflg;
996 } */
997
998 return msgrcv1(l, SCARG(uap, msqid), SCARG(uap, msgp),
999 SCARG(uap, msgsz), SCARG(uap, msgtyp), SCARG(uap, msgflg),
1000 sizeof(long), copyout, retval);
1001}
1002
1003int
1004msgrcv1(struct lwp *l, int msqidr, char *user_msgp, size_t msgsz, long msgtyp,
1005 int msgflg, size_t typesz, copyout_t put_type, register_t *retval)
1006{
1007 size_t len;
1008 kauth_cred_t cred = l->l_cred;
1009 struct msqid_ds *msqptr;
1010 struct __msg *msghdr;
1011 int error = 0, msqid;
1012 kmsq_t *msq;
1013 short next;
1014
1015 MSG_PRINTF(("call to msgrcv(%d, %p, %lld, %ld, %d)\n", msqidr,
1016 user_msgp, (long long)msgsz, msgtyp, msgflg));
1017
1018 if ((ssize_t)msgsz < 0)
1019 return EINVAL;
1020
1021restart:
1022 msqid = IPCID_TO_IX(msqidr);
1023
1024 mutex_enter(&msgmutex);
1025 /* In case of reallocation, we will wait for completion */
1026 while (__predict_false(msg_realloc_state))
1027 cv_wait(&msg_realloc_cv, &msgmutex);
1028
1029 if (msqid < 0 || msqid >= msginfo.msgmni) {
1030 MSG_PRINTF(("msqid (%d) out of range (0<=msqid<%d)\n", msqid,
1031 msginfo.msgmni));
1032 error = EINVAL;
1033 goto unlock;
1034 }
1035
1036 msq = &msqs[msqid];
1037 msqptr = &msq->msq_u;
1038
1039 if (msqptr->msg_qbytes == 0) {
1040 MSG_PRINTF(("no such message queue id\n"));
1041 error = EINVAL;
1042 goto unlock;
1043 }
1044 if (msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) {
1045 MSG_PRINTF(("wrong sequence number\n"));
1046 error = EINVAL;
1047 goto unlock;
1048 }
1049
1050 if ((error = ipcperm(cred, &msqptr->msg_perm, IPC_R))) {
1051 MSG_PRINTF(("requester doesn't have read access\n"));
1052 goto unlock;
1053 }
1054
1055 msghdr = NULL;
1056 while (msghdr == NULL) {
1057 if (msgtyp == 0) {
1058 msghdr = msqptr->_msg_first;
1059 if (msghdr != NULL) {
1060 if (msgsz < msghdr->msg_ts &&
1061 (msgflg & MSG_NOERROR) == 0) {
1062 MSG_PRINTF(("first msg on the queue "
1063 "is too big (want %lld, got %d)\n",
1064 (long long)msgsz, msghdr->msg_ts));
1065 error = E2BIG;
1066 goto unlock;
1067 }
1068 if (msqptr->_msg_first == msqptr->_msg_last) {
1069 msqptr->_msg_first = NULL;
1070 msqptr->_msg_last = NULL;
1071 } else {
1072 msqptr->_msg_first = msghdr->msg_next;
1073 KASSERT(msqptr->_msg_first != NULL);
1074 }
1075 }
1076 } else {
1077 struct __msg *previous;
1078 struct __msg **prev;
1079
1080 for (previous = NULL, prev = &msqptr->_msg_first;
1081 (msghdr = *prev) != NULL;
1082 previous = msghdr, prev = &msghdr->msg_next) {
1083 /*
1084 * Is this message's type an exact match or is
1085 * this message's type less than or equal to
1086 * the absolute value of a negative msgtyp?
1087 * Note that the second half of this test can
1088 * NEVER be true if msgtyp is positive since
1089 * msg_type is always positive!
1090 */
1091
1092 if (msgtyp != msghdr->msg_type &&
1093 msghdr->msg_type > -msgtyp)
1094 continue;
1095
1096 MSG_PRINTF(("found message type %ld, requested %ld\n",
1097 msghdr->msg_type, msgtyp));
1098 if (msgsz < msghdr->msg_ts &&
1099 (msgflg & MSG_NOERROR) == 0) {
1100 MSG_PRINTF(("requested message on the queue "
1101 "is too big (want %lld, got %d)\n",
1102 (long long)msgsz, msghdr->msg_ts));
1103 error = E2BIG;
1104 goto unlock;
1105 }
1106 *prev = msghdr->msg_next;
1107 if (msghdr != msqptr->_msg_last)
1108 break;
1109 if (previous == NULL) {
1110 KASSERT(prev == &msqptr->_msg_first);
1111 msqptr->_msg_first = NULL;
1112 msqptr->_msg_last = NULL;
1113 } else {
1114 KASSERT(prev != &msqptr->_msg_first);
1115 msqptr->_msg_last = previous;
1116 }
1117 break;
1118 }
1119 }
1120
1121 /*
1122 * We've either extracted the msghdr for the appropriate
1123 * message or there isn't one.
1124 * If there is one then bail out of this loop.
1125 */
1126 if (msghdr != NULL)
1127 break;
1128
1129 /*
1130 * Hmph! No message found. Does the user want to wait?
1131 */
1132
1133 if ((msgflg & IPC_NOWAIT) != 0) {
1134 MSG_PRINTF(("no appropriate message found (msgtyp=%ld)\n",
1135 msgtyp));
1136 error = ENOMSG;
1137 goto unlock;
1138 }
1139
1140 /*
1141 * Wait for something to happen
1142 */
1143
1144 msg_waiters++;
1145 MSG_PRINTF(("msgrcv: goodnight\n"));
1146 error = cv_wait_sig(&msq->msq_cv, &msgmutex);
1147 MSG_PRINTF(("msgrcv: good morning (error=%d)\n", error));
1148 msg_waiters--;
1149
1150 /*
1151 * In case of such state, notify reallocator and
1152 * restart the call.
1153 */
1154 if (msg_realloc_state) {
1155 cv_broadcast(&msg_realloc_cv);
1156 mutex_exit(&msgmutex);
1157 goto restart;
1158 }
1159
1160 if (error != 0) {
1161 MSG_PRINTF(("msgsnd: interrupted system call\n"));
1162 error = EINTR;
1163 goto unlock;
1164 }
1165
1166 /*
1167 * Make sure that the msq queue still exists
1168 */
1169
1170 if (msqptr->msg_qbytes == 0 ||
1171 msqptr->msg_perm._seq != IPCID_TO_SEQ(msqidr)) {
1172 MSG_PRINTF(("msqid deleted\n"));
1173 error = EIDRM;
1174 goto unlock;
1175 }
1176 }
1177
1178 /*
1179 * Return the message to the user.
1180 *
1181 * First, do the bookkeeping (before we risk being interrupted).
1182 */
1183
1184 msqptr->_msg_cbytes -= msghdr->msg_ts;
1185 msqptr->msg_qnum--;
1186 msqptr->msg_lrpid = l->l_proc->p_pid;
1187 msqptr->msg_rtime = time_second;
1188
1189 /*
1190 * Make msgsz the actual amount that we'll be returning.
1191 * Note that this effectively truncates the message if it is too long
1192 * (since msgsz is never increased).
1193 */
1194
1195 MSG_PRINTF(("found a message, msgsz=%lld, msg_ts=%d\n",
1196 (long long)msgsz, msghdr->msg_ts));
1197 if (msgsz > msghdr->msg_ts)
1198 msgsz = msghdr->msg_ts;
1199
1200 /*
1201 * Return the type to the user.
1202 */
1203 mutex_exit(&msgmutex);
1204 error = (*put_type)(&msghdr->msg_type, user_msgp, typesz);
1205 mutex_enter(&msgmutex);
1206 if (error != 0) {
1207 MSG_PRINTF(("error (%d) copying out message type\n", error));
1208 msg_freehdr(msghdr);
1209 cv_broadcast(&msq->msq_cv);
1210 goto unlock;
1211 }
1212 user_msgp += typesz;
1213
1214 /*
1215 * Return the segments to the user
1216 */
1217
1218 next = msghdr->msg_spot;
1219 for (len = 0; len < msgsz; len += msginfo.msgssz) {
1220 size_t tlen;
1221 KASSERT(next > -1);
1222 KASSERT(next < msginfo.msgseg);
1223
1224 if (msgsz - len > msginfo.msgssz)
1225 tlen = msginfo.msgssz;
1226 else
1227 tlen = msgsz - len;
1228 mutex_exit(&msgmutex);
1229 error = copyout(&msgpool[next * msginfo.msgssz],
1230 user_msgp, tlen);
1231 mutex_enter(&msgmutex);
1232 if (error != 0) {
1233 MSG_PRINTF(("error (%d) copying out message segment\n",
1234 error));
1235 msg_freehdr(msghdr);
1236 cv_broadcast(&msq->msq_cv);
1237 goto unlock;
1238 }
1239 user_msgp += tlen;
1240 next = msgmaps[next].next;
1241 }
1242
1243 /*
1244 * Done, return the actual number of bytes copied out.
1245 */
1246
1247 msg_freehdr(msghdr);
1248 cv_broadcast(&msq->msq_cv);
1249 *retval = msgsz;
1250
1251unlock:
1252 mutex_exit(&msgmutex);
1253 return error;
1254}
1255
1256/*
1257 * Sysctl initialization and nodes.
1258 */
1259
1260static int
1261sysctl_ipc_msgmni(SYSCTLFN_ARGS)
1262{
1263 int newsize, error;
1264 struct sysctlnode node;
1265 node = *rnode;
1266 node.sysctl_data = &newsize;
1267
1268 newsize = msginfo.msgmni;
1269 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1270 if (error || newp == NULL)
1271 return error;
1272
1273 sysctl_unlock();
1274 error = msgrealloc(newsize, msginfo.msgseg);
1275 sysctl_relock();
1276 return error;
1277}
1278
1279static int
1280sysctl_ipc_msgseg(SYSCTLFN_ARGS)
1281{
1282 int newsize, error;
1283 struct sysctlnode node;
1284 node = *rnode;
1285 node.sysctl_data = &newsize;
1286
1287 newsize = msginfo.msgseg;
1288 error = sysctl_lookup(SYSCTLFN_CALL(&node));
1289 if (error || newp == NULL)
1290 return error;
1291
1292 sysctl_unlock();
1293 error = msgrealloc(msginfo.msgmni, newsize);
1294 sysctl_relock();
1295 return error;
1296}
1297
1298SYSCTL_SETUP(sysctl_ipc_msg_setup, "sysctl kern.ipc subtree setup")
1299{
1300 const struct sysctlnode *node = NULL;
1301
1302 sysctl_createv(clog, 0, NULL, &node,
1303 CTLFLAG_PERMANENT,
1304 CTLTYPE_NODE, "ipc",
1305 SYSCTL_DESCR("SysV IPC options"),
1306 NULL, 0, NULL, 0,
1307 CTL_KERN, KERN_SYSVIPC, CTL_EOL);
1308
1309 if (node == NULL)
1310 return;
1311
1312 sysctl_createv(clog, 0, &node, NULL,
1313 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1314 CTLTYPE_INT, "msgmni",
1315 SYSCTL_DESCR("Max number of message queue identifiers"),
1316 sysctl_ipc_msgmni, 0, &msginfo.msgmni, 0,
1317 CTL_CREATE, CTL_EOL);
1318 sysctl_createv(clog, 0, &node, NULL,
1319 CTLFLAG_PERMANENT | CTLFLAG_READWRITE,
1320 CTLTYPE_INT, "msgseg",
1321 SYSCTL_DESCR("Max number of number of message segments"),
1322 sysctl_ipc_msgseg, 0, &msginfo.msgseg, 0,
1323 CTL_CREATE, CTL_EOL);
1324}
1325